Malware
BELLHOP
• BELLHOP is a JavaScript backdoor interpreted using the native Windows Scripting Host(WSH).
BELLHOP is a JavaScript malware family operated by Anunak.
Background
BELLHOP is a JavaScript backdoor run through the native Windows Scripting Host (WSH). Once the dropper has collected basic information about the host, it writes a base64-encoded JavaScript blob to disk and establishes persistence in three different ways: by adding a Run key in the Registry, a RunOnce key in the Registry, and a named scheduled task. For command and control it uses HTTP and HTTPS, mostly routing traffic through legitimate services such as Google Docs and PasteBin.
Source: Malpedia (Fraunhofer FKIE).