Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs
This commit is contained in:
SsSnake
25
data/ioc/spyware/amnesty/2020-09-25_finfisher/README.md
Normal file
25
data/ioc/spyware/amnesty/2020-09-25_finfisher/README.md
Normal file
@@ -0,0 +1,25 @@
|
||||
# Technical Report
|
||||
|
||||
This repository contains indicators of compromise and scripts related to the report [German-made FinSpy spyware found in Egypt, and Mac and Linux versions revealed ](https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/) published by Amnesty Tech in September 2020.
|
||||
|
||||
Indicators:
|
||||
|
||||
* `domains.txt` : domains identified
|
||||
* `ips.txt` : IPv4 addresses identified
|
||||
* `sha256.csv` : sha256 of samples identified
|
||||
* `rules.yar` : Yara rules
|
||||
|
||||
Tools in the script folder:
|
||||
|
||||
* `decode_modules.py` : decode encrypted modules of Linux and MacOs
|
||||
* `read_config.py` : read FinSpy configuration
|
||||
* `android/extract_config.py` : extract configuration from FinSpy Android samples
|
||||
* `android/java_parser.py` : extract obfuscated strings from decompiled java code
|
||||
* `android/string_decoder.py` : decode obfuscated strings
|
||||
* `linux/extract_config.py` : extract configuration files from a Linux FinSpy installer
|
||||
* `cobaltstrike/cobaltstrike_config.py`: extract the configuration of a Cobalt Strike payload
|
||||
* `cobaltstrike/cobaltstrike_decode.py`: decode an obfuscated Cobalt Strike payload
|
||||
|
||||
Additional files:
|
||||
|
||||
* `android_tlv_list.csv` : list of TLV values extracted from the Android sample
|
||||
@@ -0,0 +1,813 @@
|
||||
Group ID,Group name,TLV value,Known TLV,TLV name,Function
|
||||
64,drives all get,131488,✔,TlvTypeGetAllDrivesRequest,
|
||||
64,drives all get,131744,✔,TlvTypeGetAllDrivesReply,
|
||||
66,contents folder get,135328,✔,TlvTypeGetFolderContentsRequest,
|
||||
66,contents folder get,135584,✔,TlvTypeGetFolderContentsReply,
|
||||
66,contents folder get,135840,✔,TlvTypeGetFolderContentsNext,
|
||||
66,contents folder get,136096,✔,TlvTypeGetFolderContentsEnd,
|
||||
68,download file,139424,✔,TlvTypeDownloadFileRequest,
|
||||
68,download file,139680,✔,TlvTypeCancelDownloadFileRequest,
|
||||
68,download file,139936,✔,TlvTypeDownloadFileReply,
|
||||
68,download file,140192,✔,TlvTypeDownloadFileNext,
|
||||
68,download file,140448,✔,TlvTypeDownloadFileEnd,
|
||||
68,download file,140704,✔,TlvTypeCancelDownloadFileReply,
|
||||
70,upload file,143520,✔,TlvTypeUploadFileRequest,
|
||||
70,upload file,143776,✔,TlvTypeCancelUploadFileRequest,
|
||||
70,upload file,144032,✔,TlvTypeUploadFileReply,
|
||||
70,upload file,144288,✔,TlvTypeUploadFileNext,
|
||||
70,upload file,144544,✔,TlvTypeUploadFileEnd,
|
||||
70,upload file,144800,✔,TlvTypeUploadFileCompleted,
|
||||
70,upload file,145056,✔,TlvTypeCancelUploadFileReply,
|
||||
72,delete file,147616,✔,TlvTypeDeleteFileRequest,
|
||||
72,delete file,147872,✔,TlvTypeDeleteFileReply,
|
||||
74,search file,151968,✔,TlvTypeSearchFileRequest,
|
||||
74,search file,152224,✔,TlvTypeSearchFileReply,
|
||||
74,search file,152480,✔,TlvTypeSearchFileNext,
|
||||
74,search file,152736,✔,TlvTypeSearchFileEnd,
|
||||
74,search file,152992,✔,TlvTypeCancelSearchFileRequest,
|
||||
74,search file,153248,✔,TlvTypeCancelSearchFileReply,
|
||||
78,fs,159888,✔,TlvTypeFSFileDataChunk,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/d, L/org/xmlpush/v3/o/h, L/org/xmlpush/v3/h/c"
|
||||
78,fs,160128,✔,TlvTypeFSDiskDrive,Lorg/xmlpush/v3/o/e
|
||||
78,fs,160384,✔,TlvTypeFSFullPath,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/f/b, L/org/xmlpush/v3/o/h, L/org/xmlpush/v3/h/c"
|
||||
78,fs,160640,✔,TlvTypeFSFilename,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, L/org/xmlpush/v3/h/c"
|
||||
78,fs,160896,✔,TlvTypeFSFileExtension,
|
||||
78,fs,161088,✔,TlvTypeFSDiskDriveType,Lorg/xmlpush/v3/o/e
|
||||
78,fs,161408,✔,TlvTypeFSFileSize,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e"
|
||||
78,fs,161584,✔,TlvTypeFSIsFolder,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e"
|
||||
79,fs,161840,✔,TlvTypeFSReadOnly,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e"
|
||||
79,fs,162096,✔,TlvTypeFSHidden,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e"
|
||||
79,fs,162352,✔,TlvTypeFSSystem,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e"
|
||||
79,fs,162688,✔,TlvTypeFSFileCreationTime,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e"
|
||||
79,fs,162944,✔,TlvTypeFSFileLastAccessTime,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e"
|
||||
79,fs,163200,✔,TlvTypeFSFileLastWriteTime,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e"
|
||||
79,fs,163472,✔,TlvTypeFSFullPathM,"Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, L/org/xmlpush/v3/h/c"
|
||||
79,fs,163632,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
82,system config file,168096,✔,TlvTypeGetFileSystemConfigRequest,
|
||||
82,system config file,168352,✔,TlvTypeFileSystemConfigReply,
|
||||
82,system config file,168608,✔,TlvTypeSetFileSystemConfigRequest,
|
||||
128,line cmd,262560,✔,TlvTypeStartCmdLineSessionRequest,
|
||||
128,line cmd,262816,✔,TlvTypeStartCmdLineSessionReply,
|
||||
128,line cmd,263072,✔,TlvTypeStopCmdLineSessionRequest,
|
||||
128,line cmd,263328,✔,TlvTypeCmdLineSessionStoppedReply,
|
||||
128,line cmd,263584,✔,TlvTypeCmdLineExecute,
|
||||
128,line cmd,263840,✔,TlvTypeCmdLineExecutionResult,
|
||||
130,line cmd execute,266352,✔,TlvTypeCmdLineExecuteCommand,
|
||||
130,line cmd execute,266560,✔,TlvTypeCmdLineExecuteAnswerID,
|
||||
130,line cmd execute,266864,✔,TlvTypeCmdLineExecuteAnswerData,
|
||||
146,line config cmd,299168,✔,TlvTypeGetCmdLineConfigRequest,
|
||||
146,line config cmd,299424,✔,TlvTypeCmdLineConfigReply,
|
||||
146,line config cmd,299680,✔,TlvTypeSetCmdLineConfigRequest,
|
||||
160,config scheduler,328096,✔,TlvTypeGetSchedulerConfigRequest,
|
||||
160,config scheduler,328352,✔,TlvTypeSchedulerConfigReply,
|
||||
160,config scheduler,328608,✔,TlvTypeSetSchedulerConfigRequest,
|
||||
162,task scheduler,331920,✔,TlvTypeSchedulerTask,
|
||||
162,task scheduler,332192,✔,TlvTypeSchedulerTaskRecordByTime,
|
||||
162,task scheduler,332448,✔,TlvTypeSchedulerTaskRecordScreenWhenAppRuns,
|
||||
162,task scheduler,332704,✔,TlvTypeSchedulerTaskRecordMicWhenAppUsesIt,
|
||||
162,task scheduler,332960,✔,TlvTypeSchedulerTaskRecordWebCamWhenAppUsesIt,
|
||||
176,sch,360592,✔,TlvTypeSCHTaskConfiguration,L/org/xmlpush/v3/h/c
|
||||
176,sch,360752,✔,TlvTypeSCHTaskEnabled,L/org/xmlpush/v3/h/c
|
||||
176,sch,361344,✔,TlvTypeSCHTaskStartDateTime,L/org/xmlpush/v3/h/c
|
||||
176,sch,361600,✔,TlvTypeSCHTaskStopDateTime,L/org/xmlpush/v3/h/c
|
||||
176,sch,362112,✔,TlvTypeSCHApplicationName,
|
||||
176,sch,362288,✔,TlvTypeSCHApplicationWindowOnly,
|
||||
512,microphone,1048992,✔,TlvTypeStartMicrophoneRequest,
|
||||
512,microphone,1049248,✔,TlvTypeStartMicrophoneReply,
|
||||
512,microphone,1049504,✔,TlvTypeMicrophoneFrame,
|
||||
512,microphone,1049760,✔,TlvTypeStopMicrophoneRequest,
|
||||
512,microphone,1050016,✔,TlvTypeMicrophoneStoppedReply,
|
||||
512,microphone,1050272,✔,TlvTypeStartMicrophoneRecording,
|
||||
514,,1052736,✔,TlvTypeMICFrameID,"Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/n"
|
||||
514,,1053072,✔,TlvTypeMICFrameData,"Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/n"
|
||||
514,,1053312,✔,TlvTypeAudioSessionType,
|
||||
514,,1053568,✔,TlvTypeAudioEncodingType,
|
||||
518,audio config,1061024,✔,TlvTypeGetAudioConfigRequest,
|
||||
518,audio config,1061280,✔,TlvTypeAudioConfigReply,
|
||||
518,audio config,1061536,✔,TlvTypeSetAudioConfigRequest,
|
||||
520,type video,1066112,✔,TlvTypeVideoSessionType,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b"
|
||||
520,type video,1066368,✔,TlvTypeVideoEncodingType,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b"
|
||||
544,screen,1114528,✔,TlvTypeStartScreenRequest,
|
||||
544,screen,1114784,✔,TlvTypeStartScreenReply,
|
||||
544,screen,1115040,✔,TlvTypeScreenFrame,
|
||||
544,screen,1115296,✔,TlvTypeStopScreenRequest,
|
||||
544,screen,1115552,✔,TlvTypeScreenStoppedReply,
|
||||
544,screen,1115808,✔,TlvTypeStartScreenRecording,
|
||||
548,cam web,1122720,✔,TlvTypeStartWebCamRequest,
|
||||
548,cam web,1122976,✔,TlvTypeStartWebCamReply,
|
||||
548,cam web,1123232,✔,TlvTypeWebCamFrame,
|
||||
548,cam web,1123488,✔,TlvTypeStopWebCamRequest,
|
||||
548,cam web,1123744,✔,TlvTypeWebCamStoppedReply,
|
||||
548,cam web,1124000,✔,TlvTypeStartWebCamRecording,
|
||||
550,config video,1126560,✔,TlvTypeGetVideoConfigRequest,
|
||||
550,config video,1126816,✔,TlvTypeVideoConfigReply,
|
||||
550,config video,1127072,✔,TlvTypeSetVideoConfigRequest,
|
||||
552,,1130560,✔,TlvTypeVDFrameID,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b"
|
||||
552,,1130896,✔,TlvTypeVDFrameData,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b"
|
||||
552,,1131136,✔,TlvTypeOriginalVideoResolution,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b"
|
||||
552,,1131392,✔,TlvTypeVideoResolution,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b"
|
||||
552,,1132160,✔,TlvTypeAutomaticRecordingUID,
|
||||
576,key logging,1180064,✔,TlvTypeStartKeyLoggingRequest,
|
||||
576,key logging,1180320,✔,TlvTypeStartKeyLoggingReply,
|
||||
576,key logging,1180576,✔,TlvTypeKeyLoggingFrame,
|
||||
576,key logging,1180832,✔,TlvTypeStopKeyLoggingRequest,
|
||||
576,key logging,1181088,✔,TlvTypeKeyLoggingStoppedReply,
|
||||
582,config keylogger,1192096,✔,TlvTypeGetKeyloggerConfigRequest,
|
||||
582,config keylogger,1192352,✔,TlvTypeKeyloggerConfigReply,
|
||||
582,config keylogger,1192608,✔,TlvTypeSetKeyloggerConfigRequest,
|
||||
584,kl frame data,1196416,✔,TlvTypeKLFrameData,Lorg/xmlpush/v3/o/i
|
||||
640,skype,1311136,✔,TlvTypeSkypeAudioMetaInfo,
|
||||
640,skype,1311376,✔,TlvTypeSkypeAudioRecording,
|
||||
640,skype,1311648,✔,TlvTypeSkypeTextRecording,
|
||||
640,skype,1311904,✔,TlvTypeSkypeFileMetaInfo,
|
||||
640,skype,1312144,✔,TlvTypeSkypeFileRecording,
|
||||
640,skype,1312416,✔,TlvTypeSkypeContactsRecording,
|
||||
640,skype,1312640,✔,TlvTypeSkypeContactsUserData,
|
||||
646,config skype,1323168,✔,TlvTypeGetSkypeConfigRequest,
|
||||
646,config skype,1323424,✔,TlvTypeSkypeConfigReply,
|
||||
646,config skype,1323680,✔,TlvTypeSetSkypeConfigRequest,
|
||||
646,config skype,1324336,✔,TlvTypeConfigSkypeAudioEnable,
|
||||
646,config skype,1324592,✔,TlvTypeConfigSkypeTextEnable,
|
||||
646,config skype,1324848,✔,TlvTypeConfigSkypeFileEnable,
|
||||
647,config contacts enable list skype,1325104,✔,TlvTypeConfigSkypeContactsListEnable,
|
||||
648,skype,1327232,✔,TlvTypeSkypeAudioEncodingType,
|
||||
648,skype,1327488,✔,TlvTypeSkypeLoggedInUserAccountName,
|
||||
648,skype,1327744,✔,TlvTypeSkypeConversationPartnerAccountName,
|
||||
648,skype,1328000,✔,TlvTypeSkypeConversationPartnerDisplayName,
|
||||
648,skype,1328256,✔,TlvTypeSkypeChatMembers,
|
||||
648,skype,1328512,✔,TlvTypeSkypeTextMessage,
|
||||
648,skype,1328768,✔,TlvTypeSkypeChatID,
|
||||
648,skype,1329024,✔,TlvTypeSkypeSenderAccountName,
|
||||
649,skype,1329280,✔,TlvTypeSkypeSenderDisplayName,
|
||||
649,skype,1329536,✔,TlvTypeSkypeIncoming,
|
||||
649,skype,1329792,✔,TlvTypeSkypeSessionType,
|
||||
704,changed file,1442208,✔,TlvTypeChangedFileMetaInfo,
|
||||
704,changed file,1442432,✔,TlvTypeChangedFileChangeTime,
|
||||
704,changed file,1442688,✔,TlvTypeChangedFileChangeEvent,
|
||||
704,changed file,1442960,✔,TlvTypeChangedFileRecording,
|
||||
710,config changed,1454240,✔,TlvTypeGetChangedConfigRequest,
|
||||
710,config changed,1454496,✔,TlvTypeChangedConfigReply,
|
||||
710,config changed,1454752,✔,TlvTypeSetChangedConfigRequest,
|
||||
710,config changed,1454912,✔,TlvTypeConfigChangedEvents,
|
||||
736,,1507744,✔,TlvTypeAccessedFileMetaInfo,
|
||||
736,,1507968,✔,TlvTypeAccessedFileAccessTime,
|
||||
736,,1508224,✔,TlvTypeAccessedFileAccessEvent,
|
||||
736,,1508496,✔,TlvTypeAccessedFileRecording,
|
||||
736,,1508736,✔,TlvTypeAccessedApplicationName,
|
||||
736,,1508912,✔,TlvTypeConfigRecordImagesFromExplorer,
|
||||
742,accessed config,1519776,✔,TlvTypeGetAccessedConfigRequest,
|
||||
742,accessed config,1520032,✔,TlvTypeAccessedConfigReply,
|
||||
742,accessed config,1520288,✔,TlvTypeSetAccessedConfigRequest,
|
||||
742,accessed config,1520448,✔,TlvTypeConfigAccessedEvents,
|
||||
768,print,1573280,✔,TlvTypePrintFileMetaInfo,
|
||||
768,print,1573520,✔,TlvTypePrintFrame,
|
||||
772,print,1581184,✔,TlvTypePrintApplicationName,
|
||||
772,print,1581440,✔,TlvTypePrintFilename,
|
||||
772,print,1581696,✔,TlvTypePrintEncodingType,
|
||||
774,print config,1585312,✔,TlvTypeGetPrintConfigRequest,
|
||||
774,print config,1585568,✔,TlvTypePrintConfigReply,
|
||||
774,print config,1585824,✔,TlvTypeSetPrintConfigRequest,
|
||||
800,deleted,1638816,✔,TlvTypeDeletedFileMetaInfo,
|
||||
800,deleted,1639296,✔,TlvTypeDeletedFileDeletionTime,
|
||||
800,deleted,1639552,✔,TlvTypeDeletedFileRecycleBin,
|
||||
800,deleted,1639808,✔,TlvTypeDeletedMethod,
|
||||
800,deleted,1640064,✔,TlvTypeDeletedApplicationName,
|
||||
800,deleted,1640336,✔,TlvTypeDeletedFileRecording,
|
||||
806,config deleted,1650848,✔,TlvTypeGetDeletedConfigRequest,
|
||||
806,config deleted,1651104,✔,TlvTypeDeletedConfigReply,
|
||||
806,config deleted,1651360,✔,TlvTypeSetDeletedConfigRequest,
|
||||
1024,application upload forensics,2097568,✔,TlvTypeUploadForensicsApplicationRequest,
|
||||
1024,application upload forensics,2097824,✔,TlvTypeUploadForensicsApplicationReply,
|
||||
1024,application upload forensics,2098080,✔,TlvTypeUploadForensicsApplicationChunk,
|
||||
1024,application upload forensics,2098336,✔,TlvTypeUploadForensicsApplicationDoneRequest,
|
||||
1024,application upload forensics,2098592,✔,TlvTypeUploadForensicsApplicationDoneReply,
|
||||
1026,application remove forensics,2101664,✔,TlvTypeRemoveForensicsApplicationRequest,
|
||||
1026,application remove forensics,2101920,✔,TlvTypeRemoveForensicsApplicationReply,
|
||||
1028,app forensics execute,2105760,✔,TlvTypeForensicsAppExecuteRequest,
|
||||
1028,app forensics execute,2106016,✔,TlvTypeForensicsAppExecuteReply,
|
||||
1028,app forensics execute,2106272,✔,TlvTypeForensicsAppExecuteResult,
|
||||
1028,app forensics execute,2106528,✔,TlvTypeForensicsAppExecuteResultChunk,
|
||||
1028,app forensics execute,2106784,✔,TlvTypeForensicsAppExecuteResultDone,
|
||||
1028,app forensics execute,2107040,✔,TlvTypeForensicsCancelAppExecuteRequest,
|
||||
1028,app forensics execute,2107296,✔,TlvTypeForensicsCancelAppExecuteReply,
|
||||
1030,config forensics,2109600,✔,TlvTypeGetForensicsConfigRequest,
|
||||
1030,config forensics,2109856,✔,TlvTypeForensicsConfigReply,
|
||||
1030,config forensics,2110112,✔,TlvTypeSetForensicsConfigRequest,
|
||||
1032,application config info forensics,2113680,✔,TlvTypeConfigForensicsApplicationInfoGeneric,
|
||||
1032,application config info forensics,2113952,✔,TlvTypeConfigForensicsApplicationInfo,
|
||||
1034,forensics,2117760,✔,TlvTypeConfigForensicsApplicationName,
|
||||
1034,forensics,2117952,✔,TlvTypeConfigForensicsApplicationSize,
|
||||
1034,forensics,2118208,✔,TlvTypeConfigForensicsApplicationID,
|
||||
1034,forensics,2118528,✔,TlvTypeConfigForensicsApplicationCmdline,
|
||||
1034,forensics,2118784,✔,TlvTypeConfigForensicsApplicationOutput,
|
||||
1034,forensics,2118976,✔,TlvTypeConfigForensicsApplicationTimeout,
|
||||
1034,forensics,2119232,✔,TlvTypeConfigForensicsApplicationVersion,
|
||||
1034,forensics,2119552,✔,TlvTypeForensicsFriendlyName,
|
||||
1035,output application config forensics,2119808,✔,TlvTypeConfigForensicsApplicationOutputPrepend,
|
||||
1035,output application config forensics,2120064,✔,TlvTypeConfigForensicsApplicationOutputContentType,
|
||||
1056,vo meta info ip,2163104,✔,TlvTypeVoIPMetaInfo,
|
||||
1058,vo ip,2166912,✔,TlvTypeVoIPEncodingType,
|
||||
1058,vo ip,2167168,✔,TlvTypeVoIPSessionType,
|
||||
1058,vo ip,2167424,✔,TlvTypeVoIPApplicationName,Lorg/xmlpush/v3/o/n
|
||||
1058,vo ip,2167696,✔,TlvTypeVoIPAppScreenshot,
|
||||
1058,vo ip,2167952,✔,TlvTypeVoIPAudioRecording,
|
||||
1058,vo ip,2168112,✔,TlvTypeConfigVoIPScreenshotEnabled,
|
||||
1062,vo config ip,2175136,✔,TlvTypeGetVoIPConfigRequest,
|
||||
1062,vo config ip,2175392,✔,TlvTypeVoIPConfigReply,
|
||||
1062,vo config ip,2175648,✔,TlvTypeSetVoIPConfigRequest,
|
||||
1088,clicks mouse,2228640,✔,TlvTypeMouseClicksMetaInfo,
|
||||
1088,clicks mouse,2228896,✔,TlvTypeMouseClicksFrame,
|
||||
1090,clicks mouse,2232448,✔,TlvTypeMouseClicksEncodingType,
|
||||
1090,clicks mouse,2232896,✔,TlvTypeConfigMouseClicksRectangle,
|
||||
1090,clicks mouse,2233152,✔,TlvTypeConfigMouseClicksSensitivity,
|
||||
1090,clicks mouse,2233408,✔,TlvTypeConfigMouseClicksType,
|
||||
1094,clicks config mouse,2240672,✔,TlvTypeGetMouseClicksConfigRequest,
|
||||
1094,clicks config mouse,2240928,✔,TlvTypeMouseClicksConfigReply,
|
||||
1094,clicks config mouse,2241184,✔,TlvTypeSetMouseClicksConfigRequest,
|
||||
2112,sms,4325792,✔,TlvTypeMobileSMSMetaInfo,Lorg/xmlpush/v3/f/b
|
||||
2112,sms,4326016,✔,TlvTypeMobileSMSData,Lorg/xmlpush/v3/f/b
|
||||
2112,sms,4326256,✔,TlvTypeSMSSenderNumber,Lorg/xmlpush/v3/f/b
|
||||
2112,sms,4326512,✔,TlvTypeSMSRecipientNumber,Lorg/xmlpush/v3/f/b
|
||||
2112,sms,4326528,✔,TlvTypeSMSInformation,
|
||||
2112,sms,4326768,✔,TlvTypeSMSDirection,Lorg/xmlpush/v3/f/b
|
||||
2112,sms,4327040,×,unknown,Lorg/xmlpush/v3/f/b
|
||||
2144,address book mobile,4391328,✔,TlvTypeMobileAddressBookMetaInfo,Lorg/xmlpush/v3/i/a
|
||||
2144,address book mobile,4391552,✔,TlvTypeMobileAddressBookData,Lorg/xmlpush/v3/i/a
|
||||
2152,address book checksum mobile,4407360,✔,TlvTypeMobileAddressBookChecksum,
|
||||
2176,mobile blackberry,4456864,✔,TlvTypeMobileBlackberryMessengerMetaInfo,
|
||||
2176,mobile blackberry,4457088,✔,TlvTypeMobileBlackberryMessengerData,
|
||||
2176,mobile blackberry,4457328,✔,TlvTypeMobileBlackberryMsChatID,
|
||||
2176,mobile blackberry,4457600,✔,TlvTypeMobileBlackberryMsConversationPartners,
|
||||
2208,mobile tracking,4522400,✔,TlvTypeMobileTrackingStartRequest,
|
||||
2208,mobile tracking,4522656,✔,TlvTypeMobileTrackingStopRequest,
|
||||
2208,mobile tracking,4523376,✔,TlvTypeMobileTrackingDataV10,"Lorg/xmlpush/v3/t/e, Lorg/xmlpush/v3/t/e, Lorg/xmlpush/v3/t/e, Lorg/xmlpush/v3/t/e"
|
||||
2214,mobile config tracking,4535200,✔,TlvTypeMobileTrackingConfig,Lorg/xmlpush/v3/h/c
|
||||
2214,mobile config tracking,4535440,✔,TlvTypeMobileTrackingConfigRaw,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
2216,mobile tracking,4538432,✔,TlvTypeMobileTrackingTimeInterval,L/org/xmlpush/v3/h/c
|
||||
2216,mobile tracking,4538688,✔,TlvTypeMobileTrackingDistance,L/org/xmlpush/v3/h/c
|
||||
2216,mobile tracking,4538928,✔,TlvTypeMobileTrackingSendOnAnyChannel,L/org/xmlpush/v3/h/c
|
||||
2240,mobile call phone,4587936,✔,TlvTypeMobilePhoneCallLogsMetaInfo,Lorg/xmlpush/v3/f/a
|
||||
2240,mobile call phone,4588192,✔,TlvTypeMobilePhoneCallLogsData,Lorg/xmlpush/v3/f/b
|
||||
2240,mobile call phone,4588400,✔,TlvTypeMobilePhoneCallLogsType,Lorg/xmlpush/v3/f/b
|
||||
2240,mobile call phone,4588672,✔,TlvTypeMobilePhoneCallAdditionalInformation,Lorg/xmlpush/v3/f/b
|
||||
2240,mobile call phone,4588912,✔,TlvTypeMobilePhoneCallLogsCallerNumber,Lorg/xmlpush/v3/f/b
|
||||
2240,mobile call phone,4589168,✔,TlvTypeMobilePhoneCallLogsCalleeNumber,Lorg/xmlpush/v3/f/b
|
||||
2240,mobile call phone,4589440,✔,TlvTypeMobilePhoneCallLogsCallerName,Lorg/xmlpush/v3/f/b
|
||||
2241,name call phone logs mobile callee,4589696,✔,TlvTypeMobilePhoneCallLogsCalleeName,Lorg/xmlpush/v3/f/b
|
||||
2242,last call phone entry mobile endtime log,4591680,✔,TlvTypeMobilePhoneCallLogLastEntryEndtime,
|
||||
3072,mobile logging,6291872,✔,TlvTypeMobileLoggingMetaInfo,
|
||||
3072,mobile logging,6292096,✔,TlvTypeMobileLoggingData,
|
||||
3616,master agent,7405984,✔,TlvTypeMasterAgentLogin,
|
||||
3616,master agent,7406240,✔,TlvTypeMasterAgentLoginAnswer,
|
||||
3616,master agent,7406752,✔,TlvTypeMasterAgentTargetList,
|
||||
3616,master agent,7407008,✔,TlvTypeMasterAgentTargetOnlineList,
|
||||
3616,master agent,7407264,✔,TlvTypeMasterAgentTargetInfoReply,
|
||||
3616,master agent,7407520,✔,TlvTypeMasterAgentUserList,
|
||||
3617,master agent list,7407776,✔,TlvTypeMasterAgentUserListReply,
|
||||
3617,master agent list,7408032,✔,TlvTypeMasterAgentTargetArchivedList,
|
||||
3617,master agent list,7408288,✔,TlvTypeMasterAgentTargetListEx,
|
||||
3617,master agent list,7408544,✔,TlvTypeMasterAgentTargetOnlineListEx,
|
||||
3617,master agent list,7408800,✔,TlvTypeMasterAgentMobileTargetArchivedList,
|
||||
3617,master agent list,7409056,✔,TlvTypeMasterAgentMobileTargetList,
|
||||
3617,master agent list,7409312,✔,TlvTypeMasterAgentMobileTargetOnlineList,
|
||||
3618,,7409824,✔,TlvTypeMasterAgentQueryFirst,
|
||||
3618,,7410080,✔,TlvTypeMasterAgentQueryNext,
|
||||
3618,,7410336,✔,TlvTypeMasterAgentQueryLast,
|
||||
3618,,7410592,✔,TlvTypeMasterAgentQueryAnswer,
|
||||
3618,,7410848,✔,TlvTypeMasterAgentRemoveRecord,
|
||||
3618,,7411104,✔,TlvTypeMasterAgentTargetInfoExReply,
|
||||
3618,,7411344,✔,TlvTypeTargetInfoExProperty,
|
||||
3618,,7411616,✔,TlvTypeTargetInfoExPropertyValue,
|
||||
3619,,7411840,✔,TlvTypeTargetInfoExPropertyValueName,
|
||||
3619,,7411968,✔,TlvTypeTargetInfoExPropertyValueData,
|
||||
3619,,7412384,✔,TlvTypeMasterAgentAlarm,
|
||||
3620,master agent,7413920,✔,TlvTypeMasterAgentRetrieveData,
|
||||
3620,master agent,7414176,✔,TlvTypeMasterAgentRetrieveDataAnswer,
|
||||
3620,master agent,7414432,✔,TlvTypeMasterAgentRemoveUser,
|
||||
3620,master agent,7414688,✔,TlvTypeMasterAgentRemoveTarget,
|
||||
3620,master agent,7414944,✔,TlvTypeMasterAgentRetrieveDataComments,
|
||||
3620,master agent,7415200,✔,TlvTypeMasterAgentUpdateDataComments,
|
||||
3620,master agent,7415712,✔,TlvTypeMasterAgentRetrieveActivityLogging,
|
||||
3621,master agent,7415968,✔,TlvTypeMasterAgentRetrieveMasterLogging,
|
||||
3621,master agent,7416224,✔,TlvTypeMasterAgentRetrieveAgentActivityLogging,
|
||||
3621,master agent,7417248,✔,TlvTypeMasterAgentSendUserGUIConfig,
|
||||
3621,master agent,7417504,✔,TlvTypeMasterAgentGetUserGUIConfigRequest,
|
||||
3621,master agent,7417760,✔,TlvTypeMasterAgentGetUserGUIConfigReply,
|
||||
3622,master agent,7418016,✔,TlvTypeMasterAgentProxyList,
|
||||
3622,master agent,7418272,✔,TlvTypeMasterAgentProxyInfoReply,
|
||||
3622,master agent,7419040,✔,TlvTypeMasterAgentNameValuePacket,
|
||||
3622,master agent,7419248,✔,TlvTypeMasterAgentValueName,
|
||||
3622,master agent,7419392,✔,TlvTypeMasterAgentValueData,
|
||||
3622,master agent,7419808,✔,TlvTypeMasterAgentRetrieveTargetHistory,
|
||||
3623,install master agent,7421088,✔,TlvTypeMasterAgentInstallMasterLicense,
|
||||
3623,install master agent,7421344,✔,TlvTypeMasterAgentInstallSoftwareUpdate,
|
||||
3623,install master agent,7421600,✔,TlvTypeMasterAgentInstallSoftwareUpdateChunk,
|
||||
3623,install master agent,7421856,✔,TlvTypeMasterAgentInstallSoftwareUpdateDone,
|
||||
3624,master agent,7422112,✔,TlvTypeMasterAgentSoftwareUpdateInfo,
|
||||
3624,master agent,7422368,✔,TlvTypeMasterAgentSoftwareUpdateInfoReply,
|
||||
3624,master agent,7422624,✔,TlvTypeMasterAgentSoftwareUpdate,
|
||||
3624,master agent,7422880,✔,TlvTypeMasterAgentSoftwareUpdateReply,
|
||||
3624,master agent,7423136,✔,TlvTypeMasterAgentSoftwareUpdateNext,
|
||||
3624,master agent,7423392,✔,TlvTypeMasterAgentAddTimeSchedule,
|
||||
3624,master agent,7423648,✔,TlvTypeMasterAgentAddScreenSchedule,
|
||||
3624,master agent,7423904,✔,TlvTypeMasterAgentAddLockedSchedule,
|
||||
3625,master agent,7424160,✔,TlvTypeMasterAgentRemoveSchedule,
|
||||
3625,master agent,7424416,✔,TlvTypeMasterAgentGetSchedulerList,
|
||||
3625,master agent,7424672,✔,TlvTypeMasterAgentSchedulerTimeAction,
|
||||
3625,master agent,7424928,✔,TlvTypeMasterAgentSchedulerScreenAction,
|
||||
3625,master agent,7425184,✔,TlvTypeMasterAgentSchedulerLockedAction,
|
||||
3625,master agent,7425440,✔,TlvTypeMasterAgentProjectSoftwareUpdateInfo,
|
||||
3625,master agent,7425696,✔,TlvTypeMasterAgentProjectSoftwareUpdateInfoReply,
|
||||
3625,master agent,7425952,✔,TlvTypeMasterAgentProjectSoftwareUpdate,
|
||||
3626,master agent,7426112,✔,TlvTypeMasterAgentSchedulerID,
|
||||
3626,master agent,7426368,✔,TlvTypeMasterAgentSchedulerStartTime,L/org/xmlpush/v3/h/c
|
||||
3626,master agent,7426624,✔,TlvTypeMasterAgentSchedulerStopTime,L/org/xmlpush/v3/h/c
|
||||
3626,master agent,7427488,✔,TlvTypeMasterAgentAddRecordedDataAvailableSchedule,
|
||||
3626,master agent,7427744,✔,TlvTypeMasterAgentSchedulerRecordedDataAvailableAction,
|
||||
3627,master agent data,7428256,✔,TlvTypeMasterAgentRetrieveRemoteMasterData,
|
||||
3627,master agent data,7428512,✔,TlvTypeMasterAgentRetrieveRemoteMasterDataReply,
|
||||
3627,master agent data,7428768,✔,TlvTypeMasterAgentDeleteRemoteMasterData,
|
||||
3627,master agent data,7429024,✔,TlvTypeMasterAgentRetrieveOfflineMasterData,
|
||||
3627,master agent data,7429280,✔,TlvTypeMasterAgentRetrieveOfflineMasterDataReply,
|
||||
3627,master agent data,7429536,✔,TlvTypeMasterAgentDeleteOfflineMasterData,
|
||||
3628,master agent,7430304,✔,TlvTypeMasterAgentQueryFirstEx,
|
||||
3628,master agent,7430560,✔,TlvTypeMasterAgentQueryNextEx,
|
||||
3628,master agent,7430816,✔,TlvTypeMasterAgentQueryLastEx,
|
||||
3628,master agent,7431072,✔,TlvTypeMasterAgentQueryAnswerEx,
|
||||
3628,master agent,7431328,✔,TlvTypeMasterAgentSendUserPreferences,
|
||||
3628,master agent,7431584,✔,TlvTypeMasterAgentGetUserPreferencesRequest,
|
||||
3628,master agent,7431840,✔,TlvTypeMasterAgentGetUserPreferencesReply,
|
||||
3628,master agent,7432096,✔,TlvTypeMasterAgentListMCFilesRequest,
|
||||
3629,master agent mc,7432608,✔,TlvTypeMasterAgentDeleteMCFiles,
|
||||
3629,master agent mc,7432864,✔,TlvTypeMasterAgentSendMCFiles,
|
||||
3629,master agent mc,7433120,✔,TlvTypeMasterAgentMCStatisticsRequest,
|
||||
3629,master agent mc,7433376,✔,TlvTypeMasterAgentMCStatisticsReply,
|
||||
3629,master agent mc,7433616,✔,TlvTypeMasterAgentMCStatisticsValues,
|
||||
3630,master agent,7434400,✔,TlvTypeMasterAgentTrojanKeyRequest,
|
||||
3630,master agent,7434656,✔,TlvTypeMasterAgentTrojanKeyReply,
|
||||
3630,master agent,7434912,✔,TlvTypeMasterAgentEvProtectionX509Request,
|
||||
3630,master agent,7435168,✔,TlvTypeMasterAgentEvProtectionX509Reply,
|
||||
3630,master agent,7435424,✔,TlvTypeMasterAgentEvProtectionImportCert,
|
||||
3630,master agent,7435680,✔,TlvTypeMasterAgentEvProtectionImportCertCompleted,
|
||||
3630,master agent,7435936,✔,TlvTypeMasterAgentConfigurationRequest,
|
||||
3630,master agent,7436192,✔,TlvTypeMasterAgentConfigurationReply,
|
||||
3631,master agent configuration,7436448,✔,TlvTypeMasterAgentConfigurationUpdateRequest,
|
||||
3631,master agent configuration,7436704,✔,TlvTypeMasterAgentConfigurationUpdateRequestCompleted,
|
||||
3631,master agent configuration,7436944,✔,TlvTypeMasterAgentConfiguration,
|
||||
3631,master agent configuration,7437216,✔,TlvTypeMasterAgentConfigurationValue,
|
||||
3631,master agent configuration,7437424,✔,TlvTypeMasterAgentConfigurationValueName,
|
||||
3631,master agent configuration,7437568,✔,TlvTypeMasterAgentConfigurationValueData,
|
||||
3631,master agent configuration,7437984,✔,TlvTypeMasterAgentConfigurationTransferDone,
|
||||
3632,master agent,7438496,✔,TlvTypeMasterAgentRetrieveTargetFile,
|
||||
3632,master agent,7438752,✔,TlvTypeMasterAgentRetrieveTargetFileAnswer,
|
||||
3632,master agent,7438912,✔,TlvTypeMasterAgentAlarmEntryID,
|
||||
3632,master agent,7439168,✔,TlvTypeMasterAgentAlarmEntryVersion,
|
||||
3632,master agent,7439424,✔,TlvTypeMasterAgentAlarmTriggerFlags,
|
||||
3632,master agent,7439776,✔,TlvTypeMasterAgentGetAlarmList,
|
||||
3632,master agent,7440032,✔,TlvTypeMasterAgentAddAlarmEntry,
|
||||
3632,master agent,7440288,✔,TlvTypeMasterAgentRemoveAlarmEntry,
|
||||
3633,master agent,7440544,✔,TlvTypeMasterAgentAlarmEntry,
|
||||
3633,master agent,7440800,✔,TlvTypeMasterAgentSystemStatus,
|
||||
3633,master agent,7441056,✔,TlvTypeMasterAgentSystemStatusRequest,
|
||||
3633,master agent,7441312,✔,TlvTypeMasterAgentSystemStatusReply,
|
||||
3633,master agent,7441552,✔,TlvTypeMasterAgentLicenseValues,
|
||||
3633,master agent,7441824,✔,TlvTypeMasterAgentLicenseValuesRequest,
|
||||
3633,master agent,7442080,✔,TlvTypeMasterAgentLicenseValuesReply,
|
||||
3634,master agent,7442592,✔,TlvTypeMasterAgentGetNetworkConfigurationRequest,
|
||||
3634,master agent,7442848,✔,TlvTypeMasterAgentSetNetworkConfigurationRequest,
|
||||
3634,master agent,7443104,✔,TlvTypeMasterAgentSetNetworkConfigurationReply,
|
||||
3634,master agent,7443360,✔,TlvTypeMasterAgentRetrieveAllowedModulesList,
|
||||
3634,master agent,7443616,✔,TlvTypeMasterAgentRetrieveAllowedModulesListAnswer,
|
||||
3636,master agent,7446688,✔,TlvTypeMasterAgentRemoveAllTargetData,
|
||||
3636,master agent,7446944,✔,TlvTypeMasterAgentForceDownloadRecordedData,
|
||||
3636,master agent,7447200,✔,TlvTypeMasterAgentTargetCreateNotification,
|
||||
3636,master agent,7447456,✔,TlvTypeMasterAgentMobileTargetInfoReply,
|
||||
3636,master agent,7447696,✔,TlvTypeMasterAgentMobileTargetInfoValues,
|
||||
3638,master agent alert,7450784,✔,TlvTypeMasterAgentAlert,
|
||||
3640,master agent,7454880,✔,TlvTypeMasterAgentAddUser,
|
||||
3640,master agent,7455392,✔,TlvTypeMasterAgentAddUserReply,
|
||||
3640,master agent,7455648,✔,TlvTypeMasterAgentModifyUser,
|
||||
3640,master agent,7455904,✔,TlvTypeMasterAgentSetUserPermission,
|
||||
3640,master agent,7456160,✔,TlvTypeMasterAgentSetTargetPermission,
|
||||
3640,master agent,7456400,✔,TlvTypeMasterAgentUserPermission,
|
||||
3640,master agent,7456656,✔,TlvTypeMasterAgentTargetPermission,
|
||||
3641,master agent,7456928,✔,TlvTypeMasterAgentUserPermissionValuePacket,
|
||||
3641,master agent,7457184,✔,TlvTypeMasterAgentTargetPermissionValuePacket,
|
||||
3641,master agent,7457344,✔,TlvTypeMasterAgentUserPermissionValueName,
|
||||
3641,master agent,7457600,✔,TlvTypeMasterAgentTargetPermissionValueName,
|
||||
3641,master agent,7457856,✔,TlvTypeMasterAgentUserPermissionValueData,
|
||||
3641,master agent,7458112,✔,TlvTypeMasterAgentTargetPermissionValueData,
|
||||
3641,master agent,7458464,✔,TlvTypeMasterAgentModifyPassword,
|
||||
3641,master agent,7458656,✔,TlvTypeMasterAgentMobileTargetPermissionValueName,
|
||||
3642,master agent,7458976,✔,TlvTypeMasterAgentUploadFile,
|
||||
3642,master agent,7459232,✔,TlvTypeMasterAgentUploadFileChunk,
|
||||
3642,master agent,7459488,✔,TlvTypeMasterAgentUploadFileDone,
|
||||
3642,master agent,7459744,✔,TlvTypeMasterAgentUploadFilesTransferDone,
|
||||
3642,master agent,7460000,✔,TlvTypeMasterAgentGetTargetModuleConfigRequest,
|
||||
3642,master agent,7460256,✔,TlvTypeMasterAgentRemoveFile,
|
||||
3642,master agent,7460512,✔,TlvTypeMasterAgentMobileProxyList,
|
||||
3642,master agent,7460768,✔,TlvTypeMasterAgentSMSProxyList,
|
||||
3643,master agent,7461024,✔,TlvTypeMasterAgentSMSProxyInfoReply,
|
||||
3643,master agent,7461280,✔,TlvTypeMasterAgentCallPhoneNumberList,
|
||||
3643,master agent,7461536,✔,TlvTypeMasterAgentCallPhoneNumberInfoReply,
|
||||
3643,master agent,7461792,✔,TlvTypeMasterAgentGetMobileTargetModuleConfigRequest,
|
||||
3643,master agent,7462048,✔,TlvTypeMasterAgentSendSMS,
|
||||
3647,master agent,7469984,✔,TlvTypeMasterAgentEncryptionRequired,
|
||||
3647,master agent,7470240,✔,TlvTypeMasterAgentFileCompleted,
|
||||
3647,master agent,7470496,✔,TlvTypeMasterAgentRequestCompleted,
|
||||
3647,master agent,7470752,✔,TlvTypeAgentMasterComm,
|
||||
3647,master agent,7471008,✔,TlvTypeMasterAgentRequestStatus,
|
||||
3648,master,7471424,✔,TlvTypeProxyMasterCommSig,
|
||||
3648,master,7471520,✔,TlvTypeMasterTargetConn,
|
||||
3648,master,7471776,✔,TlvTypeProxyMasterComm,
|
||||
3648,master,7472032,✔,TlvTypeMasterProxyComm,
|
||||
3648,master,7472288,✔,TlvTypeProxyMasterHeartBeatAnswer,
|
||||
3648,master,7472544,✔,TlvTypeProxyMasterDisconnect,
|
||||
3648,master,7472704,✔,TlvTypeProxyMasterNotification,
|
||||
3648,master,7473056,✔,TlvTypeProxyMasterRequest,
|
||||
3649,master,7473312,✔,TlvTypeMasterProxyCommNotification,
|
||||
3649,master,7473568,✔,TlvTypeMasterCheckTargetDisconnect,
|
||||
3680,target proxy,7536960,✔,TlvTypeProxyTargetCommSig,
|
||||
3680,target proxy,7537312,✔,TlvTypeProxyTargetComm,
|
||||
3680,target proxy,7537568,✔,TlvTypeProxyMasterTargetComm,
|
||||
3680,target proxy,7537728,✔,TlvTypeProxyTargetRequestCrypto,
|
||||
3680,target proxy,7538064,✔,TlvTypeProxyTargetAnswerCrypto,
|
||||
3744,target,7668128,✔,TlvTypeMasterTargetComm,
|
||||
3744,target,7668384,✔,TlvTypeTargetCloseAllLiveStreaming,
|
||||
3776,relay,7733664,✔,TlvTypeRelayProxyComm,
|
||||
3776,relay,7734176,✔,TlvTypeRelayDummyHeartbeat,
|
||||
4032,test type meta,8257792,✔,TlvTypeTestMetaTypeInvalid,
|
||||
4032,test type meta,8258608,✔,TlvTypeTestMetaTypeBool,
|
||||
4032,test type meta,8258880,✔,TlvTypeTestMetaTypeUInt,
|
||||
4032,test type meta,8259152,✔,TlvTypeTestMetaTypeInt,
|
||||
4032,test type meta,8259440,✔,TlvTypeTestMetaTypeString,
|
||||
4033,test,8259712,✔,TlvTypeTestMetaTypeUnicode,
|
||||
4033,test,8259984,✔,TlvTypeTestMetaTypeRaw,
|
||||
4033,test,8260256,✔,TlvTypeTestMetaTypeGroup,
|
||||
4033,test,8260416,✔,TlvTypeTestMemberIdentifier,
|
||||
4033,test,8260736,✔,TlvTypeTestMemberName,
|
||||
4096,target,8389008,✔,TlvTypeTargetData,
|
||||
4096,target,8389280,✔,TlvTypeTargetHeartBeat,
|
||||
4096,target,8389680,✔,TlvTypeTargetKeepSessionAlive,
|
||||
4096,target,8390000,✔,TlvTypeTargetLocalIP,
|
||||
4096,target,8390256,✔,TlvTypeTargetGlobalIP,
|
||||
4096,target,8390448,✔,TlvTypeTargetState,
|
||||
4097,agent master,8390784,✔,TlvTypeTargetID,
|
||||
4097,agent master,8391072,✔,TlvTypeGetInstalledModulesRequest,
|
||||
4097,agent master,8391328,✔,TlvTypeInstalledModulesReply,
|
||||
4097,agent master,8391488,✔,TlvTypeTrojanUID,
|
||||
4097,agent master,8391808,✔,TlvTypeTrojanID,
|
||||
4097,agent master,8392000,✔,TlvTypeTrojanMaxInfections,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
4097,agent master,8392240,✔,TlvTypeScreenSaverOn,
|
||||
4097,agent master,8392496,✔,TlvTypeScreenLocked,
|
||||
4098,agent master,8392752,✔,TlvTypeRecordedDataAvailable,
|
||||
4098,agent master,8393024,✔,TlvTypeDownloadedRecordedDataTimeStamp,
|
||||
4098,agent master,8393280,✔,TlvTypeInstallationMode,
|
||||
4098,agent master,8393552,✔,TlvTypeTargetRemoveNotification,
|
||||
4098,agent master,8393792,✔,TlvTypeTargetPlatformBits,
|
||||
4098,agent master,8394032,✔,TlvTypeRemoveItselfMaxInfectionReached,
|
||||
4098,agent master,8394288,✔,TlvTypeRemoveItselfAtMasterRequest,
|
||||
4098,agent master,8394544,✔,TlvTypeRemoveItselfAtAgentRequest,
|
||||
4099,agent master,8394912,✔,TlvTypeRemoveItselfAtAgentReqRequest,
|
||||
4099,agent master,8395072,✔,TlvTypeRecordedFilesDownloadTotal,
|
||||
4099,agent master,8395328,✔,TlvTypeRecordedFilesDownloadProgress,
|
||||
4099,agent master,8395632,✔,TlvTypeTargetLicenseInfo,
|
||||
4099,agent master,8395840,✔,TlvTypeRemoveTargetLicenseInfo,
|
||||
4099,agent master,8396176,✔,TlvTypeTargetAllConfigurations,
|
||||
4100,target error,8396960,✔,TlvTypeTargetError,
|
||||
4102,target config,8401056,✔,TlvTypeGetTargetConfigRequest,
|
||||
4102,target config,8401312,✔,TlvTypeTargetConfigReply,
|
||||
4102,target config,8401568,✔,TlvTypeSetTargetConfigRequest,
|
||||
4102,target config,8402304,✔,TlvTypeConfigTargetID,
|
||||
4102,target config,8402496,✔,TlvTypeConfigTargetHeartbeatInterval,
|
||||
4102,target config,8402800,✔,TlvTypeConfigTargetProxy,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
4103,agent master,8403008,✔,TlvTypeConfigTargetPort,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
4103,agent master,8403584,✔,TlvTypeConfigAutoRemovalDateTime,
|
||||
4103,agent master,8403776,✔,TlvTypeConfigAutoRemovalIfNoProxy,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
4103,agent master,8404032,✔,TlvTypeInternalAutoRemovalElapsedTime,
|
||||
4104,active hiding config,8405040,✔,TlvTypeConfigActiveHiding,
|
||||
4106,target module,8409248,✔,TlvTypeTargetLoadModuleRequest,
|
||||
4106,target module,8409504,✔,TlvTypeTargetLoadModuleReply,
|
||||
4106,target module,8409760,✔,TlvTypeTargetUnLoadModuleRequest,
|
||||
4106,target module,8410016,✔,TlvTypeTargetUnLoadModuleReply,
|
||||
4106,target module,8410272,✔,TlvTypeTargetUploadModuleRequest,
|
||||
4106,target module,8410528,✔,TlvTypeTargetUploadModuleReply,
|
||||
4106,target module,8410784,✔,TlvTypeTargetUploadModuleChunk,
|
||||
4106,target module,8411040,✔,TlvTypeTargetUploadModuleDoneRequest,
|
||||
4107,target module,8411296,✔,TlvTypeTargetUploadModuleDoneReply,
|
||||
4107,target module,8411552,✔,TlvTypeTargetRemoveModuleRequest,
|
||||
4107,target module,8411808,✔,TlvTypeTargetRemoveModuleReply,
|
||||
4107,target module,8412064,✔,TlvTypeTargetOfflineUploadModuleRequest,
|
||||
4107,target module,8412320,✔,TlvTypeTargetOfflineUploadModuleReply,
|
||||
4107,target module,8412576,✔,TlvTypeTargetOfflineUploadModuleChunk,
|
||||
4107,target module,8412832,✔,TlvTypeTargetOfflineUploadModuleDoneRequest,
|
||||
4107,target module,8413088,✔,TlvTypeTargetOfflineUploadModuleDoneReply,
|
||||
4108,target error,8413344,✔,TlvTypeTargetOfflineError,
|
||||
4108,target error,8413600,✔,TlvTypeTargetUploadError,
|
||||
4109,files reply master list agent mc,8415392,✔,TlvTypeMasterAgentListMCFilesReply,
|
||||
4110,target recorded,8417440,✔,TlvTypeTargetGetRecordedFilesRequest,
|
||||
4110,target recorded,8417696,✔,TlvTypeTargetRecordedFilesReply,
|
||||
4110,target recorded,8417952,✔,TlvTypeTargetRecordedFileDownloadRequest,
|
||||
4110,target recorded,8418208,✔,TlvTypeTargetRecordedFileDownloadReply,
|
||||
4110,target recorded,8418464,✔,TlvTypeTargetRecordedFileDownloadChunk,
|
||||
4110,target recorded,8418720,✔,TlvTypeTargetRecordedFileDownloadCompleted,
|
||||
4110,target recorded,8418976,✔,TlvTypeTargetRecordedFileDeleteRequest,
|
||||
4110,target recorded,8419232,✔,TlvTypeTargetRecordedFileDeleteReply,
|
||||
4111,target recorded ex,8419488,✔,TlvTypeTargetGetRecordedFilesRequestEx,
|
||||
4111,target recorded ex,8419744,✔,TlvTypeTargetRecordedFilesReplyEx,
|
||||
4111,target recorded ex,8420000,✔,TlvTypeTargetRecordedFileDeleteRequestEx,
|
||||
4111,target recorded ex,8420256,✔,TlvTypeTargetRecordedFilesDownloadRequestEx,
|
||||
4128,data,8454544,✔,TlvTypeProxyData,
|
||||
4128,data,8454800,✔,TlvTypeRelayData,
|
||||
4130,proxy,8458400,✔,TlvTypeProxyTargetDisconnect,
|
||||
4130,proxy,8458656,✔,TlvTypeProxyMobileTargetDisconnect,
|
||||
4130,proxy,8458912,✔,TlvTypeProxyDummyHeartbeat,
|
||||
4130,proxy,8459168,✔,TlvTypeProxyMobileDummyHeartbeat,
|
||||
4160,master,8520080,✔,TlvTypeMasterData,
|
||||
4160,master,8520768,✔,TlvTypeMasterMode,
|
||||
4160,master,8521024,✔,TlvTypeMasterToken,
|
||||
4160,master,8521344,✔,TlvTypeMasterQueryResult,
|
||||
4161,string master alarm,8522368,✔,TlvTypeMasterAlarmString,
|
||||
4192,agent,8585616,✔,TlvTypeAgentData,
|
||||
4192,agent,8585808,✔,TlvTypeAgentQueryID,
|
||||
4192,agent,8586048,✔,TlvTypeAgentQueryModSubmodID,
|
||||
4192,agent,8586304,✔,TlvTypeAgentQueryFromDate,
|
||||
4192,agent,8586560,✔,TlvTypeAgentQueryToDate,
|
||||
4192,agent,8586816,✔,TlvTypeAgentQuerySortOrder,
|
||||
4192,agent,8587136,✔,TlvTypeAgentQueryValueFilter,
|
||||
4193,uid agent,8587328,✔,TlvTypeAgentUID,
|
||||
4224,mobile,8651152,✔,TlvTypeMobileTargetData,
|
||||
4224,mobile,8651376,✔,TlvTypeMobileTargetHeartBeatV10,"Lorg/xmlpush/v3/o/g, Lorg/xmlpush/v3/o/g"
|
||||
4224,mobile,8651632,✔,TlvTypeMobileTargetExtendedHeartBeatV10,"Lorg/xmlpush/v3/o/g, Lorg/xmlpush/v3/q/b"
|
||||
4224,mobile,8651888,✔,TlvTypeMobileHeartBeatReplyV10,"Lorg/xmlpush/v3/o/h$b, Lorg/xmlpush/v3/o/l$2, L/org/xmlpush/v3/q/a, L/org/xmlpush/v3/q/c"
|
||||
4225,installed reply modules mobile,8653472,✔,TlvTypeMobileInstalledModulesReply,
|
||||
4225,installed reply modules mobile,8652912,×,unknown,Lorg/xmlpush/v3/o/l$2
|
||||
4226,module upload mobile target,8655008,✔,TlvTypeMobileTargetOfflineUploadModuleRequest,L/org/xmlpush/v3/o/h
|
||||
4226,module upload mobile target,8656032,✔,TlvTypeMobileTargetUploadModuleRequest,
|
||||
4226,module upload mobile target,8656288,✔,TlvTypeMobileTargetUploadModuleReply,
|
||||
4226,module upload mobile target,8656544,✔,TlvTypeMobileTargetUploadModuleChunk,
|
||||
4226,module upload mobile target,8656800,✔,TlvTypeMobileTargetUploadModuleDoneRequest,
|
||||
4227,target mobile,8657056,✔,TlvTypeMobileTargetUploadModuleDoneReply,
|
||||
4227,target mobile,8657312,✔,TlvTypeMobileTargetRemoveModuleRequest,
|
||||
4227,target mobile,8657568,✔,TlvTypeMobileTargetRemoveModuleReply,
|
||||
4227,target mobile,8657824,✔,TlvTypeMobileTargetOfflineUploadModuleReply,Lorg/xmlpush/v3/o/j
|
||||
4227,target mobile,8658080,✔,TlvTypeMobileTargetOfflineUploadModuleChunk,L/org/xmlpush/v3/o/h
|
||||
4227,target mobile,8658336,✔,TlvTypeMobileTargetOfflineUploadModuleDoneRequest,L/org/xmlpush/v3/o/h
|
||||
4227,target mobile,8658592,✔,TlvTypeMobileTargetOfflineUploadModuleDoneReply,Lorg/xmlpush/v3/o/j
|
||||
4227,target mobile,8658848,✔,TlvTypeMobileTargetOfflineError,
|
||||
4228,mobile target,8659104,✔,TlvTypeMobileTargetError,
|
||||
4228,mobile target,8659360,✔,TlvTypeMobileTargetGetRecordedFilesRequest,L/org/xmlpush/v3/o/h
|
||||
4228,mobile target,8659616,✔,TlvTypeMobileTargetRecordedFilesReply,Lorg/xmlpush/v3/o/d
|
||||
4228,mobile target,8659872,✔,TlvTypeMobileTargetRecordedFileDownloadRequest,L/org/xmlpush/v3/o/h
|
||||
4228,mobile target,8660128,✔,TlvTypeMobileTargetRecordedFileDownloadReply,Lorg/xmlpush/v3/o/d
|
||||
4228,mobile target,8660384,✔,TlvTypeMobileTargetRecordedFileDownloadChunk,Lorg/xmlpush/v3/o/d
|
||||
4228,mobile target,8660640,✔,TlvTypeMobileTargetRecordedFileDownloadCompleted,Lorg/xmlpush/v3/o/d
|
||||
4228,mobile target,8660896,✔,TlvTypeMobileTargetRecordedFileDeleteRequest,L/org/xmlpush/v3/o/h
|
||||
4229,target reply delete mobile recorded file,8661152,✔,TlvTypeMobileTargetRecordedFileDeleteReply,
|
||||
4230,mobile config target,8663968,✔,TlvTypeMobileTargetOfflineConfig,Lorg/xmlpush/v3/q/c
|
||||
4230,mobile config target,8664224,✔,TlvTypeMobileTargetEmergencyConfigAsTLV,
|
||||
4230,mobile config target,8664432,✔,TlvTypeMobileTargetEmergencyConfig,"L/org/xmlpush/v3/q/a, L/org/xmlpush/v3/q/c"
|
||||
4234,load module mobile target,8671392,✔,TlvTypeMobileTargetLoadModuleRequest,
|
||||
4234,load module mobile target,8671648,✔,TlvTypeMobileTargetLoadModuleReply,
|
||||
4234,load module mobile target,8671904,✔,TlvTypeMobileTargetUnLoadModuleRequest,
|
||||
4234,load module mobile target,8672160,✔,TlvTypeMobileTargetUnLoadModuleReply,
|
||||
4236,target error,8675472,✔,TlvTypeMobileTargetHeartbeatEvents,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
4236,agent master files mc reply list,8675648,✔,TlvTypeMobileTargetHeartbeatInterval,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
4236,recorded target,8675984,✔,TlvTypeMobileTargetHeartbeatRestrictions,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
4236,recorded target,8676208,✔,TlvTypeConfigSMSPhoneNumber,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
4236,recorded target,8676496,✔,TlvTypeMobileTargetPositioning,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c"
|
||||
4236,recorded target,8676672,✔,TlvTypeMobileTrojanUID,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/t/d, Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/i, Lorg/xmlpush/v3/o/i, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/n, Lorg/xmlpush/v3/a/a, Lorg/xmlpush/v3/q/c, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/h/c, Lorg/xmlpush/v3/i/a, L/org/xmlpush/v3/h/c"
|
||||
4236,recorded target,8676976,✔,TlvTypeMobileTrojanID,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
