#JScript - Twitter Hashtag

8 months ago

J'ai fait ça ... - Ca bouge avec la position de la souris - Et sinon il y a aussi un mode autonome ... - Ca n'est pas fait pour mobile #html #canvans #jscript #demo #checkernoard #krakoukass >>> https://t.co/nIccWzn79N

pakal_org's tweet photo. J'ai fait ça ...

- Ca bouge avec la position de la souris
- Et sinon il y a aussi un mode autonome ...
- Ca n'est pas fait pour mobile

#html #canvans #jscript #demo #checkernoard #krakoukass

>>> https://t.co/nIccWzn79N https://t.co/eyN0kv7MR2

0

2

0

29

P4nd3m1cb0y

@P4nd3m1cb0y

10 months ago

[2/4] By tapping into AMSI + ETW, you can observe deobfuscated script content as it executes, without fighting layers of junk #code. This changes how fast you can analyze phishing loaders, #PowerShell droppers, and #JScript #malware.

1

4

0

2

226

Karsten Hahn @struppigel

over 1 year ago

🦔 📹 New Video: Binary Refinery deobfuscation of a LummaStealer loader (PowerShell, JScript) https://t.co/shZuhRBe0e #MalwareAnalysisForHedgehogs #PowerShell #JScript

3

101

40

37

9K

VMRay

@vmray

almost 2 years ago

🚨 #Alert: Multi-stage payload reflectively loads backdoored TaskScheduler.dll https://t.co/PhXIt7H35l 🔍 A #JScript file with low detection rates on VT retrieves additional payloads via the Pastebin alternative "https://t.co/TZAeEurmTu" and a JPG file hosted on Google Drive. The image embeds a #backdoored version of the .NET TaskScheduler library, which is loaded reflectively and used to download and execute the final #AsyncRAT/#DCRat payload 🐀 🧵(1/3)

vmray's tweet photo. 🚨 #Alert: Multi-stage payload reflectively loads backdoored TaskScheduler.dll
https://t.co/PhXIt7H35l

🔍 A #JScript file with low detection rates on VT retrieves additional payloads via the Pastebin alternative "https://t.co/TZAeEurmTu" and a JPG file hosted on Google Drive. The image embeds a #backdoored version of the .NET TaskScheduler library, which is loaded reflectively and used to download and execute the final #AsyncRAT/#DCRat payload 🐀

🧵(1/3)

2

84

32

33

8K

Anonymous🐾🐈‍⬛ @YourAnonRiots

over 2 years ago

Researchers have uncovered a multi-stage attack involving infected sites, #fake Chrome updates, and a #JScript downloader to deploy the BadSpace #malware. https://t.co/eLqEUhf28F #cybersecurity

0

3

1

459

Anna @Loeweanva

over 2 years ago

#BadSpace #WarmCookie #Backdoor #GData #JScript #SocGholish https://t.co/DkDyZE3GAQ

0

5

1

0

291

Gootloader @Gootloader

over 2 years ago

Wish this was happening sooner, but looks like disabling #VBScript prevents #Gootloader from running (even though it is coded in #JScript .js) https://t.co/e71udQUVHY

Gootloader's tweet photo. Wish this was happening sooner, but looks like disabling #VBScript prevents #Gootloader from running (even though it is coded in #JScript .js) https://t.co/e71udQUVHY https://t.co/ujtr5v54Fi

1

6

0

1

317

Mohd Sameer @MohdSameer200

over 2 years ago

Day 100 of #100dayofcode of #backend Learning: (Next.js) 1. Creating Navigation menu in next.js 2. Using and understanding Aceternity UI #100daysofcodechallenge #react #nodejs #jscript #javascript #chaiaurcode #hiteshchoudhary

MohdSameer200's tweet photo. Day 100 of #100dayofcode of #backend
Learning: (Next.js)
1. Creating Navigation menu in next.js
2. Using and understanding Aceternity UI
#100daysofcodechallenge #react #nodejs #jscript #javascript #chaiaurcode #hiteshchoudhary https://t.co/xHxuqodxc2

1

4

0

96

ANY.RUN

@anyrun_app

almost 3 years ago

📌Intriguing #AsyncRAT's execution chain with #NodeJS #Phishing -> user execution of WSF script -> #VBScript -> Fake Jpg Using bitsAdmin -> ZIP download -> #JScript -> BAT -> downloaded Node.exe and created app.js scheduled task -> run.js -> powershell.exe -> aspnet_compiler.exe -> AsyncRAT ⚙️The file app.js is employed in a scheduled task to execute another script, run.js, which, in turn, initiates the main AsyncRAT payload using PowerShell. ⚙️The obfuscated #PowerShell command executes two payloads contained in msg.dll and runpe.dll. These files are .txt files with a .dll extension. ⚙️The runpe.dll is used to inject msg.dll in the aspnet_compiler.exe process. msg.dll is a main payload containing AsyncRAT. ⚙️open.js is used to run get.js, here get.js: 1️⃣ retrieves the external IP address for an FTP connection 2️⃣ gathers information from the browsers (Chrome and Edge), 3️⃣ uploads it to an FTP server 4️⃣ executes a PowerShell script ⚙️The PowerShell script reads and executes code from specific files to steal personal data. Various functions handle file manipulation (reading and archiving data) and directory cleanup (deleting files). Check the sample ↘️ https://t.co/1gWycxhqK6 Check CyberChef recipe and IOC below ↘️

anyrun_app's tweet photo. 📌Intriguing #AsyncRAT's execution chain with #NodeJS

#Phishing -> user execution of WSF script -> #VBScript -> Fake Jpg Using bitsAdmin -> ZIP download -> #JScript -> BAT -> downloaded Node.exe and created app.js scheduled task -> run.js -> powershell.exe -> aspnet_compiler.exe -> AsyncRAT

⚙️The file app.js is employed in a scheduled task to execute another script, run.js, which, in turn, initiates the main AsyncRAT payload using PowerShell.

⚙️The obfuscated #PowerShell command executes two payloads contained in msg.dll and runpe.dll. These files are .txt files with a .dll extension.

⚙️The runpe.dll is used to inject msg.dll in the aspnet_compiler.exe process.
msg.dll is a main payload containing AsyncRAT.

⚙️open.js is used to run get.js, here get.js:
1️⃣ retrieves the external IP address for an FTP connection
2️⃣ gathers information from the browsers (Chrome and Edge),
3️⃣ uploads it to an FTP server
4️⃣ executes a PowerShell script

⚙️The PowerShell script reads and executes code from specific files to steal personal data. Various functions handle file manipulation (reading and archiving data) and directory cleanup (deleting files).

Check the sample ↘️
https://t.co/1gWycxhqK6

Check CyberChef recipe and IOC below ↘️

3

56

18

21

6K

Karsten Hahn @struppigel

almost 3 years ago

New Video: Deobfuscation of JScript malware like GootLoader using 3 methods 🦔 ➡️ regex ➡️ AST manipulation ➡️ dynamic deobfuscation #GootLoader #MalwareAnalysisForHedgehogs #AST #JScript https://t.co/xeD8qyWy4h

2

169

67

73

17K