constant 0xConstant
0xConstant
/ offline_decryptor.ps1
Created
January 31, 2024 22:32
This script can be used by a Behemoth ransomware victim to decrypt files. It expects only one parameter and that is the path to the JSON file that contains the decrypted keys and IVs.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Parameter for JSON file path | |
| param( | |
| [Parameter(Mandatory = $true)] | |
| [string]$jsonFilePath | |
| ) | |
| # Ensure the JSON file exists | |
| if (-Not (Test-Path -Path $jsonFilePath)) { | |
| Write-Host "JSON file not found at $jsonFilePath" -ForegroundColor Red | |
| exit |
0xConstant
/ key_decryptor.ps1
Last active
January 31, 2024 22:31
This script can be used by a Behemoth ransomware operator to decrypt keys and IVs inside the JSON file that holds them using a private key. The decrypted keys and IVs are then shared with the victim and they will be given another script to decrypt their files.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Parameters for JSON file path and private key file path | |
| param( | |
| [Parameter(Mandatory = $true)] | |
| [string]$jsonFilePath, | |
| [Parameter(Mandatory = $true)] | |
| [string]$privateKeyPath | |
| ) | |
| # Check if the JSON file exists |
0xConstant
/ sphinx.vbs
Created
September 14, 2023 06:16
Read more about this script in here c0nstant.ca/public/1200/
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Dim pdf(1024) | |
| pdf(0) = "JVBERi0xLjcNCiW1tbW1DQoxIDAgb2JqDQo8PC9UeXBlL0NhdG" | |
| pdf(1) = "Fsb2cvUGFnZXMgMiAwIFIvTGFuZyhlbikgL1N0cnVjdFRyZWVS" | |
| pdf(2) = "b290IDEwIDAgUi9NYXJrSW5mbzw8L01hcmtlZCB0cnVlPj4vTW" | |
| pdf(3) = "V0YWRhdGEgMjAgMCBSL1ZpZXdlclByZWZlcmVuY2VzIDIxIDAg" | |
| pdf(4) = "Uj4+DQplbmRvYmoNCjIgMCBvYmoNCjw8L1R5cGUvUGFnZXMvQ2" | |
| pdf(5) = "91bnQgMS9LaWRzWyAzIDAgUl0gPj4NCmVuZG9iag0KMyAwIG9i" | |
| pdf(6) = "ag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZX" | |
| pdf(7) = "M8PC9Gb250PDwvRjEgNSAwIFI+Pi9FeHRHU3RhdGU8PC9HUzcg" | |
| pdf(8) = "NyAwIFIvR1M4IDggMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW" |
This file has been truncated, but you can view the full file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| google.com | |
| youtube.com | |
| tmall.com | |
| baidu.com | |
| qq.com | |
| sohu.com | |
| facebook.com | |
| taobao.com | |
| 360.cn | |
| jd.com |
0xConstant
/ insta-dw-tut-8.py
Created
March 10, 2020 20:23
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import tests | |
| video_url = input("Enter video URL: ") | |
| output_name = input("Enter output file name (i.e. sample.mp4): ") | |
| tests.my_module(video_url, output_name) |
0xConstant
/ insta-dw-tut-6.py
Created
March 10, 2020 20:19
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import requests | |
| import re | |
| def my_module(video_url_, output_name): | |
| """ | |
| This module can be used to download instagram videos, | |
| You can pass two arguments, video url & output name | |
| i.e. my_module('https://www.instagram.com/p/B82F0mJhiUV/', 'sample.mp4') | |
| """ |
0xConstant
/ insta-dw-tut-7.txt
Created
March 10, 2020 20:06
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Help on module tests: | |
| NAME | |
| tests | |
| FUNCTIONS | |
| my_module(video_url_, output_name) | |
| This module can be used to download instagram videos, | |
| You can pass two arguments, video url & output name | |
| i.e. my_module('https://www.instagram.com/p/B82F0mJhiUV/', 'sample.mp4') |
0xConstant
/ insta-dw-tut-5.py
Created
March 10, 2020 20:01
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import requests | |
| import re | |
| video_url_ = input("Enter video URL: ") | |
| output_name = input("Enter a name for the output file (i.e. sample.mp4): ") | |
| grab_source_code = requests.get(str(video_url_)) | |
| grab_video_link = re.search(r'"video_url":"(.*?)"', str(grab_source_code.text)).group(1) | |
| unicode_removed = grab_video_link.replace(r"\u0026", "&") |
0xConstant
/ insta-dw-tut-4.py
Created
March 10, 2020 19:46
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import requests | |
| import re | |
| # code jadid | |
| output_name = 'sample.mp4' | |
| video_url_ = 'https://www.instagram.com/p/B82F0mJhiUV/' | |
| grab_source_code = requests.get(str(video_url_)) | |
| print(grab_source_code.text) | |
| grab_video_link = re.search(r'"video_url":"(.*?)"', str(grab_source_code.text)).group(1) |
0xConstant
/ insta-dw-tut-3.py
Created
March 10, 2020 19:27
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import requests | |
| import re | |
| video_url_ = 'https://www.instagram.com/p/B82F0mJhiUV/' | |
| grab_source_code = requests.get(str(video_url_)) | |
| print(grab_source_code.text) | |
| grab_video_link = re.search(r'"video_url":"(.*?)"', str(grab_source_code.text)).group(1) | |
| print(grab_video_link) | |
| unicode_removed = grab_video_link.replace(r"\u0026", "&") |
NewerOlder