API Reference: Building Config Extractors

Overview

scripts/analyst.py is a declarative config-extraction engine: given a JSON spec describing the config blob location, ordered decode layers, and field definitions, it extracts a structured, defanged config from a sample. It reads bytes statically and executes nothing.

Dependencies

Package	Version	Purpose
(stdlib)	—	base64, struct, JSON, file IO

Spec format

{
  "blob": {"marker": "CFG0", "length": 256},
  "decode": [{"type": "xor", "key": "0x5a"}, {"type": "base64"}],
  "fields": [
    {"name": "c2", "offset": 0, "length": 64, "type": "str"},
    {"name": "port", "offset": 64, "type": "u16"},
    {"name": "ip", "offset": 66, "type": "ipv4"}
  ]
}

blob: offset+length or marker+length (searches for the marker).
decode: ordered xor (single-byte 0x.. or multi-byte string key) and base64 layers.
fields: str, u16, u32 (little-endian), ipv4. URL/IP fields are defanged.

Core functions

`extract(path, spec)`

Locates the blob, applies decode layers, parses fields, returns the config.

Usage

python scripts/analyst.py extract sample.bin --spec family.json

Sources

MITRE ATT&CK T1140 Deobfuscate/Decode Information — https://attack.mitre.org/techniques/T1140/
Declarative config-extractor design (DC3-MWCP, CAPE parsers) — https://github.com/Defense-Cyber-Crime-Center/DC3-MWCP
XOR/base64 layered config encoding from public family teardowns

1.6 KiB Raw Blame History