Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/citizen_lab/201611_KeyBoy/README.md

@@ -0,0 +1,94 @@
+## KeyBoy IOCs
+
+This directory contains IOCs from the Citizen Lab report [It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community](https://citizenlab.org/2016/11/parliament-keyboy/) published the 17th of November 2016.
+
+Files included in this directory:
+* openioc.ioc : IOCs in OpenIOC format
+* stix.xml : IOCs in STIX XML format
+* iocs.csv : IOCs in csv format
+* keyboy.yar : Yara rules related to the KeyBoy samples identified
+* kb_c2Decode.py : script to decode KeyBoy C2 communications (see help hereafter)
+* kb_configDecode.py : script to decode KeyBoy configuration (see help hereafter)
+
+
+### kb_c2Decode.py
+
+Help:
+```bash
+$ python kb_c2Decode.py -h
+usage: kb_c2Decode.py [-h] (-k KEY | -b BINARY) [--verbose] PCAPF
+
+Decode KeyBoy C2 traffic from pcap file
+
+positional arguments:
+  PCAPF                 PCAP File containing c2 traffic
+
+optional arguments:
+  -h, --help            show this help message and exit
+  -k KEY, --key KEY     Manually provide C2 decode key
+  -b BINARY, --binary BINARY
+                        KeyBoy binary
+  --verbose, -v         Enable verbose output
+
+```
+
+Example:
+```
+$ python kb_c2Decode.py -b wab32res.dll dump.pcap
+============================
+{KeyBoy C2 Traffic decoder}
+============================
+
+Found constant: 0x71
+Computing decode value...
+Found decoding multiplier (inverse): 0x91
+Searching PCAP for RAW TCP packets and decoding...
+
+*a*
+HOME-PC
+192.168.100.103
+MyUser
+2016/06/03 00:24:20
+20151108
+```
+
+
+### kb_configDecode.py
+
+Help:
+```
+$ python kb_configDecode.py -h
+usage: kb_configDecode.py [-h] [--verbose] [--skip SKIP] FILE
+
+Decode KeyBoy backdoor configuration files
+
+positional arguments:
+  FILE                  KeyBoy encoded config file
+
+optional arguments:
+  -h, --help            show this help message and exit
+  --verbose, -v         Enable verbose output
+  --skip SKIP, -s SKIP  Skip over <SKIP> bytes at beginning of file
+
+```
+
+Example:
+
+```
+$ python kb_configDecode.py cfs.dat
+============================
+{KeyBoy Config file Decoder}
+============================
+
+Configuration Data:
+==============================
+Identity Code:	9876543210
+C2 Host/IP #1:	103.242.134.243
+C2 Host/IP #2:	103.242.134.243
+C2 Host/IP #3:	103.242.134.243
+C2 Port #1:	443
+C2 Port #2:	1234
+C2 Port #3:	1234
+Password:	password8888
+Campaign ID:	MyUser
+```

data/ioc/spyware/citizen_lab/201611_KeyBoy/iocs.csv

@@ -0,0 +1,270 @@
+uuid,event_id,category,type,value,comment,to_ids,date
+5820ab7b-5a8c-4164-8113-49798e96ca05,17,Artifacts dropped,md5,"495adb1b9777002ecfe22aaf52fcee93","Wab32res.dll payload, KeyBoy 20160509",1,20161107
+5820ab93-8b90-4f61-8591-497a8e96ca05,17,Network activity,ip-dst,"103.40.102.233","C2 IP",1,20161116
+5820ab93-ca00-4627-a8e9-497a8e96ca05,17,Network activity,ip-dst,"45.125.12.147","C2 IP",1,20161110
+5820aba7-e398-41cb-939b-49798e96ca05,17,Network activity,domain,"tibetvoices.com","domain linked to one of the C2 IPs",1,20161107
+5820abec-8b88-4398-ba31-497a8e96ca05,17,Network activity,ip-dst,"116.193.154.69","C2 IP",1,20161107
+5820ac1b-05c0-4d60-8fc5-497a8e96ca05,17,Artifacts dropped,md5,"0c7e55509e0b6d4277b3facf864af018","Payload KeyBoy P_20150313",1,20161107
+5820ac33-586c-4674-b96d-49798e96ca05,17,Network activity,domain,"www.eleven.mypop3.org","C2 domains",1,20161116
+5820ac33-aa80-4d97-99a2-49798e96ca05,17,Network activity,domain,"www.about.jkub.com","C2 domains",1,20161107
+5820ac34-dfc4-4772-8fb6-49798e96ca05,17,Network activity,domain,"www.backus.myftp.name","C2 domains",1,20161116
+5820ac71-ff98-486d-b2e6-49798e96ca05,17,Artifacts dropped,md5,"98977426d544bd145979f65f0322ae30","Payload KeyBoy 20151108",1,20161107
+5820ac98-f508-4869-9701-497a8e96ca05,17,Network activity,ip-dst,"103.242.134.243","C2 IP",1,20161116
+5820ad1d-5d34-489f-97b8-497a8e96ca05,17,Network activity,ip-dst,"157.7.84.81","IPs for C2 Host: www.about.jkub[.]com",1,20161107
+5820ad1d-a7c0-4f84-9d29-497a8e96ca05,17,Network activity,ip-dst,"45.32.47.148","IPs for C2 Host: www.about.jkub[.]com",1,20161107
+5820ad50-de2c-4f26-bd5c-497a8e96ca05,17,Network activity,ip-dst,"192.241.149.43","IP behind C2 Host: www.backus.myftp[.]name",1,20161107
+5820ad9c-c3c4-455e-a5f2-497a8e96ca05,17,Artifacts dropped,md5,"c5b5f01ba24d6c02636388809f44472e","Payload KeyBoy 20151108",1,20161107
+5820adb2-5520-499c-95d3-49798e96ca05,17,Artifacts dropped,md5,"371bc132499f455f06fa80696db0df27","64b KeyBoy payload 20151108",1,20161107
+5820ae20-ebec-43d6-9f95-497a8e96ca05,17,Artifacts dropped,yara,"import ""pe""
+rule new_keyboy_export
+{
+    meta:
+        author = ""Matt Brooks, @cmatthewbrooks""
+        desc = ""Matches the new 2016 sample's export""
+        date = ""2016-08-28""
+        md5 = ""495adb1b9777002ecfe22aaf52fcee93""
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+
+
+        filesize < 200KB and
+
+
+        //The malware family seems to share many exports
+        //but this is the new kid on the block.
+        pe.exports(""cfsUpdate"")
+}","",1,20161107
+5820ae49-9114-4d4d-b043-49798e96ca05,17,Artifacts dropped,yara,"rule new_keyboy_header_codes
+{
+    meta:
+        author = ""Matt Brooks, @cmatthewbrooks""
+        desc = ""Matches the 2016 sample's header codes""
+        date = ""2016-08-28""
+        md5 = ""495adb1b9777002ecfe22aaf52fcee93""
+    
+    strings:
+        $s1 = ""*l*"" wide fullword
+        $s2 = ""*a*"" wide fullword
+        $s3 = ""*s*"" wide fullword
+        $s4 = ""*d*"" wide fullword
+        $s5 = ""*f*"" wide fullword
+        $s6 = ""*g*"" wide fullword
+        $s7 = ""*h*"" wide fullword
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        filesize < 200KB and
+        all of them
+}","",1,20161107
+5820ae5c-cac4-4c1a-a969-497a8e96ca05,17,Artifacts dropped,yara,"rule keyboy_commands
+{
+    meta:
+        author = ""Matt Brooks, @cmatthewbrooks""
+        desc = ""Matches the 2016 sample's sent and received commands""
+        date = ""2016-08-28""
+        md5 = ""495adb1b9777002ecfe22aaf52fcee93""
+    
+    strings:
+        $s1 = ""Update"" wide fullword
+        $s2 = ""UpdateAndRun"" wide fullword
+        $s3 = ""Refresh"" wide fullword
+        $s4 = ""OnLine"" wide fullword
+        $s5 = ""Disconnect"" wide fullword
+        $s6 = ""Pw_Error"" wide fullword
+        $s7 = ""Pw_OK"" wide fullword
+        $s8 = ""Sysinfo"" wide fullword
+        $s9 = ""Download"" wide fullword
+        $s10 = ""UploadFileOk"" wide fullword
+        $s11 = ""RemoteRun"" wide fullword
+        $s12 = ""FileManager"" wide fullword
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        filesize < 200KB and
+        6 of them
+}","",1,20161107
+5820ae72-a878-4992-b659-49798e96ca05,17,Artifacts dropped,yara,"rule keyboy_errors
+{
+    meta:
+        author = ""Matt Brooks, @cmatthewbrooks""
+        desc = ""Matches the sample's shell error2 log statements""
+        date = ""2016-08-28""
+        md5 = ""495adb1b9777002ecfe22aaf52fcee93""
+    
+    strings:
+        //These strings are in ASCII pre-2015 and UNICODE in 2016
+        $error = ""Error2"" ascii wide
+        //2016 specific:
+        $s1 = ""Can't find [%s]!Check the file name and try again!"" ascii wide
+        $s2 = ""Open [%s] error! %d"" ascii wide
+        $s3 = ""The Size of [%s] is zero!"" ascii wide
+        $s4 = ""CreateThread DownloadFile[%s] Error!"" ascii wide
+        $s5 = ""UploadFile [%s] Error:Connect Server Failed!"" ascii wide
