CAPE-parsers 0.1.41__tar.gz → 0.1.44__tar.gz

{cape_parsers-0.1.41 → cape_parsers-0.1.44}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: CAPE-parsers
-Version: 0.1.41
+Version: 0.1.44
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
 Keywords: cape,parsers,malware,configuration
@@ -23,7 +23,7 @@ Requires-Dist: pefile
 Requires-Dist: pycryptodomex (>=3.20.0)
 Requires-Dist: rat-king-parser (>=4.1.0)
 Requires-Dist: ruff (>=0.7.2)
-Requires-Dist: unicorn (==2.1.1)
+Requires-Dist: unicorn (>=2.1.1)
 Requires-Dist: yara-python (>=4.5.1)
 Description-Content-Type: text/markdown
 

{cape_parsers-0.1.41 → cape_parsers-0.1.44}/cape_parsers/CAPE/community/Lumma.py

@@ -43,13 +43,15 @@ RULE_SOURCE_LUMMA_NEW_KEYS = """rule LummaConfigNewKeys
         author = "YungBinary"
     strings:
         $key_nonce = {
-            B8 ?? ?? ?? ??
-            BF ?? ?? ?? ??
+            B8 [4]
+            (BF ?? ?? ?? ??
+            B9 08 00 00 00|
             B9 08 00 00 00
+            BF ?? ?? ?? ??)
             96
             F3 A5
             96
-            B8 ?? ?? ?? ??
+            B8
         }
     condition:
         uint16(0) == 0x5A4D and $key_nonce
@@ -63,7 +65,7 @@ RULE_SOURCE_LUMMA_NEW_ENCRYPTED_C2 = """rule LummaConfigNewEncryptedStrings
         $encrypted_array = {
             C1 E? 07
             8D 8? [4]
-            8D 74 24 10
+            8D 74 24 ??
             FF [1-3]
             56
             5?

cape_parsers-0.1.44/cape_parsers/CAPE/core/Stealc.py

@@ -0,0 +1,21 @@
+import socket
+from contextlib import suppress
+
+
+def _is_ip(ip):
+    try:
+        socket.inet_aton(ip)
+        return True
+    except Exception:
+        return False
+
+
+def extract_config(data):
+    config_dict = {"C2s": []}
+    with suppress(Exception):
+        if data[:2] == b"MZ":
+            return
+        for line in data.decode().split("\n"):
+            if _is_ip(line) and line not in config_dict["C2s"]:
+                config_dict["C2s"].append(line)
+        return config_dict

{cape_parsers-0.1.41 → cape_parsers-0.1.44}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "CAPE-parsers"
-version = "0.1.41"
+version = "0.1.44"
 description = "CAPE: Malware Configuration Extraction"
 authors = ["Kevin O'Reilly <kev@capesandbox.com>", "doomedraven <doomedraven@capesandbox.com>"]
 license = "MIT"
@@ -23,7 +23,7 @@ maco = "1.1.8"
 yara-python = ">=4.5.1"
 dnfile = ">=0.15.1"
 dncil = ">=1.0.2"
-unicorn = "2.1.1"
+unicorn = ">=2.1.1"
 rat-king-parser = ">=4.1.0"
 
 ruff = ">=0.7.2"