INNER CODE UNIT · Python

encrypted

gendigitalinc/ioc · AuraStealer/extras/aurastealer_config_extractor.py:27

            encrypted = chunk[56 : 56 + data_len]
            try:
                decrypted = AES.new(aes_key, AES.MODE_CBC, aes_iv).decrypt(encrypted)
            except (ValueError, TypeError):
                continue

            # Remove PKCS#7 padding
            decrypted = decrypted.rstrip(bytes([decrypted[-1]])).rstrip(b"\x00")

            # Check all bytes are printable ASCII
            if all(32 <= b <= 127 for b in decrypted):
                return decrypted
    return None


def main():
    parser = argparse.ArgumentParser()
    group = parser.add_mutually_exclusive_group(required=True)

View source record →