Skip to content

Instantly share code, notes, and snippets.

@irshadqemu

irshadqemu/unpack_3rdstage_lokibot.py

Created January 4, 2021 10:46
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save irshadqemu/68a4db9b3f8f4f205e17f6050ffbb652 to your computer and use it in GitHub Desktop.
Save irshadqemu/68a4db9b3f8f4f205e17f6050ffbb652 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
unpack_3rdstage_lokibot.py
import binascii
from itertools import cycle
SERVER_RESPONSE_FIE = "server_response.txt"
XOR_KEY = b"ZKkz8PH0"
with open(SERVER_RESPONSE_FIE) as serverfd:
resp_str = serverfd.read()
resp_str = resp_str[::-1]
resp_bytes = binascii.unhexlify(resp_str)
decoded_bytes = [x ^ y for (x, y) in zip(resp_bytes, cycle(XOR_KEY))]
with open("decoded.dll_", "wb") as outfile:
outfile.write(bytes(decoded_bytes))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment