INNER CODE UNIT · Python

extract

gendigitalinc/ioc · AuraStealer/extras/aurastealer_config_extractor.py:6

def extract(data: bytes) -> bytes:
    """
    Encrypted config structure:
        [AES_KEY]              - 32 bytes
        [AES_IV]               - 16 bytes
        [LEN_MASKED]           - 4 bytes (data length XORed with MASK
        [MASK]                 - 4 bytes
        [ENCRYPTED_DATA]       - LEN bytes (AES-CBC encrypted config data with PKCS#7 padding)
    """
    # The config is typically of size < 500 bytes, so 2kB chunks should be enough
    CHUNK_SIZE = 2048
    for addr in range(0, len(data) - CHUNK_SIZE + 1, 4):
        chunk = data[addr : addr + CHUNK_SIZE]

        aes_key = chunk[:32]
        aes_iv = chunk[32:48]
        data_len_masked = int.from_bytes(chunk[48:52], "little")
        mask = int.from_bytes(chunk[52:56], "little")

View source record →