Skip to content

Instantly share code, notes, and snippets.

@idiom
Created July 9, 2017 05:34
Show Gist options
  • Save idiom/5a2ab5d24da4179b2b7bb2a14fd97c73 to your computer and use it in GitHub Desktop.
Save idiom/5a2ab5d24da4179b2b7bb2a14fd97c73 to your computer and use it in GitHub Desktop.
Simple decryptor for strings found in MOLE ransomware sample
"""
Simple decryptor for strings found in MOLE ransomware sample
MD5: d87cebeb7298e8669079ed3b4f203fd7
"""
def decrypt_string(ctext):
out = ""
for c in ctext:
v3 = ord(c)
if v3 < 0x61 or v3 > 0x7a:
if v3 < 65 or v3 > 0x5a:
out += chr(v3)
else:
out += chr((v3 - 52) % 26 + 65)
else:
out += chr((v3 - 84) % 26 + 0x61)
return out
print decrypt_string("fhccbegkktorsq7p.bavba")
print decrypt_string("fhccbegwl2kiiqzk.bavba")
print decrypt_string("/P opqrqvg /frg {qrsnhyg} obbgfgnghfcbyvpl vtabernyysnvyh")
print decrypt_string("/P opqrqvg /frg {qrsnhyg} erpbirelranoyrq Ab")
print decrypt_string("/P iffnqzva.rkr Qryrgr Funqbjf /Nyy /Dhvrg")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment