Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/decode_modules.py

@@ -0,0 +1,56 @@
+import sys
+import os
+import struct
+import hashlib
+import ctypes
+import binascii
+import argparse
+from Crypto.Cipher import AES
+"""
+Decode FinSpy modules for Linux and MacOS
+
+Author : Maciek mak@malwarelab.pl
+Date: August 2020
+"""
+
+
+def unpack(data, s=0):
+    """
+    Decode the binary with aplib
+    """
+    cin = ctypes.c_buffer(data)
+    cout = ctypes.c_buffer(s if s else len(data) * 20)
+    aplib_path = os.path.join(
+            os.path.dirname(os.path.realpath(__file__)),
+            "_aplib.so")
+    aPLIB = ctypes.cdll.LoadLibrary(aplib_path)
+    n = aPLIB.aP_depack(cin, cout)
+    return cout.raw[:n]
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description='Unpack FinSpy modules')
+    parser.add_argument('MODULE', help='Finspy module')
+    args = parser.parse_args()
+
+    with open(args.MODULE,'rb') as f:
+        hmd5 = f.read(0x10)
+        IV = f.read(0x10)
+        data = f.read()
+
+    hash_iv_data = hashlib.md5(IV + data)
+    if hmd5 == hash_iv_data.digest():
+        data = IV + data
+        IV = b'\xd9!V\xee\xbe\x0c\xf9\x18*\xfaR;%&\xb7\x08'
+
+    if hmd5 == hashlib.md5(data).digest():
+        print('[+] DATA HASH match {}'.format(binascii.hexlify(hmd5)))
+
+    key = b'YO\xf4\xa6\xd6\x1d\xd7!\xdc\x01A\xbfg\x83"m'
+    xdata = AES.new(key,mode=AES.MODE_CBC,IV=bytes(IV)).decrypt(data)
+    size = struct.unpack('I',xdata[:4])[0]
+    print('[+] Unpacked size: {:x}'.format(size))
+    depack = unpack(xdata[4:], size)
+    with open(args.MODULE + '.unpacked.bin','wb') as f:
+        f.write(depack)
+    print('[*] saved to {}.unpacked.bin'.format(sys.argv[1]))