saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/extracting-config-from-agent-tesla-rat/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.2 KiB
Raw Blame History

API Reference: Agent Tesla RAT Configuration Extraction

Agent Tesla Overview

  • Type: .NET RAT / Information Stealer
  • Exfiltration: SMTP, FTP, Telegram, HTTP POST
  • Capabilities: Keylogging, clipboard, screenshots, credential theft

String Extraction

Python Regex for ASCII Strings

re.finditer(rb'[\x20-\x7e]{6,}', binary_data)

Wide Strings (UTF-16LE)

re.finditer(rb'(?:[\x20-\x7e]\x00){6,}', binary_data)

Configuration Indicators

SMTP Exfiltration

Field Pattern
Server smtp.gmail.com, smtp.yandex.com
Port 587, 465, 25
Email [\w.+-]+@[\w-]+\.[\w.]+
Password Base64 or XOR encoded

FTP Exfiltration

Field Pattern
Server ftp.\w+\.\w+
URI ftp://user:pass@host/path

Telegram Bot

Field Pattern
Bot Token \d{8,12}:[A-Za-z0-9_-]{35}
Chat ID \d{9,13}
API URL api.telegram.org/bot{token}/sendDocument

.NET Decompilation

dnSpy

# Open sample in dnSpy
# Navigate to namespace: AgentTesla / WebMonitor / etc.
# Look for hardcoded credentials in static fields

ILSpy / dotPeek

Alternative .NET decompilers for config extraction.

YARA Rule

rule AgentTesla {
    meta:
        description = "Agent Tesla keylogger/RAT"
    strings:
        $smtp = "SmtpPort" ascii wide
        $hook = "KeyboardHook" ascii wide
        $clip = "GetClipboardData" ascii wide
        $ns1 = "AgentTesla" ascii
        $ns2 = "WebMonitor" ascii
    condition:
        uint16(0) == 0x5A4D and 3 of them
}

File Hashing

Python hashlib

import hashlib
sha256 = hashlib.sha256(open(path, 'rb').read()).hexdigest()

VirusTotal API — Sample Lookup

GET https://www.virustotal.com/api/v3/files/{sha256}
x-apikey: {API_KEY}

Response Fields

Field Description
data.attributes.popular_threat_classification Malware family
data.attributes.last_analysis_stats AV detection counts
data.attributes.sandbox_verdicts Sandbox analysis results

Sandbox Analysis

  • ANY.RUN: Interactive analysis
  • Hybrid Analysis: Automated report
  • Joe Sandbox: Deep behavioral analysis