ch0ic3/CyberThreatIntel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
StrangerealIntel 2019-08-28 01:22:39 +02:00 committed by GitHub
parent 6dc189293f
commit 26281ef911
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 62 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
offshore APT organization/Bitter/27-08-19/decrypt/decrypt.ps1 Normal file
View File

@ -0,0 +1,62 @@
$a = $args[0];
$mod=$args[1];
$res=@()
switch ($mod) {
1 { $b = $a.ToCharArray();
$c=""
Foreach ($element in $b) {$c = $c + " " + [System.String]::Format("{0:X}", [System.Convert]::ToUInt32($element))}
$c = ( ($c -join "").split() )
$c=$c[1..($c.length -1)]
for($i=0;$i -lt $c.length ;$i++)
{
$tmp=$c[$i]
$tmp=[Convert]::ToInt64($tmp,16) -1
$tmp= '{0:X}' -f $tmp
$tmp= [char][byte]"0x$tmp"
$res+=$tmp
}
break}
2 { $b = $a.ToCharArray();
$c=""
Foreach ($element in $b) {$c = $c + " " + [System.String]::Format("{0:X}", [System.Convert]::ToUInt32($element))}
$c = ( ($c -join "").split() )
$c=$c[1..($c.length -1)]
for($i=0;$i -lt $c.length ;$i++)
{
$tmp=$c[$i]
$tmp=([Convert]::ToInt64($tmp,16) -3) -band 0xFF
$tmp= '{0:X}' -f $tmp
$tmp= [char][byte]"0x$tmp"
$res+=$tmp
}
break}
3 {
$counter=0
$dat=@()
for($i=0; $i -lt $a.length; $i++)
{
if($counter -eq 2)
{
$counter =0;
$dat+= " ";
$dat+=$a[$i]
}
else {$dat+=$a[$i]}
$counter++;
}
$t=($dat -join "").split(" ")
for($i=0; $i -lt $t.length; $i++)
{
$tmp=([Convert]::ToInt64($t[$i],16) -13) -band 0xFF
$tmp= '{0:X}' -f $tmp
$tmp= [char][byte] "0x$tmp"
$res+=$tmp
}
break}
default {write-host "Invalid mod" -ForegroundColor "Red"; exit}
}
$res -join ""