Revert "Revert "Adds a CI job for testing code changes against known samples on the m…""

.github/workflows/ci.yml

@@ -0,0 +1,43 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - master
+  push:
+    branches:
+      - master
+
+jobs:
+  malware-sample-tests:
+    name: Run malware sample tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y p7zip-full
+          pip install ".[dev]"
+
+      - name: Decrypt malware samples
+        run: |
+          7z x tests/samples.enc.zip -p'${{ secrets.SAMPLES_ZIP_PASSWORD }}' -otests/samples/
+          ls -la tests/samples/
+
+      - name: Run malware pytest suite
+        run: pytest tests/ --maxfail=1 --disable-warnings -q
+
+      - name: Clean up samples
+        run: rm -rf tests/samples
+
+    # Run the workflow on approved pull request merges from forked repositories 
+    # and any pull requests from the main repository
+    if: github.event_name == 'pull_request' && (github.event.pull_request.merged == true || github.repository == github.event.pull_request.head.repo.full_name)

.gitignore

@@ -3,3 +3,5 @@
 __pycache__/
 build/
 *.egg-info/
+bin/
+tests/samples/

pyproject.toml

@@ -1,6 +1,6 @@
 [build-system]
 build-backend = "setuptools.build_meta"
-requires = [ "setuptools" ]
+requires = ["setuptools"]
 
 [project]
 name = "rat-king-parser"
@@ -34,10 +34,10 @@ classifiers = [
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
 ]
-dynamic = [ "version" ]
-dependencies = [ "dnfile", "pycryptodomex", "yara-python" ]
-optional-dependencies.dev = [ "pre-commit" ]
-optional-dependencies.maco = [ "maco", "validators" ]
+dynamic = ["version"]
+dependencies = ["dnfile", "pycryptodomex", "yara-python"]
+optional-dependencies.dev = ["pre-commit", "pytest"]
+optional-dependencies.maco = ["maco", "validators"]
 urls."Bug Reports" = "https://github.com/jeFF0Falltrades/rat_king_parser/issues"
 urls."Homepage" = "https://github.com/jeFF0Falltrades/rat_king_parser"
 urls."Say Thanks!" = "https://www.buymeacoffee.com/jeff0falltrades"
@@ -47,15 +47,15 @@ scripts.rat-king-parser = "rat_king_parser:main"
 version = { attr = "rat_king_parser._version.__version__" }
 
 [tool.setuptools.packages.find]
-where = [ "src" ]
-include = [ "rat_king_parser*" ]
+where = ["src"]
+include = ["rat_king_parser*"]
 namespaces = false
 
 [tool.setuptools.package-data]
-"rat_king_parser.yara_utils" = [ "*.yar", "*.yarc" ]
+"rat_king_parser.yara_utils" = ["*.yar", "*.yarc"]
 
 [tool.ruff]
-lint.extend-select = [ "I" ]
+lint.extend-select = ["I"]
 
 [tool.pre-commit]
 hook-config = "file:.pre-commit-config.yaml"

src/rat_king_parser/_version.py

@@ -23,4 +23,4 @@
 # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 # SOFTWARE.
-__version__ = "4.2.1"
+__version__ = "4.2.2"

tests/expected/034941c1ea1b1ae32a653aab6371f760dfc4fc43db7c7bf07ac10fc9e98c849e.json

