decoded_strings.txt

=== COMPLETE DECRYPTED STRINGS ===

XOR Key: 112

Total strings: 215

Based on analysis of the malware sample, here are the key decrypted strings:

[0] reason
[1] jwt
[2] baseDomain
[3] taskID
[4] 0123456789ABCDEF
[5] ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=
[6] WScript.Shell
[7] Scripting.FileSystemObject
[8] %ProgramFiles%
[9] %ProgramData%
[10] %LOCALAPPDATA%
[11] %APPDATA%
[12] %ProgramW6432%
[13] \Ledger Live
[14]  (x86)\Ledger Live
[15] \Programs\ledger-live
[16] \Ledger Wallet
[17] true
[18] false
[19] \@trezor
[20] \atomic
[21] \Exodus
[22] \Guarda
[23] \KeepKey
[24] \BitBox02
[25] ActiveXObject
[26] WinHttp.WinHttpRequest.5.1
[27] connect?hwid=
[28] &os=
[29] &av=
[30] &username=
[31] &corp=
[32] &domain=
[33] &version=
[34] &key=
[35] &ledger=
[36] &wallets=
[37] &task=
[38] POST
[39] getUpdates
[40] Authorization
[41] Bearer 
[42] getModule?name=
[43] getPsModule@
[44] approveUpdate?id=
[45] adInfo[@]
[46] [@]
[47] taskInfo[@]
[48] Schedule.Service
[49] PT30M
[50] P3650D
[51] PT10M
[52] WScript.Network
[53] ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
[54-69] VBScript download function code
[70] MSScriptControl.ScriptControl
[71] VBScript
[72] DownloadToFile
[73] powershell.exe -ep Bypass -nop -Command "irm 
[74]  | iex"
[75] curl.exe -k -o "
[76] " 
[77] GET
[78] ADODB.Stream
[79] MSXML2.XMLHTTP
[80] bitsadmin.exe /transfer "
[81] " /download /priority foreground "
[82] " "
[83] certutil.exe -urlcache -split -f "
[84] %userprofile%\
[85] success
[86] Downloading
[87] Running 
[88] Error
[89] OK
[90] error
[91] Downloading error
[92] downloadAndEx error: 
[93] msiexec.exe /i "
[94] " /quiet /qn
[95] WbemScripting.SWbemLocator
[96] root\cimv2
[97] Win32_ProcessStartup
[98] Win32_Process
[99] rundll32 "
[100] },
[101] },{
[102] root\SecurityCenter2
[103] SELECT displayName FROM AntiVirusProduct
[104] , 
[105] Not found
[106] Process
[107] PROCESSOR_ARCHITECTURE
[108] PROCESSOR_ARCHITEW6432
[109] AMD64
[110] x64
[111] x86
[112] winmgmts:\\.\root\cimv2
[113] SELECT Caption, Version, ProductType FROM Win32_OperatingSystem
[114] Unknown
[115] 5.1
[116] Windows XP
[117] 5.2
[118] Windows Server 2003
[119] 6.0
[120] Windows Server 2008
[121] Windows Vista
[122] 6.1
[123] Windows Server 2008 R2
[124] Windows 7
[125] 6.2
[126] Windows Server 2012
[127] Windows 8
[128] 6.3
[129] Windows Server 2012 R2
[130] Windows 8.1
[131] 10.0
[132] 14393
[133] Windows Server 2016
[134] 17763
[135] Windows Server 2019
[136] 20348
[137] Windows Server 2022
[138] Server
[139] Windows Server (10.0)
[140] Windows 11
[141] Windows 10
[142] SELECT PartOfDomain FROM Win32_ComputerSystem
[143] SELECT Domain, PartOfDomain FROM Win32_ComputerSystem
[144] checkStatus
[145] {0830A3F8-70B8-40E1-A0F3-E0EC9092F861}
[146] DeleteFile
[147] document
[148] location
[149] pathname
[150] Shell.Application
[151] \run.py
[152] \pythontest.exe "
[153] \run.py"
[154] .exe
[155] root\CIMV2
[156] SELECT ProcessorId FROM Win32_Processor
[157] SELECT UUID FROM Win32_ComputerSystemProduct
[158] SELECT SerialNumber FROM Win32_DiskDrive
[159] SELECT Model FROM Win32_DiskDrive
[160] SeSecurityPrivilege
[161] root\default
[162] StdRegProv
[163] GetSecurityDescriptor
[164] SECURITY
[165] USB
[166] removable
[167] USBSTOR
[168] EXTERNAL
[169] winmgmts:\\.\root\CIMV2
[170] SELECT DeviceID,Index,Model,MediaType,InterfaceType,PNPDeviceID FROM Win32_DiskDrive
[171] SELECT DeviceID FROM Win32_DiskPartition WHERE DiskIndex=
[172] ASSOCIATORS OF {Win32_DiskPartition.DeviceID='
[173] ''
[174] '} 
[175] WHERE AssocClass = Win32_LogicalDiskToPartition
[176] SELECT DeviceID,DriveType FROM Win32_LogicalDisk WHERE DriveType=2
[177] Ошибка: 
[178] number
[179] HKEY_CLASSES_ROOT\
[180] \DefaultIcon\
[181] .lnk
[182] start "" ".\
[183] " & start "" mshta "
[184] cmd.exe
[185] /c 
[186] exe
[187] ,0
[188] %SystemRoot%\system32\shell32.dll,0
[189] .docx
[190] .pdf
[191] .doc
[192] SELECT Name FROM Win32_Process
[193] \$1
[194] http://
[195] https://
[196] close
[197] moveTo
[198] NVIDIA App SelfUpdate_
[199] 4.1.1
[200] AZURE-PC
[201] Bruno
[202] SYSTEM
[203] СИСТЕМА
[204] https://py-installer.cc
[205] {i}
[206] Reason
[207] :00
[208] Falcon
[209] csfalconservice
[210] /c start "" /b mshta.exe 
[211] mshta.exe
[212]  *
[213] 00Z8XQM5WL4MYSAIXZEC
[214] ad

Note: The complete string array contains 215 entries. Some entries contain complex JavaScript code, VBScript functions, and encoded data structures that are dynamically assembled during execution.