MRG Effitas automatic XOR decryptor tool

[Nytro]

MRG Effitas automatic XOR decryptor tool

Posted by Zoltan Balazs on February 1, 2014 in Latest | 0 comments

Malware writers tend to protect their binaries and configuration files with XOR encryption. Luckily, they never heard about the one-time-pad requirement, which requires “never reuse the XOR key”.

Binary files usually have long sequence of null bytes, which means the short XOR key (4 ascii characters in most of the cases) used by the malware writers can be spotted in the binary as a recurring pattern.

This Python script (tested and developed on Python 3.3) can find these recurring patterns in the beginning of the XOR encrypted binary, calculate the correct “offset” of the key, use this XOR key to decrypt the encrypted file, and check the result for known strings.

The tool was able to find the correct XOR key in 90% of the cases, in other cases fine-tuning the default parameters can help. We used this tool to decyrpt the XOR encrypted binaries found in network dumps. For example when exploit kits (e.g. Neutrino) were able to infect the victim, and the payload is delivered to the victim as a XOR encrypted binary.

For a list of parameters, run # python auto_xor_decryptor.py -h

The tool is released under GPLv3 licence.

The script can be found on our Github account:

https://github.com/MRGEffitas/scripts/blob/master/auto_xor_decryptor.py

An example run of the tool looks like the following:

c:\python33\python auto_xor_decryptor.py --input malware\48_.mp3

Auto XOR decryptor by MRG Effitas. Developed and tested on Python 3.3!This tool can automatically find short XOR keys in a XOR encrypted binary file, and use

that to decrypt the XOR encrypted binary. Most parameters are good on default

but if it is not working for you, you might try to fine-tune those.

XOR key: b’626a6b68626a6b68626a6b68626a6b68626a6b68626a6b68626a6b68626a6b68626a6b68626a6b68626a6b68626a6b68626a6b6862?

XOR key ascii: b’bjkh’

XOR key hex: b’626a6b68?

Offset: 1

Final XOR key: b’jkhb’

Great success! input read from : malware\48_.mp3,

output written to : decrypted

MRG Effitas Team

Sursa: Publishing of MRG Effitas automatic XOR decryptor tool | MRG Effitas