Skip to content

Commit 95877b8

Browse files
jeFF0FalltradesjeFF0Falltrades
authored
Merge pull request jeFF0Falltrades#41 from jeFF0Falltrades/revert-39-revert-38-17-add-a-testing-pipeline-for-contributors
Revert "Revert "Adds a CI job for testing code changes against known samples on the m…""
2 parents 9fc4430 + f16b6c1 commit 95877b8

20 files changed

Lines changed: 578 additions & 10 deletions

‎.github/workflows/ci.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: CI
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- master
7+
push:
8+
branches:
9+
- master
10+
11+
jobs:
12+
malware-sample-tests:
13+
name: Run malware sample tests
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout code
17+
uses: actions/checkout@v4
18+
19+
- name: Setup Python
20+
uses: actions/setup-python@v5
21+
with:
22+
python-version: "3.13"
23+
24+
- name: Install dependencies
25+
run: |
26+
sudo apt-get update
27+
sudo apt-get install -y p7zip-full
28+
pip install ".[dev]"
29+
30+
- name: Decrypt malware samples
31+
run: |
32+
7z x tests/samples.enc.zip -p'${{ secrets.SAMPLES_ZIP_PASSWORD }}' -otests/samples/
33+
ls -la tests/samples/
34+
35+
- name: Run malware pytest suite
36+
run: pytest tests/ --maxfail=1 --disable-warnings -q
37+
38+
- name: Clean up samples
39+
run: rm -rf tests/samples
40+
41+
# Run the workflow on approved pull request merges from forked repositories
42+
# and any pull requests from the main repository
43+
if: github.event_name == 'pull_request' && (github.event.pull_request.merged == true || github.repository == github.event.pull_request.head.repo.full_name)

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,5 @@
33
__pycache__/
44
build/
55
*.egg-info/
6+
bin/
7+
tests/samples/

‎pyproject.toml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[build-system]
22
build-backend = "setuptools.build_meta"
3-
requires = [ "setuptools" ]
3+
requires = ["setuptools"]
44

55
[project]
66
name = "rat-king-parser"
@@ -34,10 +34,10 @@ classifiers = [
3434
"Programming Language :: Python :: 3.12",
3535
"Programming Language :: Python :: 3.13",
3636
]
37-
dynamic = [ "version" ]
38-
dependencies = [ "dnfile", "pycryptodomex", "yara-python" ]
39-
optional-dependencies.dev = [ "pre-commit" ]
40-
optional-dependencies.maco = [ "maco", "validators" ]
37+
dynamic = ["version"]
38+
dependencies = ["dnfile", "pycryptodomex", "yara-python"]
39+
optional-dependencies.dev = ["pre-commit", "pytest"]
40+
optional-dependencies.maco = ["maco", "validators"]
4141
urls."Bug Reports" = "https://github.com/jeFF0Falltrades/rat_king_parser/issues"
4242
urls."Homepage" = "https://github.com/jeFF0Falltrades/rat_king_parser"
4343
urls."Say Thanks!" = "https://www.buymeacoffee.com/jeff0falltrades"
@@ -47,15 +47,15 @@ scripts.rat-king-parser = "rat_king_parser:main"
4747
version = { attr = "rat_king_parser._version.__version__" }
4848

4949
[tool.setuptools.packages.find]
50-
where = [ "src" ]
51-
include = [ "rat_king_parser*" ]
50+
where = ["src"]
51+
include = ["rat_king_parser*"]
5252
namespaces = false
5353

5454
[tool.setuptools.package-data]
55-
"rat_king_parser.yara_utils" = [ "*.yar", "*.yarc" ]
55+
"rat_king_parser.yara_utils" = ["*.yar", "*.yarc"]
5656

5757
[tool.ruff]
58-
lint.extend-select = [ "I" ]
58+
lint.extend-select = ["I"]
5959

6060
[tool.pre-commit]
6161
hook-config = "file:.pre-commit-config.yaml"

‎src/rat_king_parser/_version.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@
2323
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
2424
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
2525
# SOFTWARE.
26-
__version__ = "4.2.1"
26+
__version__ = "4.2.2"

‎tests/expected/034941c1ea1b1ae32a653aab6371f760dfc4fc43db7c7bf07ac10fc9e98c849e.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"config": {
3+
"An_ti": "false",
4+
"Anti_Process": "false",
5+
"BS_OD": "false",
6+
"Certifi_cate": "MIICMDCCAZmgAwIBAgIVANpXtGwt9qBbU/pdFz8d/Pt6kzb7MA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMDIxNzA5MjAzM1oXDTMxMTEyNzA5MjAzM1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKt8nE3x/0XYeyDBrDPxdpVH1EMWSVyndAkdVChKaWQFOAAs4r/UeTmw8POG3jUz/XczWBWJt9Vu4Vl0HJN3ZmRIMr75FDGyieel0Vb8sn0hZcABsNr8dbbzfi+eoocVAyZKd79S0mOUinl4PBhldyUJCvanCnguHux8c2F5vnQlAgMBAAGjMjAwMB0GA1UdDgQWBBRjACzYO/EcXaKzlTz8Oq34J5Zq8DAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBACA8urqJU44+IpPcx9i0Q0Eu9+qWMPdZ09y+6YdumC6dun1OHn1I5F03YqYCfCdq0l3XpszJlYYzPnPB4ThOfiKUwJ1HJWS2lgWKfd+CdSWCch0c2dEE1Pao+xyNcNpuphBraHZYc4ojekgeQ8MSdHVo/YCYpmaJbxFWDhFgr3Lh",
7+
"De_lay": "1",
8+
"Group": "16JUNIO-PJOAO",
9+
"Hos_ts": "20.200.63.2",
10+
"Hw_id": "null",
11+
"In_stall": "false",
12+
"Install_File": "",
13+
"Install_Folder": "%AppData%",
14+
"Key": "dU81ekM1S2pQYmVOWWhQcjV4WlJwcWRkSnVYR2tTQ0w=",
15+
"MTX": "DcRatMutex_qwqdanchun",
16+
"Paste_bin": "null",
17+
"Por_ts": "2525",
18+
"Server_signa_ture": "c+KGE0Aw1XRgjGe2Kvay1H3VgUgqKRYGit46DnCR6eW/g+kO+H5oRsfBNkVizj0Q862zTXvLkWZ+ON84bmYhBy3o5YQOPaPyAIXha4ByY150rYRXKkzBR47RkTx616bLYUhqO+PqqNOii9THobbo3zAtwjxEoEWr8s0MLGm2AfE=",
19+
"Ver_sion": " 1.0.7"
20+
},
21+
"key": "3915b12d862a41cce3da2e11ca8cefc26116d0741c23c0748618add80ee31a5c",
22+
"salt": "4463526174427971777164616e6368756e",
23+
"sha256": "034941c1ea1b1ae32a653aab6371f760dfc4fc43db7c7bf07ac10fc9e98c849e",
24+
"yara_possible_family": "dcrat"
25+
}

‎tests/expected/0aa7bfb081e73a67c23715a55ff13a74ef6b1ce2b82a33b5537ee001592919a4.json‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{
2+
"config": {
3+
"Anti": "false",
4+
"BDOS": "false",
5+
"Certificate": "MIIE9jCCAt6gAwIBAgIQAKQXqY8ZdB/modqi69mWGTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFXb3JsZFdpbmQgU3RlYWxlcjAgFw0yMTA3MTMwNDUxMDZaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRV29ybGRXaW5kIFN0ZWFsZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCnRXYoxuLqqgXdcvIAYWb9DuVRl5ZpdpPfoIgmb7Y9A9AuiddKNm4is8EvIlEh98bQD4OBaK0EGWuj7WuAcQPCCGuzHpDqFZbXR7iRqVn6TiLRsO0LCMB4ta4XLQ4JdTFXvnQHcGiUxHddH70T/2P2bBVY0W+PVJDzG3XUWHpYb4PVv7qaQr/DalR3qyyd5otzE1kIjJLCOCyI/9ntIcD/PbMTKVnCP4fzbnkNB+xy0PmQmx3WRWEF5q72TdgaKrCbOpR2C/+rfGIoPC6Ze6dqWO3bQLGt6jpCO8A4CtAaAYmiw1vHUOfP54BgI9ls1TjYO3Rn4R1jmhWBGV2pT5chrglgSxMzPhrxFTQljG78RlPCJmyagJbtnPL3AlV34sQggcbf+80FVeyechm/xrMTSWXrJQ+xek1HRJBDFoCJyUR7SuIUelOW24TU+rwl/2dcALLZXpjYu3/zvJjH4iaJXRCt7oWhfzIFG1bHBFr78kV9VP0H+ZNVb129eUr14F/uubAoIPAz2EHG/CXBZv9GkFuzw0NgsI1eP7AznCLdT+z91M+yB7vWtvclwQ5k6MxWDPOraG5JMjUHvKI6zvyZ4IQ2a7bUENDghxLAqIxgo7zfZMdrjbRxBlqW14oki6Um7GpGKEZ0s2Ip6K2yJHBLpbVxOYjyzrxohMguh+qvgQIDAQABozIwMDAdBgNVHQ4EFgQUmTejTtK6on20N0YJez5sAZdMe/kwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAhauA0si7sHBd06DSGJgP5vJxL2daW30wR5XbAJd0HWj3QWfl7w27iyZ5AqBT4B0ojLNuMUG8mUOvpcoq0m80qUX7TIKUULKvb+i7uGGEDxk3W5F3es/CTUUWO0QlseWx9QEYziGlp6f3tkP4PTGSL0DywVRSa8l6f/B5kqwnW17CbQfJZ8vmy5snpDO/avgYssUnQtKQPhos7GbokNHps/bxEIRfLeprzQox20dw4RV59LcorjP5QV7Vc6FuYmhzC0nfRetTHckyxg66O3ekfTVs87MLiDV0ipQ+D/6k3g6DRuTdd4V2khjtI56ujSqTQ2PueNQXPu8y2fdsT2Rd1LcfxMS1xKAhSwhHfyy0I3JwzPG1D+sm3QNJEOoJviSNn5fYOFpY+mSEkFNMMeEbwOFdHxWbkiJk/Z8VwdH5I52tkHU3sRQMuZHtcKUc/SIt5Ivv6gtuEZQdm1GE6KUdiRB95s8JVGNlCcHX5bXbScu4eKCRQn3Cl+m5KR4EzI6hVP/iDRhVKj7Dn/blOHLzhNS5vW4X085dTP+1TBL8CHpQpiA3t8LfqfV1b/+WahOd3jNBNTXXfe/AQSjErgctLMdmOBpUQaJLOlcDcKGxWQdOo102nxg8Y/kFDARccywugoQxuIZpMYq74tjnJlJZ9kqR/LPrjmvx4v+0XFsaCPE=",
6+
"Delay": "3",
7+
"Group": "Default",
8+
"Hosts": "127.0.0.1",
9+
"Hwid": "null",
10+
"Install": "false",
11+
"InstallFile": "",
12+
"InstallFolder": "%AppData%",
13+
"Key": "Uk9tU0hKZUlVdXBwek1tV3NqYnBLYVRYcklWQXB5c0I=",
14+
"MTX": "AsyncMutex_6SI8OkPnk",
15+
"Pastebin": "null",
16+
"Ports": "6606,7707,8808",
17+
"Serversignature": "b4TmzraaQMXPVpdfH6wgqDtnXhWP9SP6GdUMgvKSpjPlWufiGM88XWg3Wnv1bduWRMUOAIBN31gAe/SRIhAhdCJU0h6nvqjBUKQsnrg3kT6d2beUtwLDhWWqGa3i9Nta72fkbikM65DIkUwjGtnZy3THx83+doN/+cwe9ZlhKc7TqGF9klOT0nQ9JFUi3Gn6uDzwhA7vicj1WyfM15QxLp0ZvTojgjjFUC2BVkr+mDvuuQ4OR0h4qOgl/AXOYfZwKMfvnwijdP/qqpeG+X73rXZxeDawcTMYqvWH+hOiksgsh2C9V/iN8Sjye/A6rKewmHMUozpakMjP+TjES8kwT70+vJ/uS3ugCZUjT6sOqqLl+LyQyzSpGdVJJQB/fPrYTlWTJwpXdxk8V+eqcdCf/mpeYyQnyGaFVc2whfLAN0r2aPigRQNmsY7Faom/CeNc98zIBf9Nt+KR3FfyFuYabZn5zQcYNAq6D0MVRbKQsU3eyGWN+JI24PQUloheBFJvimpBqMMRVWDLsQq82TpExWJoT47fBrzZj/6LE10vKwl6TNiE81fkglcc93ErbH1KCdXxUaxKVePUIypEaohzXkv88h7P6gjhm2Crey8mUkir408At+5Xl8hQE1ozQN0e5le2gIdxX+oFkTFDrzd65MAdKiZ7rqauNMb4aM+bEeM=",
18+
"TelegramChatID": "1863892139",
19+
"TelegramToken": "7153134069:AAHd4riTPdhAdVGBwo16vJQ5H3eORu5QAEo",
20+
"Version": ""
21+
},
22+
"key": "564eced38c73ee8089d8bcc951f28c0589a54388a4058b0da1d9c4d94514518f",
23+
"salt": "bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941",
24+
"sha256": "0aa7bfb081e73a67c23715a55ff13a74ef6b1ce2b82a33b5537ee001592919a4",
25+
"yara_possible_family": "asyncrat"
26+
}

‎tests/expected/0e19cefba973323c234322452dfd04e318f14809375090b4f6ab39282f6ba07e.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"config": {
3+
"Anti": "%Anti%",
4+
"BDOS": "%BDOS%",
5+
"Certificate": "%Certificate%",
6+
"Delay": "%Delay%",
7+
"Group": "%Group%",
8+
"Hosts": "%Hosts%",
9+
"Hwid": "null",
10+
"Install": "%Install%",
11+
"InstallFile": "%File%",
12+
"InstallFolder": "%Folder%",
13+
"Key": "%Key%",
14+
"MTX": "%MTX%",
15+
"Pastebin": "%Pastebin%",
16+
"Ports": "%Ports%",
17+
"Serversignature": "%Serversignature%",
18+
"Version": "%Version%"
19+
},
20+
"key": "None",
21+
"salt": "bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941",
22+
"sha256": "0e19cefba973323c234322452dfd04e318f14809375090b4f6ab39282f6ba07e",
23+
"yara_possible_family": "asyncrat"
24+
}

‎tests/expected/6b99acfa5961591c39b3f889cf29970c1dd48ddb0e274f14317940cf279a4412.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"config": {
3+
"Anti": "false",
4+
"BDOS": "false",
5+
"Certificate": "MIIE4DCCAsigAwIBAgIQAM+WaL4OeJIj4I0Usukl1TANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTZXJ2ZXIwIBcNMjQwNDA0MTYzMzA2WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKhz3rO2b0ITSMGvwlS7uWZLVU7cuvYiIyB2WnGxe2SUlT5/pZrRxfX6CVL8t11S5CG3UFMdKDutLiA1amqLDbkqZAjG/g1J+7OPUOBrBWfzpEk/CFCFjmUTlMPwM00DtDp5Ju8ONc09JiaL9Ni3GeYsXza+HZB0WRrgpKnMNu+833ddBOaIgdvB4KicE/S8hSRq5kTNIhiNNZ0nrMFgzaQj0ijyXNTXN7nFCTqRSkWn/2pdveWZLqzTRZ5HsUkeXr2vhSdrrk7KOpHWjqNr2Nhl+bqsIRUhwnthLhj6N1Y94W25j3ATrLR6mjjZTGI2wRm95bMe/7V4DxqV30i6MVrwYMXKcaPO+NHoF9P1lErhCgttEGyWJz2dVJqVCXA+fE8hLyKSUeJSwaBJ36Of/OFGXXMXpUD7eFHNCN2yPVsW1ogS04/xkQUmbWbRjYx/l02+RK/kAK3YsZDuvcLsbKoDq7XJKoBVfvbv5W7jcmMvHHT54PNbmkAUasbtM/+/KhKQe1etOoYd+gOv7tgcNFRVH6N6eSuTxasCYjCr9tSLLmziNalWTknHgBtL/x49BJw6FWwrEE3wsl3C4ALfHQFbtI6sTLdCk7t/oNFUhpVE4kwql5xtOpYpkAj500jGfmVc9Wjy34tON2QLKnzAO87pt8XyANEFQdm3qUJX56KdAgMBAAGjMjAwMB0GA1UdDgQWBBRP67T1n4GPr5zJ0tsXMJ+gL7IawDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBMOPQsFZRxqhZZ344n0qBiatzq/jSmfMsMKWYMTiFHHccrgSc63C+nlVpTSCys2BZaMyocxeWKI+w7NklntQhp058+oN7PVC87xod6uZQyfYG1oCR58+Po4I3lWHVdOWQrkEKf4LTpCtyPXPTccZL3AjYcZWLOvP0gcjRsF2dSGnN1WdTPKHxj+OLSwSxlwTW4WN2wg++OV9cmT4wgaT2jPDqv3twxV+JVwEeXMM7XthJsG8ajToCS3Sf7pXnuOBIBoITQEbi7Iyqm/mJwFmAkcpEXb88rHZnKs+rRzjPRI/XsvlGVVuyiHtvPJL9X+R3VVltvrawBCbmN9K2W21E56Nryip0q4wdcF1jJUHXxAiQo/jcu8fO3RGfs9I6SN54PXSWABS7MvNJU8njC1N3J110cnjTgVMNrgRhBHe6r9CGnN4gm9oKvKL5+0/zZvhUPgYusOHIQmdOdfLo0r7tckUk2D18ufRILcaOqyaHLI7Mri1XEli8Brfjdtv/dlpssh/B2/o3bhBlRVD4oL+EX71Bm6cHEKoCLL6zGySSQosQyZpR2j4qVObb5fK1EnilJG4Qk6mNULZfWVPD9TLsJTHEioV8GibykF5O79kruha/pxFvVnoDJHbTPZEWfuR4cb6YIFbTg9pJrOhUsoyZg41leCrcqHR82XOVB755xfw==",
6+
"Delay": "3",
7+
"Group": "Default",
8+
"Hosts": "minecraftdayzserver.ddns.net",
9+
"Hwid": "null",
10+
"Install": "true",
11+
"InstallFile": "WinRar.exe",
12+
"InstallFolder": "%AppData%",
13+
"Key": "VUpkMU9UTEhRSEVSN2d2eWpLeDJud2Q0STFIcDRXS0U=",
14+
"MTX": "LMAsmxp3mz2D",
15+
"Pastebin": "null",
16+
"Ports": "2400",
17+
"Serversignature": "PBjqcvsYypDmnjgUVv1SkvtLx+jFt2V7NyZ+nHik0CWcLbwOwBXD6/3an89d/I7pFAxwZXgSiLunc1yCOocUvymhbMwqT5t/yuj4GdW3a16vZSUuPbvGEOuB2oCgUNrsLWzqshnd1yaTIbNoENLJNS3phGLnQXijbrE2/mSEWbSjLcCWMC7Q52c54RCiBuKPQEhFR1KMUBtSeskObCEqOKY9tYsKKTDYDrQPp32Ho4qArPCDIiefcNiT4k17Dw4srW1OkC3uhSCc7BV1dZA/HJw5gd34pFTeCnJnqY34OmE7sux8mhBjaIXSJMXD81272ngrmGwu6++6DkdLgIx2y3uE6IcUFDQmOgU6T9I0ulogZGGZa1PI3VjBjF4TK27EwzrkR0iKi8Ctn8z/HMXnskviCaui6RlxEzWqOytSfe4m0XHpNN2gHVhKbZwJUr5IwKASOWiXgsOVpkTn8K6PDN22X2rCUigjRsE4/45qhd6BFCa/pXMgCHljHKi5qp13yor91rO9n6NjbO2bP28cexUmUwf03lClGQ2og8q05WWiqHHvLlpHxmy8fZwzniJC3tr6htyPYhGpzo20BMOz/x66tA/+JTC8CFFilvf3PP97KwfqpVNqtnyHVui7QR39E6QvoyNzw+7AxpHCSYx6F9tyWu96pBeSbCrMzXaSV0k=",
18+
"Version": "0.5.8"
19+
},
20+
"key": "eebdb6b2b00c2501b7b246442a354c5c3d743346e4cc88896ce68485dd6bbb8f",
21+
"salt": "bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941",
22+
"sha256": "6b99acfa5961591c39b3f889cf29970c1dd48ddb0e274f14317940cf279a4412",
23+
"yara_possible_family": "asyncrat"
24+
}

‎tests/expected/6e5671dec52db7f64557ba8ef70caf53cf0c782795236b03655623640f9e6a83.json‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
{
2+
"config": {
3+
"ENABLELOGGER": true,
4+
"ENCRYPTIONKEY": "O2CCRlKB5V3AWlrHVKWMrr1GvKqVxXWdcx0l0s6L8fB2mavMqr",
5+
"HIDEFILE": true,
6+
"INSTALL": false,
7+
"INSTALLNAME": "INSTALL",
8+
"MUTEX": "e4d6a6ec-320d-48ee-b6b2-fa24f03760d4",
9+
"PASSWORD": "5EPmsqV4iTCGjx9aY3yYpBWD0IgEJpHNEP75pks",
10+
"RECONNECTDELAY": 5000,
11+
"SPECIALFOLDER": "APPLICATIONDATA",
12+
"STARTUP": true,
13+
"STARTUPKEY": "STARTUP",
14+
"SUBFOLDER": "SUB",
15+
"TAG": "RELEASE",
16+
"VERSION": "1.0.00.r6",
17+
"xor_decoded_strings": [
18+
"BPN - Nuestro Banco",
19+
"Red Link - bpn",
20+
"HB Judiciales BPN",
21+
"Ingres\u00e1 a tu cuenta",
22+
"Online Banking Web",
23+
"Banca Empresa 3.0",
24+
"Banco Ciudad",
25+
"Banco Ciudad | Autogesti\u00f3n",
26+
"Banca Empresa 3.0",
27+
"Banco Comafi - Online Banking",
28+
"Banco Comafi - eBanking Empresas",
29+
"Online Banking Santander | Inicio de Sesi\u00f3n",
30+
"Online Banking Empresas",
31+
"Online Banking",
32+
"Office Banking",
33+
"HSBC Argentina",
34+
"HSBC Argentina | Bienvenido",
35+
"accessbanking.com.ar/RetailHomeBankingWeb/init.do?a=b",
36+
"ICBC Access Banking | Home Banking",
37+
"Banco Patagonia",
38+
"ebankpersonas.bancopatagonia.com.ar/eBanking/usuarios/login.htm",
39+
"P\u00e1gina del Banco de la Provincia de Buenos Aires",
40+
"Red Link",
41+
"bind - finanzas felices :)",
42+
"BindID Ingreso",
43+
"BBVA Net Cash | Empresas | BBVA Argentina",
44+
"Bienvenido a nuestra Banca Online | BBVA Argentina",
45+
"Ingres\u00e1 tu e-mail, tel\u00e9fono o usuario de Mercado Pago",
46+
"Mercado Pago | De ahora en adelante, hac\u00e9s m\u00e1s con tu dinero.",
47+
"Mercado Pago",
48+
"Home Banking",
49+
"Office Banking",
50+
"Banco Santa Cruz Gobierno - Una propuesta para cada Comuna o Municipio | Banco Santa Cruz",
51+
"Home banking",
52+
"Office Banking",
53+
"Banco de Santa Cruz",
54+
"Red Link",
55+
"Banco de la Naci\u00f3n Argentina",
56+
"Red Link - BANCO DE LA NACION ARGENTINA",
57+
"Red Link",
58+
"Macro | Agenda powered by Whyline",
59+
"Banco Macro | Banca Internet Personas",
60+
"Banco Macro | NUEVA Banca Internet Empresas",
61+
"https://argentina-e4162-default-rtdb.firebaseio.com/user.json",
62+
"C:\\\\Users\\\\",
63+
"\\\\AppData\\\\Local\\\\Aplicativo Itau",
64+
"C:\\\\Program Files\\\\Topaz OFD\\\\Warsaw",
65+
"C:\\\\ProgramData\\\\scpbrad",
66+
"C:\\\\ProgramData\\\\Trusteer",
67+
"dd.MM.yyyy HH:mm:ss",
68+
"application/json",
69+
"Sistema no disponible, intente nuevamente m\u00e1s tarde.",
70+
"SENHA DE 6 BPN",
71+
"SENHA DE 6 NB",
72+
"SENHA DE 6 CIUDAD",
73+
"SENHA DE 6 COMAFI",
74+
"SENHA DE 6 GALACIA",
75+
"SENHA DE 6 HSBC",
76+
"SENHA DE 6 ICBC",
77+
"SENHA DE 6 PATAGONIA",
78+
"SENHA DE 6 PROVINCIA",
79+
"SENHA DE 6 SANTANDER",
80+
"SENHA DE 6 BIND",
81+
"SENHA DE 6 BBVA",
82+
"driftcar.giize.com:443",
83+
"adreniz.kozow.com:443"
84+
]
85+
},
86+
"key": "526f35346a62726168486530765a6266487a7039685575526637684a737575794b4c7933654e5a3465644c415a71455861676b3078357767563277364d544b5339367279367959664d6a66456f35653934784e396c684e346b514c4e7479317442704974",
87+
"salt": "None",
88+
"sha256": "6e5671dec52db7f64557ba8ef70caf53cf0c782795236b03655623640f9e6a83",
89+
"yara_possible_family": "quasarrat"
90+
}

‎tests/expected/83892117f96867db66c1e6676822a4c0d6691cde60449ee47457f4cc31410fce.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"config": {
3+
"obfuscated_key_1": false,
4+
"obfuscated_key_10": "qztadmin.duckdns.org:9782;",
5+
"obfuscated_key_11": "1WvgEMPjdwfqIMeM9MclyQ==",
6+
"obfuscated_key_12": "NcFtjbDOcsw7Evd3coMC0y4koy/SRZGydhNmno81ZOWOvdfg7sv0Cj5ad2ROUfX4QMscAIjYJdjrrs41+qcQwg==",
7+
"obfuscated_key_13": "SubDir",
8+
"obfuscated_key_14": "Client.exe",
9+
"obfuscated_key_15": "QSR_MUTEX_YMblzlA3rm38L7nnxQ",
10+
"obfuscated_key_16": "Quasar Client Startup",
11+
"obfuscated_key_17": "mDf8ODHd9XwqMsIxpY8F",
12+
"obfuscated_key_18": "Office04",
13+
"obfuscated_key_19": "Logs",
14+
"obfuscated_key_2": false,
15+
"obfuscated_key_3": false,
16+
"obfuscated_key_4": true,
17+
"obfuscated_key_5": true,
18+
"obfuscated_key_6": false,
19+
"obfuscated_key_7": 3000,
20+
"obfuscated_key_8": "APPLICATIONDATA",
21+
"obfuscated_key_9": "1.3.0.0"
22+
},
23+
"key": "ff230bfb57fecad4bd59d4d97f6883b4",
24+
"salt": "bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941",
25+
"sha256": "83892117f96867db66c1e6676822a4c0d6691cde60449ee47457f4cc31410fce",
26+
"yara_possible_family": "quasarrat"
27+
}

0 commit comments

Comments
 (0)