@@ -0,0 +1,1439 @@
+from malwareconfig import crypto%0Afrom malwareconfig.common import Decoder%0Afrom malwareconfig.common import string_printable%0A%0A%0Aclass Bozok(Decoder):%0A    decoder_name = %22Bozok%22%0A    decoder__version = 1%0A    decoder_author = %22@kevthehermit%22%0A    decoder_description = %22Bozok Decoder%22%0A%0A    def __init__(self):%0A        self.config = %7B%7D%0A%0A%0A    def get_config(self):%0A        %22%22%22%0A        This is the main entry%0A        :return:%0A        %22%22%22%0A%0A        config_data = self.file_info.pe_resource_by_name('CFG')%0A%0A        config_data = config_data.decode('utf-8').replace('%5Cx00', '')%0A        config_fields = config_data.split('%7C')%0A%0A        config_dict = %7B'ServerID': config_fields%5B0%5D,%0A                       'InstallName': config_fields%5B2%5D,%0A                       'StartupName': config_fields%5B3%5D,%0A                       'Extension': config_fields%5B4%5D,%0A                       'Password': config_fields%5B5%5D,%0A                       'Install Flag': config_fields%5B6%5D,%0A                       'Startup Flag': config_fields%5B7%5D,%0A                       'Visible Flag': config_fields%5B8%5D,%0A                       'Unknown Flag1': config_fields%5B9%5D,%0A                       'Unknown Flag2': config_fields%5B10%5D,%0A                       'Port': config_fields%5B11%5D,%0A                       'Domain': config_fields%5B12%5D,%0A                       'Unknown Flag3': config_fields%5B13%5D%0A                       %7D%0A%0A        # Set the config to the class for use%0A        self.config = config_dict%0A

Add Bozok Decoder