95 lines
2.3 KiB
Markdown
95 lines
2.3 KiB
Markdown
|
## KeyBoy IOCs
|
|||
|
|
|
|||
|
|
This directory contains IOCs from the Citizen Lab report [It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community](https://citizenlab.org/2016/11/parliament-keyboy/) published the 17th of November 2016.
|
|||
|
|
|
|||
|
|
Files included in this directory:
|
|||
|
|
* openioc.ioc : IOCs in OpenIOC format
|
|||
|
|
* stix.xml : IOCs in STIX XML format
|
|||
|
|
* iocs.csv : IOCs in csv format
|
|||
|
|
* keyboy.yar : Yara rules related to the KeyBoy samples identified
|
|||
|
|
* kb_c2Decode.py : script to decode KeyBoy C2 communications (see help hereafter)
|
|||
|
|
* kb_configDecode.py : script to decode KeyBoy configuration (see help hereafter)
|
|||
|
|
|
|||
|
|
|
|||
|
|
### kb_c2Decode.py
|
|||
|
|
|
|||
|
|
Help:
|
|||
|
|
```bash
|
|||
|
|
$ python kb_c2Decode.py -h
|
|||
|
|
usage: kb_c2Decode.py [-h] (-k KEY | -b BINARY) [--verbose] PCAPF
|
|||
|
|
|
|||
|
|
Decode KeyBoy C2 traffic from pcap file
|
|||
|
|
|
|||
|
|
positional arguments:
|
|||
|
|
PCAPF PCAP File containing c2 traffic
|
|||
|
|
|
|||
|
|
optional arguments:
|
|||
|
|
-h, --help show this help message and exit
|
|||
|
|
-k KEY, --key KEY Manually provide C2 decode key
|
|||
|
|
-b BINARY, --binary BINARY
|
|||
|
|
KeyBoy binary
|
|||
|
|
--verbose, -v Enable verbose output
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Example:
|
|||
|
|
```
|
|||
|
|
$ python kb_c2Decode.py -b wab32res.dll dump.pcap
|
|||
|
|
============================
|
|||
|
|
{KeyBoy C2 Traffic decoder}
|
|||
|
|
============================
|
|||
|
|
|
|||
|
|
Found constant: 0x71
|
|||
|
|
Computing decode value...
|
|||
|
|
Found decoding multiplier (inverse): 0x91
|
|||
|
|
Searching PCAP for RAW TCP packets and decoding...
|
|||
|
|
|
|||
|
|
*a*
|
|||
|
|
HOME-PC
|
|||
|
|
192.168.100.103
|
|||
|
|
MyUser
|
|||
|
|
2016/06/03 00:24:20
|
|||
|
|
20151108
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
### kb_configDecode.py
|
|||
|
|
|
|||
|
|
Help:
|
|||
|
|
```
|
|||
|
|
$ python kb_configDecode.py -h
|
|||
|
|
usage: kb_configDecode.py [-h] [--verbose] [--skip SKIP] FILE
|
|||
|
|
|
|||
|
|
Decode KeyBoy backdoor configuration files
|
|||
|
|
|
|||
|
|
positional arguments:
|
|||
|
|
FILE KeyBoy encoded config file
|
|||
|
|
|
|||
|
|
optional arguments:
|
|||
|
|
-h, --help show this help message and exit
|
|||
|
|
--verbose, -v Enable verbose output
|
|||
|
|
--skip SKIP, -s SKIP Skip over <SKIP> bytes at beginning of file
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Example:
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
$ python kb_configDecode.py cfs.dat
|
|||
|
|
============================
|
|||
|
|
{KeyBoy Config file Decoder}
|
|||
|
|
============================
|
|||
|
|
|
|||
|
|
Configuration Data:
|
|||
|
|
==============================
|
|||
|
|
Identity Code: 9876543210
|
|||
|
|
C2 Host/IP #1: 103.242.134.243
|
|||
|
|
C2 Host/IP #2: 103.242.134.243
|
|||
|
|
C2 Host/IP #3: 103.242.134.243
|
|||
|
|
C2 Port #1: 443
|
|||
|
|
C2 Port #2: 1234
|
|||
|
|
C2 Port #3: 1234
|
|||
|
|
Password: password8888
|
|||
|
|
Campaign ID: MyUser
|
|||
|
|
```
|