reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-banking-trojan-webinjects/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/skills/analyzing-banking-trojan-webinjects/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: analyzing-banking-trojan-webinjects
+description: 'Analyzes banking trojan webinject configurations to extract targeted institutions,
+  injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. Activates for
+  requests to analyze banking trojan webinjects, parse a webinject config, or map targeted banks
+  and credential-theft injections.'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - malware-analysis
+  - banking-trojan
+  - webinject
+  - fraud
+  - credential-theft
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1185
+  - T1557
+  - T1056.001
+d3fend:
+  - D3-SDA
+  - D3-DA
+references:
+  - 'MITRE ATT&CK T1185 Browser Session Hijacking — https://attack.mitre.org/techniques/T1185/'
+  - 'Zeus/SpyEye webinject format (public malware research) — https://attack.mitre.org/software/S0259/'
+---
+
+# Analyzing Banking Trojan Webinjects
+
+## When to Use
+
+- You have a banking trojan webinject config (Zeus/Gozi/Dridex-style `set_url`/`data_before`/
+  `data_inject` blocks) and want to extract targeted institutions and injected code.
+- You are mapping the web-fraud workflow (form-grabbing, fake fields, MFA interception).
+
+**Do not use** this to deploy or test injects against live banking sites. This skill parses the
+config statically and executes nothing.
+
+## Prerequisites
+
+- The decoded webinject config text (decrypt the config first if needed).
+
+## Safety & Handling
+
+- Treat injected JS/HTML as malicious; do not render it. Defang any exfil URLs.
+
+## Workflow
+
+### Step 1: Parse webinject blocks
+
+```bash
+python scripts/analyst.py parse webinjects.txt
+```
+
+Parses `set_url`/`data_before`/`data_inject`/`data_after` blocks into structured entries with the
+targeted URL pattern and the injected snippet.
+
+### Step 2: Extract targets and exfil endpoints
+
+List targeted institution URL patterns and any exfil endpoints referenced by the injected code.
+
+### Step 3: Classify the injection technique
+
+Identify form-grabbing, fake additional fields (SSN, PIN, card), and MFA/OTP interception from the
+injected markup/JS.
+
+### Step 4: Defang and report
+
+Defang URLs and summarize targeted banks and theft techniques.
+
+## Validation
+
+- Each webinject block is parsed into target URL + injection.
+- Exfil endpoints in injected code are extracted and defanged.
+- Injection techniques are classified from the snippet content.
+
+## Pitfalls
+
+- Encrypted/packed configs needing decryption before parsing.
+- Wildcard URL patterns matching broadly — note the scope.
+- Obfuscated injected JS hiding the true exfil endpoint.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the parser.
+- ATT&CK T1185 and webinject format references (linked in frontmatter).

vendor-new/analyst-ai-pack/skills/analyzing-banking-trojan-webinjects/references/api-reference.md

@@ -0,0 +1,43 @@
+# API Reference: Analyzing Banking Trojan Webinjects
+
+## Overview
+
+`scripts/analyst.py` parses Zeus/SpyEye-style webinject configs (`set_url` + `data_before`/
+`data_inject`/`data_after` blocks), associates each target URL pattern with its injected snippet,
+classifies the injection technique, and extracts/defangs exfil endpoints. It parses config text
+only, executes nothing, and never renders injected code.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | regex, JSON, file IO |
+
+## Core functions
+
+### `parse(path)`
+Returns webinject count, targeted URL patterns, and per-entry technique/exfil/preview details.
+
+## Technique classes
+
+- form_grabbing (onsubmit/form hooks)
+- fake_fields (SSN/PIN/card/CVV/DOB additions)
+- mfa_interception (OTP/2FA/token capture)
+- balance_manipulation (innerHTML/balance rewriting)
+
+## Webinject format
+
+`set_url <pattern> <flags>` followed by `data_before … data_end`, `data_inject … data_end`,
+`data_after … data_end`.
+
+## Usage
+
+```bash
+python scripts/analyst.py parse webinjects.txt
+```
+
+## Sources
+
+- MITRE ATT&CK T1185 Browser Session Hijacking — https://attack.mitre.org/techniques/T1185/
+- Zeus/SpyEye webinject grammar (set_url/data_before/data_inject) from public malware research
+- Web-fraud injection techniques (form-grab, fake fields, OTP capture) from banking-trojan analyses

vendor-new/analyst-ai-pack/skills/analyzing-banking-trojan-webinjects/scripts/analyst.py

@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+"""Parse banking trojan webinject configs (Zeus/SpyEye-style) into structured entries.
+
+Parses set_url / data_before / data_inject / data_after blocks, extracts the targeted URL pattern
+and injected snippet, classifies the injection technique, and extracts/defangs exfil endpoints.
+Parses config text only; executes nothing and does not render injected code.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+
+RE_SETURL = re.compile(r"set_url\s+(\S+)(?:\s+(\S+))?", re.I)
+RE_BLOCK = re.compile(
+    r"data_(before|inject|after)\b(.*?)data_end", re.I | re.S)
+RE_URL = re.compile(r"https?://[^\s\"'<>]+", re.I)
+
+TECHNIQUE_HINTS = {
+    "form_grabbing": ["onsubmit", "form", "addeventlistener", "password"],
+    "fake_fields": ["ssn", "social security", "pin", "card number", "cvv", "mother",
+                    "date of birth", "atm"],
+    "mfa_interception": ["otp", "one-time", "token", "2fa", "verification code", "sms code"],
+    "balance_manipulation": ["balance", "innerhtml", "replace"],
+}
+
+
+def parse(path: str) -> dict:
+    text = Path(path).read_text(encoding="utf-8-sig", errors="replace")
+    entries = []
+    # Split on set_url boundaries to associate each target with its following blocks.
+    chunks = re.split(r"(?=set_url\s)", text, flags=re.I)
+    for chunk in chunks:
+        m = RE_SETURL.search(chunk)
+        if not m:
+            continue
+        target = m.group(1)
+        inject = ""
+        for bname, body in RE_BLOCK.findall(chunk):
+            if bname.lower() == "inject":
+                inject = body.strip()
+        low = inject.lower()
+        techniques = [t for t, needles in TECHNIQUE_HINTS.items()
+                      if any(n in low for n in needles)]
+        exfil = sorted({u.replace("http", "hxxp").replace(".", "[.]")
+                        for u in RE_URL.findall(inject)})
+        entries.append({
+            "target_url": target,
+            "techniques": techniques,
+            "exfil_endpoints": exfil,
+            "inject_preview": inject[:160],
+        })
+    targets = sorted({e["target_url"] for e in entries})
+    return {
+        "webinject_count": len(entries),
+        "targeted_url_patterns": targets,
+        "entries": entries,
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Parse banking trojan webinjects")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("parse")
+    p.add_argument("file")
+    args = parser.parse_args(argv)
+    print(json.dumps(parse(args.file), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())