A python script using radare2 for decrypt and patch the strings of GootKit malware
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
README.md
patch_gootkit.py Create patch_gootkit.py Apr 16, 2018

README.md

gootkit_string_patcher

ANALYSIS

http://reversingminds-blog.logdown.com/posts/7369479

DESCRIPTION

A python script using radare2 for decrypt and patch the strings of GootKit malware

OPTIONS

-o [JSON|PLAINTEXT]        print decrypted strings in the given format

EXAMPLES

patch_gootkit.py unpacked_gootkit.exe

patch_gootkit.py unpacked_gootkit.exe -o

patch_gootkit.py unpacked_gootkit.exe -o json

OUTPUT FILE

unpacked_gootkit.exe__patched