@@ -0,0 +1,25 @@
+{
+  "config": {
+    "An_ti": "false",
+    "Anti_Process": "false",
+    "BS_OD": "false",
+    "Certifi_cate": "MIICMDCCAZmgAwIBAgIVANpXtGwt9qBbU/pdFz8d/Pt6kzb7MA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMDIxNzA5MjAzM1oXDTMxMTEyNzA5MjAzM1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKt8nE3x/0XYeyDBrDPxdpVH1EMWSVyndAkdVChKaWQFOAAs4r/UeTmw8POG3jUz/XczWBWJt9Vu4Vl0HJN3ZmRIMr75FDGyieel0Vb8sn0hZcABsNr8dbbzfi+eoocVAyZKd79S0mOUinl4PBhldyUJCvanCnguHux8c2F5vnQlAgMBAAGjMjAwMB0GA1UdDgQWBBRjACzYO/EcXaKzlTz8Oq34J5Zq8DAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBACA8urqJU44+IpPcx9i0Q0Eu9+qWMPdZ09y+6YdumC6dun1OHn1I5F03YqYCfCdq0l3XpszJlYYzPnPB4ThOfiKUwJ1HJWS2lgWKfd+CdSWCch0c2dEE1Pao+xyNcNpuphBraHZYc4ojekgeQ8MSdHVo/YCYpmaJbxFWDhFgr3Lh",
+    "De_lay": "1",
+    "Group": "16JUNIO-PJOAO",
+    "Hos_ts": "20.200.63.2",
+    "Hw_id": "null",
+    "In_stall": "false",
+    "Install_File": "",
+    "Install_Folder": "%AppData%",
+    "Key": "dU81ekM1S2pQYmVOWWhQcjV4WlJwcWRkSnVYR2tTQ0w=",
+    "MTX": "DcRatMutex_qwqdanchun",
+    "Paste_bin": "null",
+    "Por_ts": "2525",
+    "Server_signa_ture": "c+KGE0Aw1XRgjGe2Kvay1H3VgUgqKRYGit46DnCR6eW/g+kO+H5oRsfBNkVizj0Q862zTXvLkWZ+ON84bmYhBy3o5YQOPaPyAIXha4ByY150rYRXKkzBR47RkTx616bLYUhqO+PqqNOii9THobbo3zAtwjxEoEWr8s0MLGm2AfE=",
+    "Ver_sion": " 1.0.7"
+  },
+  "key": "3915b12d862a41cce3da2e11ca8cefc26116d0741c23c0748618add80ee31a5c",
+  "salt": "4463526174427971777164616e6368756e",
+  "sha256": "034941c1ea1b1ae32a653aab6371f760dfc4fc43db7c7bf07ac10fc9e98c849e",
+  "yara_possible_family": "dcrat"
+}

tests/expected/0aa7bfb081e73a67c23715a55ff13a74ef6b1ce2b82a33b5537ee001592919a4.json

