NXcrypt - Framework to create backdoors in python [Video]

NXcrypt

NXcrypt is a polymorphic crypto "back door" written in python by Hadi Mene (h4d3s). The output is totally undetectable.

NXcrypt can inject malicious python files into a normal file with multi-threading system.

Run it with superuser permissions.

The output of NXcrypt is totally undetectable.

Mode of use

sudo ./NXcrypt.py --file=backdoor.py --output=output_backdoor.py # encrypt backdoor.py and output file is output_backdoor.py

sudo ./NXcrypt.py --file=shell.py # encrypt shell.py and default output file is backdoor.py but you can edit it in source code

sudo ./NXcrypt.py --help # NXcrypt help

sudo ./NXcrypt.py --backdoor-file=payload.py --file=test.py --output=hacked.py # inject payload.py with test.py into hacked.py with multi-threading system

How does it work

Encryption module:
NXcrypt adds some unwanted codes.
NXcrypt uses an internal python module 'py_compile' that compiles the code into bytecode in a .pyc file.
NXcrypt convert .pyc file to normal .py file.
And in this way we can obfuscate the code
The md5sum will also change
Injection module:
A malicious python file is injected into a normal file with multi-threading system.

Test in total virus
Before:
SHA256: e2acceb6158cf406669ab828d338982411a0e5c5876c2f2783e247b3e01c2163 File name: facebook.py Detection ratio : 2/54
After:
SHA256: 362a4b19d53d1a8f2b91491b47dba28923dfec2d90784961c46213bdadc80add File name: facebook_encrypted.py Detection ratio: 0/55