ViperZCrew [ARCHIV] [2025]

تاریخ	رشد مشترکین	اشارات	کانال‌ها
24 نوامبر	+26
23 نوامبر	+13
22 نوامبر	+21
21 نوامبر	+17
20 نوامبر	+37
19 نوامبر	+20
18 نوامبر	+17
17 نوامبر	+21
16 نوامبر	+20
15 نوامبر	+29
14 نوامبر	+42
13 نوامبر	+15
12 نوامبر	+11
11 نوامبر	+8
10 نوامبر	+18
09 نوامبر	+16
08 نوامبر	+15
07 نوامبر	+21
06 نوامبر	+15
05 نوامبر	+12
04 نوامبر	+19
03 نوامبر	+15
02 نوامبر	+23
01 نوامبر	+44

پست‌های کانال

Adaptix - C2 Framework v0.10 https://github.com/Adaptix-Framework/AdaptixC2

2	https://t.me/viperzcrew2	431
3	I moved backupData and EnCOdeDPayLoAD to text files since they are big blobs and probably kills some editors because of 7MB. Also for safety you shouldn't run the PowerShell. Only for analysis. 🔐 Password: viperzcrew	446
4	⚙️ The Main Controller: Start-MainExecution This function is the brain of the operation. It orchestrates everything in a specific, resilient sequence: 🛡Bypass Attempts: It tries to disable AMSI and attempts privilege escalation if not already an admin. 📞 Call Home: Sends the initial system information report via Send-InitialSystemInfo. 💾 Establish Persistence: Writes itself to the Registry for startup persistence using Set-StartupPersistence. 🚀 Execute Primary Payload: Calls Invoke-InMemoryExecution to run the main .NET payload. 👀 Enter Monitoring Loop: Enters an infinite loop where it: ▶️Checks for regsvr32 activity every 30 seconds. ▶️If regsvr32 is detected, it logs the success. ▶️If regsvr32 is not detected after 3 minutes ($maxwaItFOrrEgSVR32) and a backup payload exists, it triggers the fallback mechanism (Invoke-BackupExecution). ▶️Sends status updates to the C&C every 30 minutes. 🎯 Execution Flow Functions Get-MachineIdentifier → Send-InitialSystemInfo → Test-IsElevated → Set-StartupPersistence → Invoke-InMemoryExecution → [Monitor-RegSvr32Process → Invoke-BackupExecution (if timeout)]	427
5	💎 Payload Management Functions Get-ReconstructedScript ▶️Purpose: Self-replication and regeneration ▶️Behavior: Rebuilds the entire malicious script by collecting all function definitions and global variables ▶️Technique: Script regeneration for persistence and evasion ▶️Output: Complete, executable PowerShell script containing all malware functions Invoke-InMemoryExecution ▶️Purpose: Orchestrate payload execution chain ▶️Behavior: Coordinates the decoding and execution of the main payload ▶️Process: Decodes Base32 payload → Calls Invoke-CSharpAssembly → Starts monitoring ▶️Technique: Execution workflow management Decompress-GzipData ▶️Purpose: Decompress the main payload (called internally by decoding functions) ▶️Behavior: Uses GZipStream to decompress payload data in memory ▶️Technique: Compression evasion - makes payload harder to detect in encoded form	355
6	🔄 Persistence & Retry Mechanism Functions Get-RetryTempFile, Get-RetryCount, Set-RetryCount, Remove-RetryTempFile ▶️Purpose: Persistence retry system for privilege escalation attempts ▶️Behavior: Uses temporary files to track how many times the malware has attempted elevation ▶️Technique: State persistence across executions Process: 🔴Get-RetryTempFile: Creates temp file path based on hash suffix 🔴Get-RetryCount: Reads current retry count from file 🔴Set-RetryCount: Updates retry counter 🔴Remove-RetryTempFile: Cleans up after successful elevation Invoke-WorkELV ▶️Purpose: Privilege escalation execution (empty but critical) ▶️Behavior: Would contain code to execute commands with elevated privileges ▶️Technique: UAC bypass or token impersonation ▶️Context: Called when malware needs admin rights but doesn't have them	309
7	🔐 Evasion & Anti-Analysis Functions Test-DuplicateRegistryProcess ▶️Purpose: Prevent multiple instances of the malware from running ▶️Behavior: Checks for existing PowerShell processes with specific registry-related command lines ▶️Technique: Mutex-like behavior using process command-line analysis # Looks for processes with these signatures: # - "MiCRoSoFt.wIN32.RegIstry" # - Specific data key names # - "GetConsoleWindow" Start-SeparateShellKiller ▶️Purpose: Disrupt system security/UI processes ▶️Behavior: Launches hidden PowerShell that continuously kills: ShellExperienceHost (Windows Shell components) sechealthui (Security/Health monitoring) ▶️Technique: Process targeting - possibly to disable security notifications or system monitoring Invoke-NullAMSI ▶️Purpose: AMSI bypass (though empty in this version) ▶️Behavior: Placeholder for AMSI disabling code ▶️Technique: Security feature evasion - would typically patch AMSI scanning in memory	276
8	📊 Process & System Monitoring Functions Get-ProcessesList ▶️Purpose: Creates a detailed report of all running processes ▶️Behavior: Collects process name, PID, CPU time, memory usage, start time, and file path ▶️Technique: System reconnaissance for attacker intelligence Output: Formatted text report sent to Telegram Get-RegSvr32Details ▶️Purpose: Deep analysis of any regsvr32 process ▶️Behavior: Examines process arguments, DLL path, file properties, network connections, and parent process ▶️Technique: Advanced process forensics - helps attacker understand what their payload is doing 🔥Features: Retry mechanism, early closure detection, connection mapping Track-Regsvr32Attempt & Send-RegSvr32ActivityLog ▶️Purpose: Execution tracking and logging ▶️Behavior: Maintains statistics on regsvr32 attempts (success/failure counts) and sends detailed activity logs ▶️Technique: Operational security - allows attacker to monitor their attack success rate	293
9	❗️ Core Payload Execution Functions These functions handle the main malicious payload (the $EnCOdeDPayLoAD and $GLoBAl:backupData). Decode-Base32-Ultra & Decompress-GzipData ▶️Purpose: To decode and decompress the primary payload. ▶️Behavior: The payload is stored in a custom Base32 encoding (not the standard one) and is likely Gzip-compressed. These functions reverse this process to get the original bytes. Invoke-CSharpAssembly ▶️Purpose: To load and execute the decoded payload in memory. ▶️Behavior: It uses .NET's Reflection.Assembly.Load() to load the byte array directly into memory. It then invokes the assembly's EntryPoint (its Main method) inside a PowerShell background job. This is Fileless Execution - the malicious code never touches the disk, making it very hard for traditional antivirus to detect. ▶️Technique: In-Memory Assembly Load. Invoke-BackupExecution ▶️Purpose: A fallback plan. If the primary in-memory execution fails or if regsvr32 is never detected, this function is called. ▶️Behavior: It decodes the $GLoBAl:backupData, writes it to a temporary .dat file on disk, and then uses the legitimate regsvr32.exe to execute it (regsvr32 /s /i maliciousfile.dat). This is a classic Scriptlet (sct) / COM Scripting attack vector. ▶️Technique: This is a less stealthy, disk-based execution method, but it's a reliable fallback that abuses a trusted Windows component.	289
10	💾 Function: Set-StartupPersistence ▶️Purpose: To ensure the malware runs every time the computer starts up. ▶️Behavior: It creates not one, but two Registry entries in the Run keys (for both the Current User and Local Machine). A Binary Value containing the entire, reconstructed PowerShell script. A String Value containing a command that, when executed, will read the binary data from the first value and run it with a hidden window. ▶️Technique: This is a sophisticated Persistence mechanism. Storing the payload as binary data in the Registry makes it harder to spot than a simple file path. The execution command is a complex one-liner that hides its activity.	297
11	🔐 Function: Test-IsElevated ▶️Purpose: To check if the script is running with Administrator privileges and, if so, to weaken the system's defenses. ▶️Behavior: Checks for Admin rights. If Admin: 🔴Adds powershell.exe and the entire C:\ drive to Windows Defender's exclusion list. This is a critical defense bypass. 🔴Disables sleep and monitor timeouts (powercfg commands) to keep the system active. 🔴Clears recent user activity from the Registry (Run commands, typed paths) to cover its tracks. It also calls Start-SeparateShellKiller, which launches a hidden PowerShell process that continuously kills processes named ShellExperienceHost and sechealthui (possibly to disrupt system UI or security checks).	285
12	🔎 Function: Invoke-NullAMSI & Hide-Console ▶️Purpose: Evasion. ▶️Behavior: Invoke-NullAMSI is (currently) empty in this script, but its name reveals its intent. AMSI (Antimalware Scan Interface) is a Windows security feature that scans scripts for malware. A real implementation would contain code to patch or disable AMSI in memory. Hide-Console uses Windows API calls to find the PowerShell console window and hide it (ShowWindow(..., 0)), making the script run stealthily. ▶️Technique: These are classic anti-analysis and stealth techniques to avoid detection by both the user and security software. We have posted an article about ASMI here: https://t.me/viperzcrew2/449	277
13	🚨 Function: Monitor-RegSvr32Process ▶️Purpose: To monitor for the presence of regsvr32.exe processes and report their network connections. ▶️Behavior: It checks if any regsvr32 process is running. If found, it uses the netstat command to see if that process has any active network connections and reports them to the C&C. ▶️Explanation: regsvr32 is a legitimate Windows tool for registering DLLs. Malware often abuses it to run malicious code (a technique called "LOLBIN" - Living Off the Land Binaries). This script is monitoring for it because the primary payload it's meant to load is expected to use regsvr32 as part of its execution chain. The attacker is waiting for a signal that their payload has been successfully activated.	288
14	🖥 Functions: Get-SystemInformation & Send-InitialSystemInfo ▶️Purpose: To perform initial reconnaissance and send a detailed profile of the victim to the attacker. ▶️Behavior: Get-SystemInformation collects: 🖥 Username & Computer Name 🌍 Geolocation (City, Continent, Timezone, Public IP) via an external API (ip-info.ff.avast.com). 🛡 User Privileges (Admin or User) 🔒 Antivirus Product Name 💾 RAM Size 🎮 GPU Model Send-InitialSystemInfo formats this data and sends it. It also generates a list of all running processes (Get-ProcessesList), saves it to a temp file, and sends that as a document. ▶️Technique: This is the Intelligence Gathering phase. Knowing the AV, privileges, and system specs helps the attacker understand what they can do next (e.g., if they are an admin, they can disable defenses).	285
15	📤 Functions: Send-TelegramMessage & Send-TelegramDocument ▶️Purpose: To communicate with the attacker via the Telegram Bot API. ▶️Behavior: Send-TelegramMessage sends text messages, while Send-TelegramDocument uploads files. They both prepend the machine ID to all messages for attacker tracking. ▶️Technique: Data Exfiltration. These functions are the primary channel for stealing information from the victim. The script uses the Invoke-RestMethod cmdlet, a legitimate PowerShell tool, for communication, again demonstrating LotL.	285
16	🔍 Function: Get-MachineIdentifier ▶️Purpose: To generate a unique, pseudo-anonymous ID for the infected computer. ▶️Behavior: It tries to get a unique hardware identifier like the MachineGuid from the Windows Registry or the UUID from WMI. If those fail, it falls back to using the computer name and the current time. It then hashes this value with SHA256 and takes the first 4 characters. ▶️Technique: This creates a simple "Fingerprint" of the victim machine. This ID is used in all communications with the C&C to track individual infections.	286
17	📁 Global Variables & Initial Setup $GLoBAl:botToken = "8221393912:AAE4RTaXLOVnSFR-ifxG2MIMY9PALObVRH0" $GLoBAl:chatId = "-1002943753205" $GLoBAl:machineId = "" $GLoBAl:backupData = "" // A large Base32-encoded blob would be here $GLoBAl:hasBackup = $fAlse ▶️Purpose: These variables configure the malware's communication channel. ▶️Behavior: The botToken and chatId are used to send messages and files to a specific Telegram chat controlled by the attacker. The backupData is a crucial piece - it's a compressed and encoded backup payload that will be used if the primary method fails. ▶️Technique: Using Telegram for C&C is a common "Living Off the Land" (LotL) technique. It's hard to block because Telegram is a legitimate, widely used service. The chatId being a negative number indicates a Telegram channel or group.	308
18	👩‍💻 PowerShell Loader: In-Depth Malware Analysis ▶️This is a multi-stage PowerShell malware loader. Its primary goal is to decode and execute a hidden payload (a .NET assembly) in memory, establish persistence on the infected machine, and exfiltrate system information to a Telegram-based Command & Control (C&C) server. It uses advanced evasion, monitoring, and fallback mechanisms to ensure its survival and execution.	339
19	بدون متن...	391
20	### Android Emulators https://android-emulators.com/amiduos * Android emulator for Windows offering smooth 3D-accelerated gaming and OpenGL support. https://www.linuxvmimages.com/images/android-x86 * Repository of downloadable Android-x86 virtual disk images for running Android on PCs and VMs. https://www.andyroid.net/ * Android emulator for Windows / macOS offering real phone experience with app sync and seamless desktop integration. https://www.bluestacks.com/ * Widely used Android app player for Windows and Mac with multi-instance, gaming enhancements, and broad app support. https://www.genymotion.com/ * Cloud-based Android virtual devices aimed at developers for testing on different Android versions and configurations. https://www.memuplay.com/ * Windows Android emulator optimised for mobile gaming with multiple instances and performance tuning. https://www.bignox.com/ * Feature-rich Android emulator with gamepad support, rooting, multi-instance capabilities, and screen recording. https://www.primeos.in/ * Android-x86 based PC operating system blending desktop familiarity with mobile that can dual-boot or run in VM. https://www.qemu.org/ * A generic and open source machine emulator and virtualiser. https://www.osboxes.org/android-x86/ * A mobile operating system (OS) based on the Linux kernel and currently developed by Google.	234

مشاهده همه پست‌ها