CAPE-parsers 0.1.50__tar.gz → 0.1.51__tar.gz

{cape_parsers-0.1.50 → cape_parsers-0.1.51}/PKG-INFO

@@ -1,8 +1,9 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: CAPE-parsers
-Version: 0.1.50
+Version: 0.1.51
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
+License-File: LICENSE
 Keywords: cape,parsers,malware,configuration
 Author: Kevin O'Reilly
 Author-email: kev@capesandbox.com
@@ -13,6 +14,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Provides-Extra: maco
 Requires-Dist: capstone (>=4.0.2)
 Requires-Dist: dncil (>=1.0.2)

{cape_parsers-0.1.50 → cape_parsers-0.1.51}/cape_parsers/CAPE/community/AgentTesla.py

@@ -9,6 +9,7 @@ except ImportError as e:
 def extract_config(data: bytes):
     config = {}
     config_dict = {}
+    is_c2_found = False
     with suppress(Exception):
         if data[:2] == b"MZ":
             lines = extract_strings(data=data, on_demand=True, minchars=3)
@@ -25,11 +26,13 @@ def extract_config(data: bytes):
                 config_dict["Protocol"] = "Telegram"
                 config["CNCs"] = lines[base + x]
                 config_dict["Password"] = lines[base + x + 1]
+                is_c2_found = True
                 break
             # Data Exfiltration via Discord
             elif "discord" in lines[base + x]:
                 config_dict["Protocol"] = "Discord"
                 config["CNCs"] = [lines[base + x]]
+                is_c2_found = True
                 break
             # Data Exfiltration via FTP
             elif "ftp:" in lines[base + x]:
@@ -38,6 +41,7 @@ def extract_config(data: bytes):
                 username = lines[base + x + 1]
                 password = lines[base + x + 2]
                 config["CNCs"] = [f"ftp://{username}:{password}@{hostname}"]
+                is_c2_found = True
                 break
             # Data Exfiltration via SMTP
             elif "@" in lines[base + x]:
@@ -52,10 +56,12 @@ def extract_config(data: bytes):
                 config_dict["Password"] = lines[base + x + 1]
                 if "@" in lines[base + x + 2]:
                     config_dict["EmailTo"] = lines[base + x + 2]
+                is_c2_found = True
                 break
         # Get Persistence Payload Filename
         for x in range(2, 22):
-            if ".exe" in lines[base + x]:
+            # Only extract Persistence Filename when a C2 is detected.
+            if ".exe" in lines[base + x] and is_c2_found:
                 config_dict["Persistence_Filename"] = lines[base + x]
                 break
         # Get External IP Check Services

{cape_parsers-0.1.50 → cape_parsers-0.1.51}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "CAPE-parsers"
-version = "0.1.50"
+version = "0.1.51"
 description = "CAPE: Malware Configuration Extraction"
 authors = ["Kevin O'Reilly <kev@capesandbox.com>", "doomedraven <doomedraven@capesandbox.com>"]
 license = "MIT"