Decode_njRat_GZipVersion

# A script to decode embedded executable inside some njRat samples

import sys,os,time,base64,io,gzip





def DecodeX(input_file):
    if os.path.exists(input_file)==False:
        print "File does not exist\r\n"
        return
    fIn = open(input_file,"r")
    Content64 = fIn.read()
    fIn.close
    GzipContent = base64.b64decode(Content64)
    compressed_file = io.BytesIO(GzipContent)
    Decompressed = gzip.GzipFile(fileobj=compressed_file)
    ContentFinal = Decompressed.read()
    FileName, FileExt = os.path.splitext(input_file)
    fGz = open(FileName + ".exe","wb")
    fGz.write(ContentFinal)
    fGz.close()





def main():
    if len(sys.argv)!=2:
        print "Usage: Decode.py input.txt\r\n"
        sys.exit(-1)
    else:
        DecodeX(sys.argv[1])
        sys.exit(0)


if __name__ == "__main__":
    main();