MCPcopy Create free account

hub / github.com/eSentire/iocs / functions

Functions188 in github.com/eSentire/iocs

⨍ Functions 188◇ Types & classes 8
↓ 1 callersFunctionget_rdata
(pe, data)
LummaC2/Lumma.py:82
↓ 1 callersMethodget_serial
(self, hwid)
Stealc/stealc_hwid.py:66
↓ 1 callersFunctionget_sha256_hash
(string)
EarthKapre/EarthKapre-IDA.py:73
↓ 1 callersFunctionhandleStage3
(ast)
DEV#POPPER/DEV#STOPPER.js:111
↓ 1 callersFunctionhandleStager
(ast)
DEV#POPPER/DEV#STOPPER.js:46
↓ 1 callersFunctionisStager
(ast)
DEV#POPPER/DEV#STOPPER.js:764
↓ 1 callersFunctionis_base64
(s)
LummaC2/Lumma.py:59
↓ 1 callersFunctionis_ciphertext
(b: bytes)
DarkCloud/DarkCloud-IDA.py:62
↓ 1 callersFunctionis_possible_key_string
(b: bytes)
DarkCloud/DarkCloud-IDA.py:69
↓ 1 callersFunctionis_public_ip
(ip)
Amatera/Amatera.py:115
↓ 1 callersFunctionis_valid_domain
(data)
Amatera/Amatera.py:126
↓ 1 callersFunctionmain
()
Sinobi/curve-25519+aes-128-ctr.py:47
↓ 1 callersFunctionmain
()
Prometei/Prometei_Additional_Module_Decrypter.py:8
↓ 1 callersFunctionmain
()
Prometei/Prometei_Unpacker.py:46
↓ 1 callersFunctionmain
()
Stealc/stealc_hwid.py:70
↓ 1 callersFunctionmain
()
Koi/extract_koiloader_stage2.py:25
↓ 1 callersFunctionmain
()
Koi/emulate_c2.py:213
↓ 1 callersFunctionmain
()
Interlock/interlock_backdoor_simulate_client.py:104
↓ 1 callersFunctionmain
()
EarthKapre/EarthKapre-Stage2-C2-Request-Decrypter.py:31
↓ 1 callersFunctionmain
()
EarthKapre/EarthKapre-Stage2-Payload-Decrypter.py:95
↓ 1 callersFunctionmain
()
EarthKapre/EarthKapre-Stage1-C2.py:6
↓ 1 callersFunctionmain
()
EarthKapre/EarthKapre-Stage2-C2.py:108
↓ 1 callersFunctionmain
()
EarthKapre/EarthKapre-IDA.py:212
↓ 1 callersFunctionmain
()
DeerStealer/DeerStealer.py:415
↓ 1 callersFunctionmain
()
NetSupport/NetSupport_PowerShell_Unpacker.py:101
↓ 1 callersMethodmake_hwid
(self, volume_serial)
Stealc/stealc_hwid.py:27
↓ 1 callersFunctionmemory_address_to_file_offset
(pe, memory_address)
EarthKapre/EarthKapre-Stage2-Payload-Decrypter.py:37
↓ 1 callersFunctionmemory_address_to_file_offset
(pe, memory_address)
DeerStealer/decrypt_stage_2.py:64
↓ 1 callersFunctionnumeric_password
(password: str)
DarkCloud/DarkCloud-IDA.py:25
↓ 1 callersFunctionnumeric_password
(password: str)
DarkCloud/DarkCloud.py:78
↓ 1 callersFunctionprocess_code_blocks
Process multiple file blocks
NetSupport/NetSupport_PowerShell_Unpacker.py:29
↓ 1 callersMethodrandomize
(self, seed: float)
DarkCloud/DarkCloud-IDA.py:12
↓ 1 callersMethodrandomize
(self, seed: float)
DarkCloud/DarkCloud.py:65
↓ 1 callersFunctionread_file
(file_path)
NetSupport/NetSupport_PowerShell_Unpacker.py:96
↓ 1 callersFunctionremove_nulls
Modify a buffer removing null bytes
Koi/extract_koiloader_stage2.py:108
↓ 1 callersMethodrnd
(self)
DarkCloud/DarkCloud-IDA.py:19
↓ 1 callersMethodrnd
(self)
DarkCloud/DarkCloud.py:72
↓ 1 callersFunctionto_printable_ascii
(byte)
Sinobi/curve-25519+aes-128-ctr.py:35
↓ 1 callersFunctionunshuffleStringToArray
(o, c)
DEV#POPPER/DEV#STOPPER.js:57
↓ 1 callersFunctionwrite_file
(data, path)
EarthKapre/EarthKapre-Stage2-Payload-Decrypter.py:90
↓ 1 callersFunctionxor_blake3_decrypt
(data: bytes, master_secret: bytes, salt: bytes)
ShadowCoil/shadowcoil_unpacker.py:42
↓ 1 callersFunctionxor_data
(data, key)
Koi/extract_koiloader_stage2.py:84
↓ 1 callersFunctionxor_data
(data, key)
Amatera/Amatera.py:108
↓ 1 callersFunctionxor_data
(data, key)
LummaC2/Lumma.py:93
↓ 1 callersFunctionxor_data
(data, key)
EarthKapre/EarthKapre-Stage2-C2-Request-Decrypter.py:6
↓ 1 callersFunctionxor_data
(data, key)
EarthKapre/EarthKapre-Stage2-Payload-Decrypter.py:70
↓ 1 callersFunctionxor_generate
(last_result: int)
Interlock/interlock_backdoor_simulate_client.py:23
↓ 1 callersMethodxor_interlock
Decrypts a C2 response using a specific XOR-based algorithm.
Interlock/interlock_backdoor_simulate_client.py:78
↓ 1 callersFunctionyara_scan
(raw_data, rule_source)
LummaC2/Lumma.py:49
↓ 1 callersFunctionyara_scan
(raw_data, rule_source)
EarthKapre/EarthKapre-Stage2-Payload-Decrypter.py:48
↓ 1 callersFunctionyara_scan
(raw_data, rule_source)
DeerStealer/decrypt_stage_2.py:45
↓ 1 callersFunctionyara_scan_generator
(raw_data, rule_source)
DarkCloud/DarkCloud.py:122
↓ 1 callersFunctionyara_scan_generator
(raw_data, rule_source)
LummaC2/Lumma.py:39
Function"VariableDeclarator|FunctionDeclaration"
(path)
DEV#POPPER/DEV#STOPPER.js:735
FunctionBinaryExpression
(path)
DEV#POPPER/DEV#STOPPER.js:568
FunctionCallExpression
(path)
DEV#POPPER/DEV#STOPPER.js:305
MethodDecompress
(byte[] byteArray)
Pure Crypter/PureCrypterPunisher/Program.cs:503
MethodDecryptPayload
(byte[] encryptedBytes)
Nightshade/SandboxBypass/Program.cs:15
MethodExtractConfig
(string payloadsDir, Assembly assembly)
Pure Crypter/PureCrypterPunisher/Program.cs:80
FunctionFunctionDeclaration
(path)
DEV#POPPER/DEV#STOPPER.js:268
MethodGetSha256
(byte[] byteArray)
Pure Crypter/PureCrypterPunisher/Program.cs:489
MethodHandleObjectProperties
(string payloadsDir, object obj, int indent = 0, HashSet<object> visited = null)
Pure Crypter/PureCrypterPunisher/Program.cs:356
MethodIsComplexType
(Type type)
Pure Crypter/PureCrypterPunisher/Program.cs:498
MethodMain
(string[] args)
Nightshade/SandboxBypass/Program.cs:24
MethodMain
(string[] args)
Pure Crypter/PureCrypterPunisher/Program.cs:542
MethodMatchPayloadMethod
(IList<dnlib.DotNet.Emit.Instruction> instrs, int index)
Pure Crypter/PureCrypterPunisher/Program.cs:249
MethodMatchesDecryptMethodPattern
(IList<dnlib.DotNet.Emit.Instruction> instrs, int index)
Pure Crypter/PureCrypterPunisher/Program.cs:210
FunctionMemberExpression
(path)
DEV#POPPER/DEV#STOPPER.js:89
FunctionObjectProperty
(path)
DEV#POPPER/DEV#STOPPER.js:649
MethodParsePureCrypterPayload
(ModuleDefMD mod)
Pure Crypter/PureCrypterPunisher/Program.cs:34
MethodPatchCrossReferences
(Assembly asm, ModuleDefMD mod)
Pure Crypter/PureCrypterPunisher/Program.cs:298
MethodProcessMainMethod
(IList<dnlib.DotNet.Emit.Instruction> instrs, int index)
Pure Crypter/PureCrypterPunisher/Program.cs:134
FunctionProgram
(path)
DEV#POPPER/DEV#STOPPER.js:728
FunctionReturnStatement
(retPath)
DEV#POPPER/DEV#STOPPER.js:511
MethodSetTargetMethod
(ModuleDefMD mod)
Pure Crypter/PureCrypterPunisher/Program.cs:350
MethodShowHelp
()
Pure Crypter/PureCrypterPunisher/Program.cs:522
FunctionStringLiteral
(path)
DEV#POPPER/DEV#STOPPER.js:756
FunctionVariableDeclarator
(path)
DEV#POPPER/DEV#STOPPER.js:244
Method__init__
(self)
DarkCloud/DarkCloud-IDA.py:9
Method__init__
(self)
DarkCloud/DarkCloud.py:62
Method__init__
(self, c2_url, user_agent, build_id, ta_public_key, domain=None, proxy_http=None, proxy_https=None)
Koi/emulate_c2.py:41
Method__init__
(self, host, port)
Interlock/interlock_backdoor_simulate_client.py:35
Method_build
(self, obj, stream, context, path)
DeerStealer/DeerStealer.py:95
Method_parse
(self, stream, context, path)
DeerStealer/DeerStealer.py:61
Functioncustom_b64decode
(data)
EarthKapre/EarthKapre-Stage2-C2.py:24
Functiondecrypt_response_payload
Interlock group returns an XOR encrypted response Last 4 bytes is the XOR key
Interlock/interlock_php_c2_pseudocode.py:5
Functionfind_encrypted_c2_blocks
(data)
LummaC2/Lumma.py:203
Functionsimulate_c2_request
(url)
EarthKapre/EarthKapre-Stage2-C2.py:51
← previous101–188 of 188, ranked by callers