#!/usr/bin/python
# Malware found on virus total
# Modified variant of the Project Hook point-of-sale malware
# Fetches an obfuscated file containing additional C&C domains:
# http://www.localhost0x2.net/config/config_01.bin
# File content is XOR'ed using 0xE8, then Base64 encoded.
# Original File Content - config_01.bin
# gJycmNLHx5+fn8aEh4uJhICHm5zYkNrGho2c
# gJycmNLHx4Sdi4ORxYydhZibxoqBkg==
import base64
# Take the base64 given and decode it and add it to a list
base64info = "gJycmNLHx5+fn8aEh4uJhICHm5zYkNrGho2cgJycmNLHx4Sdi4ORxYydhZibxoqBkg=="
decodedInfo = base64.b64decode(base64info)
infoDecoded = decodedInfo.encode("hex")
# Take the list and make the values of the list a hex number as a string
info = []
counter = 1
for letter in infoDecoded:
if (counter == 1):
listItem = '0x' + letter
counter = 2
elif (counter == 2):
listItem = listItem + letter
info.append(listItem)
counter = 1
# Define the new list of where the hex will go after XORed with the xorKey
newInfo = []
xorKey = 0xe8
for counter in range(0,len(info)):
# Append to the list and remove from the hex 0x68 so it is represented as 68 in the list
newInfo.append(hex(int(info[counter], 16) ^ int(xorKey))[2:])
# Print the list joined together as a string and then decode the hex to ascii
print ''.join(e for e in newInfo).decode("hex")
Twitter: @lokut
This blog is for educational purposes only. The opinions expressed in this blog are my own and do not reflect the views of my employers.
Subscribe to:
Post Comments (Atom)
Test Authentication from Linux Console using python3 pexpect
Working with the IT420 lab, you will discover that we need to discover a vulnerable user account. The following python3 script uses the pex...
-
Here is a quick walk through of GetBoo. The first item that I found was you can harvest the usernames of the existing users that are regist...
-
As I was glancing through the logs of my honeypots I spent some time to look at the following logs. In the past I have just overlooked them...
-
I thought I would work through a few of these web applications provided by OWASP on their broken web applications VM. The first one I th...
-
Today looking at the logs of the honeypots, I became curious based on the whois of the IP Addresses attempting to login to SSH which country...
-
Recently I was doing some scanning with a tool that is available on github called masscan. The tool allows you to configure a configuration...
No comments:
Post a Comment