CAPE-parsers 0.1.41__py3-none-any.whl → 0.1.44__py3-none-any.whl

cape_parsers/CAPE/community/Lumma.py

@@ -43,13 +43,15 @@ RULE_SOURCE_LUMMA_NEW_KEYS = """rule LummaConfigNewKeys
         author = "YungBinary"
     strings:
         $key_nonce = {
-            B8 ?? ?? ?? ??
-            BF ?? ?? ?? ??
+            B8 [4]
+            (BF ?? ?? ?? ??
+            B9 08 00 00 00|
             B9 08 00 00 00
+            BF ?? ?? ?? ??)
             96
             F3 A5
             96
-            B8 ?? ?? ?? ??
+            B8
         }
     condition:
         uint16(0) == 0x5A4D and $key_nonce
@@ -63,7 +65,7 @@ RULE_SOURCE_LUMMA_NEW_ENCRYPTED_C2 = """rule LummaConfigNewEncryptedStrings
         $encrypted_array = {
             C1 E? 07
             8D 8? [4]
-            8D 74 24 10
+            8D 74 24 ??
             FF [1-3]
             56
             5?

cape_parsers/CAPE/core/Stealc.py

@@ -0,0 +1,21 @@
+import socket
+from contextlib import suppress
+
+
+def _is_ip(ip):
+    try:
+        socket.inet_aton(ip)
+        return True
+    except Exception:
+        return False
+
+
+def extract_config(data):
+    config_dict = {"C2s": []}
+    with suppress(Exception):
+        if data[:2] == b"MZ":
+            return
+        for line in data.decode().split("\n"):
+            if _is_ip(line) and line not in config_dict["C2s"]:
+                config_dict["C2s"].append(line)
+        return config_dict

{cape_parsers-0.1.41.dist-info → cape_parsers-0.1.44.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: CAPE-parsers
-Version: 0.1.41
+Version: 0.1.44
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
 Keywords: cape,parsers,malware,configuration
@@ -23,7 +23,7 @@ Requires-Dist: pefile
 Requires-Dist: pycryptodomex (>=3.20.0)
 Requires-Dist: rat-king-parser (>=4.1.0)
 Requires-Dist: ruff (>=0.7.2)
-Requires-Dist: unicorn (==2.1.1)
+Requires-Dist: unicorn (>=2.1.1)
 Requires-Dist: yara-python (>=4.5.1)
 Description-Content-Type: text/markdown
 

{cape_parsers-0.1.41.dist-info → cape_parsers-0.1.44.dist-info}/RECORD

@@ -14,7 +14,7 @@ cape_parsers/CAPE/community/Fareit.py,sha256=NYkcF7Ddf7SqaSJwGesGTumTJ2p8AT9qBE4
 cape_parsers/CAPE/community/Greame.py,sha256=99W1aUoSNAQ9KMO85liel5rAN0Wutzo-m176iwfOzds,3633
 cape_parsers/CAPE/community/KoiLoader.py,sha256=ZTDm7tGGNFyW8N9l35_ta7ucBuE5AL9YprNR36kfid8,4029
 cape_parsers/CAPE/community/LokiBot.py,sha256=whdVVLqu760ai90Ep-_Ghc_Z1yaty9fMSOcnY5IajXc,5660
-cape_parsers/CAPE/community/Lumma.py,sha256=GgoiPIXufe2-hTSMjNSkTCOj8sSmISEiMwieOR2_45k,11991
+cape_parsers/CAPE/community/Lumma.py,sha256=Q0n7Tl4WLUvW3Btg2jgPLQ2pmWejIMNJzWrhWO-fFAc,12028
 cape_parsers/CAPE/community/NanoCore.py,sha256=0dqhCoAyDJaYgAlbXIwCa1esfEuQSk5AtH1Rl4bj1l8,6120
 cape_parsers/CAPE/community/Nighthawk.py,sha256=eXnDqwabnrlRROg503oXYLEgotMW4hKeYwLas8SrkTc,12104
 cape_parsers/CAPE/community/Njrat.py,sha256=_noQM5058BYwTMcYCpcTD9gIxw4ANI35tUSLMAlN97Q,4713
@@ -72,6 +72,7 @@ cape_parsers/CAPE/core/Rhadamanthys.py,sha256=TuhWqOssRiTOEuCk_UXBd3SPz-V71pOCYL
 cape_parsers/CAPE/core/SmokeLoader.py,sha256=y3PGuAhGkvRSlbi1-PViv66LW4N8AA2Rc5UzxV_nRvw,3889
 cape_parsers/CAPE/core/Socks5Systemz.py,sha256=k5AdoNKl32m6g1MlOWw4EXvfqMJOFuyw5I0VkQicjRs,759
 cape_parsers/CAPE/core/SquirrelWaffle.py,sha256=ErCT5eeo5xiQTBzhpaS22PQ8pp-u-G4cjJ4bapjKT2U,3283
+cape_parsers/CAPE/core/Stealc.py,sha256=LJivSCnho9KrSp5Lbw5oRa8vdKm3y7cNxXaev4tdl-8,488
 cape_parsers/CAPE/core/Strrat.py,sha256=StKPm9Qx8iIIjWb-2P7Naow6sMSJ9tclXJcUQ8JUcWc,2243
 cape_parsers/CAPE/core/UrsnifV3.py,sha256=Nu4X2l_zwlVMjvEa5gQRaR9SgYKL-C-C9onSmd2DtuU,5510
 cape_parsers/CAPE/core/WarzoneRAT.py,sha256=Gk0eZVCNGgscNlpsbB123v4P5rvCeyf8avcTHRAd4aA,3725
@@ -105,7 +106,7 @@ cape_parsers/utils/blzpack_lib.so,sha256=5PJtnggw8fV5q4DlhwMJk4ZadvC3fFTsVTNZKvE
 cape_parsers/utils/dotnet_utils.py,sha256=pzQGbCqccz7DRv8T_i1JURlrKDIlDT2axxViiFF9hsU,1672
 cape_parsers/utils/lznt1.py,sha256=X-BmJtP6AwYSl0ORg5dfSt-NIuXbHrtCO5kUaaJI2C8,4066
 cape_parsers/utils/strings.py,sha256=a-nbvP9jYST7b6t_H37Ype-fK2jEmQr-wMF5a4i04e4,3062
-cape_parsers-0.1.41.dist-info/LICENSE,sha256=88c01_HLG8WPj7R7aU_b-O-UoF38vrrifvcko4KDxcE,1069
-cape_parsers-0.1.41.dist-info/METADATA,sha256=h1u3DgL4J0c8rRPHjVRQo3Cw4Jmgs3XPOJUgdx-t5i4,1149
-cape_parsers-0.1.41.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
-cape_parsers-0.1.41.dist-info/RECORD,,
+cape_parsers-0.1.44.dist-info/LICENSE,sha256=88c01_HLG8WPj7R7aU_b-O-UoF38vrrifvcko4KDxcE,1069
+cape_parsers-0.1.44.dist-info/METADATA,sha256=4VjbNtdc_w3GCdccHiWb_--tggZS7VT0OpdUG-Cu9DQ,1149
+cape_parsers-0.1.44.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+cape_parsers-0.1.44.dist-info/RECORD,,