CAPE-parsers 0.1.35__tar.gz → 0.1.37__tar.gz

{cape_parsers-0.1.35 → cape_parsers-0.1.37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: CAPE-parsers
-Version: 0.1.35
+Version: 0.1.37
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
 Keywords: cape,parsers,malware,configuration
@@ -21,7 +21,7 @@ Requires-Dist: maco (==1.1.8) ; extra == "maco"
 Requires-Dist: netstruct (==1.1.2)
 Requires-Dist: pefile
 Requires-Dist: pycryptodomex (>=3.20.0)
-Requires-Dist: rat-king-parser (>=4.0.0)
+Requires-Dist: rat-king-parser (>=4.1.0)
 Requires-Dist: ruff (>=0.7.2)
 Requires-Dist: unicorn (==2.1.1)
 Requires-Dist: yara-python (>=4.5.1)

cape_parsers-0.1.37/cape_parsers/CAPE/community/AsyncRAT.py

@@ -0,0 +1,29 @@
+import importlib.util
+import sys
+import os
+
+from rat_king_parser.rkp import RATConfigParser
+
+HAVE_ASYNCRAT_COMMON = False
+module_file_path = '/opt/CAPEv2/data/asyncrat_common.py'
+if os.path.exists(module_file_path):
+    try:
+        module_name = os.path.basename(module_file_path).replace('.py', '')
+        spec = importlib.util.spec_from_file_location(module_name, module_file_path)
+        asyncrat_common = importlib.util.module_from_spec(spec)
+        sys.modules[module_name] = asyncrat_common
+        spec.loader.exec_module(asyncrat_common)
+        HAVE_ASYNCRAT_COMMON = True
+    except Exception as e:
+        print("Error loading asyncrat_common.py", e)
+
+def extract_config(data: bytes):
+    config = RATConfigParser(data=data, remap_config=True).report.get("config", {})
+    if config and HAVE_ASYNCRAT_COMMON:
+        config = asyncrat_common.convert_config(config)
+
+    return config
+
+if __name__ == "__main__":
+    data = open(sys.argv[1], "rb").read()
+    print(extract_config(data))

cape_parsers-0.1.37/cape_parsers/CAPE/community/DCRat.py

@@ -0,0 +1,29 @@
+import importlib.util
+import sys
+import os
+
+from rat_king_parser.rkp import RATConfigParser
+
+HAVE_ASYNCRAT_COMMON = False
+module_file_path = '/opt/CAPEv2/data/asyncrat_common.py'
+if os.path.exists(module_file_path):
+    try:
+        module_name = os.path.basename(module_file_path).replace('.py', '')
+        spec = importlib.util.spec_from_file_location(module_name, module_file_path)
+        asyncrat_common = importlib.util.module_from_spec(spec)
+        sys.modules[module_name] = asyncrat_common
+        spec.loader.exec_module(asyncrat_common)
+        HAVE_ASYNCRAT_COMMON = True
+    except Exception as e:
+        print("Error loading asyncrat_common.py", e)
+
+def extract_config(data: bytes):
+    config = RATConfigParser(data=data, remap_config=True).report.get("config", {})
+    if config and HAVE_ASYNCRAT_COMMON:
+        config = asyncrat_common.convert_config(config)
+
+    return config
+
+if __name__ == "__main__":
+    data = open(sys.argv[1], "rb").read()
+    print(extract_config(data))

cape_parsers-0.1.37/cape_parsers/CAPE/community/VenomRAT.py

@@ -0,0 +1,29 @@
+import importlib.util
+import sys
+import os
+
+from rat_king_parser.rkp import RATConfigParser
+
+HAVE_ASYNCRAT_COMMON = False
+module_file_path = '/opt/CAPEv2/data/asyncrat_common.py'
+if os.path.exists(module_file_path):
+    try:
+        module_name = os.path.basename(module_file_path).replace('.py', '')
+        spec = importlib.util.spec_from_file_location(module_name, module_file_path)
+        asyncrat_common = importlib.util.module_from_spec(spec)
+        sys.modules[module_name] = asyncrat_common
+        spec.loader.exec_module(asyncrat_common)
+        HAVE_ASYNCRAT_COMMON = True
+    except Exception as e:
+        print("Error loading asyncrat_common.py", e)
+
+def extract_config(data: bytes):
+    config = RATConfigParser(data=data, remap_config=True).report.get("config", {})
+    if config and HAVE_ASYNCRAT_COMMON:
+        config = asyncrat_common.convert_config(config)
+
+    return config
+
+if __name__ == "__main__":
+    data = open(sys.argv[1], "rb").read()
+    print(extract_config(data))

cape_parsers-0.1.37/cape_parsers/CAPE/community/XWorm.py

@@ -0,0 +1,29 @@
+import importlib.util
+import sys
+import os
+
+from rat_king_parser.rkp import RATConfigParser
+
+HAVE_ASYNCRAT_COMMON = False
+module_file_path = '/opt/CAPEv2/data/asyncrat_common.py'
+if os.path.exists(module_file_path):
+    try:
+        module_name = os.path.basename(module_file_path).replace('.py', '')
+        spec = importlib.util.spec_from_file_location(module_name, module_file_path)
+        asyncrat_common = importlib.util.module_from_spec(spec)
+        sys.modules[module_name] = asyncrat_common
+        spec.loader.exec_module(asyncrat_common)
+        HAVE_ASYNCRAT_COMMON = True
+    except Exception as e:
+        print("Error loading asyncrat_common.py", e)
+
+def extract_config(data: bytes):
+    config = RATConfigParser(data=data, remap_config=True).report.get("config", {})
+    if config and HAVE_ASYNCRAT_COMMON:
+        config = asyncrat_common.convert_config(config)
+
+    return config
+
+if __name__ == "__main__":
+    data = open(sys.argv[1], "rb").read()
+    print(extract_config(data))

cape_parsers-0.1.37/cape_parsers/CAPE/community/XenoRAT.py

@@ -0,0 +1,29 @@
+import importlib.util
+import sys
+import os
+
+from rat_king_parser.rkp import RATConfigParser
+
+HAVE_ASYNCRAT_COMMON = False
+module_file_path = '/opt/CAPEv2/data/asyncrat_common.py'
+if os.path.exists(module_file_path):
+    try:
+        module_name = os.path.basename(module_file_path).replace('.py', '')
+        spec = importlib.util.spec_from_file_location(module_name, module_file_path)
+        asyncrat_common = importlib.util.module_from_spec(spec)
+        sys.modules[module_name] = asyncrat_common
+        spec.loader.exec_module(asyncrat_common)
+        HAVE_ASYNCRAT_COMMON = True
+    except Exception as e:
+        print("Error loading asyncrat_common.py", e)
+
+def extract_config(data: bytes):
+    config = RATConfigParser(data=data, remap_config=True).report.get("config", {})
+    if config and HAVE_ASYNCRAT_COMMON:
+        config = asyncrat_common.convert_config(config)
+
+    return config
+
+if __name__ == "__main__":
+    data = open(sys.argv[1], "rb").read()
+    print(extract_config(data))

cape_parsers-0.1.37/cape_parsers/CAPE/core/AdaptixBeacon.py

@@ -0,0 +1,102 @@
+import logging
+import struct
+from contextlib import suppress
+
+import pefile
+from Cryptodome.Cipher import ARC4
+
+log = logging.getLogger(__name__)
+
+DESCRIPTION = "Adaptix beacon configuration parser."
+AUTHOR = "enzok"
+
+
+def parse_http_config(rc4_key: bytes, data: bytes) -> dict:
+    config = {}
+    offset = 0
+    servers = []
+    ports = []
+
+    def read(fmt: str):
+        nonlocal offset
+        size = struct.calcsize(fmt)
+        value = struct.unpack_from(fmt, data, offset)
+        offset += size
+        return value if len(value) > 1 else value[0]
+
+    def read_str(length: int):
+        nonlocal offset
+        value = data[offset:offset + length].decode("utf-8", errors="replace")
+        offset += length
+        return value
+
+    config["config_rc4_key"] = rc4_key.hex()
+    config["agent_type"] = f"{read('<I'):8X}"
+    config["use_ssl"] = read("<B")
+    host_count = read("<I")
+    for host in range(host_count):
+        host_length = read("<I")
+        servers.append(read_str(host_length).strip("\x00"))
+        ports.append(read("<I"))
+
+    config["servers"] = servers
+    config["ports"] = ports
+    method_length = read("<I")
+    config["http_method"] = read_str(method_length).strip("\x00")
+    uri_length = read("<I")
+    config["uri"] = read_str(uri_length).strip("\x00")
+    parameter_length = read("<I")
+    config["parameter"] = read_str(parameter_length).strip("\x00")
+    useragent_length = read("<I")
+    config["user_agent"] = read_str(useragent_length).strip("\x00")
+    headers_length = read("<I")
+    config["http_headers"] = read_str(headers_length).strip("\x00")
+    config["ans_pre_size"] = read("<I")
+    config["ans_size"] = read("<I")
+    config["kill_date"] = read("<I")
+    config["working_time"] = read("<I")
+    config["sleep_delay"] = read("<I")
+    config["jitter_delay"] = read("<I")
+
+    return config
+
+def extract_config(filebuf: bytes) -> dict:
+    pe = pefile.PE(data=filebuf, fast_load=True)
+    data_sections = [s for s in pe.sections if b".rdata" in s.Name]
+    if not data_sections:
+        return
+
+    data = data_sections[0].get_data()
+    data_len = len(data)
+    pos = 0
+    while pos + 4 <= data_len:
+        start_offset = pos
+        key_offset = struct.unpack_from("<I", data, pos)[0]
+        pos += 4
+
+        if pos + key_offset + 32 > data_len:
+            pos = start_offset + 1
+            continue
+
+        encrypted_data = data[pos:pos + key_offset]
+        pos += key_offset
+        rc4_key = data[pos:pos + 16]
+
+        if key_offset == 787:
+            pass
+
+        with suppress(Exception):
+            decrypted = ARC4.new(rc4_key).decrypt(encrypted_data)
+            if b"User-Agent" in decrypted:
+                return parse_http_config(rc4_key, decrypted)
+
+        pos = start_offset + 1
+
+    return None
+
+
+if __name__ == "__main__":
+    import sys
+
+    with open(sys.argv[1], "rb") as f:
+        print(extract_config(f.read()))

{cape_parsers-0.1.35 → cape_parsers-0.1.37}/cape_parsers/CAPE/core/Socks5Systemz.py

@@ -20,6 +20,6 @@ def extract_config(data):
                 config_dict["C2s"].append(line)
             elif line and "\\" in line:
                 config_dict.setdefault("Timestamp path", []).append(line)
-            elif "." in line:
+            elif "." in line and "=" not in line and line not in config_dict["C2s"]:
                 config_dict.setdefault("Dummy domain", []).append(line)
         return config_dict

{cape_parsers-0.1.35 → cape_parsers-0.1.37}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "CAPE-parsers"
-version = "0.1.35"
+version = "0.1.37"
 description = "CAPE: Malware Configuration Extraction"
 authors = ["Kevin O'Reilly <kev@capesandbox.com>", "doomedraven <doomedraven@capesandbox.com>"]
 license = "MIT"
@@ -24,7 +24,7 @@ yara-python = ">=4.5.1"
 dnfile = ">=0.15.1"
 dncil = ">=1.0.2"
 unicorn = "2.1.1"
-rat-king-parser = ">=4.0.0"
+rat-king-parser = ">=4.1.0"
 
 ruff = ">=0.7.2"
 # isort = ">=5.13.2"

cape_parsers-0.1.35/cape_parsers/CAPE/community/AsyncRAT.py

@@ -1,5 +0,0 @@
-from rat_king_parser.rkp import RATConfigParser
-
-
-def extract_config(data: bytes):
-    return RATConfigParser(data=data).report.get("config", {})

cape_parsers-0.1.35/cape_parsers/CAPE/community/DCRat.py

@@ -1,5 +0,0 @@
-from rat_king_parser.rkp import RATConfigParser
-
-
-def extract_config(data: bytes):
-    return RATConfigParser(data=data).report.get("config", {})

cape_parsers-0.1.35/cape_parsers/CAPE/community/VenomRAT.py

@@ -1,5 +0,0 @@
-from rat_king_parser.rkp import RATConfigParser
-
-
-def extract_config(data: bytes):
-    return RATConfigParser(data=data).report.get("config", {})

cape_parsers-0.1.35/cape_parsers/CAPE/community/XWorm.py

@@ -1,5 +0,0 @@
-from rat_king_parser.rkp import RATConfigParser
-
-
-def extract_config(data: bytes):
-    return RATConfigParser(data=data).report.get("config", {})

cape_parsers-0.1.35/cape_parsers/CAPE/community/XenoRAT.py

@@ -1,5 +0,0 @@
-from rat_king_parser.rkp import RATConfigParser
-
-
-def extract_config(data: bytes):
-    return RATConfigParser(data=data).report.get("config", {})