This is a decryptor for Qakbot's configuration stored in the registry key
bitstring==3.1.9
hexdump==3.3
pycryptodome==3.12.0
WMI==1.5.1Usage: qakbot-registry-decrypt.py [options]
Options:
-h, --help show this help message and exit
-r REGISTRY_PATH, --regpath=REGISTRY_PATH
registry path where Qakbot's encrypted data is stored.
(e.g. 'HKEY_CURRENT_USER\SOFTWARE\Microsoft\Efwramsn')
-p PASSWORD, --password=PASSWORD
password (optional)
MD5: 90aac91ba4336bdb252dee699d32d78d https://www.virustotal.com/gui/file/edfe1d500855331f71ef12b7e459af1224a5ff3bca89ab7cd0dac930fd77c41a/detection