Demonslay335

import requests, time
from urllib3.exceptions import InsecureRequestWarning
from xml.etree import ElementTree

# Ignore self-signed SSL
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

# Build login payload
payload = {
	'username': 'admin',

Demonslay335

# Ignore self-certs
if (-not ([System.Management.Automation.PSTypeName]'ServerCertificateValidationCallback').Type)
{
$certCallback = @"
    using System;
    using System.Net;
    using System.Net.Security;
    using System.Security.Cryptography.X509Certificates;
    public class ServerCertificateValidationCallback
    {

Demonslay335

# Ignore self-certs
if (-not ([System.Management.Automation.PSTypeName]'ServerCertificateValidationCallback').Type)
{
$certCallback = @"
    using System;
    using System.Net;
    using System.Net.Security;
    using System.Security.Cryptography.X509Certificates;
    public class ServerCertificateValidationCallback
    {

Demonslay335

"""
Extract Rapid 2.0 ransomware config from encrypter or decrypter
Author: @demonslay335
"""

import os, sys, string, re, binascii, base64, argparse

# https://stackoverflow.com/a/17197027/1301139
def strings(filename, min=4, max=10000):
    with open(filename, "rb") as f:           # Python 2.x

Demonslay335

# Credit: https://twitter.com/Lee_Holmes/status/964576204425580544
param([string]$a)

0..25 | % { [PSCustomObject] @{
		Offset = $_
		Value = & {
			param($v, $o) -join ($v.ToCharArray() | % {
				[char](((([int][char]$_) - ([int][char]'a') + $o) % 26) + ([int][char]'a'))
			})
		} $a $_

Demonslay335

"""
Extract GlobeImposter 2.0 Ransomware Config
Author: @demonslay335
"""

import os
import sys
import binascii
import re
import hashlib

Demonslay335

"""
Extract BTCWare Ransomware Config
Author: @demonslay335
"""

import sys
import string
import re
import os
import argparse

Demonslay335

"""
Spora Encryption Checker
Author: @demonslay335
"""

import sys
import zlib
import struct
import os