Received a .vbs on Skype and ran it

Question

I received a .vbs file on Skype and ran it.. Please let me know if it does anything?

the code contained

Answer 1

It's obfuscated and you can be damn sure it isn't benign. Consider your computer you ran it on as "not secure" anymore. Which means that don't do any banking on it, don't order anything over the internet, and don't trust that machine at all.

On a different machine, one known not to be compromised, change all your passwords for your accounts and then do not access those accounts from the infected computer.

It would be wise to reformat the computer you ran the script on from known good media preferably with Secure Boot enabled in your BIOS/UEFI when you boot that medium to do so.

Answer 2

If you're still worried about what might have happened to your computer, take a look at this ( lines are left as strings for security reason ). Do not try to execute this code If you don't know what you're doing. I'm at work atm so I can't analyze this code in depth but it doesn't seem good. From a quick overview i found that there's

• File and folder tampering
• Registry tampering ( especially start up programs )
• Sending requests ( I noticed one particular domain - kingprog.publicvm.com, but there may be many others)
• Drive tampering

You might want to ask someone to check this out or wait for a few hours till I get home and I'll get back to you with more info.

I would still strongly advise you follow headkase's advice.

EDIT In case it's not clear, the attached link is the deobfuscated vbs code

Answer 3

I decoded this vbscript code !

The suspicious file is located on this folder %Appdata%

And check on your registry for any suspicious entry on :

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run

and

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

I worte a vbscript that can found any suspicious vbscript file running in the background.

So, this code can retrieve the location and copy the source code of this suspicious vbscript file : Just, copy and paste as Find_any_Running_VbsCode.vbs and run it by double clic :

Option Explicit
Dim Title,colItems,objItem,FilePath,ws
Dim MyProcess,LogFile,fso,Contents,arrCommandLine
MyProcess = "Wscript.exe"
Title = "Searching for instances of "& DblQuote(MyProcess) &" by Hackoo 2016"
Set fso = CreateObject("Scripting.FileSystemObject")
Set ws = CreateObject("WScript.Shell")
LogFile = Left(Wscript.ScriptFullName, InstrRev(Wscript.ScriptFullName, ".")) & "txt"
If fso.FileExists(LogFile) Then
    fso.DeleteFile(LogFile)
End If
Set colItems = GetObject("winmgmts:").ExecQuery("Select * from Win32_Process " _
& "Where Name like '%"& MyProcess &"%' AND NOT commandline like '%" & wsh.scriptname & "%'",,48)
For Each objItem in colItems
    arrCommandLine = Split(objItem.CommandLine,DblQuote(" "))
    'msgbox objItem.CommandLine
    If arrCommandLine(1) = "/c" Then 
    'msgbox arrCommandLine(2)
        FilePath = Replace(arrCommandLine(2),chr(34),"")
    else
    'msgbox arrCommandLine(1)
        FilePath = Replace(arrCommandLine(1),chr(34),"")
    end if 
    FilePath = Trim(FilePath)
    Msgbox "A suspicious file is running at this location : " & vbCrLF & DblQuote(FilePath),vbExclamation,Title
    If Len(FilePath) > 0 Then   
        Contents = ReadFile(FilePath,"all")
        Call WriteLog(DblQuote(FilePath) & vbCrlf & String(100,"*")& vbCrlf &_
        Contents & vbCrlf & String(100,"*") & vbCrlf,LogFile)
    End If  
Next
If fso.FileExists(LogFile) Then
    ws.run DblQuote(LogFile)
Else
    MsgBox "No running instances found for this process " &_
    DblQuote(MyProcess),vbExclamation,Title
End If  
'**************************************************
Function DblQuote(Str)
    DblQuote = Chr(34) & Str & Chr(34)
End Function
'**************************************************
Function ReadFile(path,mode)
    Const ForReading = 1
    Dim objFSO,objFile,i,strLine
    Set objFSO = CreateObject("Scripting.FileSystemObject")
    Set objFile = objFSO.OpenTextFile(path,ForReading)
    If mode = "byline" then
        Dim arrFileLines()
        i = 0
        Do Until objFile.AtEndOfStream
            Redim Preserve arrFileLines(i)
            strLine = objFile.ReadLine
            strLine = Trim(strLine)
            If Len(strLine) > 0 Then
                arrFileLines(i) = strLine
                i = i + 1
                ReadFile = arrFileLines
            End If  
        Loop
        objFile.Close
    End If
    If mode = "all" then
        ReadFile = objFile.ReadAll
        objFile.Close
    End If
End Function
'***************************************************
Sub WriteLog(strText,LogFile)
    Dim fso,ts 
    Const ForAppending = 8
    Set fso = CreateObject("Scripting.FileSystemObject")
    Set ts = fso.OpenTextFile(LogFile,ForAppending,True,-1)
    ts.WriteLine strText
    ts.Close
End Sub
'***************************************************