herrcore

import idautils 
import idaapi

def memdump(ea, size, file):
    data = idc.GetManyBytes(ea, size)
    with open(file, "wb") as fp:
        fp.write(data)
        print "Memdump Success!"

herrcore

// SandBoxTest.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <windows.h>
#include <tchar.h>
#include <stdio.h>
#include <strsafe.h>
#include <string>
using namespace std;

herrcore

var oShell = new ActiveXObject("Shell.Application");
var commandtoRun = "calc.exe";
oShell.ShellExecute(commandtoRun,"","","","1");

herrcore

#!/usr/bin/env python
################################################################################################
## UCL NRV2B Decompression Library
## 
## Code from "Clash of the Titans: ZeuS v SpyEye":
## https://www.sans.org/reading-room/whitepapers/malicious/clash-titans-zeus-spyeye-33393
## Author: Harshit Nayyar, [email protected]
##
## NOTE: This is the compression algorithm used in the Zeus trojan and subsequent variants
##

herrcore

#!/usr/local/bin/env python

####################################################
##
## All credit to @_qaz_qaz for this awesome post
## https://secrary.com/ReversingMalware/Upatre/
##
## Original script:
## https://gist.github.com/secrary/98c563688fa6cea1fd517170f97988ab
##

herrcore

#!/usr/bin/env python
##################################################################
#
# Ref sample:
# MD5: abd2b832007338d6d6550339eec09fb0 (AegisI5.exe)
#   \_ MD5: cf5de95d94bb349f1f21bb5713a05d25 (fA1L0mX.exe)
#       \_ MD5: 17cb0563f7c4621bc98abd06965bdfa9 (svchost.exe injected DLL)
#    
# DGA generator for Ramnit Trojan
# 

herrcore

def decrypt_string(ctxt):
    tbl = 'UmlXZEyNki880daneIlvAipdZ5Kz45FucTmGiIhYdbFHromzJjbisCtBCm'
    ctxt_bin = ''
    for i in re.findall('..',ctxt):
        ctxt_bin += chr(int(i,16))
    ptxt = ''
    for i in range(0,len(ctxt_bin) - 1):
        mut_chr = ord(ctxt_bin[i])
        tmp_chr = ord(ctxt_bin[i+1]) ^ ord(tbl[i])
        if mut_chr > tmp_chr:

herrcore

try:
    import lznt1
except:
    print "Cannot import lznt1, try this lib: https://gist.github.com/herrcore/344ba2ea540f622b52efba858050539f"

import struct

def decrypt(data):
    key = data[:8]
    data = data[8:]

herrcore

# Copyright (c) 2014 The MITRE Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.

herrcore

#!~/.wine/drive_c/Python25/python.exe
# -*- coding: utf-8 -*-

# Copyright (c) 2009-2014, Mario Vilas
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
#     * Redistributions of source code must retain the above copyright notice,