plugin_dridex.py

#!/usr/bin/env python

__description__ = 'Dridex string decoder for oledump.py'
__author__ = 'James Habben'
__version__ = '0.0.1'
__date__ = '2015/01/29'

import re

def Decode (input) :
    work = input[4:-4]
    strKeyEnc = StripCharsWithZero(work[(len(work) / 2) - 2: (len(work) / 2)])
    strKeySize = StripCharsWithZero(work[(len(work) / 2): (len(work) / 2) + 2])
    nCharSize = strKeySize - strKeyEnc
    work = work[:(len(work) / 2) - 2] + work[(len(work) / 2) + 2:]
    strKeyEnc2 = StripChars(work[(len(work) / 2) - (nCharSize/2): (len(work) / 2) + (nCharSize/2)])
    work = work[:(len(work) / 2) - (nCharSize/2)] + work[(len(work) / 2) + (nCharSize/2):]
    work_split = [work[i:i+nCharSize] for i in range(0, len(work), nCharSize)]
    decoded = ''
    for group in work_split:
        decoded += chr(StripChars(group)/strKeyEnc2)
    return decoded

def StripChars (input) :
    result = ''
    for c in input :
        if c.isdigit() :
            result += c
    return int(result)

def StripCharsWithZero (input) :
    result = ''
    for c in input :
        if c.isdigit() :
            result += c
        else:
            result += '0'
    return int(result)

class cDridexDecoder(cPluginParent):
    macroOnly = True
    name = 'Dridex decoder'

    def __init__(self, name, stream, options):
        self.streamname = name
        self.stream = stream
        self.options = options
        self.ran = False

    def Analyze(self):
        self.ran = True

        result = []

        oREString = re.compile(r'"([^"\n]+)"')
        for foundString in oREString.findall(self.stream):
            try:
                result.append(Decode(foundString))
            except:
                pass

        return result

AddPlugin(cDridexDecoder)