https://securelist.com/operation-shadowhammer-a-high-profile-supply-chain-attack/90380/

decode_shadowhammer_plugx.py

# https://securelist.com/operation-shadowhammer-a-high-profile-supply-chain-attack/90380/

from ctypes import c_uint32
from struct import pack,unpack

def decrypt(data):
    p1 = p2 = p3 = p4 = unpack("<L", data[0:4])[0];
    pos = 0
    decdata = ""
    
    while pos < len(data):
        p1 = c_uint32(p1 + (p1 >> 3) - 0x11111111).value
        p2 = c_uint32(p2 + (p2 >> 5) - 0x22222222).value
        p3 = c_uint32(p3 - (p3 << 7) + 0x33333333).value
        p4 = c_uint32(p4 - (p4 << 9) + 0x44444444).value
        decdata += chr( ( ord(data[pos]) ^ ( ( p1%256 + p2%256 + p3%256 + p4%256 ) % 256 ) ) )
        pos += 1
    return decdata