CAPE-parsers 0.1.49__tar.gz → 0.1.50__tar.gz

{cape_parsers-0.1.49 → cape_parsers-0.1.50}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: CAPE-parsers
-Version: 0.1.49
+Version: 0.1.50
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
 Keywords: cape,parsers,malware,configuration

{cape_parsers-0.1.49 → cape_parsers-0.1.50}/cape_parsers/CAPE/community/AuroraStealer.py

@@ -32,7 +32,7 @@ def extract_config(data):
             key = item.split(":")[0].strip("{").strip('"')
             value = item.split(":")[1].strip('"')
             if key == "IP":
-                config_dict["CNCs"] = [value]
+                config_dict["CNCs"] = [f"tcp://{value}"]
             elif key == "BuildID":
                 config_dict["build"] = value
             else:

{cape_parsers-0.1.49 → cape_parsers-0.1.50}/cape_parsers/CAPE/community/Stealc.py

@@ -77,7 +77,7 @@ def parse_text(data):
                 domain = line
             elif _is_ip(line):
                 domain = line
-            if line.startswith("/") and line[-4] == ".":
+            if line.startswith("/") and len(line) >= 4 and line[-4] == ".":
                 uri = line
 
 

{cape_parsers-0.1.49 → cape_parsers-0.1.50}/cape_parsers/CAPE/core/AuraStealer.py

@@ -7,6 +7,14 @@ import pefile
 from Cryptodome.Cipher import AES
 from Cryptodome.Util.Padding import unpad
 
+# Define the format for the fixed-size header part.
+# <   : little-endian
+# 32s : 32-byte string (for aes_key)
+# 16s : 16-byte string (for iv)
+# I   : 4-byte unsigned int (for dword1)
+# I   : 4-byte unsigned int (for dword2)
+HEADER_FORMAT = "<32s16sII"
+HEADER_SIZE = struct.calcsize(HEADER_FORMAT)  # This will be 32 + 16 + 4 + 4 = 56 bytes
 
 def parse_blob(data: bytes):
     """
@@ -16,15 +24,9 @@ def parse_blob(data: bytes):
       - Next 2 DWORDs (8 bytes total) = XOR to get cipher data size
       - Remaining bytes = cipher data of that size
     """
-    offset = 0
-    aes_key = data[offset:offset + 32]
-    offset += 32
-    iv = data[offset:offset + 16]
-    offset += 16
-    dword1, dword2 = struct.unpack_from("<II", data, offset)
-    cipher_size = dword1 ^ dword2
-    offset += 8
-    cipher_data = data[offset:offset + cipher_size]
+    aes_key, iv, dword1, dword2 = struct.unpack_from(HEADER_FORMAT, data, 0)
+    ciphertext_size = dword1 ^ dword2
+    cipher_data = data[HEADER_SIZE : HEADER_SIZE + ciphertext_size]
     return aes_key, iv, cipher_data
 
 
@@ -37,7 +39,8 @@ def decrypt(data: bytes) -> Tuple[bytes, bytes, bytes]:
 
 def extract_config(data: bytes) -> Dict[str, Any]:
     cfg: Dict[str, Any] = {}
-    plaintext = ""
+    plaintext = b""
+
     pe = pefile.PE(data=data, fast_load=True)
     try:
         data_section = [s for s in pe.sections if s.Name.find(b".data") != -1][0]
@@ -63,7 +66,11 @@ def extract_config(data: bytes) -> Dict[str, Any]:
         offset -= 1
 
     if plaintext:
-        parsed = json.loads(plaintext.decode("utf-8", errors="ignore").rstrip("\x00"))
+        try:
+            parsed = json.loads(plaintext.decode("utf-8", errors="ignore").rstrip("\x00"))
+        except json.JSONDecodeError:
+            return cfg
+
         conf = parsed.get("conf", {})
         build = parsed.get("build", {})
         if conf:

{cape_parsers-0.1.49 → cape_parsers-0.1.50}/cape_parsers/CAPE/core/Latrodectus.py

@@ -41,7 +41,7 @@ rule Latrodectus
         $fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01}
         $procchk1 = {E8 [3] FF 85 C0 74 [2] FF FF FF FF E9 [4] E8 [4] 89 44 24 ?? E8 [4] 83 F8 4B 73 ?? 83 [3] 06}
         $procchk2 = {72 [2] FF FF FF FF E9 [4] E8 [4] 83 F8 32 73 ?? 83 [3] 06}
-		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
+		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
     condition:
         all of them
 }
@@ -59,7 +59,7 @@ rule Latrodectus_AES
 		$key =  {C6 44 2? ?? ?? [150] C6 44 2? ?? ?? B8 02}
 		$aes_ctr_1 = {8B 44 24 ?? FF C8 89 44 24 ?? 83 7C 24 ?? 00 7C ?? 4? 63 44 24 ?? 4? 8B 4C 24 ?? 0F B6 84 01 F0 00 00 00 3D FF 00 00 00}
 		$aes_ctr_2 = {48 03 C8 48 8B C1 0F B6 ?? 48 63 4C 24 ?? 0F B6 4C 0C ?? 33 C1 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 03 D1 48 8B CA 88 01}
-		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
+		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
     condition:
         all of them
 }
@@ -152,7 +152,8 @@ def extract_config(filebuf):
                         data = instance.matched_data[::-1]
                         major = int.from_bytes(data[10:11], byteorder="big")
                         minor = int.from_bytes(data[18:19], byteorder="big")
-                        version = f"{major}.{minor}"
+                        release = int.from_bytes(data[26:27], byteorder="big")
+                        version = f"{major}.{minor}.{release}"
                     if "$key" in item.identifier:
                         key = instance.matched_data[4::5]
             try:

{cape_parsers-0.1.49 → cape_parsers-0.1.50}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "CAPE-parsers"
-version = "0.1.49"
+version = "0.1.50"
 description = "CAPE: Malware Configuration Extraction"
 authors = ["Kevin O'Reilly <kev@capesandbox.com>", "doomedraven <doomedraven@capesandbox.com>"]
 license = "MIT"