mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
97 lines
2.2 KiB
Markdown
97 lines
2.2 KiB
Markdown
# API Reference: Agent Tesla RAT Configuration Extraction
|
|
|
|
## Agent Tesla Overview
|
|
- **Type**: .NET RAT / Information Stealer
|
|
- **Exfiltration**: SMTP, FTP, Telegram, HTTP POST
|
|
- **Capabilities**: Keylogging, clipboard, screenshots, credential theft
|
|
|
|
## String Extraction
|
|
|
|
### Python Regex for ASCII Strings
|
|
```python
|
|
re.finditer(rb'[\x20-\x7e]{6,}', binary_data)
|
|
```
|
|
|
|
### Wide Strings (UTF-16LE)
|
|
```python
|
|
re.finditer(rb'(?:[\x20-\x7e]\x00){6,}', binary_data)
|
|
```
|
|
|
|
## Configuration Indicators
|
|
|
|
### SMTP Exfiltration
|
|
| Field | Pattern |
|
|
|-------|---------|
|
|
| Server | `smtp.gmail.com`, `smtp.yandex.com` |
|
|
| Port | 587, 465, 25 |
|
|
| Email | `[\w.+-]+@[\w-]+\.[\w.]+` |
|
|
| Password | Base64 or XOR encoded |
|
|
|
|
### FTP Exfiltration
|
|
| Field | Pattern |
|
|
|-------|---------|
|
|
| Server | `ftp.\w+\.\w+` |
|
|
| URI | `ftp://user:pass@host/path` |
|
|
|
|
### Telegram Bot
|
|
| Field | Pattern |
|
|
|-------|---------|
|
|
| Bot Token | `\d{8,12}:[A-Za-z0-9_-]{35}` |
|
|
| Chat ID | `\d{9,13}` |
|
|
| API URL | `api.telegram.org/bot{token}/sendDocument` |
|
|
|
|
## .NET Decompilation
|
|
|
|
### dnSpy
|
|
```bash
|
|
# Open sample in dnSpy
|
|
# Navigate to namespace: AgentTesla / WebMonitor / etc.
|
|
# Look for hardcoded credentials in static fields
|
|
```
|
|
|
|
### ILSpy / dotPeek
|
|
Alternative .NET decompilers for config extraction.
|
|
|
|
## YARA Rule
|
|
|
|
```yara
|
|
rule AgentTesla {
|
|
meta:
|
|
description = "Agent Tesla keylogger/RAT"
|
|
strings:
|
|
$smtp = "SmtpPort" ascii wide
|
|
$hook = "KeyboardHook" ascii wide
|
|
$clip = "GetClipboardData" ascii wide
|
|
$ns1 = "AgentTesla" ascii
|
|
$ns2 = "WebMonitor" ascii
|
|
condition:
|
|
uint16(0) == 0x5A4D and 3 of them
|
|
}
|
|
```
|
|
|
|
## File Hashing
|
|
|
|
### Python hashlib
|
|
```python
|
|
import hashlib
|
|
sha256 = hashlib.sha256(open(path, 'rb').read()).hexdigest()
|
|
```
|
|
|
|
## VirusTotal API — Sample Lookup
|
|
```http
|
|
GET https://www.virustotal.com/api/v3/files/{sha256}
|
|
x-apikey: {API_KEY}
|
|
```
|
|
|
|
### Response Fields
|
|
| Field | Description |
|
|
|-------|-------------|
|
|
| `data.attributes.popular_threat_classification` | Malware family |
|
|
| `data.attributes.last_analysis_stats` | AV detection counts |
|
|
| `data.attributes.sandbox_verdicts` | Sandbox analysis results |
|
|
|
|
## Sandbox Analysis
|
|
- **ANY.RUN**: Interactive analysis
|
|
- **Hybrid Analysis**: Automated report
|
|
- **Joe Sandbox**: Deep behavioral analysis
|