malware-kitten

from ghidra.program.model.listing import CodeUnit

decrypt_func = 0x004039a0

def decode(offset):
    count = 0
    res = b''
    b = getByte(toAddr(offset))
    while b != 0x0:
        try:

malware-kitten

#!/usr/bin/env python
import binascii
import sys

'''
Usage:
python3 clsid.py 85131631-480C-11D2-B1F9-00C04F86C324
311613850c48d211B1F900C04F86C324
'''

malware-kitten

#!/usr/bin/env python
# Copyright 2017 Ryan Stortz (@withzombies)
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software

malware-kitten

import r2pipe
import sys
import json
import binascii

r2p = r2pipe.open(sys.argv[1])
r2p.cmd('aaa;aac')
funcs = {}
for func in r2p.cmdj('aflj'):
    instructions = r2p.cmd("pdfj @ %s" % func['offset'])

malware-kitten

#Author: Nick Hoffman / securitykitten.github.io / @infoseckitten
#Description:  A bro script to find beacons

module BEACON;

@load base/protocols/http

#this is our master collection, we'll use this to store all our information
global master_collection: table[addr,addr] of vector of time  &synchronized;

malware-kitten

#include <string>
#include <tlhelp32.h>
#include <TCHAR.H>   
#include <dir.h>

using namespace std;

int detected = 0;

DWORD GetModulePath(HINSTANCE hInst,LPTSTR pszBuffer,DWORD dwSize)

malware-kitten

require 'base64'

data = "3d3duIWRvYmVzZXJ2aWNlbi5ldE="
decode = Base64.decode64(data)

decode.each_byte do |b|
        #shr dl,6
        #shl al,2
        #or dl,al
        print (((b<<6)%0xff |(b>>2)%0xff)).chr