악성코드 샘플 수집 스크립트
(종류별 300개 수집)

"""
    samples/
    ├── 1_Trojan/
    ├── 2_Ransomware/
    ├── 3_RAT/
    ├── 4_Keylogger/
    ├── 5_Infostealer/
    ├── 6_Backdoor/
    ├── 7_Downloader/
    ├── 8_Miner/
    └── 9_Worm/
"""

import requests
import os
import sys
import io
import time
import json
from pathlib import Path

try:
    import pyzipper
except ImportError:
    print("pyzipper 설치 필요: pip install pyzipper")
    sys.exit(1)

# ══════════════════════════════════════════════════════════
# 설정
# ══════════════════════════════════════════════════════════

API = "https://mb-api.abuse.ch/api/v1/"
SAVE_DIR = Path(__file__).parent / "samples"
SAMPLES_PER_CLASS = 300

CLASS_NAMES = {
    1: "Trojan", 2: "Ransomware", 3: "RAT",
    4: "Keylogger", 5: "Infostealer", 6: "Backdoor",
    7: "Downloader", 8: "Miner", 9: "Worm",
}

SIGS = {
    1: ["AgentTesla","Formbook","Emotet","TrickBot","Qakbot",
        "Dridex","Ursnif","DarkTortilla","GCleaner","Pikabot","BumbleBee"],
    2: ["LockBit","Conti","Stop","STOP","BlackCat","REvil",
        "Ryuk","Maze","Phobos","Djvu","BlackBasta","Akira","Play","Clop"],
    3: ["AsyncRAT","NjRAT","DarkComet","QuasarRAT","Remcos","RemcosRAT",
        "NetWire","XWorm","Warzone","WarzoneRAT","DCRat","VenomRAT",
        "ValleyRAT","OrcusRAT","Gh0stRAT","DarkVisionRAT","zgRAT"],
    4: ["SnakeKeylogger","HawkEye","MassLogger","VIPKeylogger","a310Logger"],
    5: ["Vidar","RedLine","Raccoon","LokiBot","AZORult","StealC",
        "Lumma","LummaStealer","PhantomStealer","ACRStealer",
        "RaccoonStealer","RedLineStealer","MetaStealer"],
    6: ["CobaltStrike","Metasploit","ShadowPad","PlugX",
        "SliverFox","EternalRocks","Sliver"],
    7: ["GuLoader","SmokeLoader","Smoke Loader","Amadey",
        "BazarLoader","IcedID","BatLoader","PrivateLoader"],
    8: ["CoinMiner","XMRig"],
    9: ["Phorpiex","Ramnit","Neshta","Virut"],
}


# ══════════════════════════════════════════════════════════
# 핵심 함수
# ══════════════════════════════════════════════════════════

def make_session(api_key: str) -> requests.Session:
    sess = requests.Session()
    sess.headers.update({"Auth-key": api_key})
    return sess


def test_auth(sess: requests.Session) -> bool:
    try:
        r = sess.post(API,
            data={"query": "get_siginfo", "signature": "AgentTesla", "limit": 1},
            timeout=15)
        return r.json().get("query_status") in ("ok", "no_results")
    except:
        return False


def get_pe_hashes(sess: requests.Session, signature: str, limit: int = 100) -> list:
    """시그니처 → PE exe/dll SHA256 목록"""
    try:
        r = sess.post(API,
            data={"query": "get_siginfo", "signature": signature, "limit": limit},
            timeout=30)
        data = r.json()
        if data.get("query_status") != "ok":
            return []
        return [s["sha256_hash"] for s in data.get("data", [])
                if s.get("file_type") in ("exe", "dll")]
    except:
        return []


def download_one(sess: requests.Session, sha256: str, dest_dir: Path) -> bool:
    """샘플 1개 다운로드 → AES ZIP 해제 → PE 저장"""
    out = dest_dir / f"{sha256}.bin"
    if out.exists() and out.stat().st_size > 100:
        return True  # 이미 있음

    try:
        r = sess.post(API,
            data={"query": "get_file", "sha256_hash": sha256},
            timeout=60)

        if r.status_code != 200 or len(r.content) < 100:
            return False

        if r.content[:2] != b"PK":
            return False

        # pyzipper: AES 암호화 ZIP 지원
        with pyzipper.AESZipFile(io.BytesIO(r.content)) as zf:
            names = zf.namelist()
            if not names:
                return False
            data = zf.read(names[0], pwd=b"infected")
            if len(data) < 64 or data[:2] != b"MZ":
                return False
            out.write_bytes(data)
            return True

    except Exception:
        return False


# ══════════════════════════════════════════════════════════
# 메인
# ══════════════════════════════════════════════════════════

def main():
    print("=" * 60)
    print("  ZENIK ML — MalwareBazaar PE 자동 수집기")
    print("=" * 60)
    print()

    api_key = input("MalwareBazaar Auth-Key: ").strip()
    if not api_key:
        print("API Key를 입력하세요")
        sys.exit(1)

    sess = make_session(api_key)
    print("인증...", end=" ", flush=True)
    if not test_auth(sess):
        print("실패")
        sys.exit(1)
    print("OK\n")

    # 폴더 + 기존 수량
    counts = {}
    for cid, name in CLASS_NAMES.items():
        d = SAVE_DIR / f"{cid}_{name}"
        d.mkdir(parents=True, exist_ok=True)
        counts[cid] = len(list(d.glob("*.bin")))

    print(f"저장: {SAVE_DIR.absolute()}")
    print(f"목표: 클래스당 {SAMPLES_PER_CLASS}개\n")
    for cid, name in CLASS_NAMES.items():
        bar = "█" * (counts[cid] // 10)
        print(f"  [{cid}] {name:12s}: {counts[cid]:4d} {bar}")
    print()

    total_new = 0

    for cid, name in CLASS_NAMES.items():
        if counts[cid] >= SAMPLES_PER_CLASS:
            print(f"[{name}] {counts[cid]}개 — skip")
            continue

        need = SAMPLES_PER_CLASS - counts[cid]
        dest = SAVE_DIR / f"{cid}_{name}"
        got = 0

        print(f"\n[{name}] 필요: {need}개")
        print("-" * 50)

        for sig in SIGS[cid]:
            if got >= need:
                break

            # 해시 목록
            t0 = time.time()
            hashes = get_pe_hashes(sess, sig, limit=100)
            t_q = time.time() - t0

            if not hashes:
                print(f"  {sig:20s} → 0 PE ({t_q:.1f}s)")
                continue

            # 순차 다운로드
            t0 = time.time()
            dl = 0
            for sha in hashes:
                if got >= need:
                    break
                if download_one(sess, sha, dest):
                    got += 1
                    dl += 1
                    # 진행 표시
                    if dl % 10 == 0:
                        print(f"  {sig:20s} → {dl}/{len(hashes)}...", flush=True)
            t_d = time.time() - t0

            print(f"  {sig:20s} → +{dl:3d}/{len(hashes)} PE  "
                  f"({t_q:.1f}s + {t_d:.1f}s)")

        counts[cid] += got
        total_new += got
        print(f"  => [{name}] Total: {counts[cid]}")

    # 결과
    print("\n" + "=" * 60)
    print("  완료")
    print("=" * 60 + "\n")

    grand = 0
    for cid, name in CLASS_NAMES.items():
        n = counts[cid]
        bar = "█" * (n // 10)
        ok = "OK" if n >= SAMPLES_PER_CLASS else ".." if n >= 50 else "!!"
        print(f"  {ok} [{cid}] {name:12s}: {n:4d} {bar}")
        grand += n

    print(f"\n  Total: {grand}")
    print(f"  신규: {total_new}")
    print(f"  저장: {SAVE_DIR.absolute()}")

    with open(SAVE_DIR / "progress.json", "w") as f:
        json.dump({"counts": {str(k): v for k, v in counts.items()},
                    "total": grand}, f, indent=2)


if __name__ == "__main__":
    main()