1ZRR4H

Emotet C2 Webpath generator

Sep 25th, 2019
734
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #!/usr/bin/python
  2. #Author: @1nternaut
  3. #SHA256: DDCCA0FDCE20D14135024C54DA834300FA667F39D0277107D9EAB8F74B748218
  4.  
  5. words = 'teapot,pnp,tpt,splash,site,codec,' \
  6.     'health,balloon,cab,odbc,badge,dma,psec,' \
  7.     'cookies,iplk,devices,enable,mult,prov,' \
  8.     'vermont,attrib,schema,iab,chunk,publish,' \
  9.     'prep,srvc,sess,ringin,nsip,stubs,img,add,' \
  10.     'xian,jit,free,pdf,loadan,arizona,tlb,forced,' \
  11.     'results,symbols,report,guids,taskbar,child,cone,' \
  12.     'glitch,entries,between,bml,usbccid,sym,enabled,' \
  13.     'merge,window,scripts,raster,acquire,json,rtm,walk,ban'
  14.  
  15. def genWebPath(tickcount):
  16.     url = "http(s)://IP:PORT/"
  17.     for i in range((tickcount & 0x3) + 0x1):
  18.         r1 = tickcount % 0x17F
  19.         if(words[r1] == ','):
  20.             url = url + words[r1+1:].split(',')[0] + '/'
  21.         else:
  22.             url = url + words[:r1].split(',')[-1] + '' + words[r1:].split(',')[0] + '/'
  23.         r2 = ~(tickcount / 0x17F) & 0xFFFFFFFF
  24.         tickcount = r2
  25.     print(url)
  26.  
  27. # Input: kernel32.GetTickCount
  28. genWebPath(0x9E58BE)
  29. genWebPath(0x59A854)
  30. genWebPath(0xDEADBEEF)
  31.  
  32. # Output:
  33. # http(s)://IP:PORT/site/codec/forced/
  34. # http(s)://IP:PORT/xian/
  35. # http(s)://IP:PORT/report/stubs/raster/taskbar/
RAW Paste Data