CAPE-parsers 0.1.32__py3-none-any.whl → 0.1.34__py3-none-any.whl

cape_parsers/CAPE/community/Njrat.py

@@ -174,15 +174,15 @@ def extract_config(data):
     dotnet_file_parser = Parser(data=data)
     config_dict = get_config_dict(dotnet_file_parser, data)
     config = get_clean_config(config_dict)
-
-    if config.get("domain") and config.get("port"):
-        conf["cncs"] = [f"{config['domain']}:{config['port']}"]
-
-    if config.get("campaign_id"):
-        conf["campaign id"] = config["campaign_id"]
-
-    if config.get("version"):
-        conf["version"] = config["version"]
+    if config:
+        if config.get("domain") and config.get("port"):
+            conf["cncs"] = [f"{config['domain']}:{config['port']}"]
+    
+        if config.get("campaign_id"):
+            conf["campaign id"] = config["campaign_id"]
+    
+        if config.get("version"):
+            conf["version"] = config["version"]
 
     dotnet_file_parser.close()
     return conf

cape_parsers/CAPE/core/Latrodectus.py

@@ -41,7 +41,7 @@ rule Latrodectus
         $fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01}
         $procchk1 = {E8 [3] FF 85 C0 74 [2] FF FF FF FF E9 [4] E8 [4] 89 44 24 ?? E8 [4] 83 F8 4B 73 ?? 83 [3] 06}
         $procchk2 = {72 [2] FF FF FF FF E9 [4] E8 [4] 83 F8 32 73 ?? 83 [3] 06}
-		$version = {C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 01 00 00 00 8B}
+		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
     condition:
         all of them
 }
@@ -59,7 +59,7 @@ rule Latrodectus_AES
 		$key =  {C6 44 2? ?? ?? [150] C6 44 2? ?? ?? B8 02}
 		$aes_ctr_1 = {8B 44 24 ?? FF C8 89 44 24 ?? 83 7C 24 ?? 00 7C ?? 4? 63 44 24 ?? 4? 8B 4C 24 ?? 0F B6 84 01 F0 00 00 00 3D FF 00 00 00}
 		$aes_ctr_2 = {48 03 C8 48 8B C1 0F B6 ?? 48 63 4C 24 ?? 0F B6 4C 0C ?? 33 C1 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 03 D1 48 8B CA 88 01}
-		$version = {C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 01 00 00 00 8B}
+		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
     condition:
         all of them
 }
@@ -150,8 +150,8 @@ def extract_config(filebuf):
                 for instance in item.instances:
                     if "$version" in item.identifier and not version:
                         data = instance.matched_data[::-1]
-                        major = int.from_bytes(data[4:5], byteorder="big")
-                        minor = int.from_bytes(data[12:13], byteorder="big")
+                        major = int.from_bytes(data[10:11], byteorder="big")
+                        minor = int.from_bytes(data[18:19], byteorder="big")
                         version = f"{major}.{minor}"
                     if "$key" in item.identifier:
                         key = instance.matched_data[4::5]

{cape_parsers-0.1.32.dist-info → cape_parsers-0.1.34.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: CAPE-parsers
-Version: 0.1.32
+Version: 0.1.34
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
 Keywords: cape,parsers,malware,configuration
@@ -24,7 +24,7 @@ Requires-Dist: pycryptodomex (>=3.20.0)
 Requires-Dist: rat-king-parser (>=4.0.0)
 Requires-Dist: ruff (>=0.7.2)
 Requires-Dist: unicorn (==2.1.1)
-Requires-Dist: yara-python (==4.5.1)
+Requires-Dist: yara-python (>=4.5.1)
 Description-Content-Type: text/markdown
 
