r00tten

# [X] Reading from file
# [X] Splitting word by word
# [X] Split ascii and unicode
# [X] Determine a range and apply filter
# [X] Collect all the unique ones in an array
# [X] Create random english words for them
# [X] Create an updated file
# [ ] Work with folder and file as a input

#!/usr/bin/python

r00tten

#!/usr/bin/python

import os
import logging

whitelist = []

def banner():
    print("")
    print("             ___   ___  _   _             ")

r00tten

# LS19 Zararlı Yazılım Analiz Ekibi
# Analiz Rapor Formatı
#
# Değer bölümünde | karakteri bulunan anahtarlara, çoklu girdi sağlayabilirsiniz.
#
# Örn:
#   key: |
#     First Value
#     Second Value
#

r00tten

rule SedUploader {

meta:
	author = "Mert Degirmenci"
	description = "APT28 SedUploader variant"
	date = "15.04.2019"
	hash1 = "b20aab629ea7fa73b98be9f3df1568c0a3b37480"

strings:
	// google.com

r00tten

#!/usr/bin/python
import sys
import binascii

array = []
xoredArray = []

# Hard coded XOR key
xorKey = ['0x56', '0xd7', 'a7', '0a']

r00tten

Private Sub Execute()
    Dim Path As String
    Dim FileNum As Long
    Dim xml() As Byte
    Dim bin() As Byte
    Const HIDDEN_WINDOW = 12
    strComputer = "."
    
    xml = ActiveDocument.WordOpenXML
    Set xmlParser = CreateObject("Msxml2.DOMDocument")

r00tten

#!/usr/bin/python
import sys
import binascii
import struct

array = []
# Hard coded XOR key
xorKey = [0x2d, 0x30, 0x71, 0x1b, 0x07, 0x0f, 0x43, 0x2d, 0x56, 0x2a]

# Sample encryptted string

r00tten

f sus.copyToBuffer 0 0x100030df 
f sus.lengthAsByte 0 0x10002b99 
f sus.internetReadFile_caller 0 0x10003621 
f sus.createMutex 0 0x10002cfc 
f sus.mainRoutine 0 0x10005b94 
f sus.decrypterFunc 0 0x10002f3f 
f sus.heapFree_un 0 0x10003f83 
f sus.multiByteToWideChar_caller 0 0x1000369a 
f sus.base64Decode 0 0x10002d4b 
f sus.base64Encode 0 0x10002d8f 

r00tten

af @ 0xbe
afvb -52 sus.imp.VirtualProtectEx int32_t @ 0xbe
afvb -84 sus.imp.ResumeThread int32_t @ 0xbe
afvb -60 sus.imp.VirtualFree int32_t @ 0xbe
afvb -108 sus.imp.ReadProcessMemory int32_t @ 0xbe
afvb -112 sus.imp.SetThreadContext int32_t @ 0xbe
afvb -96 sus.imp.GetThreadContext int32_t @ 0xbe
afvb -88 sus.imp.TerminateProcess int32_t @ 0xbe
afvb -44 sus.imp.WriteProcessMemory int32_t @ 0xbe
afvb -104 sus.imp.VirtualAlloc int32_t @ 0xbe

r00tten

#!/usr/bin/python
import sys
import re

def decryptor(z5ef583):
    b9d4bc = "qaf669";
    vfc9c = ""

    for i in xrange(0, len(z5ef583), 2):
        s3c1193 = int(('0x' + z5ef583[i:i+2]), 16)