恶意程序配置与C2参数提取

---
name: config-extraction
description: Extract embedded configurations from malware samples including C2 URLs, encryption keys, campaign IDs, and other operational parameters using automated and manual techniques.
---

# Config Extraction

Extract embedded configurations from malware samples to identify C2 infrastructure, encryption keys, campaign identifiers, and other operational parameters. This skill covers identifying config locations, common encoding schemes, extraction frameworks, and building custom extractors.

## Prerequisites

- **Python 3.10+** with `struct` and standard library modules
- **pefile**: PE file parsing library (`pip install pefile`)
- **MACO**: Malware Analysis Configuration Organizer framework (`pip install maco`)
- **YARA**: Pattern matching for pre-filtering (optional, used with MACO)
- **CAPE community modules**: Family-specific config parsers (optional, clone from GitHub)
- **Disassembler** (IDA Pro or Ghidra): For identifying decryption routines in custom extractors

## Steps

### 1. Identify Embedded Configurations

Malware configurations are typically stored in one of these locations:

| Location | Description | How to Find |
|----------|-------------|-------------|
| PE resources | Stored as RT_RCDATA or custom resource types | `python3 scripts/config_extractor.py --scan-resources` |
| Overlay data | Appended after the PE's last section | `python3 scripts/config_extractor.py --scan-overlay` |
| Data sections | Embedded in `.data`, `.rdata`, or custom sections | Check sections with moderate entropy (4.0-7.0) |
| Code section | Inline encrypted blobs referenced by code | Trace data references from decryption routines |
| Registry/files | Dropped to disk or registry after first execution | Monitor with Procmon or sandbox |
| Hardcoded strings | Plaintext or lightly obfuscated in binary | String extraction + pattern matching |

Initial scanning:

```bash
# Scan a sample for potential config locations
python3 scripts/config_extractor.py --scan \
    --input sample.exe \
    --output scan_results.json

# This identifies:
# - PE resource entries with high entropy
# - Overlay data presence and entropy
# - Sections with entropy between 4.0 and 7.5 (likely encoded data)
# - XOR-encoded patterns (repeating byte sequences)
# - Base64-encoded blobs
```

### 2. Decode Common Config Formats

Malware uses various encoding and encryption schemes for configuration data:

**XOR encryption** (most common):

```bash
# Scan for single-byte XOR encoded data
python3 scripts/config_extractor.py --xor-scan \
    --input sample.exe \
    --output xor_results.json

# Try XOR decryption with a known or brute-forced key
python3 scripts/config_extractor.py --xor-decrypt \
    --input sample.exe \
    --key 0x5A \
    --offset 0x4000 \
    --length 256 \
    --output decrypted_config.bin

# Multi-byte XOR key extraction
python3 scripts/config_extractor.py --xor-scan \
    --input sample.exe \
    --key-length 4 \
    --output xor_results.json
```

**Base64-encoded configs**:

```bash
# Extract and decode base64 blobs from binary
python3 scripts/config_extractor.py --base64-scan \
    --input sample.exe \
    --min-length 20 \
    --output base64_results.json
```

**Custom binary structures**:

```bash
# Extract raw bytes at a known offset and parse as structured data
python3 scripts/config_extractor.py --extract-raw \
    --input sample.exe \
    --offset 0x8400 \
    --length 512 \
    --output raw_config.bin

# Parse the extracted blob with a format definition
python3 scripts/config_extractor.py --parse-struct \
    --input raw_config.bin \
    --format "4s:magic,H:version,H:flags,256s:c2_url,32s:campaign_id,16s:encryption_key" \
    --output parsed_config.json
```

### 3. Extract from PE Resources

Many malware families store configs in PE resource sections:

```bash
# List all PE resources
python3 scripts/config_extractor.py --list-resources \
    --input sample.exe \
    --output resources.json

# Extract a specific resource by type and ID
python3 scripts/config_extractor.py --extract-resource \
    --input sample.exe \
    --resource-type RCDATA \
    --resource-id 101 \
    --output extracted_resource.bin

# Extract all resources
python3 scripts/config_extractor.py --extract-all-resources \
    --input sample.exe \
    --output-dir ./resources/
```

Common resource-based config patterns:
- **Emotet**: Encrypted RSA public keys and C2 lists in RCDATA
- **TrickBot**: Module configs in custom resource types
- **Cobalt Strike**: Beacon config in `.data` section or XOR'd resource
- **AgentTesla**: SMTP/FTP credentials in encrypted resources

### 4. Extract Overlay Data

Data appended after the PE's last section boundary:

```bash
# Check for and extract overlay data
python3 scripts/config_extractor.py --extract-overlay \
    --input sample.exe \
    --output overlay.bin

# The script calculates the overlay offset from PE headers:
# overlay_offset = last_section.PointerToRawData + last_section.SizeOfRawData
```

Overlay patterns:
- Encrypted second-stage payloads
- JSON or XML configuration blobs
- Additional PE files (droppers)
- Certificate data (legitimate overlay in signed binaries)

### 5. Use MACO Framework

The Malware Analysis Configuration Organizer (MACO) provides standardized config extraction:

```bash
# Install MACO
pip install maco

# Run MACO extractors against a sample
maco extract sample.exe --output config.json

# List available extractors
maco list

# Run a specific extractor
maco extract sample.exe --extractor emotet --output emotet_config.json

# Run with YARA pre-filter (only runs extractors matching YARA rules)
maco extract sample.exe --yara-filter --output config.json
```

MACO output follows a standardized schema with fields for:
- C2 addresses (IP, domain, URL)
- Encryption keys and certificates
- Campaign identifiers and bot IDs
- Mutex names and install paths
- Persistence mechanisms

### 6. Use CAPE Sandbox Config Extractors

CAPE sandbox includes config extractors for hundreds of malware families:

```bash
# Clone CAPE's config extractors
git clone https://github.com/CAPESandbox/community.git cape-community
cd cape-community/modules/processing/parsers/

# Run a family-specific parser
python3 maldoc/emotet.py sample.bin

# CAPE parsers output structured config data including:
# - C2 server lists
# - RSA/AES keys
# - Campaign IDs
# - Version information
```

Alternatively, submit to a CAPE sandbox instance:

```bash
# Submit sample to CAPE and retrieve config
curl -F "file=@sample.exe" http://cape-sandbox:8000/api/tasks/create/file/
# Config appears in the report under "configs" section
```

### 7. Write Custom Config Extractors

For families without existing extractors, write custom extraction scripts:

```python
# Example: Extract C2 URLs from a custom malware family
# 1. Identify the decryption routine in the disassembly
# 2. Locate the encrypted config blob (usually referenced by the decryption code)
# 3. Implement the decryption algorithm in Python
# 4. Parse the decrypted config structure

import struct

def decrypt_config(data: bytes, key: bytes) -> bytes:
    """XOR decrypt with rolling key."""
    result = bytearray(len(data))
    for i, b in enumerate(data):
        result[i] = b ^ key[i % len(key)]
    return bytes(result)

def parse_config(decrypted: bytes) -> dict:
    """Parse decrypted config structure."""
    config = {}
    offset = 0
    # Example: 4-byte magic, 2-byte version, then null-terminated C2 strings
    config["magic"] = decrypted[offset:offset+4]
    offset += 4
    config["version"] = struct.unpack_from("<H", decrypted, offset)[0]
    offset += 2
    # Parse C2 URLs until double null
    c2_list = []
    while offset < len(decrypted) - 1:
        if decrypted[offset] == 0 and decrypted[offset+1] == 0:
            break
        end = decrypted.index(0, offset)
        c2_list.append(decrypted[offset:end].decode("ascii", errors="replace"))
        offset = end + 1
    config["c2_urls"] = c2_list
    return config
```

```bash
# Run a custom extractor
python3 scripts/config_extractor.py --custom-extract \
    --input sample.exe \
    --decrypt-method xor \
    --key 0x5A3B2C1D \
    --config-offset 0x8400 \
    --config-length 1024 \
    --output extracted_config.json
```

### 8. Compare Configs Across Samples

Track campaigns by comparing extracted configurations:

```bash
# Compare configs from multiple samples
python3 scripts/config_extractor.py --compare-configs \
    --inputs config_a.json,config_b.json,config_c.json \
    --output comparison.json
```

Config comparison reveals:
- **Shared C2 infrastructure** — same C2 servers indicate same campaign or operator
- **Shared encryption keys** — same keys suggest same build or builder kit
- **Campaign ID patterns** — sequential IDs reveal campaign timeline
- **Version progression** — track malware development over time
- **Regional targeting** — language/locale settings reveal target geography

## Output Format

```json
{
  "sample": {
    "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "file_name": "sample.exe"
  },
  "config_locations": [
    {
      "type": "resource",
      "resource_type": "RCDATA",
      "resource_id": 101,
      "offset": 33792,
      "size": 512,
      "entropy": 7.2,
      "encoding": "xor"
    },
    {
      "type": "overlay",
      "offset": 245760,
      "size": 4096,
      "entropy": 6.8,
      "encoding": "base64"
    }
  ],
  "extracted_config": {
    "family": "emotet",
    "version": "4.1",
    "c2_urls": [
      "https://185.94.252.13:443/report",
      "https://91.207.182.14:8080/upload",
      "https://malicious-domain.com:443/gate"
    ],
    "encryption_key": "a1b2c3d4e5f6a7b8",
    "campaign_id": "0321_wave2",
    "mutex_name": "Global\\EMT_0321",
    "install_path": "%APPDATA%\\Microsoft\\svchost.exe",
    "persistence_method": "registry_run_key",
    "bot_id_format": "{hostname}_{username}_{random8}"
  },
  "extraction_method": "xor_decrypt_resource",
  "xor_key": "0x5A",
  "confidence": "high"
}
```

## Tips

- Always check the entropy of PE sections first — configs encrypted with XOR or AES will have entropy between 6.5 and 7.5, while compressed or random data approaches 8.0
- Single-byte XOR is the most common config encryption in commodity malware — brute-force all 255 keys and check for plaintext indicators (URLs, IPs, paths)
- For multi-byte XOR keys, look for known-plaintext attacks: if you know the config starts with "http" or a magic value, XOR the expected bytes with the ciphertext to recover the key
- PE resource sections are the most common config storage location; always enumerate resources even if they appear empty
- Overlay data is frequently overlooked — many loaders append encrypted payloads or configs after the PE's last section
- When writing custom extractors, start by identifying the decryption routine in IDA/Ghidra, then reimplement just that function in Python
- CAPE and MACO extractors cover hundreds of families — check for existing extractors before writing custom ones
- Compare extracted configs across samples from the same campaign to build a timeline of infrastructure changes
- Config extraction results are high-value IOCs — extracted C2 URLs and encryption keys should be immediately shared with your threat intel team
- Some malware families update their config format between versions, so extractors may need version-specific parsing logic