+        $s6 = ""Receive [%s] Error(Recved[%d] != Send[%d])!"" ascii wide
+        $s7 = ""Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s"" ascii wide
+        $s8 = ""CreateThread UploadFile[%s] Error!"" ascii wide
+        //Pre-2016:
+        $s9 = ""Ready Download [%s] ok!"" ascii wide
+        $s10 = ""Get ControlInfo from FileClient error!"" ascii wide
+        $s11 = ""FileClient has a error!"" ascii wide
+        $s12 = ""VirtualAlloc SendBuff Error(%d)"" ascii wide
+        $s13 = ""ReadFile [%s] Error(%d)..."" ascii wide
+        $s14 = ""ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error..."" ascii wide
+        $s15 = ""CreateThread DownloadFile[%s] Error!"" ascii wide
+        $s16 = ""RecvData MyRecv_Info Size Error!"" ascii wide
+        $s17 = ""RecvData MyRecv_Info Tag Error!"" ascii wide
+        $s18 = ""SendData szControlInfo_1 Error!"" ascii wide
+        $s19 = ""SendData szControlInfo_3 Error!"" ascii wide
+        $s20 = ""VirtualAlloc RecvBuff Error(%d)"" ascii wide
+        $s21 = ""RecvData Error!"" ascii wide
+        $s22 = ""WriteFile [%s} Error(%d)..."" ascii wide
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        filesize < 200KB and
+        $error and 3 of ($s*)
+}","",1,20161107
+5820ae84-8770-42eb-a2f4-497a8e96ca05,17,Artifacts dropped,yara,"rule keyboy_systeminfo
+{
+    meta:
+        author = ""Matt Brooks, @cmatthewbrooks""
+        desc = ""Matches the system information format before sending to C2""
+        date = ""2016-08-28""
+        md5 = ""495adb1b9777002ecfe22aaf52fcee93""
+    
+    strings:
+        //These strings are ASCII pre-2015 and UNICODE in 2016
+        $s1 = ""SystemVersion:    %s"" ascii wide
+        $s2 = ""Product  ID:      %s"" ascii wide
+        $s3 = ""InstallPath:      %s"" ascii wide
+        $s4 = ""InstallTime:      %d-%d-%d, %02d:%02d:%02d"" ascii wide
+        $s5 = ""ResgisterGroup:   %s"" ascii wide
+        $s6 = ""RegisterUser:     %s"" ascii wide
+        $s7 = ""ComputerName:     %s"" ascii wide
+        $s8 = ""WindowsDirectory: %s"" ascii wide
+        $s9 = ""System Directory: %s"" ascii wide
+        $s10 = ""Number of Processors:       %d"" ascii wide
+        $s11 = ""CPU[%d]:  %s: %sMHz"" ascii wide
+        $s12 = ""RAM:         %dMB Total, %dMB Free."" ascii wide
+        $s13 = ""DisplayMode: %d x %d, %dHz, %dbit"" ascii wide
+        $s14 = ""Uptime:      %d Days %02u:%02u:%02u"" ascii wide
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        filesize < 200KB and
+        7 of them
+}","",1,20161107
+5820ae9b-0028-4ea1-bc1f-49798e96ca05,17,Artifacts dropped,yara,"import ""pe""
+rule keyboy_related_exports
+{
+    meta:
+        author = ""Matt Brooks, @cmatthewbrooks""
+        desc = ""Matches the new 2016 sample's export""
+        date = ""2016-08-28""
+        md5 = ""495adb1b9777002ecfe22aaf52fcee93""
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+
+
+        filesize < 200KB and
+
+
+        //The malware family seems to share many exports
+        //but this is the new kid on the block.
+        pe.exports(""Embedding"") or
+        pe.exports(""SSSS"") or
+        pe.exports(""GetUP"")
+}","",1,20161107
+5820aeb4-7f4c-4e5b-af06-497a8e96ca05,17,Artifacts dropped,yara,"import ""pe""
+rule keyboy_init_config_section
+{
+    meta:
+        author = ""Matt Brooks, @cmatthewbrooks""
+        desc = ""Matches the Init section where the config is stored""
+        date = ""2016-08-28""
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+
+        //Payloads are normally smaller but the new dropper we spotted
+        //is a bit larger.
+        filesize < 300KB and
+
+        //Observed virtual sizes of the .Init section vary but they've
+        //always been 1024, 2048, or 4096 bytes.
+        for any i in (0..pe.number_of_sections - 1):
+            (
+                pe.sections[i].name == "".Init"" and
+                pe.sections[i].virtual_size % 1024 == 0
+            )
+}","",1,20161107
+5820aed7-4eac-4c87-ac4e-49798e96ca05,17,Payload delivery,yara,"rule CVE_2012_0158_KeyBoy {
+  meta:
+      author = ""Etienne Maynier <etienne@citizenlab.ca>""
+      description = ""CVE-2012-0158 variant""
+      file = ""8307e444cad98b1b59568ad2eba5f201""
+
+  strings:
+      $a = ""d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001"" nocase // OLE header
+      $b = ""ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"" nocase // junk data
+      $c = /5(\{\\b0\}|)[ ]*2006F00(\{\\b0\}|)[ ]*6F007(\{\\b0\}|)[ ]*400200045(\{\\b0\}|)[ ]*006(\{\\b0\}|)[ ]*E007(\{\\b0\}|)[ ]*400720079/ nocase
+      $d = ""MSComctlLib.ListViewCtrl.2""
+      $e = ""ac38c874503c307405347aaaebf2ac2c31ebf6e8e3"" nocase //decoding shellcode
+
+  condition:
+      all of them
+}","",1,20161107
+5820aeee-3fdc-47cc-b940-497a8e96ca05,17,Payload delivery,yara,"rule keyboy_exploit_doc_meta{
+    meta:
+        author = ""Matt Brooks, @cmatthewbrooks""
+        desc = ""Matches the meta associated with these exploit docs""
+        date = ""2016-09-30""
+
+    strings:
+        $role = ""{\\author Master}{\\operator Master}""
+        $creatim = ""{\\creatim\\yr2015\\mo10\\dy16\\hr11\\min37}""
+        $revtim = ""{\\revtim\\yr2015\\mo10\\dy16\\hr13\\min54}""
+        
+    condition:
+        uint32be(0) == 0x7B5C7274 and
+        filesize < 1MB and
+        all of them
+}","",1,20161107
+58235402-9d54-437c-b845-69fe8e96ca05,17,Artifacts dropped,regkey,"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ver","Contains the Keyboy version",1,20161116
+5823989b-68f0-4831-b1d8-49798e96ca05,17,Payload delivery,sha256,"5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49","dw20.exe dropper",1,20161109
+582398da-78c0-47ed-8bb9-49798e96ca05,17,Artifacts dropped,sha256,"9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04","Wab32res.dll payload, KeyBoy 20160509",1,20161109
+5823990b-db7c-45c9-9afb-69fe8e96ca05,17,Payload delivery,md5,"23d284245e53ae4fe05c517d807ffccf","dropper of 'agewkassif' version",1,20161109
+5823995f-701c-4616-84f5-49798e96ca05,17,Payload delivery,sha256,"542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf","dropper of 'agewkassif' sample",1,20161109
+58239987-0038-44ba-997f-49798e96ca05,17,Artifacts dropped,md5,"087bffa8a570079948310dc9731c5709","wab32res.dll, agewkassif version",1,20161109
+582399a3-04f8-4542-b205-49798e96ca05,17,Artifacts dropped,sha256,"5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88","Wab32res.dll payload, KeyBoy agewkassif version",1,20161109
+582c9016-1a1c-471e-890f-69fe8e96ca05,17,Network activity,ip-dst,"112.10.117.47","Other IP hosting tibetvoices.com",1,20161116

data/ioc/spyware/citizen_lab/201611_KeyBoy/kb_c2Decode.py

@@ -0,0 +1,107 @@
+''' 
+KeyBoy C2 traffic pcap decoder
+From: It's Parliamentary: KeyBoy and the targeting of the Tibetan Community
+Permalink: https://citizenlab.org/2016/11/parliament-keyboy/
+
+Adam Hulcoop / September 19, 2016
+adam.hulcoop[@]citizenlab.ca
+
+32 bit support only [64bit can use manual override]
+'''
+
+import scapy
+import argparse
+import logging
+import sys,getopt
+logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
+from scapy.all import TCP,rdpcap,Raw
+
+def egcd(a, b):
+    if a == 0:
+        return (b, 0, 1)
+    else:
+        g, y, x = egcd(b % a, a)
+        return (g, x - (b // a) * y, y)
+
+def modinv(a, m):
+    g, x, y = egcd(a, m)
+    if g != 1:
+        raise Exception('modular inverse does not exist')
+    else:
+        return x % m
+
+if __name__ == "__main__":
+  
+	parser = argparse.ArgumentParser(description='Decode KeyBoy C2 traffic from pcap file')
+	group = parser.add_mutually_exclusive_group(required=True)
+	group.add_argument('-k','--key',type=int, help="Manually provide C2 decode key")
+	group.add_argument('-b','--binary',help="KeyBoy binary")
+	parser.add_argument('PCAPF', help='PCAP File containing c2 traffic')
+	parser.add_argument('--verbose','-v',action='store_true',help='Enable verbose output')
+	args = parser.parse_args()
+
+	if args.verbose:
+		logging.basicConfig(format='%(message)s',level=logging.DEBUG)
+	else:
+		logging.basicConfig(format='%(message)s',level=logging.WARNING)
+
+
+
+	print "============================"
+	print "{KeyBoy C2 Traffic decoder}"
+	print "============================"
+	print ""
+
+	if args.binary: 
+		with open(args.binary,'rb') as keyboy_file:
+			keyboy_file.seek(0,2)
+			num_bytes_kb = keyboy_file.tell()
+
+			count =0
+			for i in range(num_bytes_kb):
+				keyboy_file.seek(i)
+				sig_p1 = keyboy_file.read(4)
+				sig_const = keyboy_file.read(1)
+				sig_p2 = keyboy_file.read(7)
+
+				if ( (sig_p1 == b"\x8a\x04\x73\xb1") or (sig_p1 == b"\x8a\x04\x1e\xb1") ):
+					if ( (sig_p2 == b"\xf6\xe9\x88\x04\x73\x53\x46") or (sig_p2 == b"\xf6\xe9\x88\x04\x1e\x8b\xc3") ):
+						#sig_const should be the encoding constant
+						#print "Found const: 0x%x" % ord(sig_const)
+						logging.debug("Found constant: 0x%x" % ord(sig_const))
+						encode_val = ord(sig_const)
+						count += 1
+						break
+
+
+			if count < 1 :
+				logging.warn("Didn't find signature\nQuitting..")
+				sys.exit(1)
+			else:
+				logging.debug( "Computing decode value...")
+				inv = modinv(encode_val,256)
+				logging.debug("Found decoding multiplier (inverse): %s" % hex(inv))
+	else:
+		logging.debug("Using manually specified decoding multiplier (inverse): %s" % hex(args.key))
+		inv = args.key
+
+	logging.warn ("Searching PCAP for RAW TCP packets and decoding...")
+	logging.warn("")
+
+
+	data =''
+	p = rdpcap(args.PCAPF)
+	for pkt in p:
+		if( pkt.haslayer(TCP)):
+			if( pkt.haslayer(Raw)):
+				ba = bytearray(pkt.getlayer(Raw).load)
+				for byte in ba:
+					if byte == 0:
+						data += ''
+					else:
+						data += chr(int((byte*inv) & 255))
+		
+	logging.warn(data)
+
+
+

data/ioc/spyware/citizen_lab/201611_KeyBoy/kb_configDecode.py

@@ -0,0 +1,196 @@
+''' 
+KeyBoy Config file decoder
+From: It's Parliamentary: KeyBoy and the targeting of the Tibetan Community
+Permalink: https://citizenlab.org/2016/11/parliament-keyboy/
+
+Adam Hulcoop / September 19, 2016
+adam.hulcoop[@]citizenlab.ca
+'''
+import sys
+import argparse
+import logging
+
+LookupTable = {}
+
+# Function to compute 9-bit sliding window values and return list of converted indices
+def byteDecoder(rawBytes):
+	#rawBytes should be bytearray of values
+	k=0
+	ba = []
+
+	bytex=0
+	while( bytex < len(rawBytes) -1):
+
+		index = 0
+		ix = bytex
+		t=0
+		while ( index < 9):
+			
+			while (k<8):
+				
+				if( ( ord(rawBytes[ix]) & (1 << (7-k))) > 0  ):
+					t = 2*t +1
+				else:
+					t = 2*t
+				
+				index+=1
+				k+=1
+				
+				if( index > 8):
+					break
+				
+				if ( k==8 ):
+					ix+=1
+					k=0
+				
+				
+			if (index<=8):
+				k=0
+			elif ( (index == 9) and (k==8)):
+				k=0
+				bytex+=1
+		#t should hold the resultant value
+		ba.append(t)
+		bytex+=1
+
+
+	return ba
+
+
+
+
+def CreateLookupTable():
+	for x in xrange(0,256):
+		LookupTable[x] = "{:x}".format(x)
+
+	# 0x101 is used as the exit value
+	LookupTable[257]  = "reserved"
+
+	return
+
+
+
+def BuildExtraLookupTable(curIndex, prevIndex):
+	#curIndex and prevIndex are indices from the decoded input file
+	startFrom = len(LookupTable)
+
+	if( curIndex > startFrom) :
+		# if we are looking up an index beyond the existing table size
+		vPrev = LookupTable.get(prevIndex)
+		vCur = LookupTable.get(prevIndex)
+	else:
+		vPrev = LookupTable.get(prevIndex)
+		vCur = LookupTable.get(curIndex)
+	
+	newVal = vPrev
+
+
+	if( len(vCur.split(',')) > 1 ):
+		augItem = vCur.split(',')[0]
+	else:
+		augItem = vCur
+
+	newVal = ','.join([vPrev,augItem])
+
+	LookupTable[startFrom+1] = newVal
+	logging.debug("0x%x => %s" % ((startFrom+1),newVal ))
+	
+	return
+
+	
+if __name__ == "__main__":
+  
+	parser = argparse.ArgumentParser(description='Decode KeyBoy backdoor configuration files')
+	parser.add_argument('FILE', help='KeyBoy encoded config file')
+	parser.add_argument('--verbose','-v',action='store_true',help='Enable verbose output')
+	parser.add_argument('--skip','-s',type=int,help='Skip over <SKIP> bytes at beginning of file')
+	args = parser.parse_args()
+
+	if args.verbose:
+		logging.basicConfig(format='%(message)s',level=logging.DEBUG)
+	else:
+		logging.basicConfig(format='%(message)s',level=logging.WARNING)
+
+
+	print "============================"
+	print "{KeyBoy Config file Decoder}"
+	print "============================"
+	print ""
+
+	with open(args.FILE, "rb") as f:
+
+		if args.skip is None:
+			f.seek(0,0)
+		else:
+			logging.warn("Skipping %i bytes.." % args.skip)
+			f.seek(args.skip,0)
+
+		szfile = f.read(8)
+		szf_dat = int(szfile,16)
+		logging.debug("Size of decoded config file:\t%i bytes" % szf_dat)
+
+		szconf = f.read(8)
+		szc_dat = int(szconf,16)
+		logging.debug("Size of encoded config data:\t%i bytes" % szc_dat)
+		logging.debug("")
+
+		bytesRaw = f.read(szc_dat)
+		ba = byteDecoder(bytesRaw)
+
+	#create the initial Lookup table
+	CreateLookupTable()
+
+	ResultsList = []
+
+	#Build the extra lookup table values
+	logging.debug("Dynamic lookup table entries:")
+	for val in range(len(ba)):
+
+		#for each entry in the bytes array,
+		# we need to look up the value in the table.
+		# As we go, we need to build new entries on the table
+		# corresponding to the value from this lookup, concatenated with the first character from the
+		# the value printed in the previous lookup. BuildExtraLookupTable function does that step.
+		
+		if( val == 0):
+			continue
+		elif (val == 1):
+			ResultsList.append(LookupTable.get(ba[val]))
+			prevValue = ba[val]
+		else:
+			curValue = ba[val]
+			if (curValue != 257):
+				BuildExtraLookupTable(curValue, prevValue)
+				ResultsList.append(LookupTable.get(ba[val]))
+				prevValue= curValue
+		
+	logging.debug("")
+	logging.debug("Decoded index list:")
+	logging.debug(['0x%x' % j for j in ba])
+	logging.debug("")
+
+
+	resultData = ",".join(ResultsList)
+	hChars = resultData.split(',')
+	Output = ""
+	for h in hChars:
+		Output += chr(int(h,16))
+
+	logging.debug("Retrieved config character array:")
+	logging.debug(['0x%x' % int(m,16) for m in hChars])
+	logging.debug("")
+
+	TokenizedOutput = Output.split('\r\n')
+	ConfigSections = ['Identity Code:','C2 Host/IP #1:','C2 Host/IP #2:','C2 Host/IP #3:','C2 Port #1:','C2 Port #2:','C2 Port #3:','Password:','Campaign ID:','']
+
+	logging.warn("Configuration Data:")
+	headr = "=" * 30
+	logging.warn(headr)
+
+	for x in range(len(TokenizedOutput)-1):
+		logging.warn("%s\t%s" % (ConfigSections[x],TokenizedOutput[x]))
+
+	logging.warn("")
+
+
+

data/ioc/spyware/citizen_lab/201611_KeyBoy/keyboy.yar

@@ -0,0 +1,289 @@
+import "pe"
+
+/*
+*
+* This section of the rules are all specific to the new 2016
+* KeyBoy sample targeting the Tibetan community. Other following
+* sections capture file characteristics observed across multiple
+* years of development. Don't miss the exploit doc signatures
+* at the very end.
+*
+*/
+rule new_keyboy_export
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Matches the new 2016 sample's export"
+        date = "2016-08-28"
+        md5 = "495adb1b9777002ecfe22aaf52fcee93"
+
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+
+
+        filesize < 200KB and
+
+
+        //The malware family seems to share many exports
+        //but this is the new kid on the block.
+        pe.exports("cfsUpdate")
+}
+
+
+rule new_keyboy_header_codes
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Matches the 2016 sample's header codes"
+        date = "2016-08-28"
+        md5 = "495adb1b9777002ecfe22aaf52fcee93"
+
+    strings:
+        $s1 = "*l*" wide fullword
+        $s2 = "*a*" wide fullword
+        $s3 = "*s*" wide fullword
+        $s4 = "*d*" wide fullword
+        $s5 = "*f*" wide fullword
+        $s6 = "*g*" wide fullword
+        $s7 = "*h*" wide fullword
+
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+
+
+        filesize < 200KB and
+
+
+        all of them
+}
+
+
+/*
+*
+* This section of the rules are all broader and will hit on
+* older KeyBoy samples and other samples possibly part of a
+* a larger development effort.
+*
+*/
+
+rule keyboy_commands
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Matches the 2016 sample's sent and received commands"
+        date = "2016-08-28"
+        md5 = "495adb1b9777002ecfe22aaf52fcee93"
+
+    strings:
+        $s1 = "Update" wide fullword
+        $s2 = "UpdateAndRun" wide fullword
+        $s3 = "Refresh" wide fullword
+        $s4 = "OnLine" wide fullword
+        $s5 = "Disconnect" wide fullword
+        $s6 = "Pw_Error" wide fullword
+        $s7 = "Pw_OK" wide fullword
+        $s8 = "Sysinfo" wide fullword
+        $s9 = "Download" wide fullword
+        $s10 = "UploadFileOk" wide fullword
+        $s11 = "RemoteRun" wide fullword
+        $s12 = "FileManager" wide fullword
+
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+
+
+        filesize < 200KB and
+
+
+        6 of them
+}
+
+rule keyboy_errors
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Matches the sample's shell error2 log statements"
+        date = "2016-08-28"
+        md5 = "495adb1b9777002ecfe22aaf52fcee93"
+
+    strings:
+        //These strings are in ASCII pre-2015 and UNICODE in 2016
+        $error = "Error2" ascii wide
+        //2016 specific:
+        $s1 = "Can't find [%s]!Check the file name and try again!" ascii wide
+        $s2 = "Open [%s] error! %d" ascii wide
+        $s3 = "The Size of [%s] is zero!" ascii wide
+        $s4 = "CreateThread DownloadFile[%s] Error!" ascii wide
+        $s5 = "UploadFile [%s] Error:Connect Server Failed!" ascii wide
+        $s6 = "Receive [%s] Error(Recved[%d] != Send[%d])!" ascii wide
+        $s7 = "Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s" ascii wide
+        $s8 = "CreateThread UploadFile[%s] Error!" ascii wide
+        //Pre-2016:
+        $s9 = "Ready Download [%s] ok!" ascii wide
+        $s10 = "Get ControlInfo from FileClient error!" ascii wide
+        $s11 = "FileClient has a error!" ascii wide
+        $s12 = "VirtualAlloc SendBuff Error(%d)" ascii wide
+        $s13 = "ReadFile [%s] Error(%d)..." ascii wide
+        $s14 = "ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error..." ascii wide
+        $s15 = "CreateThread DownloadFile[%s] Error!" ascii wide
+        $s16 = "RecvData MyRecv_Info Size Error!" ascii wide
+        $s17 = "RecvData MyRecv_Info Tag Error!" ascii wide
+        $s18 = "SendData szControlInfo_1 Error!" ascii wide
+        $s19 = "SendData szControlInfo_3 Error!" ascii wide
+        $s20 = "VirtualAlloc RecvBuff Error(%d)" ascii wide
+        $s21 = "RecvData Error!" ascii wide
+        $s22 = "WriteFile [%s} Error(%d)..." ascii wide
+
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+
+
+        filesize < 200KB and
+
+
+        $error and 3 of ($s*)
+}
+
+
+rule keyboy_systeminfo
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Matches the system information format before sending to C2"
+        date = "2016-08-28"
+        md5 = "495adb1b9777002ecfe22aaf52fcee93"
+
+    strings:
+        //These strings are ASCII pre-2015 and UNICODE in 2016
+        $s1 = "SystemVersion:    %s" ascii wide
+        $s2 = "Product  ID:      %s" ascii wide
+        $s3 = "InstallPath:      %s" ascii wide
+        $s4 = "InstallTime:      %d-%d-%d, %02d:%02d:%02d" ascii wide
+        $s5 = "ResgisterGroup:   %s" ascii wide
+        $s6 = "RegisterUser:     %s" ascii wide
+        $s7 = "ComputerName:     %s" ascii wide
+        $s8 = "WindowsDirectory: %s" ascii wide
+        $s9 = "System Directory: %s" ascii wide
+        $s10 = "Number of Processors:       %d" ascii wide
+        $s11 = "CPU[%d]:  %s: %sMHz" ascii wide
+        $s12 = "RAM:         %dMB Total, %dMB Free." ascii wide
+        $s13 = "DisplayMode: %d x %d, %dHz, %dbit" ascii wide
+        $s14 = "Uptime:      %d Days %02u:%02u:%02u" ascii wide
+
+
+
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+
+
+        filesize < 200KB and
+
+
+        7 of them
+}
+
+
+rule keyboy_related_exports
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Matches the new 2016 sample's export"
+        date = "2016-08-28"
+        md5 = "495adb1b9777002ecfe22aaf52fcee93"
+
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+
+
+        filesize < 200KB and
+
+
+        //The malware family seems to share many exports
+        //but this is the new kid on the block.
+        pe.exports("Embedding") or
+        pe.exports("SSSS") or
+        pe.exports("GetUP")
+}
+
+// Note: The use of the .Init section has been observed in nearly
+// all samples with the exception of the 2013 VN dropper from the
+// Rapid7 blog. The config data was stored in that sample's .data
+// section.
+rule keyboy_init_config_section
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Matches the Init section where the config is stored"
+        date = "2016-08-28"
+
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+
+
+        //Payloads are normally smaller but the new dropper we spotted
+        //is a bit larger.
+        filesize < 300KB and
+
+
+        //Observed virtual sizes of the .Init section vary but they've
+        //always been 1024, 2048, or 4096 bytes.
+        for any i in (0..pe.number_of_sections - 1):
+            (
+                pe.sections[i].name == ".Init" and
+                pe.sections[i].virtual_size % 1024 == 0
+            )
+}
+
+
+/*
+*
+* These signatures fire on the exploit documents used in this
+* operation.
+*
+*/
+rule CVE_2012_0158_KeyBoy {
+  meta:
+      author = "Etienne Maynier <etienne@citizenlab.ca>"
+      description = "CVE-2012-0158 variant"
+      file = "8307e444cad98b1b59568ad2eba5f201"
+
+
+  strings:
+      $a = "d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001" nocase // OLE header
+      $b = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" nocase // junk data
+      $c = /5(\{\\b0\}|)[ ]*2006F00(\{\\b0\}|)[ ]*6F007(\{\\b0\}|)[ ]*400200045(\{\\b0\}|)[ ]*006(\{\\b0\}|)[ ]*E007(\{\\b0\}|)[ ]*400720079/ nocase
+      $d = "MSComctlLib.ListViewCtrl.2"
+      $e = "ac38c874503c307405347aaaebf2ac2c31ebf6e8e3" nocase //decoding shellcode
+
+
+  condition:
+      all of them
+}

data/ioc/spyware/citizen_lab/201611_KeyBoy/openioc.ioc

@@ -0,0 +1,109 @@
+<?xml version="1.0" encoding="utf-8"?>
+<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5820aa49-6a40-4e51-86f9-497a8e96ca05" last-modified="2016-11-07T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
+  <short_description>Event #17</short_description>
+  <description>It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community</description>
+  <keywords />
+  <authored_by>citizenlab</authored_by>
+  <authored_date>2016-11-07T00:00:00</authored_date>
+  <links />
+  <definition>
+    <Indicator operator="OR" id="5820aa49-6a40-4e51-86f9-497a8e96ca05">
+      <IndicatorItem id="495adb1b9777002ecfe22aaf52fcee93" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="0c7e55509e0b6d4277b3facf864af018" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="98977426d544bd145979f65f0322ae30" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="c5b5f01ba24d6c02636388809f44472e" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="371bc132499f455f06fa80696db0df27" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="087bffa8a570079948310dc9731c5709" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ver" condition="is">
+        <Context document="Network" search="RegistryItem/KeyPath" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04" condition="is">
+        <Context document="FileItem" search="FileItem/Sha256sum" type="mir" />
+        <Content type="sha256"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88" condition="is">
+        <Context document="FileItem" search="FileItem/Sha256sum" type="mir" />
+        <Content type="sha256"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="tibetvoices.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="www.about.jkub.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="www.eleven.mypop3.org" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="www.backus.myftp.name" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="45.125.12.147" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="103.40.102.233" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="116.193.154.69" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="103.242.134.243" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="45.32.47.148" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="157.7.84.81" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="192.241.149.43" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="112.10.117.47" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="23d284245e53ae4fe05c517d807ffccf" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49" condition="is">
+        <Context document="FileItem" search="FileItem/Sha256sum" type="mir" />
+        <Content type="sha256"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf" condition="is">
+        <Context document="FileItem" search="FileItem/Sha256sum" type="mir" />
+        <Content type="sha256"></Content>
+      </IndicatorItem>
+    </Indicator>
+  </definition>
+</ioc>