Posts with #scriptlet

#scriptlet

Public posts on X that use #scriptlet.

Related hashtags

Malwrologist✓@DissectMalware9y
#VBScript (hxxp://down.cacheoffer.tk/d2/sp.txt) execs #PE (hxxps://down.cacheoffer.tk/d2/core.txt) Same host: #scriptlet (hxxp://down.cacheoffer.tk/d2/ps5.sct) -> double encoded #base64 #powershell -> injects #shellcode hxxp://down.cacheoffer.tk/d2/reg99.sct decoder py #oneliner
Download
Share
Copied
51724
Nick Carr✓@ItsReallyNick9y
@ItsReallyNick
Same VT uploader: "DefenderService.inf" for loading this #DailyScriptlet ––– [UnRegisterOCXSection] %11%\scrobj.dll,NI,c:/programdata/Defender.sct ––– CMSTP.exe AppLocker bypass publicized by @NickTyrer, @Oddvarmoe, & @KyleHanslovan:
Download
Share
Copied
Nick Tyrer @NickTyrer
CMSTP.exe - remote .sct execution applocker bypass. Built on research by @Oddvarmoe - & @KyleHanslovan - & @subTee Files Used:
2719
Nick Tyrer@NickTyrer9y
CMSTP.exe - remote .sct execution applocker bypass. Built on research by @Oddvarmoe - & @KyleHanslovan - & @subTee Files Used:
Download
Share
Copied
8233350
Malwrologist✓@DissectMalware8y
@ItsReallyNick
@ItsReallyNick @NickTyrer @Oddvarmoe @KyleHanslovan It is used by a maldoc that drops @GandCrab instead of using a local path it uses a url to a #scriptlet
Share
Copied
InQuest @InQuest
Interesting #malicious #doc (low detection #VT 6/58) > VBA is triggered by img #GotFocus event> dump #ini (has UnRegisterOCXs)> cmstp ini_file (to dl #scriptlet)> #obfuscated #JavaScript>#PE (#GandCrab) /companyreviews.serveftp.com/SEAxV5lx_1.txt
114
InQuest@InQuest8y
Interesting #malicious #doc (low detection #VT 6/58) > VBA is triggered by img #GotFocus event> dump #ini (has UnRegisterOCXs)> cmstp ini_file (to dl #scriptlet)> #obfuscated #JavaScript>#PE (#GandCrab) /companyreviews.serveftp.com/SEAxV5lx_1.txt
Download
Share
Copied
3919
Malwrologist✓@DissectMalware7y
What's this #PowerShell command in this #scriptlet? JScript has syntax error (unmatched double quotation?) The server is live and I could see SMB traffic
Download
Share
Copied
41435
Malwrologist✓@DissectMalware8y
I was exploring VT and found a nice PoC by @subTee: var scr = new ActiveXObject("MSScriptControl.ScriptControl"); scr.Language = "JScript"; scr.ExecuteStatement('[JScript Code]'); scr.Eval('[JScript Code]'); #redteam #scriptlet #sct file:
Download
Share
Copied
13251
Alexander Sevtsov@alexsevtsov9y
cool stuff: #scriptlet file execution in the CHM files; previously seen in XLSX and PPSX files
Download
Share
Copied
001
Malwrologist✓@DissectMalware8y
Interesting #malicious #rtf -> 1 #scriptlet, 2 #bat files, 1 #PE iNteldriVerupd1.sCt -> task.#bat -> 2nd.#bat: uses #odbcconf (/S /A {REGSVR "%TMp%\DlL.DlL") to run embedded #PE (#lolbin) and #bitsadmin to dl another #PE (/94.250.248.105/task.bat)
Download
Share
Copied
11737
InQuest@InQuest7y
#interesting #scriptlet (9eadd6ceea2084a0d5abb747ff649b32c4b215b98ded2077f044ec3ed9bc2492) is a #JavaScript based #PasswordStealer: #IE #Firefox #Chrome. Disables Windows prompts for #UAC consent by setting #EnableLUA & #ConsentPromptBehaviorAdmin registry values to 0 VT: 0/55
Download
Share
Copied
12438
Malwrologist✓@DissectMalware9y
@DissectMalware
cc: @ItsReallyNick @Dinosn @James_inthe_box @JAMESWT_MHT @JohnLaTwC @danielhbohannon @malwrhunterteam @_devonkerr_ @pollo290987 @executemalware @Ledtech3
Share
Copied
204
Malwrologist✓@DissectMalware9y
@DissectMalware
#powershell pieces: #scriptlet:
Share
Copied
011
Alex@embedded_iot7y
Awesome new idea: I get a #Python #Minecraft mod up and running again. And support @goatchurch #scriptlet concept in there. Then we can instrument #ESP32s and #Microbits and any other #MQtt enabled sensors to publish scriptlet payloads to represent their data in the digital twin!
Share
Copied
102
Constantin Milos ♏@Tinolle infosec.exchange@Tinolle19559y
An Inside Look at CVE-2017-0199 – #HTA and #Scriptlet File Handler #Vulnerability * Fortinet Blog
Share
Copied
01731
InQuest@InQuest7y
John Snow, King of the North, is trespassing with base64! Not returning to Winterfell afterward, instead heading to hxxp://vemvemserver.duckdns.org:1425 (#c2). Passes info through user-agent as well With 0 detection (VT 0/56) #malware #scriptlet
Download
Share
Copied
01442
Malwrologist✓@DissectMalware9y
@DissectMalware
#scriptlet hxxp://down.cacheoffer.tk/d2/reg9.sct #PE hxxp://down.cacheoffer.tk/d2/gd32.txt
Share
Copied
012
Show more posts