From 4cf48f7e8a1e36d438d2764dccaab579b0610cca Mon Sep 17 00:00:00 2001 From: Cutieguwu Date: Mon, 12 Jun 2023 12:13:26 -0400 Subject: [PATCH] Create Detectowor.py Preemptively adding needed format for signature checking functions and notes for future. Suspicious files data is temporarily hard-coded into the script until read from file is added before sync database to updated version functionality added. --- Detectowor.py | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 Detectowor.py diff --git a/Detectowor.py b/Detectowor.py new file mode 100644 index 0000000..3259c07 --- /dev/null +++ b/Detectowor.py @@ -0,0 +1,21 @@ +from sys import exit + +#Need some form of OS detection for Windows vs Linux + +def init_lib_linux_filesearch(): + sus_linux_files_fractureiser["~/.config/.data/lib.jar", "~/.config/systemd/user/systemd-utility.service", "/etc/systemd/system/systemd-utility.service"] + sus_linux_files_skyrage["/bin/vmd-gnu", "/etc/systemd/system/vmd-gnu.service"] + +def init_lib_win_filesearch(): + sus_win_files_fractureiser[r'%LOCALAPPDATA%\\Microsoft Edge\\libWebGL64.jar'] + sus_win_files_skyrage[r'%AppData%\\Microsoft\\Start Menu\\Programs\\Startup\\jawaw.jar', r'%AppData%\\..\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\microsoft-vm-core'] + +def init_lib_linux(): + init_lib_linux_filesearch() + print("Signature checks not implemented yet.") + +def init_lib_win(): + init_lib_win_filesearch() + print("Signature checks not implemented yet.") + +# if OS is Windows, do Windows inits, elif OS is Linux, do Windows inits \ No newline at end of file