![](data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48"><rect fill-opacity="0"/></svg>)
Quick reminder, you can decrypt encrypted Mustang Panda payloads with my tool xorex
github.com/Neo23x0/xorex
I've just increased the default maximum XOR key length to 15 (before 10) to make it decrypt the payload right away
ポストを翻訳
![画像](data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="360" height="330"><rect fill-opacity="0"/></svg>)
![画像](data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="360" height="198"><rect fill-opacity="0"/></svg>)
引用
![](data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24"><rect fill-opacity="0"/></svg>)
avallach (@xorhex@infosec.exchange)
@xorhex
#RedDelta version of #PlugX; this time encrypted with a 13 byte XOR key.
43.254.217.165:110
43.254.217.165:80
Embedded Marker: ja-user-pc
ThreatConnect: cutt.ly/rkk9wdH
VT (encrypted): cutt.ly/Akk9t6c
5d2856d38f182cba36a045935ed11a17
#MustangPanda
さらに表示
![画像](data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="436" height="680"><rect fill-opacity="0"/></svg>)
![画像](data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="680" height="582"><rect fill-opacity="0"/></svg>)
17