This is a File Stealer written in Python. As of the 07/05/23, this is undetectable in virus total. This is malware designed as powerful file stealer to steal all the files from a victims computer and then forward the files to a discord WebHook.
This is software designed to steal all of the files from a victims computer. It does this by:
- Blacking out the victims screen.
- Blocking keyboard inputs into the program so it cant be stopped directly via the commandline when running.
- All of the open applications are hidden both from view, but also from the taskbar so they cant be re-opened.
- Recursively searching through all of the drives and directories found on a computer
- Finding files which meet the criteria to be sent
- Sending all the files which meet the criteria to a Discord webhook
All you need to do to have this program work is place your discord webhook in the WEBHOOK_URL section:
WEBHOOK_URL = "place your discord webhook here"
- You will need python installed to use this. If you don't have it installed look here
- Clone the github repository
- Unzip the downloded zip file to a location of your choice
- Go to the place of which you unziped the zip file and open the stealer8.py file in a python IDE of your choice.
- Go to the WEBHOOK_URL variable and in the code, and place your discord webhook where it says to -
WEBHOOK_URL = 'place your discord webhook here' - Send this to anyone who has python installed and when they run this, this will immediately start sending files.
Extra Steps As this is a python file - this will only run if the victim has python installed, so to get round this, this can be complied into executable file.
- First install pyinstaller in cmd (command prompt) -
pip install pyinstaller - open cmd in the file which you have the python script and use the command -
pyinstaller --onefile stealer8.py - i would recommend you renaming the executable file after this as 'stealer8.exe' is quite a giveaway.
- You can send this file to anyone, and they will be able to run this even if they don't have python installed.
As of the 07/05/23 this cannot be detected in virus total when its just as a python script, to look see here. However, when this script is compliled into an executable file, six detections are made in virus total (note that I have changed the name of the executable file) to see, look here.
If you have been affected by this software, there should be no worry of infection, this software has no persistence capablities as of now, and can't be used to remotely access or control a victim machine in its current form.
This program has an in built blacklisting function, if you wish to blacklist more directories, just add them in. If you don't want any blacklisting, just delete the contecnts of the blacklisting variable and replace it with two apostrophes. This program also has a set list of accepted file extensions, so if you want more file types to be sent just add them in as you wish.
This is designed for a windows based operating system at the moment - in the future I will attempt to make it so that this can be used for any type of operating system.
if you have found a bug in the code, use the issue tab above. If you would like to submit a PR with a fix, reference the issue you are fixing. If you are looking for new features, use the suggestion function in the issues tab above to do so.
This project has been Licenced under the GNU Affero General Public License v3.0. It can be found at LICENCE
This was a program designed for education purposes only. I do not accept any responsiblity for the usage of the software for illegal or malicious purposes, nor do I condone it.