Advertisement
waliedassar

Decode_njRat_3DES

Apr 25th, 2015
536
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 0.83 KB | None | 0 0
  1. #Decoder for some obfuscated njRat version
  2. #Link:
  3. import os,sys,time
  4. from Crypto.Cipher import DES3
  5. import base64
  6.  
  7.  
  8.    
  9. def XXcipherDecode3DESXX(inFile,outFile):
  10.     key = "0102030405060708090a0b0c0d0e0f101112131415161718".decode('hex')
  11.     iv = "2109162d0B01061E".decode('hex')
  12.    
  13.     cipher = DES3.new( key, DES3.MODE_CBC, iv)
  14.     fIn = open(inFile,"rb")
  15.     contentX = fIn.read()
  16.     contentX_Base64Decoded = base64.b64decode(contentX)
  17.     fIn.close()
  18.     decryptedX = cipher.decrypt(contentX_Base64Decoded)
  19.     fOut = open(outFile,"wb")
  20.     fOut.write(decryptedX)
  21.     fOut.close()
  22.  
  23.  
  24.  
  25. def main():
  26.     if len(sys.argv)!=3:
  27.         print "Usage: Decode_njRat_3Des.py input.txt outputfile.exe"
  28.         sys.exit(-1)
  29.     else:
  30.         XXcipherDecode3DESXX(sys.argv[1],sys.argv[2])
  31.  
  32. if __name__ == "__main__":
  33.     main()
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement