Malware writing - Python malware, part 1

[dtm]

@tr4cefl0w

Look at that CPU usage! It’s caused by the code being interpreted and the infinite loop with while True: . We’ll likely (try to) fix that in the future with a timer or by converting to C with Cython.

I would like to point out there is an event-based method that performs better than GetAsncKeyState which is via SetWindowsHookEx with the WH_KEYBOARD_LL hook type that can install a global monitor on keystrokes. Please refer to LowLevelKeyboardProc for the callback function details. For an example (in C), you can refer to my previous thread on Windows Keylogging (shameless self-promotion ).

@tr4cefl0w

import ctypes # For interfacing with C functions 
import logging # For logging the keystrokes on disk 

kernel32 = ctypes.windll.kernel32 # Access functions from kernel32.dll 
user32 = ctypes.windll.user32 # Access functions from user32.dll 

user32.ShowWindow(kernel32.GetConsoleWindow(), 0) # Hide console

I’m assuming the reason you need this is because you’re building a console application. If you can get it to build with the Windows (GUI) subsystem, it removes the console prompt entirely, making this code redundant. It’s also good to note that if you do this, you may need the Windows Message Loop to keep the application alive. It’ll be needed to obtain messages for the keystrokes from SetWindowsHookEx as well.

As for the clipboard monitor, there are a few ways to do it. MSDN documents one way through GetClipboardSequenceNumber that uses a 32-bit “clipboard sequence number” to track different clipboard contents. It also documents an event-based listener with AddClipboardFormatListener with the WM_CLIPBOARDUPDATE window message (requires a window). Here is some PoC code that demonstrates the latter: ClipboardMonitor.c.

EDIT: I just realised that your code might not account for right-click → copy.

Looking forward to the rest of the series!