Scriptkd

Overview

TrojanDownloader:VBS/Scriptkd (or JS/Scriptkd) is a heuristic classification for heavily obfuscated malicious scripts (typically VBScript, JScript, or PowerShell) designed to act as the primary initial access and downloading mechanism for severe malware infections, most notably ransomware families like GandCrab or Sodinokibi/REvil.

Understanding Scriptkd
To an end-user, an infection often starts with a single click on a fake invoice attachment (like a `.zip` containing a `.vbs` file). The script executes invisibly in the background, showing no windows. For a security analyst, Scriptkd represents the critical first stage of an attack kill-chain (Living off the Land). It leverages built-in Windows scripting engines (`wscript.exe` or `cscript.exe`) to evade traditional file-based antivirus, which often struggles to parse highly obfuscated script logic.

Execution and Evasion Strategies
Scriptkd is almost exclusively delivered via targeted spearphishing or massive malspam campaigns (`T1566.001`). The script itself is heavily obfuscated (`T1027`), often utilizing random variable names, string splitting, base64 encoding, or custom mathematical decryption routines. Upon execution by `wscript.exe` (`T1059.005`), it attempts to reach out to compromised WordPress sites, Pastebin, or Discord CDNs (`T1105`) to download the secondary payload (often a PE file or an encrypted PowerShell script). It then executes this payload, frequently utilizing fileless execution techniques (`T1620`) by loading the payload directly into memory using tools like PowerShell or `Regasm.exe`.

Indicators of Compromise & Impact
The impact is the successful deployment of a high-severity secondary payload (like ransomware). Incident responders will observe `wscript.exe`, `cscript.exe`, or `powershell.exe` making anomalous outbound HTTP/HTTPS connections. EDR platforms should flag the execution of heavily obfuscated scripts from temporary directories or the `%AppData%` folder, especially if those scripts immediately attempt to spawn child processes or write executable files to disk.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.001: Restrict execution of PowerShell. Enforce PowerShell Constrained Language Mode and Script Block Logging.
• T1059.005: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_SCRIPTKD {
    meta:
        description = "Detects Scriptkd (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "scriptkd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Scriptkd Activity
id: e7cded03a355bcb6ab276d5edd386c66
status: experimental
description: Detects generic indicators of the scriptkd malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*scriptkd*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint; if `wscript.exe` successfully executed the Scriptkd payload, a secondary infection (like ransomware) is actively downloading or running.
2. Use EDR to immediately terminate any suspicious `wscript.exe`, `cscript.exe`, or `powershell.exe` processes executing out of user profile directories.
3. Review network proxies to identify the C2 domains contacted by the script and block them enterprise-wide.
4. Disable the Windows Script Host (WSH) globally via Group Policy if VBScript execution is not required for business operations.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the attack is blocked just because the email gateway stripped the attachment; users may download the script via web links.
2. Avoid relying solely on static hash signatures for scripts, as attackers dynamically generate new obfuscation patterns for every email sent.

References & External Analysis

• Search "scriptkd" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Blokrypt
• Hpfareit
• Sheldor
• Ardurk
• Cryptredol

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/scriptkd.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.