herrcore

import idaapi, idc, idautils
import re
import struct


start = 0x0041A558
end = 0x0041B1E8

for ptr in range(start,end,8):
    key = Byte(ptr)

herrcore

import idaapi, idc, idautils
import re
import struct
import base64

flag_arr=[]

def decrypt_algo(key, data, data_len):
    out=""
    for i in range(0, data_len):

herrcore

#!~/.wine/drive_c/Python25/python.exe
# -*- coding: utf-8 -*-

# Copyright (c) 2009-2014, Mario Vilas
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
#     * Redistributions of source code must retain the above copyright notice,

herrcore

# Copyright (c) 2014 The MITRE Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.

herrcore

try:
    import lznt1
except:
    print "Cannot import lznt1, try this lib: https://gist.github.com/herrcore/344ba2ea540f622b52efba858050539f"

import struct

def decrypt(data):
    key = data[:8]
    data = data[8:]

herrcore

def decrypt_string(ctxt):
    tbl = 'UmlXZEyNki880daneIlvAipdZ5Kz45FucTmGiIhYdbFHromzJjbisCtBCm'
    ctxt_bin = ''
    for i in re.findall('..',ctxt):
        ctxt_bin += chr(int(i,16))
    ptxt = ''
    for i in range(0,len(ctxt_bin) - 1):
        mut_chr = ord(ctxt_bin[i])
        tmp_chr = ord(ctxt_bin[i+1]) ^ ord(tbl[i])
        if mut_chr > tmp_chr:

herrcore

#!/usr/bin/env python
##################################################################
#
# Ref sample:
# MD5: abd2b832007338d6d6550339eec09fb0 (AegisI5.exe)
#   \_ MD5: cf5de95d94bb349f1f21bb5713a05d25 (fA1L0mX.exe)
#       \_ MD5: 17cb0563f7c4621bc98abd06965bdfa9 (svchost.exe injected DLL)
#    
# DGA generator for Ramnit Trojan
# 

herrcore

#!/usr/local/bin/env python

####################################################
##
## All credit to @_qaz_qaz for this awesome post
## https://secrary.com/ReversingMalware/Upatre/
##
## Original script:
## https://gist.github.com/secrary/98c563688fa6cea1fd517170f97988ab
##

herrcore

#!/usr/bin/env python
################################################################################################
## UCL NRV2B Decompression Library
## 
## Code from "Clash of the Titans: ZeuS v SpyEye":
## https://www.sans.org/reading-room/whitepapers/malicious/clash-titans-zeus-spyeye-33393
## Author: Harshit Nayyar, harshit.nayyar@telus.com
##
## NOTE: This is the compression algorithm used in the Zeus trojan and subsequent variants
##

herrcore

var oShell = new ActiveXObject("Shell.Application");
var commandtoRun = "calc.exe";
oShell.ShellExecute(commandtoRun,"","","","1");