Skip to content

CirqueiraDev/InfoStealer-Research

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

29 Commits
 
 
 
 
 
 

Repository files navigation

Info Stealer-Research

These tools collect sensitive data and can be abused. Use this repository ONLY for legitimate security research, authorized auditing, or educational study. Do NOT use for activities that violate privacy or the law.


Legal Notice ‼

The creator is not responsible for any misuse of this repository; all responsibilities and damages caused by creating and distributing malware are entirely the user's responsibility.


Stealer Functions

roblox_cookies.py

  • Searches for Roblox session cookies (.ROBLOSECURITY) across multiple browsers, tries them against the Roblox API to retrieve account data, and writes found accounts into a file inside a ZIP.

browser_steal.py

  • Scans browser profiles to extract extensions, saved passwords, cookies, history, downloads and card data; decrypts when needed and writes those items to files inside a ZIP.

discord_token.py

  • Searches for Discord tokens in local browser/client files and databases, validates those tokens with the Discord API, collects account details (username, id, billing, Nitro, etc.), and records them to a file.

interesting_files.py

  • Searches user folders (Desktop, Downloads, Documents, Recent, etc.) for files with keyword names related to accounts, wallets, keys, backups, and copies those files into an “Interesting Files” folder inside the ZIP.

Anti_VM_Debug.py

  • Runs anti-analysis checks: detects active debuggers, reverse-engineering processes, usernames/hosts/HWIDs associated with virtual machines or analysis environments, and returns true if signs of VM/debugging are found.

Bypass AV and Ofuscation

marshal.py

  • Compiles the code, serializes it with the marshal module, encodes it in base64 (and optionally compresses it with zlib), and generates a new script that, when executed, decodes and runs the original code in memory

Result

pyinstaller + marshal compress = true

image

Virustotal Link


only pyinstaller

image

Virustotal Link


Remember!

Information and code provided on this repository are for educational purposes only. The creator is no way responsible for any direct or indirect damage caused due to the misusage of the information. Everything you do, you are doing at your own risk and responsibility.

Credits:

  • Coded by CirqueiraDev
  • Discord: Cirqueira
  • Instagram