emotet_payload_decryption.py

from struct import pack, unpack

with open('memdump_AF0_01C90000_19a00.bin', 'rb') as f: raw = f.read()

size = 0x19a00

plain = "" i = 0 while i < size: c = raw[i:i+4] k = i + 0x3e9 _c = (unpack("<I", c)[0] + i) & 0xFFFFFFFF plain += pack("<I", _c ^ k) i += 4

print plain