CAPE-parsers 0.1.54__tar.gz → 0.1.56__tar.gz

{cape_parsers-0.1.54 → cape_parsers-0.1.56}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: CAPE-parsers
-Version: 0.1.54
+Version: 0.1.56
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
 License-File: LICENSE

cape_parsers-0.1.56/cape_parsers/CAPE/community/Amatera.py

@@ -0,0 +1,186 @@
+import base64
+import json
+import pefile
+import yara
+import struct
+import re
+import ipaddress
+from contextlib import suppress
+
+
+DESCRIPTION = "Amatera Stealer parser"
+AUTHOR = "YungBinary"
+
+RULE_SOURCE = """
+rule AmateraDecrypt
+{
+    meta:
+        author = "YungBinary"
+        description = "Find Amatera XOR key"
+    strings:
+        $decrypt = {
+            A1 ?? ?? ?? ??                  // mov     eax, dword ptr ds:szXorKey ; "852149723"
+            89 45 ??                        // mov     dword ptr [ebp+xor_key], eax
+            8B 0D ?? ?? ?? ??               // mov     ecx, dword ptr ds:szXorKey+4 ; "49723"
+            89 4D ??                        // mov     dword ptr [ebp+xor_key+4], ecx
+            66 8B 15 ?? ?? ?? ??            // mov     dx, word ptr ds:szXorKey+8 ; "3"
+            66 89 55 ??                     // mov     word ptr [ebp+xor_key+8], dx
+            8D 45 ??                        // lea     eax, [ebp+xor_key]
+            50                              // push    eax
+            E8                              // call
+        }
+    condition:
+        uint16(0) == 0x5A4D and $decrypt
+}
+"""
+
+
+RULE_SOURCE_AES_KEY = """
+rule AmateraAESKey
+{
+    meta:
+        author = "YungBinary"
+        description = "Find Amatera AES key"
+    strings:
+        $aes_key_on_stack = {
+            83 EC 2C                        // sub     esp, 2Ch
+            C6 45 D4 ??                     // mov     byte ptr [ebp-2Ch], ??
+            C6 45 D5 ??                     // mov     byte ptr [ebp-2Bh], ??
+            C6 45 D6 ??                     // mov     byte ptr [ebp-2Ah], ??
+            C6 45 D7 ??                     // mov     byte ptr [ebp-29h], ??
+            C6 45 D8 ??                     // mov     byte ptr [ebp-28h], ??
+            C6 45 D9 ??                     // mov     byte ptr [ebp-27h], ??
+            C6 45 DA ??                     // mov     byte ptr [ebp-26h], ??
+            C6 45 DB ??                     // mov     byte ptr [ebp-25h], ??
+            C6 45 DC ??                     // mov     byte ptr [ebp-24h], ??
+            C6 45 DD ??                     // mov     byte ptr [ebp-23h], ??
+            C6 45 DE ??                     // mov     byte ptr [ebp-22h], ??
+            C6 45 DF ??                     // mov     byte ptr [ebp-21h], ??
+            C6 45 E0 ??                     // mov     byte ptr [ebp-20h], ??
+            C6 45 E1 ??                     // mov     byte ptr [ebp-1Fh], ??
+            C6 45 E2 ??                     // mov     byte ptr [ebp-1Eh], ??
+            C6 45 E3 ??                     // mov     byte ptr [ebp-1Dh], ??
+            C6 45 E4 ??                     // mov     byte ptr [ebp-1Ch], ??
+            C6 45 E5 ??                     // mov     byte ptr [ebp-1Bh], ??
+            C6 45 E6 ??                     // mov     byte ptr [ebp-1Ah], ??
+            C6 45 E7 ??                     // mov     byte ptr [ebp-19h], ??
+            C6 45 E8 ??                     // mov     byte ptr [ebp-18h], ??
+            C6 45 E9 ??                     // mov     byte ptr [ebp-17h], ??
+            C6 45 EA ??                     // mov     byte ptr [ebp-16h], ??
+            C6 45 EB ??                     // mov     byte ptr [ebp-15h], ??
+            C6 45 EC ??                     // mov     byte ptr [ebp-14h], ??
+            C6 45 ED ??                     // mov     byte ptr [ebp-13h], ??
+            C6 45 EE ??                     // mov     byte ptr [ebp-12h], ??
+            C6 45 EF ??                     // mov     byte ptr [ebp-11h], ??
+            C6 45 F0 ??                     // mov     byte ptr [ebp-10h], ??
+            C6 45 F1 ??                     // mov     byte ptr [ebp-0Fh], ??
+            C6 45 F2 ??                     // mov     byte ptr [ebp-0Eh], ??
+            C6 45 F3 ??                     // mov     byte ptr [ebp-0Dh], ??
+            C7 45 F4 10 00 00 00            // mov     dword ptr [ebp-0Ch], 10h
+        }
+    condition:
+        uint16(0) == 0x5A4D and $aes_key_on_stack
+}
+"""
+
+DOMAIN_REGEX = r'^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$'
+
+
+def yara_scan(raw_data: bytes, rule_source: str):
+    yara_rules = yara.compile(source=rule_source)
+    matches = yara_rules.match(data=raw_data)
+
+    for match in matches:
+        for block in match.strings:
+            for instance in block.instances:
+                return instance.offset
+
+
+def extract_base64_strings(data: bytes, minchars: int, maxchars: int):
+    """
+    Generator that returns ASCII formatted base64 strings
+    """
+    apat = b"([A-Za-z0-9+/=]{" + str(minchars).encode() + b"," + str(maxchars).encode() + b"})\x00"
+    for s in re.findall(apat, data):
+        yield s.decode()
+
+
+def xor_data(data, key):
+    decoded = bytearray()
+    for i in range(len(data)):
+        decoded.append(key[i % len(key)] ^ data[i])
+    return decoded
+
+
+def is_public_ip(ip):
+    try:
+        # This will raise a ValueError if the IP format is incorrect
+        ip_obj = ipaddress.ip_address(ip.decode())
+        if ip_obj.is_private:
+            return False
+        return True
+    except Exception:
+        return False
+
+
+def is_valid_domain(data):
+    try:
+        if re.fullmatch(DOMAIN_REGEX, data.decode()):
+            return True
+        return False
+    except Exception:
+        return False
+
+
+def extract_config(data):
+    """
+    Extract Amatera malware configuration.
+    """
+    config_dict = {}
+
+    with suppress(Exception):
+        pe = pefile.PE(data=data)
+        image_base = pe.OPTIONAL_HEADER.ImageBase
+
+        # Identify XOR key decryption routine and extract key
+        offset = yara_scan(data, RULE_SOURCE)
+        if not offset:
+            return config_dict
+        key_str_va = struct.unpack('i', data[offset + 1: offset + 5])[0]
+        key_str = pe.get_string_at_rva(key_str_va - image_base, max_length=20) + b'\x00'
+
+        # Extract AES 256 key
+        aes_key_offset = yara_scan(data, RULE_SOURCE_AES_KEY)
+        aes_key = bytearray()
+        if aes_key_offset:
+            aes_block = data[aes_key_offset : aes_key_offset + 131]
+            for i in range(0, len(aes_block) - 4, 4):
+                aes_key.append(aes_block[i+6])
+
+        # Handle each base64 string -> decode -> decrypt with XOR key
+        for b64_str in extract_base64_strings(data, 8, 20):
+            try:
+                decoded = base64.b64decode(b64_str, validate=True)
+                decrypted = xor_data(decoded, key_str)
+                if not is_public_ip(decrypted) and not is_valid_domain(decrypted):
+                    continue
+
+                config_dict["CNCs"] = [f"https://{decrypted.decode()}"]
+
+                if aes_key:
+                    config_dict["cryptokey"] = aes_key.hex()
+                    config_dict["cryptokey_type"] = "AES"
+
+                return config_dict
+            except Exception:
+                continue
+
+    return config_dict
+
+
+if __name__ == "__main__":
+    import sys
+
+    with open(sys.argv[1], "rb") as f:
+        config_json = json.dumps(extract_config(f.read()), indent=4)
+        print(config_json)

{cape_parsers-0.1.54 → cape_parsers-0.1.56}/cape_parsers/CAPE/community/KoiLoader.py

@@ -118,8 +118,9 @@ def extract_config(data):
 
         encoded_payload = remove_nulls(encoded_payload, encoded_payload_size)
         decoded_payload = xor_data(encoded_payload, xor_key)
-
-        config["CNCs"] = find_c2(decoded_payload)
+        cncs = find_c2(decoded_payload)
+        if cncs:
+            config["CNCs"] = cncs
 
     return config
 

{cape_parsers-0.1.54 → cape_parsers-0.1.56}/cape_parsers/CAPE/community/Lumma.py

@@ -5,7 +5,7 @@ import struct
 from contextlib import suppress
 import pefile
 import yara
-from Cryptodome.Cipher import ChaCha20
+
 
 RULE_SOURCE_BUILD_ID = """rule LummaBuildId
 {
@@ -142,7 +142,7 @@ def contains_non_printable(byte_array):
             return True
     return False
 
-"""
+
 def mask32(x):
     return x & 0xFFFFFFFF
 
@@ -242,7 +242,7 @@ def chacha20_xor(message, key, nonce, counter):
         xor_key.append(message[i] ^ key_stream[i])
 
     return xor_key
-"""
+
 
 def extract_c2_domain(data):
     pattern = rb"([\w-]+\.[\w]+)\x00"
@@ -315,9 +315,7 @@ def extract_config(data):
             counter = 2
             for i in range(12):
                 encrypted_string = data[encrypted_strings_offset : encrypted_strings_offset + 40]
-                chacha20_cipher = ChaCha20.new(key=key, nonce=nonce)
-                chacha20_cipher.seek(counter)
-                decoded_c2 = chacha20_cipher.decrypt(encrypted_string).split(b"\x00", 1)[0]
+                decoded_c2 = chacha20_xor(encrypted_string, key, nonce, counter).split(b"\x00", 1)[0]
                 if contains_non_printable(decoded_c2):
                     break
                 config.setdefault("CNCs", []).append("https://" + decoded_c2.decode())
@@ -350,10 +348,7 @@ def extract_config(data):
                     c2_encrypted = data[c2_dword_offset : c2_dword_offset + 0x80]
                     counters = [0, 2, 4, 6, 8, 10, 12, 14, 16]
                     for counter in counters:
-                        # decrypted = chacha20_xor(c2_encrypted, key, nonce, counter)
-                        chacha20_cipher = ChaCha20.new(key=key, nonce=nonce)
-                        chacha20_cipher.seek(counter)
-                        decrypted = chacha20_cipher.decrypt(c2_encrypted).split(b"\x00", 1)[0]
+                        decrypted = chacha20_xor(c2_encrypted, key, nonce, counter)
                         c2 = extract_c2_domain(decrypted)
                         if c2 is not None and len(c2) > 10:
                             config["CNCs"].append("https://" + c2.decode())

{cape_parsers-0.1.54 → cape_parsers-0.1.56}/cape_parsers/CAPE/core/NitroBunnyDownloader.py

@@ -32,14 +32,15 @@ rule NitroBunnyDownloader
         cape_type = "NitroBunnyDownloader Payload"
         hash = "960e59200ec0a4b5fb3b44e6da763f5fec4092997975140797d4eec491de411b"
     strings:
-        $config = {E8 [3] 00 41 B8 ?? ?? 00 00 48 8D 15 [3] 00 48 89 C1 48 89 ?? E8 [3] 00}
+        $config1 = {E8 [3] 00 41 B8 ?? ?? 00 00 48 8D 15 [3] 00 48 89 C1 48 89 ?? E8 [3] 00}
+        $config2 = {E8 [3] 00 48 8D 15 [3] 00 41 B8 ?? ?? 00 00 48 89 C1 48 89 ?? E8 [3] 00}
         $string1 = "X-Amz-User-Agent:" wide
         $string2 = "Amz-Security-Flag:" wide
         $string3 = "/cart" wide
         $string4 = "Cookie: " wide
         $string5 = "wishlist" wide
     condition:
-        uint16(0) == 0x5A4D and $config and 2 of ($string*)
+        uint16(0) == 0x5A4D and 1 of ($config*) and 2 of ($string*)
 }
 """
 
@@ -93,25 +94,41 @@ def extract_config(filebuf):
 
     cfg = {}
     config_code_offset = None
+    config_size_offset = None
+    config_offset = None
+    rva_offset = None
+
     for hit in yara_hit:
         if hit.rule != "NitroBunnyDownloader":
             continue
 
         for item in hit.strings:
             for instance in item.instances:
-                if "$config" in item.identifier:
+                if item.identifier == "$config1":
+                    config_code_offset = instance.offset
+                    config_size_offset = 7
+                    config_offset= 14
+                    rva_offset = 18
+                    break
+                elif item.identifier == "$config2":
                     config_code_offset = instance.offset
+                    config_size_offset = 14
+                    config_offset= 8
+                    rva_offset = 12
                     break
 
+            if config_code_offset:
+                break
+
     if config_code_offset is None:
         return None
 
     try:
         pe = pefile.PE(data=filebuf, fast_load=True)
-        config_length = pe.get_dword_from_offset(config_code_offset + 7)
-        config_offset = pe.get_dword_from_offset(config_code_offset + 14)
-        rva = pe.get_rva_from_offset(config_code_offset + 18)
-        config_rva = rva + config_offset
+        config_length = pe.get_dword_from_offset(config_code_offset + config_size_offset)
+        config = pe.get_dword_from_offset(config_code_offset + config_offset)
+        rva = pe.get_rva_from_offset(config_code_offset + rva_offset)
+        config_rva = rva + config
         data = pe.get_data(config_rva, config_length)
         off = 0
         raw = cfg["raw"] = {}

{cape_parsers-0.1.54 → cape_parsers-0.1.56}/cape_parsers/CAPE/core/Rhadamanthys.py

@@ -7,6 +7,15 @@ import json
 DESCRIPTION = "Rhadamanthys parser"
 AUTHOR = "kevoreilly, YungBinary"
 
+CUSTOM_ALPHABETS = [
+    b"3Fijkbc|l4NOPQRSTUVWXY567DdewxEqrstuvyz-ABC1fghop2mnGHIJKLMZ089a", # 0.9.3
+    b"4NOPQRSTUVWXY567DdeEqrstuvwxyz-ABC1fghop23Fijkbc|lmnGHIJKLMZ089a", # 0.9.2
+    b"ABC1fghijklmnop234NOPQRSTUVWXY567DEFGHIJKLMZ089abcdeqrstuvwxyz-|", # 0.9.X
+]
+
+CHACHA_KEY = b"\x52\xAB\xDF\x06\xB6\xB1\x3A\xC0\xDA\x2D\x22\xDC\x6C\xD2\xBE\x6C\x20\x17\x69\xE0\x12\xB5\xE6\xEC\x0E\xAB\x4C\x14\x73\x4A\xED\x51"
+CHACHA_NONCE = b"\x5F\x14\xD7\x9C\xFC\xFC\x43\x9E\xC3\x40\x6B\xBA"
+
 
 def mask32(x):
     return x & 0xFFFFFFFF
@@ -240,76 +249,71 @@ def parse_compression_header(config: bytes):
     }
 
