AgentTesla分析报告

import re
import pathlib
import os
import shutil
from collections import deque
#from matplotlib.style

class AgentTeslaAnalysis():
    version = '1.0.0'
    def __init__(self, folder):
        self.folder = folder
        self.code = None
        self.property_dict1 = {}
        self.property_dict = {}
        self.property_map = {
            '.Host =': self._extract_email_host,
            'NetworkCredential': self._extract_email_u_p,
            'NameValueCollection': self._extract_Http_host,
            'WebRequest.Create' : self._extract_Tor_host
        }
        self.config = {}

    def process(self):
        for _ in pathlib.Path(self.folder).rglob("*"):
            if not os.path.isfile(str(_)): continue
            with open(str(_), 'r') as fp:
                file_stream = fp.read()
                if re.search(r'(public static [\d\w]+ [\d\w]+ \= .*?;[\n\t ]+){1,}',file_stream):
                    self.code = file_stream
                    self.create_mapping()

        for _ in pathlib.Path(self.folder).rglob("*"):
            if not os.path.isfile(str(_)): continue
            with open(str(_), 'r') as fp:
                file_stream = fp.read()
                if re.search(
                        r'internal static byte\[\] {1,}= {1,}new byte\[\d+\].*?\{([\t\n\d ]+,{0,1}){500,}[\n\t]+\}',
                        file_stream, re.DOTALL):
                    self.code = file_stream
                    self.config_extract()
        return

    def create_mapping(self):
            if re.search(r'public static string [\d\w]+ \= .*?\.[\d\w]+\(\)',self.code):
                for _ in re.findall(r'public static string [\d\w]+ \= .*?\.[\d\w]+\(\)',self.code):
                    _list =re.findall(r'public static string ([\d\w]+) \= .*?\.([\d\w]+)\(\)',_)
                    self.property_dict1[_list[0][0]] = _list[0][1]
                    _list.clear()


    def config_extract(self):
        iter_bytes = re.search(
            r'internal static byte\[\] {1,}= {1,}new byte\[\d+\].*?\{([\t\n\d ]+,{0,1}){500,}[\n\t]+\}',
            self.code, re.DOTALL).group()
        enc_bytes = []
        for _ in re.findall(r'[\n\t ]+(\d{1,3})', iter_bytes):
            enc_bytes.append(int(_))
        xor_key = re.search(r'\^ i\) \^ (0x[A-Fa-f0-9]{2})u', self.code)
        if xor_key:
            xor_key = int(re.findall(r'0x([a-fA-F0-9]{2})', xor_key.group())[0], 16)

        def decrypt(key, enc_array):
            res = []
            for index, _ in enumerate(enc_array):
                res.append(((_ ^ index) ^ xor_key) & 0xFF)
            return res

        dec_bytes = decrypt(xor_key, enc_bytes)

        for _ in re.findall(
                r'public static string ([\d\w]+)\(\).*?\{.*?return .*?\.\[\d+\] \?\? \(\d+, (\d+), (\d+)\);.*?\}',
                self.code, re.DOTALL):
            self.property_dict[_[0]] = ''.join([chr(c) for c in dec_bytes[int(_[1]): int(_[1]) + int(_[2])]])
        for _ in pathlib.Path(self.folder).rglob("*"):
            if not os.path.isfile(str(_)): continue
            reback_code = deque(maxlen=3)
            with open(str(_), 'r') as fp:
                for code_line in fp.readlines():
                    reback_code.append(code_line)
                    for k, v in self.property_map.items():
                        if code_line.find(k) >= 0:
                            v(list(reback_code))

    def _extract_Tor_host(self, code_line):
        if re.search(r'HttpWebRequest .*? \= \(HttpWebRequest\)WebRequest\.Create\(.*?\)',code_line[-1]):
            if re.search(r'string .*? \= .*?\.[\d\w]+\(\)',code_line[-2]):
                [http_TorProxy_host] = re.findall(r'string .*? \= .*?\.([\d\w]+)\(\)',code_line[-2])
                self.config["http_TorProxy_host"] = self.property_dict.get(http_TorProxy_host,'')
    #邮箱的host完成
    def _extract_email_host(self, code_line):
        code_line = code_line[-1]
        value_data = code_line.split('=')[1]
        if re.search(r'\.[\d\w]+\(\)', value_data):
            key = re.findall(r'\.([\d\w]+)\(\)', value_data)[0]
            if key in self.property_dict:
                self.config['EmailHost'] = self.property_dict[key]
        elif re.search(r'global\:\:.\..\..\..',value_data):
            key = re.findall(r'global\:\:.\..\..\.(.)', value_data)[0]
            self.config['EmailHost'] = self.property_dict[self.property_dict1[key[0]]]

    def _extract_Http_host(self,code_line):
        if re.search(r'global\:\:.\..\..\...*?, {1,}.*?\, {1,}.*?\, {1,}.*?\.[\d\w]+\(\)\, {1,}.*?\, {1,}\(NameValueCollection\).*?\)', code_line[-1]):
            [httpHost] = re.findall(
                r'global\:\:.\..\..\.(.).*?, {1,}.*?\, {1,}.*?\, {1,}.*?\.[\d\w]+\(\)\, {1,}.*?\, {1,}\(NameValueCollection\).*?\)',
                code_line[-1])
            self.config['httpHost'] = self.property_dict.get(httpHost[0], '')
        if re.search(r'.*?\(.*?\.[\d\w]+\(\)\, {1,}.*?\, {1,}.*?\, {1,}.*?\.[\d\w]+\(\)\, {1,}.*?\, {1,}\(NameValueCollection\).*?\)', code_line[-1]):
            [httpHost] = re.findall(r'.*?\(.*?\.([\d\w]+)\(\)\, {1,}.*?\, {1,}.*?\, {1,}.*?\.[\d\w]+\(\)\, {1,}.*?\, {1,}\(NameValueCollection\).*?\)', code_line[-1])
            self.config['httpHost'] = self.property_dict.get(httpHost, '')

    #邮箱和ftp
    def _extract_email_u_p(self, code_line):
        mode = 'Email'
        for _ in code_line:
            if _.find("WebRequest.Create") >= 0:
                if re.search(r'WebRequest\.Create\([\d\w_-]+\.[\d\w]+\(\) \+ .*?\)', code_line[1]):
                    [FtpHost] =re.findall(r'WebRequest\.Create\(.*?\.([\d\w]+)\(\) \+ .*?\)', code_line[1])
                    self.config['FtpHost'] = self.property_dict.get(FtpHost, '')
                elif re.search(r'WebRequest\.Create\(global::.\..\..\.. .*?\)', code_line[1]):
                    key = re.findall(r'WebRequest\.Create\(global::.\..\..\.(.) .*?\)', code_line[1])
                    FtpHost = self.property_dict1[key[0]]
                    self.config['FtpHost'] = self.property_dict.get(FtpHost, '')
            if _.find("ftp") != -1 and _.find("NetworkCredential") != -1 :
                mode = 'Ftp'
                break
        if re.search(r'NetworkCredential\([\d\w_-]+\.[\d\w]+\(\), {1,}[\d\w_-]+\.[\d\w]+\(\)\)', code_line[2]):
            [user, password] = \
            re.findall(r'NetworkCredential\([\d\w_-]+\.([\d\w]+)\(\), {1,}[\d\w_-]+\.([\d\w]+)\(\)\)', code_line[2])[0]
            if user and password and (user in self.property_dict or password in self.property_dict):
                self.config[f'{mode}UserName'] = self.property_dict.get(user, '')
                self.config[f'{mode}Password'] = self.property_dict.get(password, '')
        if re.search(r'NetworkCredential\(global\:\:.\..\..\..\, global\:\:.\..\..\..\)',  code_line[2]):
            key = re.findall(r'NetworkCredential\(global\:\:.\..\..\.(.)\, global\:\:.\..\..\.(.)\)',  code_line[2])
            self.config[f'{mode}UserName'] = self.property_dict.get(self.property_dict1[key[0][0]], '')
            self.config[f'{mode}Password'] = self.property_dict.get(self.property_dict1[key[0][1]], '')
            key.clear()
if __name__ == '__main__':
    if os.path.exists(".\\file"):
         shutil.rmtree(".\\file")
    os.system(".\\ilspycmd\\ilspycmd.exe -p -o .\\file " + input("文件路径: "))
    A = AgentTeslaAnalysis(".\\file")
    A.process()
    print(A.config)