├── .gitignore
├── .travis.yml
├── CODE_OF_CONDUCT.md
├── README.md
├── SECURITY.md
├── agent
└── agent.py
├── analyzer
└── windows
│ ├── analyzer.py
│ ├── bin
│ ├── flashplayer.exe
│ ├── loader.exe
│ ├── loader_x64.exe
│ ├── oldloader.exe
│ ├── oldloader_x64.exe
│ └── signtool.exe
│ ├── dll
│ ├── Debugger.dll
│ ├── Debugger_x64.dll
│ ├── Doppelganging.dll
│ ├── Doppelganging_x64.dll
│ ├── EvilGrab.dll
│ ├── IcedID.dll
│ ├── OldExtraction.dll
│ ├── PlugX.dll
│ ├── QakBot.dll
│ ├── Sedreco.dll
│ ├── Sedreco_x64.dll
│ ├── UPX.dll
│ ├── UPX_x64.dll
│ ├── Ursnif.dll
│ ├── Ursnif_x64.dll
│ ├── capemon.dll
│ ├── capemon_x64.dll
│ ├── cuckoomon.dll
│ └── cuckoomon_x64.dll
│ ├── lib
│ ├── __init__.py
│ ├── api
│ │ ├── __init__.py
│ │ ├── process.py
│ │ ├── screenshot.py
│ │ └── utils.py
│ ├── common
│ │ ├── __init__.py
│ │ ├── abstracts.py
│ │ ├── constants.py
│ │ ├── defines.py
│ │ ├── errors.py
│ │ ├── exceptions.py
│ │ ├── hashing.py
│ │ ├── rand.py
│ │ └── results.py
│ └── core
│ │ ├── __init__.py
│ │ ├── config.py
│ │ ├── log.py
│ │ ├── packages.py
│ │ ├── privileges.py
│ │ └── startup.py
│ └── modules
│ ├── __init__.py
│ ├── auxiliary
│ ├── __init__.py
│ ├── browser.py
│ ├── curtain.py
│ ├── digisig.py
│ ├── disguise.py
│ ├── human.py
│ ├── screenshots.py
│ ├── sysmon.py
│ └── usage.py
│ └── packages
│ ├── Combo.py
│ ├── Combo_dll.py
│ ├── Compression.py
│ ├── Compression_dll.py
│ ├── Compression_doc.py
│ ├── Compression_js.py
│ ├── Compression_pdf.py
│ ├── Compression_zip.py
│ ├── Debugger.py
│ ├── Debugger_dll.py
│ ├── Debugger_doc.py
│ ├── Doppelganging.py
│ ├── DumpOnAPI.py
│ ├── Emotet.py
│ ├── Emotet_batch.py
│ ├── Emotet_doc.py
│ ├── EvilGrab.py
│ ├── Extraction.py
│ ├── Extraction_dll.py
│ ├── Extraction_jar.py
│ ├── Extraction_js.py
│ ├── Extraction_pdf.py
│ ├── Extraction_ps1.py
│ ├── Extraction_regsvr.py
│ ├── Extraction_zip.py
│ ├── Hancitor.py
│ ├── Hancitor_dll.py
│ ├── Hancitor_doc.py
│ ├── IcedID.py
│ ├── Injection.py
│ ├── Injection_dll.py
│ ├── Injection_doc.py
│ ├── Injection_js.py
│ ├── Injection_pdf.py
│ ├── Injection_ps1.py
│ ├── Injection_zip.py
│ ├── PlugX.py
│ ├── PlugXPayload.py
│ ├── PlugX_dll.py
│ ├── PlugX_doc.py
│ ├── PlugX_zip.py
│ ├── QakBot.py
│ ├── Sedreco.py
│ ├── Sedreco_dll.py
│ ├── Shellcode-Extraction.py
│ ├── Shellcode.py
│ ├── Shellcode_x64.py
│ ├── TrickBot.py
│ ├── TrickBot_doc.py
│ ├── UPX.py
│ ├── UPX_dll.py
│ ├── Ursnif.py
│ ├── Ursnif_doc.py
│ ├── __init__.py
│ ├── applet.py
│ ├── chm.py
│ ├── chrome.py
│ ├── cpl.py
│ ├── cuckoomon.py
│ ├── cuckoomon_dll.py
│ ├── dll.py
│ ├── doc.py
│ ├── doc2016.py
│ ├── eml.py
│ ├── exe.py
│ ├── firefox.py
│ ├── generic.py
│ ├── hta.py
│ ├── html.py
│ ├── ie.py
│ ├── jar.py
│ ├── js.py
│ ├── mht.py
│ ├── msg.py
│ ├── msi.py
│ ├── pdf.py
│ ├── ppt.py
│ ├── ps1.py
│ ├── ps1_64.py
│ ├── pub.py
│ ├── python.py
│ ├── rar.py
│ ├── regsvr.py
│ ├── sct.py
│ ├── service.py
│ ├── swf.py
│ ├── vbs.py
│ ├── wsf.py
│ ├── xls.py
│ ├── xps.py
│ ├── zip.py
│ └── zip_batch.py
├── conf
├── api.conf
├── auxiliary.conf
├── cuckoo.conf
├── esx.conf
├── kvm.conf
├── kvmremote.conf
├── malheur.conf
├── memory.conf
├── multi.conf
├── physical.conf
├── processing.conf
├── reporting.conf
├── smtp_sinkhole.conf
├── socks5.conf
├── virtualbox.conf
├── vmware.conf
├── vmwarerest.conf
├── vmwareserver.conf
├── vpn.conf
├── vsphere.conf
└── xenserver.conf
├── cuckoo.py
├── cuckoo.pyproj
├── cuckoo.sln
├── cuckoo.v11.suo
├── data
├── html
│ ├── base-report.html
│ ├── base-web.html
│ ├── browse.html
│ ├── css
│ │ ├── bootstrap-responsive.min.css
│ │ └── bootstrap.min.css
│ ├── error.html
│ ├── graphic
│ │ └── logo.html
│ ├── img
│ │ ├── glyphicons-halflings-white.png
│ │ └── glyphicons-halflings.png
│ ├── js
│ │ ├── bootstrap.min.js
│ │ ├── functions.js
│ │ └── jquery.min.js
│ ├── maec_api_call_mappings.json
│ ├── pagination-menu.html
│ ├── pagination-rpp.html
│ ├── report.html
│ ├── sections
│ │ ├── behavior.html
│ │ ├── dropped.html
│ │ ├── errors.html
│ │ ├── file.html
│ │ ├── info.html
│ │ ├── network.html
│ │ ├── screenshots.html
│ │ ├── signatures.html
│ │ ├── static.html
│ │ ├── url.html
│ │ └── volatility.html
│ ├── statistics.html
│ ├── statistics
│ │ └── README
│ ├── submit.html
│ └── success.html
├── ja3
│ └── ja3fingerprint.json
├── maec_api_call_mappings.json
├── mitre_attack.json
├── peutils
│ └── UserDB.TXT
├── signature_overlay.json
├── src
│ └── binpackage
│ │ ├── Makefile
│ │ └── execsc.c
├── test-internet.vbs
└── yara
│ ├── CAPE
│ ├── AAR.yar
│ ├── Adzok.yar
│ ├── AgentTesla.yar
│ ├── AlienSpy.yar
│ ├── Ap0calypse.yar
│ ├── Arcom.yar
│ ├── Arkei.yar
│ ├── Atlas.yar
│ ├── Azer.yar
│ ├── Azorult.yar
│ ├── BackOffLoader.yar
│ ├── BackOffPOS.yar
│ ├── BadRabbit.yar
│ ├── Bandook.yar
│ ├── BitPaymer.yar
│ ├── BlackNix.yar
│ ├── BlackShades.yar
│ ├── BlueBanana.yar
│ ├── Bozok.yar
│ ├── Cerber.yar
│ ├── ChChes.yar
│ ├── ClientMesh.yar
│ ├── Clop.yar
│ ├── CobaltStrikeBeacon.yar
│ ├── Codoso.yar
│ ├── Cryptoshield.yar
│ ├── Cutlet.yar
│ ├── CyberGate.yar
│ ├── DarkComet.yar
│ ├── DarkRAT.yar
│ ├── DoppelPaymer.yar
│ ├── Dreambot.yar
│ ├── Dridex.yar
│ ├── DridexLoader.yar
│ ├── DridexV4.yar
│ ├── Emotet.yar
│ ├── Emotet_Loader.yar
│ ├── Enfal.yar
│ ├── EternalRomance.yar
│ ├── EvilGrab.yar
│ ├── Fareit.yar
│ ├── Formbook.yar
│ ├── Gandcrab.yar
│ ├── Gootkit.yar
│ ├── Greame.yar
│ ├── Hancitor.yar
│ ├── HawkEye.yar
│ ├── HawkEyev9.yar
│ ├── Hermes.yar
│ ├── HttpBrowser.yar
│ ├── IcedID.yar
│ ├── Imminent.yar
│ ├── Infinity.yar
│ ├── Jaff.yar
│ ├── JavaDropper.yar
│ ├── KeyBase.yar
│ ├── Kovter.yar
│ ├── Kronos.yar
│ ├── Locky.yar
│ ├── Loki.yar
│ ├── LostDoor.yar
│ ├── LuminosityLink.yar
│ ├── LuxNet.yar
│ ├── Magniber.yar
│ ├── Mangzamel.yar
│ ├── Maze.yar
│ ├── MedusaLocker.yar
│ ├── MegaCortex.yar
│ ├── Mole.yar
│ ├── NanoCore.yar
│ ├── NanoLocker.yar
│ ├── NetTraveler.yar
│ ├── NetWire.yar
│ ├── OlympicDestroyer.yar
│ ├── Pandora.yar
│ ├── Paradox.yar
│ ├── PatchWork.yar
│ ├── PetrWrap.yar
│ ├── Petya.yar
│ ├── Phorpiex.yar
│ ├── Plasma.yar
│ ├── PoisonIvy.yar
│ ├── PowerPool.yar
│ ├── PredatorPain.yar
│ ├── Punisher.yar
│ ├── PythoRAT.yar
│ ├── QRat.yar
│ ├── QakBot.yar
│ ├── RCSession.yar
│ ├── REvil.yar
│ ├── Ramnit.yar
│ ├── RedLeaf.yar
│ ├── Redsip.yar
│ ├── Remcos.yar
│ ├── Retefe.yar
│ ├── RokRat.yar
│ ├── Ryuk.yar
│ ├── Sakula.yar
│ ├── Scarab.yar
│ ├── Sedreco.yar
│ ├── Seduploader.yar
│ ├── Shade.yar
│ ├── ShadowTech.yar
│ ├── SmallNet.yar
│ ├── SmokeLoader.yar
│ ├── SpyGate.yar
│ ├── Sub7Nation.yar
│ ├── T5000.yar
│ ├── TClient.yar
│ ├── TSCookie.yar
│ ├── TreasureHunter.yar
│ ├── TrickBot.yar
│ ├── UPX.yar
│ ├── Ursnif.yar
│ ├── Ursnif3.yar
│ ├── Varenyky.yar
│ ├── Vertex.yar
│ ├── Vidar.yar
│ ├── VirusRat.yar
│ ├── WanaCry.yar
│ ├── Xtreme.yar
│ ├── ZeroT.yar
│ ├── ZeusPanda.yar
│ ├── adWind.yar
│ ├── jRat.yar
│ ├── njRat.yar
│ ├── tRat.yar
│ ├── unrecom.yar
│ └── xRAT.yar
│ ├── binaries
│ ├── HeavensGate.yar
│ ├── embedded.yar
│ ├── shellcodes.yar
│ └── vmdetect.yar
│ ├── memory
│ ├── .gitignore
│ ├── Exploit_HT_Flash_Vars.yar
│ ├── Exploit_HT_VRename.yar
│ ├── adgholas.yar
│ ├── angler.yar
│ ├── astrum.yar
│ ├── cve_2013_2551.yar
│ ├── cve_2014_0515.yar
│ ├── cve_2014_0569.yar
│ ├── cve_2014_6332.yar
│ ├── cve_2015_0016.yar
│ ├── cve_2015_2419.yar
│ ├── cve_2015_2545.yar
│ ├── cve_2015_5122.yar
│ ├── cve_2016_0189.yar
│ ├── cve_2016_3298.yar
│ ├── darkcomet.yar
│ ├── dridex.yar
│ ├── dyre.yar
│ ├── eitest.yar
│ ├── flash_exploits.yar
│ ├── kazybot.yar
│ ├── neutrino.yar
│ ├── nuclear.yar
│ ├── rig.yar
│ ├── shellcodes.yar
│ └── sundown.yar
│ └── urls
│ └── .gitignore
├── docs
├── AUTHORS
├── CHANGELOG
├── LICENSE
├── README
└── book
│ └── src
│ ├── Makefile
│ ├── _images
│ ├── logo
│ │ └── cuckoo.png
│ ├── schemas
│ │ └── architecture-main.png
│ └── screenshots
│ │ ├── fog_host_management.png
│ │ ├── fog_image_management.png
│ │ ├── fog_scheduled_job.png
│ │ ├── shared_folders.png
│ │ ├── windows_network.png
│ │ ├── windows_registry.png
│ │ └── windows_security.png
│ ├── conf.py
│ ├── customization
│ ├── auxiliary.rst
│ ├── index.rst
│ ├── machinery.rst
│ ├── packages.rst
│ ├── processing.rst
│ ├── reporting.rst
│ └── signatures.rst
│ ├── development
│ ├── code_style.rst
│ ├── development_notes.rst
│ └── index.rst
│ ├── faq
│ └── index.rst
│ ├── finalremarks
│ └── index.rst
│ ├── index.rst
│ ├── installation
│ ├── guest
│ │ ├── agent.rst
│ │ ├── cloning.rst
│ │ ├── creation.rst
│ │ ├── index.rst
│ │ ├── network.rst
│ │ ├── requirements.rst
│ │ └── saving.rst
│ ├── guest_physical
│ │ ├── creation.rst
│ │ ├── index.rst
│ │ ├── network.rst
│ │ ├── requirements.rst
│ │ └── saving.rst
│ ├── host
│ │ ├── configuration.rst
│ │ ├── index.rst
│ │ ├── installation.rst
│ │ └── requirements.rst
│ ├── index.rst
│ └── upgrade.rst
│ ├── introduction
│ ├── index.rst
│ ├── license.rst
│ ├── sandboxing.rst
│ └── what.rst
│ └── usage
│ ├── api.rst
│ ├── clean.rst
│ ├── dist.rst
│ ├── index.rst
│ ├── packages.rst
│ ├── performance.rst
│ ├── results.rst
│ ├── start.rst
│ ├── submit.rst
│ ├── utilities.rst
│ └── web.rst
├── extra
├── buildvswitch.sh
├── services
│ ├── cuckoo
│ ├── moloch
│ ├── openvswitch-switch
│ └── suricata
├── suricata.yaml
└── whitelist_domains.txt
├── lib
├── __init__.py
├── cuckoo
│ ├── __init__.py
│ ├── common
│ │ ├── __init__.py
│ │ ├── abstracts.py
│ │ ├── cape_utils.py
│ │ ├── colors.py
│ │ ├── compare.py
│ │ ├── compressor.py
│ │ ├── config.py
│ │ ├── constants.py
│ │ ├── decoders
│ │ │ ├── __init__.py
│ │ │ ├── alienspy.py
│ │ │ ├── darkcomet.py
│ │ │ ├── nanocore.py
│ │ │ ├── njrat.py
│ │ │ └── qrat.py
│ │ ├── defines.py
│ │ ├── demux.py
│ │ ├── dist_db.py
│ │ ├── dns.py
│ │ ├── email_utils.py
│ │ ├── exceptions.py
│ │ ├── graphs
│ │ │ ├── __init__.py
│ │ │ └── binGraph
│ │ │ │ ├── __init__.py
│ │ │ │ ├── binGraph.py
│ │ │ │ ├── graphs
│ │ │ │ ├── __init__.py
│ │ │ │ ├── ent
│ │ │ │ │ ├── __init.py__
│ │ │ │ │ └── graph.py
│ │ │ │ └── hist
│ │ │ │ │ ├── __init.py__
│ │ │ │ │ └── graph.py
│ │ │ │ └── requirements.txt
│ │ ├── icon.py
│ │ ├── irc.py
│ │ ├── ja3
│ │ │ ├── __init__.py
│ │ │ └── ja3.py
│ │ ├── logo.py
│ │ ├── logtbl.py
│ │ ├── netlog.py
│ │ ├── objects.py
│ │ ├── office
│ │ │ ├── DridexURLDecoder.py
│ │ │ ├── __init__.py
│ │ │ ├── msgextract.py
│ │ │ ├── vba2graph.py
│ │ │ └── vbadeobf.py
│ │ ├── pdftools
│ │ │ ├── __init__.py
│ │ │ ├── pdf-parser.py
│ │ │ └── pdfid.py
│ │ ├── peepdf
│ │ │ ├── AUTHORS
│ │ │ ├── CHANGELOG
│ │ │ ├── COPYING
│ │ │ ├── JSAnalysis.py
│ │ │ ├── PDFCore.py
│ │ │ ├── PDFCrypto.py
│ │ │ ├── PDFFilters.py
│ │ │ ├── PDFUtils.py
│ │ │ ├── README
│ │ │ ├── TODO
│ │ │ ├── __init__.py
│ │ │ ├── aes.py
│ │ │ ├── aespython
│ │ │ │ ├── __init__.py
│ │ │ │ ├── aes_cipher.py
│ │ │ │ ├── aes_tables.py
│ │ │ │ ├── cbc_mode.py
│ │ │ │ ├── cfb_mode.py
│ │ │ │ ├── key_expander.py
│ │ │ │ ├── ofb_mode.py
│ │ │ │ └── test_keys.py
│ │ │ ├── ccitt.py
│ │ │ ├── colorama
│ │ │ │ ├── PKG-INFO
│ │ │ │ ├── __init__.py
│ │ │ │ ├── ansi.py
│ │ │ │ ├── ansitowin32.py
│ │ │ │ ├── initialise.py
│ │ │ │ ├── win32.py
│ │ │ │ └── winterm.py
│ │ │ ├── jjdecode.py
│ │ │ ├── jsbeautifier
│ │ │ │ ├── __init__.py
│ │ │ │ └── unpackers
│ │ │ │ │ ├── README.specs.mkd
│ │ │ │ │ ├── __init__.py
│ │ │ │ │ ├── evalbased.py
│ │ │ │ │ ├── javascriptobfuscator.py
│ │ │ │ │ ├── myobfuscate.py
│ │ │ │ │ ├── packer.py
│ │ │ │ │ └── urlencode.py
│ │ │ ├── lzw.py
│ │ │ └── peepdf.dtd
│ │ ├── quarantine.py
│ │ ├── saztopcap.py
│ │ ├── signature_utils.py
│ │ ├── utils.py
│ │ └── web_utils.py
│ └── core
│ │ ├── __init__.py
│ │ ├── database.py
│ │ ├── guest.py
│ │ ├── plugins.py
│ │ ├── resultserver.py
│ │ ├── rooter.py
│ │ ├── scheduler.py
│ │ └── startup.py
└── maec
│ ├── __init__.py
│ ├── maec11.py
│ └── maec41.py
├── modules
├── __init__.py
├── auxiliary
│ ├── __init__.py
│ └── sniffer.py
├── feeds
│ ├── __init__.py
│ └── bad_ssl_certs.py
├── machinery
│ ├── __init__.py
│ ├── esx.py
│ ├── kvm.py
│ ├── kvmremote.py
│ ├── multi.py
│ ├── physical.py
│ ├── virtualbox.py
│ ├── vmware.py
│ ├── vmwarerest.py
│ ├── vmwareserver.py
│ ├── vsphere.py
│ └── xenserver.py
├── processing
│ ├── CAPE.py
│ ├── __init__.py
│ ├── analysisinfo.py
│ ├── behavior.py
│ ├── cif.py
│ ├── curtain.py
│ ├── debug.py
│ ├── decompression.py
│ ├── deduplication.py
│ ├── dropped.py
│ ├── maliciousmacrobot.py
│ ├── memory.py
│ ├── network.py
│ ├── parsers
│ │ ├── __init__.py
│ │ ├── malwareconfig
│ │ │ ├── AAR.py
│ │ │ ├── Adzok.py
│ │ │ ├── AlienSpy.py
│ │ │ ├── Arcom.py
│ │ │ ├── BackOffLoader.py
│ │ │ ├── BackOffPOS.py
│ │ │ ├── BlackNix.py
│ │ │ ├── BlackShades.py
│ │ │ ├── BlueBanana.py
│ │ │ ├── Bozok.py
│ │ │ ├── ClientMesh.py
│ │ │ ├── CobaltStrikeBeacon.py
│ │ │ ├── CyberGate.py
│ │ │ ├── DarkComet.py
│ │ │ ├── DarkRAT.py
│ │ │ ├── Greame.py
│ │ │ ├── HawkEye.py
│ │ │ ├── JavaDropper.py
│ │ │ ├── LostDoor.py
│ │ │ ├── LuminosityLink.py
│ │ │ ├── LuxNet.py
│ │ │ ├── NanoCore.py
│ │ │ ├── NetWire.py
│ │ │ ├── Nymaim.py
│ │ │ ├── Pandora.py
│ │ │ ├── Plasma.py
│ │ │ ├── PoisonIvy.py
│ │ │ ├── PredatorPain.py
│ │ │ ├── Punisher.py
│ │ │ ├── REvil.py
│ │ │ ├── Sakula.py
│ │ │ ├── ScriptDump.py
│ │ │ ├── SmallNet.py
│ │ │ ├── TSCookie.py
│ │ │ ├── TrickBot.py
│ │ │ ├── Ursnif.py
│ │ │ ├── Xtreme.py
│ │ │ ├── _ShadowTech.py
│ │ │ ├── _SpyGate.py
│ │ │ ├── _VirusRat.py
│ │ │ ├── __init__.py
│ │ │ ├── _jRat.py
│ │ │ ├── adWind.py
│ │ │ ├── njRat.py
│ │ │ ├── pyAndroRat.py
│ │ │ ├── pyDendroid.py
│ │ │ ├── pyRattyExtractor.py
│ │ │ ├── pySandroRat.py
│ │ │ ├── pySpyNote.py
│ │ │ ├── unrecom.py
│ │ │ └── xRAT.py
│ │ ├── mwcp
│ │ │ ├── __init__.py
│ │ │ ├── config
│ │ │ │ ├── __init__.py
│ │ │ │ └── log_config.yml
│ │ │ ├── parser.py
│ │ │ ├── parsers
│ │ │ │ ├── Azorult.py
│ │ │ │ ├── BitPaymer.py
│ │ │ │ ├── ChChes.py
│ │ │ │ ├── DoppelPaymer.py
│ │ │ │ ├── DridexLoader.py
│ │ │ │ ├── Emotet.py
│ │ │ │ ├── Enfal.py
│ │ │ │ ├── EvilGrab.py
│ │ │ │ ├── HttpBrowser.py
│ │ │ │ ├── IcedID.py
│ │ │ │ ├── Loki.py
│ │ │ │ ├── QakBot.py
│ │ │ │ ├── RCSession.py
│ │ │ │ ├── RedLeaf.py
│ │ │ │ ├── Redsip.py
│ │ │ │ ├── Remcos.py
│ │ │ │ ├── Retefe.py
│ │ │ │ ├── SmokeLoader.py
│ │ │ │ └── __init__.py
│ │ │ ├── reporter.py
│ │ │ ├── resources
│ │ │ │ ├── __init__.py
│ │ │ │ ├── dispatcher.py
│ │ │ │ ├── fields.json
│ │ │ │ ├── fields.txt
│ │ │ │ └── techanarchy_bridge.py
│ │ │ ├── tester.py
│ │ │ └── utils
│ │ │ │ ├── __init__.py
│ │ │ │ ├── construct
│ │ │ │ ├── __init__.py
│ │ │ │ ├── construct_html.py
│ │ │ │ ├── construct_template.html
│ │ │ │ ├── helpers.py
│ │ │ │ ├── windows_enums.py
│ │ │ │ └── windows_structures.py
│ │ │ │ ├── custombase64.py
│ │ │ │ ├── elffileutils.py
│ │ │ │ ├── logutil.py
│ │ │ │ ├── multi_proc.py
│ │ │ │ ├── pefileutils.py
│ │ │ │ └── stringutils.py
│ │ └── plugxconfig
│ │ │ ├── __init__.py
│ │ │ └── plugx.py
│ ├── procdump.py
│ ├── procmemory.py
│ ├── static.py
│ ├── strings.py
│ ├── suricata.py
│ ├── sysmon.py
│ ├── targetinfo.py
│ ├── trid.py
│ ├── usage.py
│ └── virustotal.py
├── reporting
│ ├── __init__.py
│ ├── bingraph.py
│ ├── callback.py
│ ├── compression.py
│ ├── compressresults.py
│ ├── elasticsearchdb.py
│ ├── jsondump.py
│ ├── maec41.py
│ ├── maec5.py
│ ├── malheur.py
│ ├── misp.py
│ ├── mitre.py
│ ├── mmdef.py
│ ├── moloch.py
│ ├── mongodb.py
│ ├── ramfsclean.py
│ ├── reporthtml.py
│ ├── reporthtmlsummary.py
│ ├── reportpdf.py
│ ├── resubmitexe.py
│ ├── retention.py
│ ├── submitCAPE.py
│ └── syslog.py
└── signatures
│ ├── CAPE.py
│ ├── __init__.py
│ ├── alphacrypt_apis.py
│ ├── andromeda_apis.py
│ ├── anomalous_deletefile.py
│ ├── antianalysis_detectfile.py
│ ├── antianalysis_detectreg.py
│ ├── antiav_avast_libs.py
│ ├── antiav_bitdefender_libs.py
│ ├── antiav_bypass.py
│ ├── antiav_detectfile.py
│ ├── antiav_detectreg.py
│ ├── antiav_servicestop.py
│ ├── antiav_srp.py
│ ├── antidbg_devices.py
│ ├── antidbg_windows.py
│ ├── antidebug_addvectoredexceptionhandler.py
│ ├── antidebug_checkremotedebuggerpresent.py
│ ├── antidebug_debugactiveprocess.py
│ ├── antidebug_gettickcount.py
│ ├── antidebug_guardpages.py
│ ├── antidebug_ntcreatethreadex.py
│ ├── antidebug_ntsetinformationthread.py
│ ├── antidebug_outputdebugstring.py
│ ├── antidebug_setunhandledexceptionfilter.py
│ ├── antiemu_wine.py
│ ├── antiemu_wine_func.py
│ ├── antisandbox_check_userdomain.py
│ ├── antisandbox_cuckoo.py
│ ├── antisandbox_cuckoo_files.py
│ ├── antisandbox_cuckoocrash.py
│ ├── antisandbox_fortinet_files.py
│ ├── antisandbox_joe_anubis_files.py
│ ├── antisandbox_mouse_hook.py
│ ├── antisandbox_restart.py
│ ├── antisandbox_sboxie_libs.py
│ ├── antisandbox_sboxie_mutex.py
│ ├── antisandbox_sboxie_objects.py
│ ├── antisandbox_scripttimer.py
│ ├── antisandbox_sleep.py
│ ├── antisandbox_sunbelt_files.py
│ ├── antisandbox_sunbelt_libs.py
│ ├── antisandbox_suspend.py
│ ├── antisandbox_threattrack_files.py
│ ├── antisandbox_unhook.py
│ ├── antivirus_virustotal.py
│ ├── antivm_bochs_keys.py
│ ├── antivm_dirobjects.py
│ ├── antivm_generic_bios.py
│ ├── antivm_generic_cpu.py
│ ├── antivm_generic_disk.py
│ ├── antivm_generic_disk_setupapi.py
│ ├── antivm_generic_diskreg.py
│ ├── antivm_generic_scsi.py
│ ├── antivm_generic_services.py
│ ├── antivm_generic_system.py
│ ├── antivm_hyperv_keys.py
│ ├── antivm_parallels_keys.py
│ ├── antivm_vbox_devices.py
│ ├── antivm_vbox_files.py
│ ├── antivm_vbox_keys.py
│ ├── antivm_vbox_libs.py
│ ├── antivm_vbox_provname.py
│ ├── antivm_vbox_window.py
│ ├── antivm_vmware_devices.py
│ ├── antivm_vmware_events.py
│ ├── antivm_vmware_files.py
│ ├── antivm_vmware_keys.py
│ ├── antivm_vmware_libs.py
│ ├── antivm_vmware_mutexes.py
│ ├── antivm_vpc_files.py
│ ├── antivm_vpc_keys.py
│ ├── antivm_vpc_mutex.py
│ ├── antivm_xen_keys.py
│ ├── api_spamming.py
│ ├── backdoor_ketrican_regkeys.py
│ ├── backdoor_okrum_mutex.py
│ ├── bad_certs.py
│ ├── bad_ssl_certs.py
│ ├── banker_cridex.py
│ ├── banker_geodo.py
│ ├── banker_prinimalka.py
│ ├── banker_spyeye_mutex.py
│ ├── banker_zeus_mutex.py
│ ├── banker_zeus_p2p.py
│ ├── banker_zeus_url.py
│ ├── bcdedit_command.py
│ ├── betabot_apis.py
│ ├── bitcoin_opencl.py
│ ├── bootkit.py
│ ├── bot_athenahttp.py
│ ├── bot_dirtjumper.py
│ ├── bot_drive.py
│ ├── bot_drive2.py
│ ├── bot_madness.py
│ ├── bot_russkill.py
│ ├── browser_addon.py
│ ├── browser_bho.py
│ ├── browser_needed.py
│ ├── browser_proxy.py
│ ├── browser_scanbox.py
│ ├── browser_security.py
│ ├── browser_startpage.py
│ ├── bypass_applocker.py
│ ├── bypass_firewall.py
│ ├── bypass_uac.py
│ ├── cape_extracted.py
│ ├── carberp_mutex.py
│ ├── cerber_apis.py
│ ├── chimera_apis.py
│ ├── clamav.py
│ ├── clears_logs.py
│ ├── clickfraud_cookies.py
│ ├── clickfraud_volume.py
│ ├── cmdline_anomaly.py
│ ├── codelux_apis.py
│ ├── compile_dotnet_code.py
│ ├── copies_self.py
│ ├── creates_exe.py
│ ├── creates_largekey.py
│ ├── creates_nullvalue.py
│ ├── credential_dumping.py
│ ├── critical_process.py
│ ├── cryptomining.py
│ ├── cryptopools.py
│ ├── cryptowall_apis.py
│ ├── cve_2014_6332.py
│ ├── cve_2015_2419.py
│ ├── cve_2016-0189.py
│ ├── cve_2016_7200.py
│ ├── darkcomet_regkeys.py
│ ├── dead_connect.py
│ ├── dead_link.py
│ ├── debugs_self.py
│ ├── decoy_doc.py
│ ├── deepfreeze_mutex.py
│ ├── deletes_self.py
│ ├── deletes_shadowcopies.py
│ ├── deletes_system_backup.py
│ ├── dep_bypass.py
│ ├── dep_disable.py
│ ├── disables_app.py
│ ├── disables_browserwarn.py
│ ├── disables_drives_autodisconnect.py
│ ├── disables_run_command.py
│ ├── disables_spdy.py
│ ├── disables_sysrestore.py
│ ├── disables_uac.py
│ ├── disables_wer.py
│ ├── disables_wfp.py
│ ├── disables_windefender.py
│ ├── disables_windowsupdate.py
│ ├── downloader_andromut_mutex.py
│ ├── downloader_cabby.py
│ ├── downloader_protonbot_mutex.py
│ ├── dridex_apis.py
│ ├── driver_load.py
│ ├── dropper.py
│ ├── dropper_js.py
│ ├── dynamic_function_loading.py
│ ├── dyre_apis.py
│ ├── ek_angler.py
│ ├── ek_gondad.py
│ ├── ek_heapsray.py
│ ├── ek_javaapplet.py
│ ├── ek_neutrino.py
│ ├── ek_nuclear.py
│ ├── ek_rig.py
│ ├── ek_silverlight.py
│ ├── ek_sundown.py
│ ├── ek_virtualcheck.py
│ ├── encrypted_ioc.py
│ ├── exec_crash.py
│ ├── exploit_getbasekerneladdress.py
│ ├── exploit_gethaldispatchtable.py
│ ├── exploit_heapspray.py
│ ├── family_proxyback.py
│ ├── forces_mappeddrives_uac.py
│ ├── generic_metrics.py
│ ├── generic_phish.py
│ ├── gootkit_apis.py
│ ├── h1n1_apis.py
│ ├── hancitor_apis.py
│ ├── hawkeye_apis.py
│ ├── http_request.py
│ ├── infostealer_bitcoin.py
│ ├── infostealer_browser.py
│ ├── infostealer_browser_password.py
│ ├── infostealer_ftp.py
│ ├── infostealer_im.py
│ ├── infostealer_keylog.py
│ ├── infostealer_mail.py
│ ├── infostealer_raccoon.py
│ ├── infostealer_vidar.py
│ ├── injection_createremotethread.py
│ ├── injection_explorer.py
│ ├── injection_needextension.py
│ ├── injection_network.py
│ ├── injection_runpe.py
│ ├── injection_rwx.py
│ ├── injection_themeinitapihook.py
│ ├── internet_dropper.py
│ ├── ipc_namedpipe.py
│ ├── ispy_apis.py
│ ├── js_phish.py
│ ├── js_suspicious_redirect.py
│ ├── kazybot_apis.py
│ ├── kelihos_apis.py
│ ├── kibex_apis.py
│ ├── kovter_apis.py
│ ├── kraken_mutex.py
│ ├── locker_regedit.py
│ ├── locker_taskmgr.py
│ ├── locky_apis.py
│ ├── malicious_dynamic_function_loading.py
│ ├── martians_ie.py
│ ├── martians_office.py
│ ├── mimics_agent.py
│ ├── mimics_filename.py
│ ├── mimics_filetime.py
│ ├── mimics_icon.py
│ ├── mimics_processname.py
│ ├── modifies_certs.py
│ ├── modifies_hostsfile.py
│ ├── modifies_seccenter.py
│ ├── modifies_uac_notify.py
│ ├── modifies_wallpaper.py
│ ├── move_file_on_reboot.py
│ ├── multiple_ua.py
│ ├── network_anomaly.py
│ ├── network_bind.py
│ ├── network_cnc_generic.py
│ ├── network_cnc_http.py
│ ├── network_dga.py
│ ├── network_docfile_http.py
│ ├── network_doh.py
│ ├── network_encrypts_single_packet.py
│ ├── network_excessive_udp.py
│ ├── network_http.py
│ ├── network_icmp.py
│ ├── network_irc.py
│ ├── network_smtp.py
│ ├── network_tor.py
│ ├── network_tor_service.py
│ ├── network_torgateway.py
│ ├── nymaim_apis.py
│ ├── office_codepage.py
│ ├── office_exploit.py
│ ├── office_macro.py
│ ├── office_macro_suspicious.py
│ ├── office_rtf.py
│ ├── office_security.py
│ ├── office_suspicious.py
│ ├── office_write_exe.py
│ ├── origin_langid.py
│ ├── origin_resource_langid.py
│ ├── packer_anomaly.py
│ ├── packer_armadillo_mutex.py
│ ├── packer_armadillo_regkey.py
│ ├── packer_aspack.py
│ ├── packer_aspirecrypt.py
│ ├── packer_bedsprotector.py
│ ├── packer_confuser.py
│ ├── packer_enigma.py
│ ├── packer_entropy.py
│ ├── packer_mpress.py
│ ├── packer_nate.py
│ ├── packer_smartassembly.py
│ ├── packer_spices.py
│ ├── packer_themida.py
│ ├── packer_titan.py
│ ├── packer_upx.py
│ ├── packer_vmprotect.py
│ ├── pdf_annot_urls.py
│ ├── persistence_ads.py
│ ├── persistence_autorun.py
│ ├── persistence_bootexecute.py
│ ├── persistence_fileless.py
│ ├── persistence_service.py
│ ├── persistence_shim.py
│ ├── polymorphic.py
│ ├── pony_apis.py
│ ├── powerpool_mutex.py
│ ├── powershell_command.py
│ ├── ppp_pcre.py
│ ├── prevents_safeboot.py
│ ├── process_interest.py
│ ├── process_needed.py
│ ├── procmem_yara.py
│ ├── ransomware_cryptomix.py
│ ├── ransomware_dmalocker.py
│ ├── ransomware_fileextensions.py
│ ├── ransomware_filemodifications.py
│ ├── ransomware_files.py
│ ├── ransomware_gandcrab.py
│ ├── ransomware_germanwiper.py
│ ├── ransomware_medusalocker.py
│ ├── ransomware_message.py
│ ├── ransomware_radamant.py
│ ├── ransomware_recyclebin.py
│ ├── ransomware_sodinokibi.py
│ ├── rat_beebus_mutex.py
│ ├── rat_fynloski_mutex.py
│ ├── rat_limerat.py
│ ├── rat_luminosity.py
│ ├── rat_nanocore.py
│ ├── rat_netwire.py
│ ├── rat_njrat_regkeys.py
│ ├── rat_pcclient.py
│ ├── rat_plugx_mutex.py
│ ├── rat_poisonivy.py
│ ├── rat_quasar.py
│ ├── rat_ratsnif_mutex.py
│ ├── rat_spynet.py
│ ├── rat_xtreme_mutex.py
│ ├── reads_self.py
│ ├── recon_beacon.py
│ ├── recon_checkip.py
│ ├── recon_fingerprint.py
│ ├── recon_programs.py
│ ├── recon_systeminfo.py
│ ├── remcos.py
│ ├── removes_zoneid_ads.py
│ ├── script_downloader.py
│ ├── secure_login_phish.py
│ ├── securityxploded_modules.py
│ ├── setsautoconfigurl.py
│ ├── shifu_apis.py
│ ├── sniffer_winpcap.py
│ ├── spoofs_procname.py
│ ├── spreading_autoruninf.py
│ ├── stack_pivot.py
│ ├── static_authenticode.py
│ ├── static_dotnet_anomaly.py
│ ├── static_java.py
│ ├── static_pdf.py
│ ├── static_pe_anomaly.py
│ ├── static_rat_config.py
│ ├── static_versioninfo_anomaly.py
│ ├── stealth_childproc.py
│ ├── stealth_file.py
│ ├── stealth_hiddenextension.py
│ ├── stealth_hiddenreg.py
│ ├── stealth_hidenotifications.py
│ ├── stealth_network.py
│ ├── stealth_timelimit.py
│ ├── stealth_webhistory.py
│ ├── stealth_window.py
│ ├── suricata_alert.py
│ ├── sysinternals.py
│ ├── targeted_flame.py
│ ├── tinba_apis.py
│ ├── trickbot_files.py
│ ├── trickbot_mutex.py
│ ├── trojan_fleercivet_mutex.py
│ ├── troldesh_apis.py
│ ├── upatre_apis.py
│ ├── ursnif_apis.py
│ ├── user_enum.py
│ ├── vawtrak_apis.py
│ ├── vawtrak_dll_apis.py
│ ├── virus.py
│ ├── virus_neshta.py
│ ├── virus_renamer_mutex.py
│ ├── volatility_sig.py
│ ├── webmail_phish.py
│ ├── whois_create.py
│ ├── windows_utilities.py
│ ├── wmi.py
│ └── worm_allaple_mutex.py
├── nginx.md
├── requirements.txt
├── supervisor.conf
├── systemd
├── README.md
├── cuckoo-processor.service
├── cuckoo-rooter.service
├── cuckoo-wsgi.service
├── cuckoo.service
├── suricata-update.service
└── suricata-update.timer
├── tests
├── abstracts_tests.py
├── colors_tests.py
├── config_tests.py
├── database_tests.py
├── email_utils_tests.py
├── integrity.py
├── objects_tests.py
├── processor_tests.py
├── reporter_tests.py
├── sniffer_tests.py
└── utils_tests.py
├── utils
├── __init__.py
├── api.py
├── cleaner.py
├── db_migration
│ ├── alembic.ini
│ ├── env.py
│ ├── script.py.mako
│ └── versions
│ │ ├── add_sample_parent_id.py
│ │ ├── add_shrike_and_parent_id_columns.py
│ │ ├── from_0_6_to_1_1.py
│ │ ├── from_1_1_to_1_2-added_states.py
│ │ ├── from_1_1_to_1_2-extend_file_type.py
│ │ ├── from_1_2_to_1_2-accuvant-add_statistics.py
│ │ ├── options_255_to_1024.py
│ │ └── proper_indexes.py
├── delete_range.py
├── dist.py
├── listdump.py
├── machine.py
├── process.py
├── rooter.py
├── sample_path.py
├── smtp_sinkhole.py
├── smtp_sinkhole.sh
├── stats.py
├── submit.py
├── tcpdumpwrapper.py
├── tridupdate.py
├── vpncheck.py
├── web.py
└── yara_test.py
└── web
├── analysis
├── __init__.py
├── forms.py
├── templatetags
│ ├── __init__.py
│ ├── analysis_tags.py
│ ├── generic_tags.py
│ ├── key_tags.py
│ └── pdf_tags.py
├── urls.py
└── views.py
├── api
├── __init__.py
├── urls.py
└── views.py
├── compare
├── __init__.py
├── urls.py
└── views.py
├── dashboard
├── __init__.py
├── urls.py
└── views.py
├── manage.py
├── static
├── css
│ ├── bootstrap-datetimepicker.min.css
│ ├── bootstrap.min.css
│ ├── lightbox.css
│ └── style.css
├── fonts
│ ├── glyphicons-halflings-regular.eot
│ ├── glyphicons-halflings-regular.svg
│ ├── glyphicons-halflings-regular.ttf
│ ├── glyphicons-halflings-regular.woff
│ └── glyphicons-halflings-regular.woff2
├── generated
│ └── README
├── graphic
│ ├── background.png
│ ├── cape.png
│ └── cuckoo.png
├── img
│ ├── cape.png
│ ├── close.png
│ ├── loading.gif
│ ├── next.png
│ └── prev.png
└── js
│ ├── bootstrap-collapse.js
│ ├── bootstrap-datetimepicker.min.js
│ ├── bootstrap-fileupload.js
│ ├── bootstrap-transition.js
│ ├── bootstrap.min.js
│ ├── hexdump.js
│ ├── jquery.js
│ ├── lightbox.js
│ └── moment.min.js
├── submission
├── __init__.py
├── urls.py
└── views.py
├── templates
├── analysis
│ ├── CAPE
│ │ └── index.html
│ ├── admin
│ │ └── index.html
│ ├── antivirus.html
│ ├── behavior
│ │ ├── _api_call.html
│ │ ├── _chunk.html
│ │ ├── _processes.html
│ │ ├── _search.html
│ │ ├── _search_results.html
│ │ ├── _tree.html
│ │ └── index.html
│ ├── comments
│ │ └── index.html
│ ├── curtain.html
│ ├── debugger
│ │ └── index.html
│ ├── dropped
│ │ └── index.html
│ ├── index.html
│ ├── memory
│ │ ├── _apihooks.html
│ │ ├── _callbacks.html
│ │ ├── _devicetree.html
│ │ ├── _gdt.html
│ │ ├── _idt.html
│ │ ├── _malfind.html
│ │ ├── _messagehooks.html
│ │ ├── _modscan.html
│ │ ├── _netscan.html
│ │ ├── _pslist.html
│ │ ├── _sockscan.html
│ │ ├── _ssdt.html
│ │ ├── _svcscan.html
│ │ ├── _timers.html
│ │ ├── _yarascan.html
│ │ └── index.html
│ ├── misp
│ │ └── index.html
│ ├── mitre.html
│ ├── network
│ │ ├── _cif.html
│ │ ├── _dns.html
│ │ ├── _hosts.html
│ │ ├── _http.html
│ │ ├── _icmp.html
│ │ ├── _irc.html
│ │ ├── _ja3.html
│ │ ├── _smtp.html
│ │ ├── _suricata_alerts.html
│ │ ├── _suricata_files.html
│ │ ├── _suricata_http.html
│ │ ├── _suricata_tls.html
│ │ ├── _tcp.html
│ │ ├── _udp.html
│ │ └── index.html
│ ├── overview
│ │ ├── _file.html
│ │ ├── _info.html
│ │ ├── _screenshots.html
│ │ ├── _signatures.html
│ │ ├── _summary.html
│ │ ├── _url.html
│ │ ├── _usage.html
│ │ └── index.html
│ ├── pending.html
│ ├── procdump
│ │ └── index.html
│ ├── procmemory
│ │ └── index.html
│ ├── report.html
│ ├── reports
│ │ └── index.html
│ ├── search.html
│ ├── shrike.html
│ ├── similar
│ │ └── index.html
│ ├── static
│ │ ├── _antivirus.html
│ │ ├── _dotnet.html
│ │ ├── _java.html
│ │ ├── _office.html
│ │ ├── _pdf.html
│ │ ├── _pe32.html
│ │ ├── _script.html
│ │ ├── _strings.html
│ │ ├── _url.html
│ │ └── index.html
│ ├── statistics
│ │ └── index.html
│ ├── surialert.html
│ ├── surifiles.html
│ ├── surihttp.html
│ └── suritls.html
├── api
│ └── index.html
├── auth
│ ├── base.html
│ ├── base_site.html
│ ├── login.html
│ └── logout.html
├── base.html
├── compare
│ ├── _info.html
│ ├── _summary_table.html
│ ├── both.html
│ ├── hash.html
│ └── left.html
├── dashboard
│ └── index.html
├── error.html
├── footer.html
├── header.html
├── standalone_error.html
├── statistics
│ └── index.html
├── submission
│ ├── complete.html
│ ├── index.html
│ └── status.html
├── success.html
└── success_simple.html
└── web
├── __init__.py
├── headers.py
├── local_settings.py
├── settings.py
├── urls.py
└── wsgi.py
/.gitignore:
--------------------------------------------------------------------------------
1 | # Ignore Cuckoo Database
2 | db/cuckoo.db
3 |
4 | # Ignore Cuckoo logs
5 | log/*.log*
6 |
7 | # Ignore Cuckoo analyses
8 | storage/*
9 |
10 | # Ignore Python byte code
11 | *.pyc
12 |
13 | # Ignore certificates
14 | *.pem
15 | *.cert
16 |
17 | # Ignore OS generated files
18 | .DS_Store*
19 | .AppleDouble
20 | ehthumbs.db
21 | Icon?
22 | Thumbs.db
23 |
24 | # Ignore development files
25 | docs/book/src/_build/
26 | .idea/
27 |
28 | # Ignore Django secret_key
29 | web/web/secret_key.py
30 |
31 | cuckoo.v11.suo
32 | cuckoo.v12.suo
33 |
34 | # Ignore yara rules
35 | data/yara/index_*.yar
36 | UpgradeLog.htm
37 |
38 | # Ignore virtualenvs
39 | venv/
40 | .venv/
41 | virtualenv/
42 | .virtualenv/
43 |
44 |
--------------------------------------------------------------------------------
/.travis.yml:
--------------------------------------------------------------------------------
1 | branches:
2 | only:
3 | - master
4 | language: python
5 | python:
6 | - 2.7
7 | before_install:
8 | - sudo apt-get update -qq
9 | - sudo apt-get install python-magic python-dpkt python-libvirt
10 | - wget http://downloads.sourceforge.net/project/ssdeep/ssdeep-2.12/ssdeep-2.12.tar.gz
11 | - tar -zxvf ssdeep-2.12.tar.gz
12 | - cd ssdeep-2.12
13 | - ./configure && make
14 | - sudo make install
15 | - cd ..
16 | install:
17 | - pip install -r requirements.txt
18 | script:
19 | - python cuckoo.py --debug --test
20 | - nosetests
21 |
--------------------------------------------------------------------------------
/SECURITY.md:
--------------------------------------------------------------------------------
1 | # Security Policy
2 |
3 | ## Supported Versions
4 |
5 | Use this section to tell people about which versions of your project are
6 | currently being supported with security updates.
7 |
8 | | Version | Supported |
9 | | ------- | ------------------ |
10 | | 5.1.x | :white_check_mark: |
11 | | 5.0.x | :x: |
12 | | 4.0.x | :white_check_mark: |
13 | | < 4.0 | :x: |
14 |
15 | ## Reporting a Vulnerability
16 |
17 | Use this section to tell people how to report a vulnerability.
18 |
19 | Tell them where to go, how often they can expect to get an update on a
20 | reported vulnerability, what to expect if the vulnerability is accepted or
21 | declined, etc.
22 |
--------------------------------------------------------------------------------
/analyzer/windows/bin/flashplayer.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/bin/flashplayer.exe
--------------------------------------------------------------------------------
/analyzer/windows/bin/loader.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/bin/loader.exe
--------------------------------------------------------------------------------
/analyzer/windows/bin/loader_x64.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/bin/loader_x64.exe
--------------------------------------------------------------------------------
/analyzer/windows/bin/oldloader.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/bin/oldloader.exe
--------------------------------------------------------------------------------
/analyzer/windows/bin/oldloader_x64.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/bin/oldloader_x64.exe
--------------------------------------------------------------------------------
/analyzer/windows/bin/signtool.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/bin/signtool.exe
--------------------------------------------------------------------------------
/analyzer/windows/dll/Debugger.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Debugger.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/Debugger_x64.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Debugger_x64.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/Doppelganging.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Doppelganging.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/Doppelganging_x64.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Doppelganging_x64.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/EvilGrab.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/EvilGrab.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/IcedID.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/IcedID.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/OldExtraction.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/OldExtraction.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/PlugX.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/PlugX.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/QakBot.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/QakBot.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/Sedreco.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Sedreco.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/Sedreco_x64.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Sedreco_x64.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/UPX.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/UPX.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/UPX_x64.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/UPX_x64.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/Ursnif.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Ursnif.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/Ursnif_x64.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/Ursnif_x64.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/capemon.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/capemon.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/capemon_x64.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/capemon_x64.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/cuckoomon.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/cuckoomon.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/cuckoomon_x64.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/analyzer/windows/dll/cuckoomon_x64.dll
--------------------------------------------------------------------------------
/analyzer/windows/lib/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/analyzer/windows/lib/api/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/analyzer/windows/lib/common/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/analyzer/windows/lib/common/exceptions.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | class CuckooError(Exception):
6 | pass
7 |
8 | class CuckooPackageError(Exception):
9 | pass
--------------------------------------------------------------------------------
/analyzer/windows/lib/common/hashing.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | BUFSIZE = 1024*1024
6 |
7 |
8 | def hash_file(method, path):
9 | """Calculates an hash on a file by path.
10 | @param method: callable hashing method
11 | @param path: file path
12 | @return: computed hash string
13 | """
14 | f = open(path, "rb")
15 | h = method()
16 | while True:
17 | buf = f.read(BUFSIZE)
18 | if not buf:
19 | break
20 | h.update(buf)
21 | return h.hexdigest()
22 |
--------------------------------------------------------------------------------
/analyzer/windows/lib/common/rand.py:
--------------------------------------------------------------------------------
1 | import random
2 | import string
3 |
4 | def random_string(minimum, maximum=None, charset=None):
5 | if maximum is None:
6 | maximum = minimum
7 |
8 | count = random.randint(minimum, maximum)
9 | if not charset:
10 | return "".join(random.choice(string.ascii_letters) for x in xrange(count))
11 |
12 | return ''.join(random.choice(charset) for x in range(count))
13 |
14 | def random_integer(digits):
15 | start = 10 ** (digits - 1)
16 | end = (10 ** digits) - 1
17 | return random.randint(start, end)
18 |
--------------------------------------------------------------------------------
/analyzer/windows/lib/core/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/auxiliary/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/Compression_pdf.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class Compression_PDF(Package):
8 | """PDF analysis package."""
9 | PATHS = [
10 | ("ProgramFiles", "Adobe", "*a*", "Reader", "AcroRd32.exe"),
11 | ]
12 |
13 | def __init__(self, options={}, config=None):
14 | """@param options: options dict."""
15 | self.config = config
16 | self.options = options
17 | self.options["compression"] = "1"
18 | self.options["procdump"] = "0"
19 |
20 | def start(self, path):
21 | reader = self.get_path_glob("Adobe Reader")
22 | return self.execute(reader, "\"%s\"" % path, path)
23 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/Extraction_pdf.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class Extraction_PDF(Package):
8 | """PDF analysis package."""
9 | PATHS = [
10 | ("ProgramFiles", "Adobe", "*a*", "Reader", "AcroRd32.exe"),
11 | ]
12 |
13 | def __init__(self, options={}, config=None):
14 | """@param options: options dict."""
15 | self.config = config
16 | self.options = options
17 | self.options["extraction"] = "1"
18 | self.options["procdump"] = "0"
19 |
20 | def start(self, path):
21 | reader = self.get_path_glob("Adobe Reader")
22 | return self.execute(reader, "\"%s\"" % path, path)
23 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/Injection_pdf.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class Injection_PDF(Package):
8 | """PDF analysis package."""
9 | PATHS = [
10 | ("ProgramFiles", "Adobe", "*a*", "Reader", "AcroRd32.exe"),
11 | ]
12 |
13 | def __init__(self, options={}, config=None):
14 | """@param options: options dict."""
15 | self.config = config
16 | self.options = options
17 | self.options["injection"] = "1"
18 | self.options["procdump"] = "0"
19 |
20 | def start(self, path):
21 | reader = self.get_path_glob("Adobe Reader")
22 | return self.execute(reader, "\"%s\"" % path, path)
23 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/chm.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | import os
6 | import shutil
7 |
8 | from lib.common.abstracts import Package
9 |
10 | class CHM(Package):
11 | """Chm analysis package."""
12 | PATHS = [
13 | ("SystemRoot", "hh.exe"),
14 | ]
15 |
16 | def start(self, path):
17 | hh = self.get_path_glob("hh.exe")
18 |
19 | # Check file extension.
20 | ext = os.path.splitext(path)[-1].lower()
21 | # If the file doesn't have the proper .chm extension force it
22 | # and rename it. This is needed for hh to open correctly.
23 | if ext != ".chm":
24 | new_path = path + ".chm"
25 | os.rename(path, new_path)
26 | path = new_path
27 |
28 | return self.execute(hh, "\"%s\"" % path, path)
29 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/chrome.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2014 Optiv, Inc. (brad.spengler@optiv.com)
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class Chrome(Package):
8 | """Chrome analysis package."""
9 | PATHS = [
10 | ("ProgramFiles", "Google", "Chrome", "Application", "chrome.exe"),
11 | ]
12 |
13 | def start(self, url):
14 | chrome = self.get_path("Google Chrome")
15 | # pass the URL instead of a filename in this case
16 | return self.execute(chrome, "\"%s\"" % url, url)
17 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/cpl.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class CPL(Package):
8 | """Control Panel Applet analysis package."""
9 | PATHS = [
10 | ("SystemRoot", "system32", "control.exe"),
11 | ]
12 |
13 | def start(self, path):
14 | control = self.get_path("control.exe")
15 | return self.execute(control, "\"%s\"" % path, path)
16 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/doc.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | import os
6 |
7 | from lib.common.abstracts import Package
8 |
9 | class DOC(Package):
10 | """Word analysis package."""
11 | PATHS = [
12 | ("ProgramFiles", "Microsoft Office", "WINWORD.EXE"),
13 | ("ProgramFiles", "Microsoft Office", "Office*", "WINWORD.EXE"),
14 | ("ProgramFiles", "Microsoft Office*", "root", "Office*", "WINWORD.EXE"),
15 | ("ProgramFiles", "Microsoft Office", "WORDVIEW.EXE"),
16 | ]
17 |
18 | def start(self, path):
19 | word = self.get_path_glob("Microsoft Office Word")
20 | if "." not in os.path.basename(path):
21 | new_path = path + ".doc"
22 | os.rename(path, new_path)
23 | path = new_path
24 |
25 | return self.execute(word, "\"%s\" /q" % path, path)
26 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/doc2016.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | import os
6 |
7 | from lib.common.abstracts import Package
8 |
9 | class DOC2016(Package):
10 | """Word analysis package."""
11 |
12 | def __init__(self, options={}, config=None):
13 | self.config = config
14 | self.options = options
15 |
16 | PATHS = [
17 | ("ProgramFiles", "Microsoft Office*", "root", "Office16", "WINWORD.EXE"),
18 | ]
19 |
20 | def start(self, path):
21 | word = self.get_path_glob("Microsoft Office Word")
22 | if "." not in os.path.basename(path):
23 | new_path = path + ".doc"
24 | os.rename(path, new_path)
25 | path = new_path
26 |
27 | return self.execute(word, "\"%s\" /q" % path, path)
28 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/eml.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation., Optiv, Inc. (brad.spengler@optiv.com)
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class EML(Package):
8 | """Outlook EML analysis package."""
9 | PATHS = [
10 | ("ProgramFiles", "Microsoft Office", "OUTLOOK.EXE"),
11 | ("ProgramFiles", "Microsoft Office", "Office*", "OUTLOOK.EXE"),
12 | ("ProgramFiles", "Microsoft Office*", "root", "Office*", "OUTLOOK.EXE"),
13 | ]
14 |
15 | def start(self, path):
16 | outlook = self.get_path_glob("Microsoft Office Outlook")
17 | return self.execute(outlook, "/eml \"%s\"" % path, path)
18 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/firefox.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2014 Optiv, Inc. (brad.spengler@optiv.com)
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class Firefox(Package):
8 | """Firefox analysis package."""
9 | PATHS = [
10 | ("ProgramFiles", "Mozilla Firefox", "firefox.exe"),
11 | ]
12 |
13 | def start(self, url):
14 | firefox = self.get_path("Mozilla Firefox")
15 | # pass the URL instead of a filename in this case
16 | return self.execute(firefox, "\"%s\"" % url, url)
17 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/generic.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from random import randint
6 |
7 | from lib.common.abstracts import Package
8 |
9 | class Generic(Package):
10 | """Generic analysis package.
11 | The sample is started using START command in a cmd.exe prompt.
12 | """
13 | PATHS = [
14 | ("SystemRoot", "system32", "cmd.exe"),
15 | ]
16 |
17 | def start(self, path):
18 | cmd_path = self.get_path("cmd.exe")
19 | cmd_args = "/c start /wait \"\" \"{0}\"".format(path)
20 | return self.execute(cmd_path, cmd_args, path)
21 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/hta.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2016 Brad Spengler
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | import os
6 | import logging
7 |
8 | from lib.common.abstracts import Package
9 |
10 | log = logging.getLogger(__name__)
11 |
12 | class HTA(Package):
13 | """HTA file analysis package."""
14 | PATHS = [
15 | ("SystemRoot", "system32", "mshta.exe"),
16 | ]
17 |
18 | def start(self, path):
19 | mshta = self.get_path("mshta.exe")
20 |
21 | if not path.endswith(".hta"):
22 | os.rename(path, path + ".hta")
23 | path += ".hta"
24 |
25 | return self.execute(mshta, "\"%s\"" % path, path)
26 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/ie.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class IE(Package):
8 | """Internet Explorer analysis package."""
9 | PATHS = [
10 | ("ProgramFiles", "Internet Explorer", "iexplore.exe"),
11 | ]
12 |
13 | def start(self, url):
14 | iexplore = self.get_path("Internet Explorer")
15 | # pass the URL instead of a filename in this case
16 | return self.execute(iexplore, "\"%s\"" % url, url)
17 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/jar.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class Jar(Package):
8 | """Java analysis package."""
9 | PATHS = [
10 | ("ProgramFiles", "Java", "jre*", "bin", "java.exe"),
11 | ]
12 |
13 | def start(self, path):
14 | java = self.get_path_glob("Java")
15 | class_path = self.options.get("class")
16 |
17 | if class_path:
18 | args = "-cp \"%s\" %s" % (path, class_path)
19 | else:
20 | args = "-jar \"%s\"" % path
21 |
22 | return self.execute(java, args, path)
23 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/msg.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation., Optiv, Inc. (brad.spengler@optiv.com)
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class MSG(Package):
8 | """Outlook MSG analysis package."""
9 | PATHS = [
10 | ("ProgramFiles", "Microsoft Office", "OUTLOOK.EXE"),
11 | ("ProgramFiles", "Microsoft Office", "Office*", "OUTLOOK.EXE"),
12 | ("ProgramFiles", "Microsoft Office*", "root", "Office*", "OUTLOOK.EXE"),
13 | ]
14 |
15 | def start(self, path):
16 | outlook = self.get_path_glob("Microsoft Office Outlook")
17 | return self.execute(outlook, "/f \"%s\"" % path, path)
18 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/msi.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class Msi(Package):
8 | """MSI analysis package."""
9 |
10 | PATHS = [
11 | ("SystemRoot", "system32", "msiexec.exe"),
12 | ]
13 |
14 | def start(self, path):
15 | msi_path = self.get_path("msiexec.exe")
16 | msi_args = "/I \"{0}\"".format(path)
17 | return self.execute(msi_path, msi_args, path)
18 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/pdf.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class PDF(Package):
8 | """PDF analysis package."""
9 | PATHS = [
10 | ("ProgramFiles", "Adobe", "*a*", "Reader", "AcroRd32.exe"),
11 | ]
12 |
13 | def start(self, path):
14 | reader = self.get_path_glob("Adobe Reader")
15 | return self.execute(reader, "\"%s\"" % path, path)
16 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/ppt.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class PPT(Package):
8 | """PowerPoint analysis package."""
9 | PATHS = [
10 | ("ProgramFiles", "Microsoft Office", "POWERPNT.EXE"),
11 | ("ProgramFiles", "Microsoft Office", "Office*", "POWERPNT.EXE"),
12 | ("ProgramFiles", "Microsoft Office*", "root", "Office*", "POWERPNT.EXE"),
13 | ]
14 |
15 | def start(self, path):
16 | powerpoint = self.get_path_glob("Microsoft Office PowerPoint")
17 | return self.execute(powerpoint, "/s \"%s\"" % path, path)
18 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/ps1.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | import os
6 |
7 | from lib.common.abstracts import Package
8 |
9 | # Originally proposed by David Maciejak.
10 |
11 | class PS1(Package):
12 | """PowerShell analysis package."""
13 | PATHS = [
14 | ("SystemRoot", "system32", "WindowsPowerShell", "v*.0", "powershell.exe"),
15 | ]
16 |
17 | def start(self, path):
18 | powershell = self.get_path_glob("PowerShell")
19 |
20 | if not path.endswith(".ps1"):
21 | os.rename(path, path + ".ps1")
22 | path += ".ps1"
23 |
24 | args = "-NoProfile -ExecutionPolicy bypass -File \"{0}\"".format(path)
25 | return self.execute(powershell, args, path)
26 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/ps1_64.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | import os
6 |
7 | from lib.common.abstracts import Package
8 |
9 | # Originally proposed by David Maciejak.
10 |
11 | class PS1(Package):
12 | """PowerShell analysis package."""
13 | PATHS = [
14 | ("SystemRoot", "sysnative", "WindowsPowerShell", "v*.0", "powershell.exe"),
15 | ]
16 |
17 | def start(self, path):
18 | powershell = self.get_path_glob("PowerShell")
19 |
20 | if not path.endswith(".ps1"):
21 | os.rename(path, path + ".ps1")
22 | path += ".ps1"
23 |
24 | args = "-NoProfile -ExecutionPolicy bypass -File \"{0}\"".format(path)
25 | return self.execute(powershell, args, path)
26 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/python.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class Python(Package):
8 | """Python analysis package."""
9 |
10 | PATHS = [
11 | ("HomeDrive", "Python*", "python.exe"),
12 | ]
13 |
14 | def start(self, path):
15 | python = self.get_path_glob("Python")
16 | arguments = self.options.get("arguments", "")
17 | return self.execute(python, "%s %s" % (path, arguments), path)
18 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/sct.py:
--------------------------------------------------------------------------------
1 | # This file is part of CAPE Sandbox - https://github.com/ctxis/CAPE
2 | # See the file 'docs/LICENSE' for copying permission.
3 |
4 | import os
5 |
6 | from lib.common.abstracts import Package
7 |
8 | class SCT(Package):
9 | """SCT analysis package."""
10 | PATHS = [
11 | ("SystemRoot", "system32", "regsvr32.exe"),
12 | ]
13 |
14 | def start(self, path):
15 | regsvr32 = self.get_path("regsvr32.exe")
16 | args = "/u /n /i:{0} scrobj.dll".format(path)
17 |
18 | return self.execute(regsvr32, args, path)
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/swf.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class SWF(Package):
8 | """Shockwave Flash analysis package.
9 | Download a version of standalone flash from adobe and
10 | place in bin/ as flashplayer.exe to use
11 |
12 | You can find the bundles you want here:
13 | https://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html
14 | You want the debug folder (in the zip). The filename will have 'sa' (stand-alone) in it
15 | """
16 |
17 | def start(self, path):
18 | return self.execute("bin/flashplayer.exe", path, path)
19 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/wsf.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2016 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | import logging
6 | import os
7 |
8 | from lib.common.abstracts import Package
9 |
10 | log = logging.getLogger(__name__)
11 |
12 | class WSF(Package):
13 | """Windows Scripting File analysis package."""
14 | PATHS = [
15 | ("SystemRoot", "system32", "wscript.exe"),
16 | ]
17 |
18 | def start(self, path):
19 | wscript = self.get_path("WScript")
20 |
21 | # Enforce the .wsf file extension as is required by wscript.
22 | if not path.endswith(".wsf"):
23 | os.rename(path, path + ".wsf")
24 | path += ".wsf"
25 |
26 | return self.execute(wscript, "\"%s\"" % path, path)
27 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/xls.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | import os
6 |
7 | from lib.common.abstracts import Package
8 |
9 | class XLS(Package):
10 | """Excel analysis package."""
11 | PATHS = [
12 | ("ProgramFiles", "Microsoft Office", "EXCEL.EXE"),
13 | ("ProgramFiles", "Microsoft Office", "Office*", "EXCEL.EXE"),
14 | ("ProgramFiles", "Microsoft Office*", "root", "Office*", "EXCEL.EXE"),
15 | ]
16 |
17 | def start(self, path):
18 | excel = self.get_path_glob("Microsoft Office Excel")
19 | if "." not in os.path.basename(path):
20 | new_path = path + ".xls"
21 | os.rename(path, new_path)
22 | path = new_path
23 |
24 | return self.execute(excel, "\"%s\" /e" % path, path)
25 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/xps.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 |
8 | class Xps(Package):
9 | """XPS analysis package."""
10 |
11 | PATHS = [
12 | ("SystemRoot", "system32", "xpsrchvw.exe"),
13 | ]
14 |
15 | def start(self, path):
16 | xpsrchvw_path = self.get_path("xpsrchvw.exe")
17 | xpsrchvw_args = "\"{0}\"".format(path)
18 | return self.execute(xpsrchvw_path, xpsrchvw_args, path)
19 |
--------------------------------------------------------------------------------
/conf/malheur.conf:
--------------------------------------------------------------------------------
1 | generic = {
2 | input_format = "mist";
3 | };
4 |
5 | cluster = {
6 | reject_num = 2;
7 | };
8 |
9 | features = {
10 | mist_level = 2;
11 | };
--------------------------------------------------------------------------------
/conf/multi.conf:
--------------------------------------------------------------------------------
1 | [multi]
2 | # Specify a comma-separated list of the machinery modules to be used.
3 | machinery = kvm,physical
4 |
5 | # The rest should be configured in the hypervisor configurations,
6 | # as example: kvm.conf and physical.conf
7 |
--------------------------------------------------------------------------------
/conf/physical.conf:
--------------------------------------------------------------------------------
1 | [physical]
2 | # Specify a comma-separated list of available machines to be used. For each
3 | # specified ID you have to define a dedicated section containing the details
4 | # on the respective machine. (E.g. physical1,physical2,physical3)
5 | machines = physical1
6 |
7 | # Credentials to access the machine
8 | user = username
9 | password = password
10 |
11 | [physical1]
12 | # Specify the label name of the current machine as specified in your
13 | # physical machine configuration.
14 | label = physical1
15 |
16 | # Specify the operating system platform used by current machine
17 | # [windows/darwin/linux].
18 | platform = windows
19 |
20 | # Specify the IP address of the current machine. Make sure that the IP address
21 | # is valid and that the host machine is able to reach it. If not, the analysis
22 | # will fail.
23 | ip = 192.168.56.101
24 |
--------------------------------------------------------------------------------
/conf/smtp_sinkhole.conf:
--------------------------------------------------------------------------------
1 | [email]
2 | server =
3 | port =
4 | user =
5 | password =
6 | # coma space separated list, if more then one receiver
7 | to =
8 | from =
9 |
--------------------------------------------------------------------------------
/conf/socks5.conf:
--------------------------------------------------------------------------------
1 | [socks5]
2 | # By default we disable socks5 support as it requires running utils/rooter.py as
3 | # root next to cuckoo.py (which should run as regular user).
4 | enabled = no
5 |
6 | # Comma-separated list of the available proxies.
7 | proxies = ch
8 |
9 | [ch]
10 | name = ch_tor
11 | description = ch_tor
12 | proxyport = 5008
13 | dnsport = 10053
14 |
--------------------------------------------------------------------------------
/cuckoo.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio 2012
4 | Project("{888888A0-9F3D-457C-B088-3A5042F75D52}") = "cuckoo", "cuckoo.pyproj", "{365A3967-518E-457B-972A-3C90834F0F80}"
5 | EndProject
6 | Global
7 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
8 | Debug|Any CPU = Debug|Any CPU
9 | Release|Any CPU = Release|Any CPU
10 | EndGlobalSection
11 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
12 | {365A3967-518E-457B-972A-3C90834F0F80}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
13 | {365A3967-518E-457B-972A-3C90834F0F80}.Debug|Any CPU.Build.0 = Debug|Any CPU
14 | {365A3967-518E-457B-972A-3C90834F0F80}.Release|Any CPU.ActiveCfg = Release|Any CPU
15 | {365A3967-518E-457B-972A-3C90834F0F80}.Release|Any CPU.Build.0 = Release|Any CPU
16 | EndGlobalSection
17 | GlobalSection(SolutionProperties) = preSolution
18 | HideSolutionNode = FALSE
19 | EndGlobalSection
20 | EndGlobal
21 |
--------------------------------------------------------------------------------
/cuckoo.v11.suo:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/cuckoo.v11.suo
--------------------------------------------------------------------------------
/data/html/error.html:
--------------------------------------------------------------------------------
1 | {% extends "base-web.html" %}
2 | {% block content %}
3 |
6 |
7 |
8 | Error: {{error}}
9 |
10 |
11 | {% endblock %}
--------------------------------------------------------------------------------
/data/html/img/glyphicons-halflings-white.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/data/html/img/glyphicons-halflings-white.png
--------------------------------------------------------------------------------
/data/html/img/glyphicons-halflings.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/data/html/img/glyphicons-halflings.png
--------------------------------------------------------------------------------
/data/html/js/functions.js:
--------------------------------------------------------------------------------
1 | function showHide(id, lbl) {
2 | var e = document.getElementById(id);
3 |
4 | if (lbl !== "undefined")
5 | var l = document.getElementById(lbl);
6 |
7 | if(e.style.display == "none") {
8 | e.style.display = "block";
9 | if (l) {
10 | l.innerHTML = "Collapse";
11 | }
12 | }
13 | else {
14 | e.style.display = "none";
15 | if (l)
16 | l.innerHTML = "Expand";
17 | }
18 | }
19 |
--------------------------------------------------------------------------------
/data/html/report.html:
--------------------------------------------------------------------------------
1 | {% extends "base-report.html" %}
2 | {% block content %}
3 | {% include "sections/info.html" %}
4 | {% include "sections/errors.html" %}
5 | {% if results.info.category == "file" %}
6 | {% include "sections/file.html" %}
7 | {% elif results.info.category == "url" %}
8 | {% include "sections/url.html" %}
9 | {% endif %}
10 | {% include "sections/signatures.html" %}
11 | {% include "sections/screenshots.html" %}
12 | {% include "sections/network.html" %}
13 | {% if results.info.category == "file" %}
14 | {% include "sections/static.html" %}
15 | {% endif %}
16 | {% include "sections/dropped.html" %}
17 | {% include "sections/behavior.html" %}
18 | {% include "sections/volatility.html" %}
19 | {% endblock %}
--------------------------------------------------------------------------------
/data/html/sections/errors.html:
--------------------------------------------------------------------------------
1 | {% if results.debug.errors %}
2 |
3 |
Errors
4 |
5 |
6 |
7 | {% for error in results.debug.errors %}
8 | - {{error}}
9 | {% endfor %}
10 |
11 |
12 | {% endif %}
--------------------------------------------------------------------------------
/data/html/sections/screenshots.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
Screenshots
4 |
5 | {% if results.shots %}
6 | {% for shot in results.shots %}
7 |
8 | {% endfor %}
9 | {% else %}
10 | No screenshots available.
11 | {% endif %}
12 |
13 |
--------------------------------------------------------------------------------
/data/html/statistics.html:
--------------------------------------------------------------------------------
1 | {% extends "base-web.html" %}
2 | {% block content %}
3 |
4 |
5 |
17 |
18 | {% endblock %}
--------------------------------------------------------------------------------
/data/html/statistics/README:
--------------------------------------------------------------------------------
1 | This is an empty directory where statistics images will be created.
2 |
--------------------------------------------------------------------------------
/data/html/success.html:
--------------------------------------------------------------------------------
1 | {% extends "base-web.html" %}
2 | {% block content %}
3 |
6 |
7 |
8 |
GOOD! File {{submitfile}} was submitted for analysis with Task ID
{{taskid}}.
9 |
10 |
11 | {% endblock %}
--------------------------------------------------------------------------------
/data/signature_overlay.json:
--------------------------------------------------------------------------------
1 | {
2 | "creates_exe": {
3 | "severity": 2,
4 | "alert": false,
5 | "custom_attribute": "machete"
6 | }
7 | }
8 |
--------------------------------------------------------------------------------
/data/src/binpackage/Makefile:
--------------------------------------------------------------------------------
1 | execsc.exe: execsc.c
2 | i586-mingw32msvc-cc -Wall -o $@ $<
3 |
4 |
--------------------------------------------------------------------------------
/data/src/binpackage/execsc.c:
--------------------------------------------------------------------------------
1 | #include
2 | #include
3 | #include
4 |
5 | int main (int argc, char ** argv) {
6 | int fd;
7 | char buf[2048] = {0};
8 |
9 | if (argc < 2) return 1;
10 |
11 | // read in shellcode from analysis target file
12 | fd = open(argv[1], 0);
13 | read(fd, buf, 2048);
14 | close(fd);
15 |
16 | // jump into shellcode
17 | int (*func)();
18 | func = (int (*)()) buf;
19 | (int)(*func)();
20 |
21 | return 0;
22 | }
23 |
24 |
--------------------------------------------------------------------------------
/data/yara/CAPE/AAR.yar:
--------------------------------------------------------------------------------
1 | rule AAR
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/AAR"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "AAR Payload"
9 |
10 | strings:
11 | $a = "Hashtable"
12 | $b = "get_IsDisposed"
13 | $c = "TripleDES"
14 | $d = "testmemory.FRMMain.resources"
15 | $e = "$this.Icon" wide
16 | $f = "{11111-22222-20001-00001}" wide
17 | $g = "@@@@@"
18 |
19 | condition:
20 | all of them
21 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/Adzok.yar:
--------------------------------------------------------------------------------
1 | rule Adzok
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | Description = "Adzok Rat"
6 | Versions = "Free 1.0.0.3,"
7 | ref = "http://malwareconfig.com/stats/Adzok"
8 | maltype = "Remote Access Trojan"
9 | filetype = "jar"
10 | cape_type = "Adzok Payload"
11 |
12 | strings:
13 | $a1 = "config.xmlPK"
14 | $a2 = "key.classPK"
15 | $a3 = "svd$1.classPK"
16 | $a4 = "svd$2.classPK"
17 | $a5 = "Mensaje.classPK"
18 | $a6 = "inic$ShutdownHook.class"
19 | $a7 = "Uninstall.jarPK"
20 | $a8 = "resources/icono.pngPK"
21 |
22 | condition:
23 | 7 of ($a*)
24 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/AgentTesla.yar:
--------------------------------------------------------------------------------
1 | rule AgentTesla
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "AgentTesla Payload"
6 | cape_type = "AgentTesla Payload"
7 | strings:
8 | $string1 = "smtp" wide
9 | $string2 = "appdata" wide
10 | $string3 = "76487-337-8429955-22614" wide
11 | $string4 = "yyyy-MM-dd HH:mm:ss" wide
12 | //$string5 = "%site_username%" wide
13 | $string6 = "webpanel" wide
14 | $string7 = "
UserName :" wide
15 | $string8 = "
IP Address :" wide
16 |
17 | $agt1 = "IELibrary.dll" ascii
18 | $agt2 = "C:\\Users\\Admin\\Desktop\\IELibrary\\IELibrary\\obj\\Debug\\IELibrary.pdb" ascii
19 | $agt3 = "GetSavedPasswords" ascii
20 | $agt4 = "GetSavedCookies" ascii
21 | condition:
22 | uint16(0) == 0x5A4D and (all of ($string*) or 3 of ($agt*))
23 | }
24 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Ap0calypse.yar:
--------------------------------------------------------------------------------
1 | rule Ap0calypse
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/Ap0calypse"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "Ap0calypse Payload"
9 |
10 | strings:
11 | $a = "Ap0calypse"
12 | $b = "Sifre"
13 | $c = "MsgGoster"
14 | $d = "Baslik"
15 | $e = "Dosyalars"
16 | $f = "Injecsiyon"
17 |
18 | condition:
19 | all of them
20 | }
21 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Arcom.yar:
--------------------------------------------------------------------------------
1 | rule Arcom
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/Arcom"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "Arcom Payload"
9 |
10 | strings:
11 | $a1 = "CVu3388fnek3W(3ij3fkp0930di"
12 | $a2 = "ZINGAWI2"
13 | $a3 = "clWebLightGoldenrodYellow"
14 | $a4 = "Ancestor for '%s' not found" wide
15 | $a5 = "Control-C hit" wide
16 | $a6 = {A3 24 25 21}
17 |
18 | condition:
19 | all of them
20 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/Arkei.yar:
--------------------------------------------------------------------------------
1 | rule Arkei
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Arkei Payload"
6 | cape_type = "Arkei Payload"
7 | strings:
8 | $string1 = "Windows_Antimalware_Host_System_Worker"
9 | $string2 = "Arkei"
10 | $string3 = "Bitcoin\\wallet.dat"
11 | $string4 = "Ethereum\\keystore"
12 | condition:
13 | uint16(0) == 0x5A4D and all of them
14 | }
15 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Atlas.yar:
--------------------------------------------------------------------------------
1 | rule Atlas
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Atlas Payload"
6 | cape_type = "Atlas Payload"
7 | strings:
8 | $a1 = "bye.bat"
9 | $a2 = "task=knock&id=%s&ver=%s x%s&disks=%s&other=%s&ip=%s&pub="
10 | $a3 = "process call create \"cmd /c start vssadmin delete shadows /all /q"
11 | condition:
12 | uint16(0) == 0x5A4D and (all of ($a*))
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Azer.yar:
--------------------------------------------------------------------------------
1 | rule Azer
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Azer Payload"
6 | cape_type = "Azer Payload"
7 | strings:
8 | $a1 = "webmafia@asia.com" wide
9 | $a2 = "INTERESTING_INFORMACION_FOR_DECRYPT.TXT" wide
10 | $a3 = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ" //-----BEGIN PUBLIC KEY-----
11 | condition:
12 | uint16(0) == 0x5A4D and (all of ($a*))
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Azorult.yar:
--------------------------------------------------------------------------------
1 | rule Azorult
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Azorult Payload"
6 | cape_type = "Azorult Payload"
7 | strings:
8 | $code1 = {C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 01 00 00 8D 85 00 FE FF FF 89 47 1C C7 47 20 80 00 00 00 8D 85 80 FD FF FF 89 47 24 C7 47 28 80 00 00 00 8D 85 80 F5 FF FF 89 47 2C C7 47 30 00 08 00 00 8D 85 80 F1 FF FF 89 47 34 C7 47 38 00 04 00 00 57 68 00 00 00 90}
9 | $string1 = "SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),\"unixepoch\")"
10 | condition:
11 | uint16(0) == 0x5A4D and all of them
12 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/BackOffLoader.yar:
--------------------------------------------------------------------------------
1 | rule BackOffLoader
2 | {
3 | meta:
4 | author = "enzo"
5 | description = "BackOffLoader Payload"
6 | cape_type = "BackOffLoader Payload"
7 | strings:
8 | $str1 = "uid=%I64u&uinfo=%s&win=%d.%d&bits=%d&vers=%s&build=%s"
9 | $str2 = "&bots="
10 | $str3 = "{b:%s|%s}"
11 | $str4 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
12 | condition:
13 | all of them
14 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/BackOffPOS.yar:
--------------------------------------------------------------------------------
1 | rule BackOffPOS
2 | {
3 | meta:
4 | author = "enzo"
5 | description = "BackOffPos Payload"
6 | cape_type = "BackOffPos Payload"
7 | strings:
8 | $str1 = "oprat=2&uid=%I64u&uinfo=%s&win=%d.%d&vers=%s"
9 | $str2 = "&logs="
10 | $str3 = "&data="
11 | $str4 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
12 | $str5 = "Content-Type: application/x-www-form-urlencoded"
13 | condition:
14 | all of them
15 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/BadRabbit.yar:
--------------------------------------------------------------------------------
1 | rule BadRabbit
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "BadRabbit Payload"
6 | cape_type = "BadRabbit Payload"
7 | strings:
8 | $a1 = "caforssztxqzf2nm.onion" wide
9 | $a2 = "schtasks /Create /SC once /TN drogon /RU SYSTEM" wide
10 | $a3 = "schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal" wide
11 | condition:
12 | uint16(0) == 0x5A4D and (all of ($a*))
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Bandook.yar:
--------------------------------------------------------------------------------
1 | rule Bandook
2 | {
3 |
4 | meta:
5 | author = " Kevin Breen "
6 | ref = "http://malwareconfig.com/stats/bandook"
7 | maltype = "Remote Access Trojan"
8 | filetype = "exe"
9 | cape_type = "Bandook Payload"
10 |
11 | strings:
12 | $a = "aaaaaa1|"
13 | $b = "aaaaaa2|"
14 | $c = "aaaaaa3|"
15 | $d = "aaaaaa4|"
16 | $e = "aaaaaa5|"
17 | $f = "%s%d.exe"
18 | $g = "astalavista"
19 | $h = "givemecache"
20 | $i = "%s\\system32\\drivers\\blogs\\*"
21 | $j = "bndk13me"
22 |
23 |
24 |
25 | condition:
26 | all of them
27 | }
28 |
--------------------------------------------------------------------------------
/data/yara/CAPE/BitPaymer.yar:
--------------------------------------------------------------------------------
1 | rule BitPaymer
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "BitPaymer Payload"
6 | cape_type = "BitPaymer Payload"
7 |
8 | strings:
9 | $decrypt32 = {6A 40 58 3B C8 0F 4D C1 39 46 04 7D 50 53 57 8B F8 81 E7 3F 00 00 80 79 05 4F 83 CF C0 47 F7 DF 99 1B FF 83 E2 3F 03 C2 F7 DF C1 F8 06 03 F8 C1 E7 06 57}
10 | $antidefender = "TouchMeNot" wide
11 | condition:
12 | uint16(0) == 0x5A4D and all of them
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/BlackNix.yar:
--------------------------------------------------------------------------------
1 | rule BlackNix
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/BlackNix"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "BlackNix Payload"
9 |
10 | strings:
11 | $a1 = "SETTINGS" wide
12 | $a2 = "Mark Adler"
13 | $a3 = "Random-Number-Here"
14 | $a4 = "RemoteShell"
15 | $a5 = "SystemInfo"
16 |
17 |
18 | condition:
19 | all of them
20 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/BlackShades.yar:
--------------------------------------------------------------------------------
1 | rule BlackShades
2 | {
3 | meta:
4 | author = "Brian Wallace (@botnet_hunter)"
5 | ref = "http://blog.cylance.com/a-study-in-bots-blackshades-net"
6 | family = "blackshades"
7 | cape_type = "BlackShades Payload"
8 |
9 | strings:
10 | $string1 = "bss_server"
11 | $string2 = "txtChat"
12 | $string3 = "UDPFlood"
13 | condition:
14 | all of them
15 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/BlueBanana.yar:
--------------------------------------------------------------------------------
1 | rule BlueBanana
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/BlueBanana"
6 | maltype = "Remote Access Trojan"
7 | filetype = "Java"
8 | cape_type = "BlueBanana Payload"
9 |
10 | strings:
11 | $meta = "META-INF"
12 | $conf = "config.txt"
13 | $a = "a/a/a/a/f.class"
14 | $b = "a/a/a/a/l.class"
15 | $c = "a/a/a/b/q.class"
16 | $d = "a/a/a/b/v.class"
17 |
18 |
19 | condition:
20 | all of them
21 | }
22 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Bozok.yar:
--------------------------------------------------------------------------------
1 | rule Bozok
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/Bozok"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "Bozok Payload"
9 |
10 | strings:
11 | $a = "getVer" nocase
12 | $b = "StartVNC" nocase
13 | $c = "SendCamList" nocase
14 | $d = "untPlugin" nocase
15 | $e = "gethostbyname" nocase
16 |
17 | condition:
18 | all of them
19 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/Cerber.yar:
--------------------------------------------------------------------------------
1 | rule Cerber
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Cerber Payload"
6 | cape_type = "Cerber Payload"
7 | strings:
8 | $code1 = {33 C0 66 89 45 8? 8D 7D 8? AB AB AB AB AB [0-2] 66 AB 8D 45 8? [0-3] E8 ?? ?? 00 00}
9 | condition:
10 | //check for MZ Signature at offset 0
11 | uint16(0) == 0x5A4D and all of them
12 | }
13 |
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/ChChes.yar:
--------------------------------------------------------------------------------
1 | rule ChChes
2 | {
3 | meta:
4 | author = "kev"
5 | description = "ChChes Payload"
6 | cape_type = "ChChes Payload"
7 | strings:
8 | $payload1 = {55 8B EC 53 E8 ?? ?? FF FF E8 D? FF FF FF 05 ?? ?? ?? 00 33 DB 39 58 44 75 58 56 57 50 E8 57 00 00 00 59 8B F0 E8 A? FF FF FF B9 ?? ?? ?? 00 BF D0 1C ?? 00 2B CF 03 C1 39 5E 30 76 0F}
9 | $payload2 = {55 8B EC E8 ?? ?? FF FF E8 D? FF FF FF 05 ?? ?? ?? 00 83 78 44 00 75 40 56 57 50 E8 3E 00 00 00 59 8B F0 6A 00 FF 76 30 E8 A8 FF FF FF B9 ?? ?? ?? 00 BF 00 1A E1 00 2B CF 03 C1 50 FF 56 70}
10 | condition:
11 | $payload1 or $payload2
12 | }
13 |
--------------------------------------------------------------------------------
/data/yara/CAPE/ClientMesh.yar:
--------------------------------------------------------------------------------
1 | rule ClientMesh
2 | {
3 | meta:
4 | author = "Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/ClientMesh"
6 | family = "torct"
7 | cape_type = "ClientMesh Payload"
8 |
9 | strings:
10 | $string1 = "machinedetails"
11 | $string2 = "MySettings"
12 | $string3 = "sendftppasswords"
13 | $string4 = "sendbrowserpasswords"
14 | $string5 = "arma2keyMass"
15 | $string6 = "keylogger"
16 | $conf = {00 00 00 00 00 00 00 00 00 7E}
17 |
18 | condition:
19 | all of them
20 | }
21 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Clop.yar:
--------------------------------------------------------------------------------
1 | rule Clop
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | cape_type = "Clop Payload"
6 | strings:
7 | $string1 = "%s%s.Cl0p" wide
8 | $string2 = "%s\\Cl0pReadMe.txt" wide
9 | condition:
10 | uint16(0) == 0x5A4D and all of them
11 | }
12 |
--------------------------------------------------------------------------------
/data/yara/CAPE/CobaltStrikeBeacon.yar:
--------------------------------------------------------------------------------
1 | rule CobaltStrikeBeacon
2 | {
3 | meta:
4 | author = "JPCERTCC"
5 | description = "Cobalt Strike Payload"
6 | ref = "https://raw.githubusercontent.com/JPCERTCC/aa-tools/master/cobaltstrikescan.py"
7 | cape_type = "Cobalt Strike Payload"
8 | strings:
9 | $v1 = { 73 70 72 6E 67 00 }
10 | $v2 = { 69 69 69 69 69 69 69 69 }
11 | condition: $v1 and $v2
12 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/Codoso.yar:
--------------------------------------------------------------------------------
1 | rule Codoso
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Codoso Payload"
6 | cape_type = "Codoso Payload"
7 | strings:
8 | $a1 = "WHO_A_R_E_YOU?"
9 | $a2 = "DUDE_AM_I_SHARP-3.14159265358979"
10 | $a3 = "USERMODECMD"
11 | condition:
12 | uint16(0) == 0x5A4D and (all of ($a*))
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Cryptoshield.yar:
--------------------------------------------------------------------------------
1 | rule Cryptoshield
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Cryptoshield Payload"
6 | cape_type = "Cryptoshield Payload"
7 | strings:
8 | $a1 = "CRYPTOSHIELD." wide
9 | $a2 = "Click on Yes in the next window for restore work explorer" wide
10 | $a3 = "r_sp@india.com - SUPPORT"
11 | condition:
12 | uint16(0) == 0x5A4D and (all of ($a*))
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/CyberGate.yar:
--------------------------------------------------------------------------------
1 | rule CyberGate
2 | {
3 |
4 | meta:
5 | author = " Kevin Breen "
6 | ref = "http://malwareconfig.com/stats/CyberGate"
7 | maltype = "Remote Access Trojan"
8 | filetype = "exe"
9 | cape_type = "CyberGate Payload"
10 |
11 | strings:
12 | $string1 = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
13 | $string2 = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
14 | $string3 = "EditSvr"
15 | $string4 = "TLoader"
16 | $string5 = "Stroks"
17 | $string6 = "####@####"
18 | $res1 = "XX-XX-XX-XX"
19 | $res2 = "CG-CG-CG-CG"
20 |
21 | condition:
22 | all of ($string*) and any of ($res*)
23 | }
24 |
--------------------------------------------------------------------------------
/data/yara/CAPE/DarkComet.yar:
--------------------------------------------------------------------------------
1 | rule DarkComet
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/DarkComet"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "DarkComet Payload"
9 |
10 | strings:
11 | // Versions 2x
12 | $a1 = "#BOT#URLUpdate"
13 | $a2 = "Command successfully executed!"
14 | $a3 = "MUTEXNAME" wide
15 | $a4 = "NETDATA" wide
16 | // Versions 3x & 4x & 5x
17 | $b1 = "FastMM Borland Edition"
18 | $b2 = "%s, ClassID: %s"
19 | $b3 = "I wasn't able to open the hosts file"
20 | $b4 = "#BOT#VisitUrl"
21 | $b5 = "#KCMDDC"
22 |
23 |
24 |
25 | condition:
26 | all of ($a*) or all of ($b*)
27 | }
28 |
--------------------------------------------------------------------------------
/data/yara/CAPE/DarkRAT.yar:
--------------------------------------------------------------------------------
1 | rule DarkRAT
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/DarkRAT"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "DarkRAT Payload"
9 |
10 | strings:
11 | $a = "@1906dark1996coder@"
12 | $b = "SHEmptyRecycleBinA"
13 | $c = "mciSendStringA"
14 | $d = "add_Shutdown"
15 | $e = "get_SaveMySettingsOnExit"
16 | $f = "get_SpecialDirectories"
17 | $g = "Client.My"
18 |
19 | condition:
20 | all of them
21 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/DoppelPaymer.yar:
--------------------------------------------------------------------------------
1 | rule DoppelPaymer
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "DoppelPaymer Payload"
6 | cape_type = "DoppelPaymer Payload"
7 |
8 | strings:
9 | $getproc32 = {81 FB ?? ?? ?? ?? 74 2D 8B CB E8 ?? ?? ?? ?? 85 C0 74 0C 8B C8 8B D7 E8 ?? ?? ?? ?? 5B 5F C3}
10 | $cmd_string = "Setup run\n" wide
11 | condition:
12 | uint16(0) == 0x5A4D and all of them
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Dreambot.yar:
--------------------------------------------------------------------------------
1 | rule Dreambot
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Dreambot Payload"
6 | cape_type = "Dreambot Payload"
7 | strings:
8 | $a1 = {53 56 33 F6 33 DB C1 6C 24 0C 02 74 2F 8B 02 85 C0 75 11 83 7C 24 0C 02 76 0A 39 42 04 75 05 39 42 08 74 18 43 8A CB D3 C0 33 C6 33 44 24 10 8B F0 89 32 83 C2 04 FF 4C 24 0C 75 D1 5E 5B C2 08 00}
9 | $a2 = {53 33 C9 33 DB C1 6C 24 08 02 74 22 56 8B 02 85 C0 8B F0 74 18 33 C1 33 44 24 10 43 8A CB D3 C8 8B CE 89 02 83 C2 04 FF 4C 24 0C 75 E0 5E 5B C2 08 00}
10 | $b1 = "Oct 5 2016"
11 | $b2 = ".bss"
12 | condition:
13 | uint16(0) == 0x5A4D and (1 of ($a*)) and (all of ($b*))
14 | }
15 |
--------------------------------------------------------------------------------
/data/yara/CAPE/DridexLoader.yar:
--------------------------------------------------------------------------------
1 | rule DridexLoader
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Dridex v4 dropper C2 parsing function"
6 | cape_type = "DridexLoader Payload"
7 |
8 | strings:
9 | $c2parse_1 = {57 0F 95 C0 89 35 ?? ?? ?? ?? 88 46 04 33 FF 80 3D ?? ?? ?? ?? 00 76 54 8B 04 FD ?? ?? ?? ?? 8D 4D EC 83 65 F4 00 89 45 EC 66 8B 04 FD ?? ?? ?? ?? 66 89 45 F0 8D 45 F8 50}
10 | $c2parse_2 = {89 45 00 0F B7 53 04 89 10 0F B6 4B 0C 83 F9 0A 7F 03 8A 53 0C 0F B6 53 0C 85 D2 7E B7 8D 74 24 0C C7 44 24 08 00 00 00 00 8D 04 7F 8D 8C 00}
11 | $c2parse_3 = {89 08 66 39 1D ?? ?? ?? ?? A1 ?? ?? ?? ?? 0F 95 C1 88 48 04 80 3D ?? ?? ?? ?? 0A 77 05 A0 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? 00 56 8B F3 76 4E 66 8B 04 F5}
12 | $c2parse_4 = {0F B7 C0 89 01 A0 ?? ?? ?? ?? 3C 0A 77 ?? A0 ?? ?? ?? ?? A0 ?? ?? ?? ?? 57 33 FF 84 C0 74 ?? 56 BE}
13 | condition:
14 | uint16(0) == 0x5A4D and any of them
15 | }
16 |
--------------------------------------------------------------------------------
/data/yara/CAPE/DridexV4.yar:
--------------------------------------------------------------------------------
1 | rule DridexV4
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Dridex v4 Payload"
6 | cape_type = "Dridex v4 Payload"
7 |
8 | strings:
9 | $decrypt32 = {6A 40 58 3B C8 0F 4D C1 39 46 04 7D 50 53 57 8B F8 81 E7 3F 00 00 80 79 05 4F 83 CF C0 47 F7 DF 99 1B FF 83 E2 3F 03 C2 F7 DF C1 F8 06 03 F8 C1 E7 06 57}
10 | $getproc32 = {81 FB ?? ?? ?? ?? 74 2D 8B CB E8 ?? ?? ?? ?? 85 C0 74 0C 8B C8 8B D7 E8 ?? ?? ?? ?? 5B 5F C3}
11 | $getproc64 = {81 FB ?? ?? ?? ?? 75 04 33 C0 EB 2D 8B CB E8 ?? ?? ?? ?? 48 85 C0 75 17 8B CB E8 ?? ?? ?? ?? 84 C0 74 E5 8B CB E8 ?? ?? ?? ?? 48 85 C0 74 D9 8B D7 48 8B C8 E8 ?? ?? ?? ?? 48 8B 5C 24 30 48 83 C4 20 5F C3}
12 |
13 | condition:
14 | uint16(0) == 0x5A4D and any of them
15 | }
16 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Emotet_Loader.yar:
--------------------------------------------------------------------------------
1 | rule Emotet_Loader
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Emotet Loader"
6 | cape_type = "Emotet Loader"
7 | strings:
8 | $antihook = {8B 15 ?? ?? ?? ?? 03 15 ?? ?? ?? ?? 89 95 28 FF FF FF A1 ?? ?? ?? ?? 2D 4D 01 00 00 A3 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 3B 0D ?? ?? ?? ?? 76 26 8B 95 18 FF FF FF 8B 42 38}
9 | condition:
10 | //check for MZ Signature at offset 0
11 | uint16(0) == 0x5A4D and any of them
12 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/Enfal.yar:
--------------------------------------------------------------------------------
1 | rule Enfal
2 | {
3 | meta:
4 | author = "kev"
5 | description = "Enfal configuration blob"
6 | cape_type = "Enfal Config"
7 | strings:
8 | $config1 = {BF 49 ?? 75 22 12 ?? 75 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C}
9 |
10 | condition:
11 | $config1
12 | }
13 |
--------------------------------------------------------------------------------
/data/yara/CAPE/EvilGrab.yar:
--------------------------------------------------------------------------------
1 | rule EvilGrab
2 | {
3 | meta:
4 | author = "kev"
5 | description = "EvilGrab configuration function"
6 | cape_type = "EvilGrab Payload"
7 | strings:
8 | $configure1 = {8D 44 24 ?? 50 6A 01 E8 ?? ?? ?? ?? 85 C0 74 07 33 C0 E9 9? 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 07 59 73 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68}
9 | $configure2 = {8D 44 24 ?? 50 6A 01 E8 ?? ?? ?? ?? 85 C0 74 07 33 C0 E9 9? 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 07 59 73 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83}
10 | $configure3 = {8D 95 60 ?? ?? ?? 52 6A 01 E8 ?? ?? ?? ?? 85 C0 74 13 33 C0 8B 4D F4 64 89 0D 00 00 00 00 5F 5E 5B 8B E5 5D C3 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE}
11 |
12 | condition:
13 | //check for MZ Signature at offset 0
14 | uint16(0) == 0x5A4D
15 |
16 | and
17 |
18 | $configure1 or $configure2 or $configure3
19 | }
20 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Fareit.yar:
--------------------------------------------------------------------------------
1 | rule Fareit
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Fareit Payload"
6 | cape_type = "Fareit Payload"
7 | strings:
8 | $string1 = {0D 0A 09 09 0D 0A 0D 0A 09 20 20 20 3A 6B 74 6B 20 20 20 0D 0A 0D 0A 0D 0A 20 20 20 20 20 64 65 6C 20 20 20 20 09 20 25 31 20 20 0D 0A 09 69 66 20 20 09 09 20 65 78 69 73 74 20 09 20 20 20 25 31 20 20 09 20 20 67 6F 74 6F 20 09 0D 20 6B 74 6B 0D 0A 20 64 65 6C 20 09 20 20 25 30 20 00}
9 | condition:
10 | uint16(0) == 0x5A4D and any of ($string*)
11 | }
12 |
13 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Gandcrab.yar:
--------------------------------------------------------------------------------
1 | rule Gandcrab
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Gandcrab Payload"
6 | cape_type = "Gandcrab Payload"
7 | strings:
8 | $string1 = "GDCB-DECRYPT.txt" wide
9 | $string2 = "GandCrabGandCrabnomoreransom.coinomoreransom.bit"
10 | $string3 = "action=result&e_files=%d&e_size=%I64u&e_time=%d&" wide
11 | $string4 = "KRAB-DECRYPT.txt" wide
12 | condition:
13 | uint16(0) == 0x5A4D and any of ($string*)
14 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/Gootkit.yar:
--------------------------------------------------------------------------------
1 | rule Gootkit
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Gootkit Payload"
6 | cape_type = "Gootkit Payload"
7 | strings:
8 | $code1 = {C7 45 ?? ?? ?? 4? 00 C7 45 ?? ?? 10 40 00 C7 45 E? D8 ?? ?? 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 [1-2] 00 10 40 00 89 [5-6] 43 00 89 ?? ?? 68 E8 80 00 00 FF 15}
9 | condition:
10 | uint16(0) == 0x5A4D and all of them
11 | }
12 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Greame.yar:
--------------------------------------------------------------------------------
1 | rule Greame
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/Greame"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "Greame Payload"
9 |
10 | strings:
11 | $a = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
12 | $b = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
13 | $c = "EditSvr"
14 | $d = "TLoader"
15 | $e = "Stroks"
16 | $f = "Avenger by NhT"
17 | $g = "####@####"
18 | $h = "GREAME"
19 |
20 |
21 |
22 | condition:
23 | all of them
24 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/Hancitor.yar:
--------------------------------------------------------------------------------
1 | rule Hancitor
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Hancitor Payload"
6 | cape_type = "Hancitor Payload"
7 | strings:
8 | $decrypt1 = {33 C9 03 D6 C7 45 FC ?? ?? ?? ?? 8B 70 10 85 F6 74 12 90 8B C1 83 E0 03 8A 44 05 FC 30 04 11 41 3B CE 72 EF}
9 | $decrypt2 = {B9 08 00 00 00 8B 75 08 83 C4 04 8B F8 3B D1 76 10 8B C1 83 E0 07 8A 04 30 30 04 31 41 3B CA 72 F0 8D 45 FC}
10 | $decrypt3 = {8B 45 FC 33 D2 B9 08 00 00 00 F7 F1 8B 45 08 0F BE 0C 10 8B 55 08 03 55 FC 0F BE 02 33 C1 8B 4D 08 03 4D FC 88 01 EB C7}
11 | condition:
12 | uint16(0) == 0x5A4D and (any of ($decrypt*))
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/HawkEye.yar:
--------------------------------------------------------------------------------
1 | rule HawkEye
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/HawkEye"
6 | maltype = "KeyLogger"
7 | filetype = "exe"
8 | cape_type = "HawkEye Payload"
9 |
10 | strings:
11 | $key = "HawkEyeKeylogger" wide
12 | $salt = "099u787978786" wide
13 | $string1 = "HawkEye_Keylogger" wide
14 | $string2 = "holdermail.txt" wide
15 | $string3 = "wallet.dat" wide
16 | $string4 = "Keylog Records" wide
17 | $string5 = "" wide
18 | $string6 = "\\pidloc.txt" wide
19 | $string7 = "BSPLIT" wide
20 |
21 |
22 | condition:
23 | $key and $salt and all of ($string*)
24 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/Hermes.yar:
--------------------------------------------------------------------------------
1 | rule Hermes
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Hermes Payload"
6 | cape_type = "Hermes Payload"
7 | strings:
8 | $ext = ".HRM" wide
9 | $vss = "vssadmin Delete"
10 | $email = "supportdecrypt@firemail.cc" wide
11 | condition:
12 | uint16(0) == 0x5A4D and all of ($*)
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/IcedID.yar:
--------------------------------------------------------------------------------
1 | rule IcedID
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "IcedID Payload"
6 | cape_type = "IcedID Payload"
7 | strings:
8 | $crypt1 = {8A 04 ?? D1 C? F7 D? D1 C? 81 E? 20 01 00 00 D1 C? F7 D? 81 E? 01 91 00 00 32 C? 88}
9 | $crypt2 = {8B 44 24 04 D1 C8 F7 D0 D1 C8 2D 20 01 00 00 D1 C0 F7 D0 2D 01 91 00 00 C3}
10 | $crypt3 = {41 00 8B C8 C1 E1 08 0F B6 C4 66 33 C8 66 89 4? 24 A1 ?? ?? 41 00 89 4? 20 A0 ?? ?? 41 00 D0 E8 32 4? 32}
11 | $major_ver = {0F B6 05 ?? ?? ?? ?? 6A ?? 6A 72 FF 75 0C 6A 70 50 FF 35 ?? ?? ?? ?? 8D 45 80 FF 35 ?? ?? ?? ?? 6A 63 FF 75 08 6A 67 50 FF 75 10 FF 15 ?? ?? ?? ?? 83 C4 38 8B E5 5D C3}
12 | condition:
13 | any of them
14 | }
15 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Imminent.yar:
--------------------------------------------------------------------------------
1 | rule Imminent
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Imminent Payload"
6 | cape_type = "Imminent Payload"
7 | strings:
8 | $string1 = "Imminent-Monitor"
9 | $string2 = "abuse@imminentmethods.net"
10 | $string3 = "SevenZipHelper"
11 | $string4 = "get_EntryPoint"
12 | $string5 = "WrapNonExceptionThrows"
13 | condition:
14 | uint16(0) == 0x5A4D and all of them
15 | }
16 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Infinity.yar:
--------------------------------------------------------------------------------
1 | rule Infinity
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/Infinity"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "Infinity Payload"
9 |
10 | strings:
11 | $a = "CRYPTPROTECT_PROMPTSTRUCT"
12 | $b = "discomouse"
13 | $c = "GetDeepInfo"
14 | $d = "AES_Encrypt"
15 | $e = "StartUDPFlood"
16 | $f = "BATScripting" wide
17 | $g = "FBqINhRdpgnqATxJ.html" wide
18 | $i = "magic_key" wide
19 |
20 | condition:
21 | all of them
22 | }
23 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Jaff.yar:
--------------------------------------------------------------------------------
1 | rule Jaff
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Jaff Payload"
6 | cape_type = "Jaff Payload"
7 | strings:
8 | $a1 = "CryptGenKey"
9 | $a2 = "353260540318613681395633061841341670181307185694827316660016508"
10 | $b1 = "jaff"
11 | $b2 = "2~1c0q4t7"
12 | condition:
13 | uint16(0) == 0x5A4D and (any of ($a*) ) and (1 of ($b*))
14 | }
15 |
--------------------------------------------------------------------------------
/data/yara/CAPE/JavaDropper.yar:
--------------------------------------------------------------------------------
1 | rule JavaDropper
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/AlienSpy"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "JavaDropper Payload"
9 |
10 | strings:
11 | $jar = "META-INF/MANIFEST.MF"
12 |
13 | $b1 = "config.ini"
14 | $b2 = "password.ini"
15 |
16 | $c1 = "stub/stub.dll"
17 |
18 | $d1 = "c.dat"
19 |
20 | condition:
21 | $jar and (all of ($b*) or all of ($c*) or all of ($d*))
22 | }
23 |
--------------------------------------------------------------------------------
/data/yara/CAPE/KeyBase.yar:
--------------------------------------------------------------------------------
1 | rule KeyBase
2 | {
3 | meta:
4 | description = "Identifies KeyBase aka Kibex."
5 | author = "@bartblaze"
6 | date = "2019-02"
7 | hash = "cafe2d12fb9252925fbd1acb9b7648d6"
8 | tlp = "White"
9 | cape_type = "KeyBase Payload"
10 |
11 | strings:
12 | $s1 = " End:]" ascii wide
13 | $s2 = "Keystrokes typed:" ascii wide
14 | $s3 = "Machine Time:" ascii wide
15 | $s4 = "Text:" ascii wide
16 | $s5 = "Time:" ascii wide
17 | $s6 = "Window title:" ascii wide
18 |
19 | $x1 = "&application=" ascii wide
20 | $x2 = "&clipboardtext=" ascii wide
21 | $x3 = "&keystrokestyped=" ascii wide
22 | $x4 = "&link=" ascii wide
23 | $x5 = "&username=" ascii wide
24 | $x6 = "&windowtitle=" ascii wide
25 | $x7 = "=drowssap&" ascii wide
26 | $x8 = "=emitenihcam&" ascii wide
27 |
28 | condition:
29 | uint16(0) == 0x5a4d and (
30 | 5 of ($s*) or 6 of ($x*) or
31 | ( 3 of ($s*) and 3 of ($x*) )
32 | )
33 | }
34 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Kovter.yar:
--------------------------------------------------------------------------------
1 | rule Kovter
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Kovter Payload"
6 | cape_type = "Kovter Payload"
7 | strings:
8 | $a1 = "chkok"
9 | $a2 = "k2Tdgo"
10 | $a3 = "13_13_13"
11 | $a4 = "Win Server 2008 R2"
12 | condition:
13 | uint16(0) == 0x5A4D and (all of ($a*))
14 | }
15 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Kronos.yar:
--------------------------------------------------------------------------------
1 | rule Kronos
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Kronos Payload"
6 | cape_type = "Kronos Payload"
7 | strings:
8 | $a1 = "user_pref(\"network.cookie.cookieBehavior\""
9 | $a2 = "T0E0H4U0X3A3D4D8"
10 | $a3 = "wow64cpu.dll" wide
11 | $a4 = "Kronos" fullword ascii wide
12 | condition:
13 | uint16(0) == 0x5A4D and (any of ($a*))
14 | }
15 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Locky.yar:
--------------------------------------------------------------------------------
1 | rule Locky
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Locky Payload"
6 | cape_type = "Locky Payload"
7 | strings:
8 | $string1 = "wallet.dat" wide
9 | $string2 = "Locky_recover" wide
10 | $string3 = "opt321" wide
11 | condition:
12 | //check for MZ Signature at offset 0
13 | uint16(0) == 0x5A4D and all of them
14 | }
15 |
16 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Loki.yar:
--------------------------------------------------------------------------------
1 | rule Loki
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Loki Payload"
6 | cape_type = "Loki Payload"
7 | strings:
8 | $a1 = "DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW"
9 | $a2 = "last_compatible_version"
10 | condition:
11 | uint16(0) == 0x5A4D and (all of ($a*))
12 | }
13 |
--------------------------------------------------------------------------------
/data/yara/CAPE/LostDoor.yar:
--------------------------------------------------------------------------------
1 | rule LostDoor
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/LostDoor"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "LostDoor Payload"
9 |
10 | strings:
11 | $a0 = {0D 0A 2A 45 44 49 54 5F 53 45 52 56 45 52 2A 0D 0A}
12 | $a1 = "*mlt* = %"
13 | $a2 = "*ip* = %"
14 | $a3 = "*victimo* = %"
15 | $a4 = "*name* = %"
16 | $b5 = "[START]"
17 | $b6 = "[DATA]"
18 | $b7 = "We Control Your Digital World" wide ascii
19 | $b8 = "RC4Initialize" wide ascii
20 | $b9 = "RC4Decrypt" wide ascii
21 |
22 | condition:
23 | all of ($a*) or all of ($b*)
24 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/LuminosityLink.yar:
--------------------------------------------------------------------------------
1 | rule LuminosityLink
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/LuminosityLink"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "LuminosityLink Payload"
9 |
10 | strings:
11 | $a = "SMARTLOGS" wide
12 | $b = "RUNPE" wide
13 | $c = "b.Resources" wide
14 | $d = "CLIENTINFO*" wide
15 | $e = "Invalid Webcam Driver Download URL, or Failed to Download File!" wide
16 | $f = "Proactive Anti-Malware has been manually activated!" wide
17 | $g = "REMOVEGUARD" wide
18 | $h = "C0n1f8" wide
19 | $i = "Luminosity" wide
20 | $j = "LuminosityCryptoMiner" wide
21 | $k = "MANAGER*CLIENTDETAILS*" wide
22 |
23 | condition:
24 | all of them
25 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/LuxNet.yar:
--------------------------------------------------------------------------------
1 | rule LuxNet
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/LuxNet"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "LuxNet Payload"
9 |
10 | strings:
11 | $a = "GetHashCode"
12 | $b = "Activator"
13 | $c = "WebClient"
14 | $d = "op_Equality"
15 | $e = "dickcursor.cur" wide
16 | $f = "{0}|{1}|{2}" wide
17 |
18 | condition:
19 | all of them
20 | }
21 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Magniber.yar:
--------------------------------------------------------------------------------
1 | rule Magniber
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Magniber Payload"
6 | cape_type = "Magniber Payload"
7 | strings:
8 | $a1 = {8B 55 FC 83 C2 01 89 55 FC 8B 45 FC 3B 45 08 7D 45 6A 01 6A 00 E8 26 FF FF FF 83 C4 08 89 45 F4 83 7D F4 00 75 18 6A 7A 6A 61 E8 11 FF FF FF 83 C4 08 8B 4D FC 8B 55 F8 66 89 04 4A EB 16}
9 | condition:
10 | uint16(0) == 0x5A4D and (all of ($a*))
11 | }
12 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Mangzamel.yar:
--------------------------------------------------------------------------------
1 | rule Mangzamel
2 | {
3 | meta:
4 | cape_type = "Mangzamel Payload"
5 | description = "This rule will flag on the 4 byte xor loop in later copies of mangzamel with embedded tagging"
6 | reference = "Mangzamel Samples"
7 | author = "David Cannings"
8 | date = "2014-09"
9 | filetype = "pe"
10 |
11 | strings:
12 | $xor1 = {8B 1E 83 C0 04 33 D9 83 C6 04 89 58 FC 4A 75 F0}
13 | $xor2 = {8B 08 83 C0 04 33 4D 14 89 0A 83 C2 04 4F 75 F0}
14 | $xor3 = {53 8B 18 83 C1 04 33 DA 83 C0 04 89 59 FC 4E 75 F0 5B}
15 |
16 | condition:
17 | any of them
18 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/MedusaLocker.yar:
--------------------------------------------------------------------------------
1 | rule MedusaLocker {
2 | meta:
3 | author = "ditekshen"
4 | description = "MedusaLocker Ransomware Payload"
5 | cape_type = "MedusaLocker Payload"
6 | strings:
7 | $s1 = "\\MedusaLockerInfo\\MedusaLockerProject\\MedusaLocker\\Release\\MedusaLocker.pdb" ascii
8 | $s2 = "SOFTWARE\\Medusa" wide
9 | $s3 = "{8761ABBD-7F85-42EE-B272-A76179687C63}" fullword wide
10 | $s4 = "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" fullword wide
11 | $s5 = "{6EDD6D74-C007-4E75-B76A-E5740995E24C}" fullword wide
12 | $s6 = "vssadmin.exe delete" wide nocase
13 | $s7 = "bcdedit.exe /set {default}" wide
14 | $s8 = "wbadmin delete systemstatebackup" wide nocase
15 | $s9 = ".exe,.dll,.sys,.ini,.lnk,.rdp,.encrypted" fullword ascii
16 | $s10 = "[LOCKER] " wide
17 | condition:
18 | uint16(0) == 0x5a4d and 6 of them
19 | }
20 |
--------------------------------------------------------------------------------
/data/yara/CAPE/MegaCortex.yar:
--------------------------------------------------------------------------------
1 | rule MegaCortex
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "MegaCortex Payload"
6 | cape_type = "MegaCortex Payload"
7 | strings:
8 | $str1 = ".megac0rtx" ascii wide
9 | $str2 = "vssadmin delete shadows /all" ascii
10 | $sha256 = {98 2F 8A 42 91 44 37 71 CF FB C0 B5 A5 DB B5 E9}
11 | condition:
12 | uint16(0) == 0x5A4D and all of them
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Mole.yar:
--------------------------------------------------------------------------------
1 | rule Mole
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Mole Payload"
6 | cape_type = "Mole Payload"
7 | strings:
8 | $a1 = ".mole0" wide
9 | $a2 = "_HELP_INSTRUCTION.TXT" wide
10 | $a3 = "-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ"
11 | condition:
12 | uint16(0) == 0x5A4D and (all of ($a*))
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/NanoCore.yar:
--------------------------------------------------------------------------------
1 | rule NanoCore
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/NanoCore"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "NanoCore Payload"
9 |
10 | strings:
11 | $a = "NanoCore"
12 | $b = "ClientPlugin"
13 | $c = "ProjectData"
14 | $d = "DESCrypto"
15 | $e = "KeepAlive"
16 | $f = "IPNETROW"
17 | $g = "LogClientMessage"
18 | $h = "|ClientHost"
19 | $i = "get_Connected"
20 | $j = "#=q"
21 | $key = {43 6f 24 cb 95 30 38 39}
22 |
23 |
24 | condition:
25 | 6 of them
26 | }
27 |
--------------------------------------------------------------------------------
/data/yara/CAPE/NanoLocker.yar:
--------------------------------------------------------------------------------
1 | rule NanoLocker
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "NanoLocker Payload"
6 | cape_type = "NanoLocker Payload"
7 | strings:
8 | $a1 = "NanoLocker"
9 | $a2 = "$humanDeadline"
10 | $a3 = "Decryptor.lnk"
11 | condition:
12 | uint16(0) == 0x5A4D and (all of ($a*))
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/NetTraveler.yar:
--------------------------------------------------------------------------------
1 | rule NetTraveler
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "NetTraveler Payload"
6 | cape_type = "NetTraveler Payload"
7 | strings:
8 | $string1 = {4E 61 6D 65 3A 09 25 73 0D 0A 54 79 70 65 3A 09 25 73 0D 0A 53 65 72 76 65 72 3A 09 25 73 0D 0A} // "Name: %s Type: %s Server: %s "
9 | $string2 = "Password Expiried Time:"
10 | $string3 = "Memory: Total:%dMB,Left:%dMB (for %.2f%s)"
11 |
12 | condition:
13 | uint16(0) == 0x5A4D and all of them
14 | }
15 |
--------------------------------------------------------------------------------
/data/yara/CAPE/NetWire.yar:
--------------------------------------------------------------------------------
1 | rule NetWire
2 | {
3 | meta:
4 | author = " Kevin Breen & David Cannings"
5 | ref = "http://malwareconfig.com/stats/NetWire"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "NetWire Payload"
9 |
10 | strings:
11 |
12 | $exe1 = "%.2d-%.2d-%.4d"
13 | $exe2 = "%s%.2d-%.2d-%.4d"
14 | $exe3 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
15 | $exe4 = "wcnwClass"
16 | $exe5 = "[Ctrl+%c]"
17 | $exe6 = "SYSTEM\\CurrentControlSet\\Control\\ProductOptions"
18 | $exe7 = "%s\\.purple\\accounts.xml"
19 |
20 | condition:
21 | all of them
22 | }
23 |
--------------------------------------------------------------------------------
/data/yara/CAPE/OlympicDestroyer.yar:
--------------------------------------------------------------------------------
1 | rule OlympicDestroyer
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "OlympicDestroyer Payload"
6 | cape_type = "OlympicDestroyer Payload"
7 | strings:
8 | $string1 = "SELECT origin_url, username_value, password_value FROM logins"
9 | $string2 = "API call with %s database connection pointer"
10 | $string3 = "os_win.c:%d: (%lu) %s(%s) - %s"
11 | condition:
12 | uint16(0) == 0x5A4D and all of ($string*)
13 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/Pandora.yar:
--------------------------------------------------------------------------------
1 | rule Pandora
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/Pandora"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "Pandora Payload"
9 |
10 | strings:
11 | $a = "Can't get the Windows version"
12 | $b = "=M=Q=U=Y=]=a=e=i=m=q=u=y=}="
13 | $c = "JPEG error #%d" wide
14 | $d = "Cannot assign a %s to a %s" wide
15 | $g = "%s, ProgID:"
16 | $h = "clave"
17 | $i = "Shell_TrayWnd"
18 | $j = "melt.bat"
19 | $k = "\\StubPath"
20 | $l = "\\logs.dat"
21 | $m = "1027|Operation has been canceled!"
22 | $n = "466|You need to plug-in! Double click to install... |"
23 | $0 = "33|[Keylogger Not Activated!]"
24 |
25 | condition:
26 | all of them
27 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/Paradox.yar:
--------------------------------------------------------------------------------
1 | rule Paradox
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/Paradox"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "Paradox Payload"
9 |
10 | strings:
11 | $a = "ParadoxRAT"
12 | $b = "Form1"
13 | $c = "StartRMCam"
14 | $d = "Flooders"
15 | $e = "SlowLaris"
16 | $f = "SHITEMID"
17 | $g = "set_Remote_Chat"
18 |
19 | condition:
20 | all of them
21 | }
22 |
--------------------------------------------------------------------------------
/data/yara/CAPE/PatchWork.yar:
--------------------------------------------------------------------------------
1 | rule PatchWork
2 | {
3 | meta:
4 | description = "PatchWork"
5 | author = "@avman1995"
6 | reference = "https://app.any.run/tasks/7ef05c98-a4d4-47ff-86e5-8386f8787224"
7 | date = "2019/01"
8 | maltype = "APT"
9 | cape_type = "PatchWork Payload"
10 |
11 | strings:
12 | $string1 = "AppId"
13 | $string2 = "AXE: #"
14 | $string3 = "Bld: %s.%s.%s"
15 | $string4 = "%s@%s %s"
16 | $string5 = "c:\\intel\\"
17 |
18 | condition:
19 | all of ($string*)
20 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/PetrWrap.yar:
--------------------------------------------------------------------------------
1 | rule PetrWrap
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "PetrWrap Payload"
6 | cape_type = "PetrWrap Payload"
7 | strings:
8 | $a1 = "http://petya3jxfp2f7g3i.onion/"
9 | $a2 = "http://petya3sen7dyko2n.onion"
10 |
11 | $b1 = "http://mischapuk6hyrn72.onion/"
12 | $b2 = "http://mischa5xyix2mrhd.onion/"
13 | condition:
14 | uint16(0) == 0x5A4D and (any of ($a*)) and (any of ($b*))
15 | }
16 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Petya.yar:
--------------------------------------------------------------------------------
1 | rule Petya
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Petya Payload"
6 | cape_type = "Petya Payload"
7 | strings:
8 | $a1 = "CHKDSK is repairing sector"
9 | $a2 = "wowsmith123456@posteo.net"
10 | $a3 = "1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX" wide
11 | condition:
12 | uint16(0) == 0x5A4D and (all of ($a*))
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Phorpiex.yar:
--------------------------------------------------------------------------------
1 | rule Phorpiex
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Phorpiex Payload"
6 | cape_type = "Phorpiex Payload"
7 | strings:
8 | $code = {99 B9 FF 00 00 00 F7 F9 83 C2 01 52 E8 0F 0D 00 00 99 B9 FF 00 00 00 F7 F9 83 C2 01 52 E8 FE 0C 00 00 99 B9 FF 00 00 00 F7 F9 83 C2 01 52 E8 ED 0C 00 00 99}
9 | condition:
10 | uint16(0) == 0x5A4D and ($code)
11 | }
12 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Plasma.yar:
--------------------------------------------------------------------------------
1 | rule Plasma
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/Plasma"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "Plasma Payload"
9 |
10 | strings:
11 | $a = "Miner: Failed to Inject." wide
12 | $b = "Started GPU Mining on:" wide
13 | $c = "BK: Hard Bot Killer Ran Successfully!" wide
14 | $d = "Uploaded Keylogs Successfully!" wide
15 | $e = "No Slowloris Attack is Running!" wide
16 | $f = "An ARME Attack is Already Running on" wide
17 | $g = "Proactive Bot Killer Enabled!" wide
18 | $h = "PlasmaRAT" wide ascii
19 | $i = "AntiEverything" wide ascii
20 |
21 | condition:
22 | all of them
23 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/PoisonIvy.yar:
--------------------------------------------------------------------------------
1 | rule PoisonIvy
2 | {
3 | // Modified for CAPE in 2017/03
4 | meta:
5 | author = "Kevin Breen "
6 | ref = "http://malwareconfig.com/stats/PoisonIvy"
7 | maltype = "Remote Access Trojan"
8 | filetype = "exe"
9 | cape_type = "PoisonIvy Payload"
10 |
11 | strings:
12 | //$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
13 | $stub = "StubPath"
14 | $string1 = "CONNECT %s:%i HTTP/1.0"
15 | $string2 = "ws2_32"
16 | $string3 = "cks=u"
17 | $string4 = "thj@h"
18 | //$string5 = "advpack"
19 | $regvalue1 = "SOFTWARE\\Classes\\http\\shell\\open\\command"
20 | $regvalue2 = "Software\\Microsoft\\Active Setup\\Installed Components\\"
21 | condition:
22 | //$stub at 0x1620 and all of ($string*) or (all of them)
23 | all of ($string*) or ($stub and all of ($regvalue*))
24 | }
25 |
--------------------------------------------------------------------------------
/data/yara/CAPE/PowerPool.yar:
--------------------------------------------------------------------------------
1 | rule PowerPool {
2 | meta:
3 | author = "ditekshen"
4 | description = "PowerPool Stage 1 Backdoor Payload"
5 | cape_type = "PowerPool Payload"
6 | strings:
7 | $str1 = "cmd /c powershell.exe " wide
8 | $str2 = "rar.exe a -r %s.rar" wide
9 | $str3 = "MyDemonMutex%d" wide
10 | $str4 = "CMD COMMAND EXCUTE ERROR!" ascii
11 | $str5 = "/?id=%s&info=%s" wide
12 | $str6 = "MyScreen.jpg" wide
13 | $str7 = "proxy.log" wide
14 | condition:
15 | uint16(0) == 0x5A4D and 5 of them
16 | }
17 |
--------------------------------------------------------------------------------
/data/yara/CAPE/PredatorPain.yar:
--------------------------------------------------------------------------------
1 | rule PredatorPain
2 | {
3 |
4 | meta:
5 | author = " Kevin Breen "
6 | ref = "http://malwareconfig.com/stats/PredatorPain"
7 | maltype = "Remote Access Trojan"
8 | filetype = "exe"
9 | cape_type = "PredatorPain Payload"
10 |
11 | strings:
12 | $string1 = "holderwb.txt" wide
13 | $string3 = "There is a file attached to this email" wide
14 | $string4 = "screens\\screenshot" wide
15 | $string5 = "Disablelogger" wide
16 | $string6 = "\\pidloc.txt" wide
17 | $string7 = "clearie" wide
18 | $string8 = "clearff" wide
19 | $string9 = "emails should be sent to you shortly" wide
20 | $string10 = "jagex_cache\\regPin" wide
21 | $string11 = "open=Sys.exe" wide
22 | $ver1 = "PredatorLogger" wide
23 | $ver2 = "EncryptedCredentials" wide
24 | $ver3 = "Predator Pain" wide
25 |
26 | condition:
27 | 7 of ($string*) and any of ($ver*)
28 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/Punisher.yar:
--------------------------------------------------------------------------------
1 | rule Punisher
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/Punisher"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "Punisher Payload"
9 |
10 | strings:
11 | $a = "abccba"
12 | $b = {5C 00 68 00 66 00 68 00 2E 00 76 00 62 00 73}
13 | $c = {5C 00 73 00 63 00 2E 00 76 00 62 00 73}
14 | $d = "SpyTheSpy" wide ascii
15 | $e = "wireshark" wide
16 | $f = "apateDNS" wide
17 | $g = "abccbaDanabccb"
18 |
19 | condition:
20 | all of them
21 | }
22 |
--------------------------------------------------------------------------------
/data/yara/CAPE/PythoRAT.yar:
--------------------------------------------------------------------------------
1 | rule PythoRAT
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/PythoRAT"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "PythoRAT Payload"
9 |
10 | strings:
11 | $a = "TKeylogger"
12 | $b = "uFileTransfer"
13 | $c = "TTDownload"
14 | $d = "SETTINGS"
15 | $e = "Unknown" wide
16 | $f = "#@#@#"
17 | $g = "PluginData"
18 | $i = "OnPluginMessage"
19 |
20 | condition:
21 | all of them
22 | }
23 |
--------------------------------------------------------------------------------
/data/yara/CAPE/QRat.yar:
--------------------------------------------------------------------------------
1 | rule QRat
2 | {
3 | meta:
4 | author = "Kevin Breen @KevTheHermit"
5 | ref = "http://malwareconfig.com"
6 | maltype = "Remote Access Trojan"
7 | filetype = "jar"
8 | cape_type = "QRat Payload"
9 |
10 | strings:
11 | $a0 = "e-data"
12 | $a1 = "quaverse/crypter"
13 | $a2 = "Qrypt.class"
14 | $a3 = "Jarizer.class"
15 | $a4 = "URLConnection.class"
16 |
17 |
18 | condition:
19 | 4 of them
20 |
21 |
22 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/QakBot.yar:
--------------------------------------------------------------------------------
1 | rule QakBot
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "QakBot Payload"
6 | cape_type = "QakBot Payload"
7 | strings:
8 | $crypto = {8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 C9 00 FF FF FF 41}
9 | $anti_sandbox = {8D 4D FC 51 E8 ?? ?? ?? ?? 83 C4 04 E8 ?? ?? ?? ?? 85 C0 7E 07 C7 45 F8 00 00 00 00 33 D2 74 02 EB FA 8B 45 F8 EB 08 33 C0 74 02 EB FA 33 C0 8B E5 5D C3}
10 | $decrypt_config1 = {FF 37 83 C3 EC 53 8B 5D 0C 8D 43 14 50 6A 14 53 E8 ?? ?? ?? ?? 83 C4 14 85 C0 ?? 26 ?? ?? 86 20 02 00 00 66 85 C0 ?? ?? FF 37 FF 75 10 53}
11 | $decrypt_config2 = {8B 45 08 8B 88 24 04 00 00 51 8B 55 10 83 EA 14 52 8B 45 0C 83 C0 14 50 6A 14 8B 4D 0C 51 E8 6C 08 00 00}
12 | condition:
13 | uint16(0) == 0x5A4D and any of ($*)
14 | }
15 |
--------------------------------------------------------------------------------
/data/yara/CAPE/RCSession.yar:
--------------------------------------------------------------------------------
1 | rule RCSession
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "RCSession Payload"
6 | cape_type = "RCSession Payload"
7 | strings:
8 | $a1 = {56 33 F6 39 74 24 08 7E 4C 53 57 8B F8 2B FA 8B C6 25 03 00 00 80 79 05 48 83 C8 FC 40 83 E8 00 74 19 48 74 0F 48 74 05 6B C9 09 EB 15 8B C1 C1 E8 02 EB 03 8D 04 09 2B C8}
9 | $a2 = {83 C4 10 85 C0 74 ?? BE ?? ?? ?? ?? 89 74 24 10 E8 ?? ?? ?? ?? 6A 03 68 48 0B 00 00 56 53 57 68 02 00 00 80 E8 ?? ?? ?? ?? 83 C4 18 85 C0 74 18 E8 ?? ?? ?? ?? 6A 03 68 48}
10 | condition:
11 | (any of ($a*))
12 | }
13 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Ramnit.yar:
--------------------------------------------------------------------------------
1 | rule Ramnit
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Ramnit Payload"
6 | cape_type = "Ramnit Payload"
7 | strings:
8 | $DGA = {33 D2 B9 1D F3 01 00 F7 F1 8B C8 B8 A7 41 00 00 F7 E2 8B D1 8B C8 B8 14 0B 00 00 F7 E2 2B C8 33 D2 8B C1 8B}
9 | $xor_loop = {83 7D 0C 00 74 27 83 7D 14 00 74 21 8B 4D 0C 8B 7D 08 8B 75 10 BA 00 00 00 00 0B D2 75 04 8B 55 14 4A 8A 1C 32 32 1F 88 1F 47 4A E2 ED}
10 | $id_string = "{%08X-%04X-%04X-%04X-%08X%04X}"
11 | condition:
12 | uint16(0) == 0x5A4D and all of ($*)
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/RedLeaf.yar:
--------------------------------------------------------------------------------
1 | rule RedLeaf
2 | {
3 | meta:
4 | author = "kev"
5 | description = "RedLeaf crypto function"
6 | cape_type = "RedLeaf Payload"
7 | strings:
8 | $crypto = {6A 10 B8 ?? ?? ?? 10 E8 ?? ?? 01 00 8B F1 89 75 E4 8B 7D 08 83 CF 07 81 FF FE FF FF 7F 76 05 8B 7D 08 EB 29 8B 4E 14 89 4D EC D1 6D EC 8B C7 33 D2 6A 03 5B F7 F3 8B 55 EC 3B D0 76 10 BF FE FF FF}
9 | condition:
10 | $crypto
11 | }
12 |
13 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Redsip.yar:
--------------------------------------------------------------------------------
1 | rule Redsip
2 | {
3 | meta:
4 | author = "kev"
5 | description = "Redsip Payload"
6 | cape_type = "Redsip Payload"
7 | strings:
8 | $payload1 = {8B 45 F8 99 B9 0A 00 00 00 F7 F9 85 D2 75 1F 8A 55 10 88 55 FF 8B 45 08 03 45 F8 0F BE 08 0F BE 55 FF 33 CA 8B 45 08 03 45 F8 88 08 EB C1}
9 | condition:
10 | uint16(0) == 0x5A4D and (any of ($payload*))
11 | }
12 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Remcos.yar:
--------------------------------------------------------------------------------
1 | rule Remcos
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Remcos Payload"
6 | cape_type = "Remcos Payload"
7 | strings:
8 | $name = "Remcos" nocase
9 | $time = "%02i:%02i:%02i:%03i"
10 | $crypto = {0F B6 [1-7] 8B 45 08 [0-2] 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 ?? ?? FF FF 30 06 47 3B 7D 0C 72}
11 | condition:
12 | uint16(0) == 0x5A4D and all of ($*)
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Retefe.yar:
--------------------------------------------------------------------------------
1 | rule Retefe
2 | {
3 | meta:
4 | author = "Tomasuh"
5 | description = "Retefe Payload"
6 | cape_type = "Retefe Payload"
7 | strings:
8 | $retefe_encoded_buffer = {48 8b 44 24 20 8b 40 08 48 8b 4c 24 20 48 8d 15}
9 | $retefe_xor_seed = {24 20 48 8b 44 24 20 C7 40 08}
10 | $retefe_xor_seed_2ndarg = {89 54 24 10 48 89 4c 24 08 48 83 ec 58 ba}
11 | $retefe_shift_and_sub_match = {c1 e0 ?? b9}
12 | condition:
13 | uint16(0) == 0x5A4D and (all of them)
14 | }
15 |
--------------------------------------------------------------------------------
/data/yara/CAPE/RokRat.yar:
--------------------------------------------------------------------------------
1 | rule RokRat
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "RokRat Payload"
6 | cape_type = "RokRat Payload"
7 | strings:
8 | $code1 = {8B 57 04 8D 7F 04 33 57 FC 81 E2 FF FF FF 7F 33 57 FC 8B C2 24 01 0F B6 C0 F7 D8 1B C0 D1 EA 25 DF B0 08 99 33 87 30 06 00 00 33 C2 89 87 3C F6 FF FF 83 E9 01 75 C9}
9 | $string1 = "/pho_%s_%d.jpg" wide
10 | condition:
11 | uint16(0) == 0x5A4D and (any of ($code*)) and (any of ($string*))
12 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/Ryuk.yar:
--------------------------------------------------------------------------------
1 | rule Ryuk
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Ryuk Payload"
6 | cape_type = "Ryuk Payload"
7 | strings:
8 | $ext = ".RYK" wide
9 | $readme = "RyukReadMe.txt" wide
10 | $main = "InvokeMainViaCRT"
11 | $code = {48 8B 4D 10 48 8B 03 48 C1 E8 07 C1 E0 04 F7 D0 33 41 08 83 E0 10 31 41 08 48 8B 4D 10 48 8B 03 48 C1 E8 09 C1 E0 03 F7 D0 33 41 08 83 E0 08 31 41 08}
12 | condition:
13 | uint16(0) == 0x5A4D and 3 of ($*)
14 | }
15 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Scarab.yar:
--------------------------------------------------------------------------------
1 | rule Scarab
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Scarab Payload"
6 | cape_type = "Scarab Payload"
7 | strings:
8 | $crypt1 = {8B D8 32 1A 0F B6 DB 8B 1C 9F C1 E8 08 33 D8 8B C3 42 8B D8 32 1A 0F B6 DB 8B 1C 9F C1 E8 08 33 D8 8B C3 42 8B D8 32 1A 0F B6 DB 8B 1C 9F C1 E8 08}
9 | $crypt2 = {8B 4C 82 0C 8B D9 C1 E3 18 C1 E9 08 0B D9 8B CB 0F B6 D9 8B 1C 9D AC 0C 43 00 89 5C 24 04 8B D9 C1 EB 08 0F B6 DB 8B 34 9D AC 0C 43 00 8B D9 C1 EB 10}
10 | $crypt3 = {8B 13 8B CA 81 E1 80 80 80 80 8B C1 C1 E8 07 50 8B C1 59 2B C1 25 1B 1B 1B 1B 8B CA 81 E1 7F 7F 7F 7F 03 C9 33 C1 8B C8 81 E1 80 80 80 80 8B F1 C1 EE 07}
11 | condition:
12 | uint16(0) == 0x5A4D and all of them
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Sedreco.yar:
--------------------------------------------------------------------------------
1 | rule Sedreco
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Sedreco encrypt function entry"
6 | cape_type = "Sedreco Payload"
7 | strings:
8 | $encrypt1 = {55 8B EC 83 EC 2C 53 56 8B F2 57 8B 7D 08 B8 AB AA AA AA}
9 | $encrypt2 = {55 8B EC 83 EC 20 8B 4D 10 B8 AB AA AA AA}
10 |
11 | $encrypt64_1 = {48 89 4C 24 08 53 55 56 57 41 54 41 56 48 83 EC 18 45 8D 34 10 48 8B E9 B8 AB AA AA AA 4D 8B E1 44 89 44 24 60 41 F7 E0 8B F2 B8 AB AA AA AA}
12 |
13 | condition:
14 | uint16(0) == 0x5A4D and $encrypt1 or $encrypt2 or $encrypt64_1
15 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/Seduploader.yar:
--------------------------------------------------------------------------------
1 | rule Seduploader
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Seduploader decrypt function"
6 | cape_type = "Seduploader Payload"
7 | strings:
8 | $decrypt1 = {8D 0C 30 C7 45 FC 0A 00 00 00 33 D2 F7 75 FC 8A 82 ?? ?? ?? ?? 32 04 0F 88 01 8B 45 0C 40 89 45 0C 3B C3 7C DB}
9 | condition:
10 | uint16(0) == 0x5A4D and any of ($decrypt*)
11 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/Shade.yar:
--------------------------------------------------------------------------------
1 | rule Shade
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Shade Payload"
6 | cape_type = "Shade Payload"
7 | strings:
8 | $crypto = {C1 E1 18 [5-8] 80 80 80 80 [1-6] EE C1 ED 07 [0-5] 81 E7 FE FE FE FE [2-6] 1B 1B 1B 1B}
9 | $openssl = "openssl" nocase
10 | condition:
11 | uint16(0) == 0x5A4D and all of ($*)
12 | }
13 |
--------------------------------------------------------------------------------
/data/yara/CAPE/ShadowTech.yar:
--------------------------------------------------------------------------------
1 | rule ShadowTech
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/ShadowTech"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "ShadowTech Payload"
9 |
10 | strings:
11 | $a = "ShadowTech" nocase
12 | $b = "DownloadContainer"
13 | $c = "MySettings"
14 | $d = "System.Configuration"
15 | $newline = "#-@NewLine@-#" wide
16 | $split = "pSIL" wide
17 | $key = "ESIL" wide
18 |
19 | condition:
20 | 4 of them
21 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/SmallNet.yar:
--------------------------------------------------------------------------------
1 | rule SmallNet
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/SmallNet"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "SmallNet Payload"
9 |
10 | strings:
11 | $split1 = "!!<3SAFIA<3!!"
12 | $split2 = "!!ElMattadorDz!!"
13 | $a1 = "stub_2.Properties"
14 | $a2 = "stub.exe" wide
15 | $a3 = "get_CurrentDomain"
16 |
17 | condition:
18 | ($split1 or $split2) and (all of ($a*))
19 | }
20 |
--------------------------------------------------------------------------------
/data/yara/CAPE/SmokeLoader.yar:
--------------------------------------------------------------------------------
1 | rule SmokeLoader
2 | {
3 | meta:
4 | author = "kev"
5 | description = "SmokeLoader C2 decryption function"
6 | cape_type = "SmokeLoader Payload"
7 | strings:
8 | $decrypt64_1 = {44 0F B6 CF 48 8B D0 49 03 D9 4C 2B D8 8B 4B 01 41 8A 04 13 41 BA 04 00 00 00 0F C9 32 C1 C1 F9 08 49 FF CA 75 F6 F6 D0 88 02 48 FF C2 49 FF C9 75 DB 49 8B C0 48 8B 5C 24 30 48 83 C4 20 5F C3}
9 | $decrypt64_2 = {40 84 FF 90 90 E8 00 00 00 00 5E 48 83 C6 1C 49 8B F8 A4 80 3E 00 75 FA 80 07 00 48 8B 5C 24 30 48 83 C4 20 5F C3}
10 | $decrypt32_1 = {03 EE 8B D7 2B C7 8B F8 8B 4D 01 8A 04 17 6A 04 0F C9 5B 32 C1 C1 F9 08 4B 75 F8 F6 D0 88 02 42 4E 75 E5 8B 7C 24 14 8B C7 5F 5E 5D 5B 59 59 C3}
11 | condition:
12 | any of ($decrypt*)
13 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/SpyGate.yar:
--------------------------------------------------------------------------------
1 | rule SpyGate
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/SpyGate"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "SpyGate Payload"
9 |
10 | strings:
11 | $split = "abccba"
12 | $a1 = "abccbaSpyGateRATabccba" //$a = Version 0.2.6
13 | $a2 = "StubX.pdb"
14 | $a3 = "abccbaDanabccb"
15 | $b1 = "monikerString" nocase //$b = Version 2.0
16 | $b2 = "virustotal1"
17 | $b3 = "get_CurrentDomain"
18 | $c1 = "shutdowncomputer" wide //$c = Version 2.9
19 | $c2 = "shutdown -r -t 00" wide
20 | $c3 = "set cdaudio door closed" wide
21 | $c4 = "FileManagerSplit" wide
22 | $c5 = "Chating With >> [~Hacker~]" wide
23 |
24 | condition:
25 | (all of ($a*) and #split > 40) or (all of ($b*) and #split > 10) or (all of ($c*))
26 | }
27 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Sub7Nation.yar:
--------------------------------------------------------------------------------
1 | rule Sub7Nation
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/Sub7Nation"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "Sub7Nation Payload"
9 |
10 | strings:
11 | $a = "EnableLUA /t REG_DWORD /d 0 /f"
12 | $b = "*A01*"
13 | $c = "*A02*"
14 | $d = "*A03*"
15 | $e = "*A04*"
16 | $f = "*A05*"
17 | $g = "*A06*"
18 | $h = "#@#@#"
19 | $i = "HostSettings"
20 | $verSpecific1 = "sevane.tmp"
21 | $verSpecific2 = "cmd_.bat"
22 | $verSpecific3 = "a2b7c3d7e4"
23 | $verSpecific4 = "cmd.dll"
24 |
25 |
26 | condition:
27 | all of them
28 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/TClient.yar:
--------------------------------------------------------------------------------
1 | rule TClient
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "TClient Payload"
6 | cape_type = "TClient Payload"
7 | strings:
8 | $code1 = {41 0F B6 00 4D 8D 40 01 34 01 8B D7 83 E2 07 0F BE C8 FF C7 41 0F BE 04 91 0F AF C1 41 88 40 FF 81 FF 80 03 00 00 7C D8}
9 | condition:
10 | uint16(0) == 0x5A4D and any of ($code*)
11 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/TSCookie.yar:
--------------------------------------------------------------------------------
1 | rule TSCookie
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "TSCookie Payload"
6 | cape_type = "TSCookie Payload"
7 | strings:
8 | $string1 = "http://%s:%d" wide
9 | $string2 = "/Default.aspx" wide
10 | $string3 = "\\wship6"
11 | condition:
12 | uint16(0) == 0x5A4D and all of them
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/UPX.yar:
--------------------------------------------------------------------------------
1 | rule UPX
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 |
6 | strings:
7 | $a = "UPX0"
8 | $b = "UPX1"
9 | $c = "UPX!"
10 |
11 | condition:
12 | all of them
13 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/Ursnif3.yar:
--------------------------------------------------------------------------------
1 | rule Ursnif3
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Ursnif Payload"
6 | cape_type = "Ursnif Payload"
7 | cape_options = "dll=Debugger.dll,step-out=$crypto32,dumpsize=eax,action0=dumpebx,dumptype0=0x24,base-on-api=RtlAddVectoredExceptionHandler,dump-on-api=RtlAddVectoredExceptionHandler,dump-on-api-type=0x25,divert-debugger-log=1"
8 | strings:
9 | $crypto32 = {8B C3 83 EB 01 85 C0 75 0D 0F B6 16 83 C6 01 89 74 24 14 8D 58 07 8B C2 C1 E8 07 83 E0 01 03 D2 85 C0 0F 84 AB 01 00 00 8B C3 83 EB 01 85 C0 89 5C 24 20 75 13 0F B6 16 83 C6 01 BB 07 00 00 00}
10 | $golden_ratio = {8B 70 EC 33 70 F8 33 70 08 33 30 83 C0 04 33 F1 81 F6 B9 79 37 9E C1 C6 0B 89 70 08 41 81 F9 84 00 00 00}
11 | condition:
12 | uint16(0) == 0x5A4D and (all of them)
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Varenyky.yar:
--------------------------------------------------------------------------------
1 | rule Varenyky
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Varenyky Payload"
6 | cape_type = "Varenyky Payload"
7 | strings:
8 | $onion = "jg4rli4xoagvvmw47fr2bnnfu7t2epj6owrgyoee7daoh4gxvbt3bhyd.onion"
9 | condition:
10 | uint16(0) == 0x5A4D and ($onion)
11 | }
12 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Vertex.yar:
--------------------------------------------------------------------------------
1 | rule Vertex
2 | {
3 |
4 | meta:
5 | author = " Kevin Breen "
6 | ref = "http://malwareconfig.com/stats/Vertex"
7 | maltype = "Remote Access Trojan"
8 | filetype = "exe"
9 | cape_type = "Vertex Payload"
10 |
11 | strings:
12 | $string1 = "DEFPATH"
13 | $string2 = "HKNAME"
14 | $string3 = "HPORT"
15 | $string4 = "INSTALL"
16 | $string5 = "IPATH"
17 | $string6 = "MUTEX"
18 | $res1 = "PANELPATH"
19 | $res2 = "ROOTURL"
20 |
21 | condition:
22 | all of them
23 | }
24 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Vidar.yar:
--------------------------------------------------------------------------------
1 | rule Vidar
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Vidar Payload"
6 | cape_type = "Vidar Payload"
7 | strings:
8 | $decode = {FF 75 0C 8D 34 1F FF 15 ?? ?? ?? ?? 8B C8 33 D2 8B C7 F7 F1 8B 45 0C 8B 4D 08 8A 04 02 32 04 31 47 88 06 3B 7D 10 72 D8}
9 | $wallet = "*walle*.dat"
10 | condition:
11 | uint16(0) == 0x5A4D and all of them
12 | }
13 |
--------------------------------------------------------------------------------
/data/yara/CAPE/VirusRat.yar:
--------------------------------------------------------------------------------
1 | rule VirusRat
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/VirusRat"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "VirusRat Payload"
9 |
10 | strings:
11 | $string0 = "virustotal"
12 | $string1 = "virusscan"
13 | $string2 = "abccba"
14 | $string3 = "pronoip"
15 | $string4 = "streamWebcam"
16 | $string5 = "DOMAIN_PASSWORD"
17 | $string6 = "Stub.Form1.resources"
18 | $string7 = "ftp://{0}@{1}" wide
19 | $string8 = "SELECT * FROM moz_logins" wide
20 | $string9 = "SELECT * FROM moz_disabledHosts" wide
21 | $string10 = "DynDNS\\Updater\\config.dyndns" wide
22 | $string11 = "|BawaneH|" wide
23 |
24 | condition:
25 | all of them
26 | }
27 |
--------------------------------------------------------------------------------
/data/yara/CAPE/WanaCry.yar:
--------------------------------------------------------------------------------
1 | rule WanaCry
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "WanaCry Payload"
6 | cape_type = "WanaCry Payload"
7 | strings:
8 | $exename = "@WanaDecryptor@.exe"
9 | $res = "%08X.res"
10 | $pky = "%08X.pky"
11 | $eky = "%08X.eky"
12 | $taskstart = {8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53}
13 | condition:
14 | //check for MZ Signature at offset 0
15 | uint16(0) == 0x5A4D and all of them
16 | }
17 |
18 |
--------------------------------------------------------------------------------
/data/yara/CAPE/Xtreme.yar:
--------------------------------------------------------------------------------
1 | rule Xtreme
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/Xtreme"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | ver = "2.9, 3.1, 3.2, 3.5"
9 | cape_type = "Xtreme Payload"
10 |
11 | strings:
12 | $a = "XTREME" wide
13 | $b = "ServerStarted" wide
14 | $c = "XtremeKeylogger" wide
15 | $d = "x.html" wide
16 | $e = "Xtreme RAT" wide
17 |
18 | condition:
19 | all of them
20 | }
21 |
--------------------------------------------------------------------------------
/data/yara/CAPE/ZeroT.yar:
--------------------------------------------------------------------------------
1 | rule ZeroT
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "ZeroT Payload"
6 | cape_type = "ZeroT Payload"
7 | strings:
8 | $decrypt = {8B C1 8D B5 FC FE FF FF 33 D2 03 F1 F7 75 10 88 0C 33 41 8A 04 3A 88 06 81 F9 00 01 00 00 7C E0}
9 | $string1 = "(*^GF(9042&*"
10 | $string2 = "s2-18rg1-41g3j_.;"
11 | $string3 = "GET" wide
12 | $string4 = "open"
13 | condition:
14 | uint16(0) == 0x5A4D and all of them
15 | }
16 |
--------------------------------------------------------------------------------
/data/yara/CAPE/ZeusPanda.yar:
--------------------------------------------------------------------------------
1 | rule ZeusPanda
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "ZeusPanda Payload"
6 | cape_type = "ZeusPanda Payload"
7 | strings:
8 | $code1 = {8B 01 57 55 55 55 55 55 55 53 51 FF 50 0C 85 C0 78 E? 55 55 6A 03 6A 03 55 55 6A 0A FF 37}
9 | $code2 = {8D 85 B0 FD FF FF 50 68 ?? ?? ?? ?? 8D 85 90 FA FF FF 68 0E 01 00 00 50 E8 ?? ?? ?? ?? 83 C4 10 83 F8 FF 7E ?? 68 04 01 00 00 8D 85 B0 FD FF FF}
10 | condition:
11 | //check for MZ Signature at offset 0
12 | uint16(0) == 0x5A4D and all of them
13 | }
14 |
--------------------------------------------------------------------------------
/data/yara/CAPE/adWind.yar:
--------------------------------------------------------------------------------
1 | rule adWind
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/AAR"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "adWind Payload"
9 |
10 | strings:
11 | $meta = "META-INF"
12 | $conf = "config.xml"
13 | $a = "Adwind.class"
14 | $b = "Principal.adwind"
15 |
16 | condition:
17 | all of them
18 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/jRat.yar:
--------------------------------------------------------------------------------
1 | rule jRat
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/jRat"
6 | maltype = "Remote Access Trojan"
7 | filetype = "Java"
8 | cape_type = "jRat Payload"
9 |
10 | strings:
11 | $meta = "META-INF"
12 | $key = "key.dat"
13 | $conf = "config.dat"
14 | $jra1 = "enc.dat"
15 | $jra2 = "a.class"
16 | $jra3 = "b.class"
17 | $jra4 = "c.class"
18 | $reClass1 = /[a-z]\.class/
19 | $reClass2 = /[a-z][a-f]\.class/
20 |
21 | condition:
22 | ($meta and $key and $conf and #reClass1 > 10 and #reClass2 > 10) or ($meta and $key and all of ($jra*))
23 | }
24 |
--------------------------------------------------------------------------------
/data/yara/CAPE/njRat.yar:
--------------------------------------------------------------------------------
1 | rule njRat
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/njRat"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "njRat Payload"
9 |
10 | strings:
11 |
12 | $s1 = {7C 00 27 00 7C 00 27 00 7C} // |'|'|
13 | $s2 = "netsh firewall add allowedprogram" wide
14 | $s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
15 | $s4 = "yyyy-MM-dd" wide
16 |
17 | $v1 = "cmd.exe /k ping 0 & del" wide
18 | $v2 = "cmd.exe /c ping 127.0.0.1 & del" wide
19 | $v3 = "cmd.exe /c ping 0 -n 2 & del" wide
20 |
21 |
22 | condition:
23 | all of ($s*) and any of ($v*)
24 | }
25 |
--------------------------------------------------------------------------------
/data/yara/CAPE/tRat.yar:
--------------------------------------------------------------------------------
1 | rule tRat
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "tRat Payload"
6 | cape_type = "tRat Payload"
7 | strings:
8 | $code1 = {8D 45 FC E8 ?? ?? ?? ?? 8B 55 FC 0F B6 54 32 FF 66 33 D3 0F B7 D2 2B D6 33 D6 2B D6 33 D6 88 54 30 FF 43 8B 45 FC E8 ?? ?? ?? ?? 0F B7 F3 3B C6 7F CE}
9 | $code2 = {5A 83 E2 03 74 22 8B 0E 8B 1F 38 D9 75 41 4A 74 17 38 FD 75 3A 4A 74 10 81 E3 00 00 FF 00 81 E1 00 00 FF 00 39 D9 75 27}
10 | $string1 = "TCComand"
11 | condition:
12 | uint16(0) == 0x5A4D and all of them
13 | }
--------------------------------------------------------------------------------
/data/yara/CAPE/unrecom.yar:
--------------------------------------------------------------------------------
1 | rule unrecom
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/AAR"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "unrecom Payload"
9 |
10 | strings:
11 | $meta = "META-INF"
12 | $conf = "load/ID"
13 | $a = "load/JarMain.class"
14 | $b = "load/MANIFEST.MF"
15 | $c = "plugins/UnrecomServer.class"
16 |
17 | condition:
18 | all of them
19 | }
20 |
--------------------------------------------------------------------------------
/data/yara/CAPE/xRAT.yar:
--------------------------------------------------------------------------------
1 | rule xRAT
2 | {
3 | meta:
4 | author = " Kevin Breen "
5 | ref = "http://malwareconfig.com/stats/xRat"
6 | maltype = "Remote Access Trojan"
7 | filetype = "exe"
8 | cape_type = "xRAT Payload"
9 |
10 | strings:
11 | $v1a = "DecodeProductKey"
12 | $v1b = "StartHTTPFlood"
13 | $v1c = "CodeKey"
14 | $v1d = "MESSAGEBOX"
15 | $v1e = "GetFilezillaPasswords"
16 | $v1f = "DataIn"
17 | $v1g = "UDPzSockets"
18 | $v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}
19 |
20 | $v2a = "k__BackingField"
21 | $v2b = "k__BackingField"
22 | $v2c = "DownloadAndExecute"
23 | $v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
24 | $v2e = "england.png" wide
25 | $v2f = "Showed Messagebox" wide
26 | condition:
27 | all of ($v1*) or all of ($v2*)
28 | }
--------------------------------------------------------------------------------
/data/yara/binaries/HeavensGate.yar:
--------------------------------------------------------------------------------
1 | rule HeavensGate
2 | {
3 | meta:
4 | author = "kevoreilly"
5 | description = "Heaven's Gate: Switch from 32-bit to 64-mode"
6 | cape_type = "Heaven's Gate"
7 |
8 | strings:
9 | $gate_v1 = {6A 33 E8 00 00 00 00 83 04 24 05 CB}
10 | $gate_v2 = {9A 00 00 00 00 33 00 89 EC 5D C3 48 83 EC 20 E8 00 00 00 00 48 83 C4 20 CB}
11 | $gate_v3 = {5A 66 BB 33 00 66 53 50 89 E0 83 C4 06 FF 28}
12 |
13 | condition:
14 | ($gate_v1 or $gate_v2 or $gate_v3)
15 | }
16 |
--------------------------------------------------------------------------------
/data/yara/memory/.gitignore:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/data/yara/memory/.gitignore
--------------------------------------------------------------------------------
/data/yara/memory/darkcomet.yar:
--------------------------------------------------------------------------------
1 | // Copyright (C) 2015 KillerInstinct
2 | // The contents of this file are Yara rules processed by procmemory.py processing
3 | // module. Add your signatures here.
4 | rule DarkCometConfig
5 | {
6 | meta:
7 | author = "KillerInstinct"
8 | description = "Configuration for DarkComet"
9 | malfamily = "darkcomet"
10 |
11 | strings:
12 | $buf = /#BEGIN\sDARKCOMET[A-Za-z0-9\r\n\s\-\=\_\{\}\.:\\\/]*\#EOF\sDARKCOMET\sDATA\s--/s
13 |
14 | condition:
15 | $buf
16 | }
17 |
--------------------------------------------------------------------------------
/data/yara/memory/rig.yar:
--------------------------------------------------------------------------------
1 | /* Copyright (C) 2016 Will Metcalf william.metcalf@gmail.com
2 | * This program is free software: you can redistribute it and/or modify
3 | * it under the terms of the GNU General Public License as published by
4 | * the Free Software Foundation, either version 3 of the License, or
5 | * (at your option) any later version.
6 | *
7 | * This program is distributed in the hope that it will be useful,
8 | * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 | * GNU General Public License for more details.
11 | *
12 | * You should have received a copy of the GNU General Public License
13 | * along with this program. If not, see .
14 | */
15 |
16 | rule RIG_EK_Memory
17 | {
18 | meta:
19 | malfamily = "rig"
20 | strings:
21 | $s1 = "+ \x27
2 | http://eternal-todo.com
3 | http://twitter.com/EternalTodo
--------------------------------------------------------------------------------
/lib/cuckoo/common/peepdf/TODO:
--------------------------------------------------------------------------------
1 | Pending tasks:
2 |
3 | - Add detection of more exploits/vulns
4 | - Documentation of methods in PDFCore.py
5 | - Add the rest of supported stream filters (better testing of existent)
6 | - Automatic analysis of embedded PDF files
7 | - Improve the automatic Javascript analysis, getting code from other parts of the documents (getAnnots, etc)
8 | - GUI
9 | - ...
--------------------------------------------------------------------------------
/lib/cuckoo/common/peepdf/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/lib/cuckoo/common/peepdf/__init__.py
--------------------------------------------------------------------------------
/lib/cuckoo/common/peepdf/aespython/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/lib/cuckoo/common/peepdf/aespython/__init__.py
--------------------------------------------------------------------------------
/lib/cuckoo/common/peepdf/colorama/__init__.py:
--------------------------------------------------------------------------------
1 | from .initialise import init
2 | from .ansi import Fore, Back, Style
3 | from .ansitowin32 import AnsiToWin32
4 |
5 | VERSION = '0.1.18'
6 |
7 |
--------------------------------------------------------------------------------
/lib/cuckoo/core/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/lib/maec/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/modules/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/modules/auxiliary/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/modules/feeds/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/modules/machinery/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/modules/processing/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/modules/processing/parsers/__init__.py:
--------------------------------------------------------------------------------
1 | # Init
--------------------------------------------------------------------------------
/modules/processing/parsers/malwareconfig/__init__.py:
--------------------------------------------------------------------------------
1 | # Init
--------------------------------------------------------------------------------
/modules/processing/parsers/mwcp/__init__.py:
--------------------------------------------------------------------------------
1 | """Exposes interface for MWCP."""
2 |
3 | import logging
4 |
5 | # Add null handler to root logger to avoid "no handler" error when this is used as a library
6 | logging.getLogger().addHandler(logging.NullHandler())
7 |
8 |
9 | from mwcp import config
10 | from mwcp.parser import Parser
11 | from mwcp.parsers import register_parser_directory, iter_parsers, get_parser_descriptions
12 | from mwcp.reporter import Reporter
13 | from mwcp.resources import techanarchy_bridge
14 | from mwcp.resources.dispatcher import Dispatcher, ComponentParser, FileObject, UnableToParse, UnidentifiedFile
15 | from mwcp.utils.logutil import setup_logging
16 |
--------------------------------------------------------------------------------
/modules/processing/parsers/mwcp/config/__init__.py:
--------------------------------------------------------------------------------
1 | """Stores default configuration values."""
2 |
3 | import os
4 |
5 |
6 | log_config = os.path.join(os.path.dirname(__file__), 'log_config.yml')
7 |
--------------------------------------------------------------------------------
/modules/processing/parsers/mwcp/resources/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/modules/processing/parsers/mwcp/resources/__init__.py
--------------------------------------------------------------------------------
/modules/processing/parsers/mwcp/utils/__init__.py:
--------------------------------------------------------------------------------
1 | """This package is used to store common helper utilities for developing parsers."""
--------------------------------------------------------------------------------
/modules/processing/parsers/mwcp/utils/construct/__init__.py:
--------------------------------------------------------------------------------
1 | """This is a wrapper interface to the construct library which adds extra helper functions."""
2 |
3 |
4 | # Import interface
5 | from construct import *
6 | from mwcp.utils.construct.construct_html import html_hex
7 | from mwcp.utils.construct.windows_enums import *
8 | from mwcp.utils.construct.windows_structures import *
9 |
10 | # NOTE: This must be imported last since it contains overwritten elements of the base construct library.
11 | from mwcp.utils.construct.helpers import *
12 |
--------------------------------------------------------------------------------
/modules/processing/parsers/mwcp/utils/stringutils.py:
--------------------------------------------------------------------------------
1 | """
2 | Utility used for string conversions.
3 | """
4 |
5 | from future.builtins import str
6 |
7 |
8 | def convert_to_unicode(input_string):
9 | if isinstance(input_string, str):
10 | return input_string
11 | else:
12 | return str(input_string, encoding='utf8', errors='replace')
13 |
--------------------------------------------------------------------------------
/modules/processing/parsers/plugxconfig/__init__.py:
--------------------------------------------------------------------------------
1 | # Init
--------------------------------------------------------------------------------
/modules/reporting/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/modules/reporting/mitre.py:
--------------------------------------------------------------------------------
1 | from lib.cuckoo.common.abstracts import Report
2 |
3 | class MITRE_TTPS(Report):
4 | def run(self, results):
5 | if not results.get("ttps") or not hasattr(self, "mitre"):
6 | return
7 |
8 | attck = dict()
9 | for tactic in self.mitre.tactics:
10 | for technique in tactic.techniques:
11 | if technique.id in results["ttps"].keys():
12 | attck.setdefault(tactic.name, list())
13 | attck[tactic.name].append({"t_id": technique.id, "ttp_name": technique.name, "description": technique.description, "signature": results["ttps"][technique.id]})
14 | if attck:
15 | results["mitre_attck"] = attck
16 |
--------------------------------------------------------------------------------
/modules/signatures/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/modules/signatures/antiav_srp.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2014 Optiv, Inc. (brad.spengler@optiv.com)
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.cuckoo.common.abstracts import Signature
6 |
7 | class AntiAVSRP(Signature):
8 | name = "antiav_srp"
9 | description = "Modifies Software Restriction Policies likely to cripple AV"
10 | severity = 3
11 | categories = ["anti-av"]
12 | authors = ["Optiv"]
13 | minimum = "1.2"
14 | ttp = ["T1089"]
15 |
16 | def run(self):
17 | match_key = self.check_write_key(".*\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\\CodeIdentifiers\\\\0\\\\Paths\\\\.*", regex=True, all=True)
18 | if match_key:
19 | for match in match_key:
20 | self.data.append({"key" : match})
21 | return True
22 | return False
23 |
--------------------------------------------------------------------------------
/modules/signatures/disables_app.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2015 Kevin Ross
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.cuckoo.common.abstracts import Signature
6 |
7 | class DisablesAppLaunch(Signature):
8 | name = "disables_app_launch"
9 | description = "Modifies system policies to prevent the launching of specific applications or executables"
10 | severity = 3
11 | categories = ["stealth"]
12 | authors = ["Kevin Ross"]
13 | minimum = "1.2"
14 | ttp = ["T1112"]
15 |
16 | def run(self):
17 | if self.check_write_key(pattern=".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\DisallowRun$", regex=True):
18 | return True
19 |
20 | return False
21 |
--------------------------------------------------------------------------------
/modules/signatures/disables_spdy.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2015 Optiv, Inc. (brad.spengler@optiv.com)
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.cuckoo.common.abstracts import Signature
6 |
7 | class DisablesSPDY(Signature):
8 | name = "disables_spdy"
9 | description = "Attempts to disable SPDY support in Firefox to improve web infostealing capability"
10 | severity = 3
11 | weight = 2
12 | categories = ["generic"]
13 | authors = ["Optiv"]
14 | minimum = "1.2"
15 | evented = True
16 |
17 | def __init__(self, *args, **kwargs):
18 | Signature.__init__(self, *args, **kwargs)
19 |
20 | filter_apinames = set(["NtWriteFile"])
21 |
22 | def on_call(self, call, process):
23 | buf = self.get_argument(call, "Buffer")
24 | if "network.http.spdy.enabled" in buf and "false" in buf:
25 | return True
26 |
--------------------------------------------------------------------------------
/modules/signatures/disables_uac.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2014 Optiv, Inc. (brad.spengler@optiv.com)
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.cuckoo.common.abstracts import Signature
6 |
7 | class DisablesUAC(Signature):
8 | name = "disables_uac"
9 | description = "Attempts to disable UAC"
10 | severity = 3
11 | categories = ["generic"]
12 | authors = ["Optiv"]
13 | minimum = "1.2"
14 |
15 | def run(self):
16 | if self.check_write_key(pattern=".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\EnableLUA$", regex=True):
17 | return True
18 | return False
19 |
--------------------------------------------------------------------------------
/modules/signatures/disables_wer.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2015 Kevin Ross
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.cuckoo.common.abstracts import Signature
6 |
7 | class DisablesWER(Signature):
8 | name = "disables_wer"
9 | description = "Attempts to disable Windows Error Reporting"
10 | severity = 3
11 | categories = ["stealth"]
12 | authors = ["Kevin Ross"]
13 | minimum = "1.2"
14 | ttp = ["T1054", "T1112"]
15 |
16 | def run(self):
17 | if self.check_write_key(pattern=".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\Windows\\ Error\\ Reporting\\\\Disabled$", regex=True):
18 | return True
19 |
20 | return False
21 |
--------------------------------------------------------------------------------
/modules/signatures/disables_windowsupdate.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2015 Optiv, Inc. (brad.spengler@optiv.com)
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.cuckoo.common.abstracts import Signature
6 |
7 | class DisablesWindowsUpdate(Signature):
8 | name = "disables_windowsupdate"
9 | description = "Attempts to disable Windows Auto Updates"
10 | severity = 3
11 | categories = ["generic"]
12 | authors = ["Optiv"]
13 | minimum = "1.2"
14 | ttp = ["T1112"]
15 |
16 | def run(self):
17 | if self.check_write_key(pattern=".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\\\\(AU\\\\NoAutoUpdate|Auto\\ Update\\\\AUOptions)$", regex=True):
18 | return True
19 | return False
20 |
--------------------------------------------------------------------------------
/modules/signatures/modifies_certs.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2015 Kevin Ross
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.cuckoo.common.abstracts import Signature
6 |
7 | class ModifiesCerts(Signature):
8 | name = "modifies_certs"
9 | description = "Attempts to create or modify system certificates"
10 | severity = 3
11 | categories = ["browser"]
12 | authors = ["Kevin Ross"]
13 | minimum = "1.2"
14 | ttp = ["T1112"]
15 |
16 | filter_analysistypes = set(["file"])
17 |
18 | def run(self):
19 | if self.check_write_key(pattern=".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\SystemCertificates\\\\.*\\\\Certificates\\\\.*", regex=True):
20 | return True
21 |
22 | return False
23 |
--------------------------------------------------------------------------------
/modules/signatures/prevents_safeboot.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2014 Optiv, Inc. (brad.spengler@optiv.com)
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.cuckoo.common.abstracts import Signature
6 |
7 | class PreventsSafeboot(Signature):
8 | name = "prevents_safeboot"
9 | description = "Attempts to block SafeBoot use by removing registry keys"
10 | severity = 3
11 | categories = ["generic"]
12 | authors = ["Optiv"]
13 | minimum = "1.2"
14 |
15 | def run(self):
16 | if self.check_delete_key(pattern=".*\\\\System\\\\(CurrentControlSet|ControlSet001)\\\\Control\\\\SafeBoot\\\\.*", regex=True):
17 | return True
18 | return False
19 |
--------------------------------------------------------------------------------
/modules/signatures/ransomware_recyclebin.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2015 Optiv, Inc. (brad.spengler@optiv.com)
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.cuckoo.common.abstracts import Signature
6 |
7 | class RansomwareRecyclebin(Signature):
8 | name = "ransomware_recyclebin"
9 | description = "Empties the Recycle Bin, indicative of ransomware"
10 | severity = 3
11 | categories = ["ransomware"]
12 | authors = ["Optiv"]
13 | minimum = "1.2"
14 |
15 | def run(self):
16 | if self.check_delete_file(pattern="C:\\\\RECYCLER\\\\.*", regex=True):
17 | return True
18 | return False
--------------------------------------------------------------------------------
/modules/signatures/rat_poisonivy.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2014 Optiv, Inc. (brad.spengler@optiv.com)
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.cuckoo.common.abstracts import Signature
6 |
7 | class PoisonIvyMutexes(Signature):
8 | name = "rat_poisonivy_mutexes"
9 | description = "Creates known Poison Ivy mutexes"
10 | severity = 3
11 | categories = ["rat"]
12 | authors = ["Optiv"]
13 | references = ["http://www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf"]
14 | minimum = "1.2"
15 |
16 | def run(self):
17 | indicators = [
18 | ")!VoqA.I4",
19 | "K^DJA^#FE",
20 | "KEIVH^#$S",
21 | "%1Sjfhtd8",
22 | "2SF#@R@#!"
23 | ]
24 |
25 | for indicator in indicators:
26 | if self.check_mutex(pattern=indicator):
27 | return True
28 |
29 | return False
30 |
--------------------------------------------------------------------------------
/modules/signatures/static_rat_config.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2015 Optiv, Inc. (brad.spengler@optiv.com)
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.cuckoo.common.abstracts import Signature
6 |
7 | class RATConfig(Signature):
8 | name = "static_rat_config"
9 | description = "Contains extracted RAT config"
10 | severity = 3
11 | weight = 3
12 | categories = ["static"]
13 | authors = ["Optiv"]
14 | minimum = "1.3"
15 |
16 | def run(self):
17 | if "static" in self.results and "rat" in self.results["static"] and "name" in self.results["static"]["rat"] and len(self.results["static"]["rat"]["name"]):
18 | self.description = "Contains RAT configuration for " + self.results["static"]["rat"]["name"] + " (see Static Analysis tab)"
19 | self.families = [ self.results["static"]["rat"]["name"] ]
20 | return True
21 |
22 | return False
23 |
--------------------------------------------------------------------------------
/modules/signatures/trickbot_mutex.py:
--------------------------------------------------------------------------------
1 | from lib.cuckoo.common.abstracts import Signature
2 |
3 | class TrickBotMutexes(Signature):
4 | name = "trickbot_mutex"
5 | description = "Attempts to create a known TrickBot mutex."
6 | weight = 3
7 | severity = 3
8 | categories = ["banker", "trojan"]
9 | families = ["TrickBot"]
10 | authors = ["Eoin Miller", "Mark Parsons"]
11 | minimum = "0.5"
12 |
13 | def run(self):
14 | if self.check_mutex("Global\\TrickBot") or self.check_mutex("Global\\MGlob"):
15 | return True
16 |
17 | return False
18 |
--------------------------------------------------------------------------------
/requirements.txt:
--------------------------------------------------------------------------------
1 | sqlalchemy
2 | jinja2
3 | markupsafe
4 | libvirt-python
5 | pymongo
6 | bottle
7 | #pefile
8 | django>=1.7
9 | chardet
10 | pygal
11 | clamd
12 | pycrypto
13 | jsbeautifier
14 | dpkt
15 | nose
16 | dnspython
17 | pytz
18 | requests[socks]
19 | python-magic
20 | geoip
21 | pillow
22 | elasticsearch
23 | java-random
24 | python-whois
25 | bs4
26 | pefile2==1.2.11
27 | git+https://github.com/crackinglandia/pype32.git
28 | django-ratelimit==2.0.0
29 | git+https://github.com/kbandla/pydeep.git
30 | pyvmomi>=6.0
31 | imagehash
32 | pyinstaller
33 | sqlalchemy
34 | # upx
35 | maec
36 | oletools==0.53.1
37 | networkx>=2.1
38 | regex
39 | graphviz>=0.8.4
40 | pydot>=1.2.4
41 | olefile==0.45.1
42 | mixbox
43 | matplotlib==2.2.2
44 | numpy==1.15.0
45 | six==1.11.0
46 | statistics==1.0.3.5
47 | xmltodict
48 | pyyaml
49 | pyelftools
50 | gunicorn
51 | suricata-update
52 | git+https://github.com/doomedraven/sflock.git
53 | socks5man
54 | git+https://github.com/swimlane/pyattck.git
55 | pymisp==2.4.111.2
56 |
--------------------------------------------------------------------------------
/systemd/cuckoo-processor.service:
--------------------------------------------------------------------------------
1 | [Unit]
2 | Description=Cuckoo report processor
3 | Documentation=https://github.com/ctxis/CAPE
4 | Wants=cuckoo-rooter.service
5 | After=cuckoo-rooter.service
6 |
7 | [Service]
8 | ExecStart=/opt/CAPE/venv/bin/python /opt/CAPE/utils/process.py -p7 auto
9 | User=cuckoo
10 | Group=cuckoo
11 | Restart=always
12 | RestartSec=5m
13 |
14 | [Install]
15 | WantedBy=multi-user.target
16 |
--------------------------------------------------------------------------------
/systemd/cuckoo-rooter.service:
--------------------------------------------------------------------------------
1 | [Unit]
2 | Description=Cuckoo rooter
3 | Documentation=https://github.com/ctxis/CAPE
4 | Wants=network-online.target
5 | After=syslog.target network.target
6 |
7 | [Service]
8 | ExecStart=/opt/CAPE/venv/bin/python /opt/CAPE/utils/rooter.py
9 | User=root
10 | Group=root
11 | Restart=always
12 | RestartSec=5m
13 |
14 | [Install]
15 | WantedBy=multi-user.target
16 |
--------------------------------------------------------------------------------
/systemd/cuckoo-wsgi.service:
--------------------------------------------------------------------------------
1 | [Unit]
2 | Description=Cuckoo WSGI app
3 | Documentation=https://github.com/ctxis/CAPE
4 | Wants=cuckoo.service
5 | After=cuckoo.service
6 |
7 | [Service]
8 | WorkingDirectory=/opt/CAPE/web
9 | ExecStart=/opt/CAPE/venv/bin/gunicorn -b 127.0.0.1:8000 web.wsgi
10 | User=cuckoo
11 | Group=cuckoo
12 | Restart=always
13 | RestartSec=5m
14 |
15 | [Install]
16 | WantedBy=multi-user.target
17 |
--------------------------------------------------------------------------------
/systemd/cuckoo.service:
--------------------------------------------------------------------------------
1 | [Unit]
2 | Description=Cuckoo
3 | Documentation=https://github.com/ctxis/CAPE
4 | Wants=cuckoo-cuckoo-processor.service
5 | After=cuckoo-cuckoo-processor.service
6 |
7 | [Service]
8 | ExecStart=/opt/CAPE/venv/bin/python /opt/CAPE/cuckoo.py
9 | User=cuckoo
10 | Group=cuckoo
11 | Restart=always
12 | RestartSec=5m
13 |
14 | [Install]
15 | WantedBy=multi-user.target
16 |
--------------------------------------------------------------------------------
/systemd/suricata-update.service:
--------------------------------------------------------------------------------
1 | [Unit]
2 | Description=suricata-update
3 |
4 | [Service]
5 | User=root
6 | Group=root
7 | Type=oneshot
8 | ExecStart=/opt/CAPE/venv/bin/suricata-update
9 |
10 | [Install]
11 | WantedBy=multi-user.target
12 |
--------------------------------------------------------------------------------
/systemd/suricata-update.timer:
--------------------------------------------------------------------------------
1 | [Unit]
2 | Description=Run suricata-update hourly and at boot
3 |
4 | [Timer]
5 | OnBootSec=15min
6 | OnUnitActiveSec=1h
7 | unit=suricata-update.service
8 |
9 | [Install]
10 | WantedBy=timers.target
11 |
--------------------------------------------------------------------------------
/tests/colors_tests.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from nose.tools import assert_equals
6 |
7 | from lib.cuckoo.common.colors import color
8 |
9 |
10 | def test_return_text():
11 | """Test colorized text contains the input string."""
12 | assert "foo" in color("foo", 11)
--------------------------------------------------------------------------------
/tests/reporter_tests.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | import os
6 | import tempfile
7 | from nose.tools import assert_equals
8 |
9 | from lib.cuckoo.common.abstracts import Report
10 | from lib.cuckoo.common.config import Config
11 |
12 |
13 | class ReportMock(Report):
14 | def run(self, data):
15 | return
16 |
17 | class ReportAlterMock(Report):
18 | """Corrupts results dict."""
19 | def run(self, data):
20 | data['foo'] = 'notbar'
21 | return
22 |
--------------------------------------------------------------------------------
/tests/sniffer_tests.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from nose.tools import assert_equals
6 |
--------------------------------------------------------------------------------
/utils/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/utils/__init__.py
--------------------------------------------------------------------------------
/utils/db_migration/script.py.mako:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | """${message}
6 |
7 | Revision ID: ${up_revision}
8 | Revises: ${down_revision}
9 | Create Date: ${create_date}
10 |
11 | """
12 |
13 | # revision identifiers, used by Alembic.
14 | revision = ${repr(up_revision)}
15 | down_revision = ${repr(down_revision)}
16 |
17 | from alembic import op
18 | import sqlalchemy as sa
19 | ${imports if imports else ""}
20 |
21 | def upgrade():
22 | ${upgrades if upgrades else "pass"}
23 |
24 |
25 | def downgrade():
26 | ${downgrades if downgrades else "pass"}
27 |
--------------------------------------------------------------------------------
/utils/db_migration/versions/options_255_to_1024.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | """options_255_to_1014
6 |
7 | Revision ID: 30d0230de7cd
8 | Revises: 36926b59dfbb
9 | Create Date: 2019-10-11 11:00:31.364356
10 |
11 | """
12 |
13 | # revision identifiers, used by Alembic.
14 | revision = '30d0230de7cd'
15 | down_revision = '36926b59dfbb'
16 |
17 | from alembic import op
18 | import sqlalchemy as sa
19 |
20 | def upgrade():
21 | op.alter_column('tasks', 'options',
22 | existing_type=sa.String(length=255),
23 | type_=sa.String(length=1024),
24 | existing_nullable=True)
25 |
26 |
27 | def downgrade():
28 | op.alter_column('tasks', 'options',
29 | existing_type=sa.String(length=1024),
30 | type_=sa.String(length=255),
31 | existing_nullable=True)
32 |
--------------------------------------------------------------------------------
/utils/smtp_sinkhole.sh:
--------------------------------------------------------------------------------
1 | #!/bin/sh
2 | # Add "@reboot /opt/cuckoo-modified/utils/smtp_sinkhole.sh" to the root crontab.
3 | # smtp
4 | sudo iptables -t nat -A PREROUTING -i virbr0 -p tcp -m tcp --dport 25 -j REDIRECT --to-ports 1025
5 | sudo iptables -t nat -A PREROUTING -i virbr0 -p tcp -m tcp --sport 25 -j REDIRECT --to-ports 1025
6 | # tls + ssl
7 | sudo iptables -t nat -A PREROUTING -i virbr0 -p tcp -m tcp --dport 465 -j REDIRECT --to-ports 1025
8 | sudo iptables -t nat -A PREROUTING -i virbr0 -p tcp -m tcp --dport 587 -j REDIRECT --to-ports 1025
9 |
10 | cd /opt/CAPE/utils
11 | if [ ! -f "/opt/CAPE/utils/smtp_sinkhole.py" ]; then
12 | exit 1
13 | fi
14 |
15 | if [ ! -d dumps ]; then
16 | mkdir -p /opt/CAPE/utils/dumps
17 | fi
18 | python smtp_sinkhole.py 0.0.0.0 1025 --dir /opt/CAPE/utils/dumps
19 |
--------------------------------------------------------------------------------
/utils/tcpdumpwrapper.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/python
2 |
3 | # Copyright 2015 Optiv, Inc. (brad.spengler@optiv.com)
4 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
5 | # See the file 'docs/LICENSE' for copying permission.
6 |
7 | import sys
8 | import os
9 | import time
10 |
11 | iface = ""
12 | for idx, arg in enumerate(sys.argv):
13 | if arg == "-i" and idx < len(sys.argv) - 1:
14 | iface = sys.argv[idx+1]
15 |
16 | for i in range(30):
17 | f = open("/proc/net/dev", "rb")
18 | for line in f:
19 | dev = line.split(":")[0]
20 | if dev == iface:
21 | break
22 | f.close()
23 | time.sleep(0.5)
24 |
25 | os.execve("/usr/sbin/tcpdump", sys.argv, os.environ)
26 |
--------------------------------------------------------------------------------
/web/analysis/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
--------------------------------------------------------------------------------
/web/analysis/forms.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from django import forms
6 |
7 | from submission.models import Comment, Tag
8 |
9 | class CommentForm(forms.ModelForm):
10 | class Meta:
11 | model = Comment
12 | fields = ["message"]
13 |
14 | class TagForm(forms.ModelForm):
15 | class Meta:
16 | model = Tag
17 | fields = ["name"]
18 |
--------------------------------------------------------------------------------
/web/analysis/templatetags/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
--------------------------------------------------------------------------------
/web/analysis/templatetags/key_tags.py:
--------------------------------------------------------------------------------
1 | from django import template
2 | register = template.Library()
3 |
4 | @register.filter(name="getkey")
5 | def getkey(mapping, value):
6 | return mapping.get(value, '')
7 |
--------------------------------------------------------------------------------
/web/analysis/templatetags/pdf_tags.py:
--------------------------------------------------------------------------------
1 | from django import template
2 | register = template.Library()
3 |
4 | @register.filter(name="datefmt")
5 | def datefmt(value):
6 | formatted = value[2:6] + "/" + value[6:8] + "/" + value[8:10] + " " + \
7 | value[10:12] + ":" + value[12:14] + ":" + value[14:16] + \
8 | " GMT" + value[16:19]
9 | return formatted
10 |
--------------------------------------------------------------------------------
/web/api/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/api/__init__.py
--------------------------------------------------------------------------------
/web/compare/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file "docs/LICENSE" for copying permission.
--------------------------------------------------------------------------------
/web/compare/urls.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file "docs/LICENSE" for copying permission.
4 |
5 | from django.conf.urls import url
6 | from compare import views
7 |
8 | urlpatterns = [
9 | url(r"^(?P\d+)/$", views.left, name='compare_left'),
10 | url(r"^(?P\d+)/(?P\d+)/$", views.both, name='compare_both'),
11 | url(r"^(?P\d+)/(?P\w+)/$", views.hash, name='compare_hash'),
12 | ]
13 |
--------------------------------------------------------------------------------
/web/dashboard/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/dashboard/__init__.py
--------------------------------------------------------------------------------
/web/dashboard/urls.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file "docs/LICENSE" for copying permission.
4 |
5 | from django.conf.urls import url
6 | from dashboard import views
7 |
8 | urlpatterns = [
9 | url(r"^$", views.index),
10 | ]
11 |
--------------------------------------------------------------------------------
/web/manage.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 | # Copyright (C) 2010-2015 Cuckoo Foundation.
3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
4 | # See the file 'docs/LICENSE' for copying permission.
5 |
6 | import os
7 | import sys
8 |
9 | if __name__ == "__main__":
10 | os.environ.setdefault("DJANGO_SETTINGS_MODULE", "web.settings")
11 |
12 | from django.core.management import execute_from_command_line
13 |
14 | execute_from_command_line(sys.argv)
15 |
--------------------------------------------------------------------------------
/web/static/fonts/glyphicons-halflings-regular.eot:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/fonts/glyphicons-halflings-regular.eot
--------------------------------------------------------------------------------
/web/static/fonts/glyphicons-halflings-regular.ttf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/fonts/glyphicons-halflings-regular.ttf
--------------------------------------------------------------------------------
/web/static/fonts/glyphicons-halflings-regular.woff:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/fonts/glyphicons-halflings-regular.woff
--------------------------------------------------------------------------------
/web/static/fonts/glyphicons-halflings-regular.woff2:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/fonts/glyphicons-halflings-regular.woff2
--------------------------------------------------------------------------------
/web/static/generated/README:
--------------------------------------------------------------------------------
1 | Statistics images generated by server are stored here
--------------------------------------------------------------------------------
/web/static/graphic/background.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/graphic/background.png
--------------------------------------------------------------------------------
/web/static/graphic/cape.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/graphic/cape.png
--------------------------------------------------------------------------------
/web/static/graphic/cuckoo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/graphic/cuckoo.png
--------------------------------------------------------------------------------
/web/static/img/cape.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/img/cape.png
--------------------------------------------------------------------------------
/web/static/img/close.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/img/close.png
--------------------------------------------------------------------------------
/web/static/img/loading.gif:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/img/loading.gif
--------------------------------------------------------------------------------
/web/static/img/next.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/img/next.png
--------------------------------------------------------------------------------
/web/static/img/prev.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ctxis/CAPE/dae9fa6a254ecdbabeb7eb0d2389fa63722c1e82/web/static/img/prev.png
--------------------------------------------------------------------------------
/web/submission/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
--------------------------------------------------------------------------------
/web/submission/urls.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from django.conf.urls import url
6 | from submission import views
7 |
8 | urlpatterns = [
9 | url(r"^$", views.index, name='submission'),
10 | url(r"^resubmit/(?P[\w\d]{64})/$", views.index, name='submission'),
11 | url(r"status/(?P\d+)/$", views.status, name='submission_status'),
12 | ]
13 |
--------------------------------------------------------------------------------
/web/templates/analysis/antivirus.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 | {% block content %}
3 | 
4 | {% include "analysis/static/_antivirus.html" %}
5 | {% endblock %}
6 |
7 |
--------------------------------------------------------------------------------
/web/templates/analysis/behavior/_chunk.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | Time |
5 | TID |
6 | Caller |
7 | API |
8 | Arguments |
9 | Status |
10 | Return |
11 | Repeated |
12 |
13 |
14 |
15 | {% for call in chunk.calls %}
16 |
17 | {% include "analysis/behavior/_api_call.html" %}
18 |
19 | {% endfor %}
20 |
21 |
22 |
--------------------------------------------------------------------------------
/web/templates/analysis/behavior/_search.html:
--------------------------------------------------------------------------------
1 |
15 |
16 |
29 |
--------------------------------------------------------------------------------
/web/templates/analysis/behavior/_tree.html:
--------------------------------------------------------------------------------
1 | {% load generic_tags %}
2 | {% load analysis_tags %}
3 |
4 | Process Tree
5 |
6 | {% for process in analysis.behavior.processtree|proctreetolist %}
7 | {% if process.startchildren %}
8 |
9 | {% elif process.endchildren %}
10 |
11 | {% else %}
12 | -
13 | {{process.name}} {{process.pid}}
14 | {% if process.commandline %}
15 | {{ process.commandline }}
16 | {% endif %}
17 |
18 | {% endif %}
19 | {% endfor %}
20 |
21 |
--------------------------------------------------------------------------------
/web/templates/analysis/behavior/index.html:
--------------------------------------------------------------------------------
1 | {% include "analysis/behavior/_tree.html" %}
2 |
3 | {% include "analysis/behavior/_processes.html" %}
--------------------------------------------------------------------------------
/web/templates/analysis/comments/index.html:
--------------------------------------------------------------------------------
1 | Comments
2 |
12 |
13 | {% if analysis.info.comments %}
14 | {% for comment in analysis.info.comments %}
15 | [{{comment.Timestamp}}]
{{comment.Data|safe}}
16 | {% endfor %}
17 | {% else %}
18 | No comments posted
19 | {% endif %}
20 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_apihooks.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | PID |
5 | Process Name |
6 | Victim Function |
7 | Hook Type |
8 | Hooking Module |
9 |
10 |
11 |
12 | {% for hook in analysis.memory.apihooks.data %}
13 |
14 | {{hook.process_id}} |
15 | {{hook.process_name}} |
16 | {{hook.victim_function}} |
17 | {{hook.hook_type}} |
18 | {{hook.hooking_module}} |
19 |
20 | {% endfor %}
21 |
22 |
23 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_callbacks.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | Type |
5 | Callback |
6 | Module |
7 | Details |
8 |
9 |
10 |
11 | {% for x in analysis.memory.callbacks.data %}
12 |
13 | {{x.type}} |
14 | {{x.callback}} |
15 | {{x.module}} |
16 | {{x.details}} |
17 |
18 | {% endfor %}
19 |
20 |
21 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_devicetree.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | Driver Name |
5 | Driver Offset |
6 | Devices |
7 |
8 |
9 |
10 | {% for service in analysis.memory.devicetree.data %}
11 |
12 | {{service.driver_name}} |
13 | {{service.driver_offset}} |
14 |
15 | {% for device in service.devices %}
16 | {% if device.device_name %}
17 | {{device.device_name}},
18 | {% endif %}
19 | {% endfor %}
20 | |
21 |
22 | {% endfor %}
23 |
24 |
25 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_gdt.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | CPU |
5 | Selector |
6 | Base |
7 | Limit |
8 | Type |
9 | Dpl |
10 | Granularity |
11 | Present |
12 |
13 |
14 |
15 | {% for x in analysis.memory.gdt.data %}
16 |
17 | {{x.cpu_number}} |
18 | {{x.selector}} |
19 | {{x.base}} |
20 | {{x.limit}} |
21 | {{x.type}} |
22 | {{x.dpl}} |
23 | {{x.granularity}} |
24 | {{x.present}} |
25 |
26 | {% endfor %}
27 |
28 |
29 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_idt.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | CPU |
5 | Index |
6 | Selector |
7 | Address |
8 | Module |
9 | Section |
10 |
11 |
12 |
13 | {% for x in analysis.memory.idt.data %}
14 |
15 | {{x.cpu_number}} |
16 | {{x.index}} |
17 | {{x.selector}} |
18 | {{x.address}} |
19 | {{x.module}} |
20 | {{x.section}} |
21 |
22 | {% endfor %}
23 |
24 |
25 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_malfind.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | PID |
5 | Process Name |
6 | Start |
7 | Tag |
8 |
9 |
10 |
11 | {% for mal in analysis.memory.malfind.data %}
12 |
13 | {{mal.process_id}} |
14 | {{mal.process_name}} |
15 | {{mal.vad_start}} |
16 | {{mal.vad_tag}} |
17 |
18 | {% endfor %}
19 |
20 |
21 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_messagehooks.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | Offset |
5 | Session |
6 | Desktop |
7 | Thread |
8 | Filter |
9 | Flags |
10 | Function |
11 | Module |
12 |
13 |
14 |
15 | {% for x in analysis.memory.messagehooks.data %}
16 |
17 | {{x.offset}} |
18 | {{x.session}} |
19 | {{x.desktop}} |
20 | {{x.thread}} |
21 | {{x.filter}} |
22 | {{x.flags}} |
23 | {{x.function}} |
24 | {{x.module}} |
25 |
26 | {% endfor %}
27 |
28 |
29 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_modscan.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | Base Address |
5 | Offset |
6 | Name |
7 | File |
8 | Size |
9 |
10 |
11 |
12 | {% for mod in analysis.memory.modscan.data %}
13 |
14 | {{mod.kernel_module_base}} |
15 | {{mod.kernel_module_offset}} |
16 | {{mod.kernel_module_name}} |
17 | {{mod.kernel_module_file}} |
18 | {{mod.kernel_module_size}} |
19 |
20 | {% endfor %}
21 |
22 |
23 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_netscan.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | Offset |
5 | PID |
6 | Local Address |
7 | Local Port |
8 | Remote Address |
9 | Remote Port |
10 | Protocol |
11 |
12 |
13 |
14 | {% for sock in analysis.memory.netscan.data %}
15 |
16 | {{sock.offset}} |
17 | {{sock.process_id}} |
18 | {{sock.local_address}} |
19 | {{sock.local_port}} |
20 | {{sock.remote_address}} |
21 | {{sock.remote_port}} |
22 | {{sock.protocol}} |
23 |
24 | {% endfor %}
25 |
26 |
27 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_pslist.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | Parent PID |
5 | PID |
6 | Name |
7 | Create Time |
8 | Exit Time |
9 | # Threads |
10 | # Handles |
11 | Session ID |
12 |
13 |
14 |
15 | {% for process in analysis.memory.pslist.data %}
16 |
17 | {{process.parent_id}} |
18 | {{process.process_id}} |
19 | {{process.process_name}} |
20 | {{process.create_time}} |
21 | {{process.exit_time}} |
22 | {{process.num_threads}} |
23 | {{process.num_handles}} |
24 | {{process.session_id}} |
25 |
26 | {% endfor %}
27 |
28 |
29 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_sockscan.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | Offset |
5 | PID |
6 | Local Address |
7 | Local Port |
8 | Protocol |
9 | Creation Time |
10 |
11 |
12 |
13 | {% for sock in analysis.memory.sockscan.data %}
14 |
15 | {{sock.offset}} |
16 | {{sock.process_id}} |
17 | {{sock.address}} |
18 | {{sock.port}} |
19 | {{sock.protocol}} |
20 | {{sock.create_time}} |
21 |
22 | {% endfor %}
23 |
24 |
25 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_ssdt.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | Index |
5 | Table |
6 | Entry |
7 | Syscall Name |
8 | Syscall Addr |
9 | Syscall Modname |
10 | Hook? |
11 |
12 |
13 |
14 | {% for x in analysis.memory.ssdt.data %}
15 |
16 | {{x.index}} |
17 | {{x.table}} |
18 | {{x.entry}} |
19 | {{x.syscall_name}} |
20 | {{x.syscall_addr}} |
21 | {{x.syscall_modname}} |
22 | {{x.hook_dest_addr}}: {{x.hook_name}} |
23 |
24 | {% endfor %}
25 |
26 |
27 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_timers.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | Offset |
5 | Due Time |
6 | Period |
7 | Signaled |
8 | Routine |
9 | Module |
10 |
11 |
12 |
13 | {% for x in analysis.memory.timers.data %}
14 |
15 | {{x.offset}} |
16 | {{x.due_time}} |
17 | {{x.period}} |
18 | {{x.signaled}} |
19 | {{x.routine}} |
20 | {{x.module}} |
21 |
22 | {% endfor %}
23 |
24 |
25 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_yarascan.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | Owner |
5 | Rule |
6 | Hexdump |
7 |
8 |
9 |
10 | {% for x in analysis.memory.yarascan.data %}
11 |
12 | {{x.owner}} |
13 | {{x.rule}} |
14 | {{x.hexdump}} |
15 |
16 | {% endfor %}
17 |
18 |
19 |
--------------------------------------------------------------------------------
/web/templates/analysis/mitre.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | {% for category in analysis.mitre_attck %}
5 | {{ category }} |
6 | {% endfor %}
7 |
8 | {% for category, ttps in analysis.mitre_attck.items %}
9 |
10 | {% for ttp in ttps %}
11 | {{ttp.t_id}} - {{ ttp.ttp_name }}
12 | - Signature - {{ttp.signature}}
13 | {% endfor %}
14 | |
15 | {% endfor %}
16 |
17 |
18 |
--------------------------------------------------------------------------------
/web/templates/analysis/network/_http.html:
--------------------------------------------------------------------------------
1 | HTTP Requests
2 | {% if analysis.network.http %}
3 |
4 |
5 | URI |
6 | Data |
7 |
8 | {% for request in analysis.network.http %}
9 |
10 | {{request.uri}} |
11 | {{request.data}} |
12 |
13 | {% endfor %}
14 |
15 | {% else %}
16 | No HTTP requests performed.
17 | {% endif %}
--------------------------------------------------------------------------------
/web/templates/analysis/network/_icmp.html:
--------------------------------------------------------------------------------
1 | ICMP traffic
2 | {% if analysis.network.icmp %}
3 |
4 |
5 | Source |
6 | Destination |
7 | ICMP Type |
8 | Data |
9 |
10 | {% for packet in analysis.network.icmp %}
11 |
12 | {{packet.src}} |
13 | {{packet.dst}} |
14 | {{packet.type}} |
15 | {{packet.data}} |
16 |
17 | {% endfor %}
18 |
19 | {% else %}
20 | No ICMP traffic performed.
21 | {% endif %}
--------------------------------------------------------------------------------
/web/templates/analysis/network/_irc.html:
--------------------------------------------------------------------------------
1 | IRC traffic
2 | {% if analysis.network.irc %}
3 |
4 |
5 | Command |
6 | Params |
7 | Type |
8 |
9 | {% for irc in analysis.network.irc %}
10 |
11 | {{irc.command}} |
12 | {{irc.params}} |
13 | {{irc.type}} |
14 |
15 | {% endfor %}
16 |
17 | {% else %}
18 | No IRC requests performed.
19 | {% endif %}
--------------------------------------------------------------------------------
/web/templates/analysis/network/_smtp.html:
--------------------------------------------------------------------------------
1 | SMTP traffic
2 | {% if analysis.network.smtp %}
3 |
4 |
5 | Destination |
6 | Data |
7 |
8 | {% for req in analysis.network.smtp %}
9 |
10 | {{req.dst}} |
11 | {{req.raw}} |
12 |
13 | {% endfor %}
14 |
15 | {% else %}
16 | No SMTP traffic performed.
17 | {% endif %}
18 |
--------------------------------------------------------------------------------
/web/templates/analysis/overview/_screenshots.html:
--------------------------------------------------------------------------------
1 |
2 | Screenshots
3 | {% if analysis.deduplicated_shots %}
4 |
5 | {% for shot in analysis.deduplicated_shots %}
6 |
7 |
8 |
9 | {% endfor %}
10 |
11 | {% elif analysis.shots %}
12 |
13 | {% for shot in analysis.shots %}
14 |
15 |
16 |
17 | {% endfor %}
18 |
19 | {% else %}
20 | No screenshots available.
21 | {% endif %}
22 |
23 |
--------------------------------------------------------------------------------
/web/templates/analysis/overview/_url.html:
--------------------------------------------------------------------------------
1 |
2 | URL Details
3 |
4 |
5 |
6 |
7 | URL |
8 |
9 |
10 |
11 |
12 | {{analysis.target.url}} |
13 |
14 |
15 |
16 |
17 |
--------------------------------------------------------------------------------
/web/templates/analysis/overview/_usage.html:
--------------------------------------------------------------------------------
1 |
2 | Usage
3 |
4 |

5 |
6 |
7 |
--------------------------------------------------------------------------------
/web/templates/analysis/static/_java.html:
--------------------------------------------------------------------------------
1 |
2 |
3 | {% if analysis.static and analysis.static.java and analysis.static.java.decompiled %}
4 |
{{analysis.static.java.decompiled}}
5 | {% endif %}
6 |
7 |
--------------------------------------------------------------------------------
/web/templates/analysis/static/_script.html:
--------------------------------------------------------------------------------
1 |
2 | {% if analysis.static and analysis.static.wsf %}
3 | {% for script in analysis.static.wsf %}
4 |
7 | {% endfor %}
8 | {% else %}
9 | {% if analysis.static and analysis.static.encscript %}
10 |
11 |
{{analysis.static.encscript}}
12 |
13 | {% endif %}
14 | {% endif %}
15 |
--------------------------------------------------------------------------------
/web/templates/analysis/static/_strings.html:
--------------------------------------------------------------------------------
1 |
2 |
3 | {% for string in analysis.strings %}
4 |
{{string}}
5 | {% endfor %}
6 |
7 |
--------------------------------------------------------------------------------
/web/templates/analysis/static/_url.html:
--------------------------------------------------------------------------------
1 |
9 |
--------------------------------------------------------------------------------
/web/templates/analysis/surialert.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 | {% block content %}
3 | 
4 | {% include "analysis/network/_suricata_alerts.html" %}
5 | {% endblock %}
6 |
--------------------------------------------------------------------------------
/web/templates/analysis/surifiles.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 | {% block content %}
3 | 
4 | {% include "analysis/network/_suricata_files.html" %}
5 | {% endblock %}
6 |
7 |
--------------------------------------------------------------------------------
/web/templates/analysis/surihttp.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 | {% block content %}
3 | 
4 | {% include "analysis/network/_suricata_http.html" %}
5 | {% endblock %}
6 |
--------------------------------------------------------------------------------
/web/templates/analysis/suritls.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 | {% block content %}
3 | 
4 | {% include "analysis/network/_suricata_tls.html" %}
5 | {% endblock %}
6 |
--------------------------------------------------------------------------------
/web/templates/auth/base_site.html:
--------------------------------------------------------------------------------
1 | {% extends "auth/base.html" %}
2 |
3 | {% block title %}{{ title }} | {{ site_title|default:_('CAPE Sandbox') }}{% endblock %}
4 |
5 | {% block branding %}
6 |
7 | {% endblock %}
8 |
9 | {% block nav-global %}{% endblock %}
10 |
--------------------------------------------------------------------------------
/web/templates/auth/logout.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 | {% load i18n %}
3 |
4 | {% block content %}
5 | {% trans "Logged out" %}
6 | {% endblock %}
7 |
--------------------------------------------------------------------------------
/web/templates/base.html:
--------------------------------------------------------------------------------
1 | {%include "header.html" %}
2 |
3 | {% autoescape on %}
4 | {% block content %}{% endblock %}
5 | {% endautoescape %}
6 |
7 | {%include "footer.html" %}
8 |
--------------------------------------------------------------------------------
/web/templates/compare/_info.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | ID |
5 | Name |
6 | MD5 |
7 | Machine |
8 | Completed On |
9 | Duration |
10 |
11 |
12 |
13 |
14 | {{record.info.id}} |
15 | {{record.target.file.name}} |
16 | {{record.target.file.md5}} |
17 | {{record.info.machine.name}} |
18 | {{record.info.ended}} |
19 | {{record.info.duration}} seconds |
20 |
21 |
22 |
23 |
--------------------------------------------------------------------------------
/web/templates/compare/_summary_table.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | ID |
5 | Name |
6 | Machine |
7 | Completed On |
8 | Duration |
9 | Select |
10 |
11 |
12 |
13 | {% for record in records %}
14 |
15 | {{record.info.id}} |
16 | {{record.target.file.name}} |
17 | {{record.info.machine.name}} |
18 | {{record.info.ended}} |
19 | {{record.info.duration}} seconds |
20 | Select |
21 |
22 | {% endfor %}
23 |
24 |
25 |
--------------------------------------------------------------------------------
/web/templates/compare/hash.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 | {% block content %}
3 | 
4 |
5 |
6 |
7 |
Analysis 1
8 |
9 | {% include "compare/_info.html" with record=left %}
10 |
11 |
12 |
Analysis 2
13 |
14 |
You need to select the second analysis.
15 | {% if records.count > 0 %}
16 |
Following are all the analyses of the file with provided MD5 {{hash}}:
17 | {% include "compare/_summary_table.html" %}
18 | {% else %}
19 |
There is no analysis for the specified file or you selected the same selected analysis.
20 | {% endif %}
21 |
22 |
23 | {% endblock %}
24 |
--------------------------------------------------------------------------------
/web/templates/error.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 | {% block content %}
3 | 
4 | ERROR :-(
{{error}}
5 | {% endblock %}
--------------------------------------------------------------------------------
/web/templates/footer.html:
--------------------------------------------------------------------------------
1 |
3 |
8 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |