> Family · Unclassified JS Horus Dropper Family_

~/packetpursuit $ cat /intel/families/unclassified-js-horus-dropper.md

typeentityfamilyunclassified-js-horus-dropperconfidencelowcreated2026-06-28updated2026-06-28malware-familyloaderc2persistencedefense-evasionscript

Unclassified JS Horus Dropper Family

French-language JScript dropper cluster delivering a .NET payload via registry-staged PowerShell reflection and SendKeys GUI injection. Persistence via Schedule.Service COM with 1-minute repeat interval (PT1M). C2 infrastructure: horus-protector.pro. Single observed sample; family confidence low pending siblings.

Build / RE

  • Language: JScript for Windows Script Host (WSH) — plain text, no minification.
  • Obfuscation: Single-pass hex encoding (hexToString()) plus strReverse() for two sensitive literals (Task Scheduler ProgID and repeat interval).
  • Comments: Native French inline comments suggest French-speaking authorship or tooling. No anti-analysis, no VM checks, no debug detection.
  • Payload container: 243 KB hex-encoded blob in ifile variable; mostly null-padded. The real payload appears to be fetched from the C2 at runtime (s*.txt / r*.txt).

Deploy / ATT&CK

Tactic Technique ID
Execution Command and Scripting Interpreter: JavaScript/JScript T1059.005
Execution Command and Scripting Interpreter: PowerShell T1059.001
Persistence Scheduled Task/Job T1053.005
Defense Evasion Obfuscated Files or Information T1027.002
Defense Evasion Trusted Developer Utilities Proxy Execution: MSBuild T1127.001
Defense Evasion Component Object Model Hijacking T1546.015
Defense Evasion Input Capture: GUI Input Capture T1056.002
Collection Ingress Tool Transfer T1105

Capabilities

  • jscript-wsh-dropper
  • hex-string-obfuscation
  • schedule.service-com-persistence
  • registry-segmented-payload-staging
  • sendkeys-powershell-injection
  • msbuild-process-masquerade
  • http-plaintext-c2
  • powershell-reflective-assembly-load
  • conhost-cleanup

Related