4236,recorded target,8677296,✔,TlvTypeMobileTargetLocationChangedRange,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
4237,config,8677440,✔,TlvTypeConfigMobileAutoRemovalDateTime,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
4237,config,8677808,✔,TlvTypeConfigOverwriteProxyAndPhones,
|
||||
4237,config,8678000,✔,TlvTypeConfigCallPhoneNumber,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
4238,ex recorded target,8679488,✔,TlvTypeLocationAreaCode,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/i/a"
|
||||
4238,ex recorded target,8679744,✔,TlvTypeCellID,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/i/a"
|
||||
4238,ex recorded target,8680048,✔,TlvTypeMobileCountryCode,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/i/a"
|
||||
4238,data,8680304,✔,TlvTypeMobileNetworkCode,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/i/a"
|
||||
4238,data,8680560,✔,TlvTypeIMSI,
|
||||
4238,proxy,8680816,✔,TlvTypeIMEI,
|
||||
4238,proxy,8681072,✔,TlvTypeGPSLatitude,
|
||||
4238,proxy,8681328,✔,TlvTypeGPSLongitude,
|
||||
4239,proxy,8681520,✔,TlvTypeFirstHeartbeat,
|
||||
4239,master,8681872,✔,TlvTypeInstalledModules,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
4240,gps valid values,8683568,✔,TlvTypeValidGPSValues,
|
||||
4288,mobile proxy comm target,8782176,✔,TlvTypeProxyMobileTargetCommSig,
|
||||
4288,mobile proxy comm target,8782496,✔,TlvTypeProxyMobileTargetComm,
|
||||
4288,mobile proxy comm target,8782752,✔,TlvTypeProxyMasterMobileTargetComm,
|
||||
4384,master mobile,8978752,✔,TlvTypeMobileProxyMasterCommSig,
|
||||
4384,master mobile,8978848,✔,TlvTypeMasterMobileTargetConn,
|
||||
4384,master mobile,8979104,✔,TlvTypeMobileProxyMasterComm,
|
||||
4384,master mobile,8979360,✔,TlvTypeMobileMasterProxyComm,
|
||||
4384,master mobile,8979616,✔,TlvTypeProxyMasterMobileHeartBeatAnswer,"Lorg/xmlpush/v3/o/l$2, L/org/xmlpush/v3/o/h"
|
||||
4384,master mobile,8979872,✔,TlvTypeMobileMasterProxyCommNotification,
|
||||
8128,agent,16646544,✔,TlvTypePlaintext,
|
||||
8128,agent uid,16646800,✔,TlvTypeCompression,
|
||||
8128,mobile,16647056,✔,TlvTypeEncryption,"Lorg/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c"
|
||||
8128,mobile,16647232,✔,TlvTypeTargetUID,
|
||||
8128,mobile,16647536,✔,TlvTypeIPAddress,"Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/i, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/n"
|
||||
8128,mobile,16647808,✔,TlvTypeUserName,
|
||||
8128,installed reply modules mobile,16648064,✔,TlvTypeComputerName,
|
||||
8129,installed reply modules mobile,16648304,✔,TlvTypeLoginName,
|
||||
8129,module upload mobile target,16648560,✔,TlvTypePassphrase,
|
||||
8129,module upload mobile target,16648832,✔,TlvTypeRecordID,
|
||||
8129,module upload mobile target,16649088,✔,TlvTypeOwner,
|
||||
8129,module upload mobile target,16649344,✔,TlvTypeMetaData,
|
||||
8129,module upload mobile target,16649536,✔,TlvTypeModuleID,"Lorg/xmlpush/v3/o/d, L/org/xmlpush/v3/o/h, L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c"
|
||||
8129,mobile target,16649856,✔,TlvTypeOSName,
|
||||
8129,mobile target,16650048,✔,TlvTypeModuleSubID,"Lorg/xmlpush/v3/o/d, L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c"
|
||||
8130,mobile target,16650320,✔,TlvTypeErrorCode,
|
||||
8130,mobile target,16650560,✔,TlvTypeOffset,
|
||||
8130,mobile target,16650816,✔,TlvTypeLength,
|
||||
8130,mobile target,16651088,✔,TlvTypeRequestID,"Lorg/xmlpush/v3/w, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/j, Lorg/xmlpush/v3/o/j, Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/i, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/n, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/q/c, Lorg/xmlpush/v3/f/b, L/org/xmlpush/v3/o/h, L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c"
|
||||
8130,mobile target,16651328,✔,TlvTypeRequestType,
|
||||
8130,mobile target,16651584,✔,TlvTypeVersion,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c"
|
||||
8130,mobile target,16651840,✔,TlvTypeMachineID,
|
||||
8130,mobile target,16652096,✔,TlvTypeMajorNumber,
|
||||
8131,mobile target,16652352,✔,TlvTypeMinorNumber,
|
||||
8131,mobile target,16652656,✔,TlvTypeGlobalIPAddress,
|
||||
8131,mobile target,16652912,✔,TlvTypeASCII_Filename,
|
||||
8131,mobile target,16653120,✔,TlvTypeFilesize,
|
||||
8131,mobile target,16653392,✔,TlvTypeFilecount,
|
||||
8131,mobile target,16653712,✔,TlvTypeFiledata,
|
||||
8131,target reply recorded delete file mobile,16653968,✔,TlvTypeMD5Sum,
|
||||
8131,mobile target config,16654144,✔,TlvTypeProxyPort,
|
||||
8132,mobile target config,16654400,✔,TlvTypeStatus,
|
||||
8132,mobile target config,16654656,✔,TlvTypeUserID,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
8132,module load mobile target,16654912,✔,TlvTypeGroupID,
|
||||
8132,module load mobile target,16655168,✔,TlvTypePermissions,
|
||||
8132,module load mobile target,16655424,✔,TlvTypeRequestCode,
|
||||
8132,module load mobile target,16655680,✔,TlvTypeDataSize,
|
||||
8132,,16655936,✔,TlvTypeKeyType,
|
||||
8132,,16656240,✔,TlvTypeEmail,
|
||||
8133,,16656432,✔,TlvTypeEnabled,
|
||||
8133,,16656688,✔,TlvTypeLicensed,
|
||||
8133,,16656960,✔,TlvTypeAudioFrequency,"Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/n"
|
||||
8133,,16657216,✔,TlvTypeAudioBitsPerSample,"Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/n"
|
||||
8133,,16657472,✔,TlvTypeAudioChannels,"Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/n"
|
||||
8133,,16657728,✔,TlvTypeStartTime,
|
||||
8133,config,16657984,✔,TlvTypeStopTime,
|
||||
8133,config,16658240,✔,TlvTypeBitMask,
|
||||
8134,config,16658560,✔,TlvTypeTimeZone,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/t/d, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/i, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/n, Lorg/xmlpush/v3/a/a, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/i/a"
|
||||
8134,,16658816,✔,TlvTypeDateTime,"Lorg/xmlpush/v3/t/d, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b"
|
||||
8134,,16659072,✔,TlvTypeStartSessionDateTime,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/i, Lorg/xmlpush/v3/o/n, Lorg/xmlpush/v3/a/a, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/i/a"
|
||||
8134,,16659328,✔,TlvTypeStopSessionDateTime,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/n"
|
||||
8134,,16659520,✔,TlvTypeDateTimeRef,"L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c"
|
||||
8134,,16659776,✔,TlvTypeScheduleRepeat,"L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c"
|
||||
8134,,16660032,✔,TlvTypeUnixMasterDateTime,
|
||||
8134,,16660288,✔,TlvTypeUnixUTCDateTime,
|
||||
8135,,16660544,✔,TlvTypeDurationInSeconds,Lorg/xmlpush/v3/f/b
|
||||
8135,,16660864,✔,TlvTypeMasterRefTime,
|
||||
8135,,16661120,✔,TlvTypeMasterRefTimeStart,
|
||||
8135,values gps valid,16661376,✔,TlvTypeMasterRefTimeEnd,
|
||||
8135,,16661568,✔,TlvTypeCounter,"Lorg/xmlpush/v3/q/c, Lorg/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c"
|
||||
8135,,16661888,✔,TlvTypeWhiteListEntry,type: byte array
|
||||
8135,,16662144,✔,TlvTypeBlackListEntry,type: array
|
||||
8135,,16662336,✔,TlvTypeBlackWhiteListingMode,
|
||||
8136,config,16662576,✔,TlvTypeConfigEnabled,
|
||||
8136,config,16662848,✔,TlvTypeConfigMaxRecordingSize,
|
||||
8136,config,16663104,✔,TlvTypeConfigAudioQuality,"Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/n, L/org/xmlpush/v3/h/c"
|
||||
8136,config,16663344,✔,TlvTypeConfigVideoBlackAndWhite,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b, L/org/xmlpush/v3/h/c"
|
||||
8136,config,16663616,✔,TlvTypeConfigVideoResolution,L/org/xmlpush/v3/h/c
|
||||
8136,config,16663872,✔,TlvTypeConfigCaptureFrequency,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b, L/org/xmlpush/v3/h/c"
|
||||
8136,config,16664128,✔,TlvTypeConfigVideoQuality,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b, L/org/xmlpush/v3/h/c"
|
||||
8136,config,16664384,✔,TlvTypeConfigFilesStandardFilter,
|
||||
8137,config,16664704,✔,TlvTypeConfigFilesCustomFilter,
|
||||
8137,config,16664896,✔,TlvTypeConfigStandardLocation,
|
||||
8137,config,16665216,✔,TlvTypeConfigCustomLocation,
|
||||
8137,config,16665408,✔,TlvTypeConfigFileChunkSize,
|
||||
8137,config,16665664,✔,TlvTypeConfigFileTransferSpeed,
|
||||
8137,config,16665904,✔,TlvTypeConfigUploadFileOverwrite,
|
||||
8137,config,16666160,✔,TlvTypeConfigDeleteOverReboot,
|
||||
8137,config,16666496,✔,TlvTypeConfigCustomLocationException,
|
||||
8138,master mobile,16666752,✔,TlvTypeExtraData,
|
||||
8138,master mobile,16667008,✔,TlvTypeSignature,
|
||||
8138,,16667264,✔,TlvTypeComments,
|
||||
8138,,16667520,✔,TlvTypeDescription,
|
||||
8138,,16667776,✔,TlvTypeFilenameExtension,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/f/b"
|
||||
8138,,16668032,✔,TlvTypeSessionType,
|
||||
8138,,16668224,✔,TlvTypePeriod,
|
||||
8138,,16668512,✔,TlvTypeMobileTargetUID,"Lorg/xmlpush/v3/w, Lorg/xmlpush/v3/o/g, Lorg/xmlpush/v3/o/c, Lorg/xmlpush/v3/a/a, Lorg/xmlpush/v3/q/c, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/h/c, Lorg/xmlpush/v3/h/c, L/org/xmlpush/v3/o/h, L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c"
|
||||
8139,,16668784,✔,TlvTypeMobileTargetID,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
8139,,16669072,✔,TlvTypeMobilePlaintext,
|
||||
8139,,16669328,✔,TlvTypeMobileCompression,Lorg/xmlpush/v3/k
|
||||
8139,,16669584,✔,TlvTypeMobileEncryption,"Lorg/xmlpush/v3/o/m, Lorg/xmlpush/v3/h/c"
|
||||
8139,,16669824,✔,TlvTypeEncodingType,
|
||||
8139,,16670576,✔,TlvTypePhoneNumber,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/t/d, Lorg/xmlpush/v3/a/a, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/i/a"
|
||||
8140,custom config location mode,16670784,✔,TlvTypeConfigCustomLocationMode,
|
||||
8140,custom config location mode,16672080,×,unknown,Lorg/xmlpush/v3/n/k
|
||||
8140,custom config location mode,16671792,×,unknown,Lorg/xmlpush/v3/n/m
|
||||
8142,network interface,16674928,✔,TlvTypeNetworkInterface,
|
||||
8142,network interface,16675136,✔,TlvTypeNetworkInterfaceMode,
|
||||
8142,network interface,16675440,✔,TlvTypeNetworkInterfaceAddress,
|
||||
8142,network interface,16675696,✔,TlvTypeNetworkInterfaceNetmask,
|
||||
8142,network interface,16675952,✔,TlvTypeNetworkInterfaceGateway,
|
||||
8142,network interface,16676208,✔,TlvTypeNetworkInterfaceDNS_1,
|
||||
8142,network interface,16676464,✔,TlvTypeNetworkInterfaceDNS_2,
|
||||
8143,,16677440,✔,TlvTypeLoginTime,
|
||||
8143,,16677696,✔,TlvTypeLogoffTime,
|
||||
8143,,16678720,✔,TlvTypeGeneric_Type,
|
||||
8144,,16678976,✔,TlvTypeChecksum,
|
||||
8144,,16679280,✔,TlvTypeCity,
|
||||
8144,,16679536,✔,TlvTypeCountry,
|
||||
8144,,16679792,✔,TlvTypeCountryCode,
|
||||
8146,,16683072,✔,TlvTypeTargetType,
|
||||
8146,,16683392,✔,TlvTypeDurationString,Lorg/xmlpush/v3/o/a
|
||||
8146,,16683904,×,unknown,Lorg/xmlpush/v3/n/m
|
||||
8146,,16684848,×,unknown,"Lorg/xmlpush/v3/o/k, L/org/xmlpush/v3/h/c"
|
||||
8160,,16712000,✔,TlvTypeTargetConnectionBroken,
|
||||
8160,,16712256,✔,TlvTypeAgentConnectionBroken,
|
||||
8160,,16712512,✔,TlvTypeTargetOffline,
|
||||
8176,,16744768,✔,TlvTypeProxyConnectionBroken,
|
||||
4242,,8688960,×,unknown,Lorg/xmlpush/v3/w
|
||||
4242,,8689296,×,unknown,Lorg/xmlpush/v3/w
|
||||
4242,,8689568,×,unknown,Lorg/xmlpush/v3/w
|
||||
2752,,5636992,×,unknown,Lorg/xmlpush/v3/n/k
|
||||
2752,,5637504,×,unknown,Lorg/xmlpush/v3/n/k
|
||||
2752,,5637760,×,unknown,Lorg/xmlpush/v3/n/k
|
||||
2752,,5636464,×,unknown,Lorg/xmlpush/v3/n/m
|
||||
2752,,5636736,×,unknown,Lorg/xmlpush/v3/n/m
|
||||
2752,,5637248,×,unknown,Lorg/xmlpush/v3/n/m
|
||||
2753,,5638256,×,unknown,Lorg/xmlpush/v3/n/m
|
||||
2753,,5638768,×,unknown,Lorg/xmlpush/v3/n/m
|
||||
2754,,5641600,×,unknown,Lorg/xmlpush/v3/n/m
|
||||
2754,,5640608,×,unknown,Lorg/xmlpush/v3/n/m
|
||||
2754,,5641120,×,unknown,Lorg/xmlpush/v3/n/m
|
||||
2754,,5640864,×,unknown,Lorg/xmlpush/v3/n/m
|
||||
2754,,5640352,×,unknown,Lorg/xmlpush/v3/n/m
|
||||
2218,,4542832,×,unknown,Lorg/xmlpush/v3/t/d
|
||||
2218,,4542624,×,unknown,Lorg/xmlpush/v3/t/d
|
||||
8147,,16685104,×,unknown,"Lorg/xmlpush/v3/o/k, L/org/xmlpush/v3/h/c"
|
||||
8147,,16685392,×,unknown,"Lorg/xmlpush/v3/o/k, L/org/xmlpush/v3/h/c"
|
||||
2658,,5444000,×,unknown,Lorg/xmlpush/v3/o/k
|
||||
2658,,5444512,×,unknown,Lorg/xmlpush/v3/o/k
|
||||
2656,,5440320,×,unknown,Lorg/xmlpush/v3/o/k
|
||||
2656,,5439904,×,unknown,Lorg/xmlpush/v3/o/k
|
||||
2660,,5447840,×,unknown,Lorg/xmlpush/v3/o/k
|
||||
2722,,5575072,×,unknown,Lorg/xmlpush/v3/o/a
|
||||
2722,,5575328,×,unknown,Lorg/xmlpush/v3/o/a
|
||||
2722,config,5575840,×,unknown,Lorg/xmlpush/v3/o/a
|
||||
2560,config,5243552,×,unknown,Lorg/xmlpush/v3/o/i
|
||||
2560,config,5243296,×,unknown,Lorg/xmlpush/v3/o/i
|
||||
4244,config,8693104,×,unknown,Lorg/xmlpush/v3/o/g
|
||||
4244,config,8692080,×,unknown,Lorg/xmlpush/v3/o/g
|
||||
4244,config,8692336,×,unknown,Lorg/xmlpush/v3/o/g
|
||||
4244,config,8692592,×,unknown,Lorg/xmlpush/v3/o/g
|
||||
4244,config,8692848,×,unknown,Lorg/xmlpush/v3/o/g
|
||||
4244,config,8693360,×,unknown,Lorg/xmlpush/v3/o/g
|
||||
4244,config,8691872,×,unknown,Lorg/xmlpush/v3/o/g
|
||||
2690,config,5509536,×,unknown,Lorg/xmlpush/v3/o/b
|
||||
2690,config,5510048,×,unknown,Lorg/xmlpush/v3/o/b
|
||||
2692,config,5513376,×,unknown,Lorg/xmlpush/v3/o/b
|
||||
2688,config,5505856,×,unknown,Lorg/xmlpush/v3/o/b
|
||||
2688,config,5505440,×,unknown,Lorg/xmlpush/v3/o/b
|
||||
2592,config,5309088,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
2602,,5329824,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
2602,,5330592,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
2602,,5329568,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
2602,,5330080,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
2596,,5317536,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
2596,,5317792,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
2596,,5318048,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
2596,,5317280,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
2594,,5313440,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
2594,,5312928,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
2594,,5313184,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
2600,,5325216,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
2598,,5321376,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
2598,,5322144,×,unknown,Lorg/xmlpush/v3/o/e
|
||||
2784,mode location custom config,5703584,×,unknown,Lorg/xmlpush/v3/o/n
|
||||
2784,mode location custom config,5703328,×,unknown,Lorg/xmlpush/v3/o/n
|
||||
2784,mode location custom config,5702816,×,unknown,Lorg/xmlpush/v3/o/n
|
||||
