hasherezade

<mcconf>
<ver>1000004</ver>
<gtag>tt0002</gtag>
<servs>
<srv>91.219.28.77:443</srv>
<srv>193.9.28.24:443</srv>
<srv>37.1.209.51:443</srv>
<srv>138.201.44.28:443</srv>
<srv>188.116.23.98:443</srv>
<srv>104.250.138.194:443</srv>

hasherezade

Text strings referenced in payload_:.text
Address    Text string
004012EE   UNICODE "TrickBot"
0040131C   UNICODE "Bot"
004013D2   UNICODE "Bot"
00401432   UNICODE "PT0S"
004014F8   UNICODE "Author Name"
00401559   UNICODE "Trigger1"
00401590   (Initial CPU selection)
004015F3   UNICODE "P1D"

hasherezade

#!/usr/bin/python
# CC-BY: hasherezade
"""Decoder for 7even-HONE$T ransomware"""

import argparse
import os

PREFIX = 'M'
SUFFIX = '*'

hasherezade

#pragma once
#include <Windows.h>
//WARNIG: we don't want to use any imported functions in here!

#include "pe_hdrs_helper.h"

/*
typedef struct _IMAGE_EXPORT_DIRECTORY {
    DWORD   Characteristics;
    DWORD   TimeDateStamp;

hasherezade

#pragma once
#include <Windows.h>

//here we don't want to use any functions imported form extenal modules

typedef struct _LDR_MODULE { 
    LIST_ENTRY  InLoadOrderModuleList;//   +0x00 
    LIST_ENTRY  InMemoryOrderModuleList;// +0x08   
    LIST_ENTRY  InInitializationOrderModuleList;// +0x10 
    void*   BaseAddress; // +0x18 

hasherezade

#include <stdio.h>

size_t filesize(FILE *f)
{
    fseek(f, 0, SEEK_END);
    size_t size = ftell(f);
    fseek(f, 0, SEEK_SET);
    return size;
}

hasherezade

#!/usr/bin/python2.7

import argparse

def decode(data, key, offset, extra_rounds):
    maxlen = len(data)
    keylen = len(key)
    j = 0 #key index
    num2 =  (maxlen - 1) * (extra_rounds + 1)
    decoded = bytearray()

hasherezade

.n64
.m4u
.m3u
.mid
.wma
.flv
.3g2
.mkv
.3gp
.mp4

hasherezade

#!/usr/bin/python
# CC-BY: hasherezade
"""Finds R5A key for 7even-HONE$T ransomware - variant: 08a53eb5d54c6829cf6ea29bd61ea161"""

import argparse
import os

PREFIX = 'M'
SUFFIX = '*'

hasherezade

{
    "blacklist": {
        "countries": [
            "am",
            "az",
            "by",
            "ge",
            "kg",
            "kz",
            "md",