AppleJeus malware custom string decryption

applejeus_custom_string_dec.py

#!/usr/bin/env python3

#
#   Author: @jaydinbas
#
#   Custom string decryption used by AppleJeus malware
#   See https://www.volexity.com/blog/2022/12/01/buyer-beware-fake-cryptocurrency-applications-serving-as-front-for-applejeus-malware/
#
#   Reference sample: 9352625b3e6a3c998e328e11ad43efb5602fe669aed9c9388af5f55fadfedc78
#   Found in function sub_180001830
#

def rc4crypt(data, key):
    key = bytearray(key)
    data = bytearray(data)

    x = 0
    box = bytearray([i for i in range(256)])
    for i in range(256):
        x = (x + box[i] + key[i % len(key)]) % 256
        box[i], box[x] = box[x], box[i]
    x,y = 0, 0
    for (i,char) in enumerate(data):
        x = (x + 1) % 256
        y = (y + box[x]) % 256
        box[x], box[y] = box[y], box[x]

        data[i] ^= box[(box[x] + box[y]) % 256]
    return bytes(data)

def decrypt_string(s):
    enc_key = b'\xc6\xdfbEb\xd7\xcf\x9c\x9ee\xe0\xf0\xd6\xcd,b\xb7Y\xf5\xa1'
    key_key = b"AppX7y4nbzq37zn4ks9k7amqjywdat7d"

    xor_key = rc4crypt(enc_key,key_key)

    s = bytearray(s)

    for i in range(len(s)):
        s[i] ^= xor_key[i % len(xor_key)]
        s[i] = (s[i] - 0x38) & 0xFF

    return s

# prints bytearray(b'https://www.google.com')
print(decrypt_string(b'\xc2\x95\x9f\xef\xe5\x01\x0f\x17\x8e\xef\x8c-\xaf\x92\xdf\xf2\xc0\xb1P\xa9\xc5\x9c'))