2784,interface network,5702032,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
2784,interface network,5702304,×,unknown,Lorg/xmlpush/v3/h/c
|
||||
2785,interface network,5703808,×,unknown,Lorg/xmlpush/v3/o/n
|
||||
2785,interface network,5704064,×,unknown,Lorg/xmlpush/v3/o/n
|
||||
1757,interface network,3600000,×,unknown,Lorg/xmlpush/v3/b/f
|
||||
2696,interface network,5521552,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
2696,interface network,5521568,×,unknown,Lorg/xmlpush/v3/h/c
|
||||
2720,,5570960,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
2720,,5571232,×,unknown,Lorg/xmlpush/v3/h/c
|
||||
2756,,5644432,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
2756,,5644704,×,unknown,Lorg/xmlpush/v3/h/c
|
||||
2848,,5833104,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
2848,,5833376,×,unknown,Lorg/xmlpush/v3/h/c
|
||||
3104,,6357392,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
3104,,6357664,×,unknown,Lorg/xmlpush/v3/h/c
|
||||
2664,,5456016,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
2664,,5456288,×,unknown,Lorg/xmlpush/v3/h/c
|
||||
4243,,8690064,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c"
|
||||
4243,,8690336,×,unknown,Lorg/xmlpush/v3/h/c
|
||||
4243,,8689712,×,unknown,"Lorg/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c"
|
||||
2304,,4719008,×,unknown,Lorg/xmlpush/v3/d/a
|
||||
2304,,4719232,×,unknown,Lorg/xmlpush/v3/d/a
|
||||
3106,,6361200,×,unknown,Lorg/xmlpush/v3/k/c
|
||||
16425,,33639248,×,unknown,Lorg/xmlpush/v3/h/a
|
||||
48781,,99903492,×,unknown,"Lorg/b/b/e$gs, L/org/b/b/e$r"
|
||||
41609,,85215461,×,unknown,"Lorg/b/b/e$df, L/org/b/b/e$j"
|
||||
4494,,9203775,×,unknown,"Lorg/b/b/e$ol, L/org/b/b/e$pi"
|
||||
25586,,52401552,×,unknown,"Lorg/b/b/e$js, L/org/b/b/e$x"
|
||||
21214,,43446532,×,unknown,"Lorg/b/b/e$ec, L/org/b/b/e$m"
|
||||
27793,,56920439,×,unknown,"Lorg/b/b/e$az, L/org/b/b/e$d"
|
||||
26992,,55281185,×,unknown,"Lorg/b/b/e$nj, L/org/b/b/e$ag"
|
||||
44308,,90744648,×,unknown,"Lorg/b/b/e$ew, L/org/b/b/e$ev"
|
||||
|
@@ -0,0 +1,4 @@
|
||||
flash.browserupdate.download
|
||||
current.browserupdate.download
|
||||
files.browserupdate.download
|
||||
browserupdate.download
|
||||
6
data/ioc/spyware/amnesty/2020-09-25_finfisher/ips.txt
Normal file
6
data/ioc/spyware/amnesty/2020-09-25_finfisher/ips.txt
Normal file
@@ -0,0 +1,6 @@
|
||||
172.241.27.171
|
||||
5.135.174.213
|
||||
158.69.105.207
|
||||
207.244.95.223
|
||||
45.11.19.235
|
||||
185.125.230.203
|
||||
174
data/ioc/spyware/amnesty/2020-09-25_finfisher/rules.yar
Normal file
174
data/ioc/spyware/amnesty/2020-09-25_finfisher/rules.yar
Normal file
@@ -0,0 +1,174 @@
|
||||
rule finspy_linux_installer1 {
|
||||
meta:
|
||||
description = "Rule for FinSpy Linux installer x86 or x64"
|
||||
author = "Etienne Maynier, Amnesty Tech"
|
||||
sample = "8aaf886a2a2cd459e65277343bc951a2d23555980eddd73218a5c608e6d2a29c"
|
||||
strings:
|
||||
$a = "%s/.kde/Autostart" ascii wide nocase
|
||||
$b = "%s/.kde4/Autostart" ascii wide nocase
|
||||
$c = "dmesg --notime 2>/dev/null | grep -i \"hypervisor detected\" | cut -d ':' -f2" ascii wide nocase
|
||||
$d = "g_plauncher" ascii wide nocase
|
||||
$e = "g_pinstall_host_location" ascii wide nocase
|
||||
$f = "g_pinstall_folder" ascii wide nocase
|
||||
$g = "%s/.bash_profile" ascii wide nocase
|
||||
$h = "lspci 2>/dev/null | grep -i \"system peripheral\" | grep -i \"virtual\"" ascii wide nocase
|
||||
$i = "lspci | grep -i \"system peripheral\" | grep -i \"virtual\"" ascii nocase
|
||||
|
||||
condition:
|
||||
7 of them
|
||||
}
|
||||
|
||||
rule finppy_linux_coremodule {
|
||||
meta:
|
||||
description = "Rule for FinSpy Linux core module x86 or x64"
|
||||
author = "Etienne Maynier, Amnesty Tech"
|
||||
strings:
|
||||
$s1 = "ps auxww | grep -iEe 'bt-scan' | grep -v -e grep" ascii
|
||||
$s2 = "ls /sys/class/net/ 2>/dev/null | awk '{printf (\"%s\n\", $1)}' 2>/dev/null" ascii
|
||||
$s3 = "cat /sys/class/net/eth?/address 2>/dev/null" ascii
|
||||
$s4 = "dmesg --notime 2>/dev/null | grep -i \"cpu\" | grep -i \"virtual\"" ascii
|
||||
$s5 = "/etc/hostname-merlin" ascii
|
||||
$s6 = "@%02X%X%c%08X.dat" ascii
|
||||
$s7 = "%s/.bash_profile1" ascii
|
||||
$s8 = "%s/.kde4/share/config" ascii
|
||||
$s9 = "ls /dev/disk/by-id/ 2>/dev/null" ascii
|
||||
$s10 = "/index.php HTTP/1.1" ascii
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x457F and 8 of them
|
||||
}
|
||||
|
||||
rule finspy_linux_installer2 {
|
||||
meta:
|
||||
description = "Rule for FinSpy Linux installer"
|
||||
author = "Etienne Maynier, Amnesty Tech"
|
||||
|
||||
strings:
|
||||
$encrypted_conf = { 5? a5 aa ca a6 54 5a ?? a? 5a a5 0a } /* header of configuration files */
|
||||
$encrypted_bin_32 = { 7f 0d 45 4c 46 01 02 c2 14 68 03 05 0e } /* header of encrypted bin */
|
||||
$encrypted_bin_64 = { 7f 07 45 4c 46 02 01 1e 15 01 8e 03 0e } /* header of encrypted bin */
|
||||
|
||||
condition:
|
||||
(uint16(0) == 0x457F or uint16(0) == 0x2123) and (#encrypted_conf > 5 or #encrypted_bin_32 > 5 or #encrypted_bin_64 > 5)
|
||||
}
|
||||
|
||||
rule finspy_macos_installer {
|
||||
meta:
|
||||
description = "Rule for FinSpy OSX installer"
|
||||
author = "Etienne Maynier, Amnesty Tech"
|
||||
|
||||
strings:
|
||||
$s1 = "80.bundle.zip" ascii
|
||||
$s2 = "AAC.dat" ascii
|
||||
$s3 = "arch.zip" ascii
|
||||
$s4 = "/Library/LaunchAgents" ascii
|
||||
$s5 = "7FC.dat" ascii
|
||||
$s6 = "logind.plist" ascii
|
||||
$s7 = "org.logind.ctp.archive" ascii
|
||||
$s8 = "helper" ascii
|
||||
$s9 = "Contents/Resources/7f.bundle/Contents/Resources" ascii
|
||||
|
||||
condition:
|
||||
uint16(0) == 0xFACF and 8 of them
|
||||
}
|
||||
|
||||
rule finspy_macos_datapkg {
|
||||
meta:
|
||||
description = "Rule for FinSpy OSX core module"
|
||||
author = "Etienne Maynier, Amnesty Tech"
|
||||
|
||||
strings:
|
||||
$s1 = "vlacwjwcefforoxisdryuvbqlxvxt" ascii
|
||||
$s2 = "vquyqefxqpwytfuherfvzwaqqyanaddmvquyqefxqpwytfu" ascii
|
||||
$s3 = "vsczabsutfuhajffslhlkulomhivwligvscza:" ascii
|
||||
$s4 = "ijfrkptshbsurggfqxshpiolwupesxewijfrkptxnj" ascii
|
||||
$s5 = "wwsodegezqrtafprejkrytzablizbddgwwsodegezqrtafprejxnj" ascii
|
||||
$s6 = "clfggqtyflyspjewoxpodxesnpavcpofclfggqtyflyspjewoxpodxesnpavcpofclfggqtyflyspjewoxpodx" ascii
|
||||
$s7 = "mhqxzxdbxsfblsxmidzcribjewzkezujmhqxzxdbxsfblsxmidzcribjewzkezujmh" ascii
|
||||
$s8 = "sqpviurrqssxwzrzdwldcanprnsuadyhsqpvixnj" ascii
|
||||
$s9 = "zfocytolmylaejykmwphsbchfkfzyadbzfocytolmylaejykmwphsbchfkfzyadbz" ascii
|
||||
$s10 = "fehbsdjwmqrdndkskegllpixxabegjrdfehbsdjwmqrdndkske" ascii
|
||||
$s11 = "exmycityouezjfdczebdfhqdgt:" ascii
|
||||
$s12 = "denueozlbzhqzzdjhxjnjhoadjdsmashdenueozlbzhqzzd" ascii
|
||||
|
||||
|
||||
condition:
|
||||
uint16(0) == 0xFACF and 8 of them
|
||||
}
|
||||
|
||||
rule finspy_android_configinapk : android apkhideconfig finspy {
|
||||
meta:
|
||||
description = "Detect FinFisher FinSpy configuration in APK file. Probably the original FinSpy version."
|
||||
date = "2020/08/05"
|
||||
reference = "https://github.com/devio/FinSpy-Tools"
|
||||
author = "Esther Onfroy a.k.a U+039b - *@0x39b.fr (https://twitter.com/u039b)"
|
||||
warning = "May have some False Positive"
|
||||
|
||||
strings:
|
||||
$re = /\x50\x4B\x01\x02[\x00-\xff]{32}[A-Za-z0-9+\/]{6}/
|
||||
|
||||
condition:
|
||||
uint32(0) == 0x04034b50 and $re and (#re > 50)
|
||||
}
|
||||
|
||||
rule finspy_android_dexden : android dexhideconfig finspy
|
||||
{
|
||||
meta:
|
||||
description = "Detect FinFisher FinSpy configuration in DEX file. Probably a newer FinSpy variant."
|
||||
date = "2020/08/05"
|
||||
author = "Esther Onfroy a.k.a U+039b - *@0x39b.fr (https://twitter.com/u039b)"
|
||||
|
||||
strings:
|
||||
$config_1 = { 90 5b fe 00 }
|
||||
$config_2 = { 70 37 80 00 }
|
||||
$config_3 = { 40 38 80 00 }
|
||||
$config_4 = { a0 33 84 }
|
||||
$config_5 = { 90 79 84 00 }
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x6564 and
|
||||
#config_1 >= 2 and
|
||||
#config_2 >= 2 and
|
||||
#config_3 >= 2 and
|
||||
#config_4 >= 2 and
|
||||
#config_5 >= 2
|
||||
}
|
||||
|
||||
rule FinSpy_TippyTime: finspyTT {
|
||||
meta:
|
||||
description = "Detect FinFisher FinSpy 'TippyTime' variant."
|
||||
date = "2020/08/05"
|
||||
author = "Esther Onfroy a.k.a U+039b - *@0x39b.fr (https://twitter.com/u039b)"
|
||||
strings:
|
||||
$config_1 = { 90 5b fe 00 }
|
||||
$config_2 = { 70 37 80 00 }
|
||||
$config_3 = { 40 38 80 00 }
|
||||
$config_4 = { a0 33 84 }
|
||||
$config_5 = { 90 79 84 00 }
|
||||
$timestamp = { 95 E9 D1 5B }
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x6564 and
|
||||
$timestamp and
|
||||
$config_1 and
|
||||
$config_2 and
|
||||
$config_3 and
|
||||
$config_4 and
|
||||
$config_5
|
||||
}
|
||||
|
||||
rule FinSpy_TippyPad: finspyTP
|
||||
{
|
||||
meta:
|
||||
description = "Detect FinFisher FinSpy 'TippyPad' variant."
|
||||
date = "2020/08/05"
|
||||
author = "Esther Onfroy a.k.a U+039b - *@0x39b.fr (https://twitter.com/u039b)"
|
||||
strings:
|
||||
$pad_1 = "0123456789abcdef"
|
||||
$pad_2 = "fedcba9876543210"
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x6564 and
|
||||
#pad_1 > 50 and
|
||||
#pad_2 > 50
|
||||
}
|
||||
@@ -0,0 +1,115 @@
|
||||
import argparse
|
||||
import struct
|
||||
import re
|
||||
import sys
|
||||
import json
|
||||
|
||||
"""
|
||||
Extract configuration from a Cobalt Strike decrypted beacon
|
||||
|
||||
Author : Etienne Maynier, Amnesty Tech
|
||||
Date : March 2020
|
||||
"""
|
||||
|
||||
CONFIG_STRUCT = {
|
||||
1: "dns_ssl",
|
||||
2: "port",
|
||||
3: ".sleeptime",
|
||||
4: ".http-get.server.output",
|
||||
5: ".jitter",
|
||||
6: ".maxdns",
|
||||
7: "publickey",
|
||||
8: ".http-get.uri",
|
||||
9: ".user-agent",
|
||||
10: ".http-post.uri",
|
||||
11: ".http-get.server.output",
|
||||
12: ".http-get.client",
|
||||
13: ".http-post.client",
|
||||
14: ".spawnto",
|
||||
15: "unknown",
|
||||
19: ".dns_idle",
|
||||
20: ".dns_sleep ",
|
||||
26: ".http-get.verb",
|
||||
27: ".http-post.verb",
|
||||
28: "shouldChunkPosts",
|
||||
29: ".post-ex.spawnto_x86",
|
||||
30: ".post-ex.spawnto_x64",
|
||||
31: "cryptoscheme",
|
||||
37: "watermark",
|
||||
38: ".stage.cleanup",
|
||||
39: "CFGCaution",
|
||||
50: "cookieBeacon"
|
||||
}
|
||||
CONFIG_SIZE = 1978
|
||||
|
||||
class JsonEncoder(json.JSONEncoder):
|
||||
def default(self, obj):
|
||||
if isinstance(obj, bytearray):
|
||||
return obj.hex()
|
||||
return json.JSONEncoder.default(self, obj)
|
||||
|
||||
|
||||
def search_config(data):
|
||||
r = re.search(b"ihihik.{2}ikihik", data)
|
||||
if r:
|
||||
return r.span()[0]
|
||||
else:
|
||||
return None
|
||||
|
||||
|
||||
def decode_config(data):
|
||||
config = {}
|
||||
i = 0
|
||||
while i < len(data) - 8:
|
||||
dec = struct.unpack(">HHH", data[i:i+6])
|
||||
if dec[0] == 1:
|
||||
v = struct.unpack(">H", data[i+6:i+8])[0]
|
||||
config["dns"] = ((v & 1) == 1)
|
||||
config["ssl"] = ((v & 8) == 8)
|
||||
elif dec[0] in CONFIG_STRUCT.keys():
|
||||
if dec[1] == 1 and dec[2] == 2:
|
||||
# Short
|
||||
config[CONFIG_STRUCT[dec[0]]] = struct.unpack(">H", data[i+6:i+8])[0]
|
||||
elif dec[1] == 2 and dec[2] == 4:
|
||||
# Int
|
||||
config[CONFIG_STRUCT[dec[0]]] = struct.unpack(">I", data[i+6:i+10])[0]
|
||||
elif dec[1] == 3:
|
||||
# Byte or string
|
||||
v = data[i+6:i+6+dec[2]]
|
||||
try:
|
||||
config[CONFIG_STRUCT[dec[0]]] = v.decode('utf-8').strip('\x00')
|
||||
except UnicodeDecodeError:
|
||||
config[CONFIG_STRUCT[dec[0]]] = v
|
||||
else:
|
||||
print("Unknown config command {}".format(dec[0]))
|
||||
# Add size +
|
||||
i += dec[2] + 6
|
||||
return config
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
parser = argparse.ArgumentParser(description='Extract Cobalt Strike configuration')
|
||||
parser.add_argument('PAYLOAD', help='A Cobalt Strike beacon')
|
||||
parser.add_argument('--json', '-j', action="store_true", help='Print json')
|
||||
args = parser.parse_args()
|
||||
|
||||
with open(args.PAYLOAD, "rb") as f:
|
||||
data = f.read()
|
||||
|
||||
START = search_config(data)
|
||||
if not START:
|
||||
print("Start position of the config struct not found")
|
||||
sys.exit(-1)
|
||||
|
||||
# Configuration is xored with 105
|
||||
conf = bytearray([c ^ 105 for c in data[START:START+CONFIG_SIZE]])
|
||||
|
||||
config = decode_config(conf)
|
||||
if args.json:
|
||||
print(json.dumps(config, indent=4, sort_keys=True, cls=JsonEncoder))
|
||||
else:
|
||||
for d in config:
|
||||
if isinstance(config[d], bytearray):
|
||||
print("{} : {}".format(d, config[d].hex()))
|
||||
else:
|
||||
print("{} : {}".format(d, config[d]))
|
||||
@@ -0,0 +1,51 @@
|
||||
import argparse
|
||||
import struct
|
||||
import sys
|
||||
|
||||
"""
|
||||
Decrypt a Cobalt Strike encrypted beacon
|
||||
|
||||
Author: Etienne Maynier, Amnesty Tech
|
||||
Date: March 2020
|
||||
"""
|
||||
|
||||
def xor(a, b):
|
||||
return bytearray([a[0]^b[0], a[1]^b[1], a[2]^b[2], a[3]^b[3]])
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
parser = argparse.ArgumentParser(description='Decode an encoded Cobalt Strike beacon')
|
||||
parser.add_argument('PAYLOAD', help='an integer for the accumulator')
|
||||
args = parser.parse_args()
|
||||
|
||||
with open(args.PAYLOAD, "rb") as f:
|
||||
data = f.read()
|
||||
|
||||
# The base address of the sample change depending on the code
|
||||
ba = data.find(b"\xe8\xd4\xff\xff\xff")
|
||||
if ba == -1:
|
||||
ba = data.find(b"\xe8\xd0\xff\xff\xff")
|
||||
if ba == -1:
|
||||
print("Base Address not found")
|
||||
sys.exit(1)
|
||||
ba += 5
|
||||
|
||||
key = data[ba:ba+4]
|
||||
print("Key : {}".format(key))
|
||||
size = struct.unpack("I", xor(key, data[ba+4:ba+8]))[0]
|
||||
print("Size : {}".format(size))
|
||||
|
||||
res = bytearray()
|
||||
i = ba+8
|
||||
while i < (len(data) - ba - 8):
|
||||
d = data[i:i+4]
|
||||
res += xor(d, key)
|
||||
key = d
|
||||
i += 4
|
||||
|
||||
if not res.startswith(b"MZ"):
|
||||
print("Invalid decoding, no PE header")
|
||||
|
||||
with open("a.out", "wb+") as f:
|
||||
f.write(res)
|
||||
print("PE file extracted in a.out")
|
||||
@@ -0,0 +1,56 @@
|
||||
import sys
|
||||
import os
|
||||
import struct
|
||||
import hashlib
|
||||
import ctypes
|
||||
import binascii
|
||||
import argparse
|
||||
from Crypto.Cipher import AES
|
||||
"""
|
||||
Decode FinSpy modules for Linux and MacOS
|
||||
|
||||
Author : Maciek mak@malwarelab.pl
|
||||
Date: August 2020
|
||||
"""
|
||||
|
||||
|
||||
def unpack(data, s=0):
|
||||
"""
|
||||
Decode the binary with aplib
|
||||
"""
|
||||
cin = ctypes.c_buffer(data)
|
||||
cout = ctypes.c_buffer(s if s else len(data) * 20)
|
||||
