CAPE: Malware Configuration Extraction
Project description
CAPE-parsers
CAPE core and community parsers
Configs structure
CNCs: []
campaign: str
botnet: str
dga_seed: hex str
version: str
mutex: str
user_agent: str
build: str
cryptokey: str
cryptokey_type: str (algorithm). Ex: RC4, RSA public key. salsa20, (x)chacha20
raw: {any other data goes here}
- All CNC entries should be in URL format. aka
<schema>://<hostname>:<port>/<uri>- Schema examples:
tcp://,ftp://,udp://,http(s), etc. - Old CAPE configs still have lack of this structures as most of them are dead families.
- This CNC simplification make it easier to parse with tools like
tldextractorurlparse
- Schema examples:
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file cape_parsers-0.1.50.tar.gz.
File metadata
- Download URL: cape_parsers-0.1.50.tar.gz
- Upload date:
- Size: 139.0 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.13.7
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
c339cd63b63d96354384c19cb68acbf68481813fdfd9073af0ff82d111bbf3b5
|
|
| MD5 |
44fd004d2de59ac7333fef6d2979b713
|
|
| BLAKE2b-256 |
e93e68dbb8e78e07ffd01f54765769ce8d43eed85e63ab570aa2387ec6dbf585
|
Provenance
The following attestation bundles were made for cape_parsers-0.1.50.tar.gz:
Publisher:
publish.yml on CAPESandbox/CAPE-parsers
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
cape_parsers-0.1.50.tar.gz -
Subject digest:
c339cd63b63d96354384c19cb68acbf68481813fdfd9073af0ff82d111bbf3b5 - Sigstore transparency entry: 488121851
- Sigstore integration time:
-
Permalink:
CAPESandbox/CAPE-parsers@8dac4bc5bb5df66fcfa0d5403c483c0bcef41212 -
Branch / Tag:
refs/tags/v0.1.50 - Owner: https://github.com/CAPESandbox
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@8dac4bc5bb5df66fcfa0d5403c483c0bcef41212 -
Trigger Event:
release
-
Statement type:
File details
Details for the file cape_parsers-0.1.50-py3-none-any.whl.
File metadata
- Download URL: cape_parsers-0.1.50-py3-none-any.whl
- Upload date:
- Size: 191.1 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.13.7
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
f8d673ca087167034ea8d24f45af47a53ff01e36dee67bfc102c18ab77f634ce
|
|
| MD5 |
59cf6ca8f96b0814d1e4a9241a07ce57
|
|
| BLAKE2b-256 |
6e63e1e3a201e87062dab2493d7419ca5c9754125fdb787a4fcbb43b51fbc327
|
Provenance
The following attestation bundles were made for cape_parsers-0.1.50-py3-none-any.whl:
Publisher:
publish.yml on CAPESandbox/CAPE-parsers
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
cape_parsers-0.1.50-py3-none-any.whl -
Subject digest:
f8d673ca087167034ea8d24f45af47a53ff01e36dee67bfc102c18ab77f634ce - Sigstore transparency entry: 488121855
- Sigstore integration time:
-
Permalink:
CAPESandbox/CAPE-parsers@8dac4bc5bb5df66fcfa0d5403c483c0bcef41212 -
Branch / Tag:
refs/tags/v0.1.50 - Owner: https://github.com/CAPESandbox
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@8dac4bc5bb5df66fcfa0d5403c483c0bcef41212 -
Trigger Event:
release
-
Statement type:
