Skip to content

Instantly share code, notes, and snippets.

@cmeslay
cmeslay / script.py
Last active April 15, 2026 12:24
Script used to automatically decrypt strings in some Covenant samples of APT28
# pip install pythonnet (works with python < 3.14)
# You can test this script with the following file: 69609e89b04d8d27dc47bda2971376cfd760abb40ffe325f00d0cf3303be8906
# https://bazaar.abuse.ch/sample/69609e89b04d8d27dc47bda2971376cfd760abb40ffe325f00d0cf3303be8906/
import clr,sys
import binascii
import re
# Add dlls to reverse .NET. You could find them in REPythonNET-MCP projects (into the `dll/`` directory)
clr.AddReference("dnlib")
import base64