This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rule alg_crypto_rc4 { | |
meta: | |
descrption = "Identify code for the (A)RC4 cryptographic algorithm." | |
author = "@shellcromancer <root@shellcromancer.io>" | |
version = "0.1" | |
date = "2022-01-03" | |
reference = "https://www.goggleheadedhacker.com/blog/post/reversing-crypto-functions#identifying-rc4-in-assembly" | |
reference = "https://0xc0decafe.com/detect-rc4-encryption-in-malicious-binaries/" | |
reference = "https://blog.talosintelligence.com/2014/06/an-introduction-to-recognizing-and.html" | |
strings: |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
let Parser = require('rss-parser'); | |
const url = 'https://www.sec.gov/cgi-bin/browse-edgar?action=getcurrent&CIK=&type=8-K&company=&dateb=&owner=include&start=40&count=40&output=atom' | |
let parser = new Parser({ | |
headers: { | |
'User-Agent': 'Company Name admin@company.net' | |
}, | |
}); | |
(async () => { |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
8507e76362664fe2ed9c9407e237fed900881472abd5fbbaf88d772268836031 | |
8604a10bd97099e8e5539eff05c49bc518a774bf8e7c4ef6c36d902f7fdaeb6e | |
0e41d3e3b464f3fb8c140340e6a85a376c6c17499dd6bbf7de5940d401b9e71a | |
24ace87331051d7d2d83bb9a89781847f47b4c00789c19b5385fce94705c3c40 | |
0b9a3b00302faf3297b60fff0714f2db87245a613dcd9849645bffa7c4a3df9b | |
82633f6fec78560d657f6eda76d11a57c5747030847b3bc14766cec7d33d42be | |
731cf0317f409c5e23411efccc94fe8ebd897f625da300ccb98ad7ff4a12741c | |
12f416e67d9cd74ec3488842b9bf61092f35c0ae4de467afaebba2cb3933fc26 | |
738c7536ff7dbd95161517658f5438b5f9633ce9baef423a629ea7057a1e0c1b |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Copy of https://github.com/SentineLabs/AlphaGolang/blob/main/3.categorize_go_folders.py | |
# for Binja with new folders view | |
folders = {} | |
def create_folders(): | |
for function in bv.functions: | |
folderName = "" | |
name = function.name | |
if name.startswith("."): |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
# author: @shellcromancer | |
# Day 53 of #100DaysofYARA | |
import io | |
import os | |
import requests | |
import zipfile | |
import yara | |
import logging |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
macho | |
file | |
fat_arch | |
nfat_arch = YR_UNDEFINED | |
fat_magic = YR_UNDEFINED | |
stack_size = YR_UNDEFINED | |
entry_point = 7384 | |
segments | |
[0] | |
segname = "__PAGEZERO" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import PySide6 | |
length = current_selection[1] - current_selection[0] | |
code_bytes = bv.read(here, length).hex() | |
tuples = [code_bytes[i:i+2] for i in range(0, len(code_bytes), 2)] | |
yara_str = f"$asm_{hex(here)} = {{{' '.join(tuples)}}}" | |
clip = PySide6.QtGui.QGuiApplication.clipboard() | |
clip.setText(yara_str) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rule elf_invalid_version { | |
meta: | |
desc = "Identify ELF file that has mangled header info." | |
author = "@shellcromancer" | |
version = "1.0" | |
last_modified = "2023.01.01" | |
reference = "https://n0.lol/ebm/1.html" | |
reference = "https://tmpout.sh/1/1.html" | |
condition: | |
( |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
from collections import defaultdict | |
import io | |
import os | |
import requests | |
import sys | |
from typing import Dict, List | |
import zipfile |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rule tool_gscript { | |
meta: | |
description = "Identify the gscript dropper generator." | |
author = "@shellcromancer <root@shellcromancer.io>" | |
version = "0.1" | |
date = "2022-01-18" | |
reference = "https://github.com/gen0cide/gscript" | |
strings: | |
$ = "gen0cide/gscript" ascii |
NewerOlder