smokeloader decrypt c2 list

smokeloader_decrypt_c2_cfg.py

'''
md5:
bba9cae25f03dfa20d57ac3bafa4a0ae
05c03457934160ecf2acc4b89da99cad

c2:
http://hellopittysloiebe.com/
http://keinemachtdendrugis.ru/
http://hallokittyverseinsheimse.ru/
http://killermansopitu.com/
http://klautuschkertiker.ru/
http://bauersuchtmannin.su/
http://hammergeildasisghj.com/
http://pimmelskinderkis.ru/
http://kollegahskilosde.com/
'''

def config_bin_v2(cfgData):

    _key = ord(cfgData[0])
    _len = ord(cfgData[4])>>1

    dec_data = []
    enc_data = cfgData[5:]
    c2 = ''
    step = 0

    for p,n in zip(enc_data, enc_data[1:]): 
        dec_data.append((ord(p)^_key)-(ord(n)^_key))
        if step > (_len-1)*2:
            break
        step +=1
    
    for c in dec_data[::2]:
        c2 += chr(c)
    
    return c2