CAPE-parsers 0.1.36__py3-none-any.whl → 0.1.37__py3-none-any.whl

cape_parsers/CAPE/core/AdaptixBeacon.py

@@ -0,0 +1,102 @@
+import logging
+import struct
+from contextlib import suppress
+
+import pefile
+from Cryptodome.Cipher import ARC4
+
+log = logging.getLogger(__name__)
+
+DESCRIPTION = "Adaptix beacon configuration parser."
+AUTHOR = "enzok"
+
+
+def parse_http_config(rc4_key: bytes, data: bytes) -> dict:
+    config = {}
+    offset = 0
+    servers = []
+    ports = []
+
+    def read(fmt: str):
+        nonlocal offset
+        size = struct.calcsize(fmt)
+        value = struct.unpack_from(fmt, data, offset)
+        offset += size
+        return value if len(value) > 1 else value[0]
+
+    def read_str(length: int):
+        nonlocal offset
+        value = data[offset:offset + length].decode("utf-8", errors="replace")
+        offset += length
+        return value
+
+    config["config_rc4_key"] = rc4_key.hex()
+    config["agent_type"] = f"{read('<I'):8X}"
+    config["use_ssl"] = read("<B")
+    host_count = read("<I")
+    for host in range(host_count):
+        host_length = read("<I")
+        servers.append(read_str(host_length).strip("\x00"))
+        ports.append(read("<I"))
+
+    config["servers"] = servers
+    config["ports"] = ports
+    method_length = read("<I")
+    config["http_method"] = read_str(method_length).strip("\x00")
+    uri_length = read("<I")
+    config["uri"] = read_str(uri_length).strip("\x00")
+    parameter_length = read("<I")
+    config["parameter"] = read_str(parameter_length).strip("\x00")
+    useragent_length = read("<I")
+    config["user_agent"] = read_str(useragent_length).strip("\x00")
+    headers_length = read("<I")
+    config["http_headers"] = read_str(headers_length).strip("\x00")
+    config["ans_pre_size"] = read("<I")
+    config["ans_size"] = read("<I")
+    config["kill_date"] = read("<I")
+    config["working_time"] = read("<I")
+    config["sleep_delay"] = read("<I")
+    config["jitter_delay"] = read("<I")
+
+    return config
+
+def extract_config(filebuf: bytes) -> dict:
+    pe = pefile.PE(data=filebuf, fast_load=True)
+    data_sections = [s for s in pe.sections if b".rdata" in s.Name]
+    if not data_sections:
+        return
+
+    data = data_sections[0].get_data()
+    data_len = len(data)
+    pos = 0
+    while pos + 4 <= data_len:
+        start_offset = pos
+        key_offset = struct.unpack_from("<I", data, pos)[0]
+        pos += 4
+
+        if pos + key_offset + 32 > data_len:
+            pos = start_offset + 1
+            continue
+
+        encrypted_data = data[pos:pos + key_offset]
+        pos += key_offset
+        rc4_key = data[pos:pos + 16]
+
+        if key_offset == 787:
+            pass
+
+        with suppress(Exception):
+            decrypted = ARC4.new(rc4_key).decrypt(encrypted_data)
+            if b"User-Agent" in decrypted:
+                return parse_http_config(rc4_key, decrypted)
+
+        pos = start_offset + 1
+
+    return None
+
+
+if __name__ == "__main__":
+    import sys
+
+    with open(sys.argv[1], "rb") as f:
+        print(extract_config(f.read()))

{cape_parsers-0.1.36.dist-info → cape_parsers-0.1.37.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: CAPE-parsers
-Version: 0.1.36
+Version: 0.1.37
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
 Keywords: cape,parsers,malware,configuration

{cape_parsers-0.1.36.dist-info → cape_parsers-0.1.37.dist-info}/RECORD

@@ -37,6 +37,7 @@ cape_parsers/CAPE/community/VenomRAT.py,sha256=0nGLNnwnO93SPbCTgoIMvkh6_smuzQxDc
 cape_parsers/CAPE/community/XWorm.py,sha256=0nGLNnwnO93SPbCTgoIMvkh6_smuzQxDcYtL77afGx8,1001
 cape_parsers/CAPE/community/XenoRAT.py,sha256=0nGLNnwnO93SPbCTgoIMvkh6_smuzQxDcYtL77afGx8,1001
 cape_parsers/CAPE/community/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+cape_parsers/CAPE/core/AdaptixBeacon.py,sha256=vjb2tK_Wpx4h71bImTJWyPJjrmr_4d6Z9_P827w_-48,2908
 cape_parsers/CAPE/core/Azorult.py,sha256=7AWPeOWhji7n13qTjq-XNPA8LDKcCOOUy8nbT0TUU_I,2145
 cape_parsers/CAPE/core/BitPaymer.py,sha256=N3Ssi_zNliKn1vt2Z1UndMGZg4CIOjf75XDdpCx2ITc,2898
 cape_parsers/CAPE/core/BlackDropper.py,sha256=OyplMDY4GFcBgqoZqbpCRIusNHhcxK2qZuH8bQu8qlw,3173
@@ -104,7 +105,7 @@ cape_parsers/utils/blzpack_lib.so,sha256=5PJtnggw8fV5q4DlhwMJk4ZadvC3fFTsVTNZKvE
 cape_parsers/utils/dotnet_utils.py,sha256=pzQGbCqccz7DRv8T_i1JURlrKDIlDT2axxViiFF9hsU,1672
 cape_parsers/utils/lznt1.py,sha256=X-BmJtP6AwYSl0ORg5dfSt-NIuXbHrtCO5kUaaJI2C8,4066
 cape_parsers/utils/strings.py,sha256=a-nbvP9jYST7b6t_H37Ype-fK2jEmQr-wMF5a4i04e4,3062
-cape_parsers-0.1.36.dist-info/LICENSE,sha256=88c01_HLG8WPj7R7aU_b-O-UoF38vrrifvcko4KDxcE,1069
-cape_parsers-0.1.36.dist-info/METADATA,sha256=toAGrERdqyq9eJJ53tbwbnZd0U3ACbxnieK1ssQgBYU,1149
-cape_parsers-0.1.36.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
-cape_parsers-0.1.36.dist-info/RECORD,,
+cape_parsers-0.1.37.dist-info/LICENSE,sha256=88c01_HLG8WPj7R7aU_b-O-UoF38vrrifvcko4KDxcE,1069
+cape_parsers-0.1.37.dist-info/METADATA,sha256=P_Q2_z1zWOvRibQcJzs0DfetfEoqFCI4H9edQLnlHeM,1149
+cape_parsers-0.1.37.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+cape_parsers-0.1.37.dist-info/RECORD,,