CAPE-parsers 0.1.34__tar.gz → 0.1.36__tar.gz

{cape_parsers-0.1.34 → cape_parsers-0.1.36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: CAPE-parsers
-Version: 0.1.34
+Version: 0.1.36
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
 Keywords: cape,parsers,malware,configuration
@@ -21,7 +21,7 @@ Requires-Dist: maco (==1.1.8) ; extra == "maco"
 Requires-Dist: netstruct (==1.1.2)
 Requires-Dist: pefile
 Requires-Dist: pycryptodomex (>=3.20.0)
-Requires-Dist: rat-king-parser (>=4.0.0)
+Requires-Dist: rat-king-parser (>=4.1.0)
 Requires-Dist: ruff (>=0.7.2)
 Requires-Dist: unicorn (==2.1.1)
 Requires-Dist: yara-python (>=4.5.1)

cape_parsers-0.1.36/cape_parsers/CAPE/community/AsyncRAT.py

@@ -0,0 +1,29 @@
+import importlib.util
+import sys
+import os
+
+from rat_king_parser.rkp import RATConfigParser
+
+HAVE_ASYNCRAT_COMMON = False
+module_file_path = '/opt/CAPEv2/data/asyncrat_common.py'
+if os.path.exists(module_file_path):
+    try:
+        module_name = os.path.basename(module_file_path).replace('.py', '')
+        spec = importlib.util.spec_from_file_location(module_name, module_file_path)
+        asyncrat_common = importlib.util.module_from_spec(spec)
+        sys.modules[module_name] = asyncrat_common
+        spec.loader.exec_module(asyncrat_common)
+        HAVE_ASYNCRAT_COMMON = True
+    except Exception as e:
+        print("Error loading asyncrat_common.py", e)
+
+def extract_config(data: bytes):
+    config = RATConfigParser(data=data, remap_config=True).report.get("config", {})
+    if config and HAVE_ASYNCRAT_COMMON:
+        config = asyncrat_common.convert_config(config)
+
+    return config
+
+if __name__ == "__main__":
+    data = open(sys.argv[1], "rb").read()
+    print(extract_config(data))

cape_parsers-0.1.36/cape_parsers/CAPE/community/DCRat.py

@@ -0,0 +1,29 @@
+import importlib.util
+import sys
+import os
+
+from rat_king_parser.rkp import RATConfigParser
+
+HAVE_ASYNCRAT_COMMON = False
+module_file_path = '/opt/CAPEv2/data/asyncrat_common.py'
+if os.path.exists(module_file_path):
+    try:
+        module_name = os.path.basename(module_file_path).replace('.py', '')
+        spec = importlib.util.spec_from_file_location(module_name, module_file_path)
+        asyncrat_common = importlib.util.module_from_spec(spec)
+        sys.modules[module_name] = asyncrat_common
+        spec.loader.exec_module(asyncrat_common)
+        HAVE_ASYNCRAT_COMMON = True
+    except Exception as e:
+        print("Error loading asyncrat_common.py", e)
+
+def extract_config(data: bytes):
+    config = RATConfigParser(data=data, remap_config=True).report.get("config", {})
+    if config and HAVE_ASYNCRAT_COMMON:
+        config = asyncrat_common.convert_config(config)
+
+    return config
+
+if __name__ == "__main__":
+    data = open(sys.argv[1], "rb").read()
+    print(extract_config(data))

cape_parsers-0.1.36/cape_parsers/CAPE/community/VenomRAT.py

@@ -0,0 +1,29 @@
+import importlib.util
+import sys
+import os
+
+from rat_king_parser.rkp import RATConfigParser
+
+HAVE_ASYNCRAT_COMMON = False
+module_file_path = '/opt/CAPEv2/data/asyncrat_common.py'
+if os.path.exists(module_file_path):
+    try:
+        module_name = os.path.basename(module_file_path).replace('.py', '')
+        spec = importlib.util.spec_from_file_location(module_name, module_file_path)
+        asyncrat_common = importlib.util.module_from_spec(spec)
+        sys.modules[module_name] = asyncrat_common
+        spec.loader.exec_module(asyncrat_common)
+        HAVE_ASYNCRAT_COMMON = True
+    except Exception as e:
+        print("Error loading asyncrat_common.py", e)
+
+def extract_config(data: bytes):
+    config = RATConfigParser(data=data, remap_config=True).report.get("config", {})
+    if config and HAVE_ASYNCRAT_COMMON:
+        config = asyncrat_common.convert_config(config)
+
+    return config
+
+if __name__ == "__main__":
+    data = open(sys.argv[1], "rb").read()
+    print(extract_config(data))

