CAPE-parsers 0.1.33__tar.gz → 0.1.35__tar.gz

{cape_parsers-0.1.33 → cape_parsers-0.1.35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: CAPE-parsers
-Version: 0.1.33
+Version: 0.1.35
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
 Keywords: cape,parsers,malware,configuration

{cape_parsers-0.1.33 → cape_parsers-0.1.35}/cape_parsers/CAPE/core/Latrodectus.py

@@ -41,7 +41,7 @@ rule Latrodectus
         $fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01}
         $procchk1 = {E8 [3] FF 85 C0 74 [2] FF FF FF FF E9 [4] E8 [4] 89 44 24 ?? E8 [4] 83 F8 4B 73 ?? 83 [3] 06}
         $procchk2 = {72 [2] FF FF FF FF E9 [4] E8 [4] 83 F8 32 73 ?? 83 [3] 06}
-		$version = {C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 01 00 00 00 8B}
+		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
     condition:
         all of them
 }
@@ -59,7 +59,7 @@ rule Latrodectus_AES
 		$key =  {C6 44 2? ?? ?? [150] C6 44 2? ?? ?? B8 02}
 		$aes_ctr_1 = {8B 44 24 ?? FF C8 89 44 24 ?? 83 7C 24 ?? 00 7C ?? 4? 63 44 24 ?? 4? 8B 4C 24 ?? 0F B6 84 01 F0 00 00 00 3D FF 00 00 00}
 		$aes_ctr_2 = {48 03 C8 48 8B C1 0F B6 ?? 48 63 4C 24 ?? 0F B6 4C 0C ?? 33 C1 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 03 D1 48 8B CA 88 01}
-		$version = {C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 01 00 00 00 8B}
+		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
     condition:
         all of them
 }
@@ -150,8 +150,8 @@ def extract_config(filebuf):
                 for instance in item.instances:
                     if "$version" in item.identifier and not version:
                         data = instance.matched_data[::-1]
-                        major = int.from_bytes(data[4:5], byteorder="big")
-                        minor = int.from_bytes(data[12:13], byteorder="big")
+                        major = int.from_bytes(data[10:11], byteorder="big")
+                        minor = int.from_bytes(data[18:19], byteorder="big")
                         version = f"{major}.{minor}"
                     if "$key" in item.identifier:
                         key = instance.matched_data[4::5]
@@ -168,7 +168,7 @@ def extract_config(filebuf):
 
                 if is_aes and key:
                     for i in range(len(data)):
-                        str_val = get_aes_string(data[i : i + 256], key)
+                        str_val = get_aes_string(data[i : i + 512], key)
                         if str_val and len(str_val) > 2:
                             str_vals.append(str_val)
                 else:

{cape_parsers-0.1.33 → cape_parsers-0.1.35}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "CAPE-parsers"
-version = "0.1.33"
+version = "0.1.35"
 description = "CAPE: Malware Configuration Extraction"
 authors = ["Kevin O'Reilly <kev@capesandbox.com>", "doomedraven <doomedraven@capesandbox.com>"]
 license = "MIT"