import pefile
import struct

def parse_config(config_list):
    config_dict = {}
    config_dict['DGA Seed Document'] = config_list[36]
    config_dict['Registry Key'] = config_list[38]
    config_dict['Browser Path 1'] = config_list[37]
    config_dict['User agent'] = config_list[12]
    config_dict['OS version'] = config_list[13]
    config_dict['Batch script'] = config_list[95]
    config_dict['Client Hello'] = config_list[100]
    config_dict['Connection check command'] = config_list[334]
    return config_dict

def config(raw_data):
    pe = pefile.PE(data=raw_data, fast_load=False)

    for section in pe.sections:
        if section.Name.rstrip('\x00') == ".bss":
            config = section.get_data()[:section.SizeOfRawData]

    if config == None:
        return
        
    config_list = config.split(b'\x00')
    
    # Crude check to make sure we have a decrypted section
    if config_list[0] == "ADVAPI32.DLL":
        config_dict = parse_config(config_list)
        return config_dict

    return
656c521328056920ccacb05b245c3117519f2738
<mask token>

<mask token>


def config(raw_data):
    pe = pefile.PE(data=raw_data, fast_load=False)
    for section in pe.sections:
        if section.Name.rstrip('\x00') == '.bss':
            config = section.get_data()[:section.SizeOfRawData]
    if config == None:
        return
    config_list = config.split(b'\x00')
    if config_list[0] == 'ADVAPI32.DLL':
        config_dict = parse_config(config_list)
        return config_dict
    return

<mask token>


def parse_config(config_list):
    config_dict = {}
    config_dict['DGA Seed Document'] = config_list[36]
    config_dict['Registry Key'] = config_list[38]
    config_dict['Browser Path 1'] = config_list[37]
    config_dict['User agent'] = config_list[12]
    config_dict['OS version'] = config_list[13]
    config_dict['Batch script'] = config_list[95]
    config_dict['Client Hello'] = config_list[100]
    config_dict['Connection check command'] = config_list[334]
    return config_dict


def config(raw_data):
    pe = pefile.PE(data=raw_data, fast_load=False)
    for section in pe.sections:
        if section.Name.rstrip('\x00') == '.bss':
            config = section.get_data()[:section.SizeOfRawData]
    if config == None:
        return
    config_list = config.split(b'\x00')
    if config_list[0] == 'ADVAPI32.DLL':
        config_dict = parse_config(config_list)
        return config_dict
    return

import pefile
import struct


def parse_config(config_list):
    config_dict = {}
    config_dict['DGA Seed Document'] = config_list[36]
    config_dict['Registry Key'] = config_list[38]
    config_dict['Browser Path 1'] = config_list[37]
    config_dict['User agent'] = config_list[12]
    config_dict['OS version'] = config_list[13]
    config_dict['Batch script'] = config_list[95]
    config_dict['Client Hello'] = config_list[100]
    config_dict['Connection check command'] = config_list[334]
    return config_dict


def config(raw_data):
    pe = pefile.PE(data=raw_data, fast_load=False)
    for section in pe.sections:
        if section.Name.rstrip('\x00') == '.bss':
            config = section.get_data()[:section.SizeOfRawData]
    if config == None:
        return
    config_list = config.split(b'\x00')
    if config_list[0] == 'ADVAPI32.DLL':
        config_dict = parse_config(config_list)
        return config_dict
    return

import pefile
import struct

def parse_config(config_list):
    config_dict = {}
    config_dict['DGA Seed Document'] = config_list[36]
    config_dict['Registry Key'] = config_list[38]
    config_dict['Browser Path 1'] = config_list[37]
    config_dict['User agent'] = config_list[12]
    config_dict['OS version'] = config_list[13]
    config_dict['Batch script'] = config_list[95]
    config_dict['Client Hello'] = config_list[100]
    config_dict['Connection check command'] = config_list[334]
    return config_dict

def config(raw_data):
    pe = pefile.PE(data=raw_data, fast_load=False)

    for section in pe.sections:
        if section.Name.rstrip('\x00') == ".bss":
            config = section.get_data()[:section.SizeOfRawData]

    if config == None:
        return
        
    config_list = config.split(b'\x00')
    
    # Crude check to make sure we have a decrypted section
    if config_list[0] == "ADVAPI32.DLL":
        config_dict = parse_config(config_list)
        return config_dict

    return