Top Tweets for #scriptlet

about 7 years ago

#interesting #scriptlet (9eadd6ceea2084a0d5abb747ff649b32c4b215b98ded2077f044ec3ed9bc2492) is a #JavaScript based #PasswordStealer: #IE #Firefox #Chrome. Disables Windows prompts for #UAC consent by setting #EnableLUA & #ConsentPromptBehaviorAdmin registry values to 0 VT: 0/55

InQuest's tweet photo. #interesting #scriptlet (9eadd6ceea2084a0d5abb747ff649b32c4b215b98ded2077f044ec3ed9bc2492) is a #JavaScript based #PasswordStealer: #IE #Firefox #Chrome.
Disables Windows prompts for #UAC consent by setting #EnableLUA & #ConsentPromptBehaviorAdmin registry values to 0
VT: 0/55 https://t.co/s4pd4IYq4O

1

38

24

5

0

over 7 years ago

John Snow, King of the North, is trespassing with base64! Not returning to Winterfell afterward, instead heading to hxxp://vemvemserver.duckdns.org:1425 (#c2). Passes info through user-agent as well With 0 detection (VT 0/56) https://t.co/chy8YqKMGs #malware #scriptlet

InQuest's tweet photo. John Snow, King of the North, is trespassing with base64! Not returning to Winterfell afterward, instead heading to hxxp://vemvemserver.duckdns.org:1425 (#c2). Passes info through user-agent as well

With 0 detection (VT 0/56)

https://t.co/chy8YqKMGs

#malware #scriptlet https://t.co/6zHWYCfQwl

0

43

15

0

over 7 years ago

What's this #PowerShell command in this #scriptlet? JScript has syntax error (unmatched double quotation?) The server is live and I could see SMB traffic

DissectMalware's tweet photo. What's this #PowerShell command in this #scriptlet?
JScript has syntax error (unmatched double quotation?)

The server is live and I could see SMB traffic https://t.co/zYvCyE5Cl5

4

35

14

1

0

over 7 years ago

I was exploring VT and found a nice PoC by @subTee: var scr = new ActiveXObject("MSScriptControl.ScriptControl"); scr.Language = "JScript"; scr.ExecuteStatement('[JScript Code]'); scr.Eval('[JScript Code]'); #redteam #scriptlet #sct file: https://t.co/V5HaQCKmZc

DissectMalware's tweet photo. I was exploring VT and found a nice PoC by @subTee:

var scr = new ActiveXObject("MSScriptControl.ScriptControl");
scr.Language = "JScript";
scr.ExecuteStatement('[JScript Code]');
scr.Eval('[JScript Code]');

#redteam #scriptlet
#sct file: https://t.co/V5HaQCKmZc https://t.co/VVa1XKykPn

1

51

32

3

0

over 7 years ago

@ItsReallyNick @NickTyrer @Oddvarmoe @KyleHanslovan It is used by a maldoc that drops @GandCrab instead of using a local path it uses a url to a #scriptlet https://t.co/yyVexdBhRW

over 7 years ago

Interesting #malicious #doc (low detection #VT 6/58) > VBA is triggered by img #GotFocus event> dump #ini (has UnRegisterOCXs)> cmstp ini_file (to dl #scriptlet)> #obfuscated #JavaScript>#PE (#GandCrab) /companyreviews.serveftp.com/SEAxV5lx_1.txt https://t.co/pGpr8rIlou

InQuest's tweet photo. Interesting #malicious #doc (low detection #VT 6/58) > VBA is triggered by img #GotFocus event> dump #ini (has UnRegisterOCXs)> cmstp ini_file (to dl #scriptlet)> #obfuscated #JavaScript>#PE (#GandCrab)

/companyreviews.serveftp.com/SEAxV5lx_1.txt

https://t.co/pGpr8rIlou https://t.co/xcG2tNCYX9

3

19

9

3

0

1

4

1

0

over 7 years ago

Interesting #malicious #doc (low detection #VT 6/58) > VBA is triggered by img #GotFocus event> dump #ini (has UnRegisterOCXs)> cmstp ini_file (to dl #scriptlet)> #obfuscated #JavaScript>#PE (#GandCrab) /companyreviews.serveftp.com/SEAxV5lx_1.txt https://t.co/pGpr8rIlou

3

19

9

3

0

over 8 years ago

Interesting #malicious #rtf -> 1 #scriptlet, 2 #bat files, 1 #PE iNteldriVerupd1.sCt -> task.#bat -> 2nd.#bat: uses #odbcconf (/S /A {REGSVR "%TMp%\DlL.DlL") to run embedded #PE (#lolbin) and #bitsadmin to dl another #PE (/94.250.248.105/task.bat)

$DissectMalware's tweet photo. Interesting #malicious #rtf -> 1 #scriptlet, 2 #bat files, 1 #PE iNteldriVerupd1.sCt -> task.#bat -> 2nd.#bat: uses #odbcconf (/S /A {REGSVR "%TMp%\DlL.DlL") to run embedded #PE (#lolbin) and #bitsadmin to dl another #PE (/94.250.248.105/task.bat) https://t.co/JSd1ngU8Bf$

1

38

17

2

0

over 8 years ago

#scriptlet hxxp://down.cacheoffer.tk/d2/reg9.sct #PE hxxp://down.cacheoffer.tk/d2/gd32.txt https://t.co/XEmKhs2e1h

0

2

1

0

over 8 years ago

#VBScript (hxxp://down.cacheoffer.tk/d2/sp.txt) execs #PE (hxxps://down.cacheoffer.tk/d2/core.txt) Same host: #scriptlet (hxxp://down.cacheoffer.tk/d2/ps5.sct) -> double encoded #base64 #powershell -> injects #shellcode hxxp://down.cacheoffer.tk/d2/reg99.sct decoder py #oneliner

DissectMalware's tweet photo. #VBScript (hxxp://down.cacheoffer.tk/d2/sp.txt) execs #PE (hxxps://down.cacheoffer.tk/d2/core.txt)
Same host:
#scriptlet (hxxp://down.cacheoffer.tk/d2/ps5.sct) -> double encoded #base64 #powershell -> injects #shellcode
hxxp://down.cacheoffer.tk/d2/reg99.sct
decoder py #oneliner https://t.co/rLge8RwuZp

5

24

17

2

0

over 8 years ago

#malicous #doc utilizes #cmstp commands -> dls #scriptlet (#JScript) -> the #JScript contains a #PE (undetected by AVs), and a #doc (clean). heavily #obfuscated #doc: https://t.co/0DI3Fsm4x4 #scriptlet: hxxp://cloud.pallets32.com/m1.txt #PE: https://t.co/HwYxdUJOzb

DissectMalware's tweet photo. #malicous #doc utilizes #cmstp commands -> dls #scriptlet (#JScript) -> the #JScript contains a #PE (undetected by AVs), and a #doc (clean). heavily #obfuscated
#doc: https://t.co/0DI3Fsm4x4
#scriptlet: hxxp://cloud.pallets32.com/m1.txt
#PE: https://t.co/HwYxdUJOzb https://t.co/0Fd8ubN4Ur

5

37

16

2

0

over 8 years ago

#powershell pieces: https://t.co/OhwCdoVuZp #scriptlet: https://t.co/4ZgKpGZR2k

0

1

0

over 8 years ago

Is sb making a new #multistage #malware, uploading on hybrid-analysis!? 2nd gen: https://t.co/UWHs3DQof5 Installs a #js #scriptlet as a service -> runs #NET (generated with #DotNetToJScript (demo app, not malicious). See 1st gen: https://t.co/or9vDIA6t6

DissectMalware's tweet photo. Is sb making a new #multistage #malware, uploading on hybrid-analysis!?
2nd gen: https://t.co/UWHs3DQof5
Installs a #js #scriptlet as a service -> runs #NET (generated with #DotNetToJScript (demo app, not malicious).
See 1st gen: https://t.co/or9vDIA6t6 https://t.co/xYy0HPejRk