Trying to decrypt VB .Net keyloggers

[Darwin226]

[QUOTE=benjojo;34924010]You mean the web browsers?
They are encrypted.[/QUOTE]

Well browsers can obviously decrypt them. I'm sure there's a way to do it.

[superbird]

[QUOTE=benjojo;34924010]You mean the web browsers?
They are encrypted.[/QUOTE]
Most RATs will send them.

[Geel]

If you just send the cookies, you can stick them in your browser and it logs into the website automatically.

[justastranger]

[IMG]http://gyazo.com/d5f1fae46b353822bccd5adf317ba1a3.png?1330522278[/IMG]
NOPE, no phishing scam here!

I think I found the good part...
[url]http://pastebin.com/NbMb12AY[/url]

I couldn't find anything on that one, so I moved on, got in, and am now messing with an account...
[url]http://pastebin.com/DYKZi2GR[/url]
Deleted the account, after snagging some attachments he had recieved...

Apparently the guy works here: [url]http://www.triumph.co.uk/[/url]

[supersnail11]

[url]http://www.youtube.com/watch?v=QXbJNM435bQ[/url]
Every keylogger I find comes from United States, the Netherlands, or Lithuania.
This one was pretty difficult as they used Chinese chars to obfuscate.

[KatrinaS]

the next youtube account I get form a phisher, i am using to comment on other phishing vids about how much of a fake both videos are

[Blade]

I feel like we should be keeping an index. Anyways, here is another if someone wants to go looking. He is from new zealand but you can get around the area lockout by providing the recovery email listed below.

[url]http://www.youtube.com/watch?v=FXBg9LE_n0o[/url]
[email][e-mail][/email]:serverserver
[email][e-mail][/email]
[email][e-mail][/email]
Hamed Rahimi

Another less interesting one.

[url]http://www.youtube.com/watch?v=9hlfhjlAfPc[/url]
[email][e-mail][/email]:sterner23

[supersnail11]

I have a shit load of cracked emails that I forgot the email for. Lemme see if I can find any and I'll set something up.

[editline]29th February 2012[/editline]

Password for all of these is "fpwhalers"
[email][e-mail][/email]
[email][e-mail][/email]
[email][e-mail][/email]
[email][e-mail][/email] (password: humptydumpty33 gmail won't let me login - wrong location. someone tell me when this is fixed)

[Blade]

This guy that I posted yesterday is at it again. He is a little mad about it.

[t]http://img208.imageshack.us/img208/3513/jrpiufzzplkqq.png[/t]

Those 3 methods are just for killing wireshark.

[marvincmarvin]

Kids with their overcomplicated code these days..

[csharp]
foreach(Process process in Process.GetProcesses())
if(process.ProcessName == "wireshark")
Process.GetCurrentProcess().Kill(); //or process.Kill();
[/csharp]

[Yogurt]

[QUOTE=marvincmarvin;34938119]Kids with their overcomplicated code these days..

[csharp]
foreach(Process process in Process.GetProcesses())
if(process.ProcessName == "wireshark")
Process.GetCurrentProcess().Kill(); //or process.Kill();
[/csharp][/QUOTE]

But that would close the application running the code...

[marvincmarvin]

[QUOTE=Yogurt;34938160]But that would close the application running the code...[/QUOTE]

It would also prevent me from seeing their email address in wireshark.

[editline]...[/editline]

Or any other packets they want to send.

[Yogurt]

[QUOTE=marvincmarvin;34938198]It would also prevent me from seeing their email address in wireshark.

[editline]...[/editline]

Or any other packets they want to send.[/QUOTE]

There are much better ways of doing it than closing your own process.

[sim642]

[QUOTE=marvincmarvin;34938198]It would also prevent me from seeing their email address in wireshark.

[editline]...[/editline]

Or any other packets they want to send.[/QUOTE]

Just rename your wireshark executable and you're good to go.

[Naarkie]

[QUOTE=marvincmarvin;34938119]Kids with their overcomplicated code these days..

[csharp]
foreach(Process process in Process.GetProcesses())
if(process.ProcessName == "wireshark")
Process.GetCurrentProcess().Kill(); //or process.Kill();
[/csharp][/QUOTE]
How did you get comments?

[Darwin226]

[QUOTE=Naarkie;34942573]How did you get comments?[/QUOTE]

He wrote that code to show how it can be done much simpler.

[Naarkie]

[QUOTE=Darwin226;34942598]He wrote that code to show how it can be done much simpler.[/QUOTE]
Oh, right. Rate me box.

[OldFusion]

You could escalate wire-shark to SYSTEM privileges so any simple virus wont be able to close or mess with it.

[danharibo]

[QUOTE=OldFusion;34942666]You could escalate wire-shark to SYSTEM privileges so any simple virus wont be able to close or mess with it.[/QUOTE]

Except in that snippet, it's killing itself, not wireshark.

[Dame Flawless]

Just so you guys know the reason they are using visual basics is because it is much easy to copy and paste it than C++ or at least to them

[StaT]

^its 100x easy'er to send emails in vb and vb.net
and true for the C&P part also

[supersnail11]

[QUOTE=StaT;34944136]^its 100x easy'er to send emails in vb and vb.net
and true for the C&P part also[/QUOTE]

C#

Also it would be disastrous if someone made a keylogger in C++

[Dame Flawless]

[QUOTE=supersnail11;34945066]Also it would be disastrous if someone made a keylogger in C++[/QUOTE]

In what way?

[benjojo]

[QUOTE=Dame Flawless;34945108]In what way?[/QUOTE]

.Net you can easily reverse the code, C++ are ~pure~ binary's and are much more work to reverse engineer.

[Giacomand]

[QUOTE=benjojo;34945135].Net you can easily reverse the code, C++ are ~pure~ binary's and are much more work to reverse engineer.[/QUOTE]

Is there a limit though? You couldn't just reverse a game like Terraria and get it's source code, could you?

[KatrinaS]

[QUOTE=Giacomand;34945304]Is there a limit though? You couldn't just reverse a game like Terraria and get it's source code, could you?[/QUOTE]

yes, you can, and thanks to that there is several modded terraria servers/clients allready

[gparent]

No one bothers killing Wireshark because anyone with a brain realizes that you can just do the wiresharking somewhere else than the PC you're running the networked app on.
[QUOTE=marvincmarvin;34938198]It would also prevent me from seeing their email address in wireshark.
Or any other packets they want to send.[/QUOTE]
For about half a minute.

[Dame Flawless]

[QUOTE=benjojo;34945135].Net you can easily reverse the code, C++ are ~pure~ binary's and are much more work to reverse engineer.[/QUOTE]

Its still very easy, when the stuff is made by idiots so I wouldn't call it disastrous.

[supersnail11]

[QUOTE=Dame Flawless;34945587]Its still very easy, when the stuff is made by idiots so I wouldn't call it disastrous.[/QUOTE]

Have you ever tried decompiling a C++ application? Visual Basic/C# are not raw executables, they are stored in a way that allows them to be decompiled to comprehensible code. Even if you could do the same to C++, the code that comes out of it would be so incomprehensible that it would be useless. The compiler doesn't compile the C++, it converts it to Assembly and compiles that. Which means it is MUCH, MUCH harder to decompile a C++ application.

[Darwin226]

[QUOTE=supersnail11;34945802]Have you ever tried decompiling a C++ application? Visual Basic/C# are not raw executables, they are stored in a way that allows them to be decompiled to comprehensible code. Even if you could do the same to C++, the code that comes out of it would be so incomprehensible that it would be useless. The compiler doesn't compile the C++, it converts it to Assembly and compiles that. Which means it is MUCH, MUCH harder to decompile a C++ application.[/QUOTE]

Don't quote me on this but, provided the person coding the C++ application is of the same skill as the VB coder, the strings have to be stored one way or another. They are still in that executable and can be extracted.
So if he mentions his email as a string, chances are that the password is somewhere near it.