前言

　　一个用于从SideWinder APT组织常用的hat文件中解密C2链接地址的Python脚本，示例代码对一些老的hat文件效果比较好，新的样本可能需要根据实际情况修改下，最初是用于对VT上命中的大量样本进行批量提取C2地址用的

示例代码

# -*- coding: utf-8

import base64

import re

import sys

def myXor(key, data):

    out = ""

    i = 0

    datalen = len(data)

    while i < datalen:

        for j in range(len(key)):

            tmp = ord(data[i]) ^ ord(key[j])

            out += chr(tmp)

            i += 1

            if i >= len(data):

                break

    return out

def myBase64Decode(key, string):

    #某些情况下会出问题：“asEqf170rcEU” -> “|abx|oeq” -> 正确结果应该是“|abx|oeq|”

    result = []

    string = string.strip("=")

    binstr = ""

    bin6list = []

    bin8list = []

    #key = "JXaYOjSNTet1dDrHsVlc0m5EknG7Ko6qibhFBuyzQUwxWCp4ZLf23gAvMR8PI9+/"

    for ch in string:

        bin6list.append("{:>06}".format(str(bin(key.index(ch)).replace("0b", ""))))

    binstr = "".join(bin6list)

    for i in range(0, len(binstr), 8):

        bin8list.append(binstr[i:i + 8])

    for item in range(len(bin8list) - 1):

        result.append(chr(int(bin8list[item], 2)))

    return "".join(result)

def myBase64Decode2(key, string):

    STANDARD_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'

    CUSTOM_ALPHABET = key

    ENCODE_TRANS = str.maketrans(STANDARD_ALPHABET, CUSTOM_ALPHABET)

    DECODE_TRANS = str.maketrans(CUSTOM_ALPHABET, STANDARD_ALPHABET)

    return base64.b64decode(string.translate(DECODE_TRANS))

def myGetb64(data):

    b64 = re.search("var b64 = \"(.+)\";", data).group(1)

    return b64

def myGetkeeeeKey(data):

    keeee = re.search("var keeee = .+?\(\"(.+)\",", data).group(1)

    return keeee

def myGetkeeeeData(data):

    keeee = re.search("var keeee = .+\((.+)\)\);", data).group(1)

    keeee = keeee.replace("\"+\"", "")

    keeee = keeee.replace("\"", "")

    return keeee

def myGetkeeee(data):

    key = myGetkeeeeKey(data)

    str = myGetkeeeeData(data)

    keeee = bytes.decode(myBase64Decode2(b64, str))

    return myXor(key, keeee)

def myGetaUrl(data):

    url = re.search("var aUrl = .+?\((.+)\)\+x;", data).group(1)

    url = url.replace("\"+\"", "")

    url = url.replace("\"", "")

    return url

def myDecodeUrl(keeee, data):

    return myXor(keeee, data)

if __name__ == '__main__':

    if 1 >= len(sys.argv):

        print("输入文件路径参数后重试")

        exit(1)

    try:

        f = open(sys.argv[1], 'r')

        data = f.read()

        f.close()

        b64 = myGetb64(data).replace("=", "")

        keeee = myGetkeeee(data)

        encodeUrl = myGetaUrl(data)

        strurl = bytes.decode(myBase64Decode2(b64, encodeUrl))

        url = myDecodeUrl(keeee, strurl)

        print(url)

    except:

        print("文件不支持或其它错误:(")

感兴趣的小伙伴可以根据样本自己修改下

3e14d22a63775a59878a71d80ea17bfd

4dc475b2055b5a880cbd67526b0f6e3c

94ae178768482ead9b0c0612325a9eeb

354a7e51b5ae982ce24b588c12f34ae1

884e404b0d8b34e98f90809909171e90

1333fb41972e81a99ada7e2df5ba014f

69737cb11c6596298a5bf1958f5d1ad3

484214759657cc28daa61de086d526f2

ca90bf0bc5771caf82f991641b316562

f158bffa5f876619aa745e23a2800c9d

巴特西

【APT】响尾蛇(SideWinder)Hta文件自动解密C2

前言

示例代码

最新文章

热门文章