├── .gitattributes ├── .gitignore ├── IDAScripts ├── dec_strings_screen.JPG ├── enc_strings_screen.JPG └── ida_python_zbot_string_decrypter.py ├── Infected_Advapi32.pdf ├── MWDownloader.py ├── Readme.md ├── TrojanSwifiShellcodeDecryptor.py ├── VBSDunihiUninstaller.py ├── decrypt_miniduke_str.py ├── decrypt_zelix_klassmaster_str.py ├── decryptor_hammertoss.py ├── logged_key_decryptor.py ├── md5_icons.py ├── rtf_obj_extractor.py └── upatre_icon_extractor.py /.gitattributes: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/.gitattributes -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/.gitignore -------------------------------------------------------------------------------- /IDAScripts/dec_strings_screen.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/IDAScripts/dec_strings_screen.JPG -------------------------------------------------------------------------------- /IDAScripts/enc_strings_screen.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/IDAScripts/enc_strings_screen.JPG -------------------------------------------------------------------------------- /IDAScripts/ida_python_zbot_string_decrypter.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/IDAScripts/ida_python_zbot_string_decrypter.py -------------------------------------------------------------------------------- /Infected_Advapi32.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/Infected_Advapi32.pdf -------------------------------------------------------------------------------- /MWDownloader.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/MWDownloader.py -------------------------------------------------------------------------------- /Readme.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/Readme.md -------------------------------------------------------------------------------- /TrojanSwifiShellcodeDecryptor.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/TrojanSwifiShellcodeDecryptor.py -------------------------------------------------------------------------------- /VBSDunihiUninstaller.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/VBSDunihiUninstaller.py -------------------------------------------------------------------------------- /decrypt_miniduke_str.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/decrypt_miniduke_str.py -------------------------------------------------------------------------------- /decrypt_zelix_klassmaster_str.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/decrypt_zelix_klassmaster_str.py -------------------------------------------------------------------------------- /decryptor_hammertoss.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/decryptor_hammertoss.py -------------------------------------------------------------------------------- /logged_key_decryptor.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/logged_key_decryptor.py -------------------------------------------------------------------------------- /md5_icons.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/md5_icons.py -------------------------------------------------------------------------------- /rtf_obj_extractor.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/rtf_obj_extractor.py -------------------------------------------------------------------------------- /upatre_icon_extractor.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ptr32Void/AnalysisScript/HEAD/upatre_icon_extractor.py --------------------------------------------------------------------------------