dodo-sec

Malware-Analysis.

donut-janky-decrypter. Decrypter for payloads created with the donut shellcode tool

astaroth-deobfuscator. IDA python script for deobfuscating Astaroth/Guildma injector DLL

KPOT-string-decrypter. IDA python scripts to decrypt strings from KPOT and set those as comments

ousa-decrypt. Simple C program for decrypting Ousaban/Javali encrypted archive payloads

Astaroth-string-decrypt. Ida python script for automating string decryption of Astaroth/Guildma samples

asta-decrypt.py. Python script for decrypting Astaroth/Guildma encrypted final stage (written to disk as db.temp)

br-banker-decrypter. Simple C++ decrypter+decompresser for brazilian banking malware payloads

amadey-string-renamer. Ida python script to rename Amadey's stdstrings structs to the string assigned to them

delphi-crypt-finder. Python

ousa-decrypt.py. Python version of the code for decrypting Ousaban/Javali encrypted archive payloads