CAPE-parsers 0.1.61__tar.gz → 0.1.62__tar.gz

{cape_parsers-0.1.61 → cape_parsers-0.1.62}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: CAPE-parsers
-Version: 0.1.61
+Version: 0.1.62
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
 License-File: LICENSE

{cape_parsers-0.1.61 → cape_parsers-0.1.62}/cape_parsers/CAPE/community/AsyncRAT.py

@@ -27,5 +27,6 @@ def extract_config(data: bytes):
 
 
 if __name__ == "__main__":
-    data = open(sys.argv[1], "rb").read()
+    with open(sys.argv[1], "rb") as f:
+        data = f.read()
     print(extract_config(data))

{cape_parsers-0.1.61 → cape_parsers-0.1.62}/cape_parsers/CAPE/community/DCRat.py

@@ -27,5 +27,6 @@ def extract_config(data: bytes):
 
 
 if __name__ == "__main__":
-    data = open(sys.argv[1], "rb").read()
+    with open(sys.argv[1], "rb") as f:
+        data = f.read()
     print(extract_config(data))

{cape_parsers-0.1.61 → cape_parsers-0.1.62}/cape_parsers/CAPE/community/LokiBot.py

@@ -151,7 +151,7 @@ def decoder(data):
                 temp = unpad(temp, 8)
                 if not temp.endswith(b".php"):
                     continue
-                urls.append("http://" + temp.decod())
+                urls.append("http://" + temp.decode())
     return urls
 
 

{cape_parsers-0.1.61 → cape_parsers-0.1.62}/cape_parsers/CAPE/community/Stealc.py

@@ -150,6 +150,9 @@ def extract_config(data):
     if botnet_id:
         config_dict.setdefault("botnet", botnet_id)
 
+    if "CNCs" not in config_dict:
+        return {}
+    
     return config_dict
 
 

{cape_parsers-0.1.61 → cape_parsers-0.1.62}/cape_parsers/CAPE/community/VenomRAT.py

@@ -27,5 +27,6 @@ def extract_config(data: bytes):
 
 
 if __name__ == "__main__":
-    data = open(sys.argv[1], "rb").read()
+    with open(sys.argv[1], "rb") as f:
+        data = f.read()
     print(extract_config(data))

{cape_parsers-0.1.61 → cape_parsers-0.1.62}/cape_parsers/CAPE/community/XWorm.py

@@ -27,5 +27,6 @@ def extract_config(data: bytes):
 
 
 if __name__ == "__main__":
-    data = open(sys.argv[1], "rb").read()
+    with open(sys.argv[1], "rb") as f:
+        data = f.read()
     print(extract_config(data))

{cape_parsers-0.1.61 → cape_parsers-0.1.62}/cape_parsers/CAPE/community/XenoRAT.py

@@ -27,5 +27,6 @@ def extract_config(data: bytes):
 
 
 if __name__ == "__main__":
-    data = open(sys.argv[1], "rb").read()
+    with open(sys.argv[1], "rb") as f:
+        data = f.read()
     print(extract_config(data))

{cape_parsers-0.1.61 → cape_parsers-0.1.62}/cape_parsers/CAPE/core/BumbleBee.py

@@ -254,4 +254,5 @@ def extract_config(data):
 if __name__ == "__main__":
     import sys
 
-    print(extract_config(open(sys.argv[1], "rb").read()))
+    with open(sys.argv[1], "rb") as f:
+        print(extract_config(f.read()))

cape_parsers-0.1.62/cape_parsers/CAPE/core/HijackLoader.py

@@ -0,0 +1,39 @@
+from contextlib import suppress
+
+try:
+    from cape_parsers.utils.strings import extract_strings
+except ImportError as e:
+    print(f"Problem importing extract_strings: {e}")
+
+import logging
+log = logging.getLogger(__name__)
+
+
+def extract_config(data: bytes):
+    config = {}
+
+    with suppress(Exception):
+        if data[:2] == b"MZ":
+            return
+
+        header_data = data[:1024]
+        lines = extract_strings(data=header_data, minchars=3, dedup=False)
+
+        if len(lines) < 4:
+            return None
+
+        if '\\' in lines[2]:
+            config.setdefault("raw", {})["directory"] = (lines[1].strip() + '\\' + lines[0].strip()).replace('  ', ' ')
+            config.setdefault("raw", {})["inject_dll"] = lines[2].strip()
+        if '.exe' in lines[3]:
+            config.setdefault("raw", {})["exe_name"] = lines[3].strip()
+
+        if config:
+            config.setdefault("raw", config)
+            return config
+
+if __name__ == "__main__":
+    import sys
+
+    with open(sys.argv[1], "rb") as f:
+        print(extract_config(f.read()))

{cape_parsers-0.1.61 → cape_parsers-0.1.62}/cape_parsers/CAPE/core/PikaBot.py

@@ -183,4 +183,5 @@ def extract_config(filebuf):
 if __name__ == "__main__":
     import sys
 
-    print(extract_config(sys.argv[1]))
+    with open(sys.argv[1], "rb") as f:
+        print(extract_config(f.read()))

{cape_parsers-0.1.61 → cape_parsers-0.1.62}/cape_parsers/CAPE/core/Remcos.py

@@ -219,4 +219,5 @@ def extract_config(filebuf):
 if __name__ == "__main__":
     import sys
 
-    print(extract_config(open(sys.argv[1], "rb").read()))
+    with open(sys.argv[1], "rb") as f:
+        print(extract_config(f.read()))

{cape_parsers-0.1.61 → cape_parsers-0.1.62}/cape_parsers/deprecated/TSCookie.py

@@ -85,7 +85,8 @@ def decode_resource(rc_data, key_end, fname):
         enc_data = rc_data[:-RC4_KEY_LENGTH]
         rc4key = rc_data[-RC4_KEY_LENGTH:-4] + key_end
         dec_data = rc4(enc_data, rc4key)
-        open(fname, "wb").write(dec_data)
+        with open(fname, "wb") as f:
+            f.write(dec_data.encode("utf-8") if isinstance(dec_data, str) else dec_data)
     except Exception:
         return
     return dec_data

{cape_parsers-0.1.61 → cape_parsers-0.1.62}/cape_parsers/utils/strings.py

@@ -1,18 +1,10 @@
 # Copyright (C) 2010-2015 Cuckoo Foundation, Optiv, Inc. (brad.spengler@optiv.com)
 # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
 # See the file 'docs/LICENSE' for copying permission.
+import yara
 import logging
 from pathlib import Path
 
-try:
-    import re2 as re
-
-    HAVE_RE2 = True
-except ImportError:
-    import re
-
-    HAVE_RE2 = False
-
 
 log = logging.getLogger(__name__)
 
@@ -66,41 +58,86 @@ def bytes2str(convert):
     return convert
 
 
-def extract_strings(filepath: str = False, data: bytes = False, on_demand: bool = False, dedup: bool = False, minchars: int = 0):
-    """Extract strings from analyzed file.
-    @return: list of printable strings.
-    """
+def extract_strings(filepath: str = False, data: bytes = False, dedup: bool = False, minchars: int = 5):
+    """Extract ASCII and UTF-16LE strings from a file or byte string using YARA.
 
-    nulltermonly = False
+    Args:
+        filepath: Path to the file to extract strings from.
+        data: Byte string to extract strings from. If filepath is provided, this is ignored.
+        dedup: If True, duplicate strings are removed.
+        minchars: Minimum length of strings to extract.
+
+    Returns:
+        A list of extracted strings.
+    """
     if minchars == 0:
         minchars = 5
 
     if filepath:
         p = Path(filepath)
         if not p.exists():
-            log.error("Sample file doesn't exist: %s", filepath)
-            return
-        try:
-            data = p.read_bytes()
-        except (IOError, OSError) as e:
-            log.error("Error reading file: %s", e)
-            return
+            return []
+        data = p.read_bytes()
+
+    if not data or not isinstance(data, bytes):
+        return []
+
+    rule_source = r"""
+    rule GetStrings {
+        strings:
+            $s = /[\x20-\x7e]{""" + str(int(minchars)) + r""",}/ ascii wide
+        condition:
+            $s
+    }
+    """
 
-    if not data:
-        return
+    try:
+        rule = yara.compile(source=rule_source)
+        matches = rule.match(data=data)
+    except yara.Error:
+        return []
 
-    endlimit = b"8192" if not HAVE_RE2 else b""
-    if nulltermonly:
-        apat = b"([\x20-\x7e]{" + str(minchars).encode() + b"," + endlimit + b"})\x00"
-        upat = b"((?:[\x20-\x7e][\x00]){" + str(minchars).encode() + b"," + endlimit + b"})\x00\x00"
-    else:
-        apat = b"[\x20-\x7e]{" + str(minchars).encode() + b"," + endlimit + b"}"
-        upat = b"(?:[\x20-\x7e][\x00]){" + str(minchars).encode() + b"," + endlimit + b"}"
+    all_instances = [
+        {
+            'offset': instance.offset,
+            'data': instance.matched_data,
+            'length': len(instance.matched_data),
+        }
+        for match in matches
+        for string_match in match.strings
+        for instance in string_match.instances
+    ]
 
-    strings = [bytes2str(string) for string in re.findall(apat, data)]
-    strings.extend(str(ws.decode("utf-16le")) for ws in re.findall(upat, data))
+    all_instances.sort(key=lambda x: x['offset'])
+
+    strings = []
+    last_end_offset = -1
+
+    for inst in all_instances:
+        current_start = inst['offset']
+        current_end = current_start + inst['length']
+
+        if current_start < last_end_offset:
+            continue
+
+        val = inst['data']
+        decoded = None
+
+        if b"\x00" in val:
+            try:
+                decoded = val.decode("utf-16le")
+            except UnicodeDecodeError:
+                pass
+
+        if not decoded:
+            decoded = val.decode("ascii", errors="ignore")
+
+        if decoded:
+            strings.append(decoded)
+            last_end_offset = current_end
 
     if dedup:
         strings = list(set(strings))
 
     return strings
+

{cape_parsers-0.1.61 → cape_parsers-0.1.62}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "CAPE-parsers"
-version = "0.1.61"
+version = "0.1.62"
 description = "CAPE: Malware Configuration Extraction"
 authors = ["Kevin O'Reilly <kev@capesandbox.com>", "doomedraven <doomedraven@capesandbox.com>"]
 license = "MIT"