mirror of
https://github.com/ytisf/theZoo.git
synced 2026-02-21 11:18:08 +00:00
Updating to v0.43 - minor fixes
This commit is contained in:
nativy
13
README.md
13
README.md
@@ -102,14 +102,15 @@ The repository holding all files is currently
|
||||
- [x] Separate between database and application.
|
||||
- [x] UI improvements.
|
||||
|
||||
## Change Log for v0.43:
|
||||
- [X] Verify argv to be working properly. (fixes in v0.5)
|
||||
- [X] Virus-Total upload and indexing module. - Not possible due to restrictions of VT.
|
||||
- [X] Automatic reporting system for malwares which are not indexed in the framework.
|
||||
|
||||
##Predicted Change Log for v1.0
|
||||
- [ ] Fix auto-complete for malware frameworks.
|
||||
- [ ] Better UI features.
|
||||
- [X] Verify argv to be working properly. (fixes in v0.5)
|
||||
- [ ] Virus-Total upload and indexing module.
|
||||
- [ ] Automatic reporting system for malwares which are not indexed in the framework.
|
||||
|
||||
Stuff which are in the making:
|
||||
- [ ] Consider changing DB to XML or SQLite3.
|
||||
|
||||
|
||||
If you have any suggestions or malware that you have indexed as in the documentations please send it to us to yuvaln210 [at] your most popular mail server so we can add it for every one's enjoyment.
|
||||
If you have any suggestions or malware that you have indexed as in the documentations please send it to us to yuval[]morirt [dot]com so we can add it for every one's enjoyment.
|
||||
@@ -1,649 +0,0 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<main_db>
|
||||
<db_ver>190220141439</db_ver>
|
||||
|
||||
<malware id="1">
|
||||
<location>"Source/Original/Dokan_Dec2008/Dokan_Dec2008"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"Dokan"</name>
|
||||
<version>"unknown"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"c"</date_born>
|
||||
<platform>"00/12/2008"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
|
||||
<malware id="3">
|
||||
<location>"Source/Original/ShadowBotv3_March2007/ShadowBotv3_March2007"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"ShadowBot"</name>
|
||||
<version>"3"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"cpp"</date_born>
|
||||
<platform>"03/2007"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
|
||||
<malware id="4">
|
||||
<location>"Source/Original/rBot0.3.3_May2004/rBot0.3.3_May2004"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"rBot"</name>
|
||||
<version>"0.3.3"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"cpp"</date_born>
|
||||
<platform>"00/05/2004"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
|
||||
<malware id="5">
|
||||
<location>"Source/Original/ZeuS2.0.8.9_Feb2013/ZeuS2.0.8.9_Feb2013"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"ZeuS"</name>
|
||||
<version>"2.0.8.9"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"c"</date_born>
|
||||
<platform>"02/2013"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
|
||||
<malware id="6">
|
||||
<location>"Source/Original/X0R-USB_Jan2009/X0R-USB_Jan2009"</location>
|
||||
<type>"virus"</type>
|
||||
<name>"X0R-USB-Virus"</name>
|
||||
<version>"unknown"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"c"</date_born>
|
||||
<platform>"00/01/2009"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
|
||||
<malware id="7">
|
||||
<location>"Source/Original/LoexBot1.3_Sep2008/LoexBot1.3_Sep2008"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"LoexBot"</name>
|
||||
<version>"1.3"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"cpp"</date_born>
|
||||
<platform>"00/09/2008"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
|
||||
<malware id="8">
|
||||
<location>"Source/Original/ZunkerBot1.4.5_Sep2007/ZunkerBot1.4.5_Sep2007"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"ZunkerBot"</name>
|
||||
<version>"1.4.5"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"php"</date_born>
|
||||
<platform>"09/2007"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
|
||||
<malware id="9">
|
||||
<location>"Source/Original/DopeBotv0.22_UnCrippled_Feb2007/DopeBotv0.22_UnCrippled_Feb2007"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"DopeBot-UnCrippled"</name>
|
||||
<version>"0.22"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"cpp"</date_born>
|
||||
<platform>"00/02/2007"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="10">
|
||||
<location>"Source/Original/vbBot_Jan2007/vbBot_Jan2007"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"vbBot"</name>
|
||||
<version>"unknown"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"vb"</date_born>
|
||||
<platform>"01/2007"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="11">
|
||||
<location>"Source/Original/xTBot0.0.2_2Feb2002/xTBot0.0.2_2Feb2002"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"xTBot"</name>
|
||||
<version>"0.0.2"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"cpp"</date_born>
|
||||
<platform>"02/2002"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="12">
|
||||
<location>"Source/Original/VBS.Win32.Vabian/VBS.Win32.Vabian"</location>
|
||||
<type>"VBS-Worm"</type>
|
||||
<name>"VBS.Win32.Vabian"</name>
|
||||
<version>"botnet"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"vb"</date_born>
|
||||
<platform>"unknown"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="13">
|
||||
<location>"Source/Original/DopeBotv0.22_CrippledFeb2007/DopeBotv0.22_CrippledFeb2007"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"DopeBot-Crippled"</name>
|
||||
<version>"0.22"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"cpp"</date_born>
|
||||
<platform>"00/02/2007"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="14">
|
||||
<location>"Source/Original/Win32.MiniPig_Nov2006/Win32.MiniPig_Nov2006"</location>
|
||||
<type>"Worm"</type>
|
||||
<name>"Win32.MiniPig"</name>
|
||||
<version>"virus"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"c"</date_born>
|
||||
<platform>"00/11/2006"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="15">
|
||||
<location>"Source/Original/HellBotv3.0_10June2005/HellBotv3.0_10June2005"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"Hellbot"</name>
|
||||
<version>"3.0"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"cpp"</date_born>
|
||||
<platform>"00/06/2005"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="16">
|
||||
<location>"Source/Original/Win32.ogw0rm_Nov2008/Win32.ogw0rm_Nov2008"</location>
|
||||
<type>"Worm"</type>
|
||||
<name>"Win32.ogwOrm"</name>
|
||||
<version>"unknown"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"cpp"</date_born>
|
||||
<platform>"00/11/2008"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="17">
|
||||
<location>"Source/Original/DopeBot.B_Dec2004/DopeBot.B_Dec2004"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"DopeBot.B"</name>
|
||||
<version>"unknown"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"cpp"</date_born>
|
||||
<platform>"00/12/2004"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="18">
|
||||
<location>"Source/Original/LiquidBot_May2005/LiquidBot_May2005"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"LiquidBot"</name>
|
||||
<version>"unknown"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"cpp"</date_born>
|
||||
<platform>"00/05/2005"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="19">
|
||||
<location>"Source/Original/SpazBot2.12_June2007/SpazBot2.12_June2007"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"SpazBot"</name>
|
||||
<version>"2.12"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"vb"</date_born>
|
||||
<platform>"00/06/2007"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="20">
|
||||
<location>"Source/Original/DBotv3.1_March2007/DBotv3.1_March2007"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"DBot"</name>
|
||||
<version>"3.1"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"c"</date_born>
|
||||
<platform>"00/03/2007"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="21">
|
||||
<location>"Source/Original/CyberBotv2.2_October2006/CyberBotv2.2_October2006"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"CyberBot"</name>
|
||||
<version>"2.2"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"cpp"</date_born>
|
||||
<platform>"00/10/2006"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="22">
|
||||
<location>"Source/Original/DopeBot.A_Dec2004/DopeBot.A_Dec2004"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"DopeBot.A"</name>
|
||||
<version>"unknown"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"cpp"</date_born>
|
||||
<platform>"00/12/2004"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="23">
|
||||
<location>"Source/Original/MyDoom.A_Jan2004/MyDoom.A_Jan2004"</location>
|
||||
<type>"virus"</type>
|
||||
<name>"MyDoom.A"</name>
|
||||
<version>"unknown"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"c"</date_born>
|
||||
<platform>"00/01/2004"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="24">
|
||||
<location>"Source/Original/ShadowBot_Sep2008/ShadowBot_Sep2008"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"ShadowBot"</name>
|
||||
<version>"unknown"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"cpp"</date_born>
|
||||
<platform>"00/09/2008"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="25">
|
||||
<location>"Binaries/CryptoLocker20Nov2013/CryptoLocker20Nov2013"</location>
|
||||
<type>"ransomeware"</type>
|
||||
<name>"CryptoLocker"</name>
|
||||
<version>"Unknown"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"20/12/2013"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="26">
|
||||
<location>"Binaries/CryptoLocker_10Sep2013/CryptoLocker_10Sep2013"</location>
|
||||
<type>"ransomeware"</type>
|
||||
<name>"CryptoLocker"</name>
|
||||
<version>"Unknown"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"10/12/2013"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="27">
|
||||
<location>"Binaries/IllusionBot_May2007/IllusionBot_May2007"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"Illusion Bot"</name>
|
||||
<version>"Unknown"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/05/2007"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="28">
|
||||
<location>"Source/Original/NBot_July2008/NBot_July2008"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"nBot"</name>
|
||||
<version>"0.32"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"c"</date_born>
|
||||
<platform>"00/05/2008"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="29">
|
||||
<location>"Binaries/Trojan.Dropper.Gen/Trojan.Dropper.Gen"</location>
|
||||
<type>"trojan"</type>
|
||||
<name>"Dropper"</name>
|
||||
<version>"Unknown"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/01/2014"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="30">
|
||||
<location>"Binaries/Trojan.NSIS.Win32/Trojan.NSIS.Win32"</location>
|
||||
<type>"trojan"</type>
|
||||
<name>"NSIS"</name>
|
||||
<version>"Unknown"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/01/2014"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="31">
|
||||
<location>"Binaries/Trojan.Win32.Bechiro.BCD/Trojan.Win32.Bechiro.BCD"</location>
|
||||
<type>"trojan"</type>
|
||||
<name>"Bechiro"</name>
|
||||
<version>"BCD"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/01/2014"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="32">
|
||||
<location>"Binaries/AndroRat_6Dec2013/AndroRat_6Dec2013"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"AndroRat"</name>
|
||||
<version>"Dec2013"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"java"</date_born>
|
||||
<platform>"06/12/2013"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="33">
|
||||
<location>"Binaries/CryptoLocker_22Jan2014/CryptoLocker_22Jan2014"</location>
|
||||
<type>"ransomeware"</type>
|
||||
<name>"CryptoLocker"</name>
|
||||
<version>"Jan2014"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"22/01/2014"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="34">
|
||||
<location>"Binaries/njRAT-v0.6.4/njRAT-v0.6.4"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"njRAT"</name>
|
||||
<version>"0.6.4"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/09/2013"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="35">
|
||||
<location>"Binaries/ZeusBankingVersion_26Nov2013/ZeusBankingVersion_26Nov2013"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"Zeus - zBot"</name>
|
||||
<version>"Nov2013"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"23/11/2013"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="36">
|
||||
<location>"Source/Original/NullBot_Dec2006/NullBot_Dec2006"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"NullBot"</name>
|
||||
<version>"Dec2006"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"cpp"</date_born>
|
||||
<platform>"00/12/2006"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="37">
|
||||
<location>"Binaries/Artemis"</location>
|
||||
<type>"trojan"</type>
|
||||
<name>"Artemis"</name>
|
||||
<version>"Unknown"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/00/0000"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="38">
|
||||
<location>"Binaries/Somoto"</location>
|
||||
<type>"apt"</type>
|
||||
<name>"Somoto"</name>
|
||||
<version>"unknown"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/00/0000"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="39">
|
||||
<location>"Binaries/Variant.Kazy"</location>
|
||||
<type>"trojan"</type>
|
||||
<name>"Variant.Kazy"</name>
|
||||
<version>"unknown"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/00/0000"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="40">
|
||||
<location>"Binaries/Win32/Brontok.W"</location>
|
||||
<type>"Worm"</type>
|
||||
<name>"Brontok.FE"</name>
|
||||
<version>"unknown"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/00/0000"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="41">
|
||||
<location>"Binaries/Trojan.Loadmoney.1"</location>
|
||||
<type>"trojan"</type>
|
||||
<name>"LMclicker.1"</name>
|
||||
<version>"unknown"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/00/0000"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="42">
|
||||
<location>"Binaries/Win32Dircrypt.Trojan.Ransom.ABZ"</location>
|
||||
<type>"ransomeware"</type>
|
||||
<name>"Trojan.Ransom"</name>
|
||||
<version>"unknown"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/00/0000"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="43">
|
||||
<location>"Binaries/TrojanWin32.Duqu.Stuxnet"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"Trojan.Win32.Duqu.Aoq ."</name>
|
||||
<version>"unknown"</version>
|
||||
<languages>"unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/00/0000"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="45">
|
||||
<location>"Binaries/Win32.Botnet.Stuxnet.B"</location>
|
||||
<type>"apt"</type>
|
||||
<name>"Stuxnet Duqu"</name>
|
||||
<version>"Realtek Signed B"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/00/2007"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="44">
|
||||
<location>"Binaries/Win32.Botnet.Stuxnet.A"</location>
|
||||
<type>"apt"</type>
|
||||
<name>"Stuxnet Duqu"</name>
|
||||
<version>"C-Media Electronics Incorporation Signature - A"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/00/2009"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="46">
|
||||
<location>"Binaries/Skywiper-A.Flame"</location>
|
||||
<type>"apt"</type>
|
||||
<name>"Skywiper AKA Flame"</name>
|
||||
<version>"A"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/00/2012"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="47">
|
||||
<location>"Binaries/Careto_Feb2014"</location>
|
||||
<type>"apt"</type>
|
||||
<name>"Careto aka The Mask"</name>
|
||||
<version>"A"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"15/02/2014"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="48">
|
||||
<location>"Binaries/ZeusGamever_Feb2014"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"Zeus"</name>
|
||||
<version>"Gamever"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"19/02/2014"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
<malware id="49">
|
||||
<location>"Binaries/Android.Spy.49_iBanking_Feb2014"</location>
|
||||
<type>"botnet"</type>
|
||||
<name>"Android Spy 29"</name>
|
||||
<version>"Banking Version"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"apk"</date_born>
|
||||
<platform>"19/02/2014"</platform>
|
||||
<arch>"arm"</arch>
|
||||
</malware>
|
||||
<malware id="50">
|
||||
<location>"Binaries/Win32.Cridex"</location>
|
||||
<type>"worm"</type>
|
||||
<name>"Cridex"</name>
|
||||
<version>"B"</version>
|
||||
<languages>"Unknown"</languages>
|
||||
<binary />
|
||||
<source />
|
||||
<date_indexed />
|
||||
<date_born>"bin"</date_born>
|
||||
<platform>"00/02/2014"</platform>
|
||||
<arch>"x86"</arch>
|
||||
</malware>
|
||||
</main_db>
|
||||
@@ -51,10 +51,10 @@ class EULA:
|
||||
print '|infect you machines will live and dangerous malwares!. |'
|
||||
print '|___________________________________________________________________________|'
|
||||
print globals.bcolors.WHITE
|
||||
eula_answer = raw_input('Type YES in captial letters to accept this EULA.\n >')
|
||||
eula_answer = raw_input('Type YES in captial letters to accept this EULA.\n > ')
|
||||
if eula_answer == 'YES':
|
||||
new = open(globals.vars.eula_file, 'a')
|
||||
new.write(eula_answer)
|
||||
else:
|
||||
print 'You need to accept the EULA.\nExiting the program.'
|
||||
sys.exit(1)
|
||||
sys.exit(0)
|
||||
@@ -8,163 +8,204 @@ from imports.updatehandler import Updater
|
||||
|
||||
|
||||
class Controller:
|
||||
def __init__(self):
|
||||
self.modules = None
|
||||
self.currentmodule = ''
|
||||
self.commands = [ ("search", "searching for malwares using given parameter with 'set'."),
|
||||
("list all", "lists all available modules"),
|
||||
("set", "sets options for the search"),
|
||||
("get", "downloads the malware"),
|
||||
("update-db", "updates the databse"),
|
||||
("back", "removes currently chosen malware"),
|
||||
("help", "displays this help..."),
|
||||
("exit", "exits...")]
|
||||
def __init__(self):
|
||||
self.modules = None
|
||||
self.currentmodule = ''
|
||||
self.commands = [("search", "searching for malwares using given parameter with 'set'."),
|
||||
("list all", "lists all available modules"),
|
||||
("set", "sets options for the search"),
|
||||
("get", "downloads the malware"),
|
||||
("report-mal", "report a malware you found"),
|
||||
("update-db", "updates the databse"),
|
||||
("back", "removes currently chosen malware and filters"),
|
||||
("help", "displays this help..."),
|
||||
("exit", "exits...")]
|
||||
|
||||
self.searchmeth = [ ("arch","which architecture etc; x86, x64, arm7 so on..."),
|
||||
("plat","platform: win32, win64, mac, android so on..."),
|
||||
("lang","c, cpp, vbs, bin so on..."),
|
||||
("vip", "1 or 0")]
|
||||
self.searchmeth = [("arch", "which architecture etc; x86, x64, arm7 so on..."),
|
||||
("plat", "platform: win32, win64, mac, android so on..."),
|
||||
("lang", "c, cpp, vbs, bin so on..."),
|
||||
("vip", "1 or 0")]
|
||||
|
||||
self.modules = self.GetPayloads()
|
||||
self.modules = self.GetPayloads()
|
||||
|
||||
#print 'im at init'
|
||||
self.plat = ''
|
||||
self.arch = ''
|
||||
self.lang = ''
|
||||
self.type = ''
|
||||
self.vip = ''
|
||||
self.plat = ''
|
||||
self.arch = ''
|
||||
self.lang = ''
|
||||
self.type = ''
|
||||
self.vip = ''
|
||||
|
||||
def GetPayloads(self):
|
||||
m = []
|
||||
csvReader = csv.reader(open(globals.vars.main_csv_file, 'rb'), delimiter=',')
|
||||
for row in csvReader:
|
||||
m.append(row)
|
||||
return m
|
||||
def GetPayloads(self):
|
||||
m = []
|
||||
csvReader = csv.reader(open(globals.vars.main_csv_file, 'rb'), delimiter=',')
|
||||
for row in csvReader:
|
||||
m.append(row)
|
||||
return m
|
||||
|
||||
def MainMenu(self):
|
||||
if len(self.currentmodule) > 0:
|
||||
g = int(self.currentmodule) - 1
|
||||
just_print = self.modules[int(g)][int(globals.vars.column_for_name)]
|
||||
cmd = raw_input(
|
||||
globals.bcolors.GREEN + 'mdb ' + globals.bcolors.RED + str(just_print) + globals.bcolors.GREEN + '#> ' + globals.bcolors.WHITE).strip()
|
||||
else:
|
||||
cmd = raw_input(globals.bcolors.GREEN + 'mdb ' + globals.bcolors.GREEN + '#> ' + globals.bcolors.WHITE).strip()
|
||||
def MainMenu(self):
|
||||
# This will give you the nice prompt you like to much
|
||||
if len(self.currentmodule) > 0:
|
||||
g = int(self.currentmodule) - 1
|
||||
just_print = self.modules[int(g)][int(globals.vars.column_for_name)]
|
||||
cmd = raw_input(
|
||||
globals.bcolors.GREEN + 'mdb ' + globals.bcolors.RED + str(
|
||||
just_print) + globals.bcolors.GREEN + '#> ' + globals.bcolors.WHITE).strip()
|
||||
else:
|
||||
cmd = raw_input(
|
||||
globals.bcolors.GREEN + 'mdb ' + globals.bcolors.GREEN + '#> ' + globals.bcolors.WHITE).strip()
|
||||
|
||||
try:
|
||||
while cmd == "":
|
||||
#print 'no cmd'
|
||||
self.MainMenu()
|
||||
try:
|
||||
while cmd == "":
|
||||
#print 'no cmd'
|
||||
self.MainMenu()
|
||||
|
||||
if cmd == 'help':
|
||||
print " Available commands:\n"
|
||||
for (cmd, desc) in self.commands:
|
||||
print "\t%s\t%s" % ('{0: <12}'.format(cmd), desc)
|
||||
print ''
|
||||
self.MainMenu()
|
||||
if cmd == 'help':
|
||||
print " Available commands:\n"
|
||||
for (cmd, desc) in self.commands:
|
||||
print "\t%s\t%s" % ('{0: <12}'.format(cmd), desc)
|
||||
print ''
|
||||
self.MainMenu()
|
||||
|
||||
if cmd == 'search':
|
||||
ar = self.modules
|
||||
manySearch = manysearches.MuchSearch()
|
||||
if cmd == 'search':
|
||||
ar = self.modules
|
||||
manySearch = manysearches.MuchSearch()
|
||||
|
||||
# function to sort by arch
|
||||
if len(self.arch) > 0:
|
||||
ar = manySearch.sort(ar, globals.vars.column_for_arch, self.arch)
|
||||
# function to sort by plat
|
||||
if len(self.plat) > 0:
|
||||
ar = manySearch.sort(ar, globals.vars.column_for_plat, self.plat)
|
||||
# function to sort by lang
|
||||
if len(self.lang) > 0:
|
||||
ar = manySearch.sort(ar, globals.vars.column_for_pl, self.lang)
|
||||
if len(self.type) > 0:
|
||||
ar = manySearch.sort(ar, globals.vars.column_for_type, self.type)
|
||||
if len(self.vip) > 0:
|
||||
ar = manySearch.sort(ar, globals.vars.column_for_vip, self.vip)
|
||||
printController = manysearches.MuchSearch()
|
||||
printController.PrintPayloads(ar)
|
||||
self.MainMenu()
|
||||
# function to sort by arch
|
||||
if len(self.arch) > 0:
|
||||
ar = manySearch.sort(ar, globals.vars.column_for_arch, self.arch)
|
||||
# function to sort by plat
|
||||
if len(self.plat) > 0:
|
||||
ar = manySearch.sort(ar, globals.vars.column_for_plat, self.plat)
|
||||
# function to sort by lang
|
||||
if len(self.lang) > 0:
|
||||
ar = manySearch.sort(ar, globals.vars.column_for_pl, self.lang)
|
||||
if len(self.type) > 0:
|
||||
ar = manySearch.sort(ar, globals.vars.column_for_type, self.type)
|
||||
if len(self.vip) > 0:
|
||||
ar = manySearch.sort(ar, globals.vars.column_for_vip, self.vip)
|
||||
printController = manysearches.MuchSearch()
|
||||
printController.PrintPayloads(ar)
|
||||
self.MainMenu()
|
||||
|
||||
if re.match('^set', cmd):
|
||||
try:
|
||||
cmd = re.split('\s+', cmd)
|
||||
print cmd[1] + ' => ' + cmd[2]
|
||||
if cmd[1] == 'arch':
|
||||
self.arch = cmd[2]
|
||||
if cmd[1] == 'plat':
|
||||
self.plat = cmd[2]
|
||||
if cmd[1] == 'lang':
|
||||
self.lang = cmd[2]
|
||||
if cmd[1] == 'type':
|
||||
self.type = cmd[2]
|
||||
except:
|
||||
print 'Need to use the set method with two arguments.'
|
||||
cmd = ''
|
||||
self.MainMenu()
|
||||
if re.match('^set', cmd):
|
||||
try:
|
||||
cmd = re.split('\s+', cmd)
|
||||
print cmd[1] + ' => ' + cmd[2]
|
||||
if cmd[1] == 'arch':
|
||||
self.arch = cmd[2]
|
||||
if cmd[1] == 'plat':
|
||||
self.plat = cmd[2]
|
||||
if cmd[1] == 'lang':
|
||||
self.lang = cmd[2]
|
||||
if cmd[1] == 'type':
|
||||
self.type = cmd[2]
|
||||
except:
|
||||
print 'Need to use the set method with two arguments.'
|
||||
cmd = ''
|
||||
self.MainMenu()
|
||||
|
||||
if cmd == 'show':
|
||||
if len(self.currentmodule) == 0:
|
||||
print "No modules have been chosen. Use 'use' command."
|
||||
if len(self.currentmodule) > 0:
|
||||
print 'Currently selected Module: ' + self.currentmodule
|
||||
print '\tarch => ' + str(self.arch)
|
||||
print '\tplat => ' + str(self.plat)
|
||||
print '\tlang => ' + str(self.lang)
|
||||
print '\ttype => ' + str(self.type)
|
||||
print ''
|
||||
self.MainMenu()
|
||||
if cmd == 'show':
|
||||
if len(self.currentmodule) == 0:
|
||||
print "No modules have been chosen. Use 'use' command."
|
||||
if len(self.currentmodule) > 0:
|
||||
print 'Currently selected Module: ' + self.currentmodule
|
||||
print '\tarch => ' + str(self.arch)
|
||||
print '\tplat => ' + str(self.plat)
|
||||
print '\tlang => ' + str(self.lang)
|
||||
print '\ttype => ' + str(self.type)
|
||||
print ''
|
||||
self.MainMenu()
|
||||
|
||||
if cmd == 'exit':
|
||||
sys.exit(1)
|
||||
if cmd == 'exit':
|
||||
sys.exit(1)
|
||||
|
||||
if cmd == 'update-db':
|
||||
updateHandler = Updater()
|
||||
updateHandler.get_maldb_ver()
|
||||
self.MainMenu()
|
||||
if cmd == 'update-db':
|
||||
updateHandler = Updater()
|
||||
updateHandler.get_maldb_ver()
|
||||
self.MainMenu()
|
||||
|
||||
if cmd == 'get':
|
||||
updateHandler = Updater()
|
||||
try:
|
||||
updateHandler.get_malware(self.currentmodule, self.modules)
|
||||
self.MainMenu()
|
||||
except:
|
||||
print globals.bcolors.RED + '[-]' + globals.bcolors.WHITE + 'Error getting malware.'
|
||||
self.MainMenu()
|
||||
if cmd == 'report-mal':
|
||||
rprt_name = raw_input("Name of malware: ")
|
||||
rprt_type = raw_input("Type of malware: ")
|
||||
rprt_version = raw_input("Version: ")
|
||||
rprt_lang = raw_input("Language: ")
|
||||
rprt_src = raw_input("Source / Binary (s/b): ")
|
||||
rprt_arch = raw_input("Win32, ARM etc. ? ")
|
||||
rprt_reporter = raw_input("Your name for a thanks note on theZoo.\nPlease notice that this will be public!\n\nName: ")
|
||||
rprt_comments = raw_input("Comments? ")
|
||||
|
||||
if re.match('^use', cmd):
|
||||
try:
|
||||
cmd = re.split('\s+', cmd)
|
||||
self.currentmodule = cmd[1]
|
||||
cmd = ''
|
||||
except:
|
||||
print 'The use method needs an argument.'
|
||||
self.MainMenu()
|
||||
report = ("//%s//\n" % rprt_name)
|
||||
report += ("///type/%s///\n" % rprt_type)
|
||||
report += ("///ver/%s///\n" % rprt_version)
|
||||
report += ("///lang/%s///\n" % rprt_lang)
|
||||
report += ("///src/%s///\n" % rprt_src)
|
||||
report += ("///arch/%s///\n" % rprt_arch)
|
||||
report += ("//reporter/%s//\n" % rprt_reporter)
|
||||
report += ("//comments/%s//\n" % rprt_comments)
|
||||
|
||||
if cmd == 'back':
|
||||
print 'im at back - WTF?'
|
||||
self.arch = ''
|
||||
self.plat = ''
|
||||
self.lang = ''
|
||||
self.type = ''
|
||||
self.currentmodule = ''
|
||||
self.MainMenu()
|
||||
# Just to avoid bots spamming us...
|
||||
email = "info"
|
||||
email += "\x40"
|
||||
email += "morirt\x2ecom"
|
||||
print "-------------- Begin of theZoo Report --------------"
|
||||
print report
|
||||
print "-------------- Ending of theZoo Report --------------"
|
||||
print "To avoid compromising your privacy we have chose this method of reporting."
|
||||
print "If you have not stated your name we will not write a thanks in our README."
|
||||
print "Your email will remain private in scenario and will not be published."
|
||||
print ""
|
||||
print "Please create an archive file with the structure as in the README file"
|
||||
print "And attach it to the email. "
|
||||
print("Please send this report to %s" % email)
|
||||
|
||||
if cmd == 'list all':
|
||||
print "\nAvailable Payloads:"
|
||||
array = self.modules
|
||||
i = 0
|
||||
print "ID\tName\tType"
|
||||
print '-----------------'
|
||||
for element in array:
|
||||
answer = array[i][globals.vars.column_for_uid]
|
||||
answer += '\t%s' % ('{0: <12}'.format(array[i][globals.vars.column_for_name]))
|
||||
answer += '\t%s' % ('{0: <12}'.format(array[i][globals.vars.column_for_type]))
|
||||
print answer
|
||||
i=i+1
|
||||
self.MainMenu()
|
||||
self.MainMenu()
|
||||
|
||||
if cmd == 'quit':
|
||||
print ":("
|
||||
sys.exit(1)
|
||||
# 'get' command. Not yet fully operational
|
||||
if cmd == 'get':
|
||||
updateHandler = Updater()
|
||||
try:
|
||||
updateHandler.get_malware(self.currentmodule, self.modules)
|
||||
self.MainMenu()
|
||||
except:
|
||||
print globals.bcolors.RED + '[-]' + globals.bcolors.WHITE + 'Error getting malware.'
