CAPE-parsers 0.1.48__py3-none-any.whl → 0.1.54__py3-none-any.whl

cape_parsers/CAPE/community/AgentTesla.py

@@ -9,6 +9,7 @@ except ImportError as e:
 def extract_config(data: bytes):
     config = {}
     config_dict = {}
+    is_c2_found = False
     with suppress(Exception):
         if data[:2] == b"MZ":
             lines = extract_strings(data=data, on_demand=True, minchars=3)
@@ -25,11 +26,13 @@ def extract_config(data: bytes):
                 config_dict["Protocol"] = "Telegram"
                 config["CNCs"] = lines[base + x]
                 config_dict["Password"] = lines[base + x + 1]
+                is_c2_found = True
                 break
             # Data Exfiltration via Discord
             elif "discord" in lines[base + x]:
                 config_dict["Protocol"] = "Discord"
                 config["CNCs"] = [lines[base + x]]
+                is_c2_found = True
                 break
             # Data Exfiltration via FTP
             elif "ftp:" in lines[base + x]:
@@ -38,6 +41,7 @@ def extract_config(data: bytes):
                 username = lines[base + x + 1]
                 password = lines[base + x + 2]
                 config["CNCs"] = [f"ftp://{username}:{password}@{hostname}"]
+                is_c2_found = True
                 break
             # Data Exfiltration via SMTP
             elif "@" in lines[base + x]:
@@ -52,10 +56,12 @@ def extract_config(data: bytes):
                 config_dict["Password"] = lines[base + x + 1]
                 if "@" in lines[base + x + 2]:
                     config_dict["EmailTo"] = lines[base + x + 2]
+                is_c2_found = True
                 break
         # Get Persistence Payload Filename
         for x in range(2, 22):
-            if ".exe" in lines[base + x]:
+            # Only extract Persistence Filename when a C2 is detected.
+            if ".exe" in lines[base + x] and is_c2_found:
                 config_dict["Persistence_Filename"] = lines[base + x]
                 break
         # Get External IP Check Services

cape_parsers/CAPE/community/Amadey.py

@@ -173,25 +173,20 @@ def extract_config(data):
     version = ""
     install_dir = ""
     install_file = ""
-    ip_pattern = r"^(?:\d{1,3}\.){3}\d{1,3}$"
     version_pattern = r"^\d+\.\d{1,2}$"
     install_dir_pattern = r"^[0-9a-f]{10}$"
 
-    i = 0
-    while i < len(decoded_strings):
+    for i in range(len(decoded_strings)):
         s = decoded_strings[i]
-        if re.match(ip_pattern, s):
-            if i + 1 < len(decoded_strings):
-                path = decoded_strings[i+1]
-                final_config.setdefault("CNCs", []).append(f"http://{s}{path}")
-                i += 1  # Skip next element as it has been processed
+        if s.endswith(".php"):
+            c2 = decoded_strings[i-1]
+            final_config.setdefault("CNCs", []).append(f"http://{c2}{s}")
         elif re.match(version_pattern, s):
             version = s
         elif re.match(install_dir_pattern, s):
             install_dir = s
         elif s.endswith(".exe"):
             install_file = s
-        i += 1
 
     if version:
         final_config["version"] = version

cape_parsers/CAPE/community/AuroraStealer.py

@@ -32,7 +32,7 @@ def extract_config(data):
             key = item.split(":")[0].strip("{").strip('"')
             value = item.split(":")[1].strip('"')
             if key == "IP":
-                config_dict["CNCs"] = [value]
+                config_dict["CNCs"] = [f"tcp://{value}"]
             elif key == "BuildID":
                 config_dict["build"] = value
             else:

cape_parsers/CAPE/community/Lumma.py

@@ -5,7 +5,7 @@ import struct
 from contextlib import suppress
 import pefile
 import yara
-
+from Cryptodome.Cipher import ChaCha20
 
 RULE_SOURCE_BUILD_ID = """rule LummaBuildId
 {
@@ -142,7 +142,7 @@ def contains_non_printable(byte_array):
             return True
     return False
 
-
+"""
 def mask32(x):
     return x & 0xFFFFFFFF
 
@@ -242,7 +242,7 @@ def chacha20_xor(message, key, nonce, counter):
         xor_key.append(message[i] ^ key_stream[i])
 
     return xor_key
-
+"""
 
 def extract_c2_domain(data):
     pattern = rb"([\w-]+\.[\w]+)\x00"
@@ -315,7 +315,9 @@ def extract_config(data):
             counter = 2
             for i in range(12):
                 encrypted_string = data[encrypted_strings_offset : encrypted_strings_offset + 40]
-                decoded_c2 = chacha20_xor(encrypted_string, key, nonce, counter).split(b"\x00", 1)[0]
+                chacha20_cipher = ChaCha20.new(key=key, nonce=nonce)
+                chacha20_cipher.seek(counter)
+                decoded_c2 = chacha20_cipher.decrypt(encrypted_string).split(b"\x00", 1)[0]
                 if contains_non_printable(decoded_c2):
                     break
                 config.setdefault("CNCs", []).append("https://" + decoded_c2.decode())
@@ -348,7 +350,10 @@ def extract_config(data):
                     c2_encrypted = data[c2_dword_offset : c2_dword_offset + 0x80]
                     counters = [0, 2, 4, 6, 8, 10, 12, 14, 16]
                     for counter in counters:
-                        decrypted = chacha20_xor(c2_encrypted, key, nonce, counter)
+                        # decrypted = chacha20_xor(c2_encrypted, key, nonce, counter)
+                        chacha20_cipher = ChaCha20.new(key=key, nonce=nonce)
+                        chacha20_cipher.seek(counter)
+                        decrypted = chacha20_cipher.decrypt(c2_encrypted).split(b"\x00", 1)[0]
                         c2 = extract_c2_domain(decrypted)
                         if c2 is not None and len(c2) > 10:
                             config["CNCs"].append("https://" + c2.decode())