 # CAPE-parsers

{cape_parsers-0.1.32.dist-info → cape_parsers-0.1.34.dist-info}/RECORD

@@ -17,7 +17,7 @@ cape_parsers/CAPE/community/LokiBot.py,sha256=whdVVLqu760ai90Ep-_Ghc_Z1yaty9fMSO
 cape_parsers/CAPE/community/Lumma.py,sha256=o8XiT1f48e_JdkbjCUFJ04uzCUr-L57bhH_12duiFyE,8978
 cape_parsers/CAPE/community/NanoCore.py,sha256=0dqhCoAyDJaYgAlbXIwCa1esfEuQSk5AtH1Rl4bj1l8,6120
 cape_parsers/CAPE/community/Nighthawk.py,sha256=eXnDqwabnrlRROg503oXYLEgotMW4hKeYwLas8SrkTc,12104
-cape_parsers/CAPE/community/Njrat.py,sha256=UYK2KoSSPSk9BLUcrJymYdajQP553sxgKR-mS-MBoKI,4667
+cape_parsers/CAPE/community/Njrat.py,sha256=_noQM5058BYwTMcYCpcTD9gIxw4ANI35tUSLMAlN97Q,4713
 cape_parsers/CAPE/community/Pandora.py,sha256=d6R3AsDr5WOfKKyA6HI0yQ5Eo7_Eif5LspW0cm2wM5M,2522
 cape_parsers/CAPE/community/PhemedroneStealer.py,sha256=T6jMW73htNCRTqlEqeec9Y3p7BKuSmit3RvWFfd8IJ8,7032
 cape_parsers/CAPE/community/PoisonIvy.py,sha256=EFO-E91gkv5Byny8He81d7Wy-9yKPkM1ndWFhQrQ1pQ,4150
@@ -56,7 +56,7 @@ cape_parsers/CAPE/core/GuLoader.py,sha256=2DgE2hMkkNO2KVdtF8B4PmuCDnkK64u7xPMHD-
 cape_parsers/CAPE/core/HttpBrowser.py,sha256=rlJhbv06m3XkPb_oIN3dGrfl_uNxwR1tDv0M4ctstx8,4539
 cape_parsers/CAPE/core/IcedID.py,sha256=lKJZoRWQa-q0TNaylLCmm2hoj1h0wNP6eUmp-uI94pQ,4023
 cape_parsers/CAPE/core/IcedIDLoader.py,sha256=SQ3cqAnQ4elTiOrDQb5hMkFG-ymzek97yRNZd1967pA,1588
-cape_parsers/CAPE/core/Latrodectus.py,sha256=bWksR29BzrtzV-mlyWKToilvppG5ia_0DGGm4xZQvEk,7519
+cape_parsers/CAPE/core/Latrodectus.py,sha256=qmMyFSiUsEhyZdEfxyG11ib1nRqX2Ojmwfwm1ahVAiI,7493
 cape_parsers/CAPE/core/Oyster.py,sha256=WVUimz6M3DxSnM6pnUI2s6hbLIQKiwhVs4KNwxEbJhE,4818
 cape_parsers/CAPE/core/PikaBot.py,sha256=s3jJL--NNwsvy9FkAADutbmqndlCZP6-ZI3W11p4QjE,5264
 cape_parsers/CAPE/core/PlugX.py,sha256=NiXAqkE5fFBioyRYALX8azaIo9pvfFfPP6xiLzO3TRQ,13156
@@ -104,7 +104,7 @@ cape_parsers/utils/blzpack_lib.so,sha256=5PJtnggw8fV5q4DlhwMJk4ZadvC3fFTsVTNZKvE
 cape_parsers/utils/dotnet_utils.py,sha256=pzQGbCqccz7DRv8T_i1JURlrKDIlDT2axxViiFF9hsU,1672
 cape_parsers/utils/lznt1.py,sha256=X-BmJtP6AwYSl0ORg5dfSt-NIuXbHrtCO5kUaaJI2C8,4066
 cape_parsers/utils/strings.py,sha256=a-nbvP9jYST7b6t_H37Ype-fK2jEmQr-wMF5a4i04e4,3062
-cape_parsers-0.1.32.dist-info/LICENSE,sha256=88c01_HLG8WPj7R7aU_b-O-UoF38vrrifvcko4KDxcE,1069
-cape_parsers-0.1.32.dist-info/METADATA,sha256=gNE-5dIOxmJ0qnA1-PEX1UWVWqPciYvXtcD5-YD2c9I,1149
-cape_parsers-0.1.32.dist-info/WHEEL,sha256=IYZQI976HJqqOpQU6PHkJ8fb3tMNBFjg-Cn-pwAbaFM,88
-cape_parsers-0.1.32.dist-info/RECORD,,
+cape_parsers-0.1.34.dist-info/LICENSE,sha256=88c01_HLG8WPj7R7aU_b-O-UoF38vrrifvcko4KDxcE,1069
+cape_parsers-0.1.34.dist-info/METADATA,sha256=HnvgbMBb9WjgTkKl3jSneLTneEzBi9x_LDjb2KVEEMA,1149
+cape_parsers-0.1.34.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+cape_parsers-0.1.34.dist-info/RECORD,,

{cape_parsers-0.1.32.dist-info → cape_parsers-0.1.34.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: poetry-core 2.0.1
+Generator: poetry-core 2.1.3
 Root-Is-Purelib: true
 Tag: py3-none-any