Simple string decryption for Vodoo string encryption samples.

Vodoo is a custom obfuscator that is primarily used in low-effort credential stealer malware.

Either drag&drop the file onto the executable or run it from the command line:

VodooDecrypt.exe <path_to_file>

VodooDecrypt will create a new file with the decrypted strings in the same directory as the input file, appending _decrypted to the original filename.

Make sure the supplied file is a valid .NET assembly, otherwise VodooDecrypt will fail to process it.

Encrypted strings in a sample assembly:

Decrypted strings after running VodooDecrypt:

You can identify Vodoo string encryption by looking at calls to the decryption. Calls will follow this pattern and usually show chinese or Unicode characters in the string argument:

ldstr "encrypted_string"
ldc.i4 12 #some integer
call string decrypt(string, int)

You can also identify it by looking for the decryption method itself, which will look like this: