sync by doomedraven · Pull Request #2761 · kevoreilly/CAPEv2

doomedraven · 2025-11-30T08:56:58Z

No description provided.

Comment out the repository for Suricata 8 and use Suricata 7.0 instead.

- removed highly variable jump size in conditional jump (0x2e6 bytes code, size highly brittle) - replaced eax register in nice characteristic pattern as it can only be eax, since pattern contains the xor eax, eax instruction by which the code zeroes)

Rhadamanthys Yara Rule Update

Yara updates 01

…ster secret (#2739)

Bumps [django](https://github.com/django/django) from 5.1.13 to 5.1.14. - [Commits](django/django@5.1.13...5.1.14) --- updated-dependencies: - dependency-name: django dependency-version: 5.1.14 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Rename surihhost to surihost in search.html * Add 'surihost' key to Suricata alert mapping * Update lib/cuckoo/common/web_utils.py Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

… pid or "explorer" for shell: monitor=<pid/"explorer">

Install dependencies from both requirements files.

Bumps [django](https://github.com/django/django) from 5.1.13 to 5.1.14. - [Commits](django/django@5.1.13...5.1.14) --- updated-dependencies: - dependency-name: django dependency-version: 5.1.14 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Updated the workflow to install dependencies using uv run with specified requirements files.

Update NitroBunnyDownloader yara

…ent (#2753) Updates the POST /status endpoint to unset the async subprocess if the new status is terminal. This makes GET /status report the final analysis state, rather than the child process state.

…rocess hook

Bumps [pypdf](https://github.com/py-pdf/pypdf) from 5.2.0 to 6.4.0. - [Release notes](https://github.com/py-pdf/pypdf/releases) - [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md) - [Commits](py-pdf/pypdf@5.2.0...6.4.0) --- updated-dependencies: - dependency-name: pypdf dependency-version: 6.4.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

gemini-code-assist · 2025-11-30T08:57:26Z

Summary of Changes

Hello @doomedraven, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request encompasses a series of updates and refinements across the codebase, focusing on improving the reliability of analysis status reporting, enhancing malware detection through updated YARA rules, and ensuring the accuracy of documentation. It also includes routine dependency updates and minor code quality improvements to maintain system stability and performance.

Highