sysopfb

import yara

rules = yara.compile(source='rule urls { strings: $a1 = /[0-9a-zA-Z_|]{6,}00000\d+/ ascii wide condition: all of them }')


def decoder(data):
    matches = rules.match(data=data)
    if matches != []:
        matches = matches[0].strings

sysopfb

Checking the expanded keys shows no difference

t2 uses thiefquests generate_xkey
>>> t2
bytearray(b'\xcav33JX2tdnsedvwwraH6pryV0sd2mxC5uSlhUQCxGxGmxE3ThvKBO1wSh58X4K7CHs0c35btQk1Pr2jaxxfqmD0uISsMH1rowcrluv93hwdD1RgC6MT4q7y34VTL1l4B')
t uses a standard key expansion for RC2
>>> t
bytearray(b'\xcav33JX2tdnsedvwwraH6pryV0sd2mxC5uSlhUQCxGxGmxE3ThvKBO1wSh58X4K7CHs0c35btQk1Pr2jaxxfqmD0uISsMH1rowcrluv93hwdD1RgC6MT4q7y34VTL1l4B')

sysopfb

{
  "lfile": "{id}-Readme.txt", 
  "spsz": 15360, 
  "lend": "SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQgYnkgTmV0d2Fsa2VyLg0KQWxsIGVuY3J5cHRlZCBmaWxlcyBmb3IgdGhpcyBjb21wdXRlciBoYXMgZXh0ZW5zaW9uOiAue2lkfQ0KDQotLQ0KSWYgZm9yIHNvbWUgcmVhc29uIHlvdSByZWFkIHRoaXMgdGV4dCBiZWZvcmUgdGhlIGVuY3J5cHRpb24gZW5kZWQsDQp0aGlzIGNhbiBiZSB1bmRlcnN0b29kIGJ5IHRoZSBmYWN0IHRoYXQgdGhlIGNvbXB1dGVyIHNsb3dzIGRvd24sDQphbmQgeW91ciBoZWFydCByYXRlIGhhcyBpbmNyZWFzZWQgZHVlIHRvIHRoZSBhYmlsaXR5IHRvIHR1cm4gaXQgb2ZmLA0KdGhlbiB3ZSByZWNvbW1lbmQgdGhhdCB5b3UgbW92ZSBhd2F5IGZyb20gdGhlIGNvbXB1dGVyIGFuZCBhY2NlcHQgdGhhdCB5b3UgaGF2ZSBiZWVuIGNvbXByb21pc2VkLg0KUmVib290aW5nL3NodXRkb3duIHdpbGwgY2F1c2UgeW91IHRvIGxvc2UgZmlsZXMgd2l0aG91dCB0aGUgcG9zc2liaWxpdHkgb2YgcmVjb3ZlcnkuDQoNCi0tDQpPdXIgIGVuY3J5cHRpb24gYWxnb3JpdGhtcyBhcmUgdmVyeSBzdHJvbmcgYW5kIHlvdXIgZmlsZXMgYXJlIHZlcnkgd2VsbCBwcm90ZWN0ZWQsDQp0aGUgb25seSB3YXkgdG8gZ2V0IHlvdXIgZmlsZXMgYmFjayBpcyB0byBjb29wZXJhdGUgd2l0aCB1cyBhbmQgZ2V0IHRoZSBkZWNyeXB0ZXIgcHJvZ3JhbS4NCg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG

sysopfb

 Pivot from config at https://twitter.com/VK_Intel/status/1260296104672886790
 
 {
   C2_CHUNK_POST: 0
   C2_POSTREQ: [('_HEADER', 0, 'Content-Type: application/octet-stream'), ('BUILD', ('PARAMETER', 'id'))]
   C2_RECOVER: 
   C2_REQUEST: [('BUILD', ('BASE64', 'HEADER', 'Cookie'))]
   C2_VERB_GET: GET
   C2_VERB_POST: POST
   CRYPTO_sCHEME: 1

sysopfb

>>> a = "0c0d9d01000074030000789c9d934d4f02410c865fffc91e3ca8c9c27eb02ccb519460221135c60b17022b625408207ec4c493ffdb67ca488c091ecca4dd4ee77d3b6da7bba348bb3a50a2022b564d39df887d032bc79b283544ec757563154802b6b0fdb72f51856f1dbefbba581543d50cb163fa4a973ad68542f5d432cf40233d68a247db5d9b35d254cf5a28208f902c121de25f1a2255c60d29675dbcce53c37e4152eece585d75f4e6b30ab467b936c8638dca2da7fd4de64e3ecfcf3fd6bd884c42eb48685504d69b26ba613af259e478ebec52df956ddcd45819ba860ef48eb893cb0d2bb62a63cfcdecbc3096d319b738e499662ae98debcf184c681d9868a839dd5a20377428a083533ca34d6d6d30f7300378033a5d123300bf82796bcc25ef54d29bd267d7d6138c7bac198c2528c768a1fbbfdea78fbc5a8492c8ee9dfa7f46eee9444716ad60adeb8afc59c73316ccc8854ea9dee16ef12cc9a3c9f455b9d3ad8a55b222ea1c7b08efc166b3a23b90e32df1927fc7fb9ebabaff2b229ba1dcfc6f5437841bdbdf92f85988fcf4fd5ccef305148275f30b"
>>> b = binascii.unhexlify(a)
>>> struct.unpack_from('<HII', b)
(3340, 413, 884)
>>> len(b)
414
>>> c = zlib.decompress(b[10:])
>>> len(c)
884

sysopfb

from z3 import *


x = BitVec('x',32)
y = BitVec('y',16)
s = Solver()
s.add(x * ZeroExt(16,y) == 0x7B5658DB)
s.add(ZeroExt(16,x) * ZeroExt(32, y) > 0x7B5658DB)

vals=[]

sysopfb

// Copyright 2009 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// Package tls partially implements TLS 1.2, as specified in RFC 5246,
// and TLS 1.3, as specified in RFC 8446.
//
// TLS 1.3 is available only on an opt-in basis in Go 1.12. To enable
// it, set the GODEBUG environment variable (comma-separated key=value
// options) such that it includes "tls13=1". To enable it from within

sysopfb

Use x86 windbg with 32 bit malware and x64 with 64 bit else you'll get errors loading the correct files with sos


Talos has some stuff to get started with https://blog.talosintelligence.com/2017/07/unravelling-net-with-help-of-windbg.html

Load up the .NET exe into windbg
sxe ld clr
sxe ld clrjit

g

sysopfb

Fast travel:

VirtualProtect on text section before xor decoding next layer

next layer resolves dependencies and then virtualallocs before main code begins


Detection notes:
single byte xor of bytecode is incredibly easy to signature on

sysopfb

enum COMMON_LIBS {
	LIB_ROUTETAB = 0xefae77e3,
	LIB_STOBJECT = 0xac6b1426,
	LIB_MPRDDM = 0xd60496e1,
	LIB_RASDLG = 0xd15380e4,
	LIB_PNGFILT = 0x9b38a0bc,
	LIB_NETAPI32 = 0x4681476c,
	LIB_ITSS = 0x31ac798,
	LIB_WMADMOD = 0x7a30b1f4,
	LIB_WMADMOE = 0x47509844,