Skip to content

Instantly share code, notes, and snippets.

View sysopfb's full-sized avatar

sysopfb

View GitHub Profile
@sysopfb
sysopfb / gist:92887be2b46659bb929fba28de7206eb
Created September 21, 2018 16:47
Domains for fake zeus leading TDS
spcialsuivre.tk
majeurproduire.tk
alimentairimaginer.tk
humaincrire.tk
suivantarriver.tk
purraliser.tk
completexprimer.tk
localcontenir.tk
faibleremettre.tk
diverseffectuer.tk
@sysopfb
sysopfb / v5.proto
Created July 25, 2017 15:55
Emotet v5 protocol
syntax="proto2";
message regrequest {
required int32 command = 1;
required string botId = 2;
required fixed32 osVersion = 3;
required fixed32 crc32 = 4;
required string procList = 5;
required string mailClient = 6;
required string unknown = 7;
@sysopfb
sysopfb / wcr.py
Last active August 17, 2021 10:13 — forked from mak/wcr.py
Extract everything from WannaCry
import re
import os,sys
import pefile
import struct
import zipfile
import hashlib
import StringIO
from Crypto import Random
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_v1_5,AES
@sysopfb
sysopfb / aplib.py
Created October 13, 2016 17:01
aplib python library
# this is a standalone single-file merge of aplib compression and decompression
# taken from my own library Kabopan http://code.google.com/p/kabopan/
# (no other clean-up or improvement)
# Ange Albertini, BSD Licence, 2007-2011
# from kbp\comp\_lz77.py ##################################################
def find_longest_match(s, sub):
"""returns the number of byte to look backward and the length of byte to copy)"""
if sub == "":
@sysopfb
sysopfb / certs.txt
Last active September 25, 2016 19:20 — forked from crazybyte/certs.txt
NOTE: HTTP SSL keys are all in PEM format (base64 encoded)
#From PEM format to DER
openssl x509 -in $1.crt -out $1.der -outform DER
#From DER format to PEM
openssl x509 -in $1.der -inform DER -out $1.pem -outform PEM
#Transforming RSA key to DER format
openssl rsa -in oberon.key -inform PEM -out oberon_key.der -outform DER