Skip to content

Instantly share code, notes, and snippets.

View alexander-hanel's full-sized avatar
😶

Alexander Hanel alexander-hanel

😶
View GitHub Profile
@alexander-hanel
alexander-hanel / ryuk_str_decoder.md
Last active March 26, 2020 18:26
Ryuk String Decoder Notes

RYUK STRING DECODER NOTES

Recent variants of Ryuk have had their code cleaned up. They removed non-referenced strings that are relics from the HERMES source code days. One interesting part of the code clean-up is a new string decoder. The string decoder is the first MD5 brute forcer that I have observed in malware. It's an interesting technique because it is a computational attack that delays execution of Ryuk before the strings are decoded in memory. The decoding of strings happens in two phases. The first phase uses a hardcoded lookup table that is to decode API names. Once the API names are decrypted, they are dynamically imported and then used to recover the original string from an MD5 hash. After the original string is discovered, each byte of the string is hashed and then the hash is MD5ed, then the hexdigest contents are appended to a string. Each byte within the appended MD5 strings is used to create a second lookup table which is then used to decrypt strings.

Example Python code of the MD5 Brutef

@alexander-hanel
alexander-hanel / Malware Analysis Resources.md
Last active November 29, 2024 00:39
Recommended resources for learning reverse engineering (emphasis on malware analysis)

Computer Architecture

Assembly Language

Check out the first two books but download the Intel Software Manuals and use as references.

  • Assembly Language Step by Step
    • Easy introduction to Assembly Language
  • Assembly Language for X86 Processors by Kip Irvine
@alexander-hanel
alexander-hanel / data_size.py
Created February 13, 2020 00:51
IDAPython: calculate data size based off of xrefs
def get_to_xrefs(ea):
xref_set = set([])
for xref in idautils.XrefsTo(ea, 1):
xref_set.add(xref)
return xref_set
def get_from_xrefs(ea):
xref_set = set([])
for xref in idautils.XrefsTo(ea, 1):
xref_set.add(xref)
@alexander-hanel
alexander-hanel / crypt_helper.py
Last active October 24, 2023 14:35
Crypt Helper Python3
import idautils
JMPS = [idaapi.NN_jmp, idaapi.NN_jmpfi, idaapi.NN_jmpni]
CALLS = [idaapi.NN_call, idaapi.NN_callfi, idaapi.NN_callni]
DEBUG = True
COMMENT = True
class CSP():
pass
@alexander-hanel
alexander-hanel / nemty_str_decoder.py
Created November 6, 2019 18:51
IDAPython script for decoding strings in nemty
import base64
from Crypto.Cipher import ARC4
def str_decrypt(enc_data):
key = 'fuckav\x00'
cipher = ARC4.new(key)
try:
enc_data = base64.b64decode(enc_data)
except:
return enc_data
@alexander-hanel
alexander-hanel / init_helper.py
Last active May 13, 2020 01:47
Find usage of XOR, XOR blocks, size of the XOR loop and dynamic calls.
import idautils
import operator
JMPS = [eval("idaapi."+name) for name in dir(idaapi) if "NN_j" in name]
def get_riat_func():
gpa = idc.get_name_ea_simple("GetProcAddress")
func_gpa = {}
for tt in idautils.XrefsTo(gpa, 0):
if tt.type != 3: # Data_Read:
import idautils
comments = {}
for func in idautils.Functions():
flags = idc.get_func_attr(func, FUNCATTR_FLAGS) # skip library & thunk functions
if flags & FUNC_LIB or flags & FUNC_THUNK:
continue
dism_addr = list(idautils.FuncItems(func))
for ea in dism_addr:
temp = idc.get_cmt(ea, 0)
if temp:
@alexander-hanel
alexander-hanel / rename_func.py
Created April 9, 2019 16:02
rename function based off of comment in operand
def rrename():
func = idaapi.get_func(here()).startEA
idc.set_name(func, idc.get_cmt(idc.get_operand_value(here(),1), True) + "_", SN_CHECK)
def hexdump(src, length=16):
FILTER = ''.join([(len(repr(chr(x))) == 3) and chr(x) or '.' for x in range(256)])
lines = []
for c in xrange(0, len(src), length):
chars = src[c:c+length]
hex = ' '.join(["%02x" % ord(x) for x in chars])
printable = ''.join(["%s" % ((ord(x) <= 127 and FILTER[ord(x)]) or '.') for x in chars])
lines.append("%04x %-*s %s\n" % (c, length*3, hex, printable))
return ''.join(lines)
@alexander-hanel
alexander-hanel / bindiff5-win-patch.bat
Last active December 24, 2020 02:04
bindiff5-win-patch.bat bindiff5.msi (see comments at the bottom)
@echo off
(
echo -----BEGIN CERTIFICATE-----
echo 0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgAEAP7/DAAGAAAAAAAAAAEAAAABAAAA
echo AQAAAAAAAAAAEAAAAgAAAAEAAAD+////AAAAAAAAAAD/////////////////////
echo ////////////////////////////////////////////////////////////////
echo ////////////////////////////////////////////////////////////////
echo ////////////////////////////////////////////////////////////////
echo ////////////////////////////////////////////////////////////////
echo ////////////////////////////////////////////////////////////////