├── .gitignore ├── .travis.yml ├── CODE_OF_CONDUCT.md ├── README.md ├── SECURITY.md ├── agent └── agent.py ├── analyzer └── windows │ ├── analyzer.py │ ├── bin │ ├── flashplayer.exe │ ├── loader.exe │ ├── loader_x64.exe │ ├── oldloader.exe │ ├── oldloader_x64.exe │ └── signtool.exe │ ├── dll │ ├── Debugger.dll │ ├── Debugger_x64.dll │ ├── Doppelganging.dll │ ├── Doppelganging_x64.dll │ ├── EvilGrab.dll │ ├── IcedID.dll │ ├── OldExtraction.dll │ ├── PlugX.dll │ ├── QakBot.dll │ ├── Sedreco.dll │ ├── Sedreco_x64.dll │ ├── UPX.dll │ ├── UPX_x64.dll │ ├── Ursnif.dll │ ├── Ursnif_x64.dll │ ├── capemon.dll │ ├── capemon_x64.dll │ ├── cuckoomon.dll │ └── cuckoomon_x64.dll │ ├── lib │ ├── __init__.py │ ├── api │ │ ├── __init__.py │ │ ├── process.py │ │ ├── screenshot.py │ │ └── utils.py │ ├── common │ │ ├── __init__.py │ │ ├── abstracts.py │ │ ├── constants.py │ │ ├── defines.py │ │ ├── errors.py │ │ ├── exceptions.py │ │ ├── hashing.py │ │ ├── rand.py │ │ └── results.py │ └── core │ │ ├── __init__.py │ │ ├── config.py │ │ ├── log.py │ │ ├── packages.py │ │ ├── privileges.py │ │ └── startup.py │ └── modules │ ├── __init__.py │ ├── auxiliary │ ├── __init__.py │ ├── browser.py │ ├── curtain.py │ ├── digisig.py │ ├── disguise.py │ ├── human.py │ ├── screenshots.py │ ├── sysmon.py │ └── usage.py │ └── packages │ ├── Combo.py │ ├── Combo_dll.py │ ├── Compression.py │ ├── Compression_dll.py │ ├── Compression_doc.py │ ├── Compression_js.py │ ├── Compression_pdf.py │ ├── Compression_zip.py │ ├── Debugger.py │ ├── Debugger_dll.py │ ├── Debugger_doc.py │ ├── Doppelganging.py │ ├── DumpOnAPI.py │ ├── Emotet.py │ ├── Emotet_batch.py │ ├── Emotet_doc.py │ ├── EvilGrab.py │ ├── Extraction.py │ ├── Extraction_dll.py │ ├── Extraction_jar.py │ ├── Extraction_js.py │ ├── Extraction_pdf.py │ ├── Extraction_ps1.py │ ├── Extraction_regsvr.py │ ├── Extraction_zip.py │ ├── Hancitor.py │ ├── Hancitor_dll.py │ ├── Hancitor_doc.py │ ├── IcedID.py │ ├── Injection.py │ ├── Injection_dll.py │ ├── Injection_doc.py │ ├── Injection_js.py │ ├── Injection_pdf.py │ ├── Injection_ps1.py │ ├── Injection_zip.py │ ├── PlugX.py │ ├── PlugXPayload.py │ ├── PlugX_dll.py │ ├── PlugX_doc.py │ ├── PlugX_zip.py │ ├── QakBot.py │ ├── Sedreco.py │ ├── Sedreco_dll.py │ ├── Shellcode-Extraction.py │ ├── Shellcode.py │ ├── Shellcode_x64.py │ ├── TrickBot.py │ ├── TrickBot_doc.py │ ├── UPX.py │ ├── UPX_dll.py │ ├── Ursnif.py │ ├── Ursnif_doc.py │ ├── __init__.py │ ├── applet.py │ ├── chm.py │ ├── chrome.py │ ├── cpl.py │ ├── cuckoomon.py │ ├── cuckoomon_dll.py │ ├── dll.py │ ├── doc.py │ ├── doc2016.py │ ├── eml.py │ ├── exe.py │ ├── firefox.py │ ├── generic.py │ ├── hta.py │ ├── html.py │ ├── ie.py │ ├── jar.py │ ├── js.py │ ├── mht.py │ ├── msg.py │ ├── msi.py │ ├── pdf.py │ ├── ppt.py │ ├── ps1.py │ ├── ps1_64.py │ ├── pub.py │ ├── python.py │ ├── rar.py │ ├── regsvr.py │ ├── sct.py │ ├── service.py │ ├── swf.py │ ├── vbs.py │ ├── wsf.py │ ├── xls.py │ ├── xps.py │ ├── zip.py │ └── zip_batch.py ├── conf ├── api.conf ├── auxiliary.conf ├── cuckoo.conf ├── esx.conf ├── kvm.conf ├── kvmremote.conf ├── malheur.conf ├── memory.conf ├── multi.conf ├── physical.conf ├── processing.conf ├── reporting.conf ├── smtp_sinkhole.conf ├── socks5.conf ├── virtualbox.conf ├── vmware.conf ├── vmwarerest.conf ├── vmwareserver.conf ├── vpn.conf ├── vsphere.conf └── xenserver.conf ├── cuckoo.py ├── cuckoo.pyproj ├── cuckoo.sln ├── cuckoo.v11.suo ├── data ├── html │ ├── base-report.html │ ├── base-web.html │ ├── browse.html │ ├── css │ │ ├── bootstrap-responsive.min.css │ │ └── bootstrap.min.css │ ├── error.html │ ├── graphic │ │ └── logo.html │ ├── img │ │ ├── glyphicons-halflings-white.png │ │ └── glyphicons-halflings.png │ ├── js │ │ ├── bootstrap.min.js │ │ ├── functions.js │ │ └── jquery.min.js │ ├── maec_api_call_mappings.json │ ├── pagination-menu.html │ ├── pagination-rpp.html │ ├── report.html │ ├── sections │ │ ├── behavior.html │ │ ├── dropped.html │ │ ├── errors.html │ │ ├── file.html │ │ ├── info.html │ │ ├── network.html │ │ ├── screenshots.html │ │ ├── signatures.html │ │ ├── static.html │ │ ├── url.html │ │ └── volatility.html │ ├── statistics.html │ ├── statistics │ │ └── README │ ├── submit.html │ └── success.html ├── ja3 │ └── ja3fingerprint.json ├── maec_api_call_mappings.json ├── mitre_attack.json ├── peutils │ └── UserDB.TXT ├── signature_overlay.json ├── src │ └── binpackage │ │ ├── Makefile │ │ └── execsc.c ├── test-internet.vbs └── yara │ ├── CAPE │ ├── AAR.yar │ ├── Adzok.yar │ ├── AgentTesla.yar │ ├── AlienSpy.yar │ ├── Ap0calypse.yar │ ├── Arcom.yar │ ├── Arkei.yar │ ├── Atlas.yar │ ├── Azer.yar │ ├── Azorult.yar │ ├── BackOffLoader.yar │ ├── BackOffPOS.yar │ ├── BadRabbit.yar │ ├── Bandook.yar │ ├── BitPaymer.yar │ ├── BlackNix.yar │ ├── BlackShades.yar │ ├── BlueBanana.yar │ ├── Bozok.yar │ ├── Cerber.yar │ ├── ChChes.yar │ ├── ClientMesh.yar │ ├── Clop.yar │ ├── CobaltStrikeBeacon.yar │ ├── Codoso.yar │ ├── Cryptoshield.yar │ ├── Cutlet.yar │ ├── CyberGate.yar │ ├── DarkComet.yar │ ├── DarkRAT.yar │ ├── DoppelPaymer.yar │ ├── Dreambot.yar │ ├── Dridex.yar │ ├── DridexLoader.yar │ ├── DridexV4.yar │ ├── Emotet.yar │ ├── Emotet_Loader.yar │ ├── Enfal.yar │ ├── EternalRomance.yar │ ├── EvilGrab.yar │ ├── Fareit.yar │ ├── Formbook.yar │ ├── Gandcrab.yar │ ├── Gootkit.yar │ ├── Greame.yar │ ├── Hancitor.yar │ ├── HawkEye.yar │ ├── HawkEyev9.yar │ ├── Hermes.yar │ ├── HttpBrowser.yar │ ├── IcedID.yar │ ├── Imminent.yar │ ├── Infinity.yar │ ├── Jaff.yar │ ├── JavaDropper.yar │ ├── KeyBase.yar │ ├── Kovter.yar │ ├── Kronos.yar │ ├── Locky.yar │ ├── Loki.yar │ ├── LostDoor.yar │ ├── LuminosityLink.yar │ ├── LuxNet.yar │ ├── Magniber.yar │ ├── Mangzamel.yar │ ├── Maze.yar │ ├── MedusaLocker.yar │ ├── MegaCortex.yar │ ├── Mole.yar │ ├── NanoCore.yar │ ├── NanoLocker.yar │ ├── NetTraveler.yar │ ├── NetWire.yar │ ├── OlympicDestroyer.yar │ ├── Pandora.yar │ ├── Paradox.yar │ ├── PatchWork.yar │ ├── PetrWrap.yar │ ├── Petya.yar │ ├── Phorpiex.yar │ ├── Plasma.yar │ ├── PoisonIvy.yar │ ├── PowerPool.yar │ ├── PredatorPain.yar │ ├── Punisher.yar │ ├── PythoRAT.yar │ ├── QRat.yar │ ├── QakBot.yar │ ├── RCSession.yar │ ├── REvil.yar │ ├── Ramnit.yar │ ├── RedLeaf.yar │ ├── Redsip.yar │ ├── Remcos.yar │ ├── Retefe.yar │ ├── RokRat.yar │ ├── Ryuk.yar │ ├── Sakula.yar │ ├── Scarab.yar │ ├── Sedreco.yar │ ├── Seduploader.yar │ ├── Shade.yar │ ├── ShadowTech.yar │ ├── SmallNet.yar │ ├── SmokeLoader.yar │ ├── SpyGate.yar │ ├── Sub7Nation.yar │ ├── T5000.yar │ ├── TClient.yar │ ├── TSCookie.yar │ ├── TreasureHunter.yar │ ├── TrickBot.yar │ ├── UPX.yar │ ├── Ursnif.yar │ ├── Ursnif3.yar │ ├── Varenyky.yar │ ├── Vertex.yar │ ├── Vidar.yar │ ├── VirusRat.yar │ ├── WanaCry.yar │ ├── Xtreme.yar │ ├── ZeroT.yar │ ├── ZeusPanda.yar │ ├── adWind.yar │ ├── jRat.yar │ ├── njRat.yar │ ├── tRat.yar │ ├── unrecom.yar │ └── xRAT.yar │ ├── binaries │ ├── HeavensGate.yar │ ├── embedded.yar │ ├── shellcodes.yar │ └── vmdetect.yar │ ├── memory │ ├── .gitignore │ ├── Exploit_HT_Flash_Vars.yar │ ├── Exploit_HT_VRename.yar │ ├── adgholas.yar │ ├── angler.yar │ ├── astrum.yar │ ├── cve_2013_2551.yar │ ├── cve_2014_0515.yar │ ├── cve_2014_0569.yar │ ├── cve_2014_6332.yar │ ├── cve_2015_0016.yar │ ├── cve_2015_2419.yar │ ├── cve_2015_2545.yar │ ├── cve_2015_5122.yar │ ├── cve_2016_0189.yar │ ├── cve_2016_3298.yar │ ├── darkcomet.yar │ ├── dridex.yar │ ├── dyre.yar │ ├── eitest.yar │ ├── flash_exploits.yar │ ├── kazybot.yar │ ├── neutrino.yar │ ├── nuclear.yar │ ├── rig.yar │ ├── shellcodes.yar │ └── sundown.yar │ └── urls │ └── .gitignore ├── docs ├── AUTHORS ├── CHANGELOG ├── LICENSE ├── README └── book │ └── src │ ├── Makefile │ ├── _images │ ├── logo │ │ └── cuckoo.png │ ├── schemas │ │ └── architecture-main.png │ └── screenshots │ │ ├── fog_host_management.png │ │ ├── fog_image_management.png │ │ ├── fog_scheduled_job.png │ │ ├── shared_folders.png │ │ ├── windows_network.png │ │ ├── windows_registry.png │ │ └── windows_security.png │ ├── conf.py │ ├── customization │ ├── auxiliary.rst │ ├── index.rst │ ├── machinery.rst │ ├── packages.rst │ ├── processing.rst │ ├── reporting.rst │ └── signatures.rst │ ├── development │ ├── code_style.rst │ ├── development_notes.rst │ └── index.rst │ ├── faq │ └── index.rst │ ├── finalremarks │ └── index.rst │ ├── index.rst │ ├── installation │ ├── guest │ │ ├── agent.rst │ │ ├── cloning.rst │ │ ├── creation.rst │ │ ├── index.rst │ │ ├── network.rst │ │ ├── requirements.rst │ │ └── saving.rst │ ├── guest_physical │ │ ├── creation.rst │ │ ├── index.rst │ │ ├── network.rst │ │ ├── requirements.rst │ │ └── saving.rst │ ├── host │ │ ├── configuration.rst │ │ ├── index.rst │ │ ├── installation.rst │ │ └── requirements.rst │ ├── index.rst │ └── upgrade.rst │ ├── introduction │ ├── index.rst │ ├── license.rst │ ├── sandboxing.rst │ └── what.rst │ └── usage │ ├── api.rst │ ├── clean.rst │ ├── dist.rst │ ├── index.rst │ ├── packages.rst │ ├── performance.rst │ ├── results.rst │ ├── start.rst │ ├── submit.rst │ ├── utilities.rst │ └── web.rst ├── extra ├── buildvswitch.sh ├── services │ ├── cuckoo │ ├── moloch │ ├── openvswitch-switch │ └── suricata ├── suricata.yaml └── whitelist_domains.txt ├── lib ├── __init__.py ├── cuckoo │ ├── __init__.py │ ├── common │ │ ├── __init__.py │ │ ├── abstracts.py │ │ ├── cape_utils.py │ │ ├── colors.py │ │ ├── compare.py │ │ ├── compressor.py │ │ ├── config.py │ │ ├── constants.py │ │ ├── decoders │ │ │ ├── __init__.py │ │ │ ├── alienspy.py │ │ │ ├── darkcomet.py │ │ │ ├── nanocore.py │ │ │ ├── njrat.py │ │ │ └── qrat.py │ │ ├── defines.py │ │ ├── demux.py │ │ ├── dist_db.py │ │ ├── dns.py │ │ ├── email_utils.py │ │ ├── exceptions.py │ │ ├── graphs │ │ │ ├── __init__.py │ │ │ └── binGraph │ │ │ │ ├── __init__.py │ │ │ │ ├── binGraph.py │ │ │ │ ├── graphs │ │ │ │ ├── __init__.py │ │ │ │ ├── ent │ │ │ │ │ ├── __init.py__ │ │ │ │ │ └── graph.py │ │ │ │ └── hist │ │ │ │ │ ├── __init.py__ │ │ │ │ │ └── graph.py │ │ │ │ └── requirements.txt │ │ ├── icon.py │ │ ├── irc.py │ │ ├── ja3 │ │ │ ├── __init__.py │ │ │ └── ja3.py │ │ ├── logo.py │ │ ├── logtbl.py │ │ ├── netlog.py │ │ ├── objects.py │ │ ├── office │ │ │ ├── DridexURLDecoder.py │ │ │ ├── __init__.py │ │ │ ├── msgextract.py │ │ │ ├── vba2graph.py │ │ │ └── vbadeobf.py │ │ ├── pdftools │ │ │ ├── __init__.py │ │ │ ├── pdf-parser.py │ │ │ └── pdfid.py │ │ ├── peepdf │ │ │ ├── AUTHORS │ │ │ ├── CHANGELOG │ │ │ ├── COPYING │ │ │ ├── JSAnalysis.py │ │ │ ├── PDFCore.py │ │ │ ├── PDFCrypto.py │ │ │ ├── PDFFilters.py │ │ │ ├── PDFUtils.py │ │ │ ├── README │ │ │ ├── TODO │ │ │ ├── __init__.py │ │ │ ├── aes.py │ │ │ ├── aespython │ │ │ │ ├── __init__.py │ │ │ │ ├── aes_cipher.py │ │ │ │ ├── aes_tables.py │ │ │ │ ├── cbc_mode.py │ │ │ │ ├── cfb_mode.py │ │ │ │ ├── key_expander.py │ │ │ │ ├── ofb_mode.py │ │ │ │ └── test_keys.py │ │ │ ├── ccitt.py │ │ │ ├── colorama │ │ │ │ ├── PKG-INFO │ │ │ │ ├── __init__.py │ │ │ │ ├── ansi.py │ │ │ │ ├── ansitowin32.py │ │ │ │ ├── initialise.py │ │ │ │ ├── win32.py │ │ │ │ └── winterm.py │ │ │ ├── jjdecode.py │ │ │ ├── jsbeautifier │ │ │ │ ├── __init__.py │ │ │ │ └── unpackers │ │ │ │ │ ├── README.specs.mkd │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── evalbased.py │ │ │ │ │ ├── javascriptobfuscator.py │ │ │ │ │ ├── myobfuscate.py │ │ │ │ │ ├── packer.py │ │ │ │ │ └── urlencode.py │ │ │ ├── lzw.py │ │ │ └── peepdf.dtd │ │ ├── quarantine.py │ │ ├── saztopcap.py │ │ ├── signature_utils.py │ │ ├── utils.py │ │ └── web_utils.py │ └── core │ │ ├── __init__.py │ │ ├── database.py │ │ ├── guest.py │ │ ├── plugins.py │ │ ├── resultserver.py │ │ ├── rooter.py │ │ ├── scheduler.py │ │ └── startup.py └── maec │ ├── __init__.py │ ├── maec11.py │ └── maec41.py ├── modules ├── __init__.py ├── auxiliary │ ├── __init__.py │ └── sniffer.py ├── feeds │ ├── __init__.py │ └── bad_ssl_certs.py ├── machinery │ ├── __init__.py │ ├── esx.py │ ├── kvm.py │ ├── kvmremote.py │ ├── multi.py │ ├── physical.py │ ├── virtualbox.py │ ├── vmware.py │ ├── vmwarerest.py │ ├── vmwareserver.py │ ├── vsphere.py │ └── xenserver.py ├── processing │ ├── CAPE.py │ ├── __init__.py │ ├── analysisinfo.py │ ├── behavior.py │ ├── cif.py │ ├── curtain.py │ ├── debug.py │ ├── decompression.py │ ├── deduplication.py │ ├── dropped.py │ ├── maliciousmacrobot.py │ ├── memory.py │ ├── network.py │ ├── parsers │ │ ├── __init__.py │ │ ├── malwareconfig │ │ │ ├── AAR.py │ │ │ ├── Adzok.py │ │ │ ├── AlienSpy.py │ │ │ ├── Arcom.py │ │ │ ├── BackOffLoader.py │ │ │ ├── BackOffPOS.py │ │ │ ├── BlackNix.py │ │ │ ├── BlackShades.py │ │ │ ├── BlueBanana.py │ │ │ ├── Bozok.py │ │ │ ├── ClientMesh.py │ │ │ ├── CobaltStrikeBeacon.py │ │ │ ├── CyberGate.py │ │ │ ├── DarkComet.py │ │ │ ├── DarkRAT.py │ │ │ ├── Greame.py │ │ │ ├── HawkEye.py │ │ │ ├── JavaDropper.py │ │ │ ├── LostDoor.py │ │ │ ├── LuminosityLink.py │ │ │ ├── LuxNet.py │ │ │ ├── NanoCore.py │ │ │ ├── NetWire.py │ │ │ ├── Nymaim.py │ │ │ ├── Pandora.py │ │ │ ├── Plasma.py │ │ │ ├── PoisonIvy.py │ │ │ ├── PredatorPain.py │ │ │ ├── Punisher.py │ │ │ ├── REvil.py │ │ │ ├── Sakula.py │ │ │ ├── ScriptDump.py │ │ │ ├── SmallNet.py │ │ │ ├── TSCookie.py │ │ │ ├── TrickBot.py │ │ │ ├── Ursnif.py │ │ │ ├── Xtreme.py │ │ │ ├── _ShadowTech.py │ │ │ ├── _SpyGate.py │ │ │ ├── _VirusRat.py │ │ │ ├── __init__.py │ │ │ ├── _jRat.py │ │ │ ├── adWind.py │ │ │ ├── njRat.py │ │ │ ├── pyAndroRat.py │ │ │ ├── pyDendroid.py │ │ │ ├── pyRattyExtractor.py │ │ │ ├── pySandroRat.py │ │ │ ├── pySpyNote.py │ │ │ ├── unrecom.py │ │ │ └── xRAT.py │ │ ├── mwcp │ │ │ ├── __init__.py │ │ │ ├── config │ │ │ │ ├── __init__.py │ │ │ │ └── log_config.yml │ │ │ ├── parser.py │ │ │ ├── parsers │ │ │ │ ├── Azorult.py │ │ │ │ ├── BitPaymer.py │ │ │ │ ├── ChChes.py │ │ │ │ ├── DoppelPaymer.py │ │ │ │ ├── DridexLoader.py │ │ │ │ ├── Emotet.py │ │ │ │ ├── Enfal.py │ │ │ │ ├── EvilGrab.py │ │ │ │ ├── HttpBrowser.py │ │ │ │ ├── IcedID.py │ │ │ │ ├── Loki.py │ │ │ │ ├── QakBot.py │ │ │ │ ├── RCSession.py │ │ │ │ ├── RedLeaf.py │ │ │ │ ├── Redsip.py │ │ │ │ ├── Remcos.py │ │ │ │ ├── Retefe.py │ │ │ │ ├── SmokeLoader.py │ │ │ │ └── __init__.py │ │ │ ├── reporter.py │ │ │ ├── resources │ │ │ │ ├── __init__.py │ │ │ │ ├── dispatcher.py │ │ │ │ ├── fields.json │ │ │ │ ├── fields.txt │ │ │ │ └── techanarchy_bridge.py │ │ │ ├── tester.py │ │ │ └── utils │ │ │ │ ├── __init__.py │ │ │ │ ├── construct │ │ │ │ ├── __init__.py │ │ │ │ ├── construct_html.py │ │ │ │ ├── construct_template.html │ │ │ │ ├── helpers.py │ │ │ │ ├── windows_enums.py │ │ │ │ └── windows_structures.py │ │ │ │ ├── custombase64.py │ │ │ │ ├── elffileutils.py │ │ │ │ ├── logutil.py │ │ │ │ ├── multi_proc.py │ │ │ │ ├── pefileutils.py │ │ │ │ └── stringutils.py │ │ └── plugxconfig │ │ │ ├── __init__.py │ │ │ └── plugx.py │ ├── procdump.py │ ├── procmemory.py │ ├── static.py │ ├── strings.py │ ├── suricata.py │ ├── sysmon.py │ ├── targetinfo.py │ ├── trid.py │ ├── usage.py │ └── virustotal.py ├── reporting │ ├── __init__.py │ ├── bingraph.py │ ├── callback.py │ ├── compression.py │ ├── compressresults.py │ ├── elasticsearchdb.py │ ├── jsondump.py │ ├── maec41.py │ ├── maec5.py │ ├── malheur.py │ ├── misp.py │ ├── mitre.py │ ├── mmdef.py │ ├── moloch.py │ ├── mongodb.py │ ├── ramfsclean.py │ ├── reporthtml.py │ ├── reporthtmlsummary.py │ ├── reportpdf.py │ ├── resubmitexe.py │ ├── retention.py │ ├── submitCAPE.py │ └── syslog.py └── signatures │ ├── CAPE.py │ ├── __init__.py │ ├── alphacrypt_apis.py │ ├── andromeda_apis.py │ ├── anomalous_deletefile.py │ ├── antianalysis_detectfile.py │ ├── antianalysis_detectreg.py │ ├── antiav_avast_libs.py │ ├── antiav_bitdefender_libs.py │ ├── antiav_bypass.py │ ├── antiav_detectfile.py │ ├── antiav_detectreg.py │ ├── antiav_servicestop.py │ ├── antiav_srp.py │ ├── antidbg_devices.py │ ├── antidbg_windows.py │ ├── antidebug_addvectoredexceptionhandler.py │ ├── antidebug_checkremotedebuggerpresent.py │ ├── antidebug_debugactiveprocess.py │ ├── antidebug_gettickcount.py │ ├── antidebug_guardpages.py │ ├── antidebug_ntcreatethreadex.py │ ├── antidebug_ntsetinformationthread.py │ ├── antidebug_outputdebugstring.py │ ├── antidebug_setunhandledexceptionfilter.py │ ├── antiemu_wine.py │ ├── antiemu_wine_func.py │ ├── antisandbox_check_userdomain.py │ ├── antisandbox_cuckoo.py │ ├── antisandbox_cuckoo_files.py │ ├── antisandbox_cuckoocrash.py │ ├── antisandbox_fortinet_files.py │ ├── antisandbox_joe_anubis_files.py │ ├── antisandbox_mouse_hook.py │ ├── antisandbox_restart.py │ ├── antisandbox_sboxie_libs.py │ ├── antisandbox_sboxie_mutex.py │ ├── antisandbox_sboxie_objects.py │ ├── antisandbox_scripttimer.py │ ├── antisandbox_sleep.py │ ├── antisandbox_sunbelt_files.py │ ├── antisandbox_sunbelt_libs.py │ ├── antisandbox_suspend.py │ ├── antisandbox_threattrack_files.py │ ├── antisandbox_unhook.py │ ├── antivirus_virustotal.py │ ├── antivm_bochs_keys.py │ ├── antivm_dirobjects.py │ ├── antivm_generic_bios.py │ ├── antivm_generic_cpu.py │ ├── antivm_generic_disk.py │ ├── antivm_generic_disk_setupapi.py │ ├── antivm_generic_diskreg.py │ ├── antivm_generic_scsi.py │ ├── antivm_generic_services.py │ ├── antivm_generic_system.py │ ├── antivm_hyperv_keys.py │ ├── antivm_parallels_keys.py │ ├── antivm_vbox_devices.py │ ├── antivm_vbox_files.py │ ├── antivm_vbox_keys.py │ ├── antivm_vbox_libs.py │ ├── antivm_vbox_provname.py │ ├── antivm_vbox_window.py │ ├── antivm_vmware_devices.py │ ├── antivm_vmware_events.py │ ├── antivm_vmware_files.py │ ├── antivm_vmware_keys.py │ ├── antivm_vmware_libs.py │ ├── antivm_vmware_mutexes.py │ ├── antivm_vpc_files.py │ ├── antivm_vpc_keys.py │ ├── antivm_vpc_mutex.py │ ├── antivm_xen_keys.py │ ├── api_spamming.py │ ├── backdoor_ketrican_regkeys.py │ ├── backdoor_okrum_mutex.py │ ├── bad_certs.py │ ├── bad_ssl_certs.py │ ├── banker_cridex.py │ ├── banker_geodo.py │ ├── banker_prinimalka.py │ ├── banker_spyeye_mutex.py │ ├── banker_zeus_mutex.py │ ├── banker_zeus_p2p.py │ ├── banker_zeus_url.py │ ├── bcdedit_command.py │ ├── betabot_apis.py │ ├── bitcoin_opencl.py │ ├── bootkit.py │ ├── bot_athenahttp.py │ ├── bot_dirtjumper.py │ ├── bot_drive.py │ ├── bot_drive2.py │ ├── bot_madness.py │ ├── bot_russkill.py │ ├── browser_addon.py │ ├── browser_bho.py │ ├── browser_needed.py │ ├── browser_proxy.py │ ├── browser_scanbox.py │ ├── browser_security.py │ ├── browser_startpage.py │ ├── bypass_applocker.py │ ├── bypass_firewall.py │ ├── bypass_uac.py │ ├── cape_extracted.py │ ├── carberp_mutex.py │ ├── cerber_apis.py │ ├── chimera_apis.py │ ├── clamav.py │ ├── clears_logs.py │ ├── clickfraud_cookies.py │ ├── clickfraud_volume.py │ ├── cmdline_anomaly.py │ ├── codelux_apis.py │ ├── compile_dotnet_code.py │ ├── copies_self.py │ ├── creates_exe.py │ ├── creates_largekey.py │ ├── creates_nullvalue.py │ ├── credential_dumping.py │ ├── critical_process.py │ ├── cryptomining.py │ ├── cryptopools.py │ ├── cryptowall_apis.py │ ├── cve_2014_6332.py │ ├── cve_2015_2419.py │ ├── cve_2016-0189.py │ ├── cve_2016_7200.py │ ├── darkcomet_regkeys.py │ ├── dead_connect.py │ ├── dead_link.py │ ├── debugs_self.py │ ├── decoy_doc.py │ ├── deepfreeze_mutex.py │ ├── deletes_self.py │ ├── deletes_shadowcopies.py │ ├── deletes_system_backup.py │ ├── dep_bypass.py │ ├── dep_disable.py │ ├── disables_app.py │ ├── disables_browserwarn.py │ ├── disables_drives_autodisconnect.py │ ├── disables_run_command.py │ ├── disables_spdy.py │ ├── disables_sysrestore.py │ ├── disables_uac.py │ ├── disables_wer.py │ ├── disables_wfp.py │ ├── disables_windefender.py │ ├── disables_windowsupdate.py │ ├── downloader_andromut_mutex.py │ ├── downloader_cabby.py │ ├── downloader_protonbot_mutex.py │ ├── dridex_apis.py │ ├── driver_load.py │ ├── dropper.py │ ├── dropper_js.py │ ├── dynamic_function_loading.py │ ├── dyre_apis.py │ ├── ek_angler.py │ ├── ek_gondad.py │ ├── ek_heapsray.py │ ├── ek_javaapplet.py │ ├── ek_neutrino.py │ ├── ek_nuclear.py │ ├── ek_rig.py │ ├── ek_silverlight.py │ ├── ek_sundown.py │ ├── ek_virtualcheck.py │ ├── encrypted_ioc.py │ ├── exec_crash.py │ ├── exploit_getbasekerneladdress.py │ ├── exploit_gethaldispatchtable.py │ ├── exploit_heapspray.py │ ├── family_proxyback.py │ ├── forces_mappeddrives_uac.py │ ├── generic_metrics.py │ ├── generic_phish.py │ ├── gootkit_apis.py │ ├── h1n1_apis.py │ ├── hancitor_apis.py │ ├── hawkeye_apis.py │ ├── http_request.py │ ├── infostealer_bitcoin.py │ ├── infostealer_browser.py │ ├── infostealer_browser_password.py │ ├── infostealer_ftp.py │ ├── infostealer_im.py │ ├── infostealer_keylog.py │ ├── infostealer_mail.py │ ├── infostealer_raccoon.py │ ├── infostealer_vidar.py │ ├── injection_createremotethread.py │ ├── injection_explorer.py │ ├── injection_needextension.py │ ├── injection_network.py │ ├── injection_runpe.py │ ├── injection_rwx.py │ ├── injection_themeinitapihook.py │ ├── internet_dropper.py │ ├── ipc_namedpipe.py │ ├── ispy_apis.py │ ├── js_phish.py │ ├── js_suspicious_redirect.py │ ├── kazybot_apis.py │ ├── kelihos_apis.py │ ├── kibex_apis.py │ ├── kovter_apis.py │ ├── kraken_mutex.py │ ├── locker_regedit.py │ ├── locker_taskmgr.py │ ├── locky_apis.py │ ├── malicious_dynamic_function_loading.py │ ├── martians_ie.py │ ├── martians_office.py │ ├── mimics_agent.py │ ├── mimics_filename.py │ ├── mimics_filetime.py │ ├── mimics_icon.py │ ├── mimics_processname.py │ ├── modifies_certs.py │ ├── modifies_hostsfile.py │ ├── modifies_seccenter.py │ ├── modifies_uac_notify.py │ ├── modifies_wallpaper.py │ ├── move_file_on_reboot.py │ ├── multiple_ua.py │ ├── network_anomaly.py │ ├── network_bind.py │ ├── network_cnc_generic.py │ ├── network_cnc_http.py │ ├── network_dga.py │ ├── network_docfile_http.py │ ├── network_doh.py │ ├── network_encrypts_single_packet.py │ ├── network_excessive_udp.py │ ├── network_http.py │ ├── network_icmp.py │ ├── network_irc.py │ ├── network_smtp.py │ ├── network_tor.py │ ├── network_tor_service.py │ ├── network_torgateway.py │ ├── nymaim_apis.py │ ├── office_codepage.py │ ├── office_exploit.py │ ├── office_macro.py │ ├── office_macro_suspicious.py │ ├── office_rtf.py │ ├── office_security.py │ ├── office_suspicious.py │ ├── office_write_exe.py │ ├── origin_langid.py │ ├── origin_resource_langid.py │ ├── packer_anomaly.py │ ├── packer_armadillo_mutex.py │ ├── packer_armadillo_regkey.py │ ├── packer_aspack.py │ ├── packer_aspirecrypt.py │ ├── packer_bedsprotector.py │ ├── packer_confuser.py │ ├── packer_enigma.py │ ├── packer_entropy.py │ ├── packer_mpress.py │ ├── packer_nate.py │ ├── packer_smartassembly.py │ ├── packer_spices.py │ ├── packer_themida.py │ ├── packer_titan.py │ ├── packer_upx.py │ ├── packer_vmprotect.py │ ├── pdf_annot_urls.py │ ├── persistence_ads.py │ ├── persistence_autorun.py │ ├── persistence_bootexecute.py │ ├── persistence_fileless.py │ ├── persistence_service.py │ ├── persistence_shim.py │ ├── polymorphic.py │ ├── pony_apis.py │ ├── powerpool_mutex.py │ ├── powershell_command.py │ ├── ppp_pcre.py │ ├── prevents_safeboot.py │ ├── process_interest.py │ ├── process_needed.py │ ├── procmem_yara.py │ ├── ransomware_cryptomix.py │ ├── ransomware_dmalocker.py │ ├── ransomware_fileextensions.py │ ├── ransomware_filemodifications.py │ ├── ransomware_files.py │ ├── ransomware_gandcrab.py │ ├── ransomware_germanwiper.py │ ├── ransomware_medusalocker.py │ ├── ransomware_message.py │ ├── ransomware_radamant.py │ ├── ransomware_recyclebin.py │ ├── ransomware_sodinokibi.py │ ├── rat_beebus_mutex.py │ ├── rat_fynloski_mutex.py │ ├── rat_limerat.py │ ├── rat_luminosity.py │ ├── rat_nanocore.py │ ├── rat_netwire.py │ ├── rat_njrat_regkeys.py │ ├── rat_pcclient.py │ ├── rat_plugx_mutex.py │ ├── rat_poisonivy.py │ ├── rat_quasar.py │ ├── rat_ratsnif_mutex.py │ ├── rat_spynet.py │ ├── rat_xtreme_mutex.py │ ├── reads_self.py │ ├── recon_beacon.py │ ├── recon_checkip.py │ ├── recon_fingerprint.py │ ├── recon_programs.py │ ├── recon_systeminfo.py │ ├── remcos.py │ ├── removes_zoneid_ads.py │ ├── script_downloader.py │ ├── secure_login_phish.py │ ├── securityxploded_modules.py │ ├── setsautoconfigurl.py │ ├── shifu_apis.py │ ├── sniffer_winpcap.py │ ├── spoofs_procname.py │ ├── spreading_autoruninf.py │ ├── stack_pivot.py │ ├── static_authenticode.py │ ├── static_dotnet_anomaly.py │ ├── static_java.py │ ├── static_pdf.py │ ├── static_pe_anomaly.py │ ├── static_rat_config.py │ ├── static_versioninfo_anomaly.py │ ├── stealth_childproc.py │ ├── stealth_file.py │ ├── stealth_hiddenextension.py │ ├── stealth_hiddenreg.py │ ├── stealth_hidenotifications.py │ ├── stealth_network.py │ ├── stealth_timelimit.py │ ├── stealth_webhistory.py │ ├── stealth_window.py │ ├── suricata_alert.py │ ├── sysinternals.py │ ├── targeted_flame.py │ ├── tinba_apis.py │ ├── trickbot_files.py │ ├── trickbot_mutex.py │ ├── trojan_fleercivet_mutex.py │ ├── troldesh_apis.py │ ├── upatre_apis.py │ ├── ursnif_apis.py │ ├── user_enum.py │ ├── vawtrak_apis.py │ ├── vawtrak_dll_apis.py │ ├── virus.py │ ├── virus_neshta.py │ ├── virus_renamer_mutex.py │ ├── volatility_sig.py │ ├── webmail_phish.py │ ├── whois_create.py │ ├── windows_utilities.py │ ├── wmi.py │ └── worm_allaple_mutex.py ├── nginx.md ├── requirements.txt ├── supervisor.conf ├── systemd ├── README.md ├── cuckoo-processor.service ├── cuckoo-rooter.service ├── cuckoo-wsgi.service ├── cuckoo.service ├── suricata-update.service └── suricata-update.timer ├── tests ├── abstracts_tests.py ├── colors_tests.py ├── config_tests.py ├── database_tests.py ├── email_utils_tests.py ├── integrity.py ├── objects_tests.py ├── processor_tests.py ├── reporter_tests.py ├── sniffer_tests.py └── utils_tests.py ├── utils ├── __init__.py ├── api.py ├── cleaner.py ├── db_migration │ ├── alembic.ini │ ├── env.py │ ├── script.py.mako │ └── versions │ │ ├── add_sample_parent_id.py │ │ ├── add_shrike_and_parent_id_columns.py │ │ ├── from_0_6_to_1_1.py │ │ ├── from_1_1_to_1_2-added_states.py │ │ ├── from_1_1_to_1_2-extend_file_type.py │ │ ├── from_1_2_to_1_2-accuvant-add_statistics.py │ │ ├── options_255_to_1024.py │ │ └── proper_indexes.py ├── delete_range.py ├── dist.py ├── listdump.py ├── machine.py ├── process.py ├── rooter.py ├── sample_path.py ├── smtp_sinkhole.py ├── smtp_sinkhole.sh ├── stats.py ├── submit.py ├── tcpdumpwrapper.py ├── tridupdate.py ├── vpncheck.py ├── web.py └── yara_test.py └── web ├── analysis ├── __init__.py ├── forms.py ├── templatetags │ ├── __init__.py │ ├── analysis_tags.py │ ├── generic_tags.py │ ├── key_tags.py │ └── pdf_tags.py ├── urls.py └── views.py ├── api ├── __init__.py ├── urls.py └── views.py ├── compare ├── __init__.py ├── urls.py └── views.py ├── dashboard ├── __init__.py ├── urls.py └── views.py ├── manage.py ├── static ├── css │ ├── bootstrap-datetimepicker.min.css │ ├── bootstrap.min.css │ ├── lightbox.css │ └── style.css ├── fonts │ ├── glyphicons-halflings-regular.eot │ ├── glyphicons-halflings-regular.svg │ ├── glyphicons-halflings-regular.ttf │ ├── glyphicons-halflings-regular.woff │ └── glyphicons-halflings-regular.woff2 ├── generated │ └── README ├── graphic │ ├── background.png │ ├── cape.png │ └── cuckoo.png ├── img │ ├── cape.png │ ├── close.png │ ├── loading.gif │ ├── next.png │ └── prev.png └── js │ ├── bootstrap-collapse.js │ ├── bootstrap-datetimepicker.min.js │ ├── bootstrap-fileupload.js │ ├── bootstrap-transition.js │ ├── bootstrap.min.js │ ├── hexdump.js │ ├── jquery.js │ ├── lightbox.js │ └── moment.min.js ├── submission ├── __init__.py ├── urls.py └── views.py ├── templates ├── analysis │ ├── CAPE │ │ └── index.html │ ├── admin │ │ └── index.html │ ├── antivirus.html │ ├── behavior │ │ ├── _api_call.html │ │ ├── _chunk.html │ │ ├── _processes.html │ │ ├── _search.html │ │ ├── _search_results.html │ │ ├── _tree.html │ │ └── index.html │ ├── comments │ │ └── index.html │ ├── curtain.html │ ├── debugger │ │ └── index.html │ ├── dropped │ │ └── index.html │ ├── index.html │ ├── memory │ │ ├── _apihooks.html │ │ ├── _callbacks.html │ │ ├── _devicetree.html │ │ ├── _gdt.html │ │ ├── _idt.html │ │ ├── _malfind.html │ │ ├── _messagehooks.html │ │ ├── _modscan.html │ │ ├── _netscan.html │ │ ├── _pslist.html │ │ ├── _sockscan.html │ │ ├── _ssdt.html │ │ ├── _svcscan.html │ │ ├── _timers.html │ │ ├── _yarascan.html │ │ └── index.html │ ├── misp │ │ └── index.html │ ├── mitre.html │ ├── network │ │ ├── _cif.html │ │ ├── _dns.html │ │ ├── _hosts.html │ │ ├── _http.html │ │ ├── _icmp.html │ │ ├── _irc.html │ │ ├── _ja3.html │ │ ├── _smtp.html │ │ ├── _suricata_alerts.html │ │ ├── _suricata_files.html │ │ ├── _suricata_http.html │ │ ├── _suricata_tls.html │ │ ├── _tcp.html │ │ ├── _udp.html │ │ └── index.html │ ├── overview │ │ ├── _file.html │ │ ├── _info.html │ │ ├── _screenshots.html │ │ ├── _signatures.html │ │ ├── _summary.html │ │ ├── _url.html │ │ ├── _usage.html │ │ └── index.html │ ├── pending.html │ ├── procdump │ │ └── index.html │ ├── procmemory │ │ └── index.html │ ├── report.html │ ├── reports │ │ └── index.html │ ├── search.html │ ├── shrike.html │ ├── similar │ │ └── index.html │ ├── static │ │ ├── _antivirus.html │ │ ├── _dotnet.html │ │ ├── _java.html │ │ ├── _office.html │ │ ├── _pdf.html │ │ ├── _pe32.html │ │ ├── _script.html │ │ ├── _strings.html │ │ ├── _url.html │ │ └── index.html │ ├── statistics │ │ └── index.html │ ├── surialert.html │ ├── surifiles.html │ ├── surihttp.html │ └── suritls.html ├── api │ └── index.html ├── auth │ ├── base.html │ ├── base_site.html │ ├── login.html │ └── logout.html ├── base.html ├── compare │ ├── _info.html │ ├── _summary_table.html │ ├── both.html │ ├── hash.html │ └── left.html ├── dashboard │ └── index.html ├── error.html ├── footer.html ├── header.html ├── standalone_error.html ├── statistics │ └── index.html ├── submission │ ├── complete.html │ ├── index.html │ └── status.html ├── success.html └── success_simple.html └── web ├── __init__.py ├── headers.py ├── local_settings.py ├── settings.py ├── urls.py └── wsgi.py /.gitignore: -------------------------------------------------------------------------------- 1 | # Ignore Cuckoo Database 2 | db/cuckoo.db 3 | 4 | # Ignore Cuckoo logs 5 | log/*.log* 6 | 7 | # Ignore Cuckoo analyses 8 | storage/* 9 | 10 | # Ignore Python byte code 11 | *.pyc 12 | 13 | # Ignore certificates 14 | *.pem 15 | *.cert 16 | 17 | # Ignore OS generated files 18 | .DS_Store* 19 | .AppleDouble 20 | ehthumbs.db 21 | Icon? 22 | Thumbs.db 23 | 24 | # Ignore development files 25 | docs/book/src/_build/ 26 | .idea/ 27 | 28 | # Ignore Django secret_key 29 | web/web/secret_key.py 30 | 31 | cuckoo.v11.suo 32 | cuckoo.v12.suo 33 | 34 | # Ignore yara rules 35 | data/yara/index_*.yar 36 | UpgradeLog.htm 37 | 38 | # Ignore virtualenvs 39 | venv/ 40 | .venv/ 41 | virtualenv/ 42 | .virtualenv/ 43 | 44 | -------------------------------------------------------------------------------- /.travis.yml: -------------------------------------------------------------------------------- 1 | branches: 2 | only: 3 | - master 4 | language: python 5 | python: 6 | - 2.7 7 | before_install: 8 | - sudo apt-get update -qq 9 | - sudo apt-get install python-magic python-dpkt python-libvirt 10 | - wget http://downloads.sourceforge.net/project/ssdeep/ssdeep-2.12/ssdeep-2.12.tar.gz 11 | - tar -zxvf ssdeep-2.12.tar.gz 12 | - cd ssdeep-2.12 13 | - ./configure && make 14 | - sudo make install 15 | - cd .. 16 | install: 17 | - pip install -r requirements.txt 18 | script: 19 | - python cuckoo.py --debug --test 20 | - nosetests 21 | -------------------------------------------------------------------------------- /SECURITY.md: -------------------------------------------------------------------------------- 1 | # Security Policy 2 | 3 | ## Supported Versions 4 | 5 | Use this section to tell people about which versions of your project are 6 | currently being supported with security updates. 7 | 8 | | Version | Supported | 9 | | ------- | ------------------ | 10 | | 5.1.x | :white_check_mark: | 11 | | 5.0.x | :x: | 12 | | 4.0.x | :white_check_mark: | 13 | | < 4.0 | :x: | 14 | 15 | ## Reporting a Vulnerability 16 | 17 | Use this section to tell people how to report a vulnerability. 18 | 19 | Tell them where to go, how often they can expect to get an update on a 20 | reported vulnerability, what to expect if the vulnerability is accepted or 21 | declined, etc. 22 | -------------------------------------------------------------------------------- /analyzer/windows/bin/flashplayer.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/bin/flashplayer.exe -------------------------------------------------------------------------------- /analyzer/windows/bin/loader.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/bin/loader.exe -------------------------------------------------------------------------------- /analyzer/windows/bin/loader_x64.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/bin/loader_x64.exe -------------------------------------------------------------------------------- /analyzer/windows/bin/oldloader.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/bin/oldloader.exe -------------------------------------------------------------------------------- /analyzer/windows/bin/oldloader_x64.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/bin/oldloader_x64.exe -------------------------------------------------------------------------------- /analyzer/windows/bin/signtool.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/bin/signtool.exe -------------------------------------------------------------------------------- /analyzer/windows/dll/Debugger.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Debugger.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/Debugger_x64.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Debugger_x64.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/Doppelganging.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Doppelganging.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/Doppelganging_x64.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Doppelganging_x64.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/EvilGrab.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/EvilGrab.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/IcedID.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/IcedID.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/OldExtraction.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/OldExtraction.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/PlugX.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/PlugX.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/QakBot.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/QakBot.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/Sedreco.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Sedreco.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/Sedreco_x64.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Sedreco_x64.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/UPX.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/UPX.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/UPX_x64.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/UPX_x64.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/Ursnif.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Ursnif.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/Ursnif_x64.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Ursnif_x64.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/capemon.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/capemon.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/capemon_x64.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/capemon_x64.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/cuckoomon.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/cuckoomon.dll -------------------------------------------------------------------------------- /analyzer/windows/dll/cuckoomon_x64.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/cuckoomon_x64.dll -------------------------------------------------------------------------------- /analyzer/windows/lib/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /analyzer/windows/lib/api/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /analyzer/windows/lib/common/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /analyzer/windows/lib/common/exceptions.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | class CuckooError(Exception): 6 | pass 7 | 8 | class CuckooPackageError(Exception): 9 | pass -------------------------------------------------------------------------------- /analyzer/windows/lib/common/hashing.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | BUFSIZE = 1024*1024 6 | 7 | 8 | def hash_file(method, path): 9 | """Calculates an hash on a file by path. 10 | @param method: callable hashing method 11 | @param path: file path 12 | @return: computed hash string 13 | """ 14 | f = open(path, "rb") 15 | h = method() 16 | while True: 17 | buf = f.read(BUFSIZE) 18 | if not buf: 19 | break 20 | h.update(buf) 21 | return h.hexdigest() 22 | -------------------------------------------------------------------------------- /analyzer/windows/lib/common/rand.py: -------------------------------------------------------------------------------- 1 | import random 2 | import string 3 | 4 | def random_string(minimum, maximum=None, charset=None): 5 | if maximum is None: 6 | maximum = minimum 7 | 8 | count = random.randint(minimum, maximum) 9 | if not charset: 10 | return "".join(random.choice(string.ascii_letters) for x in xrange(count)) 11 | 12 | return ''.join(random.choice(charset) for x in range(count)) 13 | 14 | def random_integer(digits): 15 | start = 10 ** (digits - 1) 16 | end = (10 ** digits) - 1 17 | return random.randint(start, end) 18 | -------------------------------------------------------------------------------- /analyzer/windows/lib/core/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /analyzer/windows/modules/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /analyzer/windows/modules/auxiliary/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/Compression_pdf.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | class Compression_PDF(Package): 8 | """PDF analysis package.""" 9 | PATHS = [ 10 | ("ProgramFiles", "Adobe", "*a*", "Reader", "AcroRd32.exe"), 11 | ] 12 | 13 | def __init__(self, options={}, config=None): 14 | """@param options: options dict.""" 15 | self.config = config 16 | self.options = options 17 | self.options["compression"] = "1" 18 | self.options["procdump"] = "0" 19 | 20 | def start(self, path): 21 | reader = self.get_path_glob("Adobe Reader") 22 | return self.execute(reader, "\"%s\"" % path, path) 23 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/Extraction_pdf.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | class Extraction_PDF(Package): 8 | """PDF analysis package.""" 9 | PATHS = [ 10 | ("ProgramFiles", "Adobe", "*a*", "Reader", "AcroRd32.exe"), 11 | ] 12 | 13 | def __init__(self, options={}, config=None): 14 | """@param options: options dict.""" 15 | self.config = config 16 | self.options = options 17 | self.options["extraction"] = "1" 18 | self.options["procdump"] = "0" 19 | 20 | def start(self, path): 21 | reader = self.get_path_glob("Adobe Reader") 22 | return self.execute(reader, "\"%s\"" % path, path) 23 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/Injection_pdf.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | class Injection_PDF(Package): 8 | """PDF analysis package.""" 9 | PATHS = [ 10 | ("ProgramFiles", "Adobe", "*a*", "Reader", "AcroRd32.exe"), 11 | ] 12 | 13 | def __init__(self, options={}, config=None): 14 | """@param options: options dict.""" 15 | self.config = config 16 | self.options = options 17 | self.options["injection"] = "1" 18 | self.options["procdump"] = "0" 19 | 20 | def start(self, path): 21 | reader = self.get_path_glob("Adobe Reader") 22 | return self.execute(reader, "\"%s\"" % path, path) 23 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/chm.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import os 6 | import shutil 7 | 8 | from lib.common.abstracts import Package 9 | 10 | class CHM(Package): 11 | """Chm analysis package.""" 12 | PATHS = [ 13 | ("SystemRoot", "hh.exe"), 14 | ] 15 | 16 | def start(self, path): 17 | hh = self.get_path_glob("hh.exe") 18 | 19 | # Check file extension. 20 | ext = os.path.splitext(path)[-1].lower() 21 | # If the file doesn't have the proper .chm extension force it 22 | # and rename it. This is needed for hh to open correctly. 23 | if ext != ".chm": 24 | new_path = path + ".chm" 25 | os.rename(path, new_path) 26 | path = new_path 27 | 28 | return self.execute(hh, "\"%s\"" % path, path) 29 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/chrome.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014 Optiv, Inc. (brad.spengler@optiv.com) 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | class Chrome(Package): 8 | """Chrome analysis package.""" 9 | PATHS = [ 10 | ("ProgramFiles", "Google", "Chrome", "Application", "chrome.exe"), 11 | ] 12 | 13 | def start(self, url): 14 | chrome = self.get_path("Google Chrome") 15 | # pass the URL instead of a filename in this case 16 | return self.execute(chrome, "\"%s\"" % url, url) 17 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/cpl.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | class CPL(Package): 8 | """Control Panel Applet analysis package.""" 9 | PATHS = [ 10 | ("SystemRoot", "system32", "control.exe"), 11 | ] 12 | 13 | def start(self, path): 14 | control = self.get_path("control.exe") 15 | return self.execute(control, "\"%s\"" % path, path) 16 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/doc.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import os 6 | 7 | from lib.common.abstracts import Package 8 | 9 | class DOC(Package): 10 | """Word analysis package.""" 11 | PATHS = [ 12 | ("ProgramFiles", "Microsoft Office", "WINWORD.EXE"), 13 | ("ProgramFiles", "Microsoft Office", "Office*", "WINWORD.EXE"), 14 | ("ProgramFiles", "Microsoft Office*", "root", "Office*", "WINWORD.EXE"), 15 | ("ProgramFiles", "Microsoft Office", "WORDVIEW.EXE"), 16 | ] 17 | 18 | def start(self, path): 19 | word = self.get_path_glob("Microsoft Office Word") 20 | if "." not in os.path.basename(path): 21 | new_path = path + ".doc" 22 | os.rename(path, new_path) 23 | path = new_path 24 | 25 | return self.execute(word, "\"%s\" /q" % path, path) 26 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/doc2016.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import os 6 | 7 | from lib.common.abstracts import Package 8 | 9 | class DOC2016(Package): 10 | """Word analysis package.""" 11 | 12 | def __init__(self, options={}, config=None): 13 | self.config = config 14 | self.options = options 15 | 16 | PATHS = [ 17 | ("ProgramFiles", "Microsoft Office*", "root", "Office16", "WINWORD.EXE"), 18 | ] 19 | 20 | def start(self, path): 21 | word = self.get_path_glob("Microsoft Office Word") 22 | if "." not in os.path.basename(path): 23 | new_path = path + ".doc" 24 | os.rename(path, new_path) 25 | path = new_path 26 | 27 | return self.execute(word, "\"%s\" /q" % path, path) 28 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/eml.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation., Optiv, Inc. (brad.spengler@optiv.com) 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | class EML(Package): 8 | """Outlook EML analysis package.""" 9 | PATHS = [ 10 | ("ProgramFiles", "Microsoft Office", "OUTLOOK.EXE"), 11 | ("ProgramFiles", "Microsoft Office", "Office*", "OUTLOOK.EXE"), 12 | ("ProgramFiles", "Microsoft Office*", "root", "Office*", "OUTLOOK.EXE"), 13 | ] 14 | 15 | def start(self, path): 16 | outlook = self.get_path_glob("Microsoft Office Outlook") 17 | return self.execute(outlook, "/eml \"%s\"" % path, path) 18 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/firefox.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014 Optiv, Inc. (brad.spengler@optiv.com) 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | class Firefox(Package): 8 | """Firefox analysis package.""" 9 | PATHS = [ 10 | ("ProgramFiles", "Mozilla Firefox", "firefox.exe"), 11 | ] 12 | 13 | def start(self, url): 14 | firefox = self.get_path("Mozilla Firefox") 15 | # pass the URL instead of a filename in this case 16 | return self.execute(firefox, "\"%s\"" % url, url) 17 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/generic.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from random import randint 6 | 7 | from lib.common.abstracts import Package 8 | 9 | class Generic(Package): 10 | """Generic analysis package. 11 | The sample is started using START command in a cmd.exe prompt. 12 | """ 13 | PATHS = [ 14 | ("SystemRoot", "system32", "cmd.exe"), 15 | ] 16 | 17 | def start(self, path): 18 | cmd_path = self.get_path("cmd.exe") 19 | cmd_args = "/c start /wait \"\" \"{0}\"".format(path) 20 | return self.execute(cmd_path, cmd_args, path) 21 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/hta.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2016 Brad Spengler 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import os 6 | import logging 7 | 8 | from lib.common.abstracts import Package 9 | 10 | log = logging.getLogger(__name__) 11 | 12 | class HTA(Package): 13 | """HTA file analysis package.""" 14 | PATHS = [ 15 | ("SystemRoot", "system32", "mshta.exe"), 16 | ] 17 | 18 | def start(self, path): 19 | mshta = self.get_path("mshta.exe") 20 | 21 | if not path.endswith(".hta"): 22 | os.rename(path, path + ".hta") 23 | path += ".hta" 24 | 25 | return self.execute(mshta, "\"%s\"" % path, path) 26 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/ie.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | class IE(Package): 8 | """Internet Explorer analysis package.""" 9 | PATHS = [ 10 | ("ProgramFiles", "Internet Explorer", "iexplore.exe"), 11 | ] 12 | 13 | def start(self, url): 14 | iexplore = self.get_path("Internet Explorer") 15 | # pass the URL instead of a filename in this case 16 | return self.execute(iexplore, "\"%s\"" % url, url) 17 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/jar.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | class Jar(Package): 8 | """Java analysis package.""" 9 | PATHS = [ 10 | ("ProgramFiles", "Java", "jre*", "bin", "java.exe"), 11 | ] 12 | 13 | def start(self, path): 14 | java = self.get_path_glob("Java") 15 | class_path = self.options.get("class") 16 | 17 | if class_path: 18 | args = "-cp \"%s\" %s" % (path, class_path) 19 | else: 20 | args = "-jar \"%s\"" % path 21 | 22 | return self.execute(java, args, path) 23 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/msg.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation., Optiv, Inc. (brad.spengler@optiv.com) 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | class MSG(Package): 8 | """Outlook MSG analysis package.""" 9 | PATHS = [ 10 | ("ProgramFiles", "Microsoft Office", "OUTLOOK.EXE"), 11 | ("ProgramFiles", "Microsoft Office", "Office*", "OUTLOOK.EXE"), 12 | ("ProgramFiles", "Microsoft Office*", "root", "Office*", "OUTLOOK.EXE"), 13 | ] 14 | 15 | def start(self, path): 16 | outlook = self.get_path_glob("Microsoft Office Outlook") 17 | return self.execute(outlook, "/f \"%s\"" % path, path) 18 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/msi.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | class Msi(Package): 8 | """MSI analysis package.""" 9 | 10 | PATHS = [ 11 | ("SystemRoot", "system32", "msiexec.exe"), 12 | ] 13 | 14 | def start(self, path): 15 | msi_path = self.get_path("msiexec.exe") 16 | msi_args = "/I \"{0}\"".format(path) 17 | return self.execute(msi_path, msi_args, path) 18 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/pdf.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | class PDF(Package): 8 | """PDF analysis package.""" 9 | PATHS = [ 10 | ("ProgramFiles", "Adobe", "*a*", "Reader", "AcroRd32.exe"), 11 | ] 12 | 13 | def start(self, path): 14 | reader = self.get_path_glob("Adobe Reader") 15 | return self.execute(reader, "\"%s\"" % path, path) 16 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/ppt.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | class PPT(Package): 8 | """PowerPoint analysis package.""" 9 | PATHS = [ 10 | ("ProgramFiles", "Microsoft Office", "POWERPNT.EXE"), 11 | ("ProgramFiles", "Microsoft Office", "Office*", "POWERPNT.EXE"), 12 | ("ProgramFiles", "Microsoft Office*", "root", "Office*", "POWERPNT.EXE"), 13 | ] 14 | 15 | def start(self, path): 16 | powerpoint = self.get_path_glob("Microsoft Office PowerPoint") 17 | return self.execute(powerpoint, "/s \"%s\"" % path, path) 18 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/ps1.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import os 6 | 7 | from lib.common.abstracts import Package 8 | 9 | # Originally proposed by David Maciejak. 10 | 11 | class PS1(Package): 12 | """PowerShell analysis package.""" 13 | PATHS = [ 14 | ("SystemRoot", "system32", "WindowsPowerShell", "v*.0", "powershell.exe"), 15 | ] 16 | 17 | def start(self, path): 18 | powershell = self.get_path_glob("PowerShell") 19 | 20 | if not path.endswith(".ps1"): 21 | os.rename(path, path + ".ps1") 22 | path += ".ps1" 23 | 24 | args = "-NoProfile -ExecutionPolicy bypass -File \"{0}\"".format(path) 25 | return self.execute(powershell, args, path) 26 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/ps1_64.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import os 6 | 7 | from lib.common.abstracts import Package 8 | 9 | # Originally proposed by David Maciejak. 10 | 11 | class PS1(Package): 12 | """PowerShell analysis package.""" 13 | PATHS = [ 14 | ("SystemRoot", "sysnative", "WindowsPowerShell", "v*.0", "powershell.exe"), 15 | ] 16 | 17 | def start(self, path): 18 | powershell = self.get_path_glob("PowerShell") 19 | 20 | if not path.endswith(".ps1"): 21 | os.rename(path, path + ".ps1") 22 | path += ".ps1" 23 | 24 | args = "-NoProfile -ExecutionPolicy bypass -File \"{0}\"".format(path) 25 | return self.execute(powershell, args, path) 26 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/python.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | class Python(Package): 8 | """Python analysis package.""" 9 | 10 | PATHS = [ 11 | ("HomeDrive", "Python*", "python.exe"), 12 | ] 13 | 14 | def start(self, path): 15 | python = self.get_path_glob("Python") 16 | arguments = self.options.get("arguments", "") 17 | return self.execute(python, "%s %s" % (path, arguments), path) 18 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/sct.py: -------------------------------------------------------------------------------- 1 | # This file is part of CAPE Sandbox - https://github.com/ctxis/CAPE 2 | # See the file 'docs/LICENSE' for copying permission. 3 | 4 | import os 5 | 6 | from lib.common.abstracts import Package 7 | 8 | class SCT(Package): 9 | """SCT analysis package.""" 10 | PATHS = [ 11 | ("SystemRoot", "system32", "regsvr32.exe"), 12 | ] 13 | 14 | def start(self, path): 15 | regsvr32 = self.get_path("regsvr32.exe") 16 | args = "/u /n /i:{0} scrobj.dll".format(path) 17 | 18 | return self.execute(regsvr32, args, path) -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/swf.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | class SWF(Package): 8 | """Shockwave Flash analysis package. 9 | Download a version of standalone flash from adobe and 10 | place in bin/ as flashplayer.exe to use 11 | 12 | You can find the bundles you want here: 13 | https://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html 14 | You want the debug folder (in the zip). The filename will have 'sa' (stand-alone) in it 15 | """ 16 | 17 | def start(self, path): 18 | return self.execute("bin/flashplayer.exe", path, path) 19 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/wsf.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2016 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import logging 6 | import os 7 | 8 | from lib.common.abstracts import Package 9 | 10 | log = logging.getLogger(__name__) 11 | 12 | class WSF(Package): 13 | """Windows Scripting File analysis package.""" 14 | PATHS = [ 15 | ("SystemRoot", "system32", "wscript.exe"), 16 | ] 17 | 18 | def start(self, path): 19 | wscript = self.get_path("WScript") 20 | 21 | # Enforce the .wsf file extension as is required by wscript. 22 | if not path.endswith(".wsf"): 23 | os.rename(path, path + ".wsf") 24 | path += ".wsf" 25 | 26 | return self.execute(wscript, "\"%s\"" % path, path) 27 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/xls.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import os 6 | 7 | from lib.common.abstracts import Package 8 | 9 | class XLS(Package): 10 | """Excel analysis package.""" 11 | PATHS = [ 12 | ("ProgramFiles", "Microsoft Office", "EXCEL.EXE"), 13 | ("ProgramFiles", "Microsoft Office", "Office*", "EXCEL.EXE"), 14 | ("ProgramFiles", "Microsoft Office*", "root", "Office*", "EXCEL.EXE"), 15 | ] 16 | 17 | def start(self, path): 18 | excel = self.get_path_glob("Microsoft Office Excel") 19 | if "." not in os.path.basename(path): 20 | new_path = path + ".xls" 21 | os.rename(path, new_path) 22 | path = new_path 23 | 24 | return self.execute(excel, "\"%s\" /e" % path, path) 25 | -------------------------------------------------------------------------------- /analyzer/windows/modules/packages/xps.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.common.abstracts import Package 6 | 7 | 8 | class Xps(Package): 9 | """XPS analysis package.""" 10 | 11 | PATHS = [ 12 | ("SystemRoot", "system32", "xpsrchvw.exe"), 13 | ] 14 | 15 | def start(self, path): 16 | xpsrchvw_path = self.get_path("xpsrchvw.exe") 17 | xpsrchvw_args = "\"{0}\"".format(path) 18 | return self.execute(xpsrchvw_path, xpsrchvw_args, path) 19 | -------------------------------------------------------------------------------- /conf/malheur.conf: -------------------------------------------------------------------------------- 1 | generic = { 2 | input_format = "mist"; 3 | }; 4 | 5 | cluster = { 6 | reject_num = 2; 7 | }; 8 | 9 | features = { 10 | mist_level = 2; 11 | }; -------------------------------------------------------------------------------- /conf/multi.conf: -------------------------------------------------------------------------------- 1 | [multi] 2 | # Specify a comma-separated list of the machinery modules to be used. 3 | machinery = kvm,physical 4 | 5 | # The rest should be configured in the hypervisor configurations, 6 | # as example: kvm.conf and physical.conf 7 | -------------------------------------------------------------------------------- /conf/physical.conf: -------------------------------------------------------------------------------- 1 | [physical] 2 | # Specify a comma-separated list of available machines to be used. For each 3 | # specified ID you have to define a dedicated section containing the details 4 | # on the respective machine. (E.g. physical1,physical2,physical3) 5 | machines = physical1 6 | 7 | # Credentials to access the machine 8 | user = username 9 | password = password 10 | 11 | [physical1] 12 | # Specify the label name of the current machine as specified in your 13 | # physical machine configuration. 14 | label = physical1 15 | 16 | # Specify the operating system platform used by current machine 17 | # [windows/darwin/linux]. 18 | platform = windows 19 | 20 | # Specify the IP address of the current machine. Make sure that the IP address 21 | # is valid and that the host machine is able to reach it. If not, the analysis 22 | # will fail. 23 | ip = 192.168.56.101 24 | -------------------------------------------------------------------------------- /conf/smtp_sinkhole.conf: -------------------------------------------------------------------------------- 1 | [email] 2 | server = 3 | port = 4 | user = 5 | password = 6 | # coma space separated list, if more then one receiver 7 | to = 8 | from = 9 | -------------------------------------------------------------------------------- /conf/socks5.conf: -------------------------------------------------------------------------------- 1 | [socks5] 2 | # By default we disable socks5 support as it requires running utils/rooter.py as 3 | # root next to cuckoo.py (which should run as regular user). 4 | enabled = no 5 | 6 | # Comma-separated list of the available proxies. 7 | proxies = ch 8 | 9 | [ch] 10 | name = ch_tor 11 | description = ch_tor 12 | proxyport = 5008 13 | dnsport = 10053 14 | -------------------------------------------------------------------------------- /cuckoo.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 2012 4 | Project("{888888A0-9F3D-457C-B088-3A5042F75D52}") = "cuckoo", "cuckoo.pyproj", "{365A3967-518E-457B-972A-3C90834F0F80}" 5 | EndProject 6 | Global 7 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 8 | Debug|Any CPU = Debug|Any CPU 9 | Release|Any CPU = Release|Any CPU 10 | EndGlobalSection 11 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 12 | {365A3967-518E-457B-972A-3C90834F0F80}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 13 | {365A3967-518E-457B-972A-3C90834F0F80}.Debug|Any CPU.Build.0 = Debug|Any CPU 14 | {365A3967-518E-457B-972A-3C90834F0F80}.Release|Any CPU.ActiveCfg = Release|Any CPU 15 | {365A3967-518E-457B-972A-3C90834F0F80}.Release|Any CPU.Build.0 = Release|Any CPU 16 | EndGlobalSection 17 | GlobalSection(SolutionProperties) = preSolution 18 | HideSolutionNode = FALSE 19 | EndGlobalSection 20 | EndGlobal 21 | -------------------------------------------------------------------------------- /cuckoo.v11.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/cuckoo.v11.suo -------------------------------------------------------------------------------- /data/html/error.html: -------------------------------------------------------------------------------- 1 | {% extends "base-web.html" %} 2 | {% block content %} 3 | 6 |
7 |
8 | Error: {{error}} 9 |
10 |
11 | {% endblock %} -------------------------------------------------------------------------------- /data/html/img/glyphicons-halflings-white.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/data/html/img/glyphicons-halflings-white.png -------------------------------------------------------------------------------- /data/html/img/glyphicons-halflings.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/data/html/img/glyphicons-halflings.png -------------------------------------------------------------------------------- /data/html/js/functions.js: -------------------------------------------------------------------------------- 1 | function showHide(id, lbl) { 2 | var e = document.getElementById(id); 3 | 4 | if (lbl !== "undefined") 5 | var l = document.getElementById(lbl); 6 | 7 | if(e.style.display == "none") { 8 | e.style.display = "block"; 9 | if (l) { 10 | l.innerHTML = "Collapse"; 11 | } 12 | } 13 | else { 14 | e.style.display = "none"; 15 | if (l) 16 | l.innerHTML = "Expand"; 17 | } 18 | } 19 | -------------------------------------------------------------------------------- /data/html/report.html: -------------------------------------------------------------------------------- 1 | {% extends "base-report.html" %} 2 | {% block content %} 3 | {% include "sections/info.html" %} 4 | {% include "sections/errors.html" %} 5 | {% if results.info.category == "file" %} 6 | {% include "sections/file.html" %} 7 | {% elif results.info.category == "url" %} 8 | {% include "sections/url.html" %} 9 | {% endif %} 10 | {% include "sections/signatures.html" %} 11 | {% include "sections/screenshots.html" %} 12 | {% include "sections/network.html" %} 13 | {% if results.info.category == "file" %} 14 | {% include "sections/static.html" %} 15 | {% endif %} 16 | {% include "sections/dropped.html" %} 17 | {% include "sections/behavior.html" %} 18 | {% include "sections/volatility.html" %} 19 | {% endblock %} -------------------------------------------------------------------------------- /data/html/sections/errors.html: -------------------------------------------------------------------------------- 1 | {% if results.debug.errors %} 2 |
3 |

Errors

4 |
5 |
6 | 11 |
12 | {% endif %} -------------------------------------------------------------------------------- /data/html/sections/screenshots.html: -------------------------------------------------------------------------------- 1 |
2 |
3 |

Screenshots

4 |
5 | {% if results.shots %} 6 | {% for shot in results.shots %} 7 | 8 | {% endfor %} 9 | {% else %} 10 | No screenshots available. 11 | {% endif %} 12 |
13 | -------------------------------------------------------------------------------- /data/html/statistics.html: -------------------------------------------------------------------------------- 1 | {% extends "base-web.html" %} 2 | {% block content %} 3 | 4 |
5 | 17 |
18 | {% endblock %} -------------------------------------------------------------------------------- /data/html/statistics/README: -------------------------------------------------------------------------------- 1 | This is an empty directory where statistics images will be created. 2 | -------------------------------------------------------------------------------- /data/html/success.html: -------------------------------------------------------------------------------- 1 | {% extends "base-web.html" %} 2 | {% block content %} 3 | 6 |
7 |
8 | GOOD! File {{submitfile}} was submitted for analysis with Task ID {{taskid}}. 9 |
10 |
11 | {% endblock %} -------------------------------------------------------------------------------- /data/signature_overlay.json: -------------------------------------------------------------------------------- 1 | { 2 | "creates_exe": { 3 | "severity": 2, 4 | "alert": false, 5 | "custom_attribute": "machete" 6 | } 7 | } 8 | -------------------------------------------------------------------------------- /data/src/binpackage/Makefile: -------------------------------------------------------------------------------- 1 | execsc.exe: execsc.c 2 | i586-mingw32msvc-cc -Wall -o $@ $< 3 | 4 | -------------------------------------------------------------------------------- /data/src/binpackage/execsc.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | int main (int argc, char ** argv) { 6 | int fd; 7 | char buf[2048] = {0}; 8 | 9 | if (argc < 2) return 1; 10 | 11 | // read in shellcode from analysis target file 12 | fd = open(argv[1], 0); 13 | read(fd, buf, 2048); 14 | close(fd); 15 | 16 | // jump into shellcode 17 | int (*func)(); 18 | func = (int (*)()) buf; 19 | (int)(*func)(); 20 | 21 | return 0; 22 | } 23 | 24 | -------------------------------------------------------------------------------- /data/yara/CAPE/AAR.yar: -------------------------------------------------------------------------------- 1 | rule AAR 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/AAR" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "AAR Payload" 9 | 10 | strings: 11 | $a = "Hashtable" 12 | $b = "get_IsDisposed" 13 | $c = "TripleDES" 14 | $d = "testmemory.FRMMain.resources" 15 | $e = "$this.Icon" wide 16 | $f = "{11111-22222-20001-00001}" wide 17 | $g = "@@@@@" 18 | 19 | condition: 20 | all of them 21 | } -------------------------------------------------------------------------------- /data/yara/CAPE/Adzok.yar: -------------------------------------------------------------------------------- 1 | rule Adzok 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | Description = "Adzok Rat" 6 | Versions = "Free 1.0.0.3," 7 | ref = "http://malwareconfig.com/stats/Adzok" 8 | maltype = "Remote Access Trojan" 9 | filetype = "jar" 10 | cape_type = "Adzok Payload" 11 | 12 | strings: 13 | $a1 = "config.xmlPK" 14 | $a2 = "key.classPK" 15 | $a3 = "svd$1.classPK" 16 | $a4 = "svd$2.classPK" 17 | $a5 = "Mensaje.classPK" 18 | $a6 = "inic$ShutdownHook.class" 19 | $a7 = "Uninstall.jarPK" 20 | $a8 = "resources/icono.pngPK" 21 | 22 | condition: 23 | 7 of ($a*) 24 | } -------------------------------------------------------------------------------- /data/yara/CAPE/AgentTesla.yar: -------------------------------------------------------------------------------- 1 | rule AgentTesla 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "AgentTesla Payload" 6 | cape_type = "AgentTesla Payload" 7 | strings: 8 | $string1 = "smtp" wide 9 | $string2 = "appdata" wide 10 | $string3 = "76487-337-8429955-22614" wide 11 | $string4 = "yyyy-MM-dd HH:mm:ss" wide 12 | //$string5 = "%site_username%" wide 13 | $string6 = "webpanel" wide 14 | $string7 = "
UserName      :" wide 15 | $string8 = "
IP Address  :" wide 16 | 17 | $agt1 = "IELibrary.dll" ascii 18 | $agt2 = "C:\\Users\\Admin\\Desktop\\IELibrary\\IELibrary\\obj\\Debug\\IELibrary.pdb" ascii 19 | $agt3 = "GetSavedPasswords" ascii 20 | $agt4 = "GetSavedCookies" ascii 21 | condition: 22 | uint16(0) == 0x5A4D and (all of ($string*) or 3 of ($agt*)) 23 | } 24 | -------------------------------------------------------------------------------- /data/yara/CAPE/Ap0calypse.yar: -------------------------------------------------------------------------------- 1 | rule Ap0calypse 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/Ap0calypse" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "Ap0calypse Payload" 9 | 10 | strings: 11 | $a = "Ap0calypse" 12 | $b = "Sifre" 13 | $c = "MsgGoster" 14 | $d = "Baslik" 15 | $e = "Dosyalars" 16 | $f = "Injecsiyon" 17 | 18 | condition: 19 | all of them 20 | } 21 | -------------------------------------------------------------------------------- /data/yara/CAPE/Arcom.yar: -------------------------------------------------------------------------------- 1 | rule Arcom 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/Arcom" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "Arcom Payload" 9 | 10 | strings: 11 | $a1 = "CVu3388fnek3W(3ij3fkp0930di" 12 | $a2 = "ZINGAWI2" 13 | $a3 = "clWebLightGoldenrodYellow" 14 | $a4 = "Ancestor for '%s' not found" wide 15 | $a5 = "Control-C hit" wide 16 | $a6 = {A3 24 25 21} 17 | 18 | condition: 19 | all of them 20 | } -------------------------------------------------------------------------------- /data/yara/CAPE/Arkei.yar: -------------------------------------------------------------------------------- 1 | rule Arkei 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Arkei Payload" 6 | cape_type = "Arkei Payload" 7 | strings: 8 | $string1 = "Windows_Antimalware_Host_System_Worker" 9 | $string2 = "Arkei" 10 | $string3 = "Bitcoin\\wallet.dat" 11 | $string4 = "Ethereum\\keystore" 12 | condition: 13 | uint16(0) == 0x5A4D and all of them 14 | } 15 | -------------------------------------------------------------------------------- /data/yara/CAPE/Atlas.yar: -------------------------------------------------------------------------------- 1 | rule Atlas 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Atlas Payload" 6 | cape_type = "Atlas Payload" 7 | strings: 8 | $a1 = "bye.bat" 9 | $a2 = "task=knock&id=%s&ver=%s x%s&disks=%s&other=%s&ip=%s&pub=" 10 | $a3 = "process call create \"cmd /c start vssadmin delete shadows /all /q" 11 | condition: 12 | uint16(0) == 0x5A4D and (all of ($a*)) 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/Azer.yar: -------------------------------------------------------------------------------- 1 | rule Azer 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Azer Payload" 6 | cape_type = "Azer Payload" 7 | strings: 8 | $a1 = "webmafia@asia.com" wide 9 | $a2 = "INTERESTING_INFORMACION_FOR_DECRYPT.TXT" wide 10 | $a3 = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ" //-----BEGIN PUBLIC KEY----- 11 | condition: 12 | uint16(0) == 0x5A4D and (all of ($a*)) 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/Azorult.yar: -------------------------------------------------------------------------------- 1 | rule Azorult 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Azorult Payload" 6 | cape_type = "Azorult Payload" 7 | strings: 8 | $code1 = {C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 01 00 00 8D 85 00 FE FF FF 89 47 1C C7 47 20 80 00 00 00 8D 85 80 FD FF FF 89 47 24 C7 47 28 80 00 00 00 8D 85 80 F5 FF FF 89 47 2C C7 47 30 00 08 00 00 8D 85 80 F1 FF FF 89 47 34 C7 47 38 00 04 00 00 57 68 00 00 00 90} 9 | $string1 = "SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),\"unixepoch\")" 10 | condition: 11 | uint16(0) == 0x5A4D and all of them 12 | } -------------------------------------------------------------------------------- /data/yara/CAPE/BackOffLoader.yar: -------------------------------------------------------------------------------- 1 | rule BackOffLoader 2 | { 3 | meta: 4 | author = "enzo" 5 | description = "BackOffLoader Payload" 6 | cape_type = "BackOffLoader Payload" 7 | strings: 8 | $str1 = "uid=%I64u&uinfo=%s&win=%d.%d&bits=%d&vers=%s&build=%s" 9 | $str2 = "&bots=" 10 | $str3 = "{b:%s|%s}" 11 | $str4 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)" 12 | condition: 13 | all of them 14 | } -------------------------------------------------------------------------------- /data/yara/CAPE/BackOffPOS.yar: -------------------------------------------------------------------------------- 1 | rule BackOffPOS 2 | { 3 | meta: 4 | author = "enzo" 5 | description = "BackOffPos Payload" 6 | cape_type = "BackOffPos Payload" 7 | strings: 8 | $str1 = "oprat=2&uid=%I64u&uinfo=%s&win=%d.%d&vers=%s" 9 | $str2 = "&logs=" 10 | $str3 = "&data=" 11 | $str4 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)" 12 | $str5 = "Content-Type: application/x-www-form-urlencoded" 13 | condition: 14 | all of them 15 | } -------------------------------------------------------------------------------- /data/yara/CAPE/BadRabbit.yar: -------------------------------------------------------------------------------- 1 | rule BadRabbit 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "BadRabbit Payload" 6 | cape_type = "BadRabbit Payload" 7 | strings: 8 | $a1 = "caforssztxqzf2nm.onion" wide 9 | $a2 = "schtasks /Create /SC once /TN drogon /RU SYSTEM" wide 10 | $a3 = "schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal" wide 11 | condition: 12 | uint16(0) == 0x5A4D and (all of ($a*)) 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/Bandook.yar: -------------------------------------------------------------------------------- 1 | rule Bandook 2 | { 3 | 4 | meta: 5 | author = " Kevin Breen " 6 | ref = "http://malwareconfig.com/stats/bandook" 7 | maltype = "Remote Access Trojan" 8 | filetype = "exe" 9 | cape_type = "Bandook Payload" 10 | 11 | strings: 12 | $a = "aaaaaa1|" 13 | $b = "aaaaaa2|" 14 | $c = "aaaaaa3|" 15 | $d = "aaaaaa4|" 16 | $e = "aaaaaa5|" 17 | $f = "%s%d.exe" 18 | $g = "astalavista" 19 | $h = "givemecache" 20 | $i = "%s\\system32\\drivers\\blogs\\*" 21 | $j = "bndk13me" 22 | 23 | 24 | 25 | condition: 26 | all of them 27 | } 28 | -------------------------------------------------------------------------------- /data/yara/CAPE/BitPaymer.yar: -------------------------------------------------------------------------------- 1 | rule BitPaymer 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "BitPaymer Payload" 6 | cape_type = "BitPaymer Payload" 7 | 8 | strings: 9 | $decrypt32 = {6A 40 58 3B C8 0F 4D C1 39 46 04 7D 50 53 57 8B F8 81 E7 3F 00 00 80 79 05 4F 83 CF C0 47 F7 DF 99 1B FF 83 E2 3F 03 C2 F7 DF C1 F8 06 03 F8 C1 E7 06 57} 10 | $antidefender = "TouchMeNot" wide 11 | condition: 12 | uint16(0) == 0x5A4D and all of them 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/BlackNix.yar: -------------------------------------------------------------------------------- 1 | rule BlackNix 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/BlackNix" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "BlackNix Payload" 9 | 10 | strings: 11 | $a1 = "SETTINGS" wide 12 | $a2 = "Mark Adler" 13 | $a3 = "Random-Number-Here" 14 | $a4 = "RemoteShell" 15 | $a5 = "SystemInfo" 16 | 17 | 18 | condition: 19 | all of them 20 | } -------------------------------------------------------------------------------- /data/yara/CAPE/BlackShades.yar: -------------------------------------------------------------------------------- 1 | rule BlackShades 2 | { 3 | meta: 4 | author = "Brian Wallace (@botnet_hunter)" 5 | ref = "http://blog.cylance.com/a-study-in-bots-blackshades-net" 6 | family = "blackshades" 7 | cape_type = "BlackShades Payload" 8 | 9 | strings: 10 | $string1 = "bss_server" 11 | $string2 = "txtChat" 12 | $string3 = "UDPFlood" 13 | condition: 14 | all of them 15 | } -------------------------------------------------------------------------------- /data/yara/CAPE/BlueBanana.yar: -------------------------------------------------------------------------------- 1 | rule BlueBanana 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/BlueBanana" 6 | maltype = "Remote Access Trojan" 7 | filetype = "Java" 8 | cape_type = "BlueBanana Payload" 9 | 10 | strings: 11 | $meta = "META-INF" 12 | $conf = "config.txt" 13 | $a = "a/a/a/a/f.class" 14 | $b = "a/a/a/a/l.class" 15 | $c = "a/a/a/b/q.class" 16 | $d = "a/a/a/b/v.class" 17 | 18 | 19 | condition: 20 | all of them 21 | } 22 | -------------------------------------------------------------------------------- /data/yara/CAPE/Bozok.yar: -------------------------------------------------------------------------------- 1 | rule Bozok 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/Bozok" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "Bozok Payload" 9 | 10 | strings: 11 | $a = "getVer" nocase 12 | $b = "StartVNC" nocase 13 | $c = "SendCamList" nocase 14 | $d = "untPlugin" nocase 15 | $e = "gethostbyname" nocase 16 | 17 | condition: 18 | all of them 19 | } -------------------------------------------------------------------------------- /data/yara/CAPE/Cerber.yar: -------------------------------------------------------------------------------- 1 | rule Cerber 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Cerber Payload" 6 | cape_type = "Cerber Payload" 7 | strings: 8 | $code1 = {33 C0 66 89 45 8? 8D 7D 8? AB AB AB AB AB [0-2] 66 AB 8D 45 8? [0-3] E8 ?? ?? 00 00} 9 | condition: 10 | //check for MZ Signature at offset 0 11 | uint16(0) == 0x5A4D and all of them 12 | } 13 | 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/ChChes.yar: -------------------------------------------------------------------------------- 1 | rule ChChes 2 | { 3 | meta: 4 | author = "kev" 5 | description = "ChChes Payload" 6 | cape_type = "ChChes Payload" 7 | strings: 8 | $payload1 = {55 8B EC 53 E8 ?? ?? FF FF E8 D? FF FF FF 05 ?? ?? ?? 00 33 DB 39 58 44 75 58 56 57 50 E8 57 00 00 00 59 8B F0 E8 A? FF FF FF B9 ?? ?? ?? 00 BF D0 1C ?? 00 2B CF 03 C1 39 5E 30 76 0F} 9 | $payload2 = {55 8B EC E8 ?? ?? FF FF E8 D? FF FF FF 05 ?? ?? ?? 00 83 78 44 00 75 40 56 57 50 E8 3E 00 00 00 59 8B F0 6A 00 FF 76 30 E8 A8 FF FF FF B9 ?? ?? ?? 00 BF 00 1A E1 00 2B CF 03 C1 50 FF 56 70} 10 | condition: 11 | $payload1 or $payload2 12 | } 13 | -------------------------------------------------------------------------------- /data/yara/CAPE/ClientMesh.yar: -------------------------------------------------------------------------------- 1 | rule ClientMesh 2 | { 3 | meta: 4 | author = "Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/ClientMesh" 6 | family = "torct" 7 | cape_type = "ClientMesh Payload" 8 | 9 | strings: 10 | $string1 = "machinedetails" 11 | $string2 = "MySettings" 12 | $string3 = "sendftppasswords" 13 | $string4 = "sendbrowserpasswords" 14 | $string5 = "arma2keyMass" 15 | $string6 = "keylogger" 16 | $conf = {00 00 00 00 00 00 00 00 00 7E} 17 | 18 | condition: 19 | all of them 20 | } 21 | -------------------------------------------------------------------------------- /data/yara/CAPE/Clop.yar: -------------------------------------------------------------------------------- 1 | rule Clop 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | cape_type = "Clop Payload" 6 | strings: 7 | $string1 = "%s%s.Cl0p" wide 8 | $string2 = "%s\\Cl0pReadMe.txt" wide 9 | condition: 10 | uint16(0) == 0x5A4D and all of them 11 | } 12 | -------------------------------------------------------------------------------- /data/yara/CAPE/CobaltStrikeBeacon.yar: -------------------------------------------------------------------------------- 1 | rule CobaltStrikeBeacon 2 | { 3 | meta: 4 | author = "JPCERTCC" 5 | description = "Cobalt Strike Payload" 6 | ref = "https://raw.githubusercontent.com/JPCERTCC/aa-tools/master/cobaltstrikescan.py" 7 | cape_type = "Cobalt Strike Payload" 8 | strings: 9 | $v1 = { 73 70 72 6E 67 00 } 10 | $v2 = { 69 69 69 69 69 69 69 69 } 11 | condition: $v1 and $v2 12 | } -------------------------------------------------------------------------------- /data/yara/CAPE/Codoso.yar: -------------------------------------------------------------------------------- 1 | rule Codoso 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Codoso Payload" 6 | cape_type = "Codoso Payload" 7 | strings: 8 | $a1 = "WHO_A_R_E_YOU?" 9 | $a2 = "DUDE_AM_I_SHARP-3.14159265358979" 10 | $a3 = "USERMODECMD" 11 | condition: 12 | uint16(0) == 0x5A4D and (all of ($a*)) 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/Cryptoshield.yar: -------------------------------------------------------------------------------- 1 | rule Cryptoshield 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Cryptoshield Payload" 6 | cape_type = "Cryptoshield Payload" 7 | strings: 8 | $a1 = "CRYPTOSHIELD." wide 9 | $a2 = "Click on Yes in the next window for restore work explorer" wide 10 | $a3 = "r_sp@india.com - SUPPORT" 11 | condition: 12 | uint16(0) == 0x5A4D and (all of ($a*)) 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/CyberGate.yar: -------------------------------------------------------------------------------- 1 | rule CyberGate 2 | { 3 | 4 | meta: 5 | author = " Kevin Breen " 6 | ref = "http://malwareconfig.com/stats/CyberGate" 7 | maltype = "Remote Access Trojan" 8 | filetype = "exe" 9 | cape_type = "CyberGate Payload" 10 | 11 | strings: 12 | $string1 = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23} 13 | $string2 = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23} 14 | $string3 = "EditSvr" 15 | $string4 = "TLoader" 16 | $string5 = "Stroks" 17 | $string6 = "####@####" 18 | $res1 = "XX-XX-XX-XX" 19 | $res2 = "CG-CG-CG-CG" 20 | 21 | condition: 22 | all of ($string*) and any of ($res*) 23 | } 24 | -------------------------------------------------------------------------------- /data/yara/CAPE/DarkComet.yar: -------------------------------------------------------------------------------- 1 | rule DarkComet 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/DarkComet" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "DarkComet Payload" 9 | 10 | strings: 11 | // Versions 2x 12 | $a1 = "#BOT#URLUpdate" 13 | $a2 = "Command successfully executed!" 14 | $a3 = "MUTEXNAME" wide 15 | $a4 = "NETDATA" wide 16 | // Versions 3x & 4x & 5x 17 | $b1 = "FastMM Borland Edition" 18 | $b2 = "%s, ClassID: %s" 19 | $b3 = "I wasn't able to open the hosts file" 20 | $b4 = "#BOT#VisitUrl" 21 | $b5 = "#KCMDDC" 22 | 23 | 24 | 25 | condition: 26 | all of ($a*) or all of ($b*) 27 | } 28 | -------------------------------------------------------------------------------- /data/yara/CAPE/DarkRAT.yar: -------------------------------------------------------------------------------- 1 | rule DarkRAT 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/DarkRAT" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "DarkRAT Payload" 9 | 10 | strings: 11 | $a = "@1906dark1996coder@" 12 | $b = "SHEmptyRecycleBinA" 13 | $c = "mciSendStringA" 14 | $d = "add_Shutdown" 15 | $e = "get_SaveMySettingsOnExit" 16 | $f = "get_SpecialDirectories" 17 | $g = "Client.My" 18 | 19 | condition: 20 | all of them 21 | } -------------------------------------------------------------------------------- /data/yara/CAPE/DoppelPaymer.yar: -------------------------------------------------------------------------------- 1 | rule DoppelPaymer 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "DoppelPaymer Payload" 6 | cape_type = "DoppelPaymer Payload" 7 | 8 | strings: 9 | $getproc32 = {81 FB ?? ?? ?? ?? 74 2D 8B CB E8 ?? ?? ?? ?? 85 C0 74 0C 8B C8 8B D7 E8 ?? ?? ?? ?? 5B 5F C3} 10 | $cmd_string = "Setup run\n" wide 11 | condition: 12 | uint16(0) == 0x5A4D and all of them 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/Dreambot.yar: -------------------------------------------------------------------------------- 1 | rule Dreambot 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Dreambot Payload" 6 | cape_type = "Dreambot Payload" 7 | strings: 8 | $a1 = {53 56 33 F6 33 DB C1 6C 24 0C 02 74 2F 8B 02 85 C0 75 11 83 7C 24 0C 02 76 0A 39 42 04 75 05 39 42 08 74 18 43 8A CB D3 C0 33 C6 33 44 24 10 8B F0 89 32 83 C2 04 FF 4C 24 0C 75 D1 5E 5B C2 08 00} 9 | $a2 = {53 33 C9 33 DB C1 6C 24 08 02 74 22 56 8B 02 85 C0 8B F0 74 18 33 C1 33 44 24 10 43 8A CB D3 C8 8B CE 89 02 83 C2 04 FF 4C 24 0C 75 E0 5E 5B C2 08 00} 10 | $b1 = "Oct 5 2016" 11 | $b2 = ".bss" 12 | condition: 13 | uint16(0) == 0x5A4D and (1 of ($a*)) and (all of ($b*)) 14 | } 15 | -------------------------------------------------------------------------------- /data/yara/CAPE/DridexLoader.yar: -------------------------------------------------------------------------------- 1 | rule DridexLoader 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Dridex v4 dropper C2 parsing function" 6 | cape_type = "DridexLoader Payload" 7 | 8 | strings: 9 | $c2parse_1 = {57 0F 95 C0 89 35 ?? ?? ?? ?? 88 46 04 33 FF 80 3D ?? ?? ?? ?? 00 76 54 8B 04 FD ?? ?? ?? ?? 8D 4D EC 83 65 F4 00 89 45 EC 66 8B 04 FD ?? ?? ?? ?? 66 89 45 F0 8D 45 F8 50} 10 | $c2parse_2 = {89 45 00 0F B7 53 04 89 10 0F B6 4B 0C 83 F9 0A 7F 03 8A 53 0C 0F B6 53 0C 85 D2 7E B7 8D 74 24 0C C7 44 24 08 00 00 00 00 8D 04 7F 8D 8C 00} 11 | $c2parse_3 = {89 08 66 39 1D ?? ?? ?? ?? A1 ?? ?? ?? ?? 0F 95 C1 88 48 04 80 3D ?? ?? ?? ?? 0A 77 05 A0 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? 00 56 8B F3 76 4E 66 8B 04 F5} 12 | $c2parse_4 = {0F B7 C0 89 01 A0 ?? ?? ?? ?? 3C 0A 77 ?? A0 ?? ?? ?? ?? A0 ?? ?? ?? ?? 57 33 FF 84 C0 74 ?? 56 BE} 13 | condition: 14 | uint16(0) == 0x5A4D and any of them 15 | } 16 | -------------------------------------------------------------------------------- /data/yara/CAPE/DridexV4.yar: -------------------------------------------------------------------------------- 1 | rule DridexV4 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Dridex v4 Payload" 6 | cape_type = "Dridex v4 Payload" 7 | 8 | strings: 9 | $decrypt32 = {6A 40 58 3B C8 0F 4D C1 39 46 04 7D 50 53 57 8B F8 81 E7 3F 00 00 80 79 05 4F 83 CF C0 47 F7 DF 99 1B FF 83 E2 3F 03 C2 F7 DF C1 F8 06 03 F8 C1 E7 06 57} 10 | $getproc32 = {81 FB ?? ?? ?? ?? 74 2D 8B CB E8 ?? ?? ?? ?? 85 C0 74 0C 8B C8 8B D7 E8 ?? ?? ?? ?? 5B 5F C3} 11 | $getproc64 = {81 FB ?? ?? ?? ?? 75 04 33 C0 EB 2D 8B CB E8 ?? ?? ?? ?? 48 85 C0 75 17 8B CB E8 ?? ?? ?? ?? 84 C0 74 E5 8B CB E8 ?? ?? ?? ?? 48 85 C0 74 D9 8B D7 48 8B C8 E8 ?? ?? ?? ?? 48 8B 5C 24 30 48 83 C4 20 5F C3} 12 | 13 | condition: 14 | uint16(0) == 0x5A4D and any of them 15 | } 16 | -------------------------------------------------------------------------------- /data/yara/CAPE/Emotet_Loader.yar: -------------------------------------------------------------------------------- 1 | rule Emotet_Loader 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Emotet Loader" 6 | cape_type = "Emotet Loader" 7 | strings: 8 | $antihook = {8B 15 ?? ?? ?? ?? 03 15 ?? ?? ?? ?? 89 95 28 FF FF FF A1 ?? ?? ?? ?? 2D 4D 01 00 00 A3 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 3B 0D ?? ?? ?? ?? 76 26 8B 95 18 FF FF FF 8B 42 38} 9 | condition: 10 | //check for MZ Signature at offset 0 11 | uint16(0) == 0x5A4D and any of them 12 | } -------------------------------------------------------------------------------- /data/yara/CAPE/Enfal.yar: -------------------------------------------------------------------------------- 1 | rule Enfal 2 | { 3 | meta: 4 | author = "kev" 5 | description = "Enfal configuration blob" 6 | cape_type = "Enfal Config" 7 | strings: 8 | $config1 = {BF 49 ?? 75 22 12 ?? 75 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C} 9 | 10 | condition: 11 | $config1 12 | } 13 | -------------------------------------------------------------------------------- /data/yara/CAPE/EvilGrab.yar: -------------------------------------------------------------------------------- 1 | rule EvilGrab 2 | { 3 | meta: 4 | author = "kev" 5 | description = "EvilGrab configuration function" 6 | cape_type = "EvilGrab Payload" 7 | strings: 8 | $configure1 = {8D 44 24 ?? 50 6A 01 E8 ?? ?? ?? ?? 85 C0 74 07 33 C0 E9 9? 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 07 59 73 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68} 9 | $configure2 = {8D 44 24 ?? 50 6A 01 E8 ?? ?? ?? ?? 85 C0 74 07 33 C0 E9 9? 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 07 59 73 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83} 10 | $configure3 = {8D 95 60 ?? ?? ?? 52 6A 01 E8 ?? ?? ?? ?? 85 C0 74 13 33 C0 8B 4D F4 64 89 0D 00 00 00 00 5F 5E 5B 8B E5 5D C3 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE} 11 | 12 | condition: 13 | //check for MZ Signature at offset 0 14 | uint16(0) == 0x5A4D 15 | 16 | and 17 | 18 | $configure1 or $configure2 or $configure3 19 | } 20 | -------------------------------------------------------------------------------- /data/yara/CAPE/Fareit.yar: -------------------------------------------------------------------------------- 1 | rule Fareit 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Fareit Payload" 6 | cape_type = "Fareit Payload" 7 | strings: 8 | $string1 = {0D 0A 09 09 0D 0A 0D 0A 09 20 20 20 3A 6B 74 6B 20 20 20 0D 0A 0D 0A 0D 0A 20 20 20 20 20 64 65 6C 20 20 20 20 09 20 25 31 20 20 0D 0A 09 69 66 20 20 09 09 20 65 78 69 73 74 20 09 20 20 20 25 31 20 20 09 20 20 67 6F 74 6F 20 09 0D 20 6B 74 6B 0D 0A 20 64 65 6C 20 09 20 20 25 30 20 00} 9 | condition: 10 | uint16(0) == 0x5A4D and any of ($string*) 11 | } 12 | 13 | -------------------------------------------------------------------------------- /data/yara/CAPE/Gandcrab.yar: -------------------------------------------------------------------------------- 1 | rule Gandcrab 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Gandcrab Payload" 6 | cape_type = "Gandcrab Payload" 7 | strings: 8 | $string1 = "GDCB-DECRYPT.txt" wide 9 | $string2 = "GandCrabGandCrabnomoreransom.coinomoreransom.bit" 10 | $string3 = "action=result&e_files=%d&e_size=%I64u&e_time=%d&" wide 11 | $string4 = "KRAB-DECRYPT.txt" wide 12 | condition: 13 | uint16(0) == 0x5A4D and any of ($string*) 14 | } -------------------------------------------------------------------------------- /data/yara/CAPE/Gootkit.yar: -------------------------------------------------------------------------------- 1 | rule Gootkit 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Gootkit Payload" 6 | cape_type = "Gootkit Payload" 7 | strings: 8 | $code1 = {C7 45 ?? ?? ?? 4? 00 C7 45 ?? ?? 10 40 00 C7 45 E? D8 ?? ?? 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 [1-2] 00 10 40 00 89 [5-6] 43 00 89 ?? ?? 68 E8 80 00 00 FF 15} 9 | condition: 10 | uint16(0) == 0x5A4D and all of them 11 | } 12 | -------------------------------------------------------------------------------- /data/yara/CAPE/Greame.yar: -------------------------------------------------------------------------------- 1 | rule Greame 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/Greame" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "Greame Payload" 9 | 10 | strings: 11 | $a = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23} 12 | $b = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23} 13 | $c = "EditSvr" 14 | $d = "TLoader" 15 | $e = "Stroks" 16 | $f = "Avenger by NhT" 17 | $g = "####@####" 18 | $h = "GREAME" 19 | 20 | 21 | 22 | condition: 23 | all of them 24 | } -------------------------------------------------------------------------------- /data/yara/CAPE/Hancitor.yar: -------------------------------------------------------------------------------- 1 | rule Hancitor 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Hancitor Payload" 6 | cape_type = "Hancitor Payload" 7 | strings: 8 | $decrypt1 = {33 C9 03 D6 C7 45 FC ?? ?? ?? ?? 8B 70 10 85 F6 74 12 90 8B C1 83 E0 03 8A 44 05 FC 30 04 11 41 3B CE 72 EF} 9 | $decrypt2 = {B9 08 00 00 00 8B 75 08 83 C4 04 8B F8 3B D1 76 10 8B C1 83 E0 07 8A 04 30 30 04 31 41 3B CA 72 F0 8D 45 FC} 10 | $decrypt3 = {8B 45 FC 33 D2 B9 08 00 00 00 F7 F1 8B 45 08 0F BE 0C 10 8B 55 08 03 55 FC 0F BE 02 33 C1 8B 4D 08 03 4D FC 88 01 EB C7} 11 | condition: 12 | uint16(0) == 0x5A4D and (any of ($decrypt*)) 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/HawkEye.yar: -------------------------------------------------------------------------------- 1 | rule HawkEye 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/HawkEye" 6 | maltype = "KeyLogger" 7 | filetype = "exe" 8 | cape_type = "HawkEye Payload" 9 | 10 | strings: 11 | $key = "HawkEyeKeylogger" wide 12 | $salt = "099u787978786" wide 13 | $string1 = "HawkEye_Keylogger" wide 14 | $string2 = "holdermail.txt" wide 15 | $string3 = "wallet.dat" wide 16 | $string4 = "Keylog Records" wide 17 | $string5 = "" wide 18 | $string6 = "\\pidloc.txt" wide 19 | $string7 = "BSPLIT" wide 20 | 21 | 22 | condition: 23 | $key and $salt and all of ($string*) 24 | } -------------------------------------------------------------------------------- /data/yara/CAPE/Hermes.yar: -------------------------------------------------------------------------------- 1 | rule Hermes 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Hermes Payload" 6 | cape_type = "Hermes Payload" 7 | strings: 8 | $ext = ".HRM" wide 9 | $vss = "vssadmin Delete" 10 | $email = "supportdecrypt@firemail.cc" wide 11 | condition: 12 | uint16(0) == 0x5A4D and all of ($*) 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/IcedID.yar: -------------------------------------------------------------------------------- 1 | rule IcedID 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "IcedID Payload" 6 | cape_type = "IcedID Payload" 7 | strings: 8 | $crypt1 = {8A 04 ?? D1 C? F7 D? D1 C? 81 E? 20 01 00 00 D1 C? F7 D? 81 E? 01 91 00 00 32 C? 88} 9 | $crypt2 = {8B 44 24 04 D1 C8 F7 D0 D1 C8 2D 20 01 00 00 D1 C0 F7 D0 2D 01 91 00 00 C3} 10 | $crypt3 = {41 00 8B C8 C1 E1 08 0F B6 C4 66 33 C8 66 89 4? 24 A1 ?? ?? 41 00 89 4? 20 A0 ?? ?? 41 00 D0 E8 32 4? 32} 11 | $major_ver = {0F B6 05 ?? ?? ?? ?? 6A ?? 6A 72 FF 75 0C 6A 70 50 FF 35 ?? ?? ?? ?? 8D 45 80 FF 35 ?? ?? ?? ?? 6A 63 FF 75 08 6A 67 50 FF 75 10 FF 15 ?? ?? ?? ?? 83 C4 38 8B E5 5D C3} 12 | condition: 13 | any of them 14 | } 15 | -------------------------------------------------------------------------------- /data/yara/CAPE/Imminent.yar: -------------------------------------------------------------------------------- 1 | rule Imminent 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Imminent Payload" 6 | cape_type = "Imminent Payload" 7 | strings: 8 | $string1 = "Imminent-Monitor" 9 | $string2 = "abuse@imminentmethods.net" 10 | $string3 = "SevenZipHelper" 11 | $string4 = "get_EntryPoint" 12 | $string5 = "WrapNonExceptionThrows" 13 | condition: 14 | uint16(0) == 0x5A4D and all of them 15 | } 16 | -------------------------------------------------------------------------------- /data/yara/CAPE/Infinity.yar: -------------------------------------------------------------------------------- 1 | rule Infinity 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/Infinity" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "Infinity Payload" 9 | 10 | strings: 11 | $a = "CRYPTPROTECT_PROMPTSTRUCT" 12 | $b = "discomouse" 13 | $c = "GetDeepInfo" 14 | $d = "AES_Encrypt" 15 | $e = "StartUDPFlood" 16 | $f = "BATScripting" wide 17 | $g = "FBqINhRdpgnqATxJ.html" wide 18 | $i = "magic_key" wide 19 | 20 | condition: 21 | all of them 22 | } 23 | -------------------------------------------------------------------------------- /data/yara/CAPE/Jaff.yar: -------------------------------------------------------------------------------- 1 | rule Jaff 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Jaff Payload" 6 | cape_type = "Jaff Payload" 7 | strings: 8 | $a1 = "CryptGenKey" 9 | $a2 = "353260540318613681395633061841341670181307185694827316660016508" 10 | $b1 = "jaff" 11 | $b2 = "2~1c0q4t7" 12 | condition: 13 | uint16(0) == 0x5A4D and (any of ($a*) ) and (1 of ($b*)) 14 | } 15 | -------------------------------------------------------------------------------- /data/yara/CAPE/JavaDropper.yar: -------------------------------------------------------------------------------- 1 | rule JavaDropper 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/AlienSpy" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "JavaDropper Payload" 9 | 10 | strings: 11 | $jar = "META-INF/MANIFEST.MF" 12 | 13 | $b1 = "config.ini" 14 | $b2 = "password.ini" 15 | 16 | $c1 = "stub/stub.dll" 17 | 18 | $d1 = "c.dat" 19 | 20 | condition: 21 | $jar and (all of ($b*) or all of ($c*) or all of ($d*)) 22 | } 23 | -------------------------------------------------------------------------------- /data/yara/CAPE/KeyBase.yar: -------------------------------------------------------------------------------- 1 | rule KeyBase 2 | { 3 | meta: 4 | description = "Identifies KeyBase aka Kibex." 5 | author = "@bartblaze" 6 | date = "2019-02" 7 | hash = "cafe2d12fb9252925fbd1acb9b7648d6" 8 | tlp = "White" 9 | cape_type = "KeyBase Payload" 10 | 11 | strings: 12 | $s1 = " End:]" ascii wide 13 | $s2 = "Keystrokes typed:" ascii wide 14 | $s3 = "Machine Time:" ascii wide 15 | $s4 = "Text:" ascii wide 16 | $s5 = "Time:" ascii wide 17 | $s6 = "Window title:" ascii wide 18 | 19 | $x1 = "&application=" ascii wide 20 | $x2 = "&clipboardtext=" ascii wide 21 | $x3 = "&keystrokestyped=" ascii wide 22 | $x4 = "&link=" ascii wide 23 | $x5 = "&username=" ascii wide 24 | $x6 = "&windowtitle=" ascii wide 25 | $x7 = "=drowssap&" ascii wide 26 | $x8 = "=emitenihcam&" ascii wide 27 | 28 | condition: 29 | uint16(0) == 0x5a4d and ( 30 | 5 of ($s*) or 6 of ($x*) or 31 | ( 3 of ($s*) and 3 of ($x*) ) 32 | ) 33 | } 34 | -------------------------------------------------------------------------------- /data/yara/CAPE/Kovter.yar: -------------------------------------------------------------------------------- 1 | rule Kovter 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Kovter Payload" 6 | cape_type = "Kovter Payload" 7 | strings: 8 | $a1 = "chkok" 9 | $a2 = "k2Tdgo" 10 | $a3 = "13_13_13" 11 | $a4 = "Win Server 2008 R2" 12 | condition: 13 | uint16(0) == 0x5A4D and (all of ($a*)) 14 | } 15 | -------------------------------------------------------------------------------- /data/yara/CAPE/Kronos.yar: -------------------------------------------------------------------------------- 1 | rule Kronos 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Kronos Payload" 6 | cape_type = "Kronos Payload" 7 | strings: 8 | $a1 = "user_pref(\"network.cookie.cookieBehavior\"" 9 | $a2 = "T0E0H4U0X3A3D4D8" 10 | $a3 = "wow64cpu.dll" wide 11 | $a4 = "Kronos" fullword ascii wide 12 | condition: 13 | uint16(0) == 0x5A4D and (any of ($a*)) 14 | } 15 | -------------------------------------------------------------------------------- /data/yara/CAPE/Locky.yar: -------------------------------------------------------------------------------- 1 | rule Locky 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Locky Payload" 6 | cape_type = "Locky Payload" 7 | strings: 8 | $string1 = "wallet.dat" wide 9 | $string2 = "Locky_recover" wide 10 | $string3 = "opt321" wide 11 | condition: 12 | //check for MZ Signature at offset 0 13 | uint16(0) == 0x5A4D and all of them 14 | } 15 | 16 | -------------------------------------------------------------------------------- /data/yara/CAPE/Loki.yar: -------------------------------------------------------------------------------- 1 | rule Loki 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Loki Payload" 6 | cape_type = "Loki Payload" 7 | strings: 8 | $a1 = "DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW" 9 | $a2 = "last_compatible_version" 10 | condition: 11 | uint16(0) == 0x5A4D and (all of ($a*)) 12 | } 13 | -------------------------------------------------------------------------------- /data/yara/CAPE/LostDoor.yar: -------------------------------------------------------------------------------- 1 | rule LostDoor 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/LostDoor" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "LostDoor Payload" 9 | 10 | strings: 11 | $a0 = {0D 0A 2A 45 44 49 54 5F 53 45 52 56 45 52 2A 0D 0A} 12 | $a1 = "*mlt* = %" 13 | $a2 = "*ip* = %" 14 | $a3 = "*victimo* = %" 15 | $a4 = "*name* = %" 16 | $b5 = "[START]" 17 | $b6 = "[DATA]" 18 | $b7 = "We Control Your Digital World" wide ascii 19 | $b8 = "RC4Initialize" wide ascii 20 | $b9 = "RC4Decrypt" wide ascii 21 | 22 | condition: 23 | all of ($a*) or all of ($b*) 24 | } -------------------------------------------------------------------------------- /data/yara/CAPE/LuminosityLink.yar: -------------------------------------------------------------------------------- 1 | rule LuminosityLink 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/LuminosityLink" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "LuminosityLink Payload" 9 | 10 | strings: 11 | $a = "SMARTLOGS" wide 12 | $b = "RUNPE" wide 13 | $c = "b.Resources" wide 14 | $d = "CLIENTINFO*" wide 15 | $e = "Invalid Webcam Driver Download URL, or Failed to Download File!" wide 16 | $f = "Proactive Anti-Malware has been manually activated!" wide 17 | $g = "REMOVEGUARD" wide 18 | $h = "C0n1f8" wide 19 | $i = "Luminosity" wide 20 | $j = "LuminosityCryptoMiner" wide 21 | $k = "MANAGER*CLIENTDETAILS*" wide 22 | 23 | condition: 24 | all of them 25 | } -------------------------------------------------------------------------------- /data/yara/CAPE/LuxNet.yar: -------------------------------------------------------------------------------- 1 | rule LuxNet 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/LuxNet" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "LuxNet Payload" 9 | 10 | strings: 11 | $a = "GetHashCode" 12 | $b = "Activator" 13 | $c = "WebClient" 14 | $d = "op_Equality" 15 | $e = "dickcursor.cur" wide 16 | $f = "{0}|{1}|{2}" wide 17 | 18 | condition: 19 | all of them 20 | } 21 | -------------------------------------------------------------------------------- /data/yara/CAPE/Magniber.yar: -------------------------------------------------------------------------------- 1 | rule Magniber 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Magniber Payload" 6 | cape_type = "Magniber Payload" 7 | strings: 8 | $a1 = {8B 55 FC 83 C2 01 89 55 FC 8B 45 FC 3B 45 08 7D 45 6A 01 6A 00 E8 26 FF FF FF 83 C4 08 89 45 F4 83 7D F4 00 75 18 6A 7A 6A 61 E8 11 FF FF FF 83 C4 08 8B 4D FC 8B 55 F8 66 89 04 4A EB 16} 9 | condition: 10 | uint16(0) == 0x5A4D and (all of ($a*)) 11 | } 12 | -------------------------------------------------------------------------------- /data/yara/CAPE/Mangzamel.yar: -------------------------------------------------------------------------------- 1 | rule Mangzamel 2 | { 3 | meta: 4 | cape_type = "Mangzamel Payload" 5 | description = "This rule will flag on the 4 byte xor loop in later copies of mangzamel with embedded tagging" 6 | reference = "Mangzamel Samples" 7 | author = "David Cannings" 8 | date = "2014-09" 9 | filetype = "pe" 10 | 11 | strings: 12 | $xor1 = {8B 1E 83 C0 04 33 D9 83 C6 04 89 58 FC 4A 75 F0} 13 | $xor2 = {8B 08 83 C0 04 33 4D 14 89 0A 83 C2 04 4F 75 F0} 14 | $xor3 = {53 8B 18 83 C1 04 33 DA 83 C0 04 89 59 FC 4E 75 F0 5B} 15 | 16 | condition: 17 | any of them 18 | } -------------------------------------------------------------------------------- /data/yara/CAPE/MedusaLocker.yar: -------------------------------------------------------------------------------- 1 | rule MedusaLocker { 2 | meta: 3 | author = "ditekshen" 4 | description = "MedusaLocker Ransomware Payload" 5 | cape_type = "MedusaLocker Payload" 6 | strings: 7 | $s1 = "\\MedusaLockerInfo\\MedusaLockerProject\\MedusaLocker\\Release\\MedusaLocker.pdb" ascii 8 | $s2 = "SOFTWARE\\Medusa" wide 9 | $s3 = "{8761ABBD-7F85-42EE-B272-A76179687C63}" fullword wide 10 | $s4 = "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" fullword wide 11 | $s5 = "{6EDD6D74-C007-4E75-B76A-E5740995E24C}" fullword wide 12 | $s6 = "vssadmin.exe delete" wide nocase 13 | $s7 = "bcdedit.exe /set {default}" wide 14 | $s8 = "wbadmin delete systemstatebackup" wide nocase 15 | $s9 = ".exe,.dll,.sys,.ini,.lnk,.rdp,.encrypted" fullword ascii 16 | $s10 = "[LOCKER] " wide 17 | condition: 18 | uint16(0) == 0x5a4d and 6 of them 19 | } 20 | -------------------------------------------------------------------------------- /data/yara/CAPE/MegaCortex.yar: -------------------------------------------------------------------------------- 1 | rule MegaCortex 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "MegaCortex Payload" 6 | cape_type = "MegaCortex Payload" 7 | strings: 8 | $str1 = ".megac0rtx" ascii wide 9 | $str2 = "vssadmin delete shadows /all" ascii 10 | $sha256 = {98 2F 8A 42 91 44 37 71 CF FB C0 B5 A5 DB B5 E9} 11 | condition: 12 | uint16(0) == 0x5A4D and all of them 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/Mole.yar: -------------------------------------------------------------------------------- 1 | rule Mole 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Mole Payload" 6 | cape_type = "Mole Payload" 7 | strings: 8 | $a1 = ".mole0" wide 9 | $a2 = "_HELP_INSTRUCTION.TXT" wide 10 | $a3 = "-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ" 11 | condition: 12 | uint16(0) == 0x5A4D and (all of ($a*)) 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/NanoCore.yar: -------------------------------------------------------------------------------- 1 | rule NanoCore 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/NanoCore" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "NanoCore Payload" 9 | 10 | strings: 11 | $a = "NanoCore" 12 | $b = "ClientPlugin" 13 | $c = "ProjectData" 14 | $d = "DESCrypto" 15 | $e = "KeepAlive" 16 | $f = "IPNETROW" 17 | $g = "LogClientMessage" 18 | $h = "|ClientHost" 19 | $i = "get_Connected" 20 | $j = "#=q" 21 | $key = {43 6f 24 cb 95 30 38 39} 22 | 23 | 24 | condition: 25 | 6 of them 26 | } 27 | -------------------------------------------------------------------------------- /data/yara/CAPE/NanoLocker.yar: -------------------------------------------------------------------------------- 1 | rule NanoLocker 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "NanoLocker Payload" 6 | cape_type = "NanoLocker Payload" 7 | strings: 8 | $a1 = "NanoLocker" 9 | $a2 = "$humanDeadline" 10 | $a3 = "Decryptor.lnk" 11 | condition: 12 | uint16(0) == 0x5A4D and (all of ($a*)) 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/NetTraveler.yar: -------------------------------------------------------------------------------- 1 | rule NetTraveler 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "NetTraveler Payload" 6 | cape_type = "NetTraveler Payload" 7 | strings: 8 | $string1 = {4E 61 6D 65 3A 09 25 73 0D 0A 54 79 70 65 3A 09 25 73 0D 0A 53 65 72 76 65 72 3A 09 25 73 0D 0A} // "Name: %s Type: %s Server: %s " 9 | $string2 = "Password Expiried Time:" 10 | $string3 = "Memory: Total:%dMB,Left:%dMB (for %.2f%s)" 11 | 12 | condition: 13 | uint16(0) == 0x5A4D and all of them 14 | } 15 | -------------------------------------------------------------------------------- /data/yara/CAPE/NetWire.yar: -------------------------------------------------------------------------------- 1 | rule NetWire 2 | { 3 | meta: 4 | author = " Kevin Breen & David Cannings" 5 | ref = "http://malwareconfig.com/stats/NetWire" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "NetWire Payload" 9 | 10 | strings: 11 | 12 | $exe1 = "%.2d-%.2d-%.4d" 13 | $exe2 = "%s%.2d-%.2d-%.4d" 14 | $exe3 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]" 15 | $exe4 = "wcnwClass" 16 | $exe5 = "[Ctrl+%c]" 17 | $exe6 = "SYSTEM\\CurrentControlSet\\Control\\ProductOptions" 18 | $exe7 = "%s\\.purple\\accounts.xml" 19 | 20 | condition: 21 | all of them 22 | } 23 | -------------------------------------------------------------------------------- /data/yara/CAPE/OlympicDestroyer.yar: -------------------------------------------------------------------------------- 1 | rule OlympicDestroyer 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "OlympicDestroyer Payload" 6 | cape_type = "OlympicDestroyer Payload" 7 | strings: 8 | $string1 = "SELECT origin_url, username_value, password_value FROM logins" 9 | $string2 = "API call with %s database connection pointer" 10 | $string3 = "os_win.c:%d: (%lu) %s(%s) - %s" 11 | condition: 12 | uint16(0) == 0x5A4D and all of ($string*) 13 | } -------------------------------------------------------------------------------- /data/yara/CAPE/Pandora.yar: -------------------------------------------------------------------------------- 1 | rule Pandora 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/Pandora" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "Pandora Payload" 9 | 10 | strings: 11 | $a = "Can't get the Windows version" 12 | $b = "=M=Q=U=Y=]=a=e=i=m=q=u=y=}=" 13 | $c = "JPEG error #%d" wide 14 | $d = "Cannot assign a %s to a %s" wide 15 | $g = "%s, ProgID:" 16 | $h = "clave" 17 | $i = "Shell_TrayWnd" 18 | $j = "melt.bat" 19 | $k = "\\StubPath" 20 | $l = "\\logs.dat" 21 | $m = "1027|Operation has been canceled!" 22 | $n = "466|You need to plug-in! Double click to install... |" 23 | $0 = "33|[Keylogger Not Activated!]" 24 | 25 | condition: 26 | all of them 27 | } -------------------------------------------------------------------------------- /data/yara/CAPE/Paradox.yar: -------------------------------------------------------------------------------- 1 | rule Paradox 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/Paradox" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "Paradox Payload" 9 | 10 | strings: 11 | $a = "ParadoxRAT" 12 | $b = "Form1" 13 | $c = "StartRMCam" 14 | $d = "Flooders" 15 | $e = "SlowLaris" 16 | $f = "SHITEMID" 17 | $g = "set_Remote_Chat" 18 | 19 | condition: 20 | all of them 21 | } 22 | -------------------------------------------------------------------------------- /data/yara/CAPE/PatchWork.yar: -------------------------------------------------------------------------------- 1 | rule PatchWork 2 | { 3 | meta: 4 | description = "PatchWork" 5 | author = "@avman1995" 6 | reference = "https://app.any.run/tasks/7ef05c98-a4d4-47ff-86e5-8386f8787224" 7 | date = "2019/01" 8 | maltype = "APT" 9 | cape_type = "PatchWork Payload" 10 | 11 | strings: 12 | $string1 = "AppId" 13 | $string2 = "AXE: #" 14 | $string3 = "Bld: %s.%s.%s" 15 | $string4 = "%s@%s %s" 16 | $string5 = "c:\\intel\\" 17 | 18 | condition: 19 | all of ($string*) 20 | } -------------------------------------------------------------------------------- /data/yara/CAPE/PetrWrap.yar: -------------------------------------------------------------------------------- 1 | rule PetrWrap 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "PetrWrap Payload" 6 | cape_type = "PetrWrap Payload" 7 | strings: 8 | $a1 = "http://petya3jxfp2f7g3i.onion/" 9 | $a2 = "http://petya3sen7dyko2n.onion" 10 | 11 | $b1 = "http://mischapuk6hyrn72.onion/" 12 | $b2 = "http://mischa5xyix2mrhd.onion/" 13 | condition: 14 | uint16(0) == 0x5A4D and (any of ($a*)) and (any of ($b*)) 15 | } 16 | -------------------------------------------------------------------------------- /data/yara/CAPE/Petya.yar: -------------------------------------------------------------------------------- 1 | rule Petya 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Petya Payload" 6 | cape_type = "Petya Payload" 7 | strings: 8 | $a1 = "CHKDSK is repairing sector" 9 | $a2 = "wowsmith123456@posteo.net" 10 | $a3 = "1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX" wide 11 | condition: 12 | uint16(0) == 0x5A4D and (all of ($a*)) 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/Phorpiex.yar: -------------------------------------------------------------------------------- 1 | rule Phorpiex 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Phorpiex Payload" 6 | cape_type = "Phorpiex Payload" 7 | strings: 8 | $code = {99 B9 FF 00 00 00 F7 F9 83 C2 01 52 E8 0F 0D 00 00 99 B9 FF 00 00 00 F7 F9 83 C2 01 52 E8 FE 0C 00 00 99 B9 FF 00 00 00 F7 F9 83 C2 01 52 E8 ED 0C 00 00 99} 9 | condition: 10 | uint16(0) == 0x5A4D and ($code) 11 | } 12 | -------------------------------------------------------------------------------- /data/yara/CAPE/Plasma.yar: -------------------------------------------------------------------------------- 1 | rule Plasma 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/Plasma" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "Plasma Payload" 9 | 10 | strings: 11 | $a = "Miner: Failed to Inject." wide 12 | $b = "Started GPU Mining on:" wide 13 | $c = "BK: Hard Bot Killer Ran Successfully!" wide 14 | $d = "Uploaded Keylogs Successfully!" wide 15 | $e = "No Slowloris Attack is Running!" wide 16 | $f = "An ARME Attack is Already Running on" wide 17 | $g = "Proactive Bot Killer Enabled!" wide 18 | $h = "PlasmaRAT" wide ascii 19 | $i = "AntiEverything" wide ascii 20 | 21 | condition: 22 | all of them 23 | } -------------------------------------------------------------------------------- /data/yara/CAPE/PoisonIvy.yar: -------------------------------------------------------------------------------- 1 | rule PoisonIvy 2 | { 3 | // Modified for CAPE in 2017/03 4 | meta: 5 | author = "Kevin Breen " 6 | ref = "http://malwareconfig.com/stats/PoisonIvy" 7 | maltype = "Remote Access Trojan" 8 | filetype = "exe" 9 | cape_type = "PoisonIvy Payload" 10 | 11 | strings: 12 | //$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04} 13 | $stub = "StubPath" 14 | $string1 = "CONNECT %s:%i HTTP/1.0" 15 | $string2 = "ws2_32" 16 | $string3 = "cks=u" 17 | $string4 = "thj@h" 18 | //$string5 = "advpack" 19 | $regvalue1 = "SOFTWARE\\Classes\\http\\shell\\open\\command" 20 | $regvalue2 = "Software\\Microsoft\\Active Setup\\Installed Components\\" 21 | condition: 22 | //$stub at 0x1620 and all of ($string*) or (all of them) 23 | all of ($string*) or ($stub and all of ($regvalue*)) 24 | } 25 | -------------------------------------------------------------------------------- /data/yara/CAPE/PowerPool.yar: -------------------------------------------------------------------------------- 1 | rule PowerPool { 2 | meta: 3 | author = "ditekshen" 4 | description = "PowerPool Stage 1 Backdoor Payload" 5 | cape_type = "PowerPool Payload" 6 | strings: 7 | $str1 = "cmd /c powershell.exe " wide 8 | $str2 = "rar.exe a -r %s.rar" wide 9 | $str3 = "MyDemonMutex%d" wide 10 | $str4 = "CMD COMMAND EXCUTE ERROR!" ascii 11 | $str5 = "/?id=%s&info=%s" wide 12 | $str6 = "MyScreen.jpg" wide 13 | $str7 = "proxy.log" wide 14 | condition: 15 | uint16(0) == 0x5A4D and 5 of them 16 | } 17 | -------------------------------------------------------------------------------- /data/yara/CAPE/PredatorPain.yar: -------------------------------------------------------------------------------- 1 | rule PredatorPain 2 | { 3 | 4 | meta: 5 | author = " Kevin Breen " 6 | ref = "http://malwareconfig.com/stats/PredatorPain" 7 | maltype = "Remote Access Trojan" 8 | filetype = "exe" 9 | cape_type = "PredatorPain Payload" 10 | 11 | strings: 12 | $string1 = "holderwb.txt" wide 13 | $string3 = "There is a file attached to this email" wide 14 | $string4 = "screens\\screenshot" wide 15 | $string5 = "Disablelogger" wide 16 | $string6 = "\\pidloc.txt" wide 17 | $string7 = "clearie" wide 18 | $string8 = "clearff" wide 19 | $string9 = "emails should be sent to you shortly" wide 20 | $string10 = "jagex_cache\\regPin" wide 21 | $string11 = "open=Sys.exe" wide 22 | $ver1 = "PredatorLogger" wide 23 | $ver2 = "EncryptedCredentials" wide 24 | $ver3 = "Predator Pain" wide 25 | 26 | condition: 27 | 7 of ($string*) and any of ($ver*) 28 | } -------------------------------------------------------------------------------- /data/yara/CAPE/Punisher.yar: -------------------------------------------------------------------------------- 1 | rule Punisher 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/Punisher" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "Punisher Payload" 9 | 10 | strings: 11 | $a = "abccba" 12 | $b = {5C 00 68 00 66 00 68 00 2E 00 76 00 62 00 73} 13 | $c = {5C 00 73 00 63 00 2E 00 76 00 62 00 73} 14 | $d = "SpyTheSpy" wide ascii 15 | $e = "wireshark" wide 16 | $f = "apateDNS" wide 17 | $g = "abccbaDanabccb" 18 | 19 | condition: 20 | all of them 21 | } 22 | -------------------------------------------------------------------------------- /data/yara/CAPE/PythoRAT.yar: -------------------------------------------------------------------------------- 1 | rule PythoRAT 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/PythoRAT" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "PythoRAT Payload" 9 | 10 | strings: 11 | $a = "TKeylogger" 12 | $b = "uFileTransfer" 13 | $c = "TTDownload" 14 | $d = "SETTINGS" 15 | $e = "Unknown" wide 16 | $f = "#@#@#" 17 | $g = "PluginData" 18 | $i = "OnPluginMessage" 19 | 20 | condition: 21 | all of them 22 | } 23 | -------------------------------------------------------------------------------- /data/yara/CAPE/QRat.yar: -------------------------------------------------------------------------------- 1 | rule QRat 2 | { 3 | meta: 4 | author = "Kevin Breen @KevTheHermit" 5 | ref = "http://malwareconfig.com" 6 | maltype = "Remote Access Trojan" 7 | filetype = "jar" 8 | cape_type = "QRat Payload" 9 | 10 | strings: 11 | $a0 = "e-data" 12 | $a1 = "quaverse/crypter" 13 | $a2 = "Qrypt.class" 14 | $a3 = "Jarizer.class" 15 | $a4 = "URLConnection.class" 16 | 17 | 18 | condition: 19 | 4 of them 20 | 21 | 22 | } -------------------------------------------------------------------------------- /data/yara/CAPE/QakBot.yar: -------------------------------------------------------------------------------- 1 | rule QakBot 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "QakBot Payload" 6 | cape_type = "QakBot Payload" 7 | strings: 8 | $crypto = {8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 C9 00 FF FF FF 41} 9 | $anti_sandbox = {8D 4D FC 51 E8 ?? ?? ?? ?? 83 C4 04 E8 ?? ?? ?? ?? 85 C0 7E 07 C7 45 F8 00 00 00 00 33 D2 74 02 EB FA 8B 45 F8 EB 08 33 C0 74 02 EB FA 33 C0 8B E5 5D C3} 10 | $decrypt_config1 = {FF 37 83 C3 EC 53 8B 5D 0C 8D 43 14 50 6A 14 53 E8 ?? ?? ?? ?? 83 C4 14 85 C0 ?? 26 ?? ?? 86 20 02 00 00 66 85 C0 ?? ?? FF 37 FF 75 10 53} 11 | $decrypt_config2 = {8B 45 08 8B 88 24 04 00 00 51 8B 55 10 83 EA 14 52 8B 45 0C 83 C0 14 50 6A 14 8B 4D 0C 51 E8 6C 08 00 00} 12 | condition: 13 | uint16(0) == 0x5A4D and any of ($*) 14 | } 15 | -------------------------------------------------------------------------------- /data/yara/CAPE/RCSession.yar: -------------------------------------------------------------------------------- 1 | rule RCSession 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "RCSession Payload" 6 | cape_type = "RCSession Payload" 7 | strings: 8 | $a1 = {56 33 F6 39 74 24 08 7E 4C 53 57 8B F8 2B FA 8B C6 25 03 00 00 80 79 05 48 83 C8 FC 40 83 E8 00 74 19 48 74 0F 48 74 05 6B C9 09 EB 15 8B C1 C1 E8 02 EB 03 8D 04 09 2B C8} 9 | $a2 = {83 C4 10 85 C0 74 ?? BE ?? ?? ?? ?? 89 74 24 10 E8 ?? ?? ?? ?? 6A 03 68 48 0B 00 00 56 53 57 68 02 00 00 80 E8 ?? ?? ?? ?? 83 C4 18 85 C0 74 18 E8 ?? ?? ?? ?? 6A 03 68 48} 10 | condition: 11 | (any of ($a*)) 12 | } 13 | -------------------------------------------------------------------------------- /data/yara/CAPE/Ramnit.yar: -------------------------------------------------------------------------------- 1 | rule Ramnit 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Ramnit Payload" 6 | cape_type = "Ramnit Payload" 7 | strings: 8 | $DGA = {33 D2 B9 1D F3 01 00 F7 F1 8B C8 B8 A7 41 00 00 F7 E2 8B D1 8B C8 B8 14 0B 00 00 F7 E2 2B C8 33 D2 8B C1 8B} 9 | $xor_loop = {83 7D 0C 00 74 27 83 7D 14 00 74 21 8B 4D 0C 8B 7D 08 8B 75 10 BA 00 00 00 00 0B D2 75 04 8B 55 14 4A 8A 1C 32 32 1F 88 1F 47 4A E2 ED} 10 | $id_string = "{%08X-%04X-%04X-%04X-%08X%04X}" 11 | condition: 12 | uint16(0) == 0x5A4D and all of ($*) 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/RedLeaf.yar: -------------------------------------------------------------------------------- 1 | rule RedLeaf 2 | { 3 | meta: 4 | author = "kev" 5 | description = "RedLeaf crypto function" 6 | cape_type = "RedLeaf Payload" 7 | strings: 8 | $crypto = {6A 10 B8 ?? ?? ?? 10 E8 ?? ?? 01 00 8B F1 89 75 E4 8B 7D 08 83 CF 07 81 FF FE FF FF 7F 76 05 8B 7D 08 EB 29 8B 4E 14 89 4D EC D1 6D EC 8B C7 33 D2 6A 03 5B F7 F3 8B 55 EC 3B D0 76 10 BF FE FF FF} 9 | condition: 10 | $crypto 11 | } 12 | 13 | -------------------------------------------------------------------------------- /data/yara/CAPE/Redsip.yar: -------------------------------------------------------------------------------- 1 | rule Redsip 2 | { 3 | meta: 4 | author = "kev" 5 | description = "Redsip Payload" 6 | cape_type = "Redsip Payload" 7 | strings: 8 | $payload1 = {8B 45 F8 99 B9 0A 00 00 00 F7 F9 85 D2 75 1F 8A 55 10 88 55 FF 8B 45 08 03 45 F8 0F BE 08 0F BE 55 FF 33 CA 8B 45 08 03 45 F8 88 08 EB C1} 9 | condition: 10 | uint16(0) == 0x5A4D and (any of ($payload*)) 11 | } 12 | -------------------------------------------------------------------------------- /data/yara/CAPE/Remcos.yar: -------------------------------------------------------------------------------- 1 | rule Remcos 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Remcos Payload" 6 | cape_type = "Remcos Payload" 7 | strings: 8 | $name = "Remcos" nocase 9 | $time = "%02i:%02i:%02i:%03i" 10 | $crypto = {0F B6 [1-7] 8B 45 08 [0-2] 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 ?? ?? FF FF 30 06 47 3B 7D 0C 72} 11 | condition: 12 | uint16(0) == 0x5A4D and all of ($*) 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/Retefe.yar: -------------------------------------------------------------------------------- 1 | rule Retefe 2 | { 3 | meta: 4 | author = "Tomasuh" 5 | description = "Retefe Payload" 6 | cape_type = "Retefe Payload" 7 | strings: 8 | $retefe_encoded_buffer = {48 8b 44 24 20 8b 40 08 48 8b 4c 24 20 48 8d 15} 9 | $retefe_xor_seed = {24 20 48 8b 44 24 20 C7 40 08} 10 | $retefe_xor_seed_2ndarg = {89 54 24 10 48 89 4c 24 08 48 83 ec 58 ba} 11 | $retefe_shift_and_sub_match = {c1 e0 ?? b9} 12 | condition: 13 | uint16(0) == 0x5A4D and (all of them) 14 | } 15 | -------------------------------------------------------------------------------- /data/yara/CAPE/RokRat.yar: -------------------------------------------------------------------------------- 1 | rule RokRat 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "RokRat Payload" 6 | cape_type = "RokRat Payload" 7 | strings: 8 | $code1 = {8B 57 04 8D 7F 04 33 57 FC 81 E2 FF FF FF 7F 33 57 FC 8B C2 24 01 0F B6 C0 F7 D8 1B C0 D1 EA 25 DF B0 08 99 33 87 30 06 00 00 33 C2 89 87 3C F6 FF FF 83 E9 01 75 C9} 9 | $string1 = "/pho_%s_%d.jpg" wide 10 | condition: 11 | uint16(0) == 0x5A4D and (any of ($code*)) and (any of ($string*)) 12 | } -------------------------------------------------------------------------------- /data/yara/CAPE/Ryuk.yar: -------------------------------------------------------------------------------- 1 | rule Ryuk 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Ryuk Payload" 6 | cape_type = "Ryuk Payload" 7 | strings: 8 | $ext = ".RYK" wide 9 | $readme = "RyukReadMe.txt" wide 10 | $main = "InvokeMainViaCRT" 11 | $code = {48 8B 4D 10 48 8B 03 48 C1 E8 07 C1 E0 04 F7 D0 33 41 08 83 E0 10 31 41 08 48 8B 4D 10 48 8B 03 48 C1 E8 09 C1 E0 03 F7 D0 33 41 08 83 E0 08 31 41 08} 12 | condition: 13 | uint16(0) == 0x5A4D and 3 of ($*) 14 | } 15 | -------------------------------------------------------------------------------- /data/yara/CAPE/Scarab.yar: -------------------------------------------------------------------------------- 1 | rule Scarab 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Scarab Payload" 6 | cape_type = "Scarab Payload" 7 | strings: 8 | $crypt1 = {8B D8 32 1A 0F B6 DB 8B 1C 9F C1 E8 08 33 D8 8B C3 42 8B D8 32 1A 0F B6 DB 8B 1C 9F C1 E8 08 33 D8 8B C3 42 8B D8 32 1A 0F B6 DB 8B 1C 9F C1 E8 08} 9 | $crypt2 = {8B 4C 82 0C 8B D9 C1 E3 18 C1 E9 08 0B D9 8B CB 0F B6 D9 8B 1C 9D AC 0C 43 00 89 5C 24 04 8B D9 C1 EB 08 0F B6 DB 8B 34 9D AC 0C 43 00 8B D9 C1 EB 10} 10 | $crypt3 = {8B 13 8B CA 81 E1 80 80 80 80 8B C1 C1 E8 07 50 8B C1 59 2B C1 25 1B 1B 1B 1B 8B CA 81 E1 7F 7F 7F 7F 03 C9 33 C1 8B C8 81 E1 80 80 80 80 8B F1 C1 EE 07} 11 | condition: 12 | uint16(0) == 0x5A4D and all of them 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/Sedreco.yar: -------------------------------------------------------------------------------- 1 | rule Sedreco 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Sedreco encrypt function entry" 6 | cape_type = "Sedreco Payload" 7 | strings: 8 | $encrypt1 = {55 8B EC 83 EC 2C 53 56 8B F2 57 8B 7D 08 B8 AB AA AA AA} 9 | $encrypt2 = {55 8B EC 83 EC 20 8B 4D 10 B8 AB AA AA AA} 10 | 11 | $encrypt64_1 = {48 89 4C 24 08 53 55 56 57 41 54 41 56 48 83 EC 18 45 8D 34 10 48 8B E9 B8 AB AA AA AA 4D 8B E1 44 89 44 24 60 41 F7 E0 8B F2 B8 AB AA AA AA} 12 | 13 | condition: 14 | uint16(0) == 0x5A4D and $encrypt1 or $encrypt2 or $encrypt64_1 15 | } -------------------------------------------------------------------------------- /data/yara/CAPE/Seduploader.yar: -------------------------------------------------------------------------------- 1 | rule Seduploader 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Seduploader decrypt function" 6 | cape_type = "Seduploader Payload" 7 | strings: 8 | $decrypt1 = {8D 0C 30 C7 45 FC 0A 00 00 00 33 D2 F7 75 FC 8A 82 ?? ?? ?? ?? 32 04 0F 88 01 8B 45 0C 40 89 45 0C 3B C3 7C DB} 9 | condition: 10 | uint16(0) == 0x5A4D and any of ($decrypt*) 11 | } -------------------------------------------------------------------------------- /data/yara/CAPE/Shade.yar: -------------------------------------------------------------------------------- 1 | rule Shade 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Shade Payload" 6 | cape_type = "Shade Payload" 7 | strings: 8 | $crypto = {C1 E1 18 [5-8] 80 80 80 80 [1-6] EE C1 ED 07 [0-5] 81 E7 FE FE FE FE [2-6] 1B 1B 1B 1B} 9 | $openssl = "openssl" nocase 10 | condition: 11 | uint16(0) == 0x5A4D and all of ($*) 12 | } 13 | -------------------------------------------------------------------------------- /data/yara/CAPE/ShadowTech.yar: -------------------------------------------------------------------------------- 1 | rule ShadowTech 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/ShadowTech" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "ShadowTech Payload" 9 | 10 | strings: 11 | $a = "ShadowTech" nocase 12 | $b = "DownloadContainer" 13 | $c = "MySettings" 14 | $d = "System.Configuration" 15 | $newline = "#-@NewLine@-#" wide 16 | $split = "pSIL" wide 17 | $key = "ESIL" wide 18 | 19 | condition: 20 | 4 of them 21 | } -------------------------------------------------------------------------------- /data/yara/CAPE/SmallNet.yar: -------------------------------------------------------------------------------- 1 | rule SmallNet 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/SmallNet" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "SmallNet Payload" 9 | 10 | strings: 11 | $split1 = "!!<3SAFIA<3!!" 12 | $split2 = "!!ElMattadorDz!!" 13 | $a1 = "stub_2.Properties" 14 | $a2 = "stub.exe" wide 15 | $a3 = "get_CurrentDomain" 16 | 17 | condition: 18 | ($split1 or $split2) and (all of ($a*)) 19 | } 20 | -------------------------------------------------------------------------------- /data/yara/CAPE/SmokeLoader.yar: -------------------------------------------------------------------------------- 1 | rule SmokeLoader 2 | { 3 | meta: 4 | author = "kev" 5 | description = "SmokeLoader C2 decryption function" 6 | cape_type = "SmokeLoader Payload" 7 | strings: 8 | $decrypt64_1 = {44 0F B6 CF 48 8B D0 49 03 D9 4C 2B D8 8B 4B 01 41 8A 04 13 41 BA 04 00 00 00 0F C9 32 C1 C1 F9 08 49 FF CA 75 F6 F6 D0 88 02 48 FF C2 49 FF C9 75 DB 49 8B C0 48 8B 5C 24 30 48 83 C4 20 5F C3} 9 | $decrypt64_2 = {40 84 FF 90 90 E8 00 00 00 00 5E 48 83 C6 1C 49 8B F8 A4 80 3E 00 75 FA 80 07 00 48 8B 5C 24 30 48 83 C4 20 5F C3} 10 | $decrypt32_1 = {03 EE 8B D7 2B C7 8B F8 8B 4D 01 8A 04 17 6A 04 0F C9 5B 32 C1 C1 F9 08 4B 75 F8 F6 D0 88 02 42 4E 75 E5 8B 7C 24 14 8B C7 5F 5E 5D 5B 59 59 C3} 11 | condition: 12 | any of ($decrypt*) 13 | } -------------------------------------------------------------------------------- /data/yara/CAPE/SpyGate.yar: -------------------------------------------------------------------------------- 1 | rule SpyGate 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/SpyGate" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "SpyGate Payload" 9 | 10 | strings: 11 | $split = "abccba" 12 | $a1 = "abccbaSpyGateRATabccba" //$a = Version 0.2.6 13 | $a2 = "StubX.pdb" 14 | $a3 = "abccbaDanabccb" 15 | $b1 = "monikerString" nocase //$b = Version 2.0 16 | $b2 = "virustotal1" 17 | $b3 = "get_CurrentDomain" 18 | $c1 = "shutdowncomputer" wide //$c = Version 2.9 19 | $c2 = "shutdown -r -t 00" wide 20 | $c3 = "set cdaudio door closed" wide 21 | $c4 = "FileManagerSplit" wide 22 | $c5 = "Chating With >> [~Hacker~]" wide 23 | 24 | condition: 25 | (all of ($a*) and #split > 40) or (all of ($b*) and #split > 10) or (all of ($c*)) 26 | } 27 | -------------------------------------------------------------------------------- /data/yara/CAPE/Sub7Nation.yar: -------------------------------------------------------------------------------- 1 | rule Sub7Nation 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/Sub7Nation" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "Sub7Nation Payload" 9 | 10 | strings: 11 | $a = "EnableLUA /t REG_DWORD /d 0 /f" 12 | $b = "*A01*" 13 | $c = "*A02*" 14 | $d = "*A03*" 15 | $e = "*A04*" 16 | $f = "*A05*" 17 | $g = "*A06*" 18 | $h = "#@#@#" 19 | $i = "HostSettings" 20 | $verSpecific1 = "sevane.tmp" 21 | $verSpecific2 = "cmd_.bat" 22 | $verSpecific3 = "a2b7c3d7e4" 23 | $verSpecific4 = "cmd.dll" 24 | 25 | 26 | condition: 27 | all of them 28 | } -------------------------------------------------------------------------------- /data/yara/CAPE/TClient.yar: -------------------------------------------------------------------------------- 1 | rule TClient 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "TClient Payload" 6 | cape_type = "TClient Payload" 7 | strings: 8 | $code1 = {41 0F B6 00 4D 8D 40 01 34 01 8B D7 83 E2 07 0F BE C8 FF C7 41 0F BE 04 91 0F AF C1 41 88 40 FF 81 FF 80 03 00 00 7C D8} 9 | condition: 10 | uint16(0) == 0x5A4D and any of ($code*) 11 | } -------------------------------------------------------------------------------- /data/yara/CAPE/TSCookie.yar: -------------------------------------------------------------------------------- 1 | rule TSCookie 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "TSCookie Payload" 6 | cape_type = "TSCookie Payload" 7 | strings: 8 | $string1 = "http://%s:%d" wide 9 | $string2 = "/Default.aspx" wide 10 | $string3 = "\\wship6" 11 | condition: 12 | uint16(0) == 0x5A4D and all of them 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/UPX.yar: -------------------------------------------------------------------------------- 1 | rule UPX 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | 6 | strings: 7 | $a = "UPX0" 8 | $b = "UPX1" 9 | $c = "UPX!" 10 | 11 | condition: 12 | all of them 13 | } -------------------------------------------------------------------------------- /data/yara/CAPE/Ursnif3.yar: -------------------------------------------------------------------------------- 1 | rule Ursnif3 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Ursnif Payload" 6 | cape_type = "Ursnif Payload" 7 | cape_options = "dll=Debugger.dll,step-out=$crypto32,dumpsize=eax,action0=dumpebx,dumptype0=0x24,base-on-api=RtlAddVectoredExceptionHandler,dump-on-api=RtlAddVectoredExceptionHandler,dump-on-api-type=0x25,divert-debugger-log=1" 8 | strings: 9 | $crypto32 = {8B C3 83 EB 01 85 C0 75 0D 0F B6 16 83 C6 01 89 74 24 14 8D 58 07 8B C2 C1 E8 07 83 E0 01 03 D2 85 C0 0F 84 AB 01 00 00 8B C3 83 EB 01 85 C0 89 5C 24 20 75 13 0F B6 16 83 C6 01 BB 07 00 00 00} 10 | $golden_ratio = {8B 70 EC 33 70 F8 33 70 08 33 30 83 C0 04 33 F1 81 F6 B9 79 37 9E C1 C6 0B 89 70 08 41 81 F9 84 00 00 00} 11 | condition: 12 | uint16(0) == 0x5A4D and (all of them) 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/Varenyky.yar: -------------------------------------------------------------------------------- 1 | rule Varenyky 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Varenyky Payload" 6 | cape_type = "Varenyky Payload" 7 | strings: 8 | $onion = "jg4rli4xoagvvmw47fr2bnnfu7t2epj6owrgyoee7daoh4gxvbt3bhyd.onion" 9 | condition: 10 | uint16(0) == 0x5A4D and ($onion) 11 | } 12 | -------------------------------------------------------------------------------- /data/yara/CAPE/Vertex.yar: -------------------------------------------------------------------------------- 1 | rule Vertex 2 | { 3 | 4 | meta: 5 | author = " Kevin Breen " 6 | ref = "http://malwareconfig.com/stats/Vertex" 7 | maltype = "Remote Access Trojan" 8 | filetype = "exe" 9 | cape_type = "Vertex Payload" 10 | 11 | strings: 12 | $string1 = "DEFPATH" 13 | $string2 = "HKNAME" 14 | $string3 = "HPORT" 15 | $string4 = "INSTALL" 16 | $string5 = "IPATH" 17 | $string6 = "MUTEX" 18 | $res1 = "PANELPATH" 19 | $res2 = "ROOTURL" 20 | 21 | condition: 22 | all of them 23 | } 24 | -------------------------------------------------------------------------------- /data/yara/CAPE/Vidar.yar: -------------------------------------------------------------------------------- 1 | rule Vidar 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Vidar Payload" 6 | cape_type = "Vidar Payload" 7 | strings: 8 | $decode = {FF 75 0C 8D 34 1F FF 15 ?? ?? ?? ?? 8B C8 33 D2 8B C7 F7 F1 8B 45 0C 8B 4D 08 8A 04 02 32 04 31 47 88 06 3B 7D 10 72 D8} 9 | $wallet = "*walle*.dat" 10 | condition: 11 | uint16(0) == 0x5A4D and all of them 12 | } 13 | -------------------------------------------------------------------------------- /data/yara/CAPE/VirusRat.yar: -------------------------------------------------------------------------------- 1 | rule VirusRat 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/VirusRat" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "VirusRat Payload" 9 | 10 | strings: 11 | $string0 = "virustotal" 12 | $string1 = "virusscan" 13 | $string2 = "abccba" 14 | $string3 = "pronoip" 15 | $string4 = "streamWebcam" 16 | $string5 = "DOMAIN_PASSWORD" 17 | $string6 = "Stub.Form1.resources" 18 | $string7 = "ftp://{0}@{1}" wide 19 | $string8 = "SELECT * FROM moz_logins" wide 20 | $string9 = "SELECT * FROM moz_disabledHosts" wide 21 | $string10 = "DynDNS\\Updater\\config.dyndns" wide 22 | $string11 = "|BawaneH|" wide 23 | 24 | condition: 25 | all of them 26 | } 27 | -------------------------------------------------------------------------------- /data/yara/CAPE/WanaCry.yar: -------------------------------------------------------------------------------- 1 | rule WanaCry 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "WanaCry Payload" 6 | cape_type = "WanaCry Payload" 7 | strings: 8 | $exename = "@WanaDecryptor@.exe" 9 | $res = "%08X.res" 10 | $pky = "%08X.pky" 11 | $eky = "%08X.eky" 12 | $taskstart = {8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53} 13 | condition: 14 | //check for MZ Signature at offset 0 15 | uint16(0) == 0x5A4D and all of them 16 | } 17 | 18 | -------------------------------------------------------------------------------- /data/yara/CAPE/Xtreme.yar: -------------------------------------------------------------------------------- 1 | rule Xtreme 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/Xtreme" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | ver = "2.9, 3.1, 3.2, 3.5" 9 | cape_type = "Xtreme Payload" 10 | 11 | strings: 12 | $a = "XTREME" wide 13 | $b = "ServerStarted" wide 14 | $c = "XtremeKeylogger" wide 15 | $d = "x.html" wide 16 | $e = "Xtreme RAT" wide 17 | 18 | condition: 19 | all of them 20 | } 21 | -------------------------------------------------------------------------------- /data/yara/CAPE/ZeroT.yar: -------------------------------------------------------------------------------- 1 | rule ZeroT 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "ZeroT Payload" 6 | cape_type = "ZeroT Payload" 7 | strings: 8 | $decrypt = {8B C1 8D B5 FC FE FF FF 33 D2 03 F1 F7 75 10 88 0C 33 41 8A 04 3A 88 06 81 F9 00 01 00 00 7C E0} 9 | $string1 = "(*^GF(9042&*" 10 | $string2 = "s2-18rg1-41g3j_.;" 11 | $string3 = "GET" wide 12 | $string4 = "open" 13 | condition: 14 | uint16(0) == 0x5A4D and all of them 15 | } 16 | -------------------------------------------------------------------------------- /data/yara/CAPE/ZeusPanda.yar: -------------------------------------------------------------------------------- 1 | rule ZeusPanda 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "ZeusPanda Payload" 6 | cape_type = "ZeusPanda Payload" 7 | strings: 8 | $code1 = {8B 01 57 55 55 55 55 55 55 53 51 FF 50 0C 85 C0 78 E? 55 55 6A 03 6A 03 55 55 6A 0A FF 37} 9 | $code2 = {8D 85 B0 FD FF FF 50 68 ?? ?? ?? ?? 8D 85 90 FA FF FF 68 0E 01 00 00 50 E8 ?? ?? ?? ?? 83 C4 10 83 F8 FF 7E ?? 68 04 01 00 00 8D 85 B0 FD FF FF} 10 | condition: 11 | //check for MZ Signature at offset 0 12 | uint16(0) == 0x5A4D and all of them 13 | } 14 | -------------------------------------------------------------------------------- /data/yara/CAPE/adWind.yar: -------------------------------------------------------------------------------- 1 | rule adWind 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/AAR" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "adWind Payload" 9 | 10 | strings: 11 | $meta = "META-INF" 12 | $conf = "config.xml" 13 | $a = "Adwind.class" 14 | $b = "Principal.adwind" 15 | 16 | condition: 17 | all of them 18 | } -------------------------------------------------------------------------------- /data/yara/CAPE/jRat.yar: -------------------------------------------------------------------------------- 1 | rule jRat 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/jRat" 6 | maltype = "Remote Access Trojan" 7 | filetype = "Java" 8 | cape_type = "jRat Payload" 9 | 10 | strings: 11 | $meta = "META-INF" 12 | $key = "key.dat" 13 | $conf = "config.dat" 14 | $jra1 = "enc.dat" 15 | $jra2 = "a.class" 16 | $jra3 = "b.class" 17 | $jra4 = "c.class" 18 | $reClass1 = /[a-z]\.class/ 19 | $reClass2 = /[a-z][a-f]\.class/ 20 | 21 | condition: 22 | ($meta and $key and $conf and #reClass1 > 10 and #reClass2 > 10) or ($meta and $key and all of ($jra*)) 23 | } 24 | -------------------------------------------------------------------------------- /data/yara/CAPE/njRat.yar: -------------------------------------------------------------------------------- 1 | rule njRat 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/njRat" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "njRat Payload" 9 | 10 | strings: 11 | 12 | $s1 = {7C 00 27 00 7C 00 27 00 7C} // |'|'| 13 | $s2 = "netsh firewall add allowedprogram" wide 14 | $s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide 15 | $s4 = "yyyy-MM-dd" wide 16 | 17 | $v1 = "cmd.exe /k ping 0 & del" wide 18 | $v2 = "cmd.exe /c ping 127.0.0.1 & del" wide 19 | $v3 = "cmd.exe /c ping 0 -n 2 & del" wide 20 | 21 | 22 | condition: 23 | all of ($s*) and any of ($v*) 24 | } 25 | -------------------------------------------------------------------------------- /data/yara/CAPE/tRat.yar: -------------------------------------------------------------------------------- 1 | rule tRat 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "tRat Payload" 6 | cape_type = "tRat Payload" 7 | strings: 8 | $code1 = {8D 45 FC E8 ?? ?? ?? ?? 8B 55 FC 0F B6 54 32 FF 66 33 D3 0F B7 D2 2B D6 33 D6 2B D6 33 D6 88 54 30 FF 43 8B 45 FC E8 ?? ?? ?? ?? 0F B7 F3 3B C6 7F CE} 9 | $code2 = {5A 83 E2 03 74 22 8B 0E 8B 1F 38 D9 75 41 4A 74 17 38 FD 75 3A 4A 74 10 81 E3 00 00 FF 00 81 E1 00 00 FF 00 39 D9 75 27} 10 | $string1 = "TCComand" 11 | condition: 12 | uint16(0) == 0x5A4D and all of them 13 | } -------------------------------------------------------------------------------- /data/yara/CAPE/unrecom.yar: -------------------------------------------------------------------------------- 1 | rule unrecom 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/AAR" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "unrecom Payload" 9 | 10 | strings: 11 | $meta = "META-INF" 12 | $conf = "load/ID" 13 | $a = "load/JarMain.class" 14 | $b = "load/MANIFEST.MF" 15 | $c = "plugins/UnrecomServer.class" 16 | 17 | condition: 18 | all of them 19 | } 20 | -------------------------------------------------------------------------------- /data/yara/CAPE/xRAT.yar: -------------------------------------------------------------------------------- 1 | rule xRAT 2 | { 3 | meta: 4 | author = " Kevin Breen " 5 | ref = "http://malwareconfig.com/stats/xRat" 6 | maltype = "Remote Access Trojan" 7 | filetype = "exe" 8 | cape_type = "xRAT Payload" 9 | 10 | strings: 11 | $v1a = "DecodeProductKey" 12 | $v1b = "StartHTTPFlood" 13 | $v1c = "CodeKey" 14 | $v1d = "MESSAGEBOX" 15 | $v1e = "GetFilezillaPasswords" 16 | $v1f = "DataIn" 17 | $v1g = "UDPzSockets" 18 | $v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41} 19 | 20 | $v2a = "k__BackingField" 21 | $v2b = "k__BackingField" 22 | $v2c = "DownloadAndExecute" 23 | $v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide 24 | $v2e = "england.png" wide 25 | $v2f = "Showed Messagebox" wide 26 | condition: 27 | all of ($v1*) or all of ($v2*) 28 | } -------------------------------------------------------------------------------- /data/yara/binaries/HeavensGate.yar: -------------------------------------------------------------------------------- 1 | rule HeavensGate 2 | { 3 | meta: 4 | author = "kevoreilly" 5 | description = "Heaven's Gate: Switch from 32-bit to 64-mode" 6 | cape_type = "Heaven's Gate" 7 | 8 | strings: 9 | $gate_v1 = {6A 33 E8 00 00 00 00 83 04 24 05 CB} 10 | $gate_v2 = {9A 00 00 00 00 33 00 89 EC 5D C3 48 83 EC 20 E8 00 00 00 00 48 83 C4 20 CB} 11 | $gate_v3 = {5A 66 BB 33 00 66 53 50 89 E0 83 C4 06 FF 28} 12 | 13 | condition: 14 | ($gate_v1 or $gate_v2 or $gate_v3) 15 | } 16 | -------------------------------------------------------------------------------- /data/yara/memory/.gitignore: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/data/yara/memory/.gitignore -------------------------------------------------------------------------------- /data/yara/memory/darkcomet.yar: -------------------------------------------------------------------------------- 1 | // Copyright (C) 2015 KillerInstinct 2 | // The contents of this file are Yara rules processed by procmemory.py processing 3 | // module. Add your signatures here. 4 | rule DarkCometConfig 5 | { 6 | meta: 7 | author = "KillerInstinct" 8 | description = "Configuration for DarkComet" 9 | malfamily = "darkcomet" 10 | 11 | strings: 12 | $buf = /#BEGIN\sDARKCOMET[A-Za-z0-9\r\n\s\-\=\_\{\}\.:\\\/]*\#EOF\sDARKCOMET\sDATA\s--/s 13 | 14 | condition: 15 | $buf 16 | } 17 | -------------------------------------------------------------------------------- /data/yara/memory/rig.yar: -------------------------------------------------------------------------------- 1 | /* Copyright (C) 2016 Will Metcalf william.metcalf@gmail.com 2 | * This program is free software: you can redistribute it and/or modify 3 | * it under the terms of the GNU General Public License as published by 4 | * the Free Software Foundation, either version 3 of the License, or 5 | * (at your option) any later version. 6 | * 7 | * This program is distributed in the hope that it will be useful, 8 | * but WITHOUT ANY WARRANTY; without even the implied warranty of 9 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 10 | * GNU General Public License for more details. 11 | * 12 | * You should have received a copy of the GNU General Public License 13 | * along with this program. If not, see . 14 | */ 15 | 16 | rule RIG_EK_Memory 17 | { 18 | meta: 19 | malfamily = "rig" 20 | strings: 21 | $s1 = "+ \x27 2 | http://eternal-todo.com 3 | http://twitter.com/EternalTodo -------------------------------------------------------------------------------- /lib/cuckoo/common/peepdf/TODO: -------------------------------------------------------------------------------- 1 | Pending tasks: 2 | 3 | - Add detection of more exploits/vulns 4 | - Documentation of methods in PDFCore.py 5 | - Add the rest of supported stream filters (better testing of existent) 6 | - Automatic analysis of embedded PDF files 7 | - Improve the automatic Javascript analysis, getting code from other parts of the documents (getAnnots, etc) 8 | - GUI 9 | - ... -------------------------------------------------------------------------------- /lib/cuckoo/common/peepdf/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/lib/cuckoo/common/peepdf/__init__.py -------------------------------------------------------------------------------- /lib/cuckoo/common/peepdf/aespython/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/lib/cuckoo/common/peepdf/aespython/__init__.py -------------------------------------------------------------------------------- /lib/cuckoo/common/peepdf/colorama/__init__.py: -------------------------------------------------------------------------------- 1 | from .initialise import init 2 | from .ansi import Fore, Back, Style 3 | from .ansitowin32 import AnsiToWin32 4 | 5 | VERSION = '0.1.18' 6 | 7 | -------------------------------------------------------------------------------- /lib/cuckoo/core/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /lib/maec/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /modules/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /modules/auxiliary/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /modules/feeds/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /modules/machinery/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /modules/processing/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /modules/processing/parsers/__init__.py: -------------------------------------------------------------------------------- 1 | # Init -------------------------------------------------------------------------------- /modules/processing/parsers/malwareconfig/__init__.py: -------------------------------------------------------------------------------- 1 | # Init -------------------------------------------------------------------------------- /modules/processing/parsers/mwcp/__init__.py: -------------------------------------------------------------------------------- 1 | """Exposes interface for MWCP.""" 2 | 3 | import logging 4 | 5 | # Add null handler to root logger to avoid "no handler" error when this is used as a library 6 | logging.getLogger().addHandler(logging.NullHandler()) 7 | 8 | 9 | from mwcp import config 10 | from mwcp.parser import Parser 11 | from mwcp.parsers import register_parser_directory, iter_parsers, get_parser_descriptions 12 | from mwcp.reporter import Reporter 13 | from mwcp.resources import techanarchy_bridge 14 | from mwcp.resources.dispatcher import Dispatcher, ComponentParser, FileObject, UnableToParse, UnidentifiedFile 15 | from mwcp.utils.logutil import setup_logging 16 | -------------------------------------------------------------------------------- /modules/processing/parsers/mwcp/config/__init__.py: -------------------------------------------------------------------------------- 1 | """Stores default configuration values.""" 2 | 3 | import os 4 | 5 | 6 | log_config = os.path.join(os.path.dirname(__file__), 'log_config.yml') 7 | -------------------------------------------------------------------------------- /modules/processing/parsers/mwcp/resources/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/modules/processing/parsers/mwcp/resources/__init__.py -------------------------------------------------------------------------------- /modules/processing/parsers/mwcp/utils/__init__.py: -------------------------------------------------------------------------------- 1 | """This package is used to store common helper utilities for developing parsers.""" -------------------------------------------------------------------------------- /modules/processing/parsers/mwcp/utils/construct/__init__.py: -------------------------------------------------------------------------------- 1 | """This is a wrapper interface to the construct library which adds extra helper functions.""" 2 | 3 | 4 | # Import interface 5 | from construct import * 6 | from mwcp.utils.construct.construct_html import html_hex 7 | from mwcp.utils.construct.windows_enums import * 8 | from mwcp.utils.construct.windows_structures import * 9 | 10 | # NOTE: This must be imported last since it contains overwritten elements of the base construct library. 11 | from mwcp.utils.construct.helpers import * 12 | -------------------------------------------------------------------------------- /modules/processing/parsers/mwcp/utils/stringutils.py: -------------------------------------------------------------------------------- 1 | """ 2 | Utility used for string conversions. 3 | """ 4 | 5 | from future.builtins import str 6 | 7 | 8 | def convert_to_unicode(input_string): 9 | if isinstance(input_string, str): 10 | return input_string 11 | else: 12 | return str(input_string, encoding='utf8', errors='replace') 13 | -------------------------------------------------------------------------------- /modules/processing/parsers/plugxconfig/__init__.py: -------------------------------------------------------------------------------- 1 | # Init -------------------------------------------------------------------------------- /modules/reporting/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /modules/reporting/mitre.py: -------------------------------------------------------------------------------- 1 | from lib.cuckoo.common.abstracts import Report 2 | 3 | class MITRE_TTPS(Report): 4 | def run(self, results): 5 | if not results.get("ttps") or not hasattr(self, "mitre"): 6 | return 7 | 8 | attck = dict() 9 | for tactic in self.mitre.tactics: 10 | for technique in tactic.techniques: 11 | if technique.id in results["ttps"].keys(): 12 | attck.setdefault(tactic.name, list()) 13 | attck[tactic.name].append({"t_id": technique.id, "ttp_name": technique.name, "description": technique.description, "signature": results["ttps"][technique.id]}) 14 | if attck: 15 | results["mitre_attck"] = attck 16 | -------------------------------------------------------------------------------- /modules/signatures/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | -------------------------------------------------------------------------------- /modules/signatures/antiav_srp.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014 Optiv, Inc. (brad.spengler@optiv.com) 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.cuckoo.common.abstracts import Signature 6 | 7 | class AntiAVSRP(Signature): 8 | name = "antiav_srp" 9 | description = "Modifies Software Restriction Policies likely to cripple AV" 10 | severity = 3 11 | categories = ["anti-av"] 12 | authors = ["Optiv"] 13 | minimum = "1.2" 14 | ttp = ["T1089"] 15 | 16 | def run(self): 17 | match_key = self.check_write_key(".*\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\\CodeIdentifiers\\\\0\\\\Paths\\\\.*", regex=True, all=True) 18 | if match_key: 19 | for match in match_key: 20 | self.data.append({"key" : match}) 21 | return True 22 | return False 23 | -------------------------------------------------------------------------------- /modules/signatures/disables_app.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2015 Kevin Ross 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.cuckoo.common.abstracts import Signature 6 | 7 | class DisablesAppLaunch(Signature): 8 | name = "disables_app_launch" 9 | description = "Modifies system policies to prevent the launching of specific applications or executables" 10 | severity = 3 11 | categories = ["stealth"] 12 | authors = ["Kevin Ross"] 13 | minimum = "1.2" 14 | ttp = ["T1112"] 15 | 16 | def run(self): 17 | if self.check_write_key(pattern=".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\DisallowRun$", regex=True): 18 | return True 19 | 20 | return False 21 | -------------------------------------------------------------------------------- /modules/signatures/disables_spdy.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2015 Optiv, Inc. (brad.spengler@optiv.com) 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.cuckoo.common.abstracts import Signature 6 | 7 | class DisablesSPDY(Signature): 8 | name = "disables_spdy" 9 | description = "Attempts to disable SPDY support in Firefox to improve web infostealing capability" 10 | severity = 3 11 | weight = 2 12 | categories = ["generic"] 13 | authors = ["Optiv"] 14 | minimum = "1.2" 15 | evented = True 16 | 17 | def __init__(self, *args, **kwargs): 18 | Signature.__init__(self, *args, **kwargs) 19 | 20 | filter_apinames = set(["NtWriteFile"]) 21 | 22 | def on_call(self, call, process): 23 | buf = self.get_argument(call, "Buffer") 24 | if "network.http.spdy.enabled" in buf and "false" in buf: 25 | return True 26 | -------------------------------------------------------------------------------- /modules/signatures/disables_uac.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014 Optiv, Inc. (brad.spengler@optiv.com) 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.cuckoo.common.abstracts import Signature 6 | 7 | class DisablesUAC(Signature): 8 | name = "disables_uac" 9 | description = "Attempts to disable UAC" 10 | severity = 3 11 | categories = ["generic"] 12 | authors = ["Optiv"] 13 | minimum = "1.2" 14 | 15 | def run(self): 16 | if self.check_write_key(pattern=".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\EnableLUA$", regex=True): 17 | return True 18 | return False 19 | -------------------------------------------------------------------------------- /modules/signatures/disables_wer.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2015 Kevin Ross 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.cuckoo.common.abstracts import Signature 6 | 7 | class DisablesWER(Signature): 8 | name = "disables_wer" 9 | description = "Attempts to disable Windows Error Reporting" 10 | severity = 3 11 | categories = ["stealth"] 12 | authors = ["Kevin Ross"] 13 | minimum = "1.2" 14 | ttp = ["T1054", "T1112"] 15 | 16 | def run(self): 17 | if self.check_write_key(pattern=".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\Windows\\ Error\\ Reporting\\\\Disabled$", regex=True): 18 | return True 19 | 20 | return False 21 | -------------------------------------------------------------------------------- /modules/signatures/disables_windowsupdate.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2015 Optiv, Inc. (brad.spengler@optiv.com) 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.cuckoo.common.abstracts import Signature 6 | 7 | class DisablesWindowsUpdate(Signature): 8 | name = "disables_windowsupdate" 9 | description = "Attempts to disable Windows Auto Updates" 10 | severity = 3 11 | categories = ["generic"] 12 | authors = ["Optiv"] 13 | minimum = "1.2" 14 | ttp = ["T1112"] 15 | 16 | def run(self): 17 | if self.check_write_key(pattern=".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\\\\(AU\\\\NoAutoUpdate|Auto\\ Update\\\\AUOptions)$", regex=True): 18 | return True 19 | return False 20 | -------------------------------------------------------------------------------- /modules/signatures/modifies_certs.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2015 Kevin Ross 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.cuckoo.common.abstracts import Signature 6 | 7 | class ModifiesCerts(Signature): 8 | name = "modifies_certs" 9 | description = "Attempts to create or modify system certificates" 10 | severity = 3 11 | categories = ["browser"] 12 | authors = ["Kevin Ross"] 13 | minimum = "1.2" 14 | ttp = ["T1112"] 15 | 16 | filter_analysistypes = set(["file"]) 17 | 18 | def run(self): 19 | if self.check_write_key(pattern=".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\SystemCertificates\\\\.*\\\\Certificates\\\\.*", regex=True): 20 | return True 21 | 22 | return False 23 | -------------------------------------------------------------------------------- /modules/signatures/prevents_safeboot.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014 Optiv, Inc. (brad.spengler@optiv.com) 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.cuckoo.common.abstracts import Signature 6 | 7 | class PreventsSafeboot(Signature): 8 | name = "prevents_safeboot" 9 | description = "Attempts to block SafeBoot use by removing registry keys" 10 | severity = 3 11 | categories = ["generic"] 12 | authors = ["Optiv"] 13 | minimum = "1.2" 14 | 15 | def run(self): 16 | if self.check_delete_key(pattern=".*\\\\System\\\\(CurrentControlSet|ControlSet001)\\\\Control\\\\SafeBoot\\\\.*", regex=True): 17 | return True 18 | return False 19 | -------------------------------------------------------------------------------- /modules/signatures/ransomware_recyclebin.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2015 Optiv, Inc. (brad.spengler@optiv.com) 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.cuckoo.common.abstracts import Signature 6 | 7 | class RansomwareRecyclebin(Signature): 8 | name = "ransomware_recyclebin" 9 | description = "Empties the Recycle Bin, indicative of ransomware" 10 | severity = 3 11 | categories = ["ransomware"] 12 | authors = ["Optiv"] 13 | minimum = "1.2" 14 | 15 | def run(self): 16 | if self.check_delete_file(pattern="C:\\\\RECYCLER\\\\.*", regex=True): 17 | return True 18 | return False -------------------------------------------------------------------------------- /modules/signatures/rat_poisonivy.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2014 Optiv, Inc. (brad.spengler@optiv.com) 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.cuckoo.common.abstracts import Signature 6 | 7 | class PoisonIvyMutexes(Signature): 8 | name = "rat_poisonivy_mutexes" 9 | description = "Creates known Poison Ivy mutexes" 10 | severity = 3 11 | categories = ["rat"] 12 | authors = ["Optiv"] 13 | references = ["http://www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf"] 14 | minimum = "1.2" 15 | 16 | def run(self): 17 | indicators = [ 18 | ")!VoqA.I4", 19 | "K^DJA^#FE", 20 | "KEIVH^#$S", 21 | "%1Sjfhtd8", 22 | "2SF#@R@#!" 23 | ] 24 | 25 | for indicator in indicators: 26 | if self.check_mutex(pattern=indicator): 27 | return True 28 | 29 | return False 30 | -------------------------------------------------------------------------------- /modules/signatures/static_rat_config.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2015 Optiv, Inc. (brad.spengler@optiv.com) 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from lib.cuckoo.common.abstracts import Signature 6 | 7 | class RATConfig(Signature): 8 | name = "static_rat_config" 9 | description = "Contains extracted RAT config" 10 | severity = 3 11 | weight = 3 12 | categories = ["static"] 13 | authors = ["Optiv"] 14 | minimum = "1.3" 15 | 16 | def run(self): 17 | if "static" in self.results and "rat" in self.results["static"] and "name" in self.results["static"]["rat"] and len(self.results["static"]["rat"]["name"]): 18 | self.description = "Contains RAT configuration for " + self.results["static"]["rat"]["name"] + " (see Static Analysis tab)" 19 | self.families = [ self.results["static"]["rat"]["name"] ] 20 | return True 21 | 22 | return False 23 | -------------------------------------------------------------------------------- /modules/signatures/trickbot_mutex.py: -------------------------------------------------------------------------------- 1 | from lib.cuckoo.common.abstracts import Signature 2 | 3 | class TrickBotMutexes(Signature): 4 | name = "trickbot_mutex" 5 | description = "Attempts to create a known TrickBot mutex." 6 | weight = 3 7 | severity = 3 8 | categories = ["banker", "trojan"] 9 | families = ["TrickBot"] 10 | authors = ["Eoin Miller", "Mark Parsons"] 11 | minimum = "0.5" 12 | 13 | def run(self): 14 | if self.check_mutex("Global\\TrickBot") or self.check_mutex("Global\\MGlob"): 15 | return True 16 | 17 | return False 18 | -------------------------------------------------------------------------------- /requirements.txt: -------------------------------------------------------------------------------- 1 | sqlalchemy 2 | jinja2 3 | markupsafe 4 | libvirt-python 5 | pymongo 6 | bottle 7 | #pefile 8 | django>=1.7 9 | chardet 10 | pygal 11 | clamd 12 | pycrypto 13 | jsbeautifier 14 | dpkt 15 | nose 16 | dnspython 17 | pytz 18 | requests[socks] 19 | python-magic 20 | geoip 21 | pillow 22 | elasticsearch 23 | java-random 24 | python-whois 25 | bs4 26 | pefile2==1.2.11 27 | git+https://github.com/crackinglandia/pype32.git 28 | django-ratelimit==2.0.0 29 | git+https://github.com/kbandla/pydeep.git 30 | pyvmomi>=6.0 31 | imagehash 32 | pyinstaller 33 | sqlalchemy 34 | # upx 35 | maec 36 | oletools==0.53.1 37 | networkx>=2.1 38 | regex 39 | graphviz>=0.8.4 40 | pydot>=1.2.4 41 | olefile==0.45.1 42 | mixbox 43 | matplotlib==2.2.2 44 | numpy==1.15.0 45 | six==1.11.0 46 | statistics==1.0.3.5 47 | xmltodict 48 | pyyaml 49 | pyelftools 50 | gunicorn 51 | suricata-update 52 | git+https://github.com/doomedraven/sflock.git 53 | socks5man 54 | git+https://github.com/swimlane/pyattck.git 55 | pymisp==2.4.111.2 56 | -------------------------------------------------------------------------------- /systemd/cuckoo-processor.service: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Cuckoo report processor 3 | Documentation=https://github.com/ctxis/CAPE 4 | Wants=cuckoo-rooter.service 5 | After=cuckoo-rooter.service 6 | 7 | [Service] 8 | ExecStart=/opt/CAPE/venv/bin/python /opt/CAPE/utils/process.py -p7 auto 9 | User=cuckoo 10 | Group=cuckoo 11 | Restart=always 12 | RestartSec=5m 13 | 14 | [Install] 15 | WantedBy=multi-user.target 16 | -------------------------------------------------------------------------------- /systemd/cuckoo-rooter.service: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Cuckoo rooter 3 | Documentation=https://github.com/ctxis/CAPE 4 | Wants=network-online.target 5 | After=syslog.target network.target 6 | 7 | [Service] 8 | ExecStart=/opt/CAPE/venv/bin/python /opt/CAPE/utils/rooter.py 9 | User=root 10 | Group=root 11 | Restart=always 12 | RestartSec=5m 13 | 14 | [Install] 15 | WantedBy=multi-user.target 16 | -------------------------------------------------------------------------------- /systemd/cuckoo-wsgi.service: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Cuckoo WSGI app 3 | Documentation=https://github.com/ctxis/CAPE 4 | Wants=cuckoo.service 5 | After=cuckoo.service 6 | 7 | [Service] 8 | WorkingDirectory=/opt/CAPE/web 9 | ExecStart=/opt/CAPE/venv/bin/gunicorn -b 127.0.0.1:8000 web.wsgi 10 | User=cuckoo 11 | Group=cuckoo 12 | Restart=always 13 | RestartSec=5m 14 | 15 | [Install] 16 | WantedBy=multi-user.target 17 | -------------------------------------------------------------------------------- /systemd/cuckoo.service: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Cuckoo 3 | Documentation=https://github.com/ctxis/CAPE 4 | Wants=cuckoo-cuckoo-processor.service 5 | After=cuckoo-cuckoo-processor.service 6 | 7 | [Service] 8 | ExecStart=/opt/CAPE/venv/bin/python /opt/CAPE/cuckoo.py 9 | User=cuckoo 10 | Group=cuckoo 11 | Restart=always 12 | RestartSec=5m 13 | 14 | [Install] 15 | WantedBy=multi-user.target 16 | -------------------------------------------------------------------------------- /systemd/suricata-update.service: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=suricata-update 3 | 4 | [Service] 5 | User=root 6 | Group=root 7 | Type=oneshot 8 | ExecStart=/opt/CAPE/venv/bin/suricata-update 9 | 10 | [Install] 11 | WantedBy=multi-user.target 12 | -------------------------------------------------------------------------------- /systemd/suricata-update.timer: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Run suricata-update hourly and at boot 3 | 4 | [Timer] 5 | OnBootSec=15min 6 | OnUnitActiveSec=1h 7 | unit=suricata-update.service 8 | 9 | [Install] 10 | WantedBy=timers.target 11 | -------------------------------------------------------------------------------- /tests/colors_tests.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from nose.tools import assert_equals 6 | 7 | from lib.cuckoo.common.colors import color 8 | 9 | 10 | def test_return_text(): 11 | """Test colorized text contains the input string.""" 12 | assert "foo" in color("foo", 11) -------------------------------------------------------------------------------- /tests/reporter_tests.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import os 6 | import tempfile 7 | from nose.tools import assert_equals 8 | 9 | from lib.cuckoo.common.abstracts import Report 10 | from lib.cuckoo.common.config import Config 11 | 12 | 13 | class ReportMock(Report): 14 | def run(self, data): 15 | return 16 | 17 | class ReportAlterMock(Report): 18 | """Corrupts results dict.""" 19 | def run(self, data): 20 | data['foo'] = 'notbar' 21 | return 22 | -------------------------------------------------------------------------------- /tests/sniffer_tests.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from nose.tools import assert_equals 6 | -------------------------------------------------------------------------------- /utils/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/utils/__init__.py -------------------------------------------------------------------------------- /utils/db_migration/script.py.mako: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | """${message} 6 | 7 | Revision ID: ${up_revision} 8 | Revises: ${down_revision} 9 | Create Date: ${create_date} 10 | 11 | """ 12 | 13 | # revision identifiers, used by Alembic. 14 | revision = ${repr(up_revision)} 15 | down_revision = ${repr(down_revision)} 16 | 17 | from alembic import op 18 | import sqlalchemy as sa 19 | ${imports if imports else ""} 20 | 21 | def upgrade(): 22 | ${upgrades if upgrades else "pass"} 23 | 24 | 25 | def downgrade(): 26 | ${downgrades if downgrades else "pass"} 27 | -------------------------------------------------------------------------------- /utils/db_migration/versions/options_255_to_1024.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | """options_255_to_1014 6 | 7 | Revision ID: 30d0230de7cd 8 | Revises: 36926b59dfbb 9 | Create Date: 2019-10-11 11:00:31.364356 10 | 11 | """ 12 | 13 | # revision identifiers, used by Alembic. 14 | revision = '30d0230de7cd' 15 | down_revision = '36926b59dfbb' 16 | 17 | from alembic import op 18 | import sqlalchemy as sa 19 | 20 | def upgrade(): 21 | op.alter_column('tasks', 'options', 22 | existing_type=sa.String(length=255), 23 | type_=sa.String(length=1024), 24 | existing_nullable=True) 25 | 26 | 27 | def downgrade(): 28 | op.alter_column('tasks', 'options', 29 | existing_type=sa.String(length=1024), 30 | type_=sa.String(length=255), 31 | existing_nullable=True) 32 | -------------------------------------------------------------------------------- /utils/smtp_sinkhole.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Add "@reboot /opt/cuckoo-modified/utils/smtp_sinkhole.sh" to the root crontab. 3 | # smtp 4 | sudo iptables -t nat -A PREROUTING -i virbr0 -p tcp -m tcp --dport 25 -j REDIRECT --to-ports 1025 5 | sudo iptables -t nat -A PREROUTING -i virbr0 -p tcp -m tcp --sport 25 -j REDIRECT --to-ports 1025 6 | # tls + ssl 7 | sudo iptables -t nat -A PREROUTING -i virbr0 -p tcp -m tcp --dport 465 -j REDIRECT --to-ports 1025 8 | sudo iptables -t nat -A PREROUTING -i virbr0 -p tcp -m tcp --dport 587 -j REDIRECT --to-ports 1025 9 | 10 | cd /opt/CAPE/utils 11 | if [ ! -f "/opt/CAPE/utils/smtp_sinkhole.py" ]; then 12 | exit 1 13 | fi 14 | 15 | if [ ! -d dumps ]; then 16 | mkdir -p /opt/CAPE/utils/dumps 17 | fi 18 | python smtp_sinkhole.py 0.0.0.0 1025 --dir /opt/CAPE/utils/dumps 19 | -------------------------------------------------------------------------------- /utils/tcpdumpwrapper.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | 3 | # Copyright 2015 Optiv, Inc. (brad.spengler@optiv.com) 4 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 5 | # See the file 'docs/LICENSE' for copying permission. 6 | 7 | import sys 8 | import os 9 | import time 10 | 11 | iface = "" 12 | for idx, arg in enumerate(sys.argv): 13 | if arg == "-i" and idx < len(sys.argv) - 1: 14 | iface = sys.argv[idx+1] 15 | 16 | for i in range(30): 17 | f = open("/proc/net/dev", "rb") 18 | for line in f: 19 | dev = line.split(":")[0] 20 | if dev == iface: 21 | break 22 | f.close() 23 | time.sleep(0.5) 24 | 25 | os.execve("/usr/sbin/tcpdump", sys.argv, os.environ) 26 | -------------------------------------------------------------------------------- /web/analysis/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. -------------------------------------------------------------------------------- /web/analysis/forms.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from django import forms 6 | 7 | from submission.models import Comment, Tag 8 | 9 | class CommentForm(forms.ModelForm): 10 | class Meta: 11 | model = Comment 12 | fields = ["message"] 13 | 14 | class TagForm(forms.ModelForm): 15 | class Meta: 16 | model = Tag 17 | fields = ["name"] 18 | -------------------------------------------------------------------------------- /web/analysis/templatetags/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. -------------------------------------------------------------------------------- /web/analysis/templatetags/key_tags.py: -------------------------------------------------------------------------------- 1 | from django import template 2 | register = template.Library() 3 | 4 | @register.filter(name="getkey") 5 | def getkey(mapping, value): 6 | return mapping.get(value, '') 7 | -------------------------------------------------------------------------------- /web/analysis/templatetags/pdf_tags.py: -------------------------------------------------------------------------------- 1 | from django import template 2 | register = template.Library() 3 | 4 | @register.filter(name="datefmt") 5 | def datefmt(value): 6 | formatted = value[2:6] + "/" + value[6:8] + "/" + value[8:10] + " " + \ 7 | value[10:12] + ":" + value[12:14] + ":" + value[14:16] + \ 8 | " GMT" + value[16:19] 9 | return formatted 10 | -------------------------------------------------------------------------------- /web/api/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/api/__init__.py -------------------------------------------------------------------------------- /web/compare/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file "docs/LICENSE" for copying permission. -------------------------------------------------------------------------------- /web/compare/urls.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file "docs/LICENSE" for copying permission. 4 | 5 | from django.conf.urls import url 6 | from compare import views 7 | 8 | urlpatterns = [ 9 | url(r"^(?P\d+)/$", views.left, name='compare_left'), 10 | url(r"^(?P\d+)/(?P\d+)/$", views.both, name='compare_both'), 11 | url(r"^(?P\d+)/(?P\w+)/$", views.hash, name='compare_hash'), 12 | ] 13 | -------------------------------------------------------------------------------- /web/dashboard/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/dashboard/__init__.py -------------------------------------------------------------------------------- /web/dashboard/urls.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file "docs/LICENSE" for copying permission. 4 | 5 | from django.conf.urls import url 6 | from dashboard import views 7 | 8 | urlpatterns = [ 9 | url(r"^$", views.index), 10 | ] 11 | -------------------------------------------------------------------------------- /web/manage.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # Copyright (C) 2010-2015 Cuckoo Foundation. 3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 | # See the file 'docs/LICENSE' for copying permission. 5 | 6 | import os 7 | import sys 8 | 9 | if __name__ == "__main__": 10 | os.environ.setdefault("DJANGO_SETTINGS_MODULE", "web.settings") 11 | 12 | from django.core.management import execute_from_command_line 13 | 14 | execute_from_command_line(sys.argv) 15 | -------------------------------------------------------------------------------- /web/static/fonts/glyphicons-halflings-regular.eot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/fonts/glyphicons-halflings-regular.eot -------------------------------------------------------------------------------- /web/static/fonts/glyphicons-halflings-regular.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/fonts/glyphicons-halflings-regular.ttf -------------------------------------------------------------------------------- /web/static/fonts/glyphicons-halflings-regular.woff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/fonts/glyphicons-halflings-regular.woff -------------------------------------------------------------------------------- /web/static/fonts/glyphicons-halflings-regular.woff2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/fonts/glyphicons-halflings-regular.woff2 -------------------------------------------------------------------------------- /web/static/generated/README: -------------------------------------------------------------------------------- 1 | Statistics images generated by server are stored here -------------------------------------------------------------------------------- /web/static/graphic/background.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/graphic/background.png -------------------------------------------------------------------------------- /web/static/graphic/cape.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/graphic/cape.png -------------------------------------------------------------------------------- /web/static/graphic/cuckoo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/graphic/cuckoo.png -------------------------------------------------------------------------------- /web/static/img/cape.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/img/cape.png -------------------------------------------------------------------------------- /web/static/img/close.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/img/close.png -------------------------------------------------------------------------------- /web/static/img/loading.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/img/loading.gif -------------------------------------------------------------------------------- /web/static/img/next.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/img/next.png -------------------------------------------------------------------------------- /web/static/img/prev.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/img/prev.png -------------------------------------------------------------------------------- /web/submission/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. -------------------------------------------------------------------------------- /web/submission/urls.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | from django.conf.urls import url 6 | from submission import views 7 | 8 | urlpatterns = [ 9 | url(r"^$", views.index, name='submission'), 10 | url(r"^resubmit/(?P[\w\d]{64})/$", views.index, name='submission'), 11 | url(r"status/(?P\d+)/$", views.status, name='submission_status'), 12 | ] 13 | -------------------------------------------------------------------------------- /web/templates/analysis/antivirus.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% block content %} 3 |

4 | {% include "analysis/static/_antivirus.html" %} 5 | {% endblock %} 6 | 7 | -------------------------------------------------------------------------------- /web/templates/analysis/behavior/_chunk.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | {% for call in chunk.calls %} 16 | 17 | {% include "analysis/behavior/_api_call.html" %} 18 | 19 | {% endfor %} 20 | 21 |
TimeTIDCallerAPIArgumentsStatusReturnRepeated
22 | -------------------------------------------------------------------------------- /web/templates/analysis/behavior/_search.html: -------------------------------------------------------------------------------- 1 | 15 | 16 | 29 | -------------------------------------------------------------------------------- /web/templates/analysis/behavior/_tree.html: -------------------------------------------------------------------------------- 1 | {% load generic_tags %} 2 | {% load analysis_tags %} 3 | 4 |

Process Tree

5 |
    6 | {% for process in analysis.behavior.processtree|proctreetolist %} 7 | {% if process.startchildren %} 8 |
      9 | {% elif process.endchildren %} 10 |
    11 | {% else %} 12 |
  • 13 | {{process.name}} {{process.pid}} 14 | {% if process.commandline %} 15 | {{ process.commandline }} 16 | {% endif %} 17 |
  • 18 | {% endif %} 19 | {% endfor %} 20 |
21 | -------------------------------------------------------------------------------- /web/templates/analysis/behavior/index.html: -------------------------------------------------------------------------------- 1 | {% include "analysis/behavior/_tree.html" %} 2 |
3 | {% include "analysis/behavior/_processes.html" %} -------------------------------------------------------------------------------- /web/templates/analysis/comments/index.html: -------------------------------------------------------------------------------- 1 |

Comments


2 |
{% csrf_token %} 3 |
4 |
5 | 6 |
7 | 8 |
9 |
10 |
11 |
12 |
13 | {% if analysis.info.comments %} 14 | {% for comment in analysis.info.comments %} 15 |
[{{comment.Timestamp}}]
{{comment.Data|safe}}
16 | {% endfor %} 17 | {% else %} 18 |
No comments posted
19 | {% endif %} 20 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_apihooks.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | {% for hook in analysis.memory.apihooks.data %} 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | {% endfor %} 21 | 22 |
PIDProcess NameVictim FunctionHook TypeHooking Module
{{hook.process_id}}{{hook.process_name}}{{hook.victim_function}}{{hook.hook_type}}{{hook.hooking_module}}
23 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_callbacks.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | {% for x in analysis.memory.callbacks.data %} 12 | 13 | 14 | 15 | 16 | 17 | 18 | {% endfor %} 19 | 20 |
TypeCallbackModuleDetails
{{x.type}}{{x.callback}}{{x.module}}{{x.details}}
21 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_devicetree.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | {% for service in analysis.memory.devicetree.data %} 11 | 12 | 13 | 14 | 21 | 22 | {% endfor %} 23 | 24 |
Driver NameDriver OffsetDevices
{{service.driver_name}}{{service.driver_offset}} 15 | {% for device in service.devices %} 16 | {% if device.device_name %} 17 | {{device.device_name}}, 18 | {% endif %} 19 | {% endfor %} 20 |
25 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_gdt.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | {% for x in analysis.memory.gdt.data %} 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | {% endfor %} 27 | 28 |
CPUSelectorBaseLimitTypeDplGranularityPresent
{{x.cpu_number}}{{x.selector}}{{x.base}}{{x.limit}}{{x.type}}{{x.dpl}}{{x.granularity}}{{x.present}}
29 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_idt.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | {% for x in analysis.memory.idt.data %} 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | {% endfor %} 23 | 24 |
CPUIndexSelectorAddressModuleSection
{{x.cpu_number}}{{x.index}}{{x.selector}}{{x.address}}{{x.module}}{{x.section}}
25 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_malfind.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | {% for mal in analysis.memory.malfind.data %} 12 | 13 | 14 | 15 | 16 | 17 | 18 | {% endfor %} 19 | 20 |
PIDProcess NameStartTag
{{mal.process_id}}{{mal.process_name}}{{mal.vad_start}}{{mal.vad_tag}}
21 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_messagehooks.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | {% for x in analysis.memory.messagehooks.data %} 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | {% endfor %} 27 | 28 |
OffsetSessionDesktopThreadFilterFlagsFunctionModule
{{x.offset}}{{x.session}}{{x.desktop}}{{x.thread}}{{x.filter}}{{x.flags}}{{x.function}}{{x.module}}
29 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_modscan.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | {% for mod in analysis.memory.modscan.data %} 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | {% endfor %} 21 | 22 |
Base AddressOffsetNameFileSize
{{mod.kernel_module_base}}{{mod.kernel_module_offset}}{{mod.kernel_module_name}}{{mod.kernel_module_file}}{{mod.kernel_module_size}}
23 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_netscan.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | {% for sock in analysis.memory.netscan.data %} 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | {% endfor %} 25 | 26 |
OffsetPIDLocal AddressLocal PortRemote AddressRemote PortProtocol
{{sock.offset}}{{sock.process_id}}{{sock.local_address}}{{sock.local_port}}{{sock.remote_address}}{{sock.remote_port}}{{sock.protocol}}
27 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_pslist.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | {% for process in analysis.memory.pslist.data %} 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | {% endfor %} 27 | 28 |
Parent PIDPIDNameCreate TimeExit Time# Threads# HandlesSession ID
{{process.parent_id}}{{process.process_id}}{{process.process_name}}{{process.create_time}}{{process.exit_time}}{{process.num_threads}}{{process.num_handles}}{{process.session_id}}
29 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_sockscan.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | {% for sock in analysis.memory.sockscan.data %} 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | {% endfor %} 23 | 24 |
OffsetPIDLocal AddressLocal PortProtocolCreation Time
{{sock.offset}}{{sock.process_id}}{{sock.address}}{{sock.port}}{{sock.protocol}}{{sock.create_time}}
25 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_ssdt.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | {% for x in analysis.memory.ssdt.data %} 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | {% endfor %} 25 | 26 |
IndexTableEntrySyscall NameSyscall AddrSyscall ModnameHook?
{{x.index}}{{x.table}}{{x.entry}}{{x.syscall_name}}{{x.syscall_addr}}{{x.syscall_modname}}{{x.hook_dest_addr}}: {{x.hook_name}}
27 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_timers.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | {% for x in analysis.memory.timers.data %} 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | {% endfor %} 23 | 24 |
OffsetDue TimePeriodSignaledRoutineModule
{{x.offset}}{{x.due_time}}{{x.period}}{{x.signaled}}{{x.routine}}{{x.module}}
25 | -------------------------------------------------------------------------------- /web/templates/analysis/memory/_yarascan.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | {% for x in analysis.memory.yarascan.data %} 11 | 12 | 13 | 14 | 15 | 16 | {% endfor %} 17 | 18 |
OwnerRuleHexdump
{{x.owner}}{{x.rule}}
{{x.hexdump}}
19 | -------------------------------------------------------------------------------- /web/templates/analysis/mitre.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | {% for category in analysis.mitre_attck %} 5 | 6 | {% endfor %} 7 | 8 | {% for category, ttps in analysis.mitre_attck.items %} 9 | 15 | {% endfor %} 16 | 17 |
{{ category }}
10 | {% for ttp in ttps %} 11 |
  • {{ttp.t_id}} - {{ ttp.ttp_name }}
  • 12 |
    • Signature - {{ttp.signature}}
    13 | {% endfor %} 14 |
    18 | -------------------------------------------------------------------------------- /web/templates/analysis/network/_http.html: -------------------------------------------------------------------------------- 1 |

    HTTP Requests

    2 | {% if analysis.network.http %} 3 | 4 | 5 | 6 | 7 | 8 | {% for request in analysis.network.http %} 9 | 10 | 11 | 12 | 13 | {% endfor %} 14 |
    URIData
    {{request.uri}}
    {{request.data}}
    15 | {% else %} 16 |

    No HTTP requests performed.

    17 | {% endif %} -------------------------------------------------------------------------------- /web/templates/analysis/network/_icmp.html: -------------------------------------------------------------------------------- 1 |

    ICMP traffic

    2 | {% if analysis.network.icmp %} 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | {% for packet in analysis.network.icmp %} 11 | 12 | 13 | 14 | 15 | 16 | 17 | {% endfor %} 18 |
    SourceDestinationICMP TypeData
    {{packet.src}}{{packet.dst}}{{packet.type}}{{packet.data}}
    19 | {% else %} 20 |

    No ICMP traffic performed.

    21 | {% endif %} -------------------------------------------------------------------------------- /web/templates/analysis/network/_irc.html: -------------------------------------------------------------------------------- 1 |

    IRC traffic

    2 | {% if analysis.network.irc %} 3 | 4 | 5 | 6 | 7 | 8 | 9 | {% for irc in analysis.network.irc %} 10 | 11 | 12 | 13 | 14 | 15 | {% endfor %} 16 |
    CommandParamsType
    {{irc.command}}{{irc.params}}{{irc.type}}
    17 | {% else %} 18 |

    No IRC requests performed.

    19 | {% endif %} -------------------------------------------------------------------------------- /web/templates/analysis/network/_smtp.html: -------------------------------------------------------------------------------- 1 |

    SMTP traffic

    2 | {% if analysis.network.smtp %} 3 | 4 | 5 | 6 | 7 | 8 | {% for req in analysis.network.smtp %} 9 | 10 | 11 | 12 | 13 | {% endfor %} 14 |
    DestinationData
    {{req.dst}}
    {{req.raw}}
    15 | {% else %} 16 |

    No SMTP traffic performed.

    17 | {% endif %} 18 | -------------------------------------------------------------------------------- /web/templates/analysis/overview/_screenshots.html: -------------------------------------------------------------------------------- 1 |
    2 |

    Screenshots

    3 | {% if analysis.deduplicated_shots %} 4 |
    5 | {% for shot in analysis.deduplicated_shots %} 6 | 7 | 8 | 9 | {% endfor %} 10 |
    11 | {% elif analysis.shots %} 12 |
    13 | {% for shot in analysis.shots %} 14 | 15 | 16 | 17 | {% endfor %} 18 |
    19 | {% else %} 20 | No screenshots available. 21 | {% endif %} 22 |
    23 | -------------------------------------------------------------------------------- /web/templates/analysis/overview/_url.html: -------------------------------------------------------------------------------- 1 |
    2 |

    URL Details

    3 |
    4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
    URL
    {{analysis.target.url}}
    16 |
    17 |
    -------------------------------------------------------------------------------- /web/templates/analysis/overview/_usage.html: -------------------------------------------------------------------------------- 1 |
    2 |

    Usage

    3 |
    4 | 5 |
    6 |
    7 | -------------------------------------------------------------------------------- /web/templates/analysis/static/_java.html: -------------------------------------------------------------------------------- 1 |
    2 |
    3 | {% if analysis.static and analysis.static.java and analysis.static.java.decompiled %} 4 |
    {{analysis.static.java.decompiled}}
    5 | {% endif %} 6 |
    7 |
    -------------------------------------------------------------------------------- /web/templates/analysis/static/_script.html: -------------------------------------------------------------------------------- 1 |
    2 | {% if analysis.static and analysis.static.wsf %} 3 | {% for script in analysis.static.wsf %} 4 |
    5 |
    {{script}}
    6 |
    7 | {% endfor %} 8 | {% else %} 9 | {% if analysis.static and analysis.static.encscript %} 10 |
    11 |
    {{analysis.static.encscript}}
    12 |
    13 | {% endif %} 14 | {% endif %} 15 |
    -------------------------------------------------------------------------------- /web/templates/analysis/static/_strings.html: -------------------------------------------------------------------------------- 1 |
    2 |
    3 | {% for string in analysis.strings %} 4 |
    {{string}}
    5 | {% endfor %} 6 |
    7 |
    -------------------------------------------------------------------------------- /web/templates/analysis/static/_url.html: -------------------------------------------------------------------------------- 1 |
    2 |
    3 |
    4 |

    WHOIS Information

    5 |
    {{ analysis.static.url.whois }}
    6 |
    7 |
    8 |
    9 | -------------------------------------------------------------------------------- /web/templates/analysis/surialert.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% block content %} 3 |

    4 | {% include "analysis/network/_suricata_alerts.html" %} 5 | {% endblock %} 6 | -------------------------------------------------------------------------------- /web/templates/analysis/surifiles.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% block content %} 3 |

    4 | {% include "analysis/network/_suricata_files.html" %} 5 | {% endblock %} 6 | 7 | -------------------------------------------------------------------------------- /web/templates/analysis/surihttp.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% block content %} 3 |

    4 | {% include "analysis/network/_suricata_http.html" %} 5 | {% endblock %} 6 | -------------------------------------------------------------------------------- /web/templates/analysis/suritls.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% block content %} 3 |

    4 | {% include "analysis/network/_suricata_tls.html" %} 5 | {% endblock %} 6 | -------------------------------------------------------------------------------- /web/templates/auth/base_site.html: -------------------------------------------------------------------------------- 1 | {% extends "auth/base.html" %} 2 | 3 | {% block title %}{{ title }} | {{ site_title|default:_('CAPE Sandbox') }}{% endblock %} 4 | 5 | {% block branding %} 6 |

    {{ site_header|default:_('CAPE Sandbox') }}

    7 | {% endblock %} 8 | 9 | {% block nav-global %}{% endblock %} 10 | -------------------------------------------------------------------------------- /web/templates/auth/logout.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% load i18n %} 3 | 4 | {% block content %} 5 |

    {% trans "Logged out" %}

    6 | {% endblock %} 7 | -------------------------------------------------------------------------------- /web/templates/base.html: -------------------------------------------------------------------------------- 1 | {%include "header.html" %} 2 |
    3 | {% autoescape on %} 4 | {% block content %}{% endblock %} 5 | {% endautoescape %} 6 |
    7 | {%include "footer.html" %} 8 | -------------------------------------------------------------------------------- /web/templates/compare/_info.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 |
    IDNameMD5MachineCompleted OnDuration
    {{record.info.id}}{{record.target.file.name}}{{record.target.file.md5}}{{record.info.machine.name}}{{record.info.ended}}{{record.info.duration}} seconds
    23 | -------------------------------------------------------------------------------- /web/templates/compare/_summary_table.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | {% for record in records %} 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | {% endfor %} 23 | 24 |
    IDNameMachineCompleted OnDurationSelect
    {{record.info.id}}{{record.target.file.name}}{{record.info.machine.name}}{{record.info.ended}}{{record.info.duration}} secondsSelect
    25 | -------------------------------------------------------------------------------- /web/templates/compare/hash.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% block content %} 3 |

    4 | 5 |
    6 |
    7 |

    Analysis 1

    8 | 9 | {% include "compare/_info.html" with record=left %} 10 |
    11 |
    12 |

    Analysis 2

    13 | 14 |

    You need to select the second analysis.

    15 | {% if records.count > 0 %} 16 |

    Following are all the analyses of the file with provided MD5 {{hash}}:

    17 | {% include "compare/_summary_table.html" %} 18 | {% else %} 19 |

    There is no analysis for the specified file or you selected the same selected analysis.

    20 | {% endif %} 21 |
    22 |
    23 | {% endblock %} 24 | -------------------------------------------------------------------------------- /web/templates/error.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% block content %} 3 |

    4 |
    ERROR :-(
    {{error}}
    5 | {% endblock %} -------------------------------------------------------------------------------- /web/templates/footer.html: -------------------------------------------------------------------------------- 1 | 3 | 8 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | -------------------------------------------------------------------------------- /web/templates/standalone_error.html: -------------------------------------------------------------------------------- 1 |
    ERROR :-(
    {{error}}
    2 | -------------------------------------------------------------------------------- /web/templates/submission/complete.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% block content %} 3 |

    4 |

    Submission complete!

    5 | The following tasks were added successfully: 6 | {% for task in tasks %} 7 | {{task}} 8 | {% endfor %}. 9 | Click on the links to monitor the status of the submission. 10 |
    11 | {% if failed_hashes %} 12 |

    Submission Failed!

    13 | The following tasks failed: 14 | {% for ftask in failed_hashes %} 15 |

    {{ftask}}

    16 | {% endfor %} 17 |
    18 | {% endif %} 19 | {% endblock %} 20 | -------------------------------------------------------------------------------- /web/templates/submission/status.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% block content %} 3 |

    4 | {% if completed %} 5 |

    Good news! :-)

    The analysis is completed, you can view it here.
    6 | {% else %} 7 | 8 |
    9 |

    Hang on...

    10 |

    The analysis is not finished yet, it's still {{status}}. This page will refresh every 30 seconds.

    11 |
    12 |
    13 |
    14 |
    15 | {% endif %} 16 | {% endblock %} 17 | -------------------------------------------------------------------------------- /web/templates/success.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% block content %} 3 |

    4 |

    Submission complete!

    5 | The following tasks were added successfully: 6 | {% for task in tasks %} 7 | {{task}} 8 | {% endfor %}. 9 | Click on the links to monitor the status of the submission. 10 |
    11 | {% endblock %} 12 | -------------------------------------------------------------------------------- /web/templates/success_simple.html: -------------------------------------------------------------------------------- 1 | {% extends "base.html" %} 2 | {% block content %} 3 |

    4 |
    {{message}}
    5 | {% endblock %} -------------------------------------------------------------------------------- /web/web/__init__.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. -------------------------------------------------------------------------------- /web/web/headers.py: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2010-2015 Cuckoo Foundation. 2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 3 | # See the file 'docs/LICENSE' for copying permission. 4 | 5 | import sys 6 | 7 | from django.conf import settings 8 | 9 | sys.path.append(settings.CUCKOO_PATH) 10 | 11 | from lib.cuckoo.common.constants import CUCKOO_VERSION 12 | 13 | class CuckooHeaders(object): 14 | """Set Cuckoo custom response headers.""" 15 | 16 | def process_response(self, request, response): 17 | response["Server"] = "Machete Server" 18 | response["X-Cuckoo-Version"] = CUCKOO_VERSION 19 | response["X-Content-Type-Options"] = "nosniff" 20 | response["X-Frame-Options"] = "DENY" 21 | response["X-XSS-Protection"] = "1; mode=block" 22 | response["Pragma"] = "no-cache" 23 | response["Cache-Control"] = "no-cache" 24 | response["Expires"] = "0" 25 | 26 | return response --------------------------------------------------------------------------------