aplib_path = os.path.join(
|
||||
os.path.dirname(os.path.realpath(__file__)),
|
||||
"_aplib.so")
|
||||
aPLIB = ctypes.cdll.LoadLibrary(aplib_path)
|
||||
n = aPLIB.aP_depack(cin, cout)
|
||||
return cout.raw[:n]
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
parser = argparse.ArgumentParser(description='Unpack FinSpy modules')
|
||||
parser.add_argument('MODULE', help='Finspy module')
|
||||
args = parser.parse_args()
|
||||
|
||||
with open(args.MODULE,'rb') as f:
|
||||
hmd5 = f.read(0x10)
|
||||
IV = f.read(0x10)
|
||||
data = f.read()
|
||||
|
||||
hash_iv_data = hashlib.md5(IV + data)
|
||||
if hmd5 == hash_iv_data.digest():
|
||||
data = IV + data
|
||||
IV = b'\xd9!V\xee\xbe\x0c\xf9\x18*\xfaR;%&\xb7\x08'
|
||||
|
||||
if hmd5 == hashlib.md5(data).digest():
|
||||
print('[+] DATA HASH match {}'.format(binascii.hexlify(hmd5)))
|
||||
|
||||
key = b'YO\xf4\xa6\xd6\x1d\xd7!\xdc\x01A\xbfg\x83"m'
|
||||
xdata = AES.new(key,mode=AES.MODE_CBC,IV=bytes(IV)).decrypt(data)
|
||||
size = struct.unpack('I',xdata[:4])[0]
|
||||
print('[+] Unpacked size: {:x}'.format(size))
|
||||
depack = unpack(xdata[4:], size)
|
||||
with open(args.MODULE + '.unpacked.bin','wb') as f:
|
||||
f.write(depack)
|
||||
print('[*] saved to {}.unpacked.bin'.format(sys.argv[1]))
|
||||
@@ -0,0 +1,38 @@
|
||||
import os
|
||||
import sys
|
||||
import argparse
|
||||
import re
|
||||
import struct
|
||||
|
||||
"""
|
||||
Extract configuration of Linux FinSpy from an installer
|
||||
author: Etienne Maynier, Amnesty Tech
|
||||
"""
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
parser = argparse.ArgumentParser(description='Extract configuration Linux Finspy sample')
|
||||
parser.add_argument('FILE', help='FinSpy sample for Linux')
|
||||
args = parser.parse_args()
|
||||
|
||||
regex_cfg = re.compile(b'.[\x50-\x5f]\xa5\xaa\xca\xa6\x54\x5a.[\xa0-\xaf]\x5a\xa5\x0a')
|
||||
|
||||
with open(args.FILE, 'rb') as f:
|
||||
data = f.read()
|
||||
|
||||
if len(regex_cfg.findall(data)) < 5:
|
||||
print("This does not look like a FinSpy sample")
|
||||
sys.exit(-1)
|
||||
|
||||
if not os.path.isdir('extracted'):
|
||||
os.mkdir('extracted')
|
||||
|
||||
i = 1
|
||||
for cfg in regex_cfg.finditer(data):
|
||||
pos = cfg.span()[0]
|
||||
# Decrypt the first 4 bytes to get the length
|
||||
length = struct.unpack('I', bytearray([data[pos]^0xaa, data[pos+1]^0x5a, data[pos+2]^0xa5, data[pos+3]^0xaa]))[0]
|
||||
with open('extracted/{0:02d}.dat'.format(i), 'wb+') as f:
|
||||
f.write(data[pos:pos+length])
|
||||
print("Configuration file extracted {0:02d}.dat ({} bytes)".format(i, length))
|
||||
i += 1
|
||||
@@ -0,0 +1,872 @@
|
||||
import argparse
|
||||
import os
|
||||
import sys
|
||||
import struct
|
||||
#import simplejson as json
|
||||
from json import JSONEncoder
|
||||
import json
|
||||
from io import BytesIO
|
||||
"""
|
||||
Decode configuration from FinSpy Linux, MacOS and Android samples
|
||||
Python3 only
|
||||
"""
|
||||
|
||||
__author__ = "Maciek mak@malwarelab.pl"
|
||||
|
||||
|
||||
# From https://github.com/devio/FinSpy-Tools/blob/master/Android/finspyCfgParse.py
|
||||
tlv_types = {
|
||||
4522400: "TlvTypeMobileTrackingStartRequest",
|
||||
4522656: "TlvTypeMobileTrackingStopRequest",
|
||||
4523376: "TlvTypeMobileTrackingDataV10",
|
||||
4535200: "TlvTypeMobileTrackingConfig",
|
||||
4535440: "TlvTypeMobileTrackingConfigRaw",
|
||||
4538432: "TlvTypeMobileTrackingTimeInterval",
|
||||
4538688: "TlvTypeMobileTrackingDistance",
|
||||
4538928: "TlvTypeMobileTrackingSendOnAnyChannel",
|
||||
6291872: "TlvTypeMobileLoggingMetaInfo",
|
||||
6292096: "TlvTypeMobileLoggingData",
|
||||
4456864: "TlvTypeMobileBlackberryMessengerMetaInfo",
|
||||
4457088: "TlvTypeMobileBlackberryMessengerData",
|
||||
4457328: "TlvTypeMobileBlackberryMsChatID",
|
||||
4457600: "TlvTypeMobileBlackberryMsConversationPartners",
|
||||
4587936: "TlvTypeMobilePhoneCallLogsMetaInfo",
|
||||
4588192: "TlvTypeMobilePhoneCallLogsData",
|
||||
4588400: "TlvTypeMobilePhoneCallLogsType",
|
||||
4588672: "TlvTypeMobilePhoneCallAdditionalInformation",
|
||||
4588912: "TlvTypeMobilePhoneCallLogsCallerNumber",
|
||||
4589168: "TlvTypeMobilePhoneCallLogsCalleeNumber",
|
||||
4589440: "TlvTypeMobilePhoneCallLogsCallerName",
|
||||
4589696: "TlvTypeMobilePhoneCallLogsCalleeName",
|
||||
4591680: "TlvTypeMobilePhoneCallLogLastEntryEndtime",
|
||||
4325792: "TlvTypeMobileSMSMetaInfo",
|
||||
4326016: "TlvTypeMobileSMSData",
|
||||
4326256: "TlvTypeSMSSenderNumber",
|
||||
4326512: "TlvTypeSMSRecipientNumber",
|
||||
4326768: "TlvTypeSMSDirection",
|
||||
4326528: "TlvTypeSMSInformation",
|
||||
4391328: "TlvTypeMobileAddressBookMetaInfo",
|
||||
4391552: "TlvTypeMobileAddressBookData",
|
||||
4407360: "TlvTypeMobileAddressBookChecksum",
|
||||
8978752: "TlvTypeMobileProxyMasterCommSig",
|
||||
8979104: "TlvTypeMobileProxyMasterComm",
|
||||
8979360: "TlvTypeMobileMasterProxyComm",
|
||||
8979616: "TlvTypeProxyMasterMobileHeartBeatAnswer",
|
||||
8979872: "TlvTypeMobileMasterProxyCommNotification",
|
||||
8782176: "TlvTypeProxyMobileTargetCommSig",
|
||||
8782496: "TlvTypeProxyMobileTargetComm",
|
||||
8782752: "TlvTypeProxyMasterMobileTargetComm",
|
||||
1507744: "TlvTypeAccessedFileMetaInfo",
|
||||
1507968: "TlvTypeAccessedFileAccessTime",
|
||||
1508224: "TlvTypeAccessedFileAccessEvent",
|
||||
1508496: "TlvTypeAccessedFileRecording",
|
||||
1508736: "TlvTypeAccessedApplicationName",
|
||||
1508912: "TlvTypeConfigRecordImagesFromExplorer",
|
||||
1519776: "TlvTypeGetAccessedConfigRequest",
|
||||
1520032: "TlvTypeAccessedConfigReply",
|
||||
1520288: "TlvTypeSetAccessedConfigRequest",
|
||||
1520448: "TlvTypeConfigAccessedEvents",
|
||||
2240672: "TlvTypeGetMouseClicksConfigRequest",
|
||||
2240928: "TlvTypeMouseClicksConfigReply",
|
||||
2241184: "TlvTypeSetMouseClicksConfigRequest",
|
||||
2228640: "TlvTypeMouseClicksMetaInfo",
|
||||
2228896: "TlvTypeMouseClicksFrame",
|
||||
2232448: "TlvTypeMouseClicksEncodingType",
|
||||
2232896: "TlvTypeConfigMouseClicksRectangle",
|
||||
2233152: "TlvTypeConfigMouseClicksSensitivity",
|
||||
2233408: "TlvTypeConfigMouseClicksType",
|
||||
2175136: "TlvTypeGetVoIPConfigRequest",
|
||||
2175392: "TlvTypeVoIPConfigReply",
|
||||
2175648: "TlvTypeSetVoIPConfigRequest",
|
||||
2163104: "TlvTypeVoIPMetaInfo",
|
||||
2166912: "TlvTypeVoIPEncodingType",
|
||||
2167168: "TlvTypeVoIPSessionType",
|
||||
2167424: "TlvTypeVoIPApplicationName",
|
||||
2167696: "TlvTypeVoIPAppScreenshot",
|
||||
2167952: "TlvTypeVoIPAudioRecording",
|
||||
2168112: "TlvTypeConfigVoIPScreenshotEnabled",
|
||||
2109600: "TlvTypeGetForensicsConfigRequest",
|
||||
2109856: "TlvTypeForensicsConfigReply",
|
||||
2110112: "TlvTypeSetForensicsConfigRequest",
|
||||
2097568: "TlvTypeUploadForensicsApplicationRequest",
|
||||
2097824: "TlvTypeUploadForensicsApplicationReply",
|
||||
2098080: "TlvTypeUploadForensicsApplicationChunk",
|
||||
2098336: "TlvTypeUploadForensicsApplicationDoneRequest",
|
||||
2098592: "TlvTypeUploadForensicsApplicationDoneReply",
|
||||
2101664: "TlvTypeRemoveForensicsApplicationRequest",
|
||||
2101920: "TlvTypeRemoveForensicsApplicationReply",
|
||||
2105760: "TlvTypeForensicsAppExecuteRequest",
|
||||
2106016: "TlvTypeForensicsAppExecuteReply",
|
||||
2106272: "TlvTypeForensicsAppExecuteResult",
|
||||
2106528: "TlvTypeForensicsAppExecuteResultChunk",
|
||||
2106784: "TlvTypeForensicsAppExecuteResultDone",
|
||||
2107040: "TlvTypeForensicsCancelAppExecuteRequest",
|
||||
2107296: "TlvTypeForensicsCancelAppExecuteReply",
|
||||
2113680: "TlvTypeConfigForensicsApplicationInfoGeneric",
|
||||
2113952: "TlvTypeConfigForensicsApplicationInfo",
|
||||
2117760: "TlvTypeConfigForensicsApplicationName",
|
||||
2117952: "TlvTypeConfigForensicsApplicationSize",
|
||||
2118208: "TlvTypeConfigForensicsApplicationID",
|
||||
2118528: "TlvTypeConfigForensicsApplicationCmdline",
|
||||
2118784: "TlvTypeConfigForensicsApplicationOutput",
|
||||
2118976: "TlvTypeConfigForensicsApplicationTimeout",
|
||||
2119232: "TlvTypeConfigForensicsApplicationVersion",
|
||||
2119552: "TlvTypeForensicsFriendlyName",
|
||||
2119808: "TlvTypeConfigForensicsApplicationOutputPrepend",
|
||||
2120064: "TlvTypeConfigForensicsApplicationOutputContentType",
|
||||
1638816: "TlvTypeDeletedFileMetaInfo",
|
||||
1639296: "TlvTypeDeletedFileDeletionTime",
|
||||
1639552: "TlvTypeDeletedFileRecycleBin",
|
||||
1639808: "TlvTypeDeletedMethod",
|
||||
1640064: "TlvTypeDeletedApplicationName",
|
||||
1640336: "TlvTypeDeletedFileRecording",
|
||||
1650848: "TlvTypeGetDeletedConfigRequest",
|
||||
1651104: "TlvTypeDeletedConfigReply",
|
||||
1651360: "TlvTypeSetDeletedConfigRequest",
|
||||
1573280: "TlvTypePrintFileMetaInfo",
|
||||
1573520: "TlvTypePrintFrame",
|
||||
1581184: "TlvTypePrintApplicationName",
|
||||
1581440: "TlvTypePrintFilename",
|
||||
1581696: "TlvTypePrintEncodingType",
|
||||
1585312: "TlvTypeGetPrintConfigRequest",
|
||||
1585568: "TlvTypePrintConfigReply",
|
||||
1585824: "TlvTypeSetPrintConfigRequest",
|
||||
1442208: "TlvTypeChangedFileMetaInfo",
|
||||
1442432: "TlvTypeChangedFileChangeTime",
|
||||
1442688: "TlvTypeChangedFileChangeEvent",
|
||||
1442960: "TlvTypeChangedFileRecording",
|
||||
1454240: "TlvTypeGetChangedConfigRequest",
|
||||
1454496: "TlvTypeChangedConfigReply",
|
||||
1454752: "TlvTypeSetChangedConfigRequest",
|
||||
1454912: "TlvTypeConfigChangedEvents",
|
||||
1311136: "TlvTypeSkypeAudioMetaInfo",
|
||||
1311376: "TlvTypeSkypeAudioRecording",
|
||||
1311648: "TlvTypeSkypeTextRecording",
|
||||
1311904: "TlvTypeSkypeFileMetaInfo",
|
||||
1312144: "TlvTypeSkypeFileRecording",
|
||||
1312416: "TlvTypeSkypeContactsRecording",
|
||||
1312640: "TlvTypeSkypeContactsUserData",
|
||||
1323168: "TlvTypeGetSkypeConfigRequest",
|
||||
1323424: "TlvTypeSkypeConfigReply",
|
||||
1323680: "TlvTypeSetSkypeConfigRequest",
|
||||
1324336: "TlvTypeConfigSkypeAudioEnable",
|
||||
1324592: "TlvTypeConfigSkypeTextEnable",
|
||||
1324848: "TlvTypeConfigSkypeFileEnable",
|
||||
1325104: "TlvTypeConfigSkypeContactsListEnable",
|
||||
1327232: "TlvTypeSkypeAudioEncodingType",
|
||||
1327488: "TlvTypeSkypeLoggedInUserAccountName",
|
||||
1327744: "TlvTypeSkypeConversationPartnerAccountName",
|
||||
1328000: "TlvTypeSkypeConversationPartnerDisplayName",
|
||||
1328256: "TlvTypeSkypeChatMembers",
|
||||
1328512: "TlvTypeSkypeTextMessage",
|
||||
1328768: "TlvTypeSkypeChatID",
|
||||
1329024: "TlvTypeSkypeSenderAccountName",
|
||||
1329280: "TlvTypeSkypeSenderDisplayName",
|
||||
1329536: "TlvTypeSkypeIncoming",
|
||||
1329792: "TlvTypeSkypeSessionType",
|
||||
1192096: "TlvTypeGetKeyloggerConfigRequest",
|
||||
1192352: "TlvTypeKeyloggerConfigReply",
|
||||
1192608: "TlvTypeSetKeyloggerConfigRequest",
|
||||
1180064: "TlvTypeStartKeyLoggingRequest",
|
||||
1180320: "TlvTypeStartKeyLoggingReply",
|
||||
1180576: "TlvTypeKeyLoggingFrame",
|
||||
1180832: "TlvTypeStopKeyLoggingRequest",
|
||||
1181088: "TlvTypeKeyLoggingStoppedReply",
|
||||
1196416: "TlvTypeKLFrameData",
|
||||
1126560: "TlvTypeGetVideoConfigRequest",
|
||||
1126816: "TlvTypeVideoConfigReply",
|
||||
1127072: "TlvTypeSetVideoConfigRequest",
|
||||
1114528: "TlvTypeStartScreenRequest",
|
||||
1114784: "TlvTypeStartScreenReply",
|
||||
1115040: "TlvTypeScreenFrame",
|
||||
1115296: "TlvTypeStopScreenRequest",
|
||||
1115552: "TlvTypeScreenStoppedReply",
|
||||
1115808: "TlvTypeStartScreenRecording",
|
||||
1122720: "TlvTypeStartWebCamRequest",
|
||||
1122976: "TlvTypeStartWebCamReply",
|
||||
1123232: "TlvTypeWebCamFrame",
|
||||
1123488: "TlvTypeStopWebCamRequest",
|
||||
1123744: "TlvTypeWebCamStoppedReply",
|
||||
1124000: "TlvTypeStartWebCamRecording",
|
||||
1130560: "TlvTypeVDFrameID",
|
||||
1130896: "TlvTypeVDFrameData",
|
||||
1131136: "TlvTypeOriginalVideoResolution",
|
||||
1131392: "TlvTypeVideoResolution",
|
||||
1066112: "TlvTypeVideoSessionType",
|
||||
1066368: "TlvTypeVideoEncodingType",
|
||||
1132160: "TlvTypeAutomaticRecordingUID",
|
||||
1061024: "TlvTypeGetAudioConfigRequest",
|
||||
1061280: "TlvTypeAudioConfigReply",
|
||||
1061536: "TlvTypeSetAudioConfigRequest",
|
||||
1048992: "TlvTypeStartMicrophoneRequest",
|
||||
1049248: "TlvTypeStartMicrophoneReply",
|
||||
1049504: "TlvTypeMicrophoneFrame",
|
||||
1049760: "TlvTypeStopMicrophoneRequest",
|
||||
1050016: "TlvTypeMicrophoneStoppedReply",
|
||||
1050272: "TlvTypeStartMicrophoneRecording",
|
||||
1052736: "TlvTypeMICFrameID",
|
||||
1053072: "TlvTypeMICFrameData",
|
||||
1053312: "TlvTypeAudioSessionType",
|
||||
1053568: "TlvTypeAudioEncodingType",
|
||||
328096: "TlvTypeGetSchedulerConfigRequest",
|
||||
328352: "TlvTypeSchedulerConfigReply",
|
||||
328608: "TlvTypeSetSchedulerConfigRequest",
|
||||
331920: "TlvTypeSchedulerTask",
|
||||
332192: "TlvTypeSchedulerTaskRecordByTime",
|
||||
332448: "TlvTypeSchedulerTaskRecordScreenWhenAppRuns",
|
||||
332704: "TlvTypeSchedulerTaskRecordMicWhenAppUsesIt",
|
||||
332960: "TlvTypeSchedulerTaskRecordWebCamWhenAppUsesIt",
|
||||
360592: "TlvTypeSCHTaskConfiguration",
|
||||
360752: "TlvTypeSCHTaskEnabled",
|
||||
361344: "TlvTypeSCHTaskStartDateTime",
|
||||
361600: "TlvTypeSCHTaskStopDateTime",
|
||||
362112: "TlvTypeSCHApplicationName",
|
||||
362288: "TlvTypeSCHApplicationWindowOnly",
|
||||
299168: "TlvTypeGetCmdLineConfigRequest",
|
||||
299424: "TlvTypeCmdLineConfigReply",
|
||||
299680: "TlvTypeSetCmdLineConfigRequest",
|
||||
262560: "TlvTypeStartCmdLineSessionRequest",
|
||||
262816: "TlvTypeStartCmdLineSessionReply",
|
||||
263072: "TlvTypeStopCmdLineSessionRequest",
|
||||
263328: "TlvTypeCmdLineSessionStoppedReply",
|
||||
263584: "TlvTypeCmdLineExecute",
|
||||
263840: "TlvTypeCmdLineExecutionResult",
|
||||
266352: "TlvTypeCmdLineExecuteCommand",
|
||||
266560: "TlvTypeCmdLineExecuteAnswerID",
|
||||
266864: "TlvTypeCmdLineExecuteAnswerData",
|
||||
168096: "TlvTypeGetFileSystemConfigRequest",
|
||||
168352: "TlvTypeFileSystemConfigReply",
|
||||
168608: "TlvTypeSetFileSystemConfigRequest",
|
||||
131488: "TlvTypeGetAllDrivesRequest",
|
||||
131744: "TlvTypeGetAllDrivesReply",
|
||||
135328: "TlvTypeGetFolderContentsRequest",
|
||||
135584: "TlvTypeGetFolderContentsReply",
|
||||
135840: "TlvTypeGetFolderContentsNext",
|
||||
136096: "TlvTypeGetFolderContentsEnd",
|
||||
139424: "TlvTypeDownloadFileRequest",
|
||||
139680: "TlvTypeCancelDownloadFileRequest",
|
||||
139936: "TlvTypeDownloadFileReply",
|
||||
140192: "TlvTypeDownloadFileNext",
|
||||
140448: "TlvTypeDownloadFileEnd",
|
||||
140704: "TlvTypeCancelDownloadFileReply",
|
||||
143520: "TlvTypeUploadFileRequest",
|
||||
143776: "TlvTypeCancelUploadFileRequest",
