Repository navigation
fix(parsers): harden BumbleBee, DarkGate, MonsterV2, Remcos, and SparkRAT - #86
Merged
Merged
Conversation
Guard RC4 key length (1..256 bytes) before calling ARC4.new(), isolate multi-match key extraction from single-key RC4 ciphertext decryption, guard missing config_match in extract_config_data(), and pass errors="replace" when decoding extracted strings.
Use `from Cryptodome.Cipher import ChaCha20_Poly1305` instead of `from Crypto.Cipher import ChaCha20_Poly1305` to match the repository's `pycryptodomex` dependency.
Import `extract_config` from `cape_parsers.CAPE.core.HijackLoader` instead of `cape_parsers.CAPE.community.HijackLoader`.
- Update `tests_parsers/test_adaptixbeacon.py` to match commit 7318d9c (`cryptokey`, `cryptokey_type`, and `user_agent` popped from `raw` to top-level output). - Add `@pytest.mark.skipif(not os.path.exists(...), reason="Missed file")` to `tests_parsers/test_axolotlloader.py` and `tests_parsers/test_docconnect.py` when test samples are absent from `CAPE-TestFiles`.
…dlib tests/ `Main CI Pipeline` executes `uvx pytest`, which runs in an isolated ephemeral `pytest`-only environment without `pycryptodomex`/`pefile`/`yara`. Move the `BumbleBee` and `MonsterV2` unit tests from `tests/` into `tests_parsers/test_bumblebee.py` and `tests_parsers/test_monsterv2.py` where the `Python package` workflow runs `poetry run python -m pytest tests_parsers`.
- Restore `tests/test_bumblebee_unit.py` and `tests/test_monsterv2_unit.py` in `tests/` and revert `tests_parsers/test_bumblebee.py` and `tests_parsers/test_monsterv2.py` to their sample-based tests. - In `.github/workflows/reusable-setup.yml`, add `$HOME/.local/bin` to `$GITHUB_PATH`, install the dev test dependencies (`pytest`, `pytest-asyncio`, `pytest-mock`, etc.) into `.venv`, and bump the cache key (`uv-v2`) to invalidate the cached `.venv` that lacked `pytest`. - In `.github/workflows/python-package-uv.yml`, replace `uvx pytest` (which executes in an isolated ephemeral tool environment without `.venv` packages) with `uv run --no-project pytest`.
…cos, and downgrade SparkRAT miss log
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
extract_key_dataagainst invalid/empty keys before callingARC4.new(key), scope single-key RC4 config decryption toelif len(key_match) == 1:, guard missingconfig_matchinextract_config_data, and passerrors="replace"when decoding extracted strings.config.get("raw", {})when mapping fields to top-level keys soextract_configdoes not raiseKeyError: 'raw'when aCODEsection contains no1=Yes/1=Noconfig entries.v.decoed()typo (v.decode()) and logpefile.PEFormatErroratdebuglevel instead oferroron non-PE buffers.debuglevel instead oferror.ChaCha20_Poly1305fromCryptodome.Cipher, fixHijackLoaderimport path intests_parsers/test_hijackloader.py, and add unit tests intests/.