assemblyline 4.7.5.dev146__tar.gz → 4.7.5.dev150__tar.gz

{assemblyline-4.7.5.dev146/assemblyline.egg-info → assemblyline-4.7.5.dev150}/PKG-INFO

@@ -1,20 +1,19 @@
 Metadata-Version: 2.4
 Name: assemblyline
-Version: 4.7.5.dev146
+Version: 4.7.5.dev150
 Summary: Assemblyline 4 - Automated malware analysis framework
-Home-page: https://github.com/CybercentreCanada/assemblyline-base
-Author: CCCS Assemblyline development team
-Author-email: assemblyline@cyber.gc.ca
-License: MIT
-Keywords: assemblyline automated malware analysis gc canada cse-cst cse cst cyber cccs
+Author-email: CCCS Assemblyline development team <assemblyline@cyber.gc.ca>
+License-Expression: MIT
+Project-URL: Repository, https://github.com/CybercentreCanada/assemblyline-base
+Keywords: assemblyline,automated,malware,analysis,gc,canada,cse-cst,cse,cst,cyber,cccs
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Topic :: Software Development :: Libraries
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENCE.md
 Requires-Dist: arrow
@@ -54,18 +53,7 @@ Requires-Dist: retrying; extra == "test"
 Requires-Dist: pytest-mock; extra == "test"
 Requires-Dist: pyftpdlib; extra == "test"
 Requires-Dist: pyopenssl==23.3.0; extra == "test"
-Dynamic: author
-Dynamic: author-email
-Dynamic: classifier
-Dynamic: description
-Dynamic: description-content-type
-Dynamic: home-page
-Dynamic: keywords
-Dynamic: license
 Dynamic: license-file
-Dynamic: provides-extra
-Dynamic: requires-dist
-Dynamic: summary
 
 [![Discord](https://img.shields.io/badge/chat-on%20discord-7289da.svg?sanitize=true)](https://discord.gg/GUAy9wErNu)
 [![](https://img.shields.io/discord/908084610158714900)](https://discord.gg/GUAy9wErNu)

assemblyline-4.7.5.dev150/assemblyline/VERSION

@@ -0,0 +1 @@
+4.7.5.dev150

{assemblyline-4.7.5.dev146 → assemblyline-4.7.5.dev150}/assemblyline/common/custom.yara

@@ -1272,7 +1272,7 @@ rule code_wsf {
         $ = /<script\s+?language=/
 
     condition:
-        mime startswith "text"
+        (mime startswith "text" or mime == "application/x-pem-file")
         and all of them
 }
 

{assemblyline-4.7.5.dev146 → assemblyline-4.7.5.dev150}/assemblyline/common/identify.py

@@ -392,7 +392,12 @@ class Identify:
                             return data
                     except Exception:
                         pass
-
+            elif data["mime"] == "application/x-coff":
+                # We recognize this as a COFF (Common Object File Format) executable for Linux
+                if data["magic"].startswith("Intel i386") or data["magic"].startswith("Intel 80386"):
+                    # This indicates a 32-bit COFF executable for Linux
+                    data["type"] = "executable/linux/coff32"
+                    return data
             if data["type"] == "text/plain":
                 # Check if the file is a misidentified json first before running the yara rules
                 try:
@@ -635,7 +640,7 @@ def uri_ident(path: str, info: Dict) -> str:
     return f"uri/{u.scheme}"
 
 
-if __name__ == "__main__":
+def shell_main():
     from pprint import pprint
 
     use_cache = True
@@ -682,3 +687,6 @@ if __name__ == "__main__":
                 )
             )
             name = sys.stdin.readline().strip()
+
+if __name__ == "__main__":
+    shell_main()

{assemblyline-4.7.5.dev146 → assemblyline-4.7.5.dev150}/assemblyline/common/identify_defaults.py

