CAPE-parsers 0.1.33__py3-none-any.whl → 0.1.34__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. cape_parsers/CAPE/core/Latrodectus.py +4 -4
  2. {cape_parsers-0.1.33.dist-info → cape_parsers-0.1.34.dist-info}/METADATA +1 -1
  3. {cape_parsers-0.1.33.dist-info → cape_parsers-0.1.34.dist-info}/RECORD +5 -5
  4. {cape_parsers-0.1.33.dist-info → cape_parsers-0.1.34.dist-info}/LICENSE +0 -0
  5. {cape_parsers-0.1.33.dist-info → cape_parsers-0.1.34.dist-info}/WHEEL +0 -0
cape_parsers/CAPE/core/Latrodectus.py CHANGED
@@ -41,7 +41,7 @@ rule Latrodectus
41
41
  $fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01}
42
42
  $procchk1 = {E8 [3] FF 85 C0 74 [2] FF FF FF FF E9 [4] E8 [4] 89 44 24 ?? E8 [4] 83 F8 4B 73 ?? 83 [3] 06}
43
43
  $procchk2 = {72 [2] FF FF FF FF E9 [4] E8 [4] 83 F8 32 73 ?? 83 [3] 06}
44
- $version = {C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 01 00 00 00 8B}
44
+ $version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
45
45
  condition:
46
46
  all of them
47
47
  }
@@ -59,7 +59,7 @@ rule Latrodectus_AES
59
59
  $key = {C6 44 2? ?? ?? [150] C6 44 2? ?? ?? B8 02}
60
60
  $aes_ctr_1 = {8B 44 24 ?? FF C8 89 44 24 ?? 83 7C 24 ?? 00 7C ?? 4? 63 44 24 ?? 4? 8B 4C 24 ?? 0F B6 84 01 F0 00 00 00 3D FF 00 00 00}
61
61
  $aes_ctr_2 = {48 03 C8 48 8B C1 0F B6 ?? 48 63 4C 24 ?? 0F B6 4C 0C ?? 33 C1 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 03 D1 48 8B CA 88 01}
62
- $version = {C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 01 00 00 00 8B}
62
+ $version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
63
63
  condition:
64
64
  all of them
65
65
  }
@@ -150,8 +150,8 @@ def extract_config(filebuf):
150
150
  for instance in item.instances:
151
151
  if "$version" in item.identifier and not version:
152
152
  data = instance.matched_data[::-1]
153
- major = int.from_bytes(data[4:5], byteorder="big")
154
- minor = int.from_bytes(data[12:13], byteorder="big")
153
+ major = int.from_bytes(data[10:11], byteorder="big")
154
+ minor = int.from_bytes(data[18:19], byteorder="big")
155
155
  version = f"{major}.{minor}"
156
156
  if "$key" in item.identifier:
157
157
  key = instance.matched_data[4::5]
{cape_parsers-0.1.33.dist-info → cape_parsers-0.1.34.dist-info}/METADATA RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.3
2
2
  Name: CAPE-parsers
3
- Version: 0.1.33
3
+ Version: 0.1.34
4
4
  Summary: CAPE: Malware Configuration Extraction
5
5
  License: MIT
6
6
  Keywords: cape,parsers,malware,configuration
{cape_parsers-0.1.33.dist-info → cape_parsers-0.1.34.dist-info}/RECORD RENAMED
@@ -56,7 +56,7 @@ cape_parsers/CAPE/core/GuLoader.py,sha256=2DgE2hMkkNO2KVdtF8B4PmuCDnkK64u7xPMHD-
56
56
  cape_parsers/CAPE/core/HttpBrowser.py,sha256=rlJhbv06m3XkPb_oIN3dGrfl_uNxwR1tDv0M4ctstx8,4539
57
57
  cape_parsers/CAPE/core/IcedID.py,sha256=lKJZoRWQa-q0TNaylLCmm2hoj1h0wNP6eUmp-uI94pQ,4023
58
58
  cape_parsers/CAPE/core/IcedIDLoader.py,sha256=SQ3cqAnQ4elTiOrDQb5hMkFG-ymzek97yRNZd1967pA,1588
59
- cape_parsers/CAPE/core/Latrodectus.py,sha256=bWksR29BzrtzV-mlyWKToilvppG5ia_0DGGm4xZQvEk,7519
59
+ cape_parsers/CAPE/core/Latrodectus.py,sha256=qmMyFSiUsEhyZdEfxyG11ib1nRqX2Ojmwfwm1ahVAiI,7493
60
60
  cape_parsers/CAPE/core/Oyster.py,sha256=WVUimz6M3DxSnM6pnUI2s6hbLIQKiwhVs4KNwxEbJhE,4818
61
61
  cape_parsers/CAPE/core/PikaBot.py,sha256=s3jJL--NNwsvy9FkAADutbmqndlCZP6-ZI3W11p4QjE,5264
62
62
  cape_parsers/CAPE/core/PlugX.py,sha256=NiXAqkE5fFBioyRYALX8azaIo9pvfFfPP6xiLzO3TRQ,13156
@@ -104,7 +104,7 @@ cape_parsers/utils/blzpack_lib.so,sha256=5PJtnggw8fV5q4DlhwMJk4ZadvC3fFTsVTNZKvE
104
104
  cape_parsers/utils/dotnet_utils.py,sha256=pzQGbCqccz7DRv8T_i1JURlrKDIlDT2axxViiFF9hsU,1672
105
105
  cape_parsers/utils/lznt1.py,sha256=X-BmJtP6AwYSl0ORg5dfSt-NIuXbHrtCO5kUaaJI2C8,4066
106
106
  cape_parsers/utils/strings.py,sha256=a-nbvP9jYST7b6t_H37Ype-fK2jEmQr-wMF5a4i04e4,3062
107
- cape_parsers-0.1.33.dist-info/LICENSE,sha256=88c01_HLG8WPj7R7aU_b-O-UoF38vrrifvcko4KDxcE,1069
108
- cape_parsers-0.1.33.dist-info/METADATA,sha256=XIBuV6ck4KoC0NRV5XJ-F5rsBLYT9akCJglQfea4xyE,1149
109
- cape_parsers-0.1.33.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
110
- cape_parsers-0.1.33.dist-info/RECORD,,
107
+ cape_parsers-0.1.34.dist-info/LICENSE,sha256=88c01_HLG8WPj7R7aU_b-O-UoF38vrrifvcko4KDxcE,1069
108
+ cape_parsers-0.1.34.dist-info/METADATA,sha256=HnvgbMBb9WjgTkKl3jSneLTneEzBi9x_LDjb2KVEEMA,1149
109
+ cape_parsers-0.1.34.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
110
+ cape_parsers-0.1.34.dist-info/RECORD,,