Skip to content

Instantly share code, notes, and snippets.

@reanimat0r

reanimat0r/dridex_decode.py

Forked from mak/dridex_decode.py
Created October 28, 2018 21:15
Show Gist options
  • Save reanimat0r/d598b18b7d43c683ff1edec2cecff6e5 to your computer and use it in GitHub Desktop.
Save reanimat0r/d598b18b7d43c683ff1edec2cecff6e5 to your computer and use it in GitHub Desktop.
Download ZIP
Decode dridex strings
Raw
dridex_decode.py
def dridex_decode_name(addr,idx,delm="\x00"):
addr += 8; tmp = ''; j = 0
xkey = GetManyBytes(addr,8)
for i in range(idx+1):
tmp = ''
while not tmp.endswith(delm):
tmp += chr(ord(xkey[j%8]) ^ Byte(addr+8+j))
j+=1
return tmp.strip(delm)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment