{
  "family": "scriptkd",
  "sample_count": 15,
  "category": "ransomware",
  "description": "TrojanDownloader:VBS/Scriptkd (or JS/Scriptkd) is a heuristic classification for heavily obfuscated malicious scripts (typically VBScript, JScript, or PowerShell) designed to act as the primary initial access and downloading mechanism for severe malware infections, most notably ransomware families like GandCrab or Sodinokibi/REvil.<br><br><b>Understanding Scriptkd</b><br>To an end-user, an infection often starts with a single click on a fake invoice attachment (like a `.zip` containing a `.vbs` file). The script executes invisibly in the background, showing no windows. For a security analyst, Scriptkd represents the critical first stage of an attack kill-chain (Living off the Land). It leverages built-in Windows scripting engines (`wscript.exe` or `cscript.exe`) to evade traditional file-based antivirus, which often struggles to parse highly obfuscated script logic.<br><br><b>Execution and Evasion Strategies</b><br>Scriptkd is almost exclusively delivered via targeted spearphishing or massive malspam campaigns (`T1566.001`). The script itself is heavily obfuscated (`T1027`), often utilizing random variable names, string splitting, base64 encoding, or custom mathematical decryption routines. Upon execution by `wscript.exe` (`T1059.005`), it attempts to reach out to compromised WordPress sites, Pastebin, or Discord CDNs (`T1105`) to download the secondary payload (often a PE file or an encrypted PowerShell script). It then executes this payload, frequently utilizing fileless execution techniques (`T1620`) by loading the payload directly into memory using tools like PowerShell or `Regasm.exe`.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the successful deployment of a high-severity secondary payload (like ransomware). Incident responders will observe `wscript.exe`, `cscript.exe`, or `powershell.exe` making anomalous outbound HTTP/HTTPS connections. EDR platforms should flag the execution of heavily obfuscated scripts from temporary directories or the `%AppData%` folder, especially if those scripts immediately attempt to spawn child processes or write executable files to disk.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059.005",
    "T1059.001",
    "T1105",
    "T1566.001",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059.005",
      "name": "Command and Scripting Interpreter: Visual Basic",
      "tactic": "Execution"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell",
      "tactic": "Execution"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; if `wscript.exe` successfully executed the Scriptkd payload, a secondary infection (like ransomware) is actively downloading or running.",
    "Use EDR to immediately terminate any suspicious `wscript.exe`, `cscript.exe`, or `powershell.exe` processes executing out of user profile directories.",
    "Review network proxies to identify the C2 domains contacted by the script and block them enterprise-wide.",
    "Disable the Windows Script Host (WSH) globally via Group Policy if VBScript execution is not required for business operations."
  ],
  "what_to_avoid": [
    "Do not assume the attack is blocked just because the email gateway stripped the attachment; users may download the script via web links.",
    "Avoid relying solely on static hash signatures for scripts, as attackers dynamically generate new obfuscation patterns for every email sent."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}