idiom

1. Download & Install Visual Studio 2010 - Version able to compile C++ 
2. Download and Install Mozilla build files http://ftp.mozilla.org/pub/mozilla.org/mozilla/libraries/win32/MozillaBuildSetup-Latest.exe
3. Download the latest NSS package from: http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/ 
   Download the tar with npsr 
4. Create a directory C:\src
5. Extract nss to c:\src 
    So this will end up looking like c:\src\nss-3.15
6. Run the Mozilla build shell: C:\mozilla-build\start-msvc10.bat
7. Create the required env variables
  Type:  export OS_TARGET="WINNT"

idiom

Docs

http://www.falcon-software.org/download/tnefdec/TNEF_Attachments.htm 

http://msdn.microsoft.com/en-us/library/ee201932%28v=exchg.80%29.aspx

idiom

The ntdll exported function for 32 bit syscalls looks like the following: 

mov eax,<syscall_index>
mov edx,0x7ffe0300
call dword [edx]
ret <arg_byte_count>

idiom

Dump Memory of a guest
1) vboxmanage debugvm "<imagename>" dumpguestcore --filename <outfile>

Capture Network Traffic of the guest
1) VBoxManage modifyvm "<imagename>" --nictrace1 on --nictracefile1 network.pcap
2) VirtualBox -startvm "<imagename>"

idiom

import hashlib
from StringIO import StringIO
import zipfile
import argparse
from Crypto.Cipher import ARC4
import os

'''
    Script to extract encrypted Adwind/AlienSpy Rat
    Payload is RC4 encrypted within the config.ini file.

idiom

#!/bin/bash 
# 
# Simple bash script to rip music from a youtube vid. 
# Originally from: http://www.linuxjournal.com/content/grabbing-your-music-youtube-do-it-your-wam 
#
address=$1
regex='v=(.*)'
if [[ $address =~ $regex ]]; then
    echo "Parsing URL" 
    video_id=${BASH_REMATCH[1]}

idiom

rule MSIL_GolRoted_Hawkeye_Unpacked {
        meta:
                description = "Detect Unpacked GolRoted/HawkEye Keylogger"
                author = "@seanmw"
                date = "2015-06-02"
        strings:
                $s1 = "encryptedemailstring" fullword ascii
                $s2 = "encryptedpassstring" fullword ascii
                $s3 = "encryptedsmtpstring" fullword ascii
                $s4 = "encryptedftphost" fullword ascii

idiom

using System;

public class Hello1
{
   public static void Main()
   {
      try
      {
          System.Console.WriteLine("Hello from C#");
      }

idiom

Imports System

Public Module modmain
   Sub Main()
     Try
         Console.WriteLine ("Hello World using Visual Basic!")
     Catch e As Exception
         Throw e
     End Try
   End Sub

idiom

### Keybase proof

I hereby claim:

  * I am idiom on github.
  * I am idiom (https://keybase.io/idiom) on keybase.
  * I have a public key whose fingerprint is D53F A3EF 3ED0 88B9 654B  728A 9DD5 10F3 498F 39B3

To claim this, I am signing this object: