struppigel

module.paths.unshift(
  "modulepathes"
);

const originalLog = console.log.bind(console)

function log(message){
  originalLog(message);
}

struppigel

// minimal_generic_hook.js — generic-hooking analysis harness (v3, pluggable loader)
// Run:  set ELECTRON_RUN_AS_NODE=1 && launcher.exe minimal_generic_hook.js
//
// Spies every module the sample itself requires (auto-wrapping all functions/constructors)
// and PASSES THROUGH the real modules. Only child_process is neutralized (so it can't spawn an
// uninstrumented next stage). Real modules execute — run on an isolated VM with no Internet.

// ===== per-sample CONFIG (the only part you edit between samples) =====
const CONFIG = {
  payload: "-put path to .jsc here-",  // .jsc bytecode OR a .js entry

struppigel

# Terms & Conditions — computerviruseswatch

_Last updated: July 27, 2026_

**computerviruseswatch** ("the app") is a moderation helper for the
subreddit it is installed on. By installing or using the app, you agree to
these terms.

1. **Purpose.** The app monitors public posts with a configurable flair
   (default "Disinfection Help") and maintains a status list in a Discord

struppigel

# Privacy Policy — computerviruseswatch

_Last updated: July 27, 2026_

**computerviruseswatch** is a moderation helper app for the subreddit it is
installed on (r/computerviruses). It notifies the community's helper team on
Discord about posts flaired "Disinfection Help" that have not yet received a
reply from a user with an expert flair.

## What data the app processes

struppigel

echo on

cd C:\Tools\SysinternalsSuite
if exist %1\* (
	for /F "delims=" %%f in ('dir /b /s %1') do (
		:: skip folders
		if not exist "%%~f\" ( 
			echo "%%~f" >> "%~dp1\%~n1.strings.txt"
			echo.
			strings64.exe -n 6 "%%~f" >> "%~dp1\%~n1.strings.txt"

struppigel

# Uses PowerShell and dnlib to decrypt strings dynamically
# requires pythonnet: pip install pythonnet
# requires dnlib.dll: adjust path below if necessary, remove ZoneIdentifier if you downloaded it
#
# This is applicable for samples that have a non-generic static decrypt method with an integer
# Small changes to the PS script will make it also work for non-static or generic methods
# Caution: This script runs the sample's code!
# author: Karsten Hahn @ G DATA CyberDefense

import clr

struppigel

rule PrivateLoader_ExportParsing
{
	meta:
		author = "Karsten Hahn"
		description = "PrivateLoader export parsing"
		sha256 = "892834734712fe5bc7a6614be6972de1be2d74ad424ef47b2c701046e4912426"

	strings:
		$code = {
			b8 4d 5a 00 00               // MOV  EAX,0x5a4d

struppigel

format PE GUI
entry start

include 'win32a.inc'

section '.text' code readable executable

  start:
	; get handle to calling process
	push	0

struppigel

// for sample https://malshare.com/sample.php?action=detail&hash=20946142795ea4b9fafad9a279e5da0e2f491f567380d7f37570d451f3aa6b8f
bc
bphwc

bp WriteProcessMemory
run
bc
mov $payload,[esp+c]

// calc size of dump area

struppigel

import sys
import re

if len(sys.argv) <= 1: exit()
scriptpath = sys.argv[1]

with open(scriptpath, 'r') as scriptfile:
	script = scriptfile.read().replace('^', '')
	p = re.compile('\([Ss][Ee][Tt][^=]+=([^&]+)&&')
	s = p.search(script)