Unclassified JS Rentry-Telegram Dropper
A single-sample JScript/WScript dropper family using javascript-obfuscator control-flow flattening and a 190-entry string-array lookup table. The sample downloads a secondary VBS payload from a rentry.co paste, patches hardcoded URLs/ filenames inside it, stages to %TEMP%\tempScript.bat, and copies itself to the Startup SpecialFolder for persistence. Victim fingerprinting (OS, username, external IP, antivirus products) is exfiltrated via the Telegram Bot API.
Confidence: low (single sample, no siblings in corpus).
Capabilities
- javascript-obfuscator-cff-string-array-obfuscation
- noise-comment-padding-size-inflation
- rentry-pastebin-payload-staging
- vbs-payload-string-replacement
- temp-directory-payload-staging
- startup-specialfolder-self-copy-persistence
- wmi-system-fingerprinting
- wmi-antivirusproduct-enumeration
- external-ip-resolution-ipify
- telegram-bot-api-exfiltration
- winhttp-request-downloader
- msxml2-xmlhttp-exfil-post
Related
- javascript-obfuscator — underlying obfuscation tooling
- telegram-bot-exfiltration — C2 channel concept
- unclassified-js-webdav-dropper — unrelated JS dropper family in corpus (different C2, different obfuscation)
- js-cff-string-array-obfuscation — technique page for the obfuscation pattern observed here
- wmi-system-fingerprinting — technique page for WMI-based reconnaissance
- startup-specialfolder-persistence — procedure page for the persistence mechanism
- rentry-pastebin-payload-staging — concept page for paste-service payload hosting