Module ImportFrom alias Import alias Import alias ImportFrom alias Import alias FunctionDef arguments args NameParam defaults body Expr Str Assign NameStore Num For NameStore Call NameLoad Call NameLoad Call NameLoad NameLoad body Assign NameStore SubscriptStore NameLoad Index NameLoad BinOpBitXor SubscriptLoad NameLoad Index NameLoad NameLoad Return NameLoad decorator_list FunctionDef arguments args NameParam defaults body Assign NameStore Dict Assign SubscriptStore NameLoad Index Str Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr Num Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign NameStore SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr Num Assign SubscriptStore NameLoad Index Str Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr Num Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad body Assign NameStore Dict Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr SubscriptLoad NameLoad Index Str If NameLoad body Assign SubscriptStore NameLoad Index Str Call NameLoad NameLoad Return NameLoad decorator_list FunctionDef arguments args NameParam defaults body Expr Str Assign NameStore Dict Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign NameStore Call NameLoad For NameStore Call NameLoad SubscriptLoad NameLoad Index Str body Assign NameStore Dict Assign SubscriptStore NameLoad Index Str Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr Num Assign NameStore SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Expr Call AttributeLoad NameLoad attr NameLoad Assign SubscriptStore NameLoad Index Str NameLoad Return NameLoad decorator_list FunctionDef arguments args NameParam defaults body Assign NameStore Dict Assign NameStore Call AttributeLoad NameLoad attr Num If NameLoad body Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str NameLoad Index Num For NameStore Call NameLoad SubscriptLoad NameLoad Index Str body Assign NameStore SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign NameStore Call NameLoad Call NameLoad Call AttributeLoad NameLoad attr NameLoad Assign SubscriptStore NameLoad Index Call AttributeLoad Str attr NameLoad Call AttributeLoad NameLoad attr Str Return NameLoad decorator_list FunctionDef arguments args NameParam defaults body Assign NameStore Dict Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num If CompareEq SubscriptLoad NameLoad Index Str Num body Assign NameStore Call NameLoad NameLoad NameLoad Expr Call AttributeLoad NameLoad attr Num orelse If CompareEq SubscriptLoad NameLoad Index Str Num body Assign SubscriptStore NameLoad Index Str Str Assign SubscriptStore NameLoad Index Str Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr Num Expr Call AttributeLoad NameLoad attr Num orelse If CompareEq SubscriptLoad NameLoad Index Str Num body Assign NameStore Call NameLoad NameLoad NameLoad Expr Call AttributeLoad NameLoad attr Num orelse If CompareEq SubscriptLoad NameLoad Index Str Num body Assign SubscriptStore NameLoad Index Str Str Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Expr Call AttributeLoad NameLoad attr Num If CompareEq SubscriptLoad NameLoad Index Str Num body Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr SubscriptLoad NameLoad Index Str Assign SubscriptStore NameLoad Index Str Call NameLoad NameLoad If CompareEq SubscriptLoad NameLoad Index Str Num body Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str Call NameLoad Call NameLoad Call AttributeLoad NameLoad attr SubscriptLoad NameLoad Index Str Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str Call NameLoad Call NameLoad Call AttributeLoad NameLoad attr SubscriptLoad NameLoad Index Str Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Assign SubscriptStore NameLoad Index Str Str Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign NameStore SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Assign SubscriptStore NameLoad Index Str Str Assign SubscriptStore NameLoad Index Str Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr Num Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign SubscriptStore NameLoad Index Str SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num Assign NameStore SubscriptLoad NameLoad Index Str Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Assign SubscriptStore NameLoad Index Str Call NameLoad BinOpBitAnd NameLoad Num Return NameLoad decorator_list FunctionDef arguments args NameParam defaults body Assign NameStore Dict Assign NameStore Num Assign NameStore SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num While CompareNotEq NameLoad Num body Assign SubscriptStore NameLoad Index Call AttributeLoad Str attr NameLoad Call AttributeLoad Call NameLoad Call NameLoad Call AttributeLoad NameLoad attr NameLoad attr Str Assign NameStore SubscriptLoad Call NameLoad Str Call AttributeLoad NameLoad attr Num Index Num AugAssignAdd NameStore Num Return NameLoad decorator_list FunctionDef arguments args NameParam defaults body Expr Str Assign NameStore Dict Assign NameStore Call AttributeLoad NameLoad attr Str NameLoad If UnaryOpNot NameLoad body Assign SubscriptStore NameLoad Index Str Str Return NameLoad Assign NameStore Call AttributeLoad BinOpBitXor Call NameLoad Call AttributeLoad NameLoad attr Num Num attr Num keyword Str keyword NameLoad Assign SubscriptStore NameLoad Index Str Call AttributeLoad NameLoad attr NameLoad If CompareEq Call NameLoad Call AttributeLoad NameLoad attr Num Num body Assign SubscriptStore NameLoad Index Str Str orelse Assign SubscriptStore NameLoad Index Str Str Assign SubscriptStore NameLoad Index Str Call NameLoad Call NameLoad Call AttributeLoad NameLoad attr Num Return NameLoad decorator_list
N/A pprint pprint N/A re N/A socket struct unpack N/A sys decrypt_cnc_msg N/A N/A ct N/A N/A N/A 
    Decrypt strings
    ct: bytearray of the ciphertext
    returns bytearray of the plaintext
     N/A k 255 N/A i N/A reversed N/A range N/A len ct N/A N/A k N/A ct N/A i N/A N/A ct N/A i k N/A ct N/A parse_cnc1_config N/A N/A f N/A N/A N/A data N/A N/A N/A data N/A cnccfg_ext_ip N/A N/A socket inet_ntoa N/A N/A f read 4 N/A N/A data N/A cnccfg_nb_thdscan_local N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data N/A cnccfg_nb_thdscan_ext N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A third_field N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data N/A cnccfg_flag_scanner_sniffer N/A bool N/A third_field 1 N/A N/A data N/A cnccfg_flag_nolocalscan N/A bool N/A third_field 2 N/A N/A data N/A cnccfg_flag_noextscan N/A bool N/A third_field 4 N/A N/A data N/A cnccfg_flag_test10073 N/A bool N/A third_field 8 N/A N/A data N/A cnccfg_flag_nattraversal N/A bool N/A third_field 16 N/A N/A data N/A cnccfg_flag_recontactcnc N/A bool N/A third_field 32 N/A N/A data N/A cnccfg_flag_hijackdns N/A bool N/A third_field 64 N/A N/A data N/A cnccfg_flag_thd_sniffer N/A bool N/A third_field 128 N/A N/A data N/A cnccfg_flag_killprocess N/A bool N/A third_field 1024 N/A N/A data N/A cnccfg_flag_share_peers N/A bool N/A third_field 2048 N/A N/A data N/A cnccfg_proxy_max_clients N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data N/A cnccfg_relaycnc_sleep N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data N/A cnccfg_reportcnc_ip N/A N/A socket inet_ntoa N/A N/A f read 4 N/A N/A data N/A cnccfg_relaycnc_ip N/A N/A socket inet_ntoa N/A N/A f read 4 N/A N/A data N/A cnccfg_relaycnc_timeout N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data N/A cnccfg_hijackdns1_ip N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data N/A cnccfg_hijackdns2_ip N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A data N/A parse_cnc1_cracklist N/A N/A f results N/A False N/A N/A data N/A N/A N/A data N/A userpass_list_len N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A pass_list N/A bytearray N/A N/A f read N/A data N/A userpass_list_len N/A results N/A N/A N/A data N/A wordlist N/A decrypt_cnc_msg pass_list N/A data N/A parse_cnc1_whitelist_seg N/A N/A f N/A N/A N/A deals with server whitelist allowed to connect to 10073 N/A data N/A N/A N/A data N/A whitelist_len N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A whlst N/A list N/A pair N/A range N/A data N/A whitelist_len N/A N/A whlst_entry N/A N/A N/A whlst_entry N/A ip N/A N/A socket inet_ntoa N/A N/A f read 4 N/A whlst_flags N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A whlst_entry N/A can_email N/A bool N/A whlst_flags 1 N/A N/A N/A whlst append whlst_entry N/A N/A data N/A whitelist whlst N/A data N/A