HarukaMa

Wasted one afternoon to manually deobfuscate the js from one drainer website. (see here for the "deobfuscated" reference js and script used to generate the file)

You can use the code to decrypt the traffic and even create arbitrary payload to send to their backend server.

What's the domain of that backend server? You need to find it out yourself.

The code below is in public domain.

HarukaMa

import bz2
import io
import os
from hashlib import sha1

from utils import read_uint32

plar = open("geekbench.plar", "rb")
dest = "./plar"

HarukaMa

{
    "immutable_parameters": {
        "min_committee_member_count": 11,
        "min_witness_count": 11,
        "num_special_accounts": 0,
        "num_special_assets": 0
    },
    "initial_accounts": [
        {
            "active_key": "BTS6MRyAjQq8ud7hVNYcfnVPJqcVpscN5So8BhtHuGYqET5GDW5CV",

HarukaMa

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Drawing;
using System.Linq;
using System.Runtime.InteropServices;
using System.Windows.Forms;
using Test.OBS;

namespace Test {

HarukaMa

1:07:030 root         I[KERNEL]: /Users/MrX/src/ppsspp/Core/HLE/sceKernelThread.cpp:2093 276=sceKernelCreateThread(name=psp_base, entry=08804244, prio=20, stacksize=643072)
41:07:030 root         I[KERNEL]: /Users/MrX/src/ppsspp/Core/HLE/sceKernelThread.cpp:2144 sceKernelStartThread(thread=276, argSize=33, argPtr=09fffed0)
41:07:031 root         I[KERNEL]: /Users/MrX/src/ppsspp/Core/HLE/sceKernelThread.cpp:2224 __KernelReturnFromThread: 0
41:07:031 psp_base     I[HLE]: /Users/MrX/src/ppsspp/Core/Util/BlockAllocator.cpp:379 -----------
41:07:031 psp_base     I[HLE]: /Users/MrX/src/ppsspp/Core/Util/BlockAllocator.cpp:383 Block: 08800000 - 08804000 size 00004000 taken=0 tag=(untitled)
41:07:031 psp_base     I[HLE]: /Users/MrX/src/ppsspp/Core/Util/BlockAllocator.cpp:383 Block: 08804000 - 08cf0100 size 004ec100 taken=1 tag=ELF
41:07:031 psp_base     I[HLE]: /Users/MrX/src/ppsspp/Core/Util/BlockAllocator.cpp:383 Block: 08cf0100 - 08d0a000 size 00019f00 taken=1 tag=UserSbrk
41:07:031 psp_base     I[HLE]: /Users/MrX/