CAPE-parsers 0.1.49__py3-none-any.whl → 0.1.50__py3-none-any.whl

cape_parsers/CAPE/community/AuroraStealer.py

@@ -32,7 +32,7 @@ def extract_config(data):
             key = item.split(":")[0].strip("{").strip('"')
             value = item.split(":")[1].strip('"')
             if key == "IP":
-                config_dict["CNCs"] = [value]
+                config_dict["CNCs"] = [f"tcp://{value}"]
             elif key == "BuildID":
                 config_dict["build"] = value
             else:

cape_parsers/CAPE/community/Stealc.py

@@ -77,7 +77,7 @@ def parse_text(data):
                 domain = line
             elif _is_ip(line):
                 domain = line
-            if line.startswith("/") and line[-4] == ".":
+            if line.startswith("/") and len(line) >= 4 and line[-4] == ".":
                 uri = line
 
 

cape_parsers/CAPE/core/AuraStealer.py

@@ -7,6 +7,14 @@ import pefile
 from Cryptodome.Cipher import AES
 from Cryptodome.Util.Padding import unpad
 
+# Define the format for the fixed-size header part.
+# <   : little-endian
+# 32s : 32-byte string (for aes_key)
+# 16s : 16-byte string (for iv)
+# I   : 4-byte unsigned int (for dword1)
+# I   : 4-byte unsigned int (for dword2)
+HEADER_FORMAT = "<32s16sII"
+HEADER_SIZE = struct.calcsize(HEADER_FORMAT)  # This will be 32 + 16 + 4 + 4 = 56 bytes
 
 def parse_blob(data: bytes):
     """
@@ -16,15 +24,9 @@ def parse_blob(data: bytes):
       - Next 2 DWORDs (8 bytes total) = XOR to get cipher data size
       - Remaining bytes = cipher data of that size
     """
-    offset = 0
-    aes_key = data[offset:offset + 32]
-    offset += 32
-    iv = data[offset:offset + 16]
-    offset += 16
-    dword1, dword2 = struct.unpack_from("<II", data, offset)
-    cipher_size = dword1 ^ dword2
-    offset += 8
-    cipher_data = data[offset:offset + cipher_size]
+    aes_key, iv, dword1, dword2 = struct.unpack_from(HEADER_FORMAT, data, 0)
+    ciphertext_size = dword1 ^ dword2
+    cipher_data = data[HEADER_SIZE : HEADER_SIZE + ciphertext_size]
     return aes_key, iv, cipher_data
 
 
@@ -37,7 +39,8 @@ def decrypt(data: bytes) -> Tuple[bytes, bytes, bytes]:
 
 def extract_config(data: bytes) -> Dict[str, Any]:
     cfg: Dict[str, Any] = {}
-    plaintext = ""
+    plaintext = b""
+
     pe = pefile.PE(data=data, fast_load=True)
     try:
         data_section = [s for s in pe.sections if s.Name.find(b".data") != -1][0]
@@ -63,7 +66,11 @@ def extract_config(data: bytes) -> Dict[str, Any]:
         offset -= 1
 
     if plaintext:
-        parsed = json.loads(plaintext.decode("utf-8", errors="ignore").rstrip("\x00"))
+        try:
+            parsed = json.loads(plaintext.decode("utf-8", errors="ignore").rstrip("\x00"))
+        except json.JSONDecodeError:
+            return cfg
+
         conf = parsed.get("conf", {})
         build = parsed.get("build", {})
         if conf:

cape_parsers/CAPE/core/Latrodectus.py

@@ -41,7 +41,7 @@ rule Latrodectus
         $fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01}
         $procchk1 = {E8 [3] FF 85 C0 74 [2] FF FF FF FF E9 [4] E8 [4] 89 44 24 ?? E8 [4] 83 F8 4B 73 ?? 83 [3] 06}
         $procchk2 = {72 [2] FF FF FF FF E9 [4] E8 [4] 83 F8 32 73 ?? 83 [3] 06}
-		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
+		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
     condition:
         all of them
 }
@@ -59,7 +59,7 @@ rule Latrodectus_AES
 		$key =  {C6 44 2? ?? ?? [150] C6 44 2? ?? ?? B8 02}
 		$aes_ctr_1 = {8B 44 24 ?? FF C8 89 44 24 ?? 83 7C 24 ?? 00 7C ?? 4? 63 44 24 ?? 4? 8B 4C 24 ?? 0F B6 84 01 F0 00 00 00 3D FF 00 00 00}
 		$aes_ctr_2 = {48 03 C8 48 8B C1 0F B6 ?? 48 63 4C 24 ?? 0F B6 4C 0C ?? 33 C1 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 03 D1 48 8B CA 88 01}
-		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
+		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
     condition:
         all of them
 }
@@ -152,7 +152,8 @@ def extract_config(filebuf):
                         data = instance.matched_data[::-1]
                         major = int.from_bytes(data[10:11], byteorder="big")
                         minor = int.from_bytes(data[18:19], byteorder="big")
-                        version = f"{major}.{minor}"
+                        release = int.from_bytes(data[26:27], byteorder="big")
+                        version = f"{major}.{minor}.{release}"
                     if "$key" in item.identifier:
                         key = instance.matched_data[4::5]
             try:

{cape_parsers-0.1.49.dist-info → cape_parsers-0.1.50.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: CAPE-parsers
-Version: 0.1.49
+Version: 0.1.50
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
 Keywords: cape,parsers,malware,configuration

{cape_parsers-0.1.49.dist-info → cape_parsers-0.1.50.dist-info}/RECORD

@@ -3,7 +3,7 @@ cape_parsers/CAPE/community/AgentTesla.py,sha256=rHhTmINQ0bGZEiJ5NhCKPhGobcifq3F
 cape_parsers/CAPE/community/Amadey.py,sha256=IUyt909q9IDQPPip6UW9uD16rJMD_gvkwvNZ8NHTW-k,5577
 cape_parsers/CAPE/community/Arkei.py,sha256=k36qHxdo5yPa9V1cg7EImSWP06kMog0rBda4KXqLKCY,3783
 cape_parsers/CAPE/community/AsyncRAT.py,sha256=0-FRT3d2x63KQ_cs1xmKFj7x0JRf7ID6QDc_DvBa0PM,1003
-cape_parsers/CAPE/community/AuroraStealer.py,sha256=C0j9SZDJRi107PbfYZ9G168MCyqYItrI-XK5k0Bp4tE,2632
+cape_parsers/CAPE/community/AuroraStealer.py,sha256=LRu2QFBYkGhRGDJBw3GlcKub4E0_TBWmjdR2PnobDZM,2643
 cape_parsers/CAPE/community/Carbanak.py,sha256=Smi_vTWDfWxYBQa661ZIy0624IYJA22LMHAJEQbstpk,5607
 cape_parsers/CAPE/community/CobaltStrikeBeacon.py,sha256=U4Q0ObCrPRpiO5B5fBmkgr63jXdizujNth8v6kUPnEQ,19466
 cape_parsers/CAPE/community/CobaltStrikeStager.py,sha256=HLxROBjz453uHNq1bPz0VSAhtyWDfz79ZacTPdjuWmY,7535
@@ -20,14 +20,14 @@ cape_parsers/CAPE/community/QuasarRAT.py,sha256=dzVInOc-BPVRdArk92oEY4PKq1AEW04N
 cape_parsers/CAPE/community/README.md,sha256=SHgVQraCdp033IQjM4Cm6t70U4kULn1MfSwTq3rsZv8,22
 cape_parsers/CAPE/community/Snake.py,sha256=v_MAPmg86ZdgGOkzc9GVHbi-lu4nLa1_0Lp90qiCg8s,6650
 cape_parsers/CAPE/community/SparkRAT.py,sha256=OVDty_1i9PTGuEumT0BHoDn0bD2UtdhHVNjThah80pg,2140
-cape_parsers/CAPE/community/Stealc.py,sha256=A00EEMSubZGLhgRWhL_HWDZBu-EsLWrpBv_-JR3-yZE,5302
+cape_parsers/CAPE/community/Stealc.py,sha256=18EkQ-lMMAreKV5vA9xLBmOK5B4JtYcBwVqNfof4K2A,5321
 cape_parsers/CAPE/community/VenomRAT.py,sha256=0-FRT3d2x63KQ_cs1xmKFj7x0JRf7ID6QDc_DvBa0PM,1003
 cape_parsers/CAPE/community/XWorm.py,sha256=0-FRT3d2x63KQ_cs1xmKFj7x0JRf7ID6QDc_DvBa0PM,1003
 cape_parsers/CAPE/community/XenoRAT.py,sha256=0-FRT3d2x63KQ_cs1xmKFj7x0JRf7ID6QDc_DvBa0PM,1003
 cape_parsers/CAPE/community/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cape_parsers/CAPE/community/monsterv2.py,sha256=eVEs4VIeS3PiZtRjNb69itmDq2Zkbrpn5k3M68GujiI,2995
 cape_parsers/CAPE/core/AdaptixBeacon.py,sha256=40wMfrXt-7UG30WsLC5GxUtG6tSUaaP1OT-ntWzPZn0,2956
-cape_parsers/CAPE/core/AuraStealer.py,sha256=6mbS1MNsaULpTAlh2vNeZPQy6faYm8BMu0OQh5Vb0eI,2702
+cape_parsers/CAPE/core/AuraStealer.py,sha256=RSiclflsvcrcNLHpRokc_qF2cdQKXGBKg8Ti-Q-XmaM,3021
 cape_parsers/CAPE/core/Azorult.py,sha256=YkMIhC6zRTxEkLVMUdr2MMsbV9iAnZ8hUS8be9GZ5N4,2150
 cape_parsers/CAPE/core/BitPaymer.py,sha256=HQwoE0o7HMiXItxE08vBenf2ZWMxZp84-Hf_1eZ8QdE,3050
 cape_parsers/CAPE/core/BlackDropper.py,sha256=sCSu2T5oPvcFHlSAzSsLj_gCv2Tldl0UPguwy0MVg6A,3282
@@ -41,7 +41,7 @@ cape_parsers/CAPE/core/Formbook.py,sha256=rvf0BRuRl_v8K9SJuSSfbVVMWLSTEemIgP3NtP
 cape_parsers/CAPE/core/GuLoader.py,sha256=wH6t1e7rO60Bwe0ulqFdZq12-M087zT5WQtC_Wn2biU,354
 cape_parsers/CAPE/core/IcedID.py,sha256=TEsvFq8qHz_D5kIURKWSC4lbvWaQbMriDZ3jQsVu2VA,4029
 cape_parsers/CAPE/core/IcedIDLoader.py,sha256=YUOEILpTycO01KK4qqAxGSplsRVs2EzjscUw4T-DGWs,1602
-cape_parsers/CAPE/core/Latrodectus.py,sha256=j7qq_R2fB9ls3jnm1zwWe-md29QONZN71I2MAQ0T0h4,7614
+cape_parsers/CAPE/core/Latrodectus.py,sha256=1K9yUUYtzRJ2c3unrYIUaA8nE--Zoqi5pjXY7t7t1qg,7751
 cape_parsers/CAPE/core/Oyster.py,sha256=QStBScevJuLyd5d4Rw093SxTlbRG1LFkDwYgmjZx-EQ,4881
 cape_parsers/CAPE/core/PikaBot.py,sha256=6Q8goXfMsSoU8UkdE9iuZY2KTxX_AmWhH1szke_HfWA,5280
 cape_parsers/CAPE/core/PlugX.py,sha256=lGwr1T3mttG6CTbZCj_Cf5HnOad60A3LP264jlCsGsc,13192
@@ -108,7 +108,7 @@ cape_parsers/utils/blzpack_lib.so,sha256=5PJtnggw8fV5q4DlhwMJk4ZadvC3fFTsVTNZKvE
 cape_parsers/utils/dotnet_utils.py,sha256=pzQGbCqccz7DRv8T_i1JURlrKDIlDT2axxViiFF9hsU,1672
 cape_parsers/utils/lznt1.py,sha256=X-BmJtP6AwYSl0ORg5dfSt-NIuXbHrtCO5kUaaJI2C8,4066
 cape_parsers/utils/strings.py,sha256=a-nbvP9jYST7b6t_H37Ype-fK2jEmQr-wMF5a4i04e4,3062
-cape_parsers-0.1.49.dist-info/LICENSE,sha256=88c01_HLG8WPj7R7aU_b-O-UoF38vrrifvcko4KDxcE,1069
-cape_parsers-0.1.49.dist-info/METADATA,sha256=JiiD9noZxpf8bqsPWQRJ2siYMcHkqo6VrpkwYD2r3MU,1753
-cape_parsers-0.1.49.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
-cape_parsers-0.1.49.dist-info/RECORD,,
+cape_parsers-0.1.50.dist-info/LICENSE,sha256=88c01_HLG8WPj7R7aU_b-O-UoF38vrrifvcko4KDxcE,1069
+cape_parsers-0.1.50.dist-info/METADATA,sha256=YGNfid-gqksdDmXIK8SiFMi3lSJ-66va-mpHEUBA7uQ,1753
+cape_parsers-0.1.50.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+cape_parsers-0.1.50.dist-info/RECORD,,