# Path: malwareconfig/fileparser.py
# class FileParser:
#     def __init__(self, file_path=None, rawdata=None):
#     def yarascan(self):
#     def file_hash(self, hash_type="sha256"):
#     def pe_resource_id(self, res_id):
#         def modules_callback(data):
#     def pe_resource_names(self):
#     def pe_resource_by_name(self, resource_name):
#     def dotnet_resource_names(self):
#         def modules_callback(data):
#     def dotnet_resource_by_name(self, resource_name):
#         def modules_callback(data):
#     def dotnet_guids(self):
#         def modules_callback(data):
#     def dotnet_user_strings(self):
#         def modules_callback(data):
#     def ascii_strings(self, min_len=4):
#     def unicode_strings(self, min_len=4):
#     def file_from_zip(self, filename):
#     def zip_namelist(self):
#     def parse_apk(self):
#     def elf_list_sections(self):
#         def modules_callback(data):
#     def elf_section_by_name(self, resource_name):
#         def modules_callback(data):
# 
# Path: malwareconfig/crypto.py
# def decrypt_rsa(key, data):
# def decrypt_xor(key, data):
# def decrypt_arc4(key, data):
# def decrypt_des_ecb(key, data, iv=None):
# def decrypt_des_cbc(key, data, iv=None):
# def decrypt_des3(key, data):
# def decrypt_aes(key, data):
# def decrypt_aes_cbc_iv(key, iv, data):
# def decrypt_blowfish(key, data):
# def decrypt_RC6(key, encrypted, P, Q, rounds):
#     def rol(a, i):
#     def ror(a, i):
#     def to_int(bytestring):
#     def decrypt_block(block, S):
# def derive_pbkdf2(key, salt, iv_length, key_length, iterations=8):
#     T = 2 * rounds + 4
#     L = to_int(key)
#     S = []
#     S = [0 for i in range(T)]
#     S[0] = P
#     A = 0
#     B = 0
#         A = S[i] = rol((S[i] + A + B), 3)
#         B = L[j] = rol((L[j] + A + B), (A + B))
# 
# Path: malwareconfig/common.py
# class Decoder(object):
#     decoder_name = ""
#     decoder_version = 1
#     decoder_author = ""
#     decoder_description = ""
#     file_info = object
# 
#     def set_file(self, file_info):
#         self.file_info = file_info
# 
#     def get_config(self):
#         pass
# 
# Path: malwareconfig/common.py
# def string_printable(line):
#     line = str(line)
#     new_line = ''
#     for c in line:
#         if c in string.printable:
#             new_line += c
#         else:
#             new_line += '\\x' + c.encode("utf-8").hex()
#     return new_line


import javaobj # sudo pip3 install javaobj-py3
from xml.etree import ElementTree as ET
from malwareconfig import fileparser
from io import BytesIO
from malwareconfig import crypto
from malwareconfig.common import Decoder
from malwareconfig.common import string_printable
            rsa_key_string = self.extract_rsa_key(rsa_serialized_key)

            # Decrypt the AES Key using the RSA Key
            aes_key = crypto.decrypt_rsa(rsa_key_string, encrypted_aes_key)

        except:
            # Read in serialized RSA KeyRep file.
            aes_encrypted_config = file_info.file_from_zip('lp/sq/d.png')
            aes_key = 'lks03oeldkfirowl'

        # Use the AES Key to decrpyt the config
        aes_decrypted_xml = crypto.decrypt_aes(aes_key[-16:], aes_encrypted_config)
        parsed_xml = self.parse_xml(aes_decrypted_xml)

        # Extract the implant using the xml properties
        rsa_serialized_key_path = parsed_xml['PRIVATE_PASSWORD'].lstrip('/')
        aes_path = parsed_xml['PASSWORD_CRYPTED'].lstrip('/')
        implant_path = parsed_xml['SERVER_PATH'].lstrip('/')

        rsa_serialized_key = file_info.file_from_zip(rsa_serialized_key_path)
        encrypted_aes_key = file_info.file_from_zip(aes_path)
        aes_encrypted_jar = file_info.file_from_zip(implant_path)

        # Another round of extraction
        rsa_key_string = Jbifrost.extract_rsa_key(rsa_serialized_key)
        aes_key = crypto.decrypt_rsa(rsa_key_string, encrypted_aes_key)

        implant_jar = crypto.decrypt_aes(aes_key[-16:], aes_encrypted_jar)