|
||||
self.MainMenu()
|
||||
|
||||
except KeyboardInterrupt:
|
||||
print ("i'll just go now...")
|
||||
sys.exit()
|
||||
# If used the 'use' command
|
||||
if re.match('^use', cmd):
|
||||
try:
|
||||
cmd = re.split('\s+', cmd)
|
||||
self.currentmodule = cmd[1]
|
||||
cmd = ''
|
||||
except:
|
||||
print 'The use method needs an argument.'
|
||||
self.MainMenu()
|
||||
|
||||
# Rests all current data
|
||||
if cmd == 'back':
|
||||
self.arch = ''
|
||||
self.plat = ''
|
||||
self.lang = ''
|
||||
self.type = ''
|
||||
self.currentmodule = ''
|
||||
self.MainMenu()
|
||||
|
||||
if cmd == 'list all':
|
||||
print "\nAvailable Payloads:"
|
||||
array = self.modules
|
||||
i = 0
|
||||
print "ID\tName\tType"
|
||||
print '-----------------'
|
||||
for element in array:
|
||||
answer = array[i][globals.vars.column_for_uid]
|
||||
answer += '\t%s' % ('{0: <12}'.format(array[i][globals.vars.column_for_name]))
|
||||
answer += '\t%s' % ('{0: <12}'.format(array[i][globals.vars.column_for_type]))
|
||||
print answer
|
||||
i = i + 1
|
||||
self.MainMenu()
|
||||
|
||||
if cmd == 'quit':
|
||||
print ":("
|
||||
sys.exit(1)
|
||||
|
||||
except KeyboardInterrupt:
|
||||
print ("i'll just go now...")
|
||||
sys.exit()
|
||||
|
||||
@@ -39,11 +39,12 @@ class Updater:
|
||||
return 0
|
||||
|
||||
curr_maldb_ver = f
|
||||
response = urllib2.urlopen(globals.vars.giturl+ globals.vars.maldb_ver_file)
|
||||
response = urllib2.urlopen(globals.vars.giturl + globals.vars.maldb_ver_file)
|
||||
new_maldb_ver = response.read()
|
||||
if new_maldb_ver == curr_maldb_ver:
|
||||
print globals.bcolors.GREEN + '[+]' + globals.bcolors.WHITE + " No need for an update.\n" + globals.bcolors.GREEN + '[+]' + globals.bcolors.WHITE + " You are at " + new_maldb_ver + " which is the latest version."
|
||||
sys.exit(1)
|
||||
|
||||
# Write the new DB version into the file
|
||||
f = open(globals.vars.maldb_ver_file, 'w')
|
||||
f.write(new_maldb_ver)
|
||||
|
||||
20
theZoo.py
20
theZoo.py
@@ -15,7 +15,17 @@
|
||||
|
||||
#You should have received a copy of the GNU General Public License
|
||||
#along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
|
||||
import sys
|
||||
import csv
|
||||
import os
|
||||
from optparse import OptionParser
|
||||
from imports.updatehandler import Updater
|
||||
from imports import muchmuchstrings
|
||||
from imports.eula_handler import EULA
|
||||
from imports.globals import vars
|
||||
from imports.terminal_handler import Controller
|
||||
|
||||
__version__ = "0.5.0 Citadel"
|
||||
__codename__ = "Citadel"
|
||||
@@ -25,16 +35,6 @@ __licensev__ = "GPL v3.0"
|
||||
__maintainer = "Yuval Nativ"
|
||||
__status__ = "Beta"
|
||||
|
||||
import sys
|
||||
import getopt
|
||||
import csv
|
||||
import os
|
||||
from optparse import OptionParser
|
||||
from imports.updatehandler import Updater
|
||||
from imports.eula_handler import EULA
|
||||
from imports.globals import vars
|
||||
from imports.terminal_handler import Controller
|
||||
|
||||
|
||||
def main():
|
||||
|
||||
|
||||
Reference in New Issue
Block a user