initial commit

original/decrypt_order.py

@@ -0,0 +1,105 @@
+#!/usr/bin/env python3
+
+import re
+import base64
+from pathlib import Path
+from Crypto.Cipher import AES
+from Crypto.Util.Padding import unpad
+
+correct_order = Path('order.txt').read_text().strip().split('\n')
+correct_order[0] = correct_order[0].split('=')[-1]
+
+print("=" * 80)
+print("decrypting...")
+print("=" * 80)
+
+print(f"\ngot {len(correct_order)} vars:")
+for idx, var_name in enumerate(correct_order, 1):
+    print(f"  {idx:2d}. {var_name}")
+
+content = Path('dontrunACTIVEmalware.bat.txt').read_text(encoding='utf-8', errors='ignore')
+lines = content.split('\n')
+
+variables = {}
+for line in lines:
+    matches = re.findall(r'[sS][eE][tT]\s+([a-zA-Z0-9_]+)=([A-Za-z0-9+/=]{1000,})', line, re.IGNORECASE)
+    for var_name, var_value in matches:
+        variables[var_name] = var_value
+
+print(f"\nfound {len(variables)} b64 vars")
+
+payload_segments = []
+for var_name in correct_order:
+    if var_name in variables:
+        payload_segments.append(variables[var_name])
+        print(f"  ok {var_name}: {len(variables[var_name])} chars")
+    else:
+        print(f"  missing {var_name}")
+
+complete_b64 = ''.join(payload_segments)
+print(f"\ntotal b64: {len(complete_b64)} chars")
+
+encrypted_data = base64.b64decode(complete_b64)
+print(f"decoded: {len(encrypted_data)} bytes")
+
+aes_key = bytes([150,182,100,248,129,91,226,48,131,19,150,255,147,141,114,162,91,237,159,83,174,199,218,120,251,42,139,22,30,130,227,189])
+
+iv = encrypted_data[:16]
+ciphertext = encrypted_data[16:]
+
+print(f"\niv: {iv.hex()}")
+print(f"ciphertext: {len(ciphertext)} bytes")
+
+cipher = AES.new(aes_key, AES.MODE_CBC, iv)
+complete_blocks = (len(ciphertext) // 16) * 16
+if complete_blocks < len(ciphertext):
+    print(f"truncating {len(ciphertext) - complete_blocks} bytes")
+    ciphertext = ciphertext[:complete_blocks]
+
+decrypted = cipher.decrypt(ciphertext)
+
+try:
+    decrypted_unpadded = unpad(decrypted, AES.block_size)
+    print(f"removed padding: {len(decrypted)} -> {len(decrypted_unpadded)} bytes")
+    decrypted = decrypted_unpadded
+except:
+    print(f"no padding found")
+
+print(f"\ndone")
+print(f"size: {len(decrypted)} bytes")
+print(f"first 16: {decrypted[:16].hex()}")
+print(f"first 2: {decrypted[:2]}")
+
+if decrypted[:2] == b'MZ':
+    print(f"\nit's a PE!")
+    
+    Path('payTheload.bin').write_bytes(decrypted)
+    print(f"saved to payTheload.bin")
+    
+    print(f"\ninfo:")
+    print(f"  sig: {decrypted[:2]}")
+    print(f"  size: {len(decrypted)} bytes ({len(decrypted)/1024:.1f} KB)")
+    
+    strings = []
+    current = b''
+    for byte in decrypted[:5000]:
+        if 32 <= byte < 127:
+            current += bytes([byte])
+        else:
+            if len(current) >= 5:
+                try:
+                    strings.append(current.decode('ascii'))
+                except:
+                    pass
+            current = b''
+    
+    if strings:
+        print(f"\nstrings:")
+        for s in strings[:20]:
+            print(f"  {s}")
+else:
+    print(f"\nnot a PE")
+    print(f"got: {decrypted[:2].hex()} (wanted: 4d5a)")
+    print(f"order still wrong maybe?")
+
+print("\n" + "=" * 80)

original/extract_vars.py

@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+
+import re
+from pathlib import Path
+
+content = Path('dontrunACTIVEmalware.bat.txt').read_text(encoding='utf-8', errors='ignore')
+lines = content.split('\n')
+
+variables = {}
+
+for i, line in enumerate(lines, 1):
+    for match in re.finditer(r'"([^"=]+)=([^"]*)"', line):
+        var_name = match.group(1).strip()
+        var_value = match.group(2).strip()
+        if var_name not in variables:
+            variables[var_name] = var_value
+    
+    for match in re.finditer(r'[sS][eE][tT]\s+([a-zA-Z0-9_\[\]\{\}\(\)]+)=([^\s&]+)', line, re.IGNORECASE):
+        var_name = match.group(1).strip()
+        var_value = match.group(2).strip()
+        if var_name not in variables and len(var_value) < 100:
+            variables[var_name] = var_value
+
+print(f"found {len(variables)} vars")
+
+bang_vars = {k: v for k, v in variables.items() if '!' in v}
+print(f"vars with !: {len(bang_vars)}")
+for k, v in bang_vars.items():
+    print(f"  {k} = {v}")
+
+line_42 = lines[41]
+print(f"\nline 42:")
+print(f"  {line_42[:200]}...")
+
+resolved = line_42
+for iteration in range(50):
+    old_resolved = resolved
+    matches = re.findall(r'%([^%]+)%', resolved)
+    for var_name in matches:
+        if var_name in variables:
+            resolved = resolved.replace(f'%{var_name}%', variables[var_name])
+    if old_resolved == resolved:
+        break
+
+print(f"\nresolved after {iteration+1} tries:")
+print(f"  {resolved[:500]}...")
+
+if '!' in resolved:
+    parts = [p.strip() for p in resolved.split('!') if p.strip()]
+    print(f"\ngot {len(parts)} parts")
+    
+    clean_parts = []
+    for part in parts:
+        cleaned = re.sub(r'%[^%]+%', '', part)
+        cleaned = cleaned.strip()
+        if cleaned:
+            clean_parts.append(cleaned)
+    
+    print(f"\ncleaned ({len(clean_parts)}):")
+    for idx, part in enumerate(clean_parts, 1):
+        print(f"  {idx:2d}. {part}")
+    
+    Path('order.txt').write_text('\n'.join(clean_parts))
+    print(f"\nsaved to order.txt")

original/output/order.txt

@@ -0,0 +1,21 @@
+SET43Nn4obTrQ0J=j97KQu6
+JIMZlyBt
+lloztMu
+oAWM9gN3
+xAEr2y8D
+u9HraJGX
+xNF82uy
+amiieM
+ih0wojr
+SeLNlxJi
+nrp2Cd
+ndOVLLU5
+ilUetRQ
+Ravpss
+tTp84C
+rNQFeP
+kd7VYdp
+OD1pagW
+k7EmPoW
+TGOERjgr
+xWiRpFW