Have CAPE adopt MACO format

modules/processing/parsers/CAPE/AsyncRat.py

@@ -2,8 +2,10 @@
 
 import base64
 import logging
+import os
 import string
 import struct
+from urllib.parse import urlparse
 
 import yara
 from Cryptodome.Cipher import AES
@@ -14,6 +16,8 @@
 DESCRIPTION = "AsyncRat configuration parser."
 AUTHOR = "Based on work of c3rb3ru5"
 
+IP_REGEX = r"(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"
+
 rule_source = """
 rule asyncrat {
  meta:
@@ -101,17 +105,50 @@ def extract_config(filebuf):
  key = base64.b64decode(get_string(data, 7))
  log.debug("extracted key: " + str(key))
  try:
+ family = "asyncrat"
+ hosts = decrypt_config_item_list(key, data, 2)
+ ports = decrypt_config_item_list(key, data, 1)
+ version = decrypt_config_item_printable(key, data, 3)
+ install_folder = get_wide_string(data, 5)
+ install_file = get_wide_string(data, 6)
+ install = decrypt_config_item_printable(key, data, 4)
+ mutex = decrypt_config_item_printable(key, data, 8)
+ pastebin = decrypt(key, base64.b64decode(data[12][1:])).encode("ascii").replace(b"\x0f", b"")
+
  config = {
- "family": "asyncrat",
- "hosts": decrypt_config_item_list(key, data, 2),
- "ports": decrypt_config_item_list(key, data, 1),
- "version": decrypt_config_item_printable(key, data, 3),
- "install_folder": get_wide_string(data, 5),
- "install_file": get_wide_string(data, 6),
- "install": decrypt_config_item_printable(key, data, 4),
- "mutex": decrypt_config_item_printable(key, data, 8),
- "pastebin": decrypt(key, base64.b64decode(data[12][1:])).encode("ascii").replace(b"\x0f", b""),
+ "family": family,
+ "version": version,
+ "category": "rat",
+ "mutex": mutex,
+ "paths": [{"path": os.path.join(install_folder, install_file), "usage": "install" if install else "other"}],
+ "other": {
+ # No context around how these are used
+ "hosts": hosts,
+ "ports": ports,
+ },
  }
+
+ if pastebin != b"null":
+ parsed_url = urlparse(pastebin).decode()
+ port = parsed_url.port
+ if not port:
+ port = 443 if parsed_url.scheme == "https" else 80
+
+ config.update(
+ {
+ "http": [
+ {
+ "uri": parsed_url.geturl(),
+ "protocol": parsed_url.scheme,
+ "hostname": parsed_url.netloc,
+ "port": port,
+ "path": parsed_url.path,
+ "method": "GET",
+ "usage": "c2",
+ }
+ ]
+ }
+ )
  except Exception as e:
  print(e)
  return {}

modules/processing/parsers/CAPE/Azorult.py

@@ -54,10 +54,11 @@ def string_from_offset(data, offset):
 def extract_config(filebuf):
  pe = pefile.PE(data=filebuf, fast_load=False)
  image_base = pe.OPTIONAL_HEADER.ImageBase
+ config = {}
 
  ref_c2 = yara_scan(filebuf, "$ref_c2")
  if ref_c2 is None:
- return
+ return config
 
  ref_c2_offset = int(ref_c2["$ref_c2"])
 
@@ -71,6 +72,6 @@ def extract_config(filebuf):
 
  c2_domain = string_from_offset(filebuf, c2_list_offset)
  if c2_domain:
- return {"address": c2_domain.decode()}
+ config["tcp"] = [{"server_domain": c2_domain.decode(), "usage": "c2"}]
 
- return {}
+ return config

modules/processing/parsers/CAPE/BackOffLoader.py

@@ -7,6 +7,8 @@
 from Cryptodome.Cipher import ARC4
 
 CFG_START = "1020304050607080"
+AUTHOR = "CAPE"
+DESCRIPTION = "BackOffLoader configuration parser."
 
 
 def RC4(key, data):
@@ -16,24 +18,35 @@ def RC4(key, data):
 
 def extract_config(data):
  config_data = {}
- pe = pefile.PE(data=data)
- for section in pe.sections:
- if b".data" in section.Name:
- data = section.get_data()
- if CFG_START != hexlify(unpack_from(">8s", data, offset=8)[0]):
- return None
- rc4_seed = bytes(bytearray(unpack_from(">8B", data, offset=24)))
- key = md5(rc4_seed).digest()[:5]
- enc_data = bytes(bytearray(unpack_from(">8192B", data, offset=32)))
- dec_data = RC4(key, enc_data)
- config_data = {
- "Version": unpack_from(">5s", data, offset=16)[0],
- "RC4Seed": hexlify(rc4_seed),
- "EncryptionKey": hexlify(key),
- "OnDiskConfigKey": unpack_from("20s", data, offset=8224)[0],
- "Build": dec_data[:16].strip("\x00"),
- "URLs": [url.strip("\x00") for url in dec_data[16:].split("|")],
- }
+ try:
+ pe = pefile.PE(data=data)
+ for section in pe.sections:
+ if b".data" in section.Name:
+ data = section.get_data()
+ if CFG_START != hexlify(unpack_from(">8s", data, offset=8)[0]):
+ return None
+ rc4_seed = bytes(bytearray(unpack_from(">8B", data, offset=24)))
+ key = md5(rc4_seed).digest()[:5]
+ enc_data = bytes(bytearray(unpack_from(">8192B", data, offset=32)))
+ dec_data = RC4(key, enc_data)
+ config_data = {
+ "version": unpack_from(">5s", data, offset=16)[0],
+ "encryption": [
+ {
+ "algorithm": "RC4",
+ "key": hexlify(key),
+ "seed": hexlify(rc4_seed),
+ "binaries": [{"data": dec_data[:16].strip("\x00")}],
+ "http": [{"uri": url} for url in [url.strip("\x00") for url in dec_data[16:].split("|")]],
+ "other": {
+ "OnDiskConfigKey": unpack_from("20s", data, offset=8224)[0],
+ },
+ }
+ ],
+ }
+ except pefile.PEFormatError:
+ # This isn't a PE file, therefore unlikely to extract a configuration
+ pass
  return config_data
 
 

modules/processing/parsers/CAPE/BackOffPOS.py

@@ -7,6 +7,8 @@
 from Cryptodome.Cipher import ARC4
 
 header_ptrn = b"Content-Type: application/x-www-form-urlencoded"
+AUTHOR = "CAPE"
+DESCRIPTION = "BackOffPOS configuration parser."
 
 
 def RC4(key, data):
@@ -16,25 +18,34 @@ def RC4(key, data):
 
 def extract_config(data):
  config_data = {}
- pe = pefile.PE(data=data)
- for section in pe.sections:
- if b".data" in section.Name:
- data = section.get_data()
- cfg_start = data.find(header_ptrn)
- if not cfg_start or cfg_start == -1:
- return None
- start_offset = cfg_start + len(header_ptrn) + 1
- rc4_seed = bytes(bytearray(unpack_from(">8B", data, offset=start_offset)))
- key = md5(rc4_seed).digest()[:5]
- enc_data = bytes(bytearray(unpack_from(">8192B", data, offset=start_offset + 8)))
- dec_data = RC4(key, enc_data)
- config_data = {
- "RC4Seed": hexlify(rc4_seed),
- "EncryptionKey": hexlify(key),
- "Build": dec_data[:16].strip("\x00"),
- "URLs": [url.strip("\x00") for url in dec_data[16:].split("|")],
- "Version": unpack_from(">5s", data, offset=start_offset + 16 + 8192)[0],
- }
+ try:
+ pe = pefile.PE(data=data)
+ for section in pe.sections:
+ if b".data" in section.Name:
+ data = section.get_data()
+ cfg_start = data.find(header_ptrn)
+ if not cfg_start or cfg_start == -1:
+ return None
+ start_offset = cfg_start + len(header_ptrn) + 1
+ rc4_seed = bytes(bytearray(unpack_from(">8B", data, offset=start_offset)))
+ key = md5(rc4_seed).digest()[:5]
+ enc_data = bytes(bytearray(unpack_from(">8192B", data, offset=start_offset + 8)))
+ dec_data = RC4(key, enc_data)
+ config_data = {
+ "version": unpack_from(">5s", data, offset=start_offset + 16 + 8192)[0],
+ "encryption": [
+ {
+ "algorithm": "RC4",
+ "key": hexlify(key),
+ "seed": hexlify(rc4_seed),
+ "binaries": [{"data": dec_data[:16].strip("\x00")}],
+ "http": [{"uri": url} for url in [url.strip("\x00") for url in dec_data[16:].split("|")]],
+ }
+ ],
+ }
+ except pefile.PEFormatError:
+ # This isn't a PE file, therefore unlikely to extract a configuration
+ pass
  return config_data
 
 

modules/processing/parsers/CAPE/BitPaymer.py

@@ -12,15 +12,16 @@
 # You should have received a copy of the GNU General Public License
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 
-DESCRIPTION = "BitPaymer configuration parser."
-AUTHOR = "kevoreilly"
-
 import string
 
 import pefile
 import yara
 from Cryptodome.Cipher import ARC4
 
+DESCRIPTION = "BitPaymer configuration parser."
+AUTHOR = "kevoreilly"
+
+
 rule_source = """
 rule BitPaymer
 {
@@ -83,7 +84,7 @@ def extract_config(file_data):
  for item in raw.split(b"\x00"):
  data = "".join(convert_char(c) for c in item)
  if len(data) == 760:
- config["RSA public key"] = data
+ config["encryption"] = [{"algorithm": "RSA", "public_key": data}]
  elif len(data) > 1 and "\\x" not in data:
- config["strings"] = data
+ config["decoded_strings"] = [data]
  return config

modules/processing/parsers/CAPE/BlackNix.py

@@ -1,19 +1,19 @@
 import pefile
 
+AUTHOR = "CAPE"
+DESCRIPTION = "BlackNix configuration parser."
+
 
 def extract_raw_config(raw_data):
- try:
- pe = pefile.PE(data=raw_data)
- rt_string_idx = [entry.id for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries].index(pefile.RESOURCE_TYPE["RT_RCDATA"])
- rt_string_directory = pe.DIRECTORY_ENTRY_RESOURCE.entries[rt_string_idx]
- for entry in rt_string_directory.directory.entries:
- if str(entry.name) == "SETTINGS":
- data_rva = entry.directory.entries[0].data.struct.OffsetToData
- size = entry.directory.entries[0].data.struct.Size
- data = pe.get_memory_mapped_image()[data_rva : data_rva + size]
- return data.split("}")
- except Exception:
- return None
+ pe = pefile.PE(data=raw_data)
+ rt_string_idx = [entry.id for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries].index(pefile.RESOURCE_TYPE["RT_RCDATA"])
+ rt_string_directory = pe.DIRECTORY_ENTRY_RESOURCE.entries[rt_string_idx]
+ for entry in rt_string_directory.directory.entries:
+ if str(entry.name) == "SETTINGS":
+ data_rva = entry.directory.entries[0].data.struct.OffsetToData
+ size = entry.directory.entries[0].data.struct.Size
+ data = pe.get_memory_mapped_image()[data_rva : data_rva + size]
+ return data.split("}")
 
 
 def decode(line):
@@ -28,30 +28,34 @@ def extract_config(data):
  try:
  config_raw = extract_raw_config(data)
  if config_raw:
- return {
- "Mutex": decode(config_raw[1])[::-1],
- "Anti Sandboxie": decode(config_raw[2])[::-1],
- "Max Folder Size": decode(config_raw[3])[::-1],
- "Delay Time": decode(config_raw[4])[::-1],
- "Password": decode(config_raw[5])[::-1],
- "Kernel Mode Unhooking": decode(config_raw[6])[::-1],
- "User More Unhooking": decode(config_raw[7])[::-1],
- "Melt Server": decode(config_raw[8])[::-1],
- "Offline Screen Capture": decode(config_raw[9])[::-1],
- "Offline Keylogger": decode(config_raw[10])[::-1],
- "Copy To ADS": decode(config_raw[11])[::-1],
- "Domain": decode(config_raw[12])[::-1],
- "Persistence Thread": decode(config_raw[13])[::-1],
- "Active X Key": decode(config_raw[14])[::-1],
- "Registry Key": decode(config_raw[15])[::-1],
- "Active X Run": decode(config_raw[16])[::-1],
- "Registry Run": decode(config_raw[17])[::-1],
- "Safe Mode Startup": decode(config_raw[18])[::-1],
- "Inject winlogon.exe": decode(config_raw[19])[::-1],
- "Install Name": decode(config_raw[20])[::-1],
- "Install Path": decode(config_raw[21])[::-1],
- "Campaign Name": decode(config_raw[22])[::-1],
- "Campaign Group": decode(config_raw[23])[::-1],
+ config = {
+ "campaign_id": [config_raw["Campaign Name"], config_raw["Campaign Group"]],
+ "category": ["keylogger", "apt"],
+ "password": [config_raw["Password"]],
+ "mutex": [config_raw["Mutex"]],
+ "sleep_delay": config_raw["Delay Time"],
+ "paths": [{"path": config_raw["Install Path"], "usage": "install"}],
+ "registry": [{"key": config_raw["Registry Key"], "usage": "other"}],
+ "other": {
+ "Anti Sandboxie": config_raw["Anti Sandboxie"],
+ "Max Folder Size": config_raw["Max Folder Size"],
+ "Kernel Mode Unhooking": config_raw["Kernel Mode Unhooking"],
+ "User More Unhooking": config_raw["User More Unhooking"],
+ "Melt Server": config_raw["Melt Server"],
+ "Offline Screen Capture": config_raw["Offline Screen Capture"],
+ "Offline Keylogger": config_raw["Offline Keylogger"],
+ "Copy To ADS": config_raw["Copy To ADS"],
+ "Domain": config_raw["Domain"],
+ "Persistence Thread": config_raw["Persistence Thread"],
+ "Active X Key": config_raw["Active X Key"],
+ "Active X Run": config_raw["Active X Run"],
+ "Registry Run": config_raw["Registry Run"],
+ "Safe Mode Startup": config_raw["Safe Mode Startup"],
+ "Inject winlogon.exe": config_raw["Inject winlogon.exe"],
+ },
  }
+
+ return config
+
  except Exception:
- return None
+ return {}