Get a PE file section offset and size. returns: a tuple with the section offset and size

XOR the data with the given key

XOR decrypt with rolling key args: data: a bytes object representing the encrypted data constant: a magic number used to tran

Simulate KoiLoader's generation of a random string. This is used as the second part of the key material.

Generate and set the public key and shared secret, given the threat actor public key. ta_public_key: bytes object representing the t

Send initial check in request, transmitting the GUID, Build ID, and Base64 encoded public key Returns: response object

Send the next check in request, transmitting the XOR key part and encrypted OS/Username/Computer Name Returns: response object

Count null separation in a buffer

Interlock group uses this algorithm for decryption of transmitted victim system information to their C2

Generator that returns ASCII formatted base64 strings

Extract Amatera malware configuration.

This function will be run in a separate process and serves to parse the minidump with Dumpulator and extract the C2 and strings.

Extract all byte arrays, concatenate, and return bytes of zip

Interlock group uses this algorithm for encrypting and compressing system information before its sent to their C2

Send the request to the C2 to get the command Returns: response object