cape_parsers-0.1.36/cape_parsers/CAPE/community/XWorm.py

@@ -0,0 +1,29 @@
+import importlib.util
+import sys
+import os
+
+from rat_king_parser.rkp import RATConfigParser
+
+HAVE_ASYNCRAT_COMMON = False
+module_file_path = '/opt/CAPEv2/data/asyncrat_common.py'
+if os.path.exists(module_file_path):
+    try:
+        module_name = os.path.basename(module_file_path).replace('.py', '')
+        spec = importlib.util.spec_from_file_location(module_name, module_file_path)
+        asyncrat_common = importlib.util.module_from_spec(spec)
+        sys.modules[module_name] = asyncrat_common
+        spec.loader.exec_module(asyncrat_common)
+        HAVE_ASYNCRAT_COMMON = True
+    except Exception as e:
+        print("Error loading asyncrat_common.py", e)
+
+def extract_config(data: bytes):
+    config = RATConfigParser(data=data, remap_config=True).report.get("config", {})
+    if config and HAVE_ASYNCRAT_COMMON:
+        config = asyncrat_common.convert_config(config)
+
+    return config
+
+if __name__ == "__main__":
+    data = open(sys.argv[1], "rb").read()
+    print(extract_config(data))

cape_parsers-0.1.36/cape_parsers/CAPE/community/XenoRAT.py

@@ -0,0 +1,29 @@
+import importlib.util
+import sys
+import os
+
+from rat_king_parser.rkp import RATConfigParser
+
+HAVE_ASYNCRAT_COMMON = False
+module_file_path = '/opt/CAPEv2/data/asyncrat_common.py'
+if os.path.exists(module_file_path):
+    try:
+        module_name = os.path.basename(module_file_path).replace('.py', '')
+        spec = importlib.util.spec_from_file_location(module_name, module_file_path)
+        asyncrat_common = importlib.util.module_from_spec(spec)
+        sys.modules[module_name] = asyncrat_common
+        spec.loader.exec_module(asyncrat_common)
+        HAVE_ASYNCRAT_COMMON = True
+    except Exception as e:
+        print("Error loading asyncrat_common.py", e)
+
+def extract_config(data: bytes):
+    config = RATConfigParser(data=data, remap_config=True).report.get("config", {})
+    if config and HAVE_ASYNCRAT_COMMON:
+        config = asyncrat_common.convert_config(config)
+
+    return config
+
+if __name__ == "__main__":
+    data = open(sys.argv[1], "rb").read()
+    print(extract_config(data))

{cape_parsers-0.1.34 → cape_parsers-0.1.36}/cape_parsers/CAPE/core/Latrodectus.py

@@ -168,7 +168,7 @@ def extract_config(filebuf):
 
                 if is_aes and key:
                     for i in range(len(data)):
-                        str_val = get_aes_string(data[i : i + 256], key)
+                        str_val = get_aes_string(data[i : i + 512], key)
                         if str_val and len(str_val) > 2:
                             str_vals.append(str_val)
                 else:

{cape_parsers-0.1.34 → cape_parsers-0.1.36}/cape_parsers/CAPE/core/Socks5Systemz.py

@@ -20,6 +20,6 @@ def extract_config(data):
                 config_dict["C2s"].append(line)
             elif line and "\\" in line:
                 config_dict.setdefault("Timestamp path", []).append(line)
-            elif "." in line:
+            elif "." in line and "=" not in line and line not in config_dict["C2s"]:
                 config_dict.setdefault("Dummy domain", []).append(line)
         return config_dict

{cape_parsers-0.1.34 → cape_parsers-0.1.36}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "CAPE-parsers"
-version = "0.1.34"
+version = "0.1.36"
 description = "CAPE: Malware Configuration Extraction"
 authors = ["Kevin O'Reilly <kev@capesandbox.com>", "doomedraven <doomedraven@capesandbox.com>"]
 license = "MIT"
@@ -24,7 +24,7 @@ yara-python = ">=4.5.1"
 dnfile = ">=0.15.1"
 dncil = ">=1.0.2"
 unicorn = "2.1.1"
-rat-king-parser = ">=4.0.0"
+rat-king-parser = ">=4.1.0"
 
 ruff = ">=0.7.2"
 # isort = ">=5.13.2"

cape_parsers-0.1.34/cape_parsers/CAPE/community/AsyncRAT.py

@@ -1,5 +0,0 @@
-from rat_king_parser.rkp import RATConfigParser
-
-
-def extract_config(data: bytes):
-    return RATConfigParser(data=data).report.get("config", {})

cape_parsers-0.1.34/cape_parsers/CAPE/community/DCRat.py

@@ -1,5 +0,0 @@
-from rat_king_parser.rkp import RATConfigParser
-
-
-def extract_config(data: bytes):
-    return RATConfigParser(data=data).report.get("config", {})

cape_parsers-0.1.34/cape_parsers/CAPE/community/VenomRAT.py

@@ -1,5 +0,0 @@
-from rat_king_parser.rkp import RATConfigParser
-
-
-def extract_config(data: bytes):
-    return RATConfigParser(data=data).report.get("config", {})

cape_parsers-0.1.34/cape_parsers/CAPE/community/XWorm.py

@@ -1,5 +0,0 @@
-from rat_king_parser.rkp import RATConfigParser
-
-
-def extract_config(data: bytes):
-    return RATConfigParser(data=data).report.get("config", {})

cape_parsers-0.1.34/cape_parsers/CAPE/community/XenoRAT.py

@@ -1,5 +0,0 @@
-from rat_king_parser.rkp import RATConfigParser
-
-
-def extract_config(data: bytes):
-    return RATConfigParser(data=data).report.get("config", {})