<commit_before>from common import Modules, data_strings_wide, load_yara_rules, PEParseModule, ModuleMetadata, is_ip_or_domain


class njRat(PEParseModule):
    def __init__(self):
        md = ModuleMetadata(
            module_name="njrat",
            bot_name="njRat",
            description="RAT",
            authors=["<NAME> (@botnet_hunter)"],
            version="1.0.0",
            date="March 21, 2015",
            references=[]
        )
        PEParseModule.__init__(self, md)
        self.yara_rules = None

    def _generate_yara_rules(self):
        if self.yara_rules is None:
            self.yara_rules = load_yara_rules("njrat.yara")
        return self.yara_rules

    @staticmethod
    def _is_number(s):
        if s != s.strip():
            return False
        try:
            if int(s) < 65536:
                return True
            return False
        except KeyboardInterrupt:
            raise
        except:
            return False

    def get_bot_information(self, file_data):
        # todo Pimp this out with https://github.com/kevthehermit/RATDecoders/blob/master/njRat.py
        results = {}
        wide_strings = [i for i in data_strings_wide(file_data, 1)]
        if "[endof]" not in wide_strings:
            return results
        wide_strings = wide_strings[:wide_strings.index("[endof]")]

        start_index = 0
        for x in xrange(len(wide_strings)):
            if wide_strings[x].startswith("0."):
                start_index = x

        wide_strings = wide_strings[start_index:]

        potential_domains = [d for d in wide_strings if is_ip_or_domain(d)]
        potential_ports = [int(p) for p in wide_strings if njRat._is_number(p)]

        extra_domains = ["winlogon.com", "Microsoft.com"]
        for d in extra_domains:
            if d in potential_domains:
                potential_domains.remove(d)

        if len(potential_ports) > 1:
            potential_ports = [p for p in potential_ports if p > 10]

        if len(potential_domains) == 1 and len(potential_ports) == 1:
            results['c2_uri'] = "tcp://{0}:{1}".format(potential_domains[0], potential_ports[0])
        #else:
        #    print "SHIT {0} {1}".format(potential_domains, potential_ports)

        return results


Modules.list.append(njRat())<commit_msg>Updated njrat<commit_after>from common import Modules, data_strings_wide, load_yara_rules, PEParseModule, ModuleMetadata, is_ip_or_domain


class njRat(PEParseModule):
    def __init__(self):
        md = ModuleMetadata(
            module_name="njrat",
            bot_name="njRat",
            description="RAT",
            authors=["<NAME> (@botnet_hunter)"],
            version="1.1.0",
            date="March 21, 2015",
            references=[]
        )
        PEParseModule.__init__(self, md)
        self.yara_rules = None

    def _generate_yara_rules(self):
        if self.yara_rules is None:
            self.yara_rules = load_yara_rules("njrat.yara")
        return self.yara_rules

    @staticmethod
    def _is_number(s):
        if s != s.strip():
            return False
        try:
            if int(s) < 65536:
                return True
            return False
        except KeyboardInterrupt:
            raise
        except:
            return False

    def get_bot_information(self, file_data):
        # todo Pimp this out with https://github.com/kevthehermit/RATDecoders/blob/master/njRat.py
        results = {}
        wide_strings = [i for i in data_strings_wide(file_data, 1)]
        if "[endof]" not in wide_strings:
            return results
        wide_strings = wide_strings[:wide_strings.index("[endof]")]

        start_index = 0
        for x in xrange(len(wide_strings)):
            if wide_strings[x].startswith("0."):
                start_index = x

        wide_strings = wide_strings[start_index:]

        potential_domains = [d for d in wide_strings if is_ip_or_domain(d)]
        potential_ports = [int(p) for p in wide_strings if njRat._is_number(p)]

        extra_domains = ["winlogon.com", "Microsoft.com"]
        for d in extra_domains:
            if d in potential_domains:
                potential_domains.remove(d)

        if len(potential_ports) > 1:
            potential_ports = [p for p in potential_ports if p > 10]

        if len(potential_domains) == 1 and len(potential_ports) == 1:
            if potential_domains[0].endswith(":" + str(potential_ports[0])):
                results['c2_uri'] = "tcp://{0}".format(potential_domains[0])
            else:
                results['c2_uri'] = "tcp://{0}:{1}".format(potential_domains[0], potential_ports[0])
        #else:
        #    print "SHIT {0} {1}".format(potential_domains, potential_ports)

        return results


Modules.list.append(njRat())
{'fraction_non_alphanumeric': 0.10554860241969129, 'fraction_numerical': 0.013141426783479349, 'mean_word_length': 2.167107001321004, 'pattern_counts': {'":': 1, '<': 7, '<?xml version=': 0, '>': 9, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7291843', 'n_tokens_mistral': 1546, 'n_tokens_neox': 1433, 'n_words': 320}