sysopfb

>>> a = "0c0d9d01000074030000789c9d934d4f02410c865fffc91e3ca8c9c27eb02ccb519460221135c60b17022b625408207ec4c493ffdb67ca488c091ecca4dd4ee77d3b6da7bba348bb3a50a2022b564d39df887d032bc79b283544ec757563154802b6b0fdb72f51856f1dbefbba581543d50cb163fa4a973ad68542f5d432cf40233d68a247db5d9b35d254cf5a28208f902c121de25f1a2255c60d29675dbcce53c37e4152eece585d75f4e6b30ab467b936c8638dca2da7fd4de64e3ecfcf3fd6bd884c42eb48685504d69b26ba613af259e478ebec52df956ddcd45819ba860ef48eb893cb0d2bb62a63cfcdecbc3096d319b738e499662ae98debcf184c681d9868a839dd5a20377428a083533ca34d6d6d30f7300378033a5d123300bf82796bcc25ef54d29bd267d7d6138c7bac198c2528c768a1fbbfdea78fbc5a8492c8ee9dfa7f46eee9444716ad60adeb8afc59c73316ccc8854ea9dee16ef12cc9a3c9f455b9d3ad8a55b222ea1c7b08efc166b3a23b90e32df1927fc7fb9ebabaff2b229ba1dcfc6f5437841bdbdf92f85988fcf4fd5ccef305148275f30b"
>>> b = binascii.unhexlify(a)
>>> struct.unpack_from('<HII', b)
(3340, 413, 884)
>>> len(b)
414
>>> c = zlib.decompress(b[10:])
>>> len(c)
884

sysopfb

 Pivot from config at https://twitter.com/VK_Intel/status/1260296104672886790
 
 {
   C2_CHUNK_POST: 0
   C2_POSTREQ: [('_HEADER', 0, 'Content-Type: application/octet-stream'), ('BUILD', ('PARAMETER', 'id'))]
   C2_RECOVER: 
   C2_REQUEST: [('BUILD', ('BASE64', 'HEADER', 'Cookie'))]
   C2_VERB_GET: GET
   C2_VERB_POST: POST
   CRYPTO_sCHEME: 1

sysopfb

{
  "lfile": "{id}-Readme.txt", 
  "spsz": 15360, 
  "lend": "SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQgYnkgTmV0d2Fsa2VyLg0KQWxsIGVuY3J5cHRlZCBmaWxlcyBmb3IgdGhpcyBjb21wdXRlciBoYXMgZXh0ZW5zaW9uOiAue2lkfQ0KDQotLQ0KSWYgZm9yIHNvbWUgcmVhc29uIHlvdSByZWFkIHRoaXMgdGV4dCBiZWZvcmUgdGhlIGVuY3J5cHRpb24gZW5kZWQsDQp0aGlzIGNhbiBiZSB1bmRlcnN0b29kIGJ5IHRoZSBmYWN0IHRoYXQgdGhlIGNvbXB1dGVyIHNsb3dzIGRvd24sDQphbmQgeW91ciBoZWFydCByYXRlIGhhcyBpbmNyZWFzZWQgZHVlIHRvIHRoZSBhYmlsaXR5IHRvIHR1cm4gaXQgb2ZmLA0KdGhlbiB3ZSByZWNvbW1lbmQgdGhhdCB5b3UgbW92ZSBhd2F5IGZyb20gdGhlIGNvbXB1dGVyIGFuZCBhY2NlcHQgdGhhdCB5b3UgaGF2ZSBiZWVuIGNvbXByb21pc2VkLg0KUmVib290aW5nL3NodXRkb3duIHdpbGwgY2F1c2UgeW91IHRvIGxvc2UgZmlsZXMgd2l0aG91dCB0aGUgcG9zc2liaWxpdHkgb2YgcmVjb3ZlcnkuDQoNCi0tDQpPdXIgIGVuY3J5cHRpb24gYWxnb3JpdGhtcyBhcmUgdmVyeSBzdHJvbmcgYW5kIHlvdXIgZmlsZXMgYXJlIHZlcnkgd2VsbCBwcm90ZWN0ZWQsDQp0aGUgb25seSB3YXkgdG8gZ2V0IHlvdXIgZmlsZXMgYmFjayBpcyB0byBjb29wZXJhdGUgd2l0aCB1cyBhbmQgZ2V0IHRoZSBkZWNyeXB0ZXIgcHJvZ3JhbS4NCg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG

sysopfb

Checking the expanded keys shows no difference

t2 uses thiefquests generate_xkey
>>> t2
bytearray(b'\xcav33JX2tdnsedvwwraH6pryV0sd2mxC5uSlhUQCxGxGmxE3ThvKBO1wSh58X4K7CHs0c35btQk1Pr2jaxxfqmD0uISsMH1rowcrluv93hwdD1RgC6MT4q7y34VTL1l4B')
t uses a standard key expansion for RC2
>>> t
bytearray(b'\xcav33JX2tdnsedvwwraH6pryV0sd2mxC5uSlhUQCxGxGmxE3ThvKBO1wSh58X4K7CHs0c35btQk1Pr2jaxxfqmD0uISsMH1rowcrluv93hwdD1RgC6MT4q7y34VTL1l4B')

sysopfb

import yara

rules = yara.compile(source='rule urls { strings: $a1 = /[0-9a-zA-Z_|]{6,}00000\d+/ ascii wide condition: all of them }')


def decoder(data):
    matches = rules.match(data=data)
    if matches != []:
        matches = matches[0].strings

sysopfb

def decode_data(data, key, sz): 
    S = list(range(sz)) 
    S = [x&0xff for x in S] 
    j = 0 
    out = []
    for i in range(sz): 
        j = (j + S[i] + ord( key[i % len(key)] )) % sz 
        S[i] , S[j] = S[j] , S[i]
    i = j = 0 
    for char in data: 

sysopfb

import sys
import pefile
import struct

def decode(data):
	out = ""
	for i in range(len(data)/2):
		t1 = data[i*2]
		t2 = data[(i*2)+1]
		t1 &= 0xf0

sysopfb

The Lambo - eCrime correlation effect

Compiled by Jason Reaves

Lamborghini sales

YEAR	Sales	Growth
1997	48

sysopfb

DGA code:

import java.util.Calendar;
import java.util.Random;
public class myTest {
    private static long seed;
    private static final int MAX_HOSTS = 2000;
private static void GetSeed(int m) {
        int i = Calendar.getInstance().get(1);

sysopfb

import dns.resolver

c = '.stage.1950252.updates.updaternetworkmanagerr.com'
v = ord('a')
vv = ord('a')
vvv = ord('a')
done = False
out = ""
while not done:
    t = dns.resolver.query(chr(v)+chr(vv)+chr(vvv)+c, 'TXT')