CAPE-parsers 0.1.32__tar.gz → 0.1.34__tar.gz

{cape_parsers-0.1.32 → cape_parsers-0.1.34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: CAPE-parsers
-Version: 0.1.32
+Version: 0.1.34
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
 Keywords: cape,parsers,malware,configuration
@@ -24,7 +24,7 @@ Requires-Dist: pycryptodomex (>=3.20.0)
 Requires-Dist: rat-king-parser (>=4.0.0)
 Requires-Dist: ruff (>=0.7.2)
 Requires-Dist: unicorn (==2.1.1)
-Requires-Dist: yara-python (==4.5.1)
+Requires-Dist: yara-python (>=4.5.1)
 Description-Content-Type: text/markdown
 
 # CAPE-parsers

{cape_parsers-0.1.32 → cape_parsers-0.1.34}/cape_parsers/CAPE/community/Njrat.py

@@ -174,15 +174,15 @@ def extract_config(data):
     dotnet_file_parser = Parser(data=data)
     config_dict = get_config_dict(dotnet_file_parser, data)
     config = get_clean_config(config_dict)
-
-    if config.get("domain") and config.get("port"):
-        conf["cncs"] = [f"{config['domain']}:{config['port']}"]
-
-    if config.get("campaign_id"):
-        conf["campaign id"] = config["campaign_id"]
-
-    if config.get("version"):
-        conf["version"] = config["version"]
+    if config:
+        if config.get("domain") and config.get("port"):
+            conf["cncs"] = [f"{config['domain']}:{config['port']}"]
+    
+        if config.get("campaign_id"):
+            conf["campaign id"] = config["campaign_id"]
+    
+        if config.get("version"):
+            conf["version"] = config["version"]
 
     dotnet_file_parser.close()
     return conf

{cape_parsers-0.1.32 → cape_parsers-0.1.34}/cape_parsers/CAPE/core/Latrodectus.py

@@ -41,7 +41,7 @@ rule Latrodectus
         $fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01}
         $procchk1 = {E8 [3] FF 85 C0 74 [2] FF FF FF FF E9 [4] E8 [4] 89 44 24 ?? E8 [4] 83 F8 4B 73 ?? 83 [3] 06}
         $procchk2 = {72 [2] FF FF FF FF E9 [4] E8 [4] 83 F8 32 73 ?? 83 [3] 06}
-		$version = {C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 01 00 00 00 8B}
+		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
     condition:
         all of them
 }
@@ -59,7 +59,7 @@ rule Latrodectus_AES
 		$key =  {C6 44 2? ?? ?? [150] C6 44 2? ?? ?? B8 02}
 		$aes_ctr_1 = {8B 44 24 ?? FF C8 89 44 24 ?? 83 7C 24 ?? 00 7C ?? 4? 63 44 24 ?? 4? 8B 4C 24 ?? 0F B6 84 01 F0 00 00 00 3D FF 00 00 00}
 		$aes_ctr_2 = {48 03 C8 48 8B C1 0F B6 ?? 48 63 4C 24 ?? 0F B6 4C 0C ?? 33 C1 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 03 D1 48 8B CA 88 01}
-		$version = {C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 01 00 00 00 8B}
+		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
     condition:
         all of them
 }
@@ -150,8 +150,8 @@ def extract_config(filebuf):
                 for instance in item.instances:
                     if "$version" in item.identifier and not version:
                         data = instance.matched_data[::-1]
-                        major = int.from_bytes(data[4:5], byteorder="big")
-                        minor = int.from_bytes(data[12:13], byteorder="big")
+                        major = int.from_bytes(data[10:11], byteorder="big")
+                        minor = int.from_bytes(data[18:19], byteorder="big")
                         version = f"{major}.{minor}"
                     if "$key" in item.identifier:
                         key = instance.matched_data[4::5]

{cape_parsers-0.1.32 → cape_parsers-0.1.34}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "CAPE-parsers"
-version = "0.1.32"
+version = "0.1.34"
 description = "CAPE: Malware Configuration Extraction"
 authors = ["Kevin O'Reilly <kev@capesandbox.com>", "doomedraven <doomedraven@capesandbox.com>"]
 license = "MIT"
@@ -20,7 +20,7 @@ pycryptodomex = ">=3.20.0"
 # regex = ">=2021.7.6"
 netstruct = "1.1.2"
 maco = "1.1.8"
-yara-python = "4.5.1"
+yara-python = ">=4.5.1"
 dnfile = ">=0.15.1"
 dncil = ">=1.0.2"
 unicorn = "2.1.1"