 
+def handle_encrypted_string(encrypted_string: str) -> list:
+    """
+    Args:
+        encrypted_string: a str representing
+    Returns:
+        Command and Control server list, may be empty
+    """
+
+    for alphabet in CUSTOM_ALPHABETS:
+        try:
+            custom_b64_decoded = custom_b64decode(encrypted_string, alphabet)
+            xor_key = chacha20_xor(custom_b64_decoded, CHACHA_KEY, CHACHA_NONCE)
+            # Decrypted, may still be the compressed malware configuration
+            config = decrypt_config(xor_key)
+
+            # First byte should be 0xFF
+            if config[0] != 0xFF:
+                continue
+
+            # Attempt to extract C2 url, only works in version prior to 0.9.2
+            c2_url = extract_c2_url(config)
+            if c2_url:
+                return [c2_url]
+
+            # Parse header
+            parsed = parse_compression_header(config)
+            if not parsed:
+                continue
+
+            # Decompress LZO-like compression
+            decompressed = lzo_noheader_decompress(parsed['compressed_data'], parsed['decompressed_size'])
+            pattern = re.compile(b'.' + bytes([decompressed[1]]))
+
+            cncs = [f"https://{chunk.decode()}" for chunk in pattern.split(decompressed) if chunk]
+            return cncs
+        except Exception:
+            continue
+
+    return []
+
+
 def extract_config(data):
+    """
+    Extract Rhadamanthys malware configuration.
+    """
     config_dict = {}
+    # Extract very old variant
     magic = struct.unpack("I", data[:4])[0]
     if magic == 0x59485221:
         config_dict["CNCs"] = [data[24:].split(b"\0", 1)[0].decode()]
         return config_dict
-    else:
-        key = b"\x52\xAB\xDF\x06\xB6\xB1\x3A\xC0\xDA\x2D\x22\xDC\x6C\xD2\xBE\x6C\x20\x17\x69\xE0\x12\xB5\xE6\xEC\x0E\xAB\x4C\x14\x73\x4A\xED\x51"
-        nonce = b"\x5F\x14\xD7\x9C\xFC\xFC\x43\x9E\xC3\x40\x6B\xBA"
-
-        custom_alphabets = [
-            b"ABC1fghijklmnop234NOPQRSTUVWXY567DEFGHIJKLMZ089abcdeqrstuvwxyz-|",
-            b"4NOPQRSTUVWXY567DdeEqrstuvwxyz-ABC1fghop23Fijkbc|lmnGHIJKLMZ089a", # 0.9.2
-            b"3Fijkbc|l4NOPQRSTUVWXY567DdewxEqrstuvyz-ABC1fghop2mnGHIJKLMZ089a", # 0.9.3
-        ]
-
-        # Extract base64 strings
-        extracted_strings = extract_base64_strings(data, 100, 256)
-        if not extracted_strings:
-            return config_dict
-
-        pattern = re.compile(b'.\x80')
-        for string in extracted_strings:
-            try:
-                custom_b64_decoded = custom_b64decode(string, custom_alphabets[0])
-
-                xor_key = chacha20_xor(custom_b64_decoded, key, nonce)
-
-                # Decrypted, but may still be the compressed malware configuration
-                config = decrypt_config(xor_key)
-                # Attempt to extract C2 url, only works in version prior to 0.9.2
-                c2_url = extract_c2_url(config)
-                if c2_url:
-                    config_dict = {"CNCs": [c2_url]}
-                    return config_dict
-                else:
-                    # Handle new variants that compress the Command and Control server(s)
-                    custom_b64_decoded = custom_b64decode(string, custom_alphabets[2])
-                    xor_key = chacha20_xor(custom_b64_decoded, key, nonce)
-                    config = decrypt_config(xor_key)
-
-                    parsed = parse_compression_header(config)
-                    if not parsed:
-                        return config_dict
-
-                    decompressed = lzo_noheader_decompress(parsed['compressed_data'], parsed['decompressed_size'])
-
-                    # Try old alphabet for 0.9.2
-                    if not decompressed:
-                        custom_b64_decoded = custom_b64decode(string, custom_alphabets[1])
-                        xor_key = chacha20_xor(custom_b64_decoded, key, nonce)
-                        config = decrypt_config(xor_key)
-
-                        parsed = parse_compression_header(config)
-                        if not parsed:
-                            return config_dict
-
-                        decompressed = lzo_noheader_decompress(parsed['compressed_data'], parsed['decompressed_size'])
-
-
-                    cncs = [f"https://{chunk.decode()}" for chunk in pattern.split(decompressed) if chunk]
-                    if cncs:
-                        config_dict = {"CNCs": cncs}
-                        return config_dict
-
-            except Exception:
-                continue
 
+    # New variants, extract base64 strings
+    extracted_strings = extract_base64_strings(data, 100, 256)
+    if not extracted_strings:
         return config_dict
 
+    # Handle each encrypted string
+    for string in extracted_strings:
+        cncs = handle_encrypted_string(string)
+        if cncs:
+            return {"CNCs": cncs}
+
+    return config_dict
+
 
 if __name__ == "__main__":
     import sys

{cape_parsers-0.1.54 → cape_parsers-0.1.56}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "CAPE-parsers"
-version = "0.1.54"
+version = "0.1.56"
 description = "CAPE: Malware Configuration Extraction"
 authors = ["Kevin O'Reilly <kev@capesandbox.com>", "doomedraven <doomedraven@capesandbox.com>"]
 license = "MIT"