Insomni'hack 2025: de-obfuscating strings in Linux/RudeDevil

--:----:--

Insomni'hack 2025: de-obfuscating strings in Linux/RudeDevil

by cryptax 17 hours ago

GNU/Linux ◆ xterm-256color ◆ bash 97 views

Using r2ai, we decompile the main of RudeDevil. We verify the cryptocurrency address is not a hallucination, nor function EncryptData. Then, we see the arguments passed to EncryptData: an encrypted buffer, a buffer length and a key. We ask the AI to write a Python script to decrypt the strings. We verify and edit the script the AI wrote: there were a few errors on how to display the decrypted strings. We run the script on our host and get the decrypted string value (a malicious URL).

This concerns a malicious sample of Linux/RudeDevil of February 2025.

More by cryptax

r2ai asking for authorization to execute scripts, commands etc 01:10

by cryptax 1 month ago

Attacker downloading Mozi malware on a honeypot 00:15

by cryptax 4 years ago

See all

You can download this recording in asciicast v2 format, as a .cast file.

Download

Replay in terminal

You can replay the downloaded recording in your terminal using the asciinema play command:

asciinema play 708621.cast

If you don't have asciinema CLI installed then see installation instructions.

Use with stand-alone player on your website

Download asciinema player from the releases page (you only need .js and .css file), then use it like this:

<!DOCTYPE html>
<html>
<head>
  <link rel="stylesheet" type="text/css" href="asciinema-player.css" />
</head>
<body>
  <div id="player"></div>
  <script src="asciinema-player.min.js"></script>
  <script>
    AsciinemaPlayer.create(
      '/assets/708621.cast',
      document.getElementById('player'),
      { cols: 144, rows: 40 }
    );
  </script>
</body>
</html>

See asciinema player quick-start guide for full usage instructions.

While this site doesn't provide GIF conversion at the moment, you can still do it yourself with the help of asciinema GIF generator utility - agg.

Once you have it installed, generate a GIF with the following command:

agg https://asciinema.org/a/708621 demo.gif

Or, if you already downloaded the recording file:

agg demo.cast demo.gif

Check agg --help for all available options. You can change font family and size, select color theme, adjust speed and more.

See agg manual for full usage instructions.