• ./flubot/CryptaxRocks.java: string de-obfuscation
• ./flubot/flubot.js: Frida hook to display plaintext communication with C&C
• ./frida-hook/michaelrocks.js: Frida hook to display de-obfuscated strings
• ./flubot/DGA.java: standalone implementation of Flubot's DGA algorithm

• string-decode.py: standalone Python script to de-obfuscate Ztorg strings
• DeobfuscateZtorg.py: JEB2 script to de-obfuscate Ztorg strings
• r2ztorg.py : Radare2 r2pipe script to de-obfuscated Android/Ztorg strings

• ReplaceAllatori.py: replace the ALLATORIxDEMO obfuscated string
• JEBAllatori.py: de-obfuscation but not replacing

• tous_anti.py: decrypt selected Base64+encrypted strings and put the result as comment

• aka Bankbot
• sha256: ec3a10b4f38b45b7551807ba4342b111772c712c198e6a1a971dd043020f39a2
• De-obfuscate strings: AlienBankbotDecrypt.py. Script for JEB4.

• b64script.py: decode selected Base64 strings and put the result as comment

See ./glucose-tools directory

• spyserv.py: Dummy server to display uncompressed messages for Android malware for malware sha256: 885d07d1532dcce08ae8e0751793ec30ed0152eee3c1321e2d051b2f0e3fa3d7

• grab-oji.py: Script to automatically grab fresh samples. This can be used to upload the samples to your favorite malware database for detection. Works as of May 7, 2021.

Malware sha256: aad80d2ad20fe318f19b6197b76937bf7177dbb1746b7849dd7f05aab84e6724

• MoqHaoUnpacker.java: program to unpack the sample. Provide as argument the encrypted asset. e.g. efl15a

Malware sha256: fd1aac87399ad22234c503d8adb2ae9f0d950b6edf4456b1515a30100b5656a7

• bahamutDecrypt.py: decrypts files or strings encrypted by the malware

Malware sha256: 5b9049c392eaf83b12b98419f14ece1b00042592b003a17e4e6f0fb466281368

• UnpackJwi.java: unpacks the encrypted asset file
• fakebianserver: fake C&C template