diff --git a/Unknown/APT-C-37/26-08-19/Images/3fb1c19ecfe9c11d779b8dae397cd781b64c56ef.21349-ela.png b/Unknown/APT-C-37/26-08-19/Images/3fb1c19ecfe9c11d779b8dae397cd781b64c56ef.21349-ela.png new file mode 100644 index 0000000..7d4ffc1 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/3fb1c19ecfe9c11d779b8dae397cd781b64c56ef.21349-ela.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/EDOYGWjWsAAsfM1.jpg large.jpg b/Unknown/APT-C-37/26-08-19/Images/EDOYGWjWsAAsfM1.jpg large.jpg new file mode 100644 index 0000000..7b8dc0d Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/EDOYGWjWsAAsfM1.jpg large.jpg differ diff --git a/Unknown/APT-C-37/26-08-19/Images/EDOYGiAXsAEA4Kq.jpg large.jpg b/Unknown/APT-C-37/26-08-19/Images/EDOYGiAXsAEA4Kq.jpg large.jpg new file mode 100644 index 0000000..08a04df Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/EDOYGiAXsAEA4Kq.jpg large.jpg differ diff --git a/Unknown/APT-C-37/26-08-19/Images/FirstAnal.png b/Unknown/APT-C-37/26-08-19/Images/FirstAnal.png new file mode 100644 index 0000000..2ca68c4 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/FirstAnal.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/Post.PNG b/Unknown/APT-C-37/26-08-19/Images/Post.PNG new file mode 100644 index 0000000..d8be14d Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/Post.PNG differ diff --git a/Unknown/APT-C-37/26-08-19/Images/VBScode.png b/Unknown/APT-C-37/26-08-19/Images/VBScode.png new file mode 100644 index 0000000..63029b4 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/VBScode.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/aa18205de56e2cbe15471c3cc1530e587ab975a0.35923-ela-600.png b/Unknown/APT-C-37/26-08-19/Images/aa18205de56e2cbe15471c3cc1530e587ab975a0.35923-ela-600.png new file mode 100644 index 0000000..4aef583 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/aa18205de56e2cbe15471c3cc1530e587ab975a0.35923-ela-600.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/bits.PNG b/Unknown/APT-C-37/26-08-19/Images/bits.PNG new file mode 100644 index 0000000..3c6a5a8 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/bits.PNG differ diff --git a/Unknown/APT-C-37/26-08-19/Images/c654ede55e275431042d32334f8cfd3a5526cb72.196671-600.png b/Unknown/APT-C-37/26-08-19/Images/c654ede55e275431042d32334f8cfd3a5526cb72.196671-600.png new file mode 100644 index 0000000..d61f4d2 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/c654ede55e275431042d32334f8cfd3a5526cb72.196671-600.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/c654ede55e275431042d32334f8cfd3a5526cb72.196671-ela.png b/Unknown/APT-C-37/26-08-19/Images/c654ede55e275431042d32334f8cfd3a5526cb72.196671-ela.png new file mode 100644 index 0000000..dee87b9 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/c654ede55e275431042d32334f8cfd3a5526cb72.196671-ela.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/code.vb b/Unknown/APT-C-37/26-08-19/Images/code.vb new file mode 100644 index 0000000..1a7ba9a --- /dev/null +++ b/Unknown/APT-C-37/26-08-19/Images/code.vb @@ -0,0 +1,6 @@ +VBS_ENGINE = new ActiveXObject ("MSSCRIPTCONTROL.SCRIPTCONTROL"); VBS_ENGINE = new ActiveXObject ("MSSCRIPTCONTROL.SCRIPTCONTROL"); +VBS_ENGINE.LANGUAGE = "VBSCRIPT"; VBS_ENGINE.LANGUAGE = "VBSCRIPT"; +VBS_ENGINE.TIMEOUT = -1; VBS_ENGINE.TIMEOUT = -1; +VBS_ENGINE.ADDOBJECT ("WSCRIPT",WScript); VBS_ENGINE.ADDOBJECT ("WSCRIPT", WScript); +VBS_ENGINE.ADDCODE ("FUNCTION SPLTER (HOUDINI):HOUDINI = SPLIT (HOUDINI,"+String.fromCharCode(34)+" "+String.fromCharCode(34)+"):H = 0:WHILE H < UBOUND(HOUDINI):SPLTER = SPLTER & CHR(HOUDINI(H)):H = H + 1:WEND:END FUNCTION"); VBS_ENGINE.ADDCODE ("FUNCTION SPLTER (HOUDINI): HOUDINI = SPLIT (HOUDINI," + String.fromCharCode (34) + "" + String.fromCharCode (34) + ")): H = 0: WHILE H +VBS_ENGINE.ADDCODE ("E"+"X"+"E"+"C"+"U"+"T"+"E"+"(SPLTER ("+String.fromCharCode(34)+"109 115 103 32 61 32 34 117 112 108 111 97 100 101 32 97 110 100 32 101 120 101 99 32 116 101 114 109 105 110 101 116 101 100 34 13 10 119 115 99 114 105 112 116 46 101 99 104 111 32 109 115 103 "+String.fromCharCode(34)+"))"); VBS_ENGINE.ADDCODE ("E" + "X" + "E" + "C" + "U" + "T" + "E" + "(SPLTER (" + String.fromCharCode (34) + "109 115 103 32 61 32 34 117 112 108 111 97 100 101 32 97 110 100 32 101 120 101 99 32 116 101 114 109 105 110 101 116 101 100 34 13 10 119 115 99 114 105 112 116 46 101 99 104 111 32 109 115 103 " + String.fromCharCode (34) + "))"); \ No newline at end of file diff --git a/Unknown/APT-C-37/26-08-19/Images/codeRAT.png b/Unknown/APT-C-37/26-08-19/Images/codeRAT.png new file mode 100644 index 0000000..d4d4d24 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/codeRAT.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/content.png b/Unknown/APT-C-37/26-08-19/Images/content.png new file mode 100644 index 0000000..5d4278a Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/content.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/cyber.PNG b/Unknown/APT-C-37/26-08-19/Images/cyber.PNG new file mode 100644 index 0000000..9e7b841 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/cyber.PNG differ diff --git a/Unknown/APT-C-37/26-08-19/Images/decStr.png b/Unknown/APT-C-37/26-08-19/Images/decStr.png new file mode 100644 index 0000000..08294f3 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/decStr.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/declayer.png b/Unknown/APT-C-37/26-08-19/Images/declayer.png new file mode 100644 index 0000000..b31452b Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/declayer.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/decodeJS.png b/Unknown/APT-C-37/26-08-19/Images/decodeJS.png new file mode 100644 index 0000000..e8ee0ba Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/decodeJS.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/dirfunc.PNG b/Unknown/APT-C-37/26-08-19/Images/dirfunc.PNG new file mode 100644 index 0000000..7ed63db Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/dirfunc.PNG differ diff --git a/Unknown/APT-C-37/26-08-19/Images/downfunc.PNG b/Unknown/APT-C-37/26-08-19/Images/downfunc.PNG new file mode 100644 index 0000000..067b202 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/downfunc.PNG differ diff --git a/Unknown/APT-C-37/26-08-19/Images/encodeJS.png b/Unknown/APT-C-37/26-08-19/Images/encodeJS.png new file mode 100644 index 0000000..fa56615 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/encodeJS.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/exitfunc.PNG b/Unknown/APT-C-37/26-08-19/Images/exitfunc.PNG new file mode 100644 index 0000000..750a2a2 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/exitfunc.PNG differ diff --git a/Unknown/APT-C-37/26-08-19/Images/fnVYrkD1.png b/Unknown/APT-C-37/26-08-19/Images/fnVYrkD1.png new file mode 100644 index 0000000..698cb61 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/fnVYrkD1.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/geZ6pXr1.png b/Unknown/APT-C-37/26-08-19/Images/geZ6pXr1.png new file mode 100644 index 0000000..053a2a1 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/geZ6pXr1.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/infofunc.PNG b/Unknown/APT-C-37/26-08-19/Images/infofunc.PNG new file mode 100644 index 0000000..420a5ff Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/infofunc.PNG differ diff --git a/Unknown/APT-C-37/26-08-19/Images/infolast.png b/Unknown/APT-C-37/26-08-19/Images/infolast.png new file mode 100644 index 0000000..c32990c Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/infolast.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/lay1dec.png b/Unknown/APT-C-37/26-08-19/Images/lay1dec.png new file mode 100644 index 0000000..c01e43d Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/lay1dec.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/layer2.png b/Unknown/APT-C-37/26-08-19/Images/layer2.png new file mode 100644 index 0000000..72dbfdc Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/layer2.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/listdrivesfunc.PNG b/Unknown/APT-C-37/26-08-19/Images/listdrivesfunc.PNG new file mode 100644 index 0000000..a958f22 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/listdrivesfunc.PNG differ diff --git a/Unknown/APT-C-37/26-08-19/Images/lnk.PNG b/Unknown/APT-C-37/26-08-19/Images/lnk.PNG new file mode 100644 index 0000000..31bab44 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/lnk.PNG differ diff --git a/Unknown/APT-C-37/26-08-19/Images/lnkfile.png b/Unknown/APT-C-37/26-08-19/Images/lnkfile.png new file mode 100644 index 0000000..72a052b Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/lnkfile.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/matchcode.PNG b/Unknown/APT-C-37/26-08-19/Images/matchcode.PNG new file mode 100644 index 0000000..e91e532 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/matchcode.PNG differ diff --git a/Unknown/APT-C-37/26-08-19/Images/oIdfwmrN.png b/Unknown/APT-C-37/26-08-19/Images/oIdfwmrN.png new file mode 100644 index 0000000..f0a022e Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/oIdfwmrN.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/onelinerJS.png b/Unknown/APT-C-37/26-08-19/Images/onelinerJS.png new file mode 100644 index 0000000..578f37e Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/onelinerJS.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/parents.png b/Unknown/APT-C-37/26-08-19/Images/parents.png new file mode 100644 index 0000000..6fdaebe Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/parents.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/postfunc.PNG b/Unknown/APT-C-37/26-08-19/Images/postfunc.PNG new file mode 100644 index 0000000..3383ab7 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/postfunc.PNG differ diff --git a/Unknown/APT-C-37/26-08-19/Images/processfunc.PNG b/Unknown/APT-C-37/26-08-19/Images/processfunc.PNG new file mode 100644 index 0000000..889bedf Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/processfunc.PNG differ diff --git a/Unknown/APT-C-37/26-08-19/Images/rule.png b/Unknown/APT-C-37/26-08-19/Images/rule.png new file mode 100644 index 0000000..0a3a015 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/rule.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/secAnal.png b/Unknown/APT-C-37/26-08-19/Images/secAnal.png new file mode 100644 index 0000000..af18b66 Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/secAnal.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/strings.png b/Unknown/APT-C-37/26-08-19/Images/strings.png new file mode 100644 index 0000000..e767bee Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/strings.png differ diff --git a/Unknown/APT-C-37/26-08-19/Images/upfunc.PNG b/Unknown/APT-C-37/26-08-19/Images/upfunc.PNG new file mode 100644 index 0000000..05c5d9a Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/upfunc.PNG differ diff --git a/Unknown/APT-C-37/26-08-19/Images/zoomdebug.PNG b/Unknown/APT-C-37/26-08-19/Images/zoomdebug.PNG new file mode 100644 index 0000000..49f51ee Binary files /dev/null and b/Unknown/APT-C-37/26-08-19/Images/zoomdebug.PNG differ