MagedDecrypter

#This script decrypts .net executables encrypted by Maged Encrypter
#Decoder for some obfuscated njRat version
#Link:
import os,sys,time,hashlib,base64
from Crypto.Cipher import DES3
import base64



def XXcipherDecode3DESXX(encFile,outFile):
    fKeyText = "\x35\x00\x35\x00\x36\x00\x20\x00\x4d\x00\x41\x00\x47\x00\x45\x00\x44\x00\x4b\x00\x48\x00\x4f\x00\x41\x00\x47\x06\x2e\x06\x2b\x06\x35\x06\x2a\x06\x42\x06\x2b\x06\x35\x06\x47\x06\x4a\x00\x41\x00\x21\x00\x40\x00\x23\x00\x24\x00\x25\x00\x5e\x00\x33\x06\x4a\x06\x28\x06\x47\x06\x33\x06\x4a\x06\x2a\x06\x35\x06\x2b\x06\x26\x00"


    keyChars = fKeyText.decode('utf-16').encode("utf-8")
    m = hashlib.md5()
    m.update(keyChars)
    key = m.hexdigest()
    key_hex = key.decode('hex')

    cipher = DES3.new( key_hex, DES3.MODE_ECB)
    fIn = open(encFile,"rb")
    contentX = fIn.read()
    contextX_b64 = base64.b64decode(contentX)
    fIn.close()

    decryptedX = cipher.decrypt(contextX_b64)

    fOut = open(outFile,"wb")
    fOut.write(decryptedX)
    fOut.close()
    return 0



def main():
    if len(sys.argv)!=3:
        print "Usage: Decode_njRat_3Des.py input_with_base64_text.txt outputfile.exe"
        sys.exit(-1)
    else:
        retX = XXcipherDecode3DESXX(sys.argv[1],sys.argv[2])
        sys.exit(retX)

if __name__ == "__main__":
    main()