cape_parsers/CAPE/community/{monsterv2.py → MonsterV2.py}

@@ -14,15 +14,12 @@ RULE_SOURCE = """rule MonsterV2Config
         author = "doomedraven,YungBinary"
     strings:
         $chunk_1 = {
-            41 B8 ?? ?? ?? ??
-            48 8D 15 ?? ?? ?? ??
-            48 8B CB
-            E8 ?? ?? ?? ??
-            48 8D 83 ?? ?? ?? ??
-            48 89 44 24 ??
-            48 89 6C 24 ??
-            4C 8B C7
-            48 8D 54 24 ??
+            41 B8 0E 04 00 00
+            48 8D 15 ?? ?? ?? 00
+            48 8B C?
+            E8 ?? ?? ?? ?? [3-17]
+            4C 8B C?
+            48 8D 54 24 28
             48 8B CE
             E8 ?? ?? ?? ??
         }

cape_parsers/CAPE/community/MyKings.py

@@ -0,0 +1,52 @@
+"""
+Description: MyKings AKA Smominru config parser
+Author: x.com/YungBinary
+"""
+
+from contextlib import suppress
+import json
+import re
+import base64
+
+
+def contains_non_printable(byte_array):
+    for byte in byte_array:
+        if not chr(byte).isprintable():
+            return True
+    return False
+
+
+def extract_base64_strings(data: bytes, minchars: int, maxchars: int) -> list:
+    pattern = b"([A-Za-z0-9+/=]{" + str(minchars).encode() + b"," + str(maxchars).encode() + b"})\x00{4}"
+    strings = []
+    for string in re.findall(pattern, data):
+        decoded_string = base64_and_printable(string.decode())
+        if decoded_string:
+            strings.append(decoded_string)
+    return strings
+
+
+def base64_and_printable(b64_string: str):
+    with suppress(Exception):
+        decoded_bytes = base64.b64decode(b64_string)
+        if not contains_non_printable(decoded_bytes):
+            return decoded_bytes.decode('ascii')
+
+
+def extract_config(data: bytes) -> dict:
+    config_dict = {}
+    with suppress(Exception):
+        cncs = extract_base64_strings(data, 12, 60)
+        if cncs:
+            # as they don't have schema they going under raw
+            config_dict["raw"] = {"CNCs": cncs}
+            return config_dict
+
+    return {}
+
+
+if __name__ == "__main__":
+    import sys
+
+    with open(sys.argv[1], "rb") as f:
+        print(json.dumps(extract_config(f.read()), indent=4))

cape_parsers/CAPE/community/Stealc.py

@@ -1,6 +1,7 @@
 import struct
 import pefile
 import yara
+import ipaddress
 from contextlib import suppress
 
 
@@ -42,6 +43,13 @@ def yara_scan(raw_data):
                 yield block.identifier, instance.offset
 
 
+def _is_ip(ip):
+    try:
+        ipaddress.ip_address(ip)
+        return True
+    except Exception:
+        return False
+
 def xor_data(data, key):
     decoded = bytearray()
     for i in range(len(data)):
@@ -67,7 +75,9 @@ def parse_text(data):
         for line in lines:
             if line.startswith("http") and "://" in line:
                 domain = line
-            if line.startswith("/") and line[-4] == ".":
+            elif _is_ip(line):
+                domain = line
+            if line.startswith("/") and len(line) >= 4 and line[-4] == ".":
                 uri = line
 
 

cape_parsers/CAPE/community/WinosStager.py

@@ -0,0 +1,75 @@
+"""
+Description: Winos 4.0 "OnlineModule" config parser
+Author: x.com/YungBinary
+"""
+
+from contextlib import suppress
+import re
+
+
+CONFIG_KEY_MAP = {
+    "dd": "execution_delay_seconds",
+    "cl": "communication_interval_seconds",
+    "bb": "version",
+    "bz": "comment",
+    "jp": "keylogger",
+    "bh": "end_bluescreen",
+    "ll": "anti_traffic_monitoring",
+    "dl": "entrypoint",
+    "sh": "process_daemon",
+    "kl": "process_hollowing"
+}
+
+
+def find_config(data):
+    start = ":db|".encode("utf-16le")
+    end = ":1p|".encode("utf-16le")
+    pattern = re.compile(re.escape(start) + b".*?" + re.escape(end), re.DOTALL)
+    match = pattern.search(data)
+    if match:
+        return match.group(0).decode("utf-16le")
+
+
+def extract_config(data: bytes) -> dict:
+    config_dict = {}
+    final_config = {}
+
+    with suppress(Exception):
+        config = find_config(data)
+        if not config:
+            return config_dict
+
+        # Reverse the config string, which is delimited by '|'
+        config = config[::-1]
+        # Remove leading/trailing pipes and split into key/value pairs
+        elements = [element for element in config.strip('|').split('|') if ':' in element]
+        # Split each element for key : value in a dictionary
+        config_dict = dict(element.split(':', 1) for element in elements)
+        if config_dict:
+            # Handle extraction and formatting of CNCs
+            for i in range(1, 4):
+                p, o, t = config_dict.get(f"p{i}"), config_dict.get(f"o{i}"), config_dict.get(f"t{i}")
+                if p and p != "127.0.0.1" and o:
+                    protocol = {"0": "udp", "1": "tcp"}.get(t)
+                    if protocol:
+                        cnc = f"{protocol}://{p}:{o}"
+                        final_config.setdefault("CNCs", []).append(cnc)
+
+            if "CNCs" not in final_config:
+                return {}
+
+            final_config["CNCs"] = list(set(final_config["CNCs"]))
+            # Extract campaign ID
+            final_config["campaign_id"] = "default" if config_dict["fz"] == "\u9ed8\u8ba4" else config_dict["fz"]
+
+            # Map keys, e.g. dd -> execution_delay_seconds
+            final_config["raw"] = {v: config_dict[k] for k, v in CONFIG_KEY_MAP.items() if k in config_dict}
+
+    return final_config
+
+
+if __name__ == "__main__":
+    import sys
+
+    with open(sys.argv[1], "rb") as f:
+        print(extract_config(f.read()))

cape_parsers/CAPE/core/AuraStealer.py

@@ -0,0 +1,100 @@
+import json
+import struct
+from contextlib import suppress
+from typing import Any, Dict, Tuple
+
+import pefile
+from Cryptodome.Cipher import AES
+from Cryptodome.Util.Padding import unpad
+
+# Define the format for the fixed-size header part.
+# <   : little-endian
+# 32s : 32-byte string (for aes_key)
+# 16s : 16-byte string (for iv)
+# I   : 4-byte unsigned int (for dword1)
+# I   : 4-byte unsigned int (for dword2)
+HEADER_FORMAT = "<32s16sII"
+HEADER_SIZE = struct.calcsize(HEADER_FORMAT)  # This will be 32 + 16 + 4 + 4 = 56 bytes
+
+def parse_blob(data: bytes):
+    """
+    Parse the blob according to the scheme:
+      - 32 bytes = AES key
+      - Next 16 bytes = IV
+      - Next 2 DWORDs (8 bytes total) = XOR to get cipher data size
+      - Remaining bytes = cipher data of that size
+    """
+    aes_key, iv, dword1, dword2 = struct.unpack_from(HEADER_FORMAT, data, 0)
+    ciphertext_size = dword1 ^ dword2
+    cipher_data = data[HEADER_SIZE : HEADER_SIZE + ciphertext_size]
+    return aes_key, iv, cipher_data
+
+
+def decrypt(data: bytes) -> Tuple[bytes, bytes, bytes]:
+    aes_key, iv, cipher_data = parse_blob(data)
+    cipher = AES.new(aes_key, AES.MODE_CBC, iv)
+    plaintext_padded = cipher.decrypt(cipher_data)
+    return aes_key, iv, unpad(plaintext_padded, AES.block_size)
+
+
+def extract_config(data: bytes) -> Dict[str, Any]:
+    cfg: Dict[str, Any] = {}
+    plaintext = b""
+
+    pe = pefile.PE(data=data, fast_load=True)
+    try:
+        data_section = [s for s in pe.sections if s.Name.find(b".data") != -1][0]
+    except IndexError:
+        return cfg
+
+    if not data_section:
+        return cfg
+
+    data = data_section.get_data()
+    block_size = 4096
+    zeros = b"\x00" * block_size
+    offset = data.find(zeros)
+    if offset == -1:
+        return cfg
+
+    while offset > 0:
+        with suppress(Exception):
+            aes_key, iv, plaintext = decrypt(data[offset : offset + block_size])
+            if plaintext and b"conf" in plaintext:
+                break
+
+        offset -= 1
+
+    if plaintext:
+        try:
+            parsed = json.loads(plaintext.decode("utf-8", errors="ignore").rstrip("\x00"))
+        except json.JSONDecodeError:
+            return cfg
+
+        conf = parsed.get("conf", {})
+        build = parsed.get("build", {})
+        if conf:
+            cfg = {
+                "CNCs": conf.get("hosts"),
+                "user_agent": conf.get("useragents"),
+                "version": build.get("ver"),
+                "build": build.get("build_id"),
+                "cryptokey": aes_key.hex(),
+                "cryptokey_type": "AES",
+                "raw": {
+                    "iv": iv.hex(),
+                    "anti_vm": conf.get("anti_vm"),
+                    "anti_dbg": conf.get("anti_dbg"),
+                    "self_del": conf.get("self_del"),
+                    "run_delay": conf.get("run_delay"),
+                }
+            }
+
+    return cfg
+
+
+if __name__ == "__main__":
+    import sys
+
+    with open(sys.argv[1], "rb") as f:
+        print(extract_config(f.read()))

cape_parsers/CAPE/core/Latrodectus.py

@@ -41,7 +41,7 @@ rule Latrodectus
         $fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01}
         $procchk1 = {E8 [3] FF 85 C0 74 [2] FF FF FF FF E9 [4] E8 [4] 89 44 24 ?? E8 [4] 83 F8 4B 73 ?? 83 [3] 06}
         $procchk2 = {72 [2] FF FF FF FF E9 [4] E8 [4] 83 F8 32 73 ?? 83 [3] 06}
-		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
+		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
     condition:
         all of them
 }
@@ -59,7 +59,7 @@ rule Latrodectus_AES
 		$key =  {C6 44 2? ?? ?? [150] C6 44 2? ?? ?? B8 02}
 		$aes_ctr_1 = {8B 44 24 ?? FF C8 89 44 24 ?? 83 7C 24 ?? 00 7C ?? 4? 63 44 24 ?? 4? 8B 4C 24 ?? 0F B6 84 01 F0 00 00 00 3D FF 00 00 00}
 		$aes_ctr_2 = {48 03 C8 48 8B C1 0F B6 ?? 48 63 4C 24 ?? 0F B6 4C 0C ?? 33 C1 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 03 D1 48 8B CA 88 01}
-		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
+		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
     condition:
         all of them
 }
@@ -152,7 +152,8 @@ def extract_config(filebuf):
                         data = instance.matched_data[::-1]
                         major = int.from_bytes(data[10:11], byteorder="big")
                         minor = int.from_bytes(data[18:19], byteorder="big")
-                        version = f"{major}.{minor}"
+                        release = int.from_bytes(data[26:27], byteorder="big")
+                        version = f"{major}.{minor}.{release}"
                     if "$key" in item.identifier:
                         key = instance.matched_data[4::5]
             try:

cape_parsers/CAPE/core/NitroBunnyDownloader.py

@@ -0,0 +1,151 @@
+# Copyright (C) 2024 enzok
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import logging
+import struct
+
+import pefile
+import yara
+
+log = logging.getLogger(__name__)
+
+DESCRIPTION = "NitroBunnyDownloader configuration parser."
+AUTHOR = "enzok"
+
+yara_rule = """
+rule NitroBunnyDownloader
+{
+    meta:
+        author = "enzok"
+        description = "NitroBunnyDownloader Payload"
+        cape_type = "NitroBunnyDownloader Payload"
+        hash = "960e59200ec0a4b5fb3b44e6da763f5fec4092997975140797d4eec491de411b"
+    strings:
+        $config = {E8 [3] 00 41 B8 ?? ?? 00 00 48 8D 15 [3] 00 48 89 C1 48 89 ?? E8 [3] 00}
+        $string1 = "X-Amz-User-Agent:" wide
+        $string2 = "Amz-Security-Flag:" wide
+        $string3 = "/cart" wide
+        $string4 = "Cookie: " wide
+        $string5 = "wishlist" wide
+    condition:
+        uint16(0) == 0x5A4D and $config and 2 of ($string*)
+}
+"""
+
+yara_rules = yara.compile(source=yara_rule)
+
+
+def yara_scan(raw_data):
+    try:
+        return yara_rules.match(data=raw_data)
+    except Exception as e:
+        print(e)
+        return None
+
+
+def read_dword(data, off):
+    if off + 4 > len(data):
+        raise ValueError(f"EOF reading dword at {off}")
+    val = struct.unpack_from("<I", data, off)[0]
+    return val, off + 4
+
+
+def read_qword(data, off):
+    """Read a 64-bit unsigned little-endian value."""
+    if off + 8 > len(data):
+        raise ValueError(f"EOF reading qword at {off}")
+    val = struct.unpack_from("<Q", data, off)[0]
+    return val, off + 8
+
+
+def read_utf16le_string(data, off, length):
+    if off + length > len(data):
+        raise ValueError(f"EOF reading string at {off} len={length}")
+    raw = data[off:off + length]
+    s = raw.decode("utf-16le", errors="replace").rstrip("\x00")
+    return s, off + length
+
+
+def read_string_list(data, off, count):
+    items = []
+    for i in range(count):
+        length_words, off = read_qword(data, off)
+        s, off = read_utf16le_string(data, off, length_words)
+        items.append(s)
+    return items, off
+
+
+def extract_config(filebuf):
+    yara_hit = yara_scan(filebuf)
+    if not yara_hit:
+        return None
+
+    cfg = {}
+    config_code_offset = None
+    for hit in yara_hit:
+        if hit.rule != "NitroBunnyDownloader":
+            continue
+
+        for item in hit.strings:
+            for instance in item.instances:
+                if "$config" in item.identifier:
+                    config_code_offset = instance.offset
+                    break
+
+    if config_code_offset is None:
+        return None
+
+    try:
+        pe = pefile.PE(data=filebuf, fast_load=True)
+        config_length = pe.get_dword_from_offset(config_code_offset + 7)
+        config_offset = pe.get_dword_from_offset(config_code_offset + 14)
+        rva = pe.get_rva_from_offset(config_code_offset + 18)
+        config_rva = rva + config_offset
+        data = pe.get_data(config_rva, config_length)
+        off = 0
+        raw = cfg["raw"] = {}
+        port, off = read_dword(data, off)
+        num, off = read_dword(data, off)
+        cncs, off = read_string_list(data, off, num)
+        num, off = read_qword(data, off)
+        raw["user_agent"], off = read_utf16le_string(data, off, num)
+        num, off = read_dword(data, off)
+        raw["http_header_items"], off = read_string_list(data, off, num)
+        num, off = read_dword(data, off)
+        raw["uri_list"], off = read_string_list(data, off, num)
+        raw["unknown_1"], off = read_dword(data, off)
+        raw["unknown_2"], off = read_dword(data, off)
+
+        if cncs:
+            cfg["CNCs"] = []
+            schema = {80: "http", 443: "https"}.get(port, "tcp")
+            for cnc in cncs:
+                cnc = f"{schema}://{cnc}"
+                if port not in (80, 443):
+                    cnc += f":{port}"
+
+                cfg["CNCs"].append(cnc)
+
+    except Exception as e:
+        log.error("Error: %s", e)
+        return None
+
+    return cfg
+
+
+if __name__ == "__main__":
+    import sys
+
+    with open(sys.argv[1], "rb") as f:
+        print(extract_config(f.read()))

cape_parsers/CAPE/core/Rhadamanthys.py

@@ -91,7 +91,7 @@ def chacha20_stream(key, nonce, length, blocknum):
 
 
 def decrypt_config(data):
-    decrypted_config = b"\x21\x52\x48\x59"
+    decrypted_config = b""
     data_len = len(data)
     v3 = 0
     while True:
@@ -118,40 +118,128 @@ def chacha20_xor(custom_b64_decoded, key, nonce):
     return xor_key
 
 
-def extract_strings(data, minchars, maxchars):
-    apat = b"([\x20-\x7e]{" + str(minchars).encode() + b"," + str(maxchars).encode() + b"})\x00"
-    strings = [string.decode() for string in re.findall(apat, data)]
-    match = re.search(apat, data)
-    if not match:
-        return None
-    upat = b"((?:[\x20-\x7e][\x00]){" + str(minchars).encode() + b"," + str(maxchars).encode() + b"})\x00\x00"
-    strings.extend(str(ws.decode("utf-16le")) for ws in re.findall(upat, data))
+def extract_base64_strings(data, minchars, maxchars):
+    apat = b"([A-Za-z0-9-|]{" + str(minchars).encode() + b"," + str(maxchars).encode() + b"})\x00"
+    strings = [s.decode() for s in re.findall(apat, data)]
+    upat = b"((?:[A-Za-z0-9-|]\x00){" + str(minchars).encode() + b"," + str(maxchars).encode() + b"})\x00\x00"
+    strings.extend(ws.decode("utf-16le") for ws in re.findall(upat, data))
     return strings
 
 
 def extract_c2_url(data):
     pattern = b"(http[\x20-\x7e]+)\x00"
     match = re.search(pattern, data)
-    return match.group(1).decode()
+    if match:
+        return match.group(1).decode()
 
 
-def is_potential_custom_base64(string):
-    custom_alphabet = "ABC1fghijklmnop234NOPQRSTUVWXY567DEFGHIJKLMZ089abcdeqrstuvwxyz-|"
-    for c in string:
-        if c not in custom_alphabet:
-            return False
-    return True
-
-
-def custom_b64decode(data):
+def custom_b64decode(data: bytes, custom_alphabet: bytes):
     """Decodes base64 data using a custom alphabet."""
     standard_alphabet = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
-    custom_alphabet = b"ABC1fghijklmnop234NOPQRSTUVWXY567DEFGHIJKLMZ089abcdeqrstuvwxyz-|"
     # Translate the data back to the standard alphabet before decoding
     table = bytes.maketrans(custom_alphabet, standard_alphabet)
     return base64.b64decode(data.translate(table), validate=True)
 
 
+def lzo_noheader_decompress(data: bytes, decompressed_size: int):
+    src = 0
+    dst = bytearray()
+    length = len(data)
+
+    while src < length:
+        ctrl = data[src]
+        src += 1
+
+        # Special short match
+        # Copies exactly 3 bytes from dst starting match_len + 1 bytes back.
+        if ctrl == 0x20:
+            match_len = data[src]
+            src += 1
+            start = len(dst) - match_len - 1
+            end = start + 3
+            #print(f"Control code: {hex(ctrl)}, Offset backtrack length: {hex(match_len)}, Current offset: {hex(len(dst))}, New offset: {hex(start)}")
+            dst.extend(dst[start:end])
+
+        elif ctrl >= 0xE0 or ctrl == 0x40:
+            # Compute base copy length from the upper bits of ctrl
+            base_len = ((ctrl >> 5) - 1) + 3
+
+            if ctrl >= 0xE0:
+                # Long copy: extra length byte follows
+                copy_len = base_len + data[src]
+                # Offset is byte after
+                start = data[src + 1]
+                src += 2
+            elif ctrl == 0x40:
+                # Short copy: offset byte after control code
+                copy_len = base_len
+                start = data[src]
+                src += 1
+
+            # Calculate offset in output buffer
+            offset = len(dst) - start - 1
+
+            #print(f"Control code: {hex(ctrl)}, Offset backtrack length: {hex(start)}, Current offset: {hex(len(dst))}, New offset: {hex(len(dst) - start)}, Length to copy: {hex(copy_len)}")
+
+            # Copy from previously decompressed data
+            dst.extend(dst[offset:offset + copy_len])
+
+        else:
+            # Literal run
+            literal_len = (ctrl & 0x1F) + 1
+            #print(f"Control code: {hex(ctrl)}, Literal length: {hex(literal_len)}")
+            dst.extend(data[src:src+literal_len])
+            src += literal_len
+
+        if len(dst) == decompressed_size:
+            return bytes(dst)
+
+
+def parse_compression_header(config: bytes):
+    """Parse compressed size, decompressed size, and data offset from config"""
+
+    # 0x2A when looking at the config in memory
+    base_offset = 0x26
+
+    # Compressed data offset field, for calculating the offset to the compressed buffer
+    comp_offset_field = config[base_offset]
+    # Number of bytes the field spans
+    comp_offset_size_len = (comp_offset_field & 3) + 1
+    for i in range(1, comp_offset_size_len):
+        comp_offset_field |= config[base_offset + i] << (8 * i)
+
+    comp_size_offset = comp_offset_field >> 2
+
+    # Compressed size field, for finding the size of the compressed buffer
+    comp_offset = base_offset + comp_offset_size_len
+    comp_size_field = config[comp_offset]
+    # Number of bytes the field spans
+    comp_size_len = (comp_size_field & 3) + 1
+    for i in range(1, comp_size_len):
+        comp_size_field |= config[comp_offset + i] << (8 * i)
+
+    # Decompressed size field
+    decomp_field_offset = base_offset + comp_offset_size_len + comp_size_len
+    decomp_size_field = config[decomp_field_offset]
+    # Number of bytes the field spans
+    decomp_field_len = (decomp_size_field & 3) + 1
+    for i in range(1, decomp_field_len):
+        decomp_size_field |= config[decomp_field_offset + i] << (8 * i)
+
+    # Calculate return values
+    decompressed_size = decomp_size_field >> 2
+    compressed_data_offset = decomp_field_offset + decomp_field_len + comp_size_offset
+    compressed_size_key = config[0x28] << 8
+    compressed_size = (compressed_size_key | comp_size_field) >> 2
+    compressed_data = config[compressed_data_offset : compressed_data_offset + compressed_size]
+
+    return {
+        "compressed_size": compressed_size,
+        "decompressed_size": decompressed_size,
+        "compressed_data": compressed_data
+    }
+
+
 def extract_config(data):
     config_dict = {}
     magic = struct.unpack("I", data[:4])[0]
@@ -162,25 +250,66 @@ def extract_config(data):
         key = b"\x52\xAB\xDF\x06\xB6\xB1\x3A\xC0\xDA\x2D\x22\xDC\x6C\xD2\xBE\x6C\x20\x17\x69\xE0\x12\xB5\xE6\xEC\x0E\xAB\x4C\x14\x73\x4A\xED\x51"
         nonce = b"\x5F\x14\xD7\x9C\xFC\xFC\x43\x9E\xC3\x40\x6B\xBA"
 
-        extracted_strings = extract_strings(data, 0x100, 0x100)
+        custom_alphabets = [
+            b"ABC1fghijklmnop234NOPQRSTUVWXY567DEFGHIJKLMZ089abcdeqrstuvwxyz-|",
+            b"4NOPQRSTUVWXY567DdeEqrstuvwxyz-ABC1fghop23Fijkbc|lmnGHIJKLMZ089a", # 0.9.2
+            b"3Fijkbc|l4NOPQRSTUVWXY567DdewxEqrstuvyz-ABC1fghop2mnGHIJKLMZ089a", # 0.9.3
+        ]
+
+        # Extract base64 strings
+        extracted_strings = extract_base64_strings(data, 100, 256)
+        if not extracted_strings:
+            return config_dict
+
+        pattern = re.compile(b'.\x80')
         for string in extracted_strings:
             try:
-                if not is_potential_custom_base64(string):
-                    continue
+                custom_b64_decoded = custom_b64decode(string, custom_alphabets[0])
 
-                custom_b64_decoded = custom_b64decode(string)
                 xor_key = chacha20_xor(custom_b64_decoded, key, nonce)
-                decrypted_config = decrypt_config(xor_key)
-                reexecution_delay = int.from_bytes(decrypted_config[5:7], byteorder="little")
-
-                c2_url = extract_c2_url(decrypted_config)
-                if not c2_url:
-                    continue
-                config_dict = {"raw": {"Reexecution_delay": reexecution_delay}, "CNCs": [c2_url]}
-                return config_dict
+
+                # Decrypted, but may still be the compressed malware configuration
+                config = decrypt_config(xor_key)
+                # Attempt to extract C2 url, only works in version prior to 0.9.2
+                c2_url = extract_c2_url(config)
+                if c2_url:
+                    config_dict = {"CNCs": [c2_url]}
+                    return config_dict
+                else:
+                    # Handle new variants that compress the Command and Control server(s)
+                    custom_b64_decoded = custom_b64decode(string, custom_alphabets[2])
+                    xor_key = chacha20_xor(custom_b64_decoded, key, nonce)
+                    config = decrypt_config(xor_key)
+
+                    parsed = parse_compression_header(config)
+                    if not parsed:
+                        return config_dict
+
+                    decompressed = lzo_noheader_decompress(parsed['compressed_data'], parsed['decompressed_size'])
+
+                    # Try old alphabet for 0.9.2
+                    if not decompressed:
+                        custom_b64_decoded = custom_b64decode(string, custom_alphabets[1])
+                        xor_key = chacha20_xor(custom_b64_decoded, key, nonce)
+                        config = decrypt_config(xor_key)
+
+                        parsed = parse_compression_header(config)
+                        if not parsed:
+                            return config_dict
+
+                        decompressed = lzo_noheader_decompress(parsed['compressed_data'], parsed['decompressed_size'])
+
+
+                    cncs = [f"https://{chunk.decode()}" for chunk in pattern.split(decompressed) if chunk]
+                    if cncs:
+                        config_dict = {"CNCs": cncs}
+                        return config_dict
+
             except Exception:
                 continue
 
+        return config_dict
+
 
 if __name__ == "__main__":
     import sys

{cape_parsers-0.1.48.dist-info → cape_parsers-0.1.54.dist-info}/METADATA

@@ -1,8 +1,9 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: CAPE-parsers
-Version: 0.1.48
+Version: 0.1.54
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
+License-File: LICENSE
 Keywords: cape,parsers,malware,configuration
 Author: Kevin O'Reilly
 Author-email: kev@capesandbox.com
@@ -13,6 +14,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Provides-Extra: maco
 Requires-Dist: capstone (>=4.0.2)
 Requires-Dist: dncil (>=1.0.2)

{cape_parsers-0.1.48.dist-info → cape_parsers-0.1.54.dist-info}/RECORD

@@ -1,9 +1,9 @@
 cape_parsers/CAPE/__init__.py,sha256=JcY8WPKzUFYgexwV1eyKIuT1JyNZzMJjBynlPSzxY_I,7
-cape_parsers/CAPE/community/AgentTesla.py,sha256=rHhTmINQ0bGZEiJ5NhCKPhGobcifq3FDWZItgHTpBC8,3796
-cape_parsers/CAPE/community/Amadey.py,sha256=DDPfrTzPBWCXXXB2P4doRfpiUYgKHKBxHBuQEUbNjq4,5773
+cape_parsers/CAPE/community/AgentTesla.py,sha256=ln5MqFXkTb7WrlDrUHNTnMWBYRHDSqyK4VHeq0ZldtA,4047
+cape_parsers/CAPE/community/Amadey.py,sha256=IUyt909q9IDQPPip6UW9uD16rJMD_gvkwvNZ8NHTW-k,5577
 cape_parsers/CAPE/community/Arkei.py,sha256=k36qHxdo5yPa9V1cg7EImSWP06kMog0rBda4KXqLKCY,3783
 cape_parsers/CAPE/community/AsyncRAT.py,sha256=0-FRT3d2x63KQ_cs1xmKFj7x0JRf7ID6QDc_DvBa0PM,1003
-cape_parsers/CAPE/community/AuroraStealer.py,sha256=C0j9SZDJRi107PbfYZ9G168MCyqYItrI-XK5k0Bp4tE,2632
+cape_parsers/CAPE/community/AuroraStealer.py,sha256=LRu2QFBYkGhRGDJBw3GlcKub4E0_TBWmjdR2PnobDZM,2643
 cape_parsers/CAPE/community/Carbanak.py,sha256=Smi_vTWDfWxYBQa661ZIy0624IYJA22LMHAJEQbstpk,5607
 cape_parsers/CAPE/community/CobaltStrikeBeacon.py,sha256=U4Q0ObCrPRpiO5B5fBmkgr63jXdizujNth8v6kUPnEQ,19466
 cape_parsers/CAPE/community/CobaltStrikeStager.py,sha256=HLxROBjz453uHNq1bPz0VSAhtyWDfz79ZacTPdjuWmY,7535
@@ -11,7 +11,9 @@ cape_parsers/CAPE/community/DCRat.py,sha256=0-FRT3d2x63KQ_cs1xmKFj7x0JRf7ID6QDc_
 cape_parsers/CAPE/community/Fareit.py,sha256=OyKeZdcvyAhjxZgJqkDPJHP4Npv1ArvTHJZ5F0C1Iac,1875
 cape_parsers/CAPE/community/KoiLoader.py,sha256=F2gsgCvrVuwxY1bg8rlexsjCjikAP5HIGGOqU8zhT8E,4008
 cape_parsers/CAPE/community/LokiBot.py,sha256=355kqLx0LNMr8XcGfPL7cxG8QZalcmE7ttVBqoWtTWE,5754
-cape_parsers/CAPE/community/Lumma.py,sha256=Iqd9yvt3g0FeV_bYRmL1RKp4C1H92qeGg4fXivVDSxw,12206
+cape_parsers/CAPE/community/Lumma.py,sha256=0xwX6kOWR3ezrHxN1y1A5RD2-n8XRKx5hj3ynQjgRKU,12583
+cape_parsers/CAPE/community/MonsterV2.py,sha256=cFxhYxo7FruTMmFY3OtBO-E0hDyxfsC3zWX3BlcB-qI,2915
+cape_parsers/CAPE/community/MyKings.py,sha256=bcypBMJf6Jeg0yrHZ-J-XjnhHvFbb-lpDF_zwW63gOk,1397
 cape_parsers/CAPE/community/NanoCore.py,sha256=8QZnf1AcY9481kSfsf3SHQShwPLn97peGAf8_xEasQc,6230
 cape_parsers/CAPE/community/Nighthawk.py,sha256=8ss8yvslrwUt53zV6U0xuwGKU3hgYfOt13S5lkOVpNo,12105
 cape_parsers/CAPE/community/Njrat.py,sha256=GiwSENBB43RUqyJ7zT7ZPkPUYqo8Ew4kd5MJUj0jzdc,4702
@@ -20,13 +22,14 @@ cape_parsers/CAPE/community/QuasarRAT.py,sha256=dzVInOc-BPVRdArk92oEY4PKq1AEW04N
 cape_parsers/CAPE/community/README.md,sha256=SHgVQraCdp033IQjM4Cm6t70U4kULn1MfSwTq3rsZv8,22
 cape_parsers/CAPE/community/Snake.py,sha256=v_MAPmg86ZdgGOkzc9GVHbi-lu4nLa1_0Lp90qiCg8s,6650
 cape_parsers/CAPE/community/SparkRAT.py,sha256=OVDty_1i9PTGuEumT0BHoDn0bD2UtdhHVNjThah80pg,2140
-cape_parsers/CAPE/community/Stealc.py,sha256=RddvMmFmq85J3pCqtpACT1n6k02P1_GsxXIidtveNa4,5102
+cape_parsers/CAPE/community/Stealc.py,sha256=18EkQ-lMMAreKV5vA9xLBmOK5B4JtYcBwVqNfof4K2A,5321
 cape_parsers/CAPE/community/VenomRAT.py,sha256=0-FRT3d2x63KQ_cs1xmKFj7x0JRf7ID6QDc_DvBa0PM,1003
+cape_parsers/CAPE/community/WinosStager.py,sha256=6jkfTJiVdz6oyyqTjh3I4qunYgXbD4qXS_bd-uogwGA,2407
 cape_parsers/CAPE/community/XWorm.py,sha256=0-FRT3d2x63KQ_cs1xmKFj7x0JRf7ID6QDc_DvBa0PM,1003
 cape_parsers/CAPE/community/XenoRAT.py,sha256=0-FRT3d2x63KQ_cs1xmKFj7x0JRf7ID6QDc_DvBa0PM,1003
 cape_parsers/CAPE/community/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-cape_parsers/CAPE/community/monsterv2.py,sha256=eVEs4VIeS3PiZtRjNb69itmDq2Zkbrpn5k3M68GujiI,2995
 cape_parsers/CAPE/core/AdaptixBeacon.py,sha256=40wMfrXt-7UG30WsLC5GxUtG6tSUaaP1OT-ntWzPZn0,2956
+cape_parsers/CAPE/core/AuraStealer.py,sha256=RSiclflsvcrcNLHpRokc_qF2cdQKXGBKg8Ti-Q-XmaM,3021
 cape_parsers/CAPE/core/Azorult.py,sha256=YkMIhC6zRTxEkLVMUdr2MMsbV9iAnZ8hUS8be9GZ5N4,2150
 cape_parsers/CAPE/core/BitPaymer.py,sha256=HQwoE0o7HMiXItxE08vBenf2ZWMxZp84-Hf_1eZ8QdE,3050
 cape_parsers/CAPE/core/BlackDropper.py,sha256=sCSu2T5oPvcFHlSAzSsLj_gCv2Tldl0UPguwy0MVg6A,3282
@@ -40,7 +43,8 @@ cape_parsers/CAPE/core/Formbook.py,sha256=rvf0BRuRl_v8K9SJuSSfbVVMWLSTEemIgP3NtP
 cape_parsers/CAPE/core/GuLoader.py,sha256=wH6t1e7rO60Bwe0ulqFdZq12-M087zT5WQtC_Wn2biU,354
 cape_parsers/CAPE/core/IcedID.py,sha256=TEsvFq8qHz_D5kIURKWSC4lbvWaQbMriDZ3jQsVu2VA,4029
 cape_parsers/CAPE/core/IcedIDLoader.py,sha256=YUOEILpTycO01KK4qqAxGSplsRVs2EzjscUw4T-DGWs,1602
-cape_parsers/CAPE/core/Latrodectus.py,sha256=j7qq_R2fB9ls3jnm1zwWe-md29QONZN71I2MAQ0T0h4,7614
+cape_parsers/CAPE/core/Latrodectus.py,sha256=1K9yUUYtzRJ2c3unrYIUaA8nE--Zoqi5pjXY7t7t1qg,7751
+cape_parsers/CAPE/core/NitroBunnyDownloader.py,sha256=2HD7UOqZ8gtVxwR84OMCB4NSv0VqPAEMONuDSEgtDqk,4627
 cape_parsers/CAPE/core/Oyster.py,sha256=QStBScevJuLyd5d4Rw093SxTlbRG1LFkDwYgmjZx-EQ,4881
 cape_parsers/CAPE/core/PikaBot.py,sha256=6Q8goXfMsSoU8UkdE9iuZY2KTxX_AmWhH1szke_HfWA,5280
 cape_parsers/CAPE/core/PlugX.py,sha256=lGwr1T3mttG6CTbZCj_Cf5HnOad60A3LP264jlCsGsc,13192
@@ -49,7 +53,7 @@ cape_parsers/CAPE/core/Quickbind.py,sha256=5A077RFQQOL8dtr2Q9vmlTKsWk96JkRWuHGse
 cape_parsers/CAPE/core/README.md,sha256=Zd84WEUj9NzKzGnVZV1jx6gMiEOtz01m32B7xEuS91k,17
 cape_parsers/CAPE/core/RedLine.py,sha256=bZeKLvxaS6HDpWY4RDXtSEBt93qTNzZG5iE6FNS0dOY,5734
 cape_parsers/CAPE/core/Remcos.py,sha256=MIpO2FwehBGIhO7hS0TT2hdDsgvxlI5ps4rAwyFwdTY,9483
-cape_parsers/CAPE/core/Rhadamanthys.py,sha256=mx7kEF1e8LJZbwh2uUwU56ZKgrpLqZvYVDoqm-Dvl9w,6075
+cape_parsers/CAPE/core/Rhadamanthys.py,sha256=kvkNj_Ydv_ewjctBNyBvJk31nRnXLl6pU18Ihq9bTXE,11259
 cape_parsers/CAPE/core/SmokeLoader.py,sha256=ruQ_GDiZvqtGxUTbN2N6fajUYWkIylFTvMXijgZ8L20,3890
 cape_parsers/CAPE/core/Socks5Systemz.py,sha256=jSt6QejL5K99dIB3qdItvUHL28w6N60xuwc8EQHM5Mk,783
 cape_parsers/CAPE/core/SquirrelWaffle.py,sha256=UMha7l60fL64VPHxueFUnCEGaO-CXau5ftEyK-Wv__o,3308
@@ -107,7 +111,7 @@ cape_parsers/utils/blzpack_lib.so,sha256=5PJtnggw8fV5q4DlhwMJk4ZadvC3fFTsVTNZKvE
 cape_parsers/utils/dotnet_utils.py,sha256=pzQGbCqccz7DRv8T_i1JURlrKDIlDT2axxViiFF9hsU,1672
 cape_parsers/utils/lznt1.py,sha256=X-BmJtP6AwYSl0ORg5dfSt-NIuXbHrtCO5kUaaJI2C8,4066
 cape_parsers/utils/strings.py,sha256=a-nbvP9jYST7b6t_H37Ype-fK2jEmQr-wMF5a4i04e4,3062
-cape_parsers-0.1.48.dist-info/LICENSE,sha256=88c01_HLG8WPj7R7aU_b-O-UoF38vrrifvcko4KDxcE,1069
-cape_parsers-0.1.48.dist-info/METADATA,sha256=QcTr1uhZdJD111O44MJ9OhlzkylKsW2FDL0sYiAVJrA,1753
-cape_parsers-0.1.48.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
-cape_parsers-0.1.48.dist-info/RECORD,,
+cape_parsers-0.1.54.dist-info/METADATA,sha256=LH-LzvpGEEy_jgRIxzLAAvpmyqZAbL6f934-B4aEkGI,1826
+cape_parsers-0.1.54.dist-info/WHEEL,sha256=zp0Cn7JsFoX2ATtOhtaFYIiE2rmFAD4OcMhtUki8W3U,88
+cape_parsers-0.1.54.dist-info/licenses/LICENSE,sha256=88c01_HLG8WPj7R7aU_b-O-UoF38vrrifvcko4KDxcE,1069
+cape_parsers-0.1.54.dist-info/RECORD,,

{cape_parsers-0.1.48.dist-info → cape_parsers-0.1.54.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: poetry-core 2.1.3
+Generator: poetry-core 2.2.1
 Root-Is-Purelib: true
 Tag: py3-none-any