xor3r
/ decryptor.py
Last active
February 28, 2020 14:31
FileCoder Decryptor (require log file of malware execution process from Monitor.app)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import os | |
| import sys | |
| import time | |
| import re | |
| import subprocess | |
| root_dir = '/Users' | |
xor3r
/ check-outbound-connection.py
Last active
December 30, 2019 18:22
One-time one-IP outbound connection monitor.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import subprocess | |
| while True: | |
| p1 = subprocess.Popen(["netstat", "--inet", "-n"], stdout=subprocess.PIPE) | |
| p2 = subprocess.Popen(["grep", "144.217.255.89"], stdin=p1.stdout, stdout=subprocess.PIPE) | |
| p1.stdout.close() | |
| out, err = p2.communicate() | |
| output = out.decode('utf-8') |
xor3r
/ batteryAlert.sh
Last active
September 10, 2019 18:56
Alert messages in case of low charge level
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| file="/sys/class/power_supply/BAT0/capacity" | |
| while IFS= read -r line | |
| do | |
| if [[ "$line" -le 10 ]] | |
| then | |
| notify-send -u critical "CRITICAL CHARGE LEVEL (10%)" |