ryry-cli 7.32
Remote task execution backdoor
“ryry tools”
Remote Python widget task workerryry-cli host profile reporting to C2
SHA-256396582a8bc8c47b8e115e6309b6cbfb879f5150da85dd36a3ef23b99051e281f
Evidence
1import uuid
2import platform
3import subprocess
4import os
5import sys
6import requests
7import time
8import warnings
⋯4 lines
⋯7 lines
26import json
27from pathlib import Path
28import socket
29import re
30import tempfile
31from concurrent.futures import ThreadPoolExecutor
32from PIL import Image
33from ryry import constant
34
35NETWORK_PROBE_TIMEOUT_SECONDS = 10
36NETWORK_WHEREAMI_URL = "https://api.dalipen.com/whereami"
37NETWORK_ALIYUN_GUANGZHOU_URL = "https://p-upload-gz.oss-cn-guangzhou.aliyuncs.com/"
38NETWORK_GOOGLE_HTTP_URL = "https://www.gstatic.com/generate_204"
39NETWORK_LATENCY_DECISIVE_RATIO = 1.5
⋯9 lines
70:6… ry:
71 root_path = '/sys/class/net/'
72 for dbtype in os.listdir(root_path):
73 address_path = os.path.join(root_path, dbtype, "address")
74 if not os.path.isfile(address_path):
75 continue
76 with open(address_path, "r", encoding="utf-8", errors="ignore") as f:
77 mac = _normalize_mac(f.read())
78 if mac:
79 return True, mac
80 return False, None
81 e …
⋯6 lines
91 if ok:
92 return mac_value
93 if platform.system() == 'Linux':
94 ok, mac_value = get_mac_from_system()
95 if ok:
96 return mac_value
97 try:
98 node = uuid.getnode()
99 # uuid.getnode() may return a random multicast address when no real
100 # hardware address can be found. Ignore tha …
115
116 if platform.system() == 'Windows':
117 cmd = "wmic cpu get ProcessorId"
118 output = subprocess.check_output(cmd, shell=True)
119 output_str = output.decode('gbk')
120 pos = output_str.index("\n")
121 cpu_serial = output_str[pos:].strip()
122 elif platform.system() == 'Linux':
123 with open('/proc/cpuinfo') as f:
124
125 for line in f:
126 if line[0:6] == 'Serial':
127 return "1"
128 if …
Showing the top 5 files — 7 more files (110 regions) not shown.
No evidence locations were recorded for this file. Raw result