MCPcopy Create free account
hub / github.com/Pizz33/GobypassAV-shellcode / NoBlockUserProcess

Function NoBlockUserProcess

Anti sandbox/name.go:33–78  ·  view source on GitHub ↗
()

Source from the content-addressed store, hash-verified

31}
32
33func NoBlockUserProcess() {
34 known := []string{
35 "QWJieQ==",
36 "YXp1cmU=",
37 "Z2Vvcmdl",
38 /* "YXV0b3J1bnMuZXhl", */
39 /* "YXV0b3J1bnNjLmV4ZQ==",
40 "ZmlsZW1vbi5leGU=",
41 "cHJvY21vbi5leGU=",
42 "cmVnbW9uLmV4ZQ==",
43 "cHJvY2V4cC5leGU=",
44 "aWRhcS5leGU=",
45 "aWRhcTY0LmV4ZQ==",
46 "SW1tdW5pdHlEZWJ1Z2dlci5leGU=",
47 "V2lyZXNoYXJrLmV4ZQ==",
48 "ZHVtcGNhcC5leGU=",
49 "SG9va0V4cGxvcmVyLmV4ZQ==",
50 "SW1wb3J0UkVDLmV4ZQ==",
51 "UEVUb29scy5leGU=",
52 "TG9yZFBFLmV4ZQ==",
53 "U3lzSW5zcGVjdG9yLmV4ZQ==",
54 "cHJvY19hbmFseXplci5leGU=",
55 "c3lzQW5hbHl6ZXIuZXhl",
56 "c25pZmZfaGl0LmV4ZQ==",
57 "d2luZGJnLmV4ZQ==",
58 "am9lYm94Y29udHJvbC5leGU=",
59 "am9lYm94c2VydmVyLmV4ZQ==",
60 "am9lYm94c2VydmVyLmV4ZQ==",
61 "UmVzb3VyY2VIYWNrZXIuZXhl",
62 "eDMyZGJnLmV4ZQ==",
63 "eDY0ZGJnLmV4ZQ==",
64 "RmlkZGxlci5leGU=",
65 "aHR0cGRlYnVnZ2VyLmV4ZQ==", */
66 }
67
68 u, _ := user.Current()
69 username := u.Username
70
71 for _, v := range known {
72 decoded, _ := base64.URLEncoding.DecodeString(v)
73 decodedString := string(decoded)
74 if strings.EqualFold(decodedString, username) {
75 os.Exit(0)
76 }
77 }
78}

Callers

nothing calls this directly

Calls

no outgoing calls

Tested by

no test coverage detected