@@ -0,0 +1,26 @@
+{
+  "config": {
+    "Anti": "false",
+    "BDOS": "false",
+    "Certificate": "MIIE9jCCAt6gAwIBAgIQAKQXqY8ZdB/modqi69mWGTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFXb3JsZFdpbmQgU3RlYWxlcjAgFw0yMTA3MTMwNDUxMDZaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRV29ybGRXaW5kIFN0ZWFsZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCnRXYoxuLqqgXdcvIAYWb9DuVRl5ZpdpPfoIgmb7Y9A9AuiddKNm4is8EvIlEh98bQD4OBaK0EGWuj7WuAcQPCCGuzHpDqFZbXR7iRqVn6TiLRsO0LCMB4ta4XLQ4JdTFXvnQHcGiUxHddH70T/2P2bBVY0W+PVJDzG3XUWHpYb4PVv7qaQr/DalR3qyyd5otzE1kIjJLCOCyI/9ntIcD/PbMTKVnCP4fzbnkNB+xy0PmQmx3WRWEF5q72TdgaKrCbOpR2C/+rfGIoPC6Ze6dqWO3bQLGt6jpCO8A4CtAaAYmiw1vHUOfP54BgI9ls1TjYO3Rn4R1jmhWBGV2pT5chrglgSxMzPhrxFTQljG78RlPCJmyagJbtnPL3AlV34sQggcbf+80FVeyechm/xrMTSWXrJQ+xek1HRJBDFoCJyUR7SuIUelOW24TU+rwl/2dcALLZXpjYu3/zvJjH4iaJXRCt7oWhfzIFG1bHBFr78kV9VP0H+ZNVb129eUr14F/uubAoIPAz2EHG/CXBZv9GkFuzw0NgsI1eP7AznCLdT+z91M+yB7vWtvclwQ5k6MxWDPOraG5JMjUHvKI6zvyZ4IQ2a7bUENDghxLAqIxgo7zfZMdrjbRxBlqW14oki6Um7GpGKEZ0s2Ip6K2yJHBLpbVxOYjyzrxohMguh+qvgQIDAQABozIwMDAdBgNVHQ4EFgQUmTejTtK6on20N0YJez5sAZdMe/kwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAhauA0si7sHBd06DSGJgP5vJxL2daW30wR5XbAJd0HWj3QWfl7w27iyZ5AqBT4B0ojLNuMUG8mUOvpcoq0m80qUX7TIKUULKvb+i7uGGEDxk3W5F3es/CTUUWO0QlseWx9QEYziGlp6f3tkP4PTGSL0DywVRSa8l6f/B5kqwnW17CbQfJZ8vmy5snpDO/avgYssUnQtKQPhos7GbokNHps/bxEIRfLeprzQox20dw4RV59LcorjP5QV7Vc6FuYmhzC0nfRetTHckyxg66O3ekfTVs87MLiDV0ipQ+D/6k3g6DRuTdd4V2khjtI56ujSqTQ2PueNQXPu8y2fdsT2Rd1LcfxMS1xKAhSwhHfyy0I3JwzPG1D+sm3QNJEOoJviSNn5fYOFpY+mSEkFNMMeEbwOFdHxWbkiJk/Z8VwdH5I52tkHU3sRQMuZHtcKUc/SIt5Ivv6gtuEZQdm1GE6KUdiRB95s8JVGNlCcHX5bXbScu4eKCRQn3Cl+m5KR4EzI6hVP/iDRhVKj7Dn/blOHLzhNS5vW4X085dTP+1TBL8CHpQpiA3t8LfqfV1b/+WahOd3jNBNTXXfe/AQSjErgctLMdmOBpUQaJLOlcDcKGxWQdOo102nxg8Y/kFDARccywugoQxuIZpMYq74tjnJlJZ9kqR/LPrjmvx4v+0XFsaCPE=",
+    "Delay": "3",
+    "Group": "Default",
+    "Hosts": "127.0.0.1",
+    "Hwid": "null",
+    "Install": "false",
+    "InstallFile": "",
+    "InstallFolder": "%AppData%",
+    "Key": "Uk9tU0hKZUlVdXBwek1tV3NqYnBLYVRYcklWQXB5c0I=",
+    "MTX": "AsyncMutex_6SI8OkPnk",
+    "Pastebin": "null",
+    "Ports": "6606,7707,8808",
+    "Serversignature": "b4TmzraaQMXPVpdfH6wgqDtnXhWP9SP6GdUMgvKSpjPlWufiGM88XWg3Wnv1bduWRMUOAIBN31gAe/SRIhAhdCJU0h6nvqjBUKQsnrg3kT6d2beUtwLDhWWqGa3i9Nta72fkbikM65DIkUwjGtnZy3THx83+doN/+cwe9ZlhKc7TqGF9klOT0nQ9JFUi3Gn6uDzwhA7vicj1WyfM15QxLp0ZvTojgjjFUC2BVkr+mDvuuQ4OR0h4qOgl/AXOYfZwKMfvnwijdP/qqpeG+X73rXZxeDawcTMYqvWH+hOiksgsh2C9V/iN8Sjye/A6rKewmHMUozpakMjP+TjES8kwT70+vJ/uS3ugCZUjT6sOqqLl+LyQyzSpGdVJJQB/fPrYTlWTJwpXdxk8V+eqcdCf/mpeYyQnyGaFVc2whfLAN0r2aPigRQNmsY7Faom/CeNc98zIBf9Nt+KR3FfyFuYabZn5zQcYNAq6D0MVRbKQsU3eyGWN+JI24PQUloheBFJvimpBqMMRVWDLsQq82TpExWJoT47fBrzZj/6LE10vKwl6TNiE81fkglcc93ErbH1KCdXxUaxKVePUIypEaohzXkv88h7P6gjhm2Crey8mUkir408At+5Xl8hQE1ozQN0e5le2gIdxX+oFkTFDrzd65MAdKiZ7rqauNMb4aM+bEeM=",
+    "TelegramChatID": "1863892139",
+    "TelegramToken": "7153134069:AAHd4riTPdhAdVGBwo16vJQ5H3eORu5QAEo",
+    "Version": ""
+  },
+  "key": "564eced38c73ee8089d8bcc951f28c0589a54388a4058b0da1d9c4d94514518f",
+  "salt": "bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941",
+  "sha256": "0aa7bfb081e73a67c23715a55ff13a74ef6b1ce2b82a33b5537ee001592919a4",
+  "yara_possible_family": "asyncrat"
+}

tests/expected/0e19cefba973323c234322452dfd04e318f14809375090b4f6ab39282f6ba07e.json

@@ -0,0 +1,24 @@
+{
+  "config": {
+    "Anti": "%Anti%",
+    "BDOS": "%BDOS%",
+    "Certificate": "%Certificate%",
+    "Delay": "%Delay%",
+    "Group": "%Group%",
+    "Hosts": "%Hosts%",
+    "Hwid": "null",
+    "Install": "%Install%",
+    "InstallFile": "%File%",
+    "InstallFolder": "%Folder%",
+    "Key": "%Key%",
+    "MTX": "%MTX%",
+    "Pastebin": "%Pastebin%",
+    "Ports": "%Ports%",
+    "Serversignature": "%Serversignature%",
+    "Version": "%Version%"
+  },
+  "key": "None",
+  "salt": "bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941",
+  "sha256": "0e19cefba973323c234322452dfd04e318f14809375090b4f6ab39282f6ba07e",
+  "yara_possible_family": "asyncrat"
+}

tests/expected/6b99acfa5961591c39b3f889cf29970c1dd48ddb0e274f14317940cf279a4412.json

@@ -0,0 +1,24 @@
+{
+  "config": {
+    "Anti": "false",
+    "BDOS": "false",
+    "Certificate": "MIIE4DCCAsigAwIBAgIQAM+WaL4OeJIj4I0Usukl1TANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTZXJ2ZXIwIBcNMjQwNDA0MTYzMzA2WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKhz3rO2b0ITSMGvwlS7uWZLVU7cuvYiIyB2WnGxe2SUlT5/pZrRxfX6CVL8t11S5CG3UFMdKDutLiA1amqLDbkqZAjG/g1J+7OPUOBrBWfzpEk/CFCFjmUTlMPwM00DtDp5Ju8ONc09JiaL9Ni3GeYsXza+HZB0WRrgpKnMNu+833ddBOaIgdvB4KicE/S8hSRq5kTNIhiNNZ0nrMFgzaQj0ijyXNTXN7nFCTqRSkWn/2pdveWZLqzTRZ5HsUkeXr2vhSdrrk7KOpHWjqNr2Nhl+bqsIRUhwnthLhj6N1Y94W25j3ATrLR6mjjZTGI2wRm95bMe/7V4DxqV30i6MVrwYMXKcaPO+NHoF9P1lErhCgttEGyWJz2dVJqVCXA+fE8hLyKSUeJSwaBJ36Of/OFGXXMXpUD7eFHNCN2yPVsW1ogS04/xkQUmbWbRjYx/l02+RK/kAK3YsZDuvcLsbKoDq7XJKoBVfvbv5W7jcmMvHHT54PNbmkAUasbtM/+/KhKQe1etOoYd+gOv7tgcNFRVH6N6eSuTxasCYjCr9tSLLmziNalWTknHgBtL/x49BJw6FWwrEE3wsl3C4ALfHQFbtI6sTLdCk7t/oNFUhpVE4kwql5xtOpYpkAj500jGfmVc9Wjy34tON2QLKnzAO87pt8XyANEFQdm3qUJX56KdAgMBAAGjMjAwMB0GA1UdDgQWBBRP67T1n4GPr5zJ0tsXMJ+gL7IawDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBMOPQsFZRxqhZZ344n0qBiatzq/jSmfMsMKWYMTiFHHccrgSc63C+nlVpTSCys2BZaMyocxeWKI+w7NklntQhp058+oN7PVC87xod6uZQyfYG1oCR58+Po4I3lWHVdOWQrkEKf4LTpCtyPXPTccZL3AjYcZWLOvP0gcjRsF2dSGnN1WdTPKHxj+OLSwSxlwTW4WN2wg++OV9cmT4wgaT2jPDqv3twxV+JVwEeXMM7XthJsG8ajToCS3Sf7pXnuOBIBoITQEbi7Iyqm/mJwFmAkcpEXb88rHZnKs+rRzjPRI/XsvlGVVuyiHtvPJL9X+R3VVltvrawBCbmN9K2W21E56Nryip0q4wdcF1jJUHXxAiQo/jcu8fO3RGfs9I6SN54PXSWABS7MvNJU8njC1N3J110cnjTgVMNrgRhBHe6r9CGnN4gm9oKvKL5+0/zZvhUPgYusOHIQmdOdfLo0r7tckUk2D18ufRILcaOqyaHLI7Mri1XEli8Brfjdtv/dlpssh/B2/o3bhBlRVD4oL+EX71Bm6cHEKoCLL6zGySSQosQyZpR2j4qVObb5fK1EnilJG4Qk6mNULZfWVPD9TLsJTHEioV8GibykF5O79kruha/pxFvVnoDJHbTPZEWfuR4cb6YIFbTg9pJrOhUsoyZg41leCrcqHR82XOVB755xfw==",
+    "Delay": "3",
+    "Group": "Default",
+    "Hosts": "minecraftdayzserver.ddns.net",
+    "Hwid": "null",
+    "Install": "true",
+    "InstallFile": "WinRar.exe",
+    "InstallFolder": "%AppData%",
+    "Key": "VUpkMU9UTEhRSEVSN2d2eWpLeDJud2Q0STFIcDRXS0U=",
+    "MTX": "LMAsmxp3mz2D",
+    "Pastebin": "null",
+    "Ports": "2400",
+    "Serversignature": "PBjqcvsYypDmnjgUVv1SkvtLx+jFt2V7NyZ+nHik0CWcLbwOwBXD6/3an89d/I7pFAxwZXgSiLunc1yCOocUvymhbMwqT5t/yuj4GdW3a16vZSUuPbvGEOuB2oCgUNrsLWzqshnd1yaTIbNoENLJNS3phGLnQXijbrE2/mSEWbSjLcCWMC7Q52c54RCiBuKPQEhFR1KMUBtSeskObCEqOKY9tYsKKTDYDrQPp32Ho4qArPCDIiefcNiT4k17Dw4srW1OkC3uhSCc7BV1dZA/HJw5gd34pFTeCnJnqY34OmE7sux8mhBjaIXSJMXD81272ngrmGwu6++6DkdLgIx2y3uE6IcUFDQmOgU6T9I0ulogZGGZa1PI3VjBjF4TK27EwzrkR0iKi8Ctn8z/HMXnskviCaui6RlxEzWqOytSfe4m0XHpNN2gHVhKbZwJUr5IwKASOWiXgsOVpkTn8K6PDN22X2rCUigjRsE4/45qhd6BFCa/pXMgCHljHKi5qp13yor91rO9n6NjbO2bP28cexUmUwf03lClGQ2og8q05WWiqHHvLlpHxmy8fZwzniJC3tr6htyPYhGpzo20BMOz/x66tA/+JTC8CFFilvf3PP97KwfqpVNqtnyHVui7QR39E6QvoyNzw+7AxpHCSYx6F9tyWu96pBeSbCrMzXaSV0k=",
+    "Version": "0.5.8"
+  },
+  "key": "eebdb6b2b00c2501b7b246442a354c5c3d743346e4cc88896ce68485dd6bbb8f",
+  "salt": "bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941",
+  "sha256": "6b99acfa5961591c39b3f889cf29970c1dd48ddb0e274f14317940cf279a4412",
+  "yara_possible_family": "asyncrat"
+}

tests/expected/6e5671dec52db7f64557ba8ef70caf53cf0c782795236b03655623640f9e6a83.json

@@ -0,0 +1,90 @@
+{
+  "config": {
+    "ENABLELOGGER": true,
+    "ENCRYPTIONKEY": "O2CCRlKB5V3AWlrHVKWMrr1GvKqVxXWdcx0l0s6L8fB2mavMqr",
+    "HIDEFILE": true,
+    "INSTALL": false,
+    "INSTALLNAME": "INSTALL",
+    "MUTEX": "e4d6a6ec-320d-48ee-b6b2-fa24f03760d4",
+    "PASSWORD": "5EPmsqV4iTCGjx9aY3yYpBWD0IgEJpHNEP75pks",
+    "RECONNECTDELAY": 5000,
+    "SPECIALFOLDER": "APPLICATIONDATA",
+    "STARTUP": true,
+    "STARTUPKEY": "STARTUP",
+    "SUBFOLDER": "SUB",
+    "TAG": "RELEASE",
+    "VERSION": "1.0.00.r6",
+    "xor_decoded_strings": [
+      "BPN - Nuestro Banco",
+      "Red Link - bpn",
+      "HB Judiciales BPN",
+      "Ingres\u00e1 a tu cuenta",
+      "Online Banking Web",
+      "Banca Empresa 3.0",
+      "Banco Ciudad",
+      "Banco Ciudad | Autogesti\u00f3n",
+      "Banca Empresa 3.0",
+      "Banco Comafi - Online Banking",
+      "Banco Comafi - eBanking Empresas",
+      "Online Banking Santander | Inicio de Sesi\u00f3n",
+      "Online Banking Empresas",
+      "Online Banking",
+      "Office Banking",
+      "HSBC Argentina",
+      "HSBC Argentina | Bienvenido",
+      "accessbanking.com.ar/RetailHomeBankingWeb/init.do?a=b",
+      "ICBC Access Banking | Home Banking",
+      "Banco Patagonia",
+      "ebankpersonas.bancopatagonia.com.ar/eBanking/usuarios/login.htm",
+      "P\u00e1gina del Banco de la Provincia de Buenos Aires",
+      "Red Link",
+      "bind - finanzas felices :)",
+      "BindID Ingreso",
+      "BBVA Net Cash | Empresas | BBVA Argentina",
+      "Bienvenido a nuestra Banca Online | BBVA Argentina",
+      "Ingres\u00e1 tu e-mail, tel\u00e9fono o usuario de Mercado Pago",
+      "Mercado Pago | De ahora en adelante, hac\u00e9s m\u00e1s con tu dinero.",
+      "Mercado Pago",
+      "Home Banking",
+      "Office Banking",
+      "Banco Santa Cruz Gobierno - Una propuesta para cada Comuna o Municipio | Banco Santa Cruz",
+      "Home banking",
+      "Office Banking",
+      "Banco de Santa Cruz",
+      "Red Link",
+      "Banco de la Naci\u00f3n Argentina",
+      "Red Link - BANCO DE LA NACION ARGENTINA",
+      "Red Link",
+      "Macro | Agenda powered by Whyline",
+      "Banco Macro | Banca Internet Personas",
+      "Banco Macro | NUEVA Banca Internet Empresas",
+      "https://argentina-e4162-default-rtdb.firebaseio.com/user.json",
+      "C:\\\\Users\\\\",
+      "\\\\AppData\\\\Local\\\\Aplicativo Itau",
+      "C:\\\\Program Files\\\\Topaz OFD\\\\Warsaw",
+      "C:\\\\ProgramData\\\\scpbrad",
+      "C:\\\\ProgramData\\\\Trusteer",
+      "dd.MM.yyyy HH:mm:ss",
+      "application/json",
+      "Sistema no disponible, intente nuevamente m\u00e1s tarde.",
+      "SENHA DE 6 BPN",
+      "SENHA DE 6 NB",
+      "SENHA DE 6 CIUDAD",
+      "SENHA DE 6 COMAFI",
+      "SENHA DE 6 GALACIA",
+      "SENHA DE 6 HSBC",
+      "SENHA DE 6 ICBC",
+      "SENHA DE 6 PATAGONIA",
+      "SENHA DE 6 PROVINCIA",
+      "SENHA DE 6 SANTANDER",
+      "SENHA DE 6 BIND",
+      "SENHA DE 6 BBVA",
+      "driftcar.giize.com:443",
+      "adreniz.kozow.com:443"
+    ]
+  },
+  "key": "526f35346a62726168486530765a6266487a7039685575526637684a737575794b4c7933654e5a3465644c415a71455861676b3078357767563277364d544b5339367279367959664d6a66456f35653934784e396c684e346b514c4e7479317442704974",
+  "salt": "None",
+  "sha256": "6e5671dec52db7f64557ba8ef70caf53cf0c782795236b03655623640f9e6a83",
+  "yara_possible_family": "quasarrat"
+}

tests/expected/83892117f96867db66c1e6676822a4c0d6691cde60449ee47457f4cc31410fce.json

@@ -0,0 +1,27 @@
+{
+  "config": {
+    "obfuscated_key_1": false,
+    "obfuscated_key_10": "qztadmin.duckdns.org:9782;",
+    "obfuscated_key_11": "1WvgEMPjdwfqIMeM9MclyQ==",
+    "obfuscated_key_12": "NcFtjbDOcsw7Evd3coMC0y4koy/SRZGydhNmno81ZOWOvdfg7sv0Cj5ad2ROUfX4QMscAIjYJdjrrs41+qcQwg==",
+    "obfuscated_key_13": "SubDir",
+    "obfuscated_key_14": "Client.exe",
+    "obfuscated_key_15": "QSR_MUTEX_YMblzlA3rm38L7nnxQ",
+    "obfuscated_key_16": "Quasar Client Startup",
+    "obfuscated_key_17": "mDf8ODHd9XwqMsIxpY8F",
+    "obfuscated_key_18": "Office04",
+    "obfuscated_key_19": "Logs",
+    "obfuscated_key_2": false,
+    "obfuscated_key_3": false,
+    "obfuscated_key_4": true,
+    "obfuscated_key_5": true,
+    "obfuscated_key_6": false,
+    "obfuscated_key_7": 3000,
+    "obfuscated_key_8": "APPLICATIONDATA",
+    "obfuscated_key_9": "1.3.0.0"
+  },
+  "key": "ff230bfb57fecad4bd59d4d97f6883b4",
+  "salt": "bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941",
+  "sha256": "83892117f96867db66c1e6676822a4c0d6691cde60449ee47457f4cc31410fce",
+  "yara_possible_family": "quasarrat"
+}

tests/expected/9bfed30be017e62e482a8792fb643a0ca4fa22167e4b239cde37b70db241f2c4.json

@@ -0,0 +1,25 @@
+{
+  "config": {
+    "An_ti": "true",
+    "Anti_Process": "false",
+    "BS_OD": "false",
+    "Certifi_cate": "MIICNjCCAZ+gAwIBAgIVALWZXeRliC16frxuoSrGsVJO4U2tMA0GCSqGSIb3DQEBDQUAMGcxFTATBgNVBAMMDHNwZWVkeSBkcmVhbTETMBEGA1UECwwKcXdxZGFuY2h1bjEfMB0GA1UECgwWVmVub21SQVQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIzMDYyNjEzNDc0OFoXDTM0MDQwNDEzNDc0OFowEzERMA8GA1UEAwwIVmVub21SQVQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJ2DCquy6CwL8H/T1Wi72pbKLyGQdoXBDSKpGyIfLgX5091jBQYbvFbROqt6FjbN52GSpnmd4N8TnQE6KGqTmmSmaf/nxMSNcV1sjhxm7NTfnP9vo/vnZngCmzVr91S9REqlKCiotdkIYWqbdwkmYTuqSdHaicP7Tf0H8oOYZIc5AgMBAAGjMjAwMB0GA1UdDgQWBBS/OFCWU/dcBWOe+i6ERcFdHDOwITAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAIT79sUZm5Je3T7yc9GS+pgzsgtf8OXakm0DrY41uytJgXzgi2E/bWIBja4DyuAddL0ziDCamqDQuFA1MhFNki/X0uKgu1ArxZeXlwKqpDv7ihWRqWrE3rHYha0ALSP8DN0Asmpc4FGnrfhoeoLYXRo8EqH+6ctIkggM8OiBYSTm",
+    "De_lay": "1",
+    "Group": "Default",
+    "Hos_ts": "127.0.0.1",
+    "Hw_id": "null",
+    "In_stall": "false",
+    "Install_File": "speedy",
+    "Install_Folder": "%AppData%",
+    "Key": "TzY1S0thald3UGNURmJTYjNSQVdBYlBQR2tTdUFaTTg=",
+    "MTX": "ypxcfziuep",
+    "Paste_bin": "null",
+    "Por_ts": "4449",
+    "Server_signa_ture": "Sn1WeJuN+Ypb6kUw4QirT1RzbwUEoeSYTmJAIlg0LayMd/VSwAo+0LnnT/g5HFx4QrqaM689CvKqUNfotQb9cPj05dfgrV3SplVDt5twnK6f8nnScqI8trTCmprH1gnOcoKcY8039kFo9dEj+eOiaBF451W181I5fPJd4Uug1bY=",
+    "Ver_sion": "Venom RAT + HVNC + Stealer + Grabber  v6.0.3"
+  },
+  "key": "86cfd98ca989924e7a9439902dc6a72e315da09c11b100c39cd59b9c9372b192",
+  "salt": "56656e6f6d524154427956656e6f6d",
+  "sha256": "9bfed30be017e62e482a8792fb643a0ca4fa22167e4b239cde37b70db241f2c4",
+  "yara_possible_family": "venomrat"
+}

tests/expected/a2817702fecb280069f0723cd2d0bfdca63763b9cdc833941c4f33bbe383d93e.json

@@ -0,0 +1,30 @@
+{
+  "config": {
+    "ENABLELOGGER": true,
+    "ENCRYPTIONKEY": "O2CCRlKB5V3AWlrHVKWMrr1GvKqVxXWdcx0l0s6L8fB2mavMqr",
+    "HIDEFILE": true,
+    "INSTALL": false,
+    "INSTALLNAME": "INSTALL",
+    "MUTEX": "e4d6a6ec-320d-48ee-b6b2-fa24f03760d4",
+    "PASSWORD": "5EPmsqV4iTCGjx9aY3yYpBWD0IgEJpHNEP75pks",
+    "RECONNECTDELAY": 5000,
+    "SPECIALFOLDER": "APPLICATIONDATA",
+    "STARTUP": true,
+    "STARTUPKEY": "STARTUP",
+    "SUBFOLDER": "SUB",
+    "TAG": "RELEASE",
+    "VERSION": "1.0.00.r3",
+    "hardcoded_hosts": [
+      "kilofrngcida.xyz:443",
+      "sartelloil.lat:443",
+      "fostlivedol.xyz:443",
+      "comerciodepeixekino.org:443",
+      "cartlinkfoltrem.xyz:443",
+      "trucks-transport.xyz:443"
+    ]
+  },
+  "key": "None",
+  "salt": "None",
+  "sha256": "a2817702fecb280069f0723cd2d0bfdca63763b9cdc833941c4f33bbe383d93e",
+  "yara_possible_family": "quasarrat"
+}