malware_notes

Emotet

Red Dawn Powershell Decode

CyberChef Recipe

From_Base64('A-Za-z0-9+/=',true)
Remove_null_bytes()
Find_/_Replace({'option':'Regex','string':'\\(|\\)|\\\'|\\+'},'',true,false,true,false)
Split('*','\\n')
Extract_URLs(false)

Direct link: https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true)Remove_null_bytes()Find_/_Replace(%7B'option':'Regex','string':'%5C%5C(%7C%5C%5C)%7C%5C%5C%5C'%7C%5C%5C%2B'%7D,'',true,false,true,false)Split('*','%5C%5Cn')Extract_URLs(false)

IOS Enable Edition Powershell Decode

CyberChef Recipe

From_Base64('A-Za-z0-9+/=',true)
Remove_null_bytes()
Split('*','\\n')
Extract_URLs(false)
Find_/_Replace({'option':'Regex','string':'\''},'',true,false,true,false)

Direct link: https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true)Remove_null_bytes()Split('*','%5C%5Cn')Extract_URLs(false)Find_/_Replace(%7B'option':'Regex','string':'%5C''%7D,'',true,false,true,false)