@@ -113,6 +113,7 @@ magic_patterns = [
     {"al_type": "executable/windows/ia/pe64", "regex": r"pe32\+?[^\|]+Intel Itanium[^\|]+windows"},
     {"al_type": "executable/windows/arm/dll64", "regex": r"pe32\+?[^\|]+dll[^\|]+Aarch64[^\|]+windows"},
     {"al_type": "executable/windows/arm/pe64", "regex": r"pe32\+?[^\|]+Aarch64[^\|]+windows"},
+    {"al_type": "executable/windows/pe64", "regex": r"pe with unknown[^\|]+windows[^\|]+x86-64"},
     {"al_type": "executable/windows/pe", "regex": r"pe unknown[^\|]+windows"},
     # Supported by https://github.com/mitre/multiscanner/blob/86e0145ba3c4a34611f257dc78cd2482ed6358db/multiscanner/modules/Metadata/fileextensions.py#L183
     # Supported by https://github.com/mitre/multiscanner/blob/86e0145ba3c4a34611f257dc78cd2482ed6358db/multiscanner/modules/Metadata/fileextensions.py#L185
@@ -131,7 +132,7 @@ magic_patterns = [
     {"al_type": "executable/linux/coff32", "regex": r"^(Intel 80386|i386|80386) COFF"},
     {"al_type": "executable/linux/coff64", "regex": r"^64-bit XCOFF"},
     {"al_type": "executable/linux/ia/coff64", "regex": r"^Intel ia64 COFF"},
-    {"al_type": "executable/linux/misp/ecoff", "regex": r"^MIPS[^\|]+ ECOFF"},
+    {"al_type": "executable/linux/mips/ecoff", "regex": r"^MIPS[^\|]+ ECOFF"},
     {"al_type": "executable/linux/a.out", "regex": r"^a.out"},
     # Supported by https://github.com/EmersonElectricCo/fsf/blob/15303aa298414397f9aa5d19ca343040a0fe0bbd/fsf-server/yara/ft_macho.yara
     {"al_type": "executable/mach-o", "regex": r"^Mach-O"},
@@ -242,6 +243,7 @@ magic_patterns = [
 ]
 
 # LibMagic mimetypes that we blindly trust to assign an Assemblyline type
+# Ref: https://www.rfc-editor.org/info/rfc6838/#section-3.2 for vendor-specific MIMEs
 trusted_mimes = {
     # Mpeg Audio
     "audio/mp2": "audio/mp2",

{assemblyline-4.7.5.dev146 → assemblyline-4.7.5.dev150}/assemblyline/common/postprocess.py

@@ -3,34 +3,16 @@ import operator
 import datetime
 import fnmatch
 import re
-import json
-import threading
 from typing import Any, Union, Optional
 import logging
-import random
-import time
-import asyncio
-import ssl
-import tempfile
-
-import yaml
-import aiohttp
 import lark
 import datemath
 import arrow
 
-from assemblyline.cachestore import CacheStore
-from assemblyline.common.uid import get_random_id
-from assemblyline.common.constants import CONFIG_HASH, POST_PROCESS_CONFIG_KEY
 from assemblyline.odm import base as odm
-from assemblyline.odm.models.actions import DEFAULT_POSTPROCESS_ACTIONS, PostprocessAction, Webhook
 from assemblyline.odm.models.submission import Submission
-from assemblyline.odm.messages.submission import Submission as SubmissionMessage, from_datastore_submission
+from assemblyline.odm.messages.submission import Submission as SubmissionMessage
 from assemblyline.odm.models.tagging import Tagging
-from assemblyline.remote.datatypes.events import EventWatcher
-from assemblyline.remote.datatypes.queues.named import NamedQueue
-from assemblyline.remote.datatypes.queues.priority import PriorityQueue
-from assemblyline.remote.datatypes.hash import Hash
 
 
 logger = logging.getLogger(__name__)
@@ -249,7 +231,9 @@ class MatchOperation(NodeInterface):
             self.regex = True
         else:
             pattern = fnmatch.translate(self.search)
-            if pattern.endswith('\\Z'):
+            # Support different case depending on Python version
+            # Ref: https://github.com/python/cpython/pull/133314
+            if pattern.endswith('\\z') or pattern.endswith('\\Z'):
                 pattern = pattern[0:-2]
             # if pattern.startswith('(?s:') and pattern.endswith(")"):
             #     pattern = pattern[4:-1]
@@ -568,5 +552,3 @@ class SubmissionFilter:
 
     def __repr__(self) -> str:
         return '<SubmissionFilter ' + str(self.expression) + '>'
-
-

{assemblyline-4.7.5.dev146 → assemblyline-4.7.5.dev150}/assemblyline/common/safe_archive.py

@@ -50,10 +50,7 @@ def safe_extract_tar(tar: Union[str, tarfile.TarFile], dest: str) -> None:
     owns = isinstance(tar, str)
     tf = tarfile.open(tar) if owns else tar
     try:
-        if hasattr(tarfile, "data_filter"):
-            tf.extractall(dest, filter="data")
-        else:
-            tf.extractall(dest, members=list(safe_tar_members(tf, dest)))
+        tf.extractall(dest, filter="data")
     finally:
         if owns:
             tf.close()

{assemblyline-4.7.5.dev146 → assemblyline-4.7.5.dev150}/assemblyline/filestore/transport/s3.py

@@ -160,7 +160,10 @@ class TransportS3(Transport):
             return 1
 
     def delete_batch(self, file_list: Iterable[str]):
-        """Deletes a batch of files."""
+        """Deletes a batch of files using the DeleteObjects API.
+
+        Reference: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjects.html
+        """
         if not self.use_batch_delete:
             return super().delete_batch(file_list)
 
@@ -175,7 +178,9 @@ class TransportS3(Transport):
                 },
             )
 
-            if response['Errors']:
+            # Check if there any errors returned as part of the response
+            if response.get('Errors'):
+                # If there are errors, we raise an exception with the first error message.
                 raise TransportException('Could not delete some member of batch', response['Errors'][0]['Message'])
 
     def exists(self, path):

{assemblyline-4.7.5.dev146 → assemblyline-4.7.5.dev150}/assemblyline/odm/randomizer.py

@@ -365,7 +365,7 @@ def random_data_for_field(field, name: str, minimal: bool = False) -> _Any:
         if '\\u00a1-\\U0010ffff' in field.validation_regex.pattern:
             value = get_random_host()
             if field.validation_regex.match(value):
-                return value        
+                return value
         # Generate value based on regex pattern
         return rstr.xeger(field.validation_regex)
     elif isinstance(field, Keyword) or isinstance(field, EmptyableKeyword):

{assemblyline-4.7.5.dev146 → assemblyline-4.7.5.dev150}/assemblyline/run/cli.py

@@ -512,7 +512,7 @@ class ALCommandLineInterface(cmd.Cmd):  # pylint:disable=R0904
 
             if cont:
                 if full and index == 'submission':
-                    pool = multiprocessing.Pool(processes=PROCESSES_COUNT, initializer=init)
+                    pool = multiprocessing.Pool(processes=min(PROCESSES_COUNT, test_data['total']), initializer=init)
                     for data in collection.stream_search(query, fl="id", item_buffer_size=COUNT_INCREMENT):
                         pool.apply_async(submission_delete_tree, (data.id, self.logger), callback=action_done)
                 else:

{assemblyline-4.7.5.dev146 → assemblyline-4.7.5.dev150/assemblyline.egg-info}/PKG-INFO

@@ -1,20 +1,19 @@
 Metadata-Version: 2.4
 Name: assemblyline
-Version: 4.7.5.dev146
+Version: 4.7.5.dev150
 Summary: Assemblyline 4 - Automated malware analysis framework
-Home-page: https://github.com/CybercentreCanada/assemblyline-base
-Author: CCCS Assemblyline development team
-Author-email: assemblyline@cyber.gc.ca
-License: MIT
-Keywords: assemblyline automated malware analysis gc canada cse-cst cse cst cyber cccs
+Author-email: CCCS Assemblyline development team <assemblyline@cyber.gc.ca>
+License-Expression: MIT
+Project-URL: Repository, https://github.com/CybercentreCanada/assemblyline-base
+Keywords: assemblyline,automated,malware,analysis,gc,canada,cse-cst,cse,cst,cyber,cccs
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Topic :: Software Development :: Libraries
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENCE.md
 Requires-Dist: arrow
@@ -54,18 +53,7 @@ Requires-Dist: retrying; extra == "test"
 Requires-Dist: pytest-mock; extra == "test"
 Requires-Dist: pyftpdlib; extra == "test"
 Requires-Dist: pyopenssl==23.3.0; extra == "test"
-Dynamic: author
-Dynamic: author-email
-Dynamic: classifier
-Dynamic: description
-Dynamic: description-content-type
-Dynamic: home-page
-Dynamic: keywords
-Dynamic: license
 Dynamic: license-file
-Dynamic: provides-extra
-Dynamic: requires-dist
-Dynamic: summary
 
 [![Discord](https://img.shields.io/badge/chat-on%20discord-7289da.svg?sanitize=true)](https://discord.gg/GUAy9wErNu)
 [![](https://img.shields.io/discord/908084610158714900)](https://discord.gg/GUAy9wErNu)

{assemblyline-4.7.5.dev146 → assemblyline-4.7.5.dev150}/assemblyline.egg-info/SOURCES.txt

@@ -2,8 +2,6 @@ LICENCE.md
 MANIFEST.in
 README.md
 pyproject.toml
-setup.cfg
-setup.py
 assemblyline/VERSION
 assemblyline/__init__.py
 assemblyline/py.typed
@@ -174,4 +172,7 @@ assemblyline/run/__init__.py
 assemblyline/run/cli.py
 assemblyline/run/pubsub_reader.py
 assemblyline/run/suricata_importer.py
-assemblyline/run/yara_importer.py
+assemblyline/run/yara_importer.py
+dev/core/config/classification.yml
+external/generate_attack_map.py
+external/generate_tlds.py

{assemblyline-4.7.5.dev146 → assemblyline-4.7.5.dev150}/assemblyline.egg-info/entry_points.txt

@@ -1,2 +1,3 @@
 [console_scripts]
 al_cli = assemblyline.run.cli:shell_main
+al_identify = assemblyline.common.identify:shell_main

