Decoded base64 with the 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=' alphabet
noPax
latest
listNamespaces
packages
setupGitHubSender
html_url
state
addTarEntry
sysopfb
/ gist:8c71915b065a54e458b188fec8333c22
Created
February 10, 2023 21:32
qbot sxor_3 double decode
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #stager 1 versions (sxor_3) | |
| def decode_data4(data): | |
| key = hashlib.sha1(b'bUdiuy81gYguty@4frdRdpfko(eKmudeuMncueaN').digest() | |
| rc4 = ARC4.new(key) | |
| t = rc4.decrypt(data) | |
| tt = qbot_helpers.qbot_decode(t[20:]) | |
| return(tt) | |
| #qbot_decode is just the oldschool decode of qbots: | |
| def qbot_decode(data): |
sysopfb
/ gist:2c21f05a554fa570e4f73863381ead79
Created
April 23, 2025 22:48
Amos standalone decoder for new variant
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #Saw RussianPandas ida script after I got it to the custom base64 - was easy to verify my work after finding their IDA script | |
| # Prior work ref: https://github.com/RussianPanda95/IDAPython/blob/main/Atomic%20Stealer/amos_config_extract_idapython-3-2025.py | |
| # created a standalone decoder based on the x64 opcodes | |
| import re | |
| import sys | |
| import yara | |
| import struct | |
| import binascii | |
| import base64 | |
| rule_source = ''' |
sysopfb
/ gist:b67cc9e649bd0c765801d536a3dab164
Last active
May 21, 2026 20:16
Decoded strings from nx vscode index.js
#Malware related RMMSystem that uses Metastealer C2 traffic, tracker traffic: /pmxs/logs
"""
Full DGA (Domain Generation Algorithm) replication of sub_14000BF00 and friends.
Calling generate_domains() replicates the exact output of the binary with the
hardcoded seed, count, width, and word list found in sub_14000BF00.
"""
b2aa52f6a09022524c8bd2b8411e3b5d7eab8f190300f84ff6ec11464568c96c
Has an onboard python project that is obfuscated
after deobfuscating it appears to be some kind of a backdoor/loader type bot that has an onboard config and retrieves the next hop from the ethereum blockchain,
Config:
_cfg = AgentConfig(server_url="http://127.0.0.1:8000", token="320473d40b7b18dc9fd3820bd48a55bf15806f835cb79b87f751a3b167534011", transport_mode="dns", dns_server_ip="127.0.0.1", dns_port=53, contract_address="0x5d04ed162c548fc4508cbb59266b02afbaf3ebc1", rpc_endpoints="https://eth.llamarpc.com,https://ethereum-rpc.publicnode.com,https://eth.drpc.org,https://rpc.eth.gateway.fm,https://eth-mainnet.public.blastapi.io,https://gateway.tenderly.co/public/mainnet,https://ethereum.rpc.subquery.network/public,https://eth.api.onfinality.io/public,https://rpc.sentio.xyz/mainnet,https://eth.merkle.io", blockchain_key="320473d40b7b18dc9fd3820bd48a55bf15806f835cb79b87f751a3b167534011", hardcoded_ip="", get_data_selector="1dcf296b")
OlderNewer