IDA Pro Automated String Decryption For REvil Ransomware

How to use IDA Pro and Python scripting to automatically decrypt RC4-encrypted strings in REvil ransomware samples.

Use IDA Pro and python to automatically decrypt the RC4 strings in REvil (Sodinokibi) ransomware. Expand description for details... ----- OALABS DISCORD discord.gg/6h5Bh5AMDU OALABS PATREON patreon.com/oalabs OALABS TIP JAR ko-fi.com/oalabs OALABS GITHUB github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING unpac.me/#/ ----- Try our free automated malware unpacking service! unpac.me REVil build imports with IDA Pro: youtube.com/watch?v=R4xJou6JsIE Identifying RC4 encryption in malware: youtube.com/watch?v=CiJocXXMXK4 Clean unpacked REvil sample: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93 malshare.com/sample.php?action=detail&hash=890a58f200dfff231… IDA helper functions script (gist): gist.github.com/OALabs/04ef6b2d6203d162c5b3b0eefd49530c IDA 7.xx API backward compatibility with 6.xx hex-rays.com/products/ida/7.0/docs/api70_porting_guide.shtml Best IDA scripting book ever!!! (pay-what-you-can) leanpub.com/IDAPython-Book Feedback, questions, and suggestions are always welcome : ) Sergei twitter.com/herrcore Sean twitter.com/seanmw As always check out our tools, tutorials, and more content over at openanalysis.net #MalwareAnalysis #IDAPro #Ransomware