Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/citizen_lab/201611_KeyBoy/README.md

@@ -0,0 +1,94 @@
+## KeyBoy IOCs
+
+This directory contains IOCs from the Citizen Lab report [It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community](https://citizenlab.org/2016/11/parliament-keyboy/) published the 17th of November 2016.
+
+Files included in this directory:
+* openioc.ioc : IOCs in OpenIOC format
+* stix.xml : IOCs in STIX XML format
+* iocs.csv : IOCs in csv format
+* keyboy.yar : Yara rules related to the KeyBoy samples identified
+* kb_c2Decode.py : script to decode KeyBoy C2 communications (see help hereafter)
+* kb_configDecode.py : script to decode KeyBoy configuration (see help hereafter)
+
+
+### kb_c2Decode.py
+
+Help:
+```bash
+$ python kb_c2Decode.py -h
+usage: kb_c2Decode.py [-h] (-k KEY | -b BINARY) [--verbose] PCAPF
+
+Decode KeyBoy C2 traffic from pcap file
+
+positional arguments:
+  PCAPF                 PCAP File containing c2 traffic
+
+optional arguments:
+  -h, --help            show this help message and exit
+  -k KEY, --key KEY     Manually provide C2 decode key
+  -b BINARY, --binary BINARY
+                        KeyBoy binary
+  --verbose, -v         Enable verbose output
+
+```
+
+Example:
+```
+$ python kb_c2Decode.py -b wab32res.dll dump.pcap
+============================
+{KeyBoy C2 Traffic decoder}
+============================
+
+Found constant: 0x71
+Computing decode value...
+Found decoding multiplier (inverse): 0x91
+Searching PCAP for RAW TCP packets and decoding...
+
+*a*
+HOME-PC
+192.168.100.103
+MyUser
+2016/06/03 00:24:20
+20151108
+```
+
+
+### kb_configDecode.py
+
+Help:
+```
+$ python kb_configDecode.py -h
+usage: kb_configDecode.py [-h] [--verbose] [--skip SKIP] FILE
+
+Decode KeyBoy backdoor configuration files
+
+positional arguments:
+  FILE                  KeyBoy encoded config file
+
+optional arguments:
+  -h, --help            show this help message and exit
+  --verbose, -v         Enable verbose output
+  --skip SKIP, -s SKIP  Skip over <SKIP> bytes at beginning of file
+
+```
+
+Example:
+
+```
+$ python kb_configDecode.py cfs.dat
+============================
+{KeyBoy Config file Decoder}
+============================
+
+Configuration Data:
+==============================
+Identity Code:	9876543210
+C2 Host/IP #1:	103.242.134.243
+C2 Host/IP #2:	103.242.134.243
+C2 Host/IP #3:	103.242.134.243
+C2 Port #1:	443
+C2 Port #2:	1234
+C2 Port #3:	1234
+Password:	password8888
+Campaign ID:	MyUser
+```