Skip to content

Instantly share code, notes, and snippets.

View drole's full-sized avatar

Rodel Mendrez drole

14 followers · 2 following
View GitHub Profile
@drole
drole / Shellcode to EXE
Created October 10, 2018 22:47
use primarily to analyze shellcode using a debugger
// shellcode.cpp : Defines the entry point for the console application.
//
// Shellcode_dnstxt.cpp : Defines the entry point for the console application.
//
#include "stdafx.h"
#include<stdio.h>
#include<windows.h>
@drole
drole / Azorult Strings
Last active October 13, 2019 18:02
Azorult 3.3 Strings
firefox.exe
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
%appdata%\Mozilla\Firefox\Profile}[Ýã\
MozillaFireFox
CurrentVersion
Install_Directory
nss3.dll
@drole
drole / vjw0rm
Last active April 2, 2023 20:22
vjw0rm
var j = [
'WScript.Shell',
'Scripting.FileSystemObject',
'Shell.Application',
'Microsoft.XMLHTTP'
];
var g = [
'HKCU',
'HKLM',
@drole
drole / gootkit_decode_function.py
Created November 30, 2022 22:56
A simple python function to decode most Gootkit obfuscated javascripts
def decode(encoded_string):
reversed = encoded_string[::-1]
decoded = ""
decoded_reversed = ""
for idx in range(int(len(reversed))):
if idx % 2:
decoded = decoded + reversed[idx]
else:
decoded_reversed = decoded_reversed + reversed[idx]
return decoded + decoded_reversed[::-1]
@drole
drole / deobfuscate_emotet.vba
Created March 19, 2023 10:23
Deobfuscated Emotet VBA Macro code
Function GenerateFilePath() As String
pathPropertyName = "Path"
pathSeparator = "\"
index = 2
documentPath = CallByName(ActiveDocument, pathPropertyName, index)
currentTime = GetFormattedTime()
GenerateFilePath = documentPath & pathSeparator & currentTime
End Function
@drole
drole / GootloaderCyberchefRecipe.txt
Last active July 12, 2024 17:21
Gootloader Decode Recipe
// CyberChef Recipe to deobfuscate Gootloader encoded string
// Use: https://github.com/drole/CyberChef
Unescape_string()
Gootloader_Decode()
JavaScript_Beautify('\\t','Auto',true,true)
Regular_expression('User defined','\\(\'(.*?)\'\\)',true,true,false,false,false,false,'List capture groups')
Unescape_string()
Gootloader_Decode()
@drole
drole / IoC.txt
Created January 15, 2024 21:39
AyncRAT IoCs
hxxps://prezi[.]com/i/hcfsww85oy-x/12-jan-tax_flllng_2o24/
hxxps://filetransfer[.]io/data-package/r2JfVdB0/download
hxxp://s25[.]filetransfer[.]io/storage/download/7j1einWjDhd9
hxxp[://]139[.]28[.]37[.]124:222/g[.]jpg
AsyncRAT 70683619f9aa40df2f6bd90b33d4084d6bc989cda83967d45b769196dcad880b
@drole
drole / TycoonIOCs.md
Last active September 11, 2024 15:35
Tycoon IOCs

Tycoon Phishing Kit Landing Pages (8-Feb-2024):

  • https[:]//djcs.ybuu.ru/8PB830a3IXi78o9/
  • https[:]//26qw8.hicx0.com/72w0/
  • https[:]//5f460.dkx01.com/373i/
  • https[:]//1826x.eauth0.com/499p/
  • https[:]//discovery.expedownhe.com/fg7n232/
  • https[:]//874pf.eaver1.com/h538/
  • https[:]//s8k47.moraspu.ru/02b3/
  • https[:]//melody.lincelryou.com/y48633m/
  • https[:]//721cj.ckasmi1.com/h319/
@drole
drole / cobaltstrike_ais.md
Last active May 16, 2024 04:47
  • Backdoored Advanced_IP_Scanner_2.5.4594.1.exe
    • 723227f3a71001fb9c0cd28ff52b2636 (MD5)
    • fef06c28ae5a65672c31076b062e33cfaeb2b90309444f6567877f22997bc711 (SHA256)
  • Malicious pcre.dll (DLL Sideloaded by main program executable)
    • 21cdd0a64e8ac9ed58de9b88986c8983 (MD5)
    • 9a0c600669772bc530fe07c2dbb23dbb4808c640d016ffb832460ed25d2bb49e (SHA256)

Extracted CobaltStrike Configuration

| Field | Value |Description |