parse_cnc1_sniffer_config N/A N/A f N/A N/A N/A data N/A N/A opt_data N/A N/A f read 4 N/A opt_data N/A N/A N/A data N/A snfcfg_nb_items N/A N/A unpack I opt_data N/A 0 N/A i N/A range N/A data N/A snfcfg_nb_items N/A N/A snfcfg_item_size N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A snfcfg_item N/A decrypt_cnc_msg N/A bytearray N/A N/A f read snfcfg_item_size N/A N/A data N/A N/A N/A snfcfg_{:02d}_needle format i N/A N/A snfcfg_item decode ascii N/A data N/A parse_cnc_request N/A N/A f N/A N/A N/A data N/A N/A N/A data N/A version N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data N/A msg_type N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A N/A data N/A msg_type 1 N/A N/A data N/A parse_cnc_request_config f data N/A N/A N/A f read 8 N/A N/A N/A N/A data N/A msg_type 14 N/A N/A N/A data N/A msg_type_decoded REPORT_TELNET_LOGIN N/A N/A data N/A ipaddr N/A N/A socket inet_ntoa N/A N/A f read 4 N/A N/A N/A f read 28 N/A N/A N/A N/A data N/A msg_type 15 N/A N/A data N/A parse_cnc_request_infect f data N/A N/A N/A f read 20 N/A N/A N/A N/A data N/A msg_type 20 N/A N/A N/A data N/A msg_type_decoded REPORT_SNIFF N/A N/A data N/A pkt_len N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A N/A f read 28 N/A N/A N/A data N/A msg_type 20 N/A N/A ct N/A bytearray N/A N/A f read N/A data N/A pkt_len N/A N/A data N/A sniff_payload N/A decrypt_cnc_msg ct N/A N/A N/A data N/A msg_type 15 N/A N/A N/A data N/A cpu_model_len N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data N/A cpu_model N/A decrypt_cnc_msg N/A bytearray N/A N/A f read N/A data N/A cpu_model_len N/A N/A data N/A processor_len N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data N/A processor N/A decrypt_cnc_msg N/A bytearray N/A N/A f read N/A data N/A processor_len N/A data N/A parse_cnc_request_config N/A N/A f data N/A N/A N/A N/A data N/A msg_type_decoded REQUEST_CONFIG N/A N/A data N/A loop_count N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data N/A nb_localscans N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data N/A nb_extscans N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data N/A nb_ifscans N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data N/A nb_killed N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A off_1C N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data N/A flag_BRUTEFORCE_LIST N/A bool N/A off_1C 1 N/A N/A data N/A flag_WRITE_ACCESS N/A bool N/A off_1C 2 N/A N/A data N/A flag_TIME_PROBLEM N/A bool N/A off_1C 128 N/A data N/A parse_cnc_request_infect N/A N/A f data N/A N/A N/A N/A data N/A msg_type_decoded REPORT_GOT_SHELL N/A N/A data N/A ipaddr N/A N/A socket inet_ntoa N/A N/A f read 4 N/A N/A data N/A lst_userpass_offset N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data N/A infect_state N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A off_10 N/A data N/A infect_state N/A N/A data N/A infect_state_NO_CHMOD N/A bool N/A off_10 1 N/A N/A data N/A infect_state_NO_ECHO N/A bool N/A off_10 2 N/A N/A data N/A infect_state_FOUND_NEAR_SCAN N/A bool N/A off_10 4 N/A N/A data N/A infect_state_PS_BLKLST_HIT N/A bool N/A off_10 128 N/A data N/A parse_cnc3_response N/A N/A f N/A N/A N/A data N/A N/A idx 0 N/A data_len N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A N/A data_len 0 N/A N/A N/A data N/A N/A N/A cmd_{!s} format idx N/A N/A N/A decrypt_cnc_msg N/A bytearray N/A N/A f read data_len decode ascii N/A data_len N/A N/A unpack I N/A N/A f read 4 N/A 0 N/A idx 1 N/A data N/A parse_rnde_query N/A N/A s N/A N/A N/A 
    Data from our sinkhole will be full of 127.x.y.z IPs. This is because
    our host configuration makes the malware reply to it. You can ignore these
    hits which are local only
     N/A data N/A N/A m N/A N/A re search ^\/xx\/rnde\.php\?p=(-?\d+)&f=(\d+)&m=(\d)$ s N/A N/A m N/A N/A N/A data N/A error PARSING ERROR! N/A data N/A packed_ip N/A N/A N/A N/A int N/A N/A m group 1 2022747085 to_bytes 4 byteorder little signed True N/A N/A data N/A ip_reported N/A N/A socket inet_ntoa packed_ip N/A N/A N/A int N/A N/A m group 2 0 N/A N/A N/A data N/A reporter_byteorder big N/A N/A N/A data N/A reporter_byteorder little N/A N/A data N/A flag_ext_scan N/A bool N/A int N/A N/A m group 3 N/A data N/A