Skip to content

Instantly share code, notes, and snippets.

@jachermocilla
Last active September 19, 2019 08:07
Show Gist options
  • Save jachermocilla/123d4fcd6fa2e6de30ff1419e1500535 to your computer and use it in GitHub Desktop.
Save jachermocilla/123d4fcd6fa2e6de30ff1419e1500535 to your computer and use it in GitHub Desktop.
Extract the malware sample from Virus Total Data that matches the given name only
#!/bin/bash
#filename is passed as command line argument
#file should contain the name of the malware
while IFS= read -r MALWARE; do
echo "Malware: $MALWARE"
mkdir $MALWARE
RESULT=`find . -type f -iname *.json -exec grep -l ".$MALWARE" {} \;`
#echo $RESULT
readarray -d ' ' -t MYARRAY <<< $RESULT
for F in ${MYARRAY[@]}
do
#echo $F
readarray -d '.' -t TMP <<< $F
BIN=${TMP[1]}
BIN=${BIN#/}
echo $BIN
readarray -d '/' -t HASH_ARR <<< $BIN
HASH=${HASH_ARR[1]}
NEWNAME="$MALWARE/$MALWARE.$HASH"
#echo $NEWNAME
7z e -pinfected "-i!$BIN" Win32_EXE.7z -l "-o$MALWARE"
mv $MALWARE/$HASH $MALWARE/$MALWARE.$HASH
done
done < "$1"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment