Locked Simple Telegraph Stealer, C ++

[dEEpEst]

Introduction
Hay, today we’ll talk about what a stiller is and even write a demo, the panel will be written in the second part (if we get a lot of likes xD). What is a styler?

A stiller is a certain class of trojans (malware, viruses - whatever you want), the functionality of which consists entirely of theft of passwords stored in the system, other information and sending them to the creator. Stiller, taking advantage of the Chukchi naivetyprogrammers, explores the repositories of frequently used programs and brazenly fishes from there all logins, passwords, etc. The next, he is the last stage of the work of the programs of this class - sending snacks to the attacker. Here somehow it all up and running.

 

We will write in C ++ ( HARDCOR ), but using third-party libraries (for example, libcurl), in order to simplify the task, you can rewrite this malware using WinApi exclusively to get rid of unnecessary dependencies. We will have implemented only the most basic functions:

 

• Stilling passwords from "all" browsers on Chromium
• Obtaining information about the system
• screenshots

What is the “trick” of our stiller
Usually, the stiller sends the received information to the mail, but this is not very practical / convenient, our stiller will send all the data to the server, but it will not be issued to your mother . We will use Telegraph, a service for posting articles (mainly used in Telegram). This way we increase our anonymity a bit. The panel will access the service through Tor, Proxy, etc. In Telegraph'a has its own API, which significantly simplifies our task.

Includes header file

Here we connect all the libraries we need, namespaces. Also, the following classes are described here:

 

• Config
• Converters

In the first class are given the needed values such as:

 

• Working directory
• Directory for «.bat» file (for removal)
• The name of the working directory
• Password for the final archive
• Page Telegraph, which will contain all the needed links (I will explain later)
• Access Token to edit pages on the Telegraph website

The second class describes methods that give us space for maneuvering with encodings (ASCII, Unicode)

 

This is the hidden content, please

• Sign In
• or
• Sign Up

 

Header file for working with WEB

Here we describe a class Web, it has the following methods / variables:

 

• EditPage, to edit the page Telegraph
• GetPage, for page content Telegraph
• UploadFile, to upload files to the site ( " 

  This is the hidden content, please

  • Sign In
  • or
  • Sign Up

   ")
• GetHTML, for page source
• Api, site API Telegraph'a (it is not blocked in Russia, so it should be no problem)

 

This is the hidden content, please

• Sign In
• or
• Sign Up