<commit_before>#!/usr/bin/env python
'''
AlienSpy Rat Rat Config Decoder
'''
__description__ = 'AlienSpy Rat Config Extractor'
__author__ = '<NAME> http://techanarchy.net http://malwareconfig.com'
__version__ = '0.2'
__date__ = '2015/08/25'

#Standard Imports Go Here
import os
import re
import sys
import json
import string
from optparse import OptionParser
from zipfile import ZipFile
from cStringIO import StringIO

#Non Standard Imports
from Crypto.Cipher import ARC4

def run(file_name):
    enckey = coded_jar = False
    with ZipFile(file_name, 'r') as zip:
        for name in zip.namelist():
            if name == 'ID':
                pre_key = zip.read(name)
                enckey = '{0}<KEY>'.format(pre_key)
            elif name == 'a.txt':
                pre_key = zip.read(name)
                enckey = '{0}{1}{0}{1}a'.format('plowkmsssssPosq34r', pre_key)
            if name == 'MANIFEST.MF':
                coded_jar = zip.read(name)
            elif name == 'b.txt':
                coded_jar = zip.read(name)

    if enckey and coded_jar:
        decoded_data = decrypt_RC4(enckey, coded_jar)
        decoded_jar = StringIO(decoded_data)
    else:
        return

    with ZipFile(decoded_jar) as zip:
        for name in zip.namelist():
            if name in ['config.xml', 'org/jsocket/resources/config.json']:
                raw_config = zip.read(name)
    return parse_config(raw_config)
        
#Helper Functions Go Here

def string_print(line):
    try:
        return filter(lambda x: x in string.printable, str(line))
    except:
        return line

####RC4 Cipher ####	
def decrypt_RC4(enckey, data):
	cipher = ARC4.new(enckey) # set the ciper
	return cipher.decrypt(data) # decrpyt the data

def parse_config(raw_config):
    config_dict = {}
    if 'JSocket in raw_config':
        config = json.loads(raw_config)
        for k, v in config.iteritems():
            config_dict[k] = v
    else:
        for line in raw_config.split('\n'):
            if line.startswith('<entry key'):
                config_dict[re.findall('key="(.*?)"', line)[0]] = re.findall('>(.*?)</entry', line)[0]
    return config_dict

# Main
if __name__ == "__main__":
    parser = OptionParser(usage='usage: %prog inFile outConfig\n' + __description__, version='%prog ' + __version__)
    (options, args) = parser.parse_args()
    # If we dont have args quit with help page
    if len(args) > 0:
        pass
    else:<commit_msg>Fix typo preventing else condition from executing<commit_after>#!/usr/bin/env python
'''
AlienSpy Rat Rat Config Decoder
'''
__description__ = 'AlienSpy Rat Config Extractor'
__author__ = '<NAME> http://techanarchy.net http://malwareconfig.com'
__version__ = '0.2'
__date__ = '2015/08/25'

#Standard Imports Go Here
import os
import re
import sys
import json
import string
from optparse import OptionParser
from zipfile import ZipFile
from cStringIO import StringIO

#Non Standard Imports
from Crypto.Cipher import ARC4

def run(file_name):
    enckey = coded_jar = False
    with ZipFile(file_name, 'r') as zip:
        for name in zip.namelist():
            if name == 'ID':
                pre_key = zip.read(name)
                enckey = <KEY>'.format(pre_key)
            elif name == 'a.txt':
                pre_key = zip.read(name)
                enckey = '{0}{1}{0}{1}a'.format('plowkmsssssPosq34r', pre_key)
            if name == 'MANIFEST.MF':
                coded_jar = zip.read(name)
            elif name == 'b.txt':
                coded_jar = zip.read(name)

    if enckey and coded_jar:
        decoded_data = decrypt_RC4(enckey, coded_jar)
        decoded_jar = StringIO(decoded_data)
    else:
        return

    with ZipFile(decoded_jar) as zip:
        for name in zip.namelist():
            if name in ['config.xml', 'org/jsocket/resources/config.json']:
                raw_config = zip.read(name)
    return parse_config(raw_config)
        
#Helper Functions Go Here

def string_print(line):
    try:
        return filter(lambda x: x in string.printable, str(line))
    except:
        return line

####RC4 Cipher ####	
def decrypt_RC4(enckey, data):
	cipher = ARC4.new(enckey) # set the ciper
	return cipher.decrypt(data) # decrpyt the data

def parse_config(raw_config):
    config_dict = {}
    if 'JSocket' in raw_config:
        config = json.loads(raw_config)
        for k, v in config.iteritems():
            config_dict[k] = v
    else:
        for line in raw_config.split('\n'):
            if line.startswith('<entry key'):
                config_dict[re.findall('key="(.*?)"', line)[0]] = re.findall('>(.*?)</entry', line)[0]
    return config_dict

# Main
if __name__ == "__main__":
    parser = OptionParser(usage='usage: %prog inFile outConfig\n' + __description__, version='%prog ' + __version__)
    (options, args) = parser.parse_args()
    # If we dont have args quit with help page
    if len(args) > 0:
        pass
    else:
{'fraction_non_alphanumeric': 0.12028397565922921, 'fraction_numerical': 0.009939148073022312, 'mean_word_length': 2.5914056809905315, 'pattern_counts': {'":': 2, '<': 11, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2163310', 'n_tokens_mistral': 1655, 'n_tokens_neox': 1590, 'n_words': 427}