|
||||
144032: "TlvTypeUploadFileReply",
|
||||
144288: "TlvTypeUploadFileNext",
|
||||
144544: "TlvTypeUploadFileEnd",
|
||||
144800: "TlvTypeUploadFileCompleted",
|
||||
145056: "TlvTypeCancelUploadFileReply",
|
||||
147616: "TlvTypeDeleteFileRequest",
|
||||
147872: "TlvTypeDeleteFileReply",
|
||||
151968: "TlvTypeSearchFileRequest",
|
||||
152224: "TlvTypeSearchFileReply",
|
||||
152480: "TlvTypeSearchFileNext",
|
||||
152736: "TlvTypeSearchFileEnd",
|
||||
152992: "TlvTypeCancelSearchFileRequest",
|
||||
153248: "TlvTypeCancelSearchFileReply",
|
||||
159888: "TlvTypeFSFileDataChunk",
|
||||
160128: "TlvTypeFSDiskDrive",
|
||||
160384: "TlvTypeFSFullPath",
|
||||
160640: "TlvTypeFSFilename",
|
||||
160896: "TlvTypeFSFileExtension",
|
||||
161088: "TlvTypeFSDiskDriveType",
|
||||
161408: "TlvTypeFSFileSize",
|
||||
161584: "TlvTypeFSIsFolder",
|
||||
161840: "TlvTypeFSReadOnly",
|
||||
162096: "TlvTypeFSHidden",
|
||||
162352: "TlvTypeFSSystem",
|
||||
162688: "TlvTypeFSFileCreationTime",
|
||||
162944: "TlvTypeFSFileLastAccessTime",
|
||||
163200: "TlvTypeFSFileLastWriteTime",
|
||||
163472: "TlvTypeFSFullPathM",
|
||||
8978848: "TlvTypeMasterMobileTargetConn",
|
||||
7471520: "TlvTypeMasterTargetConn",
|
||||
7405984: "TlvTypeMasterAgentLogin",
|
||||
7406240: "TlvTypeMasterAgentLoginAnswer",
|
||||
7406752: "TlvTypeMasterAgentTargetList",
|
||||
7407008: "TlvTypeMasterAgentTargetOnlineList",
|
||||
7407264: "TlvTypeMasterAgentTargetInfoReply",
|
||||
7407520: "TlvTypeMasterAgentUserList",
|
||||
7407776: "TlvTypeMasterAgentUserListReply",
|
||||
7408032: "TlvTypeMasterAgentTargetArchivedList",
|
||||
7408288: "TlvTypeMasterAgentTargetListEx",
|
||||
7408544: "TlvTypeMasterAgentTargetOnlineListEx",
|
||||
7408800: "TlvTypeMasterAgentMobileTargetArchivedList",
|
||||
7409056: "TlvTypeMasterAgentMobileTargetList",
|
||||
7409312: "TlvTypeMasterAgentMobileTargetOnlineList",
|
||||
7409824: "TlvTypeMasterAgentQueryFirst",
|
||||
7410080: "TlvTypeMasterAgentQueryNext",
|
||||
7410336: "TlvTypeMasterAgentQueryLast",
|
||||
7410592: "TlvTypeMasterAgentQueryAnswer",
|
||||
7410848: "TlvTypeMasterAgentRemoveRecord",
|
||||
7411104: "TlvTypeMasterAgentTargetInfoExReply",
|
||||
7411344: "TlvTypeTargetInfoExProperty",
|
||||
7411616: "TlvTypeTargetInfoExPropertyValue",
|
||||
7411840: "TlvTypeTargetInfoExPropertyValueName",
|
||||
7411968: "TlvTypeTargetInfoExPropertyValueData",
|
||||
7412384: "TlvTypeMasterAgentAlarm",
|
||||
7413920: "TlvTypeMasterAgentRetrieveData",
|
||||
7414176: "TlvTypeMasterAgentRetrieveDataAnswer",
|
||||
7414432: "TlvTypeMasterAgentRemoveUser",
|
||||
7414688: "TlvTypeMasterAgentRemoveTarget",
|
||||
7414944: "TlvTypeMasterAgentRetrieveDataComments",
|
||||
7415200: "TlvTypeMasterAgentUpdateDataComments",
|
||||
7415712: "TlvTypeMasterAgentRetrieveActivityLogging",
|
||||
7415968: "TlvTypeMasterAgentRetrieveMasterLogging",
|
||||
7416224: "TlvTypeMasterAgentRetrieveAgentActivityLogging",
|
||||
7417248: "TlvTypeMasterAgentSendUserGUIConfig",
|
||||
7417504: "TlvTypeMasterAgentGetUserGUIConfigRequest",
|
||||
7417760: "TlvTypeMasterAgentGetUserGUIConfigReply",
|
||||
7418016: "TlvTypeMasterAgentProxyList",
|
||||
7418272: "TlvTypeMasterAgentProxyInfoReply",
|
||||
7419040: "TlvTypeMasterAgentNameValuePacket",
|
||||
7419248: "TlvTypeMasterAgentValueName",
|
||||
7419392: "TlvTypeMasterAgentValueData",
|
||||
7419808: "TlvTypeMasterAgentRetrieveTargetHistory",
|
||||
7421088: "TlvTypeMasterAgentInstallMasterLicense",
|
||||
7421344: "TlvTypeMasterAgentInstallSoftwareUpdate",
|
||||
7421600: "TlvTypeMasterAgentInstallSoftwareUpdateChunk",
|
||||
7421856: "TlvTypeMasterAgentInstallSoftwareUpdateDone",
|
||||
7422112: "TlvTypeMasterAgentSoftwareUpdateInfo",
|
||||
7422368: "TlvTypeMasterAgentSoftwareUpdateInfoReply",
|
||||
7422624: "TlvTypeMasterAgentSoftwareUpdate",
|
||||
7422880: "TlvTypeMasterAgentSoftwareUpdateReply",
|
||||
7423136: "TlvTypeMasterAgentSoftwareUpdateNext",
|
||||
7423392: "TlvTypeMasterAgentAddTimeSchedule",
|
||||
7423648: "TlvTypeMasterAgentAddScreenSchedule",
|
||||
7423904: "TlvTypeMasterAgentAddLockedSchedule",
|
||||
7424160: "TlvTypeMasterAgentRemoveSchedule",
|
||||
7424416: "TlvTypeMasterAgentGetSchedulerList",
|
||||
7424672: "TlvTypeMasterAgentSchedulerTimeAction",
|
||||
7424928: "TlvTypeMasterAgentSchedulerScreenAction",
|
||||
7425184: "TlvTypeMasterAgentSchedulerLockedAction",
|
||||
7425440: "TlvTypeMasterAgentProjectSoftwareUpdateInfo",
|
||||
7425696: "TlvTypeMasterAgentProjectSoftwareUpdateInfoReply",
|
||||
7425952: "TlvTypeMasterAgentProjectSoftwareUpdate",
|
||||
7426112: "TlvTypeMasterAgentSchedulerID",
|
||||
7426368: "TlvTypeMasterAgentSchedulerStartTime",
|
||||
7426624: "TlvTypeMasterAgentSchedulerStopTime",
|
||||
7427488: "TlvTypeMasterAgentAddRecordedDataAvailableSchedule",
|
||||
7427744: "TlvTypeMasterAgentSchedulerRecordedDataAvailableAction",
|
||||
7428256: "TlvTypeMasterAgentRetrieveRemoteMasterData",
|
||||
7428512: "TlvTypeMasterAgentRetrieveRemoteMasterDataReply",
|
||||
7428768: "TlvTypeMasterAgentDeleteRemoteMasterData",
|
||||
7429024: "TlvTypeMasterAgentRetrieveOfflineMasterData",
|
||||
7429280: "TlvTypeMasterAgentRetrieveOfflineMasterDataReply",
|
||||
7429536: "TlvTypeMasterAgentDeleteOfflineMasterData",
|
||||
7430304: "TlvTypeMasterAgentQueryFirstEx",
|
||||
7430560: "TlvTypeMasterAgentQueryNextEx",
|
||||
7430816: "TlvTypeMasterAgentQueryLastEx",
|
||||
7431072: "TlvTypeMasterAgentQueryAnswerEx",
|
||||
7431328: "TlvTypeMasterAgentSendUserPreferences",
|
||||
7431584: "TlvTypeMasterAgentGetUserPreferencesRequest",
|
||||
7431840: "TlvTypeMasterAgentGetUserPreferencesReply",
|
||||
7432096: "TlvTypeMasterAgentListMCFilesRequest",
|
||||
8415392: "TlvTypeMasterAgentListMCFilesReply",
|
||||
7432608: "TlvTypeMasterAgentDeleteMCFiles",
|
||||
7432864: "TlvTypeMasterAgentSendMCFiles",
|
||||
7433120: "TlvTypeMasterAgentMCStatisticsRequest",
|
||||
7433376: "TlvTypeMasterAgentMCStatisticsReply",
|
||||
7433616: "TlvTypeMasterAgentMCStatisticsValues",
|
||||
7434400: "TlvTypeMasterAgentTrojanKeyRequest",
|
||||
7434656: "TlvTypeMasterAgentTrojanKeyReply",
|
||||
7434912: "TlvTypeMasterAgentEvProtectionX509Request",
|
||||
7435168: "TlvTypeMasterAgentEvProtectionX509Reply",
|
||||
7435424: "TlvTypeMasterAgentEvProtectionImportCert",
|
||||
7435680: "TlvTypeMasterAgentEvProtectionImportCertCompleted",
|
||||
7435936: "TlvTypeMasterAgentConfigurationRequest",
|
||||
7436192: "TlvTypeMasterAgentConfigurationReply",
|
||||
7436448: "TlvTypeMasterAgentConfigurationUpdateRequest",
|
||||
7436704: "TlvTypeMasterAgentConfigurationUpdateRequestCompleted",
|
||||
7436944: "TlvTypeMasterAgentConfiguration",
|
||||
7437216: "TlvTypeMasterAgentConfigurationValue",
|
||||
7437424: "TlvTypeMasterAgentConfigurationValueName",
|
||||
7437568: "TlvTypeMasterAgentConfigurationValueData",
|
||||
7437984: "TlvTypeMasterAgentConfigurationTransferDone",
|
||||
7438496: "TlvTypeMasterAgentRetrieveTargetFile",
|
||||
7438752: "TlvTypeMasterAgentRetrieveTargetFileAnswer",
|
||||
7438912: "TlvTypeMasterAgentAlarmEntryID",
|
||||
7439168: "TlvTypeMasterAgentAlarmEntryVersion",
|
||||
7439424: "TlvTypeMasterAgentAlarmTriggerFlags",
|
||||
7439776: "TlvTypeMasterAgentGetAlarmList",
|
||||
7440032: "TlvTypeMasterAgentAddAlarmEntry",
|
||||
7440288: "TlvTypeMasterAgentRemoveAlarmEntry",
|
||||
7440544: "TlvTypeMasterAgentAlarmEntry",
|
||||
7440800: "TlvTypeMasterAgentSystemStatus",
|
||||
7441056: "TlvTypeMasterAgentSystemStatusRequest",
|
||||
7441312: "TlvTypeMasterAgentSystemStatusReply",
|
||||
7441552: "TlvTypeMasterAgentLicenseValues",
|
||||
7441824: "TlvTypeMasterAgentLicenseValuesRequest",
|
||||
7442080: "TlvTypeMasterAgentLicenseValuesReply",
|
||||
7442592: "TlvTypeMasterAgentGetNetworkConfigurationRequest",
|
||||
7442848: "TlvTypeMasterAgentSetNetworkConfigurationRequest",
|
||||
7443104: "TlvTypeMasterAgentSetNetworkConfigurationReply",
|
||||
7443360: "TlvTypeMasterAgentRetrieveAllowedModulesList",
|
||||
7443616: "TlvTypeMasterAgentRetrieveAllowedModulesListAnswer",
|
||||
7446688: "TlvTypeMasterAgentRemoveAllTargetData",
|
||||
7446944: "TlvTypeMasterAgentForceDownloadRecordedData",
|
||||
7447200: "TlvTypeMasterAgentTargetCreateNotification",
|
||||
7447456: "TlvTypeMasterAgentMobileTargetInfoReply",
|
||||
7447696: "TlvTypeMasterAgentMobileTargetInfoValues",
|
||||
7450784: "TlvTypeMasterAgentAlert",
|
||||
7454880: "TlvTypeMasterAgentAddUser",
|
||||
7455392: "TlvTypeMasterAgentAddUserReply",
|
||||
7455648: "TlvTypeMasterAgentModifyUser",
|
||||
7455904: "TlvTypeMasterAgentSetUserPermission",
|
||||
7456160: "TlvTypeMasterAgentSetTargetPermission",
|
||||
7456400: "TlvTypeMasterAgentUserPermission",
|
||||
7456656: "TlvTypeMasterAgentTargetPermission",
|
||||
7456928: "TlvTypeMasterAgentUserPermissionValuePacket",
|
||||
7457184: "TlvTypeMasterAgentTargetPermissionValuePacket",
|
||||
7457344: "TlvTypeMasterAgentUserPermissionValueName",
|
||||
7457600: "TlvTypeMasterAgentTargetPermissionValueName",
|
||||
7457856: "TlvTypeMasterAgentUserPermissionValueData",
|
||||
7458112: "TlvTypeMasterAgentTargetPermissionValueData",
|
||||
7458464: "TlvTypeMasterAgentModifyPassword",
|
||||
7458656: "TlvTypeMasterAgentMobileTargetPermissionValueName",
|
||||
7458976: "TlvTypeMasterAgentUploadFile",
|
||||
7459232: "TlvTypeMasterAgentUploadFileChunk",
|
||||
7459488: "TlvTypeMasterAgentUploadFileDone",
|
||||
7459744: "TlvTypeMasterAgentUploadFilesTransferDone",
|
||||
7460000: "TlvTypeMasterAgentGetTargetModuleConfigRequest",
|
||||
7460256: "TlvTypeMasterAgentRemoveFile",
|
||||
7460512: "TlvTypeMasterAgentMobileProxyList",
|
||||
7460768: "TlvTypeMasterAgentSMSProxyList",
|
||||
7461024: "TlvTypeMasterAgentSMSProxyInfoReply",
|
||||
7461280: "TlvTypeMasterAgentCallPhoneNumberList",
|
||||
7461536: "TlvTypeMasterAgentCallPhoneNumberInfoReply",
|
||||
7461792: "TlvTypeMasterAgentGetMobileTargetModuleConfigRequest",
|
||||
7462048: "TlvTypeMasterAgentSendSMS",
|
||||
7469984: "TlvTypeMasterAgentEncryptionRequired",
|
||||
7470752: "TlvTypeAgentMasterComm",
|
||||
7470240: "TlvTypeMasterAgentFileCompleted",
|
||||
7470496: "TlvTypeMasterAgentRequestCompleted",
|
||||
7471008: "TlvTypeMasterAgentRequestStatus",
|
||||
7733664: "TlvTypeRelayProxyComm",
|
||||
8454800: "TlvTypeRelayData",
|
||||
7734176: "TlvTypeRelayDummyHeartbeat",
|
||||
7668128: "TlvTypeMasterTargetComm",
|
||||
7668384: "TlvTypeTargetCloseAllLiveStreaming",
|
||||
7471424: "TlvTypeProxyMasterCommSig",
|
||||
7471776: "TlvTypeProxyMasterComm",
|
||||
7472032: "TlvTypeMasterProxyComm",
|
||||
7472288: "TlvTypeProxyMasterHeartBeatAnswer",
|
||||
7472544: "TlvTypeProxyMasterDisconnect",
|
||||
7472704: "TlvTypeProxyMasterNotification",
|
||||
7473056: "TlvTypeProxyMasterRequest",
|
||||
7473312: "TlvTypeMasterProxyCommNotification",
|
||||
7473568: "TlvTypeMasterCheckTargetDisconnect",
|
||||
7536960: "TlvTypeProxyTargetCommSig",
|
||||
7537312: "TlvTypeProxyTargetComm",
|
||||
7537568: "TlvTypeProxyMasterTargetComm",
|
||||
7537728: "TlvTypeProxyTargetRequestCrypto",
|
||||
7538064: "TlvTypeProxyTargetAnswerCrypto",
|
||||
8454544: "TlvTypeProxyData",
|
||||
8458400: "TlvTypeProxyTargetDisconnect",
|
||||
8458656: "TlvTypeProxyMobileTargetDisconnect",
|
||||
8458912: "TlvTypeProxyDummyHeartbeat",
|
||||
8459168: "TlvTypeProxyMobileDummyHeartbeat",
|
||||
8585616: "TlvTypeAgentData",
|
||||
8585808: "TlvTypeAgentQueryID",
|
||||
8586048: "TlvTypeAgentQueryModSubmodID",
|
||||
8586304: "TlvTypeAgentQueryFromDate",
|
||||
8586560: "TlvTypeAgentQueryToDate",
|
||||
8586816: "TlvTypeAgentQuerySortOrder",
|
||||
8587136: "TlvTypeAgentQueryValueFilter",
|
||||
8587328: "TlvTypeAgentUID",
|
||||
8520080: "TlvTypeMasterData",
|
||||
8520768: "TlvTypeMasterMode",
|
||||
8521024: "TlvTypeMasterToken",
|
||||
8521344: "TlvTypeMasterQueryResult",
|
||||
8522368: "TlvTypeMasterAlarmString",
|
||||
8651152: "TlvTypeMobileTargetData",
|
||||
8651376: "TlvTypeMobileTargetHeartBeatV10",
|
||||
8651632: "TlvTypeMobileTargetExtendedHeartBeatV10",
|
||||
8651888: "TlvTypeMobileHeartBeatReplyV10",
|
||||
8653472: "TlvTypeMobileInstalledModulesReply",
|
||||
8656032: "TlvTypeMobileTargetUploadModuleRequest",
|
||||
8656288: "TlvTypeMobileTargetUploadModuleReply",
|
||||
8656544: "TlvTypeMobileTargetUploadModuleChunk",
|
||||
8656800: "TlvTypeMobileTargetUploadModuleDoneRequest",
|
||||
8657056: "TlvTypeMobileTargetUploadModuleDoneReply",
|
||||
8657312: "TlvTypeMobileTargetRemoveModuleRequest",
|
||||
8657568: "TlvTypeMobileTargetRemoveModuleReply",
|
||||
8655008: "TlvTypeMobileTargetOfflineUploadModuleRequest",
|
||||
8657824: "TlvTypeMobileTargetOfflineUploadModuleReply",
|
||||
8658080: "TlvTypeMobileTargetOfflineUploadModuleChunk",
|
||||
8658336: "TlvTypeMobileTargetOfflineUploadModuleDoneRequest",
|
||||
8658592: "TlvTypeMobileTargetOfflineUploadModuleDoneReply",
|
||||
8658848: "TlvTypeMobileTargetOfflineError",
|
||||
8659104: "TlvTypeMobileTargetError",
|
||||
8659360: "TlvTypeMobileTargetGetRecordedFilesRequest",
|
||||
8659616: "TlvTypeMobileTargetRecordedFilesReply",
|
||||
8659872: "TlvTypeMobileTargetRecordedFileDownloadRequest",
|
||||
8660128: "TlvTypeMobileTargetRecordedFileDownloadReply",
|
||||
8660384: "TlvTypeMobileTargetRecordedFileDownloadChunk",
|
||||
8660640: "TlvTypeMobileTargetRecordedFileDownloadCompleted",
|
||||
8660896: "TlvTypeMobileTargetRecordedFileDeleteRequest",
|
||||
8661152: "TlvTypeMobileTargetRecordedFileDeleteReply",
|
||||
8663968: "TlvTypeMobileTargetOfflineConfig",
|
||||
8664224: "TlvTypeMobileTargetEmergencyConfigAsTLV",
|
||||
8664432: "TlvTypeMobileTargetEmergencyConfig",
|
||||
8671392: "TlvTypeMobileTargetLoadModuleRequest",
|
||||
8671648: "TlvTypeMobileTargetLoadModuleReply",
|
||||
8671904: "TlvTypeMobileTargetUnLoadModuleRequest",
|
||||
8672160: "TlvTypeMobileTargetUnLoadModuleReply",
|
||||
8675472: "TlvTypeMobileTargetHeartbeatEvents",
|
||||
8675648: "TlvTypeMobileTargetHeartbeatInterval",
|
||||
8675984: "TlvTypeMobileTargetHeartbeatRestrictions",
|
||||
8676208: "TlvTypeConfigSMSPhoneNumber",
|
||||
8676496: "TlvTypeMobileTargetPositioning",
|
||||
8676672: "TlvTypeMobileTrojanUID",
|
||||
8676976: "TlvTypeMobileTrojanID",
|
||||
8677296: "TlvTypeMobileTargetLocationChangedRange",
|
||||
8677440: "TlvTypeConfigMobileAutoRemovalDateTime",
|
||||
8677808: "TlvTypeConfigOverwriteProxyAndPhones",
|
||||
8678000: "TlvTypeConfigCallPhoneNumber",
|
||||
8679488: "TlvTypeLocationAreaCode",
|
||||
8679744: "TlvTypeCellID",
|
||||
8680048: "TlvTypeMobileCountryCode",
|
||||
8680304: "TlvTypeMobileNetworkCode",
