Breaking down the python code

Github link - https://github.com/OklenCodes/SimpleTrojan/blob/main/Trojan/Trojan.py

"import psutil" module is for getting all the machine information like CPU usage and RAM usuage

"import base64" is for base64 encoding

"import time" is for the ability to the sleep the malware

"import gzip" will allow me to compress and decompress the malware

"import os" is to execute the malware

"def main (): " is for the main process, starting by forking a child process

Forking is like creating a new process under another process, usually a parent or main process.

First we check the process id, if it equals to 1, this means it is the parent process and it will execute the information to show disk usage, cpu usage and more. It will sleep for 2 seconds then continously loop the information while updating it.

However, If the process ID is equal to 2 or less than 0, that means that this is the child process and it will execute the trojan.

The information that is displayed and the 3 seconds of sleep

The Trojan function starts by opening a hidden file in write mode.

Then the blob is base64 decoded.

Next the blob is decompressed.

Following that, the base code 64 is written to the malware file,

then it is closed.

Finally the malware is executed.

Going forward

I think going forward I am going to look at creating malware in C++ so I can explore more low-level control over system resources