        # Update for new file

# Path: malwareconfig/fileparser.py
# class FileParser:
#     def __init__(self, file_path=None, rawdata=None):
#     def yarascan(self):
#     def file_hash(self, hash_type="sha256"):
#     def pe_resource_id(self, res_id):
#         def modules_callback(data):
#     def pe_resource_names(self):
#     def pe_resource_by_name(self, resource_name):
#     def dotnet_resource_names(self):
#         def modules_callback(data):
#     def dotnet_resource_by_name(self, resource_name):
#         def modules_callback(data):
#     def dotnet_guids(self):
#         def modules_callback(data):
#     def dotnet_user_strings(self):
#         def modules_callback(data):
#     def ascii_strings(self, min_len=4):
#     def unicode_strings(self, min_len=4):
#     def file_from_zip(self, filename):
#     def zip_namelist(self):
#     def parse_apk(self):
#     def elf_list_sections(self):
#         def modules_callback(data):
#     def elf_section_by_name(self, resource_name):
#         def modules_callback(data):
# 
# Path: malwareconfig/crypto.py
# def decrypt_rsa(key, data):
# def decrypt_xor(key, data):
# def decrypt_arc4(key, data):
# def decrypt_des_ecb(key, data, iv=None):
# def decrypt_des_cbc(key, data, iv=None):
# def decrypt_des3(key, data):
# def decrypt_aes(key, data):
# def decrypt_aes_cbc_iv(key, iv, data):
# def decrypt_blowfish(key, data):
# def decrypt_RC6(key, encrypted, P, Q, rounds):
#     def rol(a, i):
#     def ror(a, i):
#     def to_int(bytestring):
#     def decrypt_block(block, S):
# def derive_pbkdf2(key, salt, iv_length, key_length, iterations=8):
#     T = 2 * rounds + 4
#     L = to_int(key)
#     S = []
#     S = [0 for i in range(T)]
#     S[0] = P
#     A = 0
#     B = 0
#         A = S[i] = rol((S[i] + A + B), 3)
#         B = L[j] = rol((L[j] + A + B), (A + B))
# 
# Path: malwareconfig/common.py
# class Decoder(object):
#     decoder_name = ""
#     decoder_version = 1
#     decoder_author = ""
#     decoder_description = ""
#     file_info = object
# 
#     def set_file(self, file_info):
#         self.file_info = file_info
# 
#     def get_config(self):
#         pass
# 
# Path: malwareconfig/common.py
# def string_printable(line):
#     line = str(line)
#     new_line = ''
#     for c in line:
#         if c in string.printable:
#             new_line += c
#         else:
#             new_line += '\\x' + c.encode("utf-8").hex()
#     return new_line


# Path: malwareconfig/decoders/jbifrost.py
import javaobj # sudo pip3 install javaobj-py3
from xml.etree import ElementTree as ET
from malwareconfig import fileparser
from io import BytesIO
from malwareconfig import crypto
from malwareconfig.common import Decoder
from malwareconfig.common import string_printable

            rsa_key_string = self.extract_rsa_key(rsa_serialized_key)

            # Decrypt the AES Key using the RSA Key
            aes_key = crypto.decrypt_rsa(rsa_key_string, encrypted_aes_key)

        except:
            # Read in serialized RSA KeyRep file.
            aes_encrypted_config = file_info.file_from_zip('lp/sq/d.png')
            aes_key = 'lks03oeldkfirowl'

        # Use the AES Key to decrpyt the config
        aes_decrypted_xml = crypto.decrypt_aes(aes_key[-16:], aes_encrypted_config)
        parsed_xml = self.parse_xml(aes_decrypted_xml)

        # Extract the implant using the xml properties
        rsa_serialized_key_path = parsed_xml['PRIVATE_PASSWORD'].lstrip('/')
        aes_path = parsed_xml['PASSWORD_CRYPTED'].lstrip('/')
        implant_path = parsed_xml['SERVER_PATH'].lstrip('/')

        rsa_serialized_key = file_info.file_from_zip(rsa_serialized_key_path)
        encrypted_aes_key = file_info.file_from_zip(aes_path)
        aes_encrypted_jar = file_info.file_from_zip(implant_path)

        # Another round of extraction
        rsa_key_string = Jbifrost.extract_rsa_key(rsa_serialized_key)
        aes_key = crypto.decrypt_rsa(rsa_key_string, encrypted_aes_key)

        implant_jar = crypto.decrypt_aes(aes_key[-16:], aes_encrypted_jar)

        # Update for new file

        new_info = fileparser.FileParser(rawdata=implant_jar)