Top Tweets for #Scriptlet
Awesome new idea: I get a #Python #Minecraft mod up and running again. And support @goatchurch #scriptlet concept in there. Then we can instrument #ESP32s and #Microbits and any other #MQtt enabled sensors to publish scriptlet payloads to represent their data in the digital twin!
#interesting #scriptlet (9eadd6ceea2084a0d5abb747ff649b32c4b215b98ded2077f044ec3ed9bc2492) is a #JavaScript based #PasswordStealer: #IE #Firefox #Chrome.
Disables Windows prompts for #UAC consent by setting #EnableLUA & #ConsentPromptBehaviorAdmin registry values to 0
VT: 0/55
John Snow, King of the North, is trespassing with base64! Not returning to Winterfell afterward, instead heading to hxxp://vemvemserver.duckdns.org:1425 (#c2). Passes info through user-agent as well
With 0 detection (VT 0/56)
https://t.co/chy8YqKMGs
#malware #scriptlet
What's this #PowerShell command in this #scriptlet?
JScript has syntax error (unmatched double quotation?)
The server is live and I could see SMB traffic
I was exploring VT and found a nice PoC by @subTee:
var scr = new ActiveXObject("MSScriptControl.ScriptControl");
scr.Language = "JScript";
scr.ExecuteStatement('[JScript Code]');
scr.Eval('[JScript Code]');
#redteam #scriptlet
#sct file: https://t.co/V5HaQCKmZc
![DissectMalware's tweet photo. I was exploring VT and found a nice PoC by @subTee:
var scr = new ActiveXObject("MSScriptControl.ScriptControl");
scr.Language = "JScript";
scr.ExecuteStatement('[JScript Code]');
scr.Eval('[JScript Code]');
#redteam #scriptlet
#sct file: https://t.co/V5HaQCKmZc https://t.co/VVa1XKykPn](https://pbs.twimg.com/media/DzmCRHpWwAAbCeB.png)
@ItsReallyNick @NickTyrer @Oddvarmoe @KyleHanslovan It is used by a maldoc that drops @GandCrab
instead of using a local path it uses a url to a #scriptlet
https://t.co/yyVexdBhRW
Interesting #malicious #doc (low detection #VT 6/58) > VBA is triggered by img #GotFocus event> dump #ini (has UnRegisterOCXs)> cmstp ini_file (to dl #scriptlet)> #obfuscated #JavaScript>#PE (#GandCrab)
/companyreviews.serveftp.com/SEAxV5lx_1.txt
https://t.co/pGpr8rIlou
Interesting #malicious #doc (low detection #VT 6/58) > VBA is triggered by img #GotFocus event> dump #ini (has UnRegisterOCXs)> cmstp ini_file (to dl #scriptlet)> #obfuscated #JavaScript>#PE (#GandCrab)
/companyreviews.serveftp.com/SEAxV5lx_1.txt
https://t.co/pGpr8rIlou
Interesting #malicious #rtf -> 1 #scriptlet, 2 #bat files, 1 #PE
iNteldriVerupd1.sCt -> task.#bat -> 2nd.#bat: uses #odbcconf (/S /A {REGSVR "%TMp%\DlL.DlL") to run embedded #PE (#lolbin) and #bitsadmin to dl another #PE (/94.250.248.105/task.bat)
#scriptlet hxxp://down.cacheoffer.tk/d2/reg9.sct
#PE hxxp://down.cacheoffer.tk/d2/gd32.txt
https://t.co/XEmKhs2e1h
#VBScript (hxxp://down.cacheoffer.tk/d2/sp.txt) execs #PE (hxxps://down.cacheoffer.tk/d2/core.txt)
Same host:
#scriptlet (hxxp://down.cacheoffer.tk/d2/ps5.sct) -> double encoded #base64 #powershell -> injects #shellcode
hxxp://down.cacheoffer.tk/d2/reg99.sct
decoder py #oneliner
#malicous #doc utilizes #cmstp commands -> dls #scriptlet (#JScript) -> the #JScript contains a #PE (undetected by AVs), and a #doc (clean). heavily #obfuscated
#doc: https://t.co/0DI3Fsm4x4
#scriptlet: hxxp://cloud.pallets32.com/m1.txt
#PE: https://t.co/HwYxdUJOzb
Is sb making a new #multistage #malware, uploading on hybrid-analysis!?
2nd gen: https://t.co/UWHs3DQof5
Installs a #js #scriptlet as a service -> runs #NET (generated with #DotNetToJScript (demo app, not malicious).
See 1st gen: https://t.co/or9vDIA6t6
#JS script executes #NET (#js code is generated with #DotNetToJScript tool developed by @tiraniddo) - I decompiled the embedded serialized .NET object with #ILSpy.
Seems is a practice but was also good for me.
https://t.co/f1spPSGdLL
cool stuff: #scriptlet file execution in the CHM files; previously seen in XLSX and PPSX files https://t.co/W2VSD23XGw
An Inside Look at CVE-2017-0199 β #HTA and #Scriptlet File Handler #Vulnerability * Fortinet Blog https://t.co/BRMyFOAWWO
Last Seen Hashtags on Sotwe
public
Seen from Italy
ΓΔ±tΔ±r
Seen from Netherlands
momsonn
Seen from United States
anxiouspanda
Seen from Brazil
broppykids
Seen from Mexico
snapchat
Seen from United Kingdom
minichat()()()()*+filter:videos
Seen from Brazil
ΰΉΰΈ₯ΰΈΰΉΰΈͺΰΈΰΉΰΈΰΈ§ΰΉΰΈͺΰΈ²ΰΈ§
Seen from Thailand
ΰΈΰΈ±ΰΈΰΉΰΈ’ΰΈͺΰΉΰΈΰΈ£ΰΈΰΉΰΈΰΈ’
Seen from Thailand
ε£ζ°΄ζ
Seen from Japan
Most Popular Users
Elon Musk 
@elonmusk
241.8M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
114.6M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90.1M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.5M followers
Bill Gates
@billgates
65.3M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers