Demonslay335

import os, sys, argparse

# Charset used by Jemd ransomware
charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'

# https://en.wikipedia.org/wiki/Linear_congruential_generator
def lcg(modulus, a, c, seed):
	while True:
		seed = (a * seed + c) % modulus
		yield seed

Demonslay335

using System;
using Org.BouncyCastle.Math;

public BigInteger CalculateRSA(BigInteger p, BigInteger q, BigInteger e)
{
      // n = p*q - for illustration
      BigInteger n = p.Multiply(q);

      // phi / r = (p-1)*(q-1)
      BigInteger phi = p.Subtract(BigInteger.One).Multiply(q.Subtract(BigInteger.One));

Demonslay335

import requests, time
from urllib3.exceptions import InsecureRequestWarning
from xml.etree import ElementTree

# Ignore self-signed SSL
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

# Build login payload
payload = {
	'username': 'admin',

Demonslay335

# Ignore self-certs
if (-not ([System.Management.Automation.PSTypeName]'ServerCertificateValidationCallback').Type)
{
$certCallback = @"
    using System;
    using System.Net;
    using System.Net.Security;
    using System.Security.Cryptography.X509Certificates;
    public class ServerCertificateValidationCallback
    {

Demonslay335

"""
Extract Rapid 2.0 ransomware config from encrypter or decrypter
Author: @demonslay335
"""

import os, sys, string, re, binascii, base64, argparse

# https://stackoverflow.com/a/17197027/1301139
def strings(filename, min=4, max=10000):
    with open(filename, "rb") as f:           # Python 2.x

Demonslay335

# Credit: https://twitter.com/Lee_Holmes/status/964576204425580544
param([string]$a)

0..25 | % { [PSCustomObject] @{
		Offset = $_
		Value = & {
			param($v, $o) -join ($v.ToCharArray() | % {
				[char](((([int][char]$_) - ([int][char]'a') + $o) % 26) + ([int][char]'a'))
			})
		} $a $_

Demonslay335

"""
Extract BTCWare Ransomware Config
Author: @demonslay335
"""

import sys
import string
import re
import os
import argparse

Demonslay335

"""
Spora Encryption Checker
Author: @demonslay335
"""

import sys
import zlib
import struct
import os