|
||||
8680560: "TlvTypeIMSI",
|
||||
8680816: "TlvTypeIMEI",
|
||||
8681072: "TlvTypeGPSLatitude",
|
||||
8681328: "TlvTypeGPSLongitude",
|
||||
8681520: "TlvTypeFirstHeartbeat",
|
||||
8681872: "TlvTypeInstalledModules",
|
||||
8683568: "TlvTypeValidGPSValues",
|
||||
8389008: "TlvTypeTargetData",
|
||||
8389280: "TlvTypeTargetHeartBeat",
|
||||
8389680: "TlvTypeTargetKeepSessionAlive",
|
||||
8390000: "TlvTypeTargetLocalIP",
|
||||
8390256: "TlvTypeTargetGlobalIP",
|
||||
8390448: "TlvTypeTargetState",
|
||||
8390784: "TlvTypeTargetID",
|
||||
8391072: "TlvTypeGetInstalledModulesRequest",
|
||||
8391328: "TlvTypeInstalledModulesReply",
|
||||
8391488: "TlvTypeTrojanUID",
|
||||
8391808: "TlvTypeTrojanID",
|
||||
8392000: "TlvTypeTrojanMaxInfections",
|
||||
8392240: "TlvTypeScreenSaverOn",
|
||||
8392496: "TlvTypeScreenLocked",
|
||||
8392752: "TlvTypeRecordedDataAvailable",
|
||||
8393024: "TlvTypeDownloadedRecordedDataTimeStamp",
|
||||
8393280: "TlvTypeInstallationMode",
|
||||
8393552: "TlvTypeTargetRemoveNotification",
|
||||
8393792: "TlvTypeTargetPlatformBits",
|
||||
8394032: "TlvTypeRemoveItselfMaxInfectionReached",
|
||||
8394288: "TlvTypeRemoveItselfAtMasterRequest",
|
||||
8394544: "TlvTypeRemoveItselfAtAgentRequest",
|
||||
8394912: "TlvTypeRemoveItselfAtAgentReqRequest",
|
||||
8395072: "TlvTypeRecordedFilesDownloadTotal",
|
||||
8395328: "TlvTypeRecordedFilesDownloadProgress",
|
||||
8395632: "TlvTypeTargetLicenseInfo",
|
||||
8395840: "TlvTypeRemoveTargetLicenseInfo",
|
||||
8396176: "TlvTypeTargetAllConfigurations",
|
||||
8396960: "TlvTypeTargetError",
|
||||
8401056: "TlvTypeGetTargetConfigRequest",
|
||||
8401312: "TlvTypeTargetConfigReply",
|
||||
8401568: "TlvTypeSetTargetConfigRequest",
|
||||
8402304: "TlvTypeConfigTargetID",
|
||||
8402496: "TlvTypeConfigTargetHeartbeatInterval",
|
||||
8402800: "TlvTypeConfigTargetProxy",
|
||||
8403008: "TlvTypeConfigTargetPort",
|
||||
8403584: "TlvTypeConfigAutoRemovalDateTime",
|
||||
8403776: "TlvTypeConfigAutoRemovalIfNoProxy",
|
||||
8404032: "TlvTypeInternalAutoRemovalElapsedTime",
|
||||
8405040: "TlvTypeConfigActiveHiding",
|
||||
8409248: "TlvTypeTargetLoadModuleRequest",
|
||||
8409504: "TlvTypeTargetLoadModuleReply",
|
||||
8409760: "TlvTypeTargetUnLoadModuleRequest",
|
||||
8410016: "TlvTypeTargetUnLoadModuleReply",
|
||||
8410272: "TlvTypeTargetUploadModuleRequest",
|
||||
8410528: "TlvTypeTargetUploadModuleReply",
|
||||
8410784: "TlvTypeTargetUploadModuleChunk",
|
||||
8411040: "TlvTypeTargetUploadModuleDoneRequest",
|
||||
8411296: "TlvTypeTargetUploadModuleDoneReply",
|
||||
8411552: "TlvTypeTargetRemoveModuleRequest",
|
||||
8411808: "TlvTypeTargetRemoveModuleReply",
|
||||
8412064: "TlvTypeTargetOfflineUploadModuleRequest",
|
||||
8412320: "TlvTypeTargetOfflineUploadModuleReply",
|
||||
8412576: "TlvTypeTargetOfflineUploadModuleChunk",
|
||||
8412832: "TlvTypeTargetOfflineUploadModuleDoneRequest",
|
||||
8413088: "TlvTypeTargetOfflineUploadModuleDoneReply",
|
||||
8413344: "TlvTypeTargetOfflineError",
|
||||
8413600: "TlvTypeTargetUploadError",
|
||||
8417440: "TlvTypeTargetGetRecordedFilesRequest",
|
||||
8417696: "TlvTypeTargetRecordedFilesReply",
|
||||
8417952: "TlvTypeTargetRecordedFileDownloadRequest",
|
||||
8418208: "TlvTypeTargetRecordedFileDownloadReply",
|
||||
8418464: "TlvTypeTargetRecordedFileDownloadChunk",
|
||||
8418720: "TlvTypeTargetRecordedFileDownloadCompleted",
|
||||
8418976: "TlvTypeTargetRecordedFileDeleteRequest",
|
||||
8419232: "TlvTypeTargetRecordedFileDeleteReply",
|
||||
8419488: "TlvTypeTargetGetRecordedFilesRequestEx",
|
||||
8419744: "TlvTypeTargetRecordedFilesReplyEx",
|
||||
8420000: "TlvTypeTargetRecordedFileDeleteRequestEx",
|
||||
8420256: "TlvTypeTargetRecordedFilesDownloadRequestEx",
|
||||
16744768: "TlvTypeProxyConnectionBroken",
|
||||
16712000: "TlvTypeTargetConnectionBroken",
|
||||
16712256: "TlvTypeAgentConnectionBroken",
|
||||
16712512: "TlvTypeTargetOffline",
|
||||
16646544: "TlvTypePlaintext",
|
||||
16646800: "TlvTypeCompression",
|
||||
16647056: "TlvTypeEncryption",
|
||||
16647232: "TlvTypeTargetUID",
|
||||
16647536: "TlvTypeIPAddress",
|
||||
16647808: "TlvTypeUserName",
|
||||
16648064: "TlvTypeComputerName",
|
||||
16648304: "TlvTypeLoginName",
|
||||
16648560: "TlvTypePassphrase",
|
||||
16648832: "TlvTypeRecordID",
|
||||
16649088: "TlvTypeOwner",
|
||||
16649344: "TlvTypeMetaData",
|
||||
16649536: "TlvTypeModuleID",
|
||||
16649856: "TlvTypeOSName",
|
||||
16650048: "TlvTypeModuleSubID",
|
||||
16650320: "TlvTypeErrorCode",
|
||||
16650560: "TlvTypeOffset",
|
||||
16650816: "TlvTypeLength",
|
||||
16651088: "TlvTypeRequestID",
|
||||
16651328: "TlvTypeRequestType",
|
||||
16651584: "TlvTypeVersion",
|
||||
16651840: "TlvTypeMachineID",
|
||||
16652096: "TlvTypeMajorNumber",
|
||||
16652352: "TlvTypeMinorNumber",
|
||||
16652656: "TlvTypeGlobalIPAddress",
|
||||
16652912: "TlvTypeASCII_Filename",
|
||||
16653120: "TlvTypeFilesize",
|
||||
16653392: "TlvTypeFilecount",
|
||||
16653712: "TlvTypeFiledata",
|
||||
16653968: "TlvTypeMD5Sum",
|
||||
16654144: "TlvTypeProxyPort",
|
||||
16654400: "TlvTypeStatus",
|
||||
16654656: "TlvTypeUserID",
|
||||
16654912: "TlvTypeGroupID",
|
||||
16655168: "TlvTypePermissions",
|
||||
16655424: "TlvTypeRequestCode",
|
||||
16655680: "TlvTypeDataSize",
|
||||
16655936: "TlvTypeKeyType",
|
||||
16656240: "TlvTypeEmail",
|
||||
16656432: "TlvTypeEnabled",
|
||||
16656688: "TlvTypeLicensed",
|
||||
16656960: "TlvTypeAudioFrequency",
|
||||
16657216: "TlvTypeAudioBitsPerSample",
|
||||
16657472: "TlvTypeAudioChannels",
|
||||
16657728: "TlvTypeStartTime",
|
||||
16657984: "TlvTypeStopTime",
|
||||
16658240: "TlvTypeBitMask",
|
||||
16658560: "TlvTypeTimeZone",
|
||||
16658816: "TlvTypeDateTime",
|
||||
16659072: "TlvTypeStartSessionDateTime",
|
||||
16659328: "TlvTypeStopSessionDateTime",
|
||||
16659520: "TlvTypeDateTimeRef",
|
||||
16659776: "TlvTypeScheduleRepeat",
|
||||
16660032: "TlvTypeUnixMasterDateTime",
|
||||
16660288: "TlvTypeUnixUTCDateTime",
|
||||
16660544: "TlvTypeDurationInSeconds",
|
||||
16660864: "TlvTypeMasterRefTime",
|
||||
16661120: "TlvTypeMasterRefTimeStart",
|
||||
16661376: "TlvTypeMasterRefTimeEnd",
|
||||
16661568: "TlvTypeCounter",
|
||||
16661888: "TlvTypeWhiteListEntry",
|
||||
16662144: "TlvTypeBlackListEntry",
|
||||
16662336: "TlvTypeBlackWhiteListingMode",
|
||||
16662576: "TlvTypeConfigEnabled",
|
||||
16662848: "TlvTypeConfigMaxRecordingSize",
|
||||
16663104: "TlvTypeConfigAudioQuality",
|
||||
16663344: "TlvTypeConfigVideoBlackAndWhite",
|
||||
16663616: "TlvTypeConfigVideoResolution",
|
||||
16663872: "TlvTypeConfigCaptureFrequency",
|
||||
16664128: "TlvTypeConfigVideoQuality",
|
||||
16664384: "TlvTypeConfigFilesStandardFilter",
|
||||
16664704: "TlvTypeConfigFilesCustomFilter",
|
||||
16664896: "TlvTypeConfigStandardLocation",
|
||||
16665216: "TlvTypeConfigCustomLocation",
|
||||
16665408: "TlvTypeConfigFileChunkSize",
|
||||
16665664: "TlvTypeConfigFileTransferSpeed",
|
||||
16665904: "TlvTypeConfigUploadFileOverwrite",
|
||||
16666160: "TlvTypeConfigDeleteOverReboot",
|
||||
16666496: "TlvTypeConfigCustomLocationException",
|
||||
16666752: "TlvTypeExtraData",
|
||||
16667008: "TlvTypeSignature",
|
||||
16667264: "TlvTypeComments",
|
||||
16667520: "TlvTypeDescription",
|
||||
16667776: "TlvTypeFilenameExtension",
|
||||
16668032: "TlvTypeSessionType",
|
||||
16668224: "TlvTypePeriod",
|
||||
16668512: "TlvTypeMobileTargetUID",
|
||||
16668784: "TlvTypeMobileTargetID",
|
||||
16669072: "TlvTypeMobilePlaintext",
|
||||
16669328: "TlvTypeMobileCompression",
|
||||
16669584: "TlvTypeMobileEncryption",
|
||||
16669824: "TlvTypeEncodingType",
|
||||
16670576: "TlvTypePhoneNumber",
|
||||
16670784: "TlvTypeConfigCustomLocationMode",
|
||||
16674928: "TlvTypeNetworkInterface",
|
||||
16675136: "TlvTypeNetworkInterfaceMode",
|
||||
16675440: "TlvTypeNetworkInterfaceAddress",
|
||||
16675696: "TlvTypeNetworkInterfaceNetmask",
|
||||
16675952: "TlvTypeNetworkInterfaceGateway",
|
||||
16676208: "TlvTypeNetworkInterfaceDNS_1",
|
||||
16676464: "TlvTypeNetworkInterfaceDNS_2",
|
||||
16677440: "TlvTypeLoginTime",
|
||||
16677696: "TlvTypeLogoffTime",
|
||||
16678720: "TlvTypeGeneric_Type",
|
||||
16678976: "TlvTypeChecksum",
|
||||
16679280: "TlvTypeCity",
|
||||
16679536: "TlvTypeCountry",
|
||||
16679792: "TlvTypeCountryCode",
|
||||
16683072: "TlvTypeTargetType",
|
||||
16683392: "TlvTypeDurationString",
|
||||
8257792: "TlvTypeTestMetaTypeInvalid",
|
||||
8258608: "TlvTypeTestMetaTypeBool",
|
||||
8258880: "TlvTypeTestMetaTypeUInt",
|
||||
8259152: "TlvTypeTestMetaTypeInt",
|
||||
8259440: "TlvTypeTestMetaTypeString",
|
||||
8259712: "TlvTypeTestMetaTypeUnicode",
|
||||
8259984: "TlvTypeTestMetaTypeRaw",
|
||||
8260256: "TlvTypeTestMetaTypeGroup",
|
||||
8260416: "TlvTypeTestMemberIdentifier",
|
||||
8260736: "TlvTypeTestMemberName",
|
||||
0x2331a0: "TlvTypeVideoConfigReply", # Guess based on module
|
||||
0x2431a0: "TlvTypeScreenRecordingConfigReply", # Guess
|
||||
0x2731a0: "TlvTypeEmailConfigReply", # Guess
|
||||
0x2831a0: "TlvTypeWifiConfigReply", # Guess
|
||||
0x2931a0: "TlvTypeRemoteConfigReply", #Guess
|
||||
}
|
||||
|
||||
NEED_RECURSION = ["TlvTypeChangedConfigReply", "TlvTypeTargetConfigReply",
|
||||
"TlvTypeFileSystemConfigReply", "TlvTypeCmdLineConfigReply",
|
||||
"TlvTypeSchedulerConfigReply", "TlvTypeMobileTargetOfflineConfig",
|
||||
"TlvTypeMobileTrackingConfigRaw", "TlvTypeMobileTrackingConfig",
|
||||
"0x544090", "0x5440a0", "0x534090", "0x5341a0"]
|
||||
|
||||
|
||||
def decode(m):
|
||||
cfg = {}
|
||||
while m.b.tell() < m._len:
|
||||
size = m.dword()
|
||||
tag = m.dword()
|
||||
tag_type = (tag & 0xf0) >> 4
|
||||
name = tlv_types.get(tag)
|
||||
if tag_type < 4:
|
||||
data = m.byte()
|
||||
elif tag_type >= 6:
|
||||
data = m.read(size - 8)
|
||||
if tag_type == 8:
|
||||
data = data.decode('utf-16')
|
||||
if u"\u0380" in data:
|
||||
category, rest = data.split(u"\u0380")
|
||||
data = {'category': category, 'list': rest.split(u"\u0381")}
|
||||
else:
|
||||
data = m.dword()
|
||||
if not name:
|
||||
name = hex(tag)
|
||||
|
||||
if name in NEED_RECURSION or "ConfigReply" in name:
|
||||
nm = M(data)
|
||||
cfg[name] = decode(nm)
|
||||
elif name in cfg and type(cfg[name]) != list:
|
||||
olv = cfg[name]
|
||||
cfg[name] = [olv, data]
|
||||
elif name in cfg and type(cfg[name]) == list:
|
||||
cfg[name].append(data)
|
||||
elif name == "TlvTypeInstalledModules":
|
||||
# Specific decoding for Android modules
|
||||
olv = {"data": data}
|
||||
olv["logging"] = (data[68] == 1)
|
||||
olv["spycall"] = (data[64] == 1)
|
||||
olv["call_interception"] = (data[65] == 1)
|
||||
olv["sms"] = (data[66] == 1)
|
||||
olv["addressbook"] = (data[67] == 1)
|
||||
olv["tracking"] = (data[69] == 1)
|
||||
olv["phonelogs"] = (data[70] == 1)
|
||||
cfg[name] = olv
|
||||
else:
|
||||
cfg[name] = data
|
||||
|
||||
return cfg
|
||||
|
||||
class MyEncoder(JSONEncoder):
|
||||
"""
|
||||
JSON encoder to encode bytes
|
||||
"""
|
||||
def default(self, o):
|
||||
if isinstance(o, bytes):
|
||||
try:
|
||||
return o.decode('utf-8')
|
||||
except UnicodeDecodeError:
|
||||
return repr(o)
|
||||
return o
|
||||
|
||||
|
||||
# From https://github.com/mak/mlib
|
||||
class M(object):
|
||||
TRANSL = {'byte': ('B', 1), 'word': ('H', 2),
|
||||
'dword': ('I', 4), 'qword': ('Q', 8)}
|
||||
|
||||
def __init__(self, d, end_fmt=''):
|
||||
self._len = len(d)
|
||||
self.b = BytesIO(d)
|
||||
|
||||
def _get_bytes(self, fmt, s, off):
|
||||
return struct.unpack(fmt, self.read(off, s) if off else self.read(s))[0]
|
||||
|
||||
def skip(self, n):
|
||||
self.b.seek(n, os.SEEK_CUR)
|
||||
|
||||
def unskip(self, n):
|
||||
self.b.seek(-n, os.SEEK_CUR)
|
||||
|
||||
def read(self, a0, a1= None):
|
||||
r = None
|
||||
if a1 is None:
|
||||
r = self.b.read(a0)
|
||||
else:
|
||||
r = self.read_at(a0,a1)
|
||||
return r
|
||||
|
||||
def read_at(self, off, n):
|
||||
old_l = self.b.tell()
|
||||
self.b.seek(off, os.SEEK_SET)
|
||||
r = self.b.read(n)
|
||||
self.b.seek(old_l, os.SEEK_SET)
|
||||
return r
|
||||
|
||||
def __len__(self):
|
||||
return self._len
|
||||
|
||||
def __getattr__(self, name):
|
||||
at = False
|
||||
if name.endswith('_at'):
|
||||
name = name[:-3]
|
||||
|
||||
if name in M.TRANSL:
|
||||
f, s = M.TRANSL[name]
|
||||
return lambda off = None: self._get_bytes(f, s, off)
|
||||
|
||||
if __name__ == "__main__":
|
||||
parser = argparse.ArgumentParser(description='Decode FinSpy configuration files')
|
||||
parser.add_argument('CONFFILE', help='Configuration file')
|
||||
args = parser.parse_args()
|
||||
|
||||
|
||||
with open(args.CONFFILE, 'rb') as f:
|
||||
d = f.read()
|
||||
|
||||
m = M(d)
|
||||
total_size = m.dword()
|
||||
if total_size != len(d):
|
||||
print("Encrypted configuration, decrypting...")
|
||||
k = (0xaa, 0x5a, 0xa5)
|
||||
r = bytearray()
|
||||
for i, c in enumerate(bytearray(d)):
|
||||
r.append(c ^ k[i % 3])
|
||||
data = bytes(r)
|
||||
m = M(data)
|
||||
total_size = m.dword()
|
||||
|
||||
_ = m.dword() ## doesn't matter but config is wrapped into TlvTypeEncryption
|
||||
cfg = decode(m)
|
||||
print(json.dumps(cfg, cls=MyEncoder, indent=4))
|
||||
13
data/ioc/spyware/amnesty/2020-09-25_finfisher/sha256.csv
Normal file
13
data/ioc/spyware/amnesty/2020-09-25_finfisher/sha256.csv
Normal file
@@ -0,0 +1,13 @@
|
||||
sha256,Description
|
||||
1e9162cd0941557304a6a097dfaadf59f90bc8bbaa9879afe67b5ce0d1514be8,Linux FinSpy sample
|
||||
854774a198db490a1ae9f06d5da5fe6a1f683bf3d7186e56776516f982d41ad3,Android FinSpy sample
|
||||
bb8c0e477512adab1db26eb77fe10dadbc5dcbf8e94569061c7199ca4626a420,Backdoored rar installer
|
||||
80d6e71c54fb3d4a904637e4d56e108a8255036cbb4760493b142889e47b951f,MacOS Installer
|
||||
f960144126748b971386731d35e41288336ad72a9da0c6b942287f397d57c600,Backdoored flash installer
|
||||
fab6b3bbc14c80049f95b040680fba6d1b47f07746729d04c887a55272084648,Encoded cobalt strike beacon
|
||||
8f216d2f0be2c4a5c07abf45cf138453f72f00ec598327756c6fc9d5f4dabe0d,Decoded Cobalt Strike beacon
|
||||
4f3003dd2ed8dcb68133f95c14e28b168bd0f52e5ae9842f528d3f7866495cea,Older Mac OS sample
|
||||
bd1b8bc046dbf19f8c9bbf9398fdbc47c777e1d9e6d9ff1787ada05ed75c1b12,Older Linux sample
|
||||
9f04439bc94f2eef76b72ac2e0aeece0d4f46b6c42ef179fc860f6b5876f5f50,Android FinSpy sample
|
||||
928aefbcac9386c953b3491230a719ff65b21612eb6bd9b32501de149cacbc92,Android FinSpy sample
|
||||
14658327efaa15275fb8718956ee97ebcad5bc80312a4f3182a3b10cd3dcf257,NilePhish downloader
|
||||
|
Reference in New Issue
Block a user