initial commit

2026-08-27 11:04:42 -06:00
commit 5ab7731f12
33 changed files with 1794 additions and 0 deletions
@@ -0,0 +1,105 @@
+#!/usr/bin/env python3
+
+import re
+import base64
+from pathlib import Path
+from Crypto.Cipher import AES
+from Crypto.Util.Padding import unpad
+
+correct_order = Path('order.txt').read_text().strip().split('\n')
+correct_order[0] = correct_order[0].split('=')[-1]
+
+print("=" * 80)
+print("decrypting...")
+print("=" * 80)
+
+print(f"\ngot {len(correct_order)} vars:")
+for idx, var_name in enumerate(correct_order, 1):
+    print(f"  {idx:2d}. {var_name}")
+
+content = Path('dontrunACTIVEmalware.bat.txt').read_text(encoding='utf-8', errors='ignore')
+lines = content.split('\n')
+
+variables = {}
+for line in lines:
+    matches = re.findall(r'[sS][eE][tT]\s+([a-zA-Z0-9_]+)=([A-Za-z0-9+/=]{1000,})', line, re.IGNORECASE)
+    for var_name, var_value in matches:
+        variables[var_name] = var_value
+
+print(f"\nfound {len(variables)} b64 vars")
+
+payload_segments = []
+for var_name in correct_order:
+    if var_name in variables:
+        payload_segments.append(variables[var_name])
+        print(f"  ok {var_name}: {len(variables[var_name])} chars")
+    else:
+        print(f"  missing {var_name}")
+
+complete_b64 = ''.join(payload_segments)
+print(f"\ntotal b64: {len(complete_b64)} chars")
+
+encrypted_data = base64.b64decode(complete_b64)
+print(f"decoded: {len(encrypted_data)} bytes")
+
+aes_key = bytes([150,182,100,248,129,91,226,48,131,19,150,255,147,141,114,162,91,237,159,83,174,199,218,120,251,42,139,22,30,130,227,189])
+
+iv = encrypted_data[:16]
+ciphertext = encrypted_data[16:]
+
+print(f"\niv: {iv.hex()}")
+print(f"ciphertext: {len(ciphertext)} bytes")
+
+cipher = AES.new(aes_key, AES.MODE_CBC, iv)
+complete_blocks = (len(ciphertext) // 16) * 16
+if complete_blocks < len(ciphertext):
+    print(f"truncating {len(ciphertext) - complete_blocks} bytes")
+    ciphertext = ciphertext[:complete_blocks]
+
+decrypted = cipher.decrypt(ciphertext)
+
+try:
+    decrypted_unpadded = unpad(decrypted, AES.block_size)
+    print(f"removed padding: {len(decrypted)} -> {len(decrypted_unpadded)} bytes")
+    decrypted = decrypted_unpadded
+except:
+    print(f"no padding found")
+
+print(f"\ndone")
+print(f"size: {len(decrypted)} bytes")
+print(f"first 16: {decrypted[:16].hex()}")
+print(f"first 2: {decrypted[:2]}")
+
+if decrypted[:2] == b'MZ':
+    print(f"\nit's a PE!")
+    
+    Path('payTheload.bin').write_bytes(decrypted)
+    print(f"saved to payTheload.bin")
+    
+    print(f"\ninfo:")
+    print(f"  sig: {decrypted[:2]}")
+    print(f"  size: {len(decrypted)} bytes ({len(decrypted)/1024:.1f} KB)")
+    
+    strings = []
+    current = b''
+    for byte in decrypted[:5000]:
+        if 32 <= byte < 127:
+            current += bytes([byte])
+        else:
+            if len(current) >= 5:
+                try:
+                    strings.append(current.decode('ascii'))
+                except:
+                    pass
+            current = b''
+    
+    if strings:
+        print(f"\nstrings:")
+        for s in strings[:20]:
+            print(f"  {s}")
+else:
+    print(f"\nnot a PE")
+    print(f"got: {decrypted[:2].hex()} (wanted: 4d5a)")
+    print(f"order still wrong maybe?")
+
+print("\n" + "=" * 80)