{"id":13755057,"url":"https://github.com/lacike/gandcrab_string_decryptor","last_synced_at":"2025-05-10T00:31:34.926Z","repository":{"id":142026130,"uuid":"182073985","full_name":"laciKE/gandcrab_string_decryptor","owner":"laciKE","description":"IDC script for decrypting strings in the GandCrab v5.1-5.3","archived":false,"fork":false,"pushed_at":"2019-04-24T22:48:22.000Z","size":395,"stargazers_count":5,"open_issues_count":0,"forks_count":4,"subscribers_count":4,"default_branch":"master","last_synced_at":"2024-02-12T15:17:40.880Z","etag":null,"topics":["gandcrab","ida","idc","malware-analysis"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/laciKE.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2019-04-18T11:19:21.000Z","updated_at":"2023-06-05T13:04:26.000Z","dependencies_parsed_at":"2024-01-13T03:00:57.158Z","dependency_job_id":"544c9f2f-fdec-4b24-9efd-65efc3c9391d","html_url":"https://github.com/laciKE/gandcrab_string_decryptor","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/laciKE%2Fgandcrab_string_decryptor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/laciKE%2Fgandcrab_string_decryptor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/laciKE%2Fgandcrab_string_decryptor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/laciKE%2Fgandcrab_string_decryptor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/laciKE","download_url":"https://codeload.github.com/laciKE/gandcrab_string_decryptor/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253346488,"owners_count":21894264,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["gandcrab","ida","idc","malware-analysis"],"created_at":"2024-08-03T10:00:42.444Z","updated_at":"2025-05-10T00:31:34.405Z","avatar_url":"https://github.com/laciKE.png","language":"C","funding_links":[],"categories":["\u003ca id=\"9dcc6c7dd980bec1f92d0cc9a2209a24\"\u003e\u003c/a\u003e字符串"],"sub_categories":["功能"],"readme":"# GandCrab String Decryptor\n\nIda C script for string decryption.\n\nTested with GandCrab v 5.1 (DLL) and GandCrab v 5.2 (exe) and 5.3 (exe)\n\nTesting samples SHA265:\n  - 6aa3f17e5f62b715908b5cb3ea462bfa6cecfd3f4d70078eabd418291a5a7b83\n  - 017b236bf38a1cf9a52fc0bdee2d5f23f038b00f9811c8a58b8b66b1c756b8d6\n  - 1791e9d01451f953e74249019654609cd33c2ab66e97f2ed7a609e99f9ce8320\n  - d01fd7176d48d8210fe85923ff383d87dab7d2e2b37e9da58c7e075a1aae153c\n\n## How it works\n\nThis script will try to identify the string decrypt function, which should be the heavily used function and it should be short.\nString decryption function takes one argument and extracts from it the key, length of encrypted data and encrypted data itself. Encryption is RC4, as we can see below:\n\n![String decryption function](gandcrab_decrypt_string_function.png)\n\n![RC4 decryption](gandcrab_RC4_decrypt_function.png)\n\nThen, this script finds the calls to the string decryption and reconstructs its argument from \"mov\" instructions which manipulate with the local variables (see picture below). After the extraction of the parameters for RC4 it is possible to decrypt string and perform check if it is ASCII or Unicode string. Finaly, this script makes the comments with decrypted values:\n\n![RC4 decryption](gandcrab_decrypted_strings.png)\n\n![RC4 decryption](gandcrab_script_output.png)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flacike%2Fgandcrab_string_decryptor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flacike%2Fgandcrab_string_decryptor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flacike%2Fgandcrab_string_decryptor/lists"}