assemblyline-4.7.5.dev150/assemblyline.egg-info/top_level.txt

@@ -0,0 +1,7 @@
+assemblyline
+dev
+docker
+external
+kibana
+pipelines
+test

assemblyline-4.7.5.dev150/dev/core/config/classification.yml

@@ -0,0 +1 @@
+enforce: true

assemblyline-4.7.5.dev150/external/generate_attack_map.py

@@ -0,0 +1,220 @@
+import shutil
+import subprocess
+import os
+
+from pprint import pformat
+from datetime import datetime
+
+from stix2 import FileSystemSource, CompositeDataSource, Filter
+from stix2.utils import get_type_from_id
+
+CTI_BASE = "/tmp/cti_git"
+
+
+def clone_cti(base=CTI_BASE):
+    print("Preparing CTI git repo...")
+
+    if os.path.exists(base):
+        shutil.rmtree(base)
+
+    subprocess.check_call(["git", "clone", "https://github.com/mitre/cti.git", base])
+
+
+def load_datasource(base=CTI_BASE):
+    print("Loading CTI datasources map...")
+    enterprise_attack_fs = FileSystemSource(os.path.join(base, "enterprise-attack"))
+    mobile_attack_fs = FileSystemSource(os.path.join(base, "mobile-attack"))
+
+    composite_ds = CompositeDataSource()
+    composite_ds.add_data_sources([enterprise_attack_fs, mobile_attack_fs])
+    return composite_ds
+
+
+def get_revoked_by(stix_id, thesrc):
+    relations = thesrc.relationships(stix_id, 'revoked-by', source_only=True)
+    revoked_by = thesrc.query([
+        Filter('id', 'in', [r.target_ref for r in relations]),
+        Filter('revoked', '=', False)
+    ])
+    revoke_id = None
+    if revoked_by:
+        revoked_by = revoked_by[0]
+
+        for er in revoked_by['external_references']:
+            if er['source_name'] in ["mitre-attack", "mobile-mitre-attack", "mitre-mobile-attack"]:
+                revoke_id = er['external_id']
+                break
+
+    return revoke_id
+
+
+def get_attack_map(composite_ds):
+    print("Parsing attack patterns ...")
+    att_filter = Filter('type', '=', 'attack-pattern')
+
+    attack_map = {}
+    revoke_map = {}
+
+    for item in composite_ds.query(att_filter):
+        name = item['name']
+
+        attack_id = None
+        for er in item['external_references']:
+            if er['source_name'] in ["mitre-attack", "mobile-mitre-attack", "mitre-mobile-attack"]:
+                attack_id = er['external_id']
+                break
+
+        if attack_id:
+            if not item['revoked']:
+                categories = [x['phase_name'] for x in item['kill_chain_phases']]
+                desc = item['description']
+                platforms = item['x_mitre_platforms']
+
+                attack_map[attack_id] = {
+                    "name": name,
+                    "categories": categories,
+                    "description": desc,
+                    "platforms": platforms,
+                    "attack_id": attack_id
+                }
+                print(f"\tAdding {name.upper()} as ID: {attack_id}")
+            else:
+                revoke_id = get_revoked_by(item['id'], composite_ds)
+                if revoke_id is None:
+                    print(f"\t[WARN] {name.upper()} ({attack_id}) has been revoked without being replaced.")
+                else:
+                    revoke_map[attack_id] = revoke_id
+                    print(f"\tAdding revoked {name.upper()} to the revoked map: {attack_id} => {revoke_id}")
+        else:
+            print(f"[ERR] Ignored {name.upper()}: No attack ID found.")
+
+    return attack_map, revoke_map
+
+
+def get_software_map(composite_ds):
+    print("Parsing softwares ...")
+    malware_filter = Filter('type', '=', 'malware')
+    tool_filter = Filter('type', '=', 'tool')
+
+    software_map = {}
+    revoke_map = {}
+
+    for cur_filter in [malware_filter, tool_filter]:
+        for item in composite_ds.query(cur_filter):
+            name = item['name']
+
+            software_id = None
+            for er in item['external_references']:
+                if er['source_name'] in ["mitre-attack", "mobile-mitre-attack", "mitre-mobile-attack"]:
+                    software_id = er['external_id']
+                    break
+
+            if software_id:
+                if not item['revoked']:
+                    if cur_filter == malware_filter:
+                        soft_type = 'malware'
+                    else:
+                        soft_type = 'tool'
+
+                    desc = item['description']
+                    platforms = item.get('x_mitre_platforms') or []
+
+                    related_attack_ids = []
+                    attack_pattern_refs = [r.target_ref
+                                           for r in composite_ds.relationships(item, 'uses', source_only=True)
+                                           if get_type_from_id(r.target_ref) == 'attack-pattern']
+                    for attack_item in composite_ds.query([Filter('type', '=', 'attack-pattern'),
+                                                           Filter('id', 'in', attack_pattern_refs)]):
+                        for er in attack_item['external_references']:
+                            if er['source_name'] in ["mitre-attack", "mobile-mitre-attack", "mitre-mobile-attack"]:
+                                related_attack_ids.append(er['external_id'])
+                                break
+
+                    software_map[software_id] = {
+                        "name": name,
+                        "description": desc,
+                        "platforms": platforms,
+                        "software_id": software_id,
+                        "type": soft_type,
+                        "attack_ids": related_attack_ids
+                    }
+                    print(f"\tAdding {name.upper()} as ID: {software_id}")
+                else:
+                    revoke_id = get_revoked_by(item['id'], composite_ds)
+                    if revoke_id is None:
+                        print(f"\t[WARN] {name.upper()} ({software_id}) has been revoked without being replaced.")
+                    else:
+                        revoke_map[software_id] = revoke_id
+                        print(f"\tAdding revoked {name.upper()} to the revoked map: {software_id} => {revoke_id}")
+            else:
+                print(f"[ERR] Ignored {name.upper()}: No attack ID found.")
+
+    return software_map, revoke_map
+
+
+def get_group_map(composite_ds):
+    print("Parsing intrusion sets ...")
+    group_filter = Filter('type', '=', 'intrusion-set')
+
+    group_map = {}
+    revoke_map = {}
+
+    for item in composite_ds.query(group_filter):
+        name = item['name']
+
+        group_id = None
+        for er in item['external_references']:
+            if er['source_name'] in ["mitre-attack", "mobile-mitre-attack", "mitre-mobile-attack"]:
+                group_id = er['external_id']
+                break
+
+        if group_id:
+            if not item['revoked']:
+                group_map[group_id] = {
+                    "name": name,
+                    "description": item['description'],
+                    "group_id": group_id
+                }
+                print(f"\tAdding {name.upper()} as ID: {group_id}")
+            else:
+                revoke_id = get_revoked_by(item['id'], composite_ds)
+                if revoke_id is None:
+                    print(f"\t[WARN] {name.upper()} ({group_id}) has been revoked without being replaced.")
+                else:
+                    revoke_map[group_id] = revoke_id
+                    print(f"\tAdding revoked {name.upper()} to the revoked map: {group_id} => {revoke_id}")
+        else:
+            print(f"[ERR] Ignored {name.upper()}: No group ID found.")
+
+    return group_map, revoke_map
+
+
+if __name__ == "__main__":
+    attack_map_location = "../assemblyline/common/attack_map.py"
+    if not os.path.exists(attack_map_location):
+        print("Could not find attack_map.py file. Make sure you run this script "
+              "in its home directory otherwise this won't work.")
+        exit(1)
+
+    clone_cti()
+    datasource = load_datasource()
+
+    att_map, att_rev_map = get_attack_map(datasource)
+    soft_map, soft_rev_map = get_software_map(datasource)
+    grp_map, grp_rev_map = get_group_map(datasource)
+
+    revoke_map = att_rev_map
+    revoke_map.update(soft_rev_map)
+    revoke_map.update(grp_rev_map)
+
+    with open(attack_map_location, "w") as attack_map_fh:
+        attack_map_fh.write("# This file is generated using generate_attack_map.py script\n"
+                            "# DO NOT EDIT! Re-run the script instead...\n"
+                            f"# Last ran: {datetime.now()}\n\n"
+                            f"attack_map = {{\n {pformat(att_map, width=120)[1:-1]}\n}}\n\n"
+                            f"software_map = {{\n {pformat(soft_map, width=120)[1:-1]}\n}}\n\n"
+                            f"group_map = {{\n {pformat(grp_map, width=120)[1:-1]}\n}}\n\n"
+                            f"revoke_map = {{\n {pformat(revoke_map, width=120)[1:-1]}\n}}\n")
+
+    print(f"Attack map file written into: {attack_map_location}")
+    print("You can now commit the new attack file to your git.")

assemblyline-4.7.5.dev150/external/generate_tlds.py

@@ -0,0 +1,53 @@
+import os
+import requests
+
+
+def get_tlds(url):
+    comments = []
+    tlds = []
+
+    response = requests.get(url)
+    for line in response.text.splitlines():
+        if not line:
+            continue
+        if line.startswith('#'):
+            comments.append(line)
+        else:
+            tlds.append(line)
+
+    return comments, tlds
+
+
+def get_special_tlds(url):
+    response = requests.get(url)
+    # Ignore first line from CSV and return list of domains without the period suffix
+    return [line.split(',', 1)[0][:-1].upper() for line in response.text.splitlines()[1:]]
+
+
+if __name__ == "__main__":
+    tlds_url = 'https://data.iana.org/TLD/tlds-alpha-by-domain.txt'
+    tlds_location = "../assemblyline/common/net_static.py"
+    if not os.path.exists(tlds_location):
+        print("Could not find net_static.py file. Make sure you run this script "
+              "in its home directory otherwise this won't work.")
+        exit(1)
+
+    comments, tlds = get_tlds(tlds_url)
+    comments_lines = '\n'.join(comments)
+    tlds_lines = '",\n    "'.join(tlds)
+
+    special_tlds_url = "https://www.iana.org/assignments/special-use-domain-names/special-use-domain.csv"
+    special_tlds = get_special_tlds(special_tlds_url)
+    special_tlds_lines = '",\n    "'.join(special_tlds)
+
+    with open(tlds_location, "w") as tlds_fh:
+        tlds_fh.write("# This file is generated using generate_tlds.py script\n"
+                      "# DO NOT EDIT! Re-run the script instead...\n\n"
+                      f"# Top level domains from: {tlds_url}\n"
+                      f"{comments_lines}\n"
+                      f"TLDS_ALPHA_BY_DOMAIN = {{\n    \"{tlds_lines}\"\n}}\n\n"
+                      f"# Special-use TLDs from: {special_tlds_url}\n"
+                      f"TLDS_SPECIAL_BY_DOMAIN = {{\n    \"{special_tlds_lines}\"\n}}")
+
+    print(f"TLDS list file written into: {tlds_location}")
+    print("You can now commit the new net_static.py file to your git.")