CAPE-parsers 0.1.48__tar.gz → 0.1.49__tar.gz

{cape_parsers-0.1.48 → cape_parsers-0.1.49}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: CAPE-parsers
-Version: 0.1.48
+Version: 0.1.49
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
 Keywords: cape,parsers,malware,configuration

{cape_parsers-0.1.48 → cape_parsers-0.1.49}/cape_parsers/CAPE/community/Amadey.py

@@ -173,25 +173,20 @@ def extract_config(data):
     version = ""
     install_dir = ""
     install_file = ""
-    ip_pattern = r"^(?:\d{1,3}\.){3}\d{1,3}$"
     version_pattern = r"^\d+\.\d{1,2}$"
     install_dir_pattern = r"^[0-9a-f]{10}$"
 
-    i = 0
-    while i < len(decoded_strings):
+    for i in range(len(decoded_strings)):
         s = decoded_strings[i]
-        if re.match(ip_pattern, s):
-            if i + 1 < len(decoded_strings):
-                path = decoded_strings[i+1]
-                final_config.setdefault("CNCs", []).append(f"http://{s}{path}")
-                i += 1  # Skip next element as it has been processed
+        if s.endswith(".php"):
+            c2 = decoded_strings[i-1]
+            final_config.setdefault("CNCs", []).append(f"http://{c2}{s}")
         elif re.match(version_pattern, s):
             version = s
         elif re.match(install_dir_pattern, s):
             install_dir = s
         elif s.endswith(".exe"):
             install_file = s
-        i += 1
 
     if version:
         final_config["version"] = version

{cape_parsers-0.1.48 → cape_parsers-0.1.49}/cape_parsers/CAPE/community/Stealc.py

@@ -1,6 +1,7 @@
 import struct
 import pefile
 import yara
+import ipaddress
 from contextlib import suppress
 
 
@@ -42,6 +43,13 @@ def yara_scan(raw_data):
                 yield block.identifier, instance.offset
 
 
+def _is_ip(ip):
+    try:
+        ipaddress.ip_address(ip)
+        return True
+    except Exception:
+        return False
+
 def xor_data(data, key):
     decoded = bytearray()
     for i in range(len(data)):
@@ -67,6 +75,8 @@ def parse_text(data):
         for line in lines:
             if line.startswith("http") and "://" in line:
                 domain = line
+            elif _is_ip(line):
+                domain = line
             if line.startswith("/") and line[-4] == ".":
                 uri = line
 

cape_parsers-0.1.49/cape_parsers/CAPE/core/AuraStealer.py

@@ -0,0 +1,93 @@
+import json
+import struct
+from contextlib import suppress
+from typing import Any, Dict, Tuple
+
+import pefile
+from Cryptodome.Cipher import AES
+from Cryptodome.Util.Padding import unpad
+
+
+def parse_blob(data: bytes):
+    """
+    Parse the blob according to the scheme:
+      - 32 bytes = AES key
+      - Next 16 bytes = IV
+      - Next 2 DWORDs (8 bytes total) = XOR to get cipher data size
+      - Remaining bytes = cipher data of that size
+    """
+    offset = 0
+    aes_key = data[offset:offset + 32]
+    offset += 32
+    iv = data[offset:offset + 16]
+    offset += 16
+    dword1, dword2 = struct.unpack_from("<II", data, offset)
+    cipher_size = dword1 ^ dword2
+    offset += 8
+    cipher_data = data[offset:offset + cipher_size]
+    return aes_key, iv, cipher_data
+
+
+def decrypt(data: bytes) -> Tuple[bytes, bytes, bytes]:
+    aes_key, iv, cipher_data = parse_blob(data)
+    cipher = AES.new(aes_key, AES.MODE_CBC, iv)
+    plaintext_padded = cipher.decrypt(cipher_data)
+    return aes_key, iv, unpad(plaintext_padded, AES.block_size)
+
+
+def extract_config(data: bytes) -> Dict[str, Any]:
+    cfg: Dict[str, Any] = {}
+    plaintext = ""
+    pe = pefile.PE(data=data, fast_load=True)
+    try:
+        data_section = [s for s in pe.sections if s.Name.find(b".data") != -1][0]
+    except IndexError:
+        return cfg
+
+    if not data_section:
+        return cfg
+
+    data = data_section.get_data()
+    block_size = 4096
+    zeros = b"\x00" * block_size
+    offset = data.find(zeros)
+    if offset == -1:
+        return cfg
+
+    while offset > 0:
+        with suppress(Exception):
+            aes_key, iv, plaintext = decrypt(data[offset : offset + block_size])
+            if plaintext and b"conf" in plaintext:
+                break
+
+        offset -= 1
+
+    if plaintext:
+        parsed = json.loads(plaintext.decode("utf-8", errors="ignore").rstrip("\x00"))
+        conf = parsed.get("conf", {})
+        build = parsed.get("build", {})
+        if conf:
+            cfg = {
+                "CNCs": conf.get("hosts"),
+                "user_agent": conf.get("useragents"),
+                "version": build.get("ver"),
+                "build": build.get("build_id"),
+                "cryptokey": aes_key.hex(),
+                "cryptokey_type": "AES",
+                "raw": {
+                    "iv": iv.hex(),
+                    "anti_vm": conf.get("anti_vm"),
+                    "anti_dbg": conf.get("anti_dbg"),
+                    "self_del": conf.get("self_del"),
+                    "run_delay": conf.get("run_delay"),
+                }
+            }
+
+    return cfg
+
+
+if __name__ == "__main__":
+    import sys
+
+    with open(sys.argv[1], "rb") as f:
+        print(extract_config(f.read()))

{cape_parsers-0.1.48 → cape_parsers-0.1.49}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "CAPE-parsers"
-version = "0.1.48"
+version = "0.1.49"
 description = "CAPE: Malware Configuration Extraction"
 authors = ["Kevin O'Reilly <kev@capesandbox.com>", "doomedraven <doomedraven@capesandbox.com>"]
 license = "MIT"