usualsuspect’s gists

usualsuspect / fast16.txt

Created April 26, 2026 18:54

fast16.sys patching instruction list

	[00012ff4] If pattern 48 89 84 24 9c 00 00 00 4b 0f 8f 79 ff ff ff found, patch in 9a 00 02 00 00 1b 00 at +0x0f offset
	[00013014] Add unknown1 to previous match offset +0x10
	[00013034] Store pattern match 48 89 84 24 9c 00 00 00 4b 0f 8f 79 ff ff with offset +0x06 at [0]
	[00013054] Store pattern match 48 89 84 24 9c 00 00 00 4b 0f 8f 79 ff ff ff 00 with offset +0x07 at [1]
	[00013074] If pattern 8b 5d 0c 8b 55 08 8b 36 8b found, patch in 9a e4 02 00 00 1b 00 90 at +0x00 offset
	[00013094] Add unknown1 to previous match offset +0x01
	[000130b4] If pattern 83 ec 04 53 e8 ?? ?? ?? ?? eb 09 83 ec 04 53 found, patch in 9a e8 02 00 00 1b 00 90 90 at +0x17 offset
	[000130d4] Add unknown1 to previous match offset +0x18
	[000130f4] Store pattern match of previous pattern with offset +0x30 at [5]
	[00013114] Store pattern match of previous pattern with offset +0x36 at [6]

usualsuspect / zip_mod_filter.yara

Created April 21, 2026 13:18

YARA rule for zips with file modification filter

	rule zip_file_mod_filter
	{
	meta:
	author = "@jaydinbas"
	description = "Only match zips where every file has newer modification date than 2025-04-01"

	strings:
	$file_sig = "PK\x03\x04" //zip header sig
	$entry_sig = "PK\x01\x02" //central directory header

usualsuspect / secure.py

Created December 10, 2025 14:51

Pure Python implementation of SecureStringToBSTR

	#!/usr/bin/env python3
	#
	# Pure Python code for PowerShell's SecureStringToBSTR API
	#
	# @jaydinbas
	#

	import base64
	import binascii
	import hashlib

usualsuspect / config.txt

Created October 1, 2024 12:28

Cobalt Strike config ns.nacta.in

	BeaconType - Hybrid HTTP DNS
	Port - 1
	SleepTime - 258000
	MaxGetSize - 1527201
	Jitter - 70
	MaxDNS - 255
	PublicKey_MD5 - 111d7dcba67aa777ffbee816c78745e7
	C2Server - ns.nacta.in,/watch/4827893
	UserAgent - Not Found
	HttpPostUri - Not Found

usualsuspect / hash64.py

Created March 8, 2024 15:13

Unknown 64bit hash used for API lookup

	#
	# Used in custom import table to lookup APIs via hash instead of name
	#

	def hash_str64(s):
	h = 0x1111111111111111
	for i in range(len(s)):
	h = h*0xABFFF385ABFFF386
	h &= 0xFFFFFFFFFFFFFFFF
	h += s[i]

usualsuspect / pika_dns_cobaltstrike.txt

Created November 29, 2023 15:04

https://twitter.com/Threatlabz/status/1729571130581934547

	BeaconType - Hybrid HTTP DNS
	Port - 1
	SleepTime - 5000
	MaxGetSize - 2798028
	Jitter - 45
	MaxDNS - 247
	PublicKey_MD5 - d94a9ed1b7edf342d1723b57a8485051
	C2Server - dns.ionoslaba.com,/dev/coke/CQHL5IYQF
	UserAgent - Not Found
	HttpPostUri - Not Found

usualsuspect / config.txt

Created November 28, 2023 20:24

	BeaconType - Hybrid HTTP DNS
	Port - 1
	SleepTime - 3000
	MaxGetSize - 1048576
	Jitter - 20
	MaxDNS - 255
	PublicKey_MD5 - 34aa5e72eba144f50c75d5ad3bb11d43
	C2Server - ns1.data.microsoftdata.site,/ga.js,ns2.data.microsoftdata.site,/visit.js,ns3.data.microsoftdata.site,/IE9CompatViewList.xml,ns4.data.microsoftdata.site,/dpixel
	UserAgent - Not Found
	HttpPostUri - Not Found

usualsuspect / config.txt

Created November 23, 2023 13:30

"BreakPoint Software Inc." signed Cobalt Strike config

	BeaconType - HTTPS
	Port - 443
	SleepTime - 45000
	MaxGetSize - 2801745
	Jitter - 37
	MaxDNS - Not Found
	PublicKey_MD5 - 6b11b512dcbf5063bafcc82a0e1c2bc1
	C2Server - www.tosoh.cloudns.ph,/jquery-3.3.1.min.js
	UserAgent - Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
	HttpPostUri - /jquery-3.3.2.min.js

usualsuspect / exproler_config.txt

Created July 11, 2023 18:37

Pokemon Cobalt Strike Config

	BeaconType - HTTPS
	Port - 443
	SleepTime - 10000
	MaxGetSize - 1398322
	Jitter - 20
	MaxDNS - Not Found
	PublicKey_MD5 - e516ca02d126b82ff30593ce45d9cba5
	C2Server - 47.94.58.82,/api/v1/server/user/info
	UserAgent - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
	HttpPostUri - /api/v1/server/log

usualsuspect / decrypt.py

Created May 2, 2023 11:21

String decryption for unknown malware

	#!/usr/bin/env python3
	#
	# String decryption for unknown malware
	#
	# Author: @jaydinbas (2023-05-02)
	#
	# Reference sample:
	#
	# https://www.virustotal.com/gui/file/88c10674bb6a53791bfe08497948699bf57ea9980a878a3a5fc1afb160d1d234
	#