Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

What is this? #71

Closed
Nkaslqi opened this issue Nov 23, 2024 · 8 comments
Closed

What is this? #71

Nkaslqi opened this issue Nov 23, 2024 · 8 comments
Assignees
Labels
question Further information is requested

Comments

@Nkaslqi
Copy link

Nkaslqi commented Nov 23, 2024

So i obfuscated my code with Somalifuscator but once i open the obfuscated file, it creates a new file kdothzgdF.bat with this script inside:
@echo off
findstr /i "echo" "C:\Users\Kernel\Downloads\KlausTweaks.bat"
if %errorlevel% == 0 ( taskkill /f /im cmd.exe ) else ( (goto) 2>nul & del "%~f0" )

then it opens my file for a second then it closes with this:

Screenshot 2024-11-22 220001

why is that? any fix?

@Nkaslqi Nkaslqi added the question Further information is requested label Nov 23, 2024
@KingKDot
Copy link
Owner

So i obfuscated my code with Somalifuscator but once i open the obfuscated file, it creates a new file kdothzgdF.bat with this script inside:

@echo off

findstr /i "echo" "C:\Users\Kernel\Downloads\KlausTweaks.bat"

if %errorlevel% == 0 ( taskkill /f /im cmd.exe ) else ( (goto) 2>nul & del "%~f0" )

then it opens my file for a second then it closes with this:

Screenshot 2024-11-22 220001

why is that? any fix?

That's weird I've never seen that error before. It's supposed to be checking to see if unobfuscated echo statments are present within your script (people trying to reverse) but findstr is breaking most likely due to weird characters present within your file. Today I will make an option to turn that off. Thank you for showing me.

@Nkaslqi
Copy link
Author

Nkaslqi commented Nov 26, 2024

So i obfuscated my code with Somalifuscator but once i open the obfuscated file, it creates a new file kdothzgdF.bat with this script inside:
@echo off
findstr /i "echo" "C:\Users\Kernel\Downloads\KlausTweaks.bat"
if %errorlevel% == 0 ( taskkill /f /im cmd.exe ) else ( (goto) 2>nul & del "%~f0" )
then it opens my file for a second then it closes with this:
Screenshot 2024-11-22 220001
why is that? any fix?

That's weird I've never seen that error before. It's supposed to be checking to see if unobfuscated echo statments are present within your script (people trying to reverse) but findstr is breaking most likely due to weird characters present within your file. Today I will make an option to turn that off. Thank you for showing me.

ohh alr ty, i also tested a file with chcp 65001, because i had some symbols and Somalifuscator didnt even load showing an error

@Nkaslqi
Copy link
Author

Nkaslqi commented Nov 27, 2024

So i obfuscated my code with Somalifuscator but once i open the obfuscated file, it creates a new file kdothzgdF.bat with this script inside:
@echo off
findstr /i "echo" "C:\Users\Kernel\Downloads\KlausTweaks.bat"
if %errorlevel% == 0 ( taskkill /f /im cmd.exe ) else ( (goto) 2>nul & del "%~f0" )
then it opens my file for a second then it closes with this:
Screenshot 2024-11-22 220001
why is that? any fix?

That's weird I've never seen that error before. It's supposed to be checking to see if unobfuscated echo statments are present within your script (people trying to reverse) but findstr is breaking most likely due to weird characters present within your file. Today I will make an option to turn that off. Thank you for showing me.

fixed, it works now, the only problem is that it takes a lot to load all the functions once i open the obfuscated file, it seems like he does 1 line of code every 5 seconds, even more if i use the utf-16-bom option, maybe because it takes a bit to decrypt it, or maybe i did something wrong, let me know

edit: i tried with a small size file and it works, so i think its because the file size is big

@KingKDot
Copy link
Owner

So i obfuscated my code with Somalifuscator but once i open the obfuscated file, it creates a new file kdothzgdF.bat with this script inside:
@echo off
findstr /i "echo" "C:\Users\Kernel\Downloads\KlausTweaks.bat"
if %errorlevel% == 0 ( taskkill /f /im cmd.exe ) else ( (goto) 2>nul & del "%~f0" )
then it opens my file for a second then it closes with this:
Screenshot 2024-11-22 220001
why is that? any fix?

That's weird I've never seen that error before. It's supposed to be checking to see if unobfuscated echo statments are present within your script (people trying to reverse) but findstr is breaking most likely due to weird characters present within your file. Today I will make an option to turn that off. Thank you for showing me.

fixed, it works now, the only problem is that it takes a lot to load all the functions once i open the obfuscated file, it seems like he does 1 line of code every 5 seconds, even more if i use the utf-16-bom option, maybe because it takes a bit to decrypt it, or maybe i did something wrong, let me know

edit: i tried with a small size file and it works, so i think its because the file size is big

The cmd.exe interpreter is extremely slow once it needs to evalute over 1.6k lines lol

@Nkaslqi
Copy link
Author

Nkaslqi commented Dec 2, 2024

So i obfuscated my code with Somalifuscator but once i open the obfuscated file, it creates a new file kdothzgdF.bat with this script inside:
@echo off
findstr /i "echo" "C:\Users\Kernel\Downloads\KlausTweaks.bat"
if %errorlevel% == 0 ( taskkill /f /im cmd.exe ) else ( (goto) 2>nul & del "%~f0" )
then it opens my file for a second then it closes with this:
Screenshot 2024-11-22 220001
why is that? any fix?

That's weird I've never seen that error before. It's supposed to be checking to see if unobfuscated echo statments are present within your script (people trying to reverse) but findstr is breaking most likely due to weird characters present within your file. Today I will make an option to turn that off. Thank you for showing me.

fixed, it works now, the only problem is that it takes a lot to load all the functions once i open the obfuscated file, it seems like he does 1 line of code every 5 seconds, even more if i use the utf-16-bom option, maybe because it takes a bit to decrypt it, or maybe i did something wrong, let me know
edit: i tried with a small size file and it works, so i think its because the file size is big

The cmd.exe interpreter is extremely slow once it needs to evalute over 1.6k lines lol

just one more thing, why the .rar is automatically detected by Microsoft Defender even if it's password protected, can't even download it, 1 week ago was normal

@KingKDot
Copy link
Owner

KingKDot commented Dec 2, 2024

So i obfuscated my code with Somalifuscator but once i open the obfuscated file, it creates a new file kdothzgdF.bat with this script inside:
@echo off
findstr /i "echo" "C:\Users\Kernel\Downloads\KlausTweaks.bat"
if %errorlevel% == 0 ( taskkill /f /im cmd.exe ) else ( (goto) 2>nul & del "%~f0" )
then it opens my file for a second then it closes with this:
Screenshot 2024-11-22 220001
why is that? any fix?

That's weird I've never seen that error before. It's supposed to be checking to see if unobfuscated echo statments are present within your script (people trying to reverse) but findstr is breaking most likely due to weird characters present within your file. Today I will make an option to turn that off. Thank you for showing me.

fixed, it works now, the only problem is that it takes a lot to load all the functions once i open the obfuscated file, it seems like he does 1 line of code every 5 seconds, even more if i use the utf-16-bom option, maybe because it takes a bit to decrypt it, or maybe i did something wrong, let me know
edit: i tried with a small size file and it works, so i think its because the file size is big

The cmd.exe interpreter is extremely slow once it needs to evalute over 1.6k lines lol

just one more thing, why the .rar is automatically detected by Microsoft Defender even if it's password protected, can't even download it, 1 week ago was normal

no idea. Maybe its the command line stuff idk. Try just building one normally then using winrar or 7z yourself to add a password

@Nkaslqi
Copy link
Author

Nkaslqi commented Dec 2, 2024

So i obfuscated my code with Somalifuscator but once i open the obfuscated file, it creates a new file kdothzgdF.bat with this script inside:
@echo off
findstr /i "echo" "C:\Users\Kernel\Downloads\KlausTweaks.bat"
if %errorlevel% == 0 ( taskkill /f /im cmd.exe ) else ( (goto) 2>nul & del "%~f0" )
then it opens my file for a second then it closes with this:
Screenshot 2024-11-22 220001
why is that? any fix?

That's weird I've never seen that error before. It's supposed to be checking to see if unobfuscated echo statments are present within your script (people trying to reverse) but findstr is breaking most likely due to weird characters present within your file. Today I will make an option to turn that off. Thank you for showing me.

fixed, it works now, the only problem is that it takes a lot to load all the functions once i open the obfuscated file, it seems like he does 1 line of code every 5 seconds, even more if i use the utf-16-bom option, maybe because it takes a bit to decrypt it, or maybe i did something wrong, let me know
edit: i tried with a small size file and it works, so i think its because the file size is big

The cmd.exe interpreter is extremely slow once it needs to evalute over 1.6k lines lol

just one more thing, why the .rar is automatically detected by Microsoft Defender even if it's password protected, can't even download it, 1 week ago was normal

no idea. Maybe its the command line stuff idk. Try just building one normally then using winrar or 7z yourself to add a password

i tried to put a blank file other than the .bat inside the .rar and it works, kinda weird

@KingKDot
Copy link
Owner

KingKDot commented Dec 3, 2024

Wow. No idea then.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
question Further information is requested
Projects
None yet
Development

No branches or pull requests

2 participants