INNER CODE UNIT · Python

chunk

gendigitalinc/ioc · AuraStealer/extras/aurastealer_config_extractor.py:18

        chunk = data[addr : addr + CHUNK_SIZE]

        aes_key = chunk[:32]
        aes_iv = chunk[32:48]
        data_len_masked = int.from_bytes(chunk[48:52], "little")
        mask = int.from_bytes(chunk[52:56], "little")
        data_len = data_len_masked ^ mask

        if data_len + 56 <= len(chunk) and data_len > 0:
            encrypted = chunk[56 : 56 + data_len]
            try:
                decrypted = AES.new(aes_key, AES.MODE_CBC, aes_iv).decrypt(encrypted)
            except (ValueError, TypeError):
                continue

            # Remove PKCS#7 padding
            decrypted = decrypted.rstrip(bytes([decrypted[-1]])).rstrip(b"\x00")

View source record →