Author Topic: [Python2.7] Hazz15, Zong22, Megan35, Atom128  (Read 1600 times)

0 Members and 1 Guest are viewing this topic.

Offline Deque

  • P.I.N.N.
  • Global Moderator
  • Overlord
  • *
  • Posts: 1203
  • Cookies: 518
  • Programmer, Malware Analyst
    • View Profile
[Python2.7] Hazz15, Zong22, Megan35, Atom128
« on: May 13, 2013, 09:23:10 am »
You probably already encountered these odd encodings I named in the title.
Searching for algorithms or explanations won't give you much information as they seem to be an invention by a single website: http://crypo.in.ua/tools/eng_atom128d.php

It is amazing how many people use these encodings nevertheless.
I discovered that they are only base64 variants whose characters have been substituted.

Here is a Python 2.7 solution for these encodings. It calculates the base64 string and substitutes the characters afterwards to encode or vice versa to decode.

Code: (python) [Select]
import base64

atom128 = "3GHIJKLMNOPQRSTUb=cdefghijklmnopWXYZ/12+406789VaqrstuvwxyzABCDEF5"
megan35 = "/128GhIoPQROSTeUbADfgHijKLM+n0pFWXY456xyzB7=39VaqrstJklmNuZvwcdEC"
zong22 = "ZKj9n+yf0wDVX1s/5YbdxSo=ILaUpPBCHg8uvNO4klm6iJGhQ7eFrWczAMEq3RTt2"
hazz15 = "HNO4klm6ij9n+J2hyf0gzA8uvwDEq3X1Q7ZKeFrWcVTts/MRGYbdxSo=ILaUpPBC5"
base = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="

class B64VariantEncoder:

    def __init__(self, translation):
        base = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
        self.lookup = dict(zip(base, translation))
        self.revlookup = dict(zip(translation, base))

    def encode(self, text):
        global lookup
        b64 = base64.b64encode(text)
        result = "".join([self.lookup[x] for x in b64])
        return result

    def decode(self, code):
        global revlookup
        b64 = "".join([self.revlookup[x] for x in code])
        result = base64.b64decode(b64)
        return result   

def encode(variant, text):
    encoder = B64VariantEncoder(variant)
    return encoder.encode(text)

def decode(variant, code):
    try:
        encoder = B64VariantEncoder(variant)
        return encoder.decode(code)
    except KeyError:
        return "no valid encoding"
    except TypeError:
        return "no correct padding"

print "type in your string to encode/decode"
text = raw_input()
print "encode (1) or decode (2)?"
option = raw_input()

if option == "1":
    print "base64:", encode(base, text)
    print "atom128:", encode(atom128, text)
    print "megan35:", encode(megan35, text)
    print "hazz15:", encode(hazz15, text)
    print "zong22:", encode(zong22, text)   
elif option == "2":
    print "base64:", decode(base, text)
    print "atom128:", decode(atom128, text)
    print "megan35:", decode(megan35, text)
    print "hazz15:", decode(hazz15, text)
    print "zong22:", decode(zong22, text)
else:
    print "no valid option"

Note: This is just a source sample and not meant as a full fledged application.
« Last Edit: May 13, 2013, 11:23:48 am by Kulverstukas »

Offline vezzy

  • Royal Highness
  • ****
  • Posts: 771
  • Cookies: 172
    • View Profile
Re: [Python2.7] Hazz15, Zong22, Megan35, Atom128
« Reply #1 on: May 13, 2013, 06:47:58 pm »
Thanks a bunch for the insight.
Quote from: Dippy hippy
Just brushing though. I will be semi active mainly came to find a HQ botnet, like THOR or just any p2p botnet

Offline Axon

  • VIP
  • King
  • *
  • Posts: 2047
  • Cookies: 319
    • View Profile
Re: [Python2.7] Hazz15, Zong22, Megan35, Atom128
« Reply #2 on: May 13, 2013, 07:47:38 pm »
Actually I've never heard of these encoding up until now, thanks for the delightful information. +1

Offline zoup

  • Serf
  • *
  • Posts: 29
  • Cookies: 3
  • I don't understand anything here !
    • View Profile
Re: [Python2.7] Hazz15, Zong22, Megan35, Atom128
« Reply #3 on: May 17, 2013, 04:40:43 am »
Didn't know this site thanks for the link and code.

Offline Deque

  • P.I.N.N.
  • Global Moderator
  • Overlord
  • *
  • Posts: 1203
  • Cookies: 518
  • Programmer, Malware Analyst
    • View Profile
Re: [Python2.7] Hazz15, Zong22, Megan35, Atom128
« Reply #4 on: May 17, 2013, 10:08:25 am »
It wasn't meant as recommendation to use this site, though. It is just some insight into the bullshit they are performing.