hasherezade

#!/usr/bin/python
# CC-BY: hasherezade
"""Convert wchar string to char string"""

import argparse

def convert(data):
    maxlen = len(data)
    decoded = bytearray()
    i = 0

hasherezade

{
    "blacklist": {
        "countries": [
            "am",
            "az",
            "by",
            "ge",
            "kg",
            "kz",
            "md",

hasherezade

#!/usr/bin/python
# CC-BY: hasherezade
"""Finds R5A key for 7even-HONE$T ransomware - variant: 08a53eb5d54c6829cf6ea29bd61ea161"""

import argparse
import os

PREFIX = 'M'
SUFFIX = '*'

hasherezade

.n64
.m4u
.m3u
.mid
.wma
.flv
.3g2
.mkv
.3gp
.mp4

hasherezade

#!/usr/bin/python2.7

import argparse

def decode(data, key, offset, extra_rounds):
    maxlen = len(data)
    keylen = len(key)
    j = 0 #key index
    num2 =  (maxlen - 1) * (extra_rounds + 1)
    decoded = bytearray()

hasherezade

#include <stdio.h>

size_t filesize(FILE *f)
{
    fseek(f, 0, SEEK_END);
    size_t size = ftell(f);
    fseek(f, 0, SEEK_SET);
    return size;
}

hasherezade

#pragma once
#include <Windows.h>

//here we don't want to use any functions imported form extenal modules

typedef struct _LDR_MODULE { 
    LIST_ENTRY  InLoadOrderModuleList;//   +0x00 
    LIST_ENTRY  InMemoryOrderModuleList;// +0x08   
    LIST_ENTRY  InInitializationOrderModuleList;// +0x10 
    void*   BaseAddress; // +0x18 

hasherezade

#pragma once
#include <Windows.h>
//WARNIG: we don't want to use any imported functions in here!

#include "pe_hdrs_helper.h"

/*
typedef struct _IMAGE_EXPORT_DIRECTORY {
    DWORD   Characteristics;
    DWORD   TimeDateStamp;

hasherezade

#!/usr/bin/python
# CC-BY: hasherezade
"""Decoder for 7even-HONE$T ransomware"""

import argparse
import os

PREFIX = 'M'
SUFFIX = '*'

hasherezade

Text strings referenced in payload_:.text
Address    Text string
004012EE   UNICODE "TrickBot"
0040131C   UNICODE "Bot"
004013D2   UNICODE "Bot"
00401432   UNICODE "PT0S"
004014F8   UNICODE "Author Name"
00401559   UNICODE "Trigger1"
00401590   (Initial CPU selection)
004015F3   UNICODE "P1D"