Rentry / Pastebin Payload Staging

Abuse of text-hosting / paste services (rentry.co, pastebin.com, paste.ee, etc.) as a payload staging layer. Malware authors store obfuscated or partially-obfuscated VBS/BAT/PowerShell snippets on a paste service, then hardcode the raw URL into a dropper. The dropper fetches the paste content, performs string replacements (e.g., swapping placeholder URLs for live C2s), and executes the result.

Why It Works

• Paste services are rarely blocked by corporate firewalls (often categorised as " blogging / text sharing").
• Raw URLs (/raw) return plain text without HTML wrapping, making them trivial to consume from WinHttpRequest or MSXML2.XMLHTTP.
• Content can be updated without changing the dropper binary (live payload swapping).
• Free, anonymous, no authentication required.

Detection / Fingerprint

• wscript.exe or cscript.exe making HTTP GET to rentry.co/raw/..., pastebin.com/raw/..., paste.ee/...
• String-replacement operations on fetched text (replace("DownloadURL", ...))
• Follow-up download from a secondary URL discovered inside the paste content

Defensive Countermeasures

• Proxy block rentry.co, pastebin.com, paste.ee unless explicit business need.
• Alert on wscript.exe HTTP GET to any paste-service domain.
• Monitor for replace() string-mutation on large text blobs inside WScript processes.

Pages Where Observed

• unclassified-js-rentry-telegram-dropper — b0c43e946344 using rentry.co/6yg2yfkf/raw