> Family · unclassified-js-german-locale-dropper_

~/packetpursuit $ cat /intel/families/unclassified-js-german-locale-dropper.md

typeentityconfidencelowupdated2026-07-19scriptobfuscationevasiondefense-evasionc2loader

unclassified-js-german-locale-dropper

JScript dropper family characterised by sequential variable-reassignment obfuscation (last-wins semantics), this['eval'](payload) execution via bracket-notation COM API resolution, a German-only LCID sandbox gate, and an HTTP GET/POST command-response loop to a PHP C2 endpoint.

Overview

First observed sample (d3d22298, Jul 2026, numeric filename 14391660018203124.js). Single observed sample; low-confidence family attribution pending sibling confirmation.

Build Stack

  • Language: JScript / Windows Script Host
  • Obfuscation: Hand-rolled — no commercial tool (not javascript-obfuscator)
  • Reassignment: 84 unique variables, ~1,949 sequential overwrite statements (avg ~23 overwrites each, last-wins semantics)
  • Execution: function xpu(){this[eval](payload)} — single function wrapping eval'd payload
  • COM access: Bracket-notation character assembly (this['WScript']['CreateObject']('WScript.Shell')) rather than literal API names

Deploy / TTPs

Technique ID Evidence Confidence
JavaScript/JScript execution T1059.007 File extension .js, WScript COM object instantiation High
Obfuscated files or information T1027 1,949 sequential variable overwrites, bracket-notation API assembly High
System location discovery T1082 RegRead('HKCU\\Control Panel\\International\\Locale') for sandbox gate High
Virtualization/Sandbox evasion T1497.001 German LCID whitelist (1031/3079/5127/4103/2055); exits on non-German locale High
Ingress tool transfer T1105 HTTP GET fetch of remote command from 193.143.1.150/server.php High
Data collection T1005 ProductId + ComputerName fingerprint for C2 routing High
Exfiltration over C2 channel T1041 HTTP POST of command stdout back to same PHP endpoint High
File and directory discovery T1083 ScriptFullName, %appdata%, %TEMP% path resolution Medium
Process creation T1106 WScript.Shell.Exec('cmd /c ...') for command execution High
Masquerading T1036 Self-copy to %appdata%\\[ProductId]@[ComputerName].js Medium

Capabilities

  • jscript-sequential-variable-reassignment-eval
  • german-lcid-sandbox-gate
  • wscript-com-api-bracket-assembly
  • http-get-post-command-loop
  • productid-computername-fingerprinting
  • wscript-to-cscript-migration
  • plaintext-http-c2
  • script-fullname-placeholder-replacement
  • locale-gate-anti-sandbox

Notable Analyses

  • d3d22298134d18033e55bc3581fa12d5cf30fe121d256e4044516e2bcdde4e23 — First observed sample. 42 KB, 84 variables, 1,949 reassignments, German LCID gate, C2 193.143.1.150/server.php. Static-only. ^[/intel/analyses/d3d22298134d18033e55bc3581fa12d5cf30fe121d256e4044516e2bcdde4e23.html]

Related Pages