CAPE-parsers 0.1.42__tar.gz → 0.1.44__tar.gz

{cape_parsers-0.1.42 → cape_parsers-0.1.44}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: CAPE-parsers
-Version: 0.1.42
+Version: 0.1.44
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
 Keywords: cape,parsers,malware,configuration
@@ -23,7 +23,7 @@ Requires-Dist: pefile
 Requires-Dist: pycryptodomex (>=3.20.0)
 Requires-Dist: rat-king-parser (>=4.1.0)
 Requires-Dist: ruff (>=0.7.2)
-Requires-Dist: unicorn (==2.1.1)
+Requires-Dist: unicorn (>=2.1.1)
 Requires-Dist: yara-python (>=4.5.1)
 Description-Content-Type: text/markdown
 

{cape_parsers-0.1.42 → cape_parsers-0.1.44}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "CAPE-parsers"
-version = "0.1.42"
+version = "0.1.44"
 description = "CAPE: Malware Configuration Extraction"
 authors = ["Kevin O'Reilly <kev@capesandbox.com>", "doomedraven <doomedraven@capesandbox.com>"]
 license = "MIT"
@@ -23,7 +23,7 @@ maco = "1.1.8"
 yara-python = ">=4.5.1"
 dnfile = ">=0.15.1"
 dncil = ">=1.0.2"
-unicorn = "2.1.1"
+unicorn = ">=2.1.1"
 rat-king-parser = ">=4.1.0"
 
 ruff = ">=0.7.2"

cape_parsers-0.1.42/cape_parsers/CAPE/community/Amadey.py

@@ -1,43 +0,0 @@
-import base64
-import re
-
-str_hash_data = 'd6052c4fe86a6346964a6bbbe2423e20'
-str_alphabet = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 '
-
-def is_ascii(s):
-    return all(c < 128 or c == 0 for c in s)
-
-def decrypt(str_data, str_hash_data, str_alphabet):
-    str_hash = ''
-
-    for i in range(len(str_data)):
-        str_hash += str_hash_data[i % len(str_hash_data)]
-
-    out = ''
-
-    for i in range(len(str_data)):
-        if str_data[i] not in str_alphabet:
-            out += str_data[i]
-            continue
-        alphabet_count = str_alphabet.find(str_data[i])
-        hash_count = str_alphabet.find(str_hash[i])
-        index_calc = (alphabet_count + len(str_alphabet) - hash_count) % len(str_alphabet)
-        out += str_alphabet[index_calc]
-
-    return base64.b64decode(out)
-
-file_data = open('/tmp/amadey.bin','rb').read()
-
-strings = []
-for m in re.finditer(rb'[a-zA-Z =0-9]{4,}',file_data):
-    strings.append(m.group().decode('utf-8'))
-
-for s in strings:
-    try:
-        temp = decrypt(s, str_hash_data, str_alphabet)
-        if is_ascii(temp) and len(temp) > 3:
-            print(temp.decode('utf-8'))
-    except:
-        continue
-
-decrypt('1RydQIOr3Zcp6emn RYv8IGzgUKS6r5ThSdqDVBERAP2Ir 0JQ1=', str_hash_data, str_alphabet)