The most interesting capability of Sarvdap, researchers say, is present within the original code: a hardcoded list of commonly known blacklist servers. However, because the server was offline during analysis, the security researchers couldn’t determine what exactly the configuration contained. If the C&C is online and the Real-time Blackhole List (RBL) checks are passed, a configuration file is downloaded. Should the host be blacklisted, the malware terminates itself. In the event that the IP isn’t blacklisted, the malware starts beaconing to the hardcoded command and control (C&C) server over TCP port 2352. Next, the malware checks the Internet connection by attempting to connect to and, if the check passes, it starts enumerating multiple blacklist feeds to verify the host IP’s reputation status. Next, the malware injects the main bot code into this process, checks the system for a debugger to ensure it isn’t being analyzed, and creates the mutex “ Start_Main_JSM_complete”. Commonly downloaded by the Andromeda botnet, the spambot has been used to deliver pharmaceutical spam and to distribute the main Andromeda bot to more targets.Īfter initial execution, Sarvdap drops a copy of itself into the %windir% folder, launches a new svchost.exe process, and then initializes itself by allocating memory. While other spambots typically start sending spam emails as soon as a host has been infected, Sarvdap first checks to see whether the IP isn’t on a blacklist, and shuts itself down if it is. Usage: wa-spam.The Sarvdap spambot was recently observed checking the IP addresses of infected hosts against common blacklists, in an attempt to ensure that its spam email is successfully delivered, Palo Alto Networks security researchers reveal. Use the following command to get more help. Python3 hw.py 'Subash Mylraj' 'spam test!' 5 The third argument is the number of times that the message needs to be sent.

The first argument is the name of the chat. We use it here to link our script and the browser. Geckodriver is a web browser engine used by mozilla firefox. The setup file installs splinter, argparse and geckodriver. It showcases the capability of automation possible using the splinter library. This repository is a mere attempt to automate sending messages on whatsapp. The author of this repository is not responsible for any nuisance caused. It uses the splinter library to type and mouse-click.ĭISCLAIMER: The contents of this repository were written only for educational purposes and not to cause trouble or annoyance to any person or group of persons. This script can send a finite amount of messages to a chat on whatsapp. A python script to spam a chat on whatsapp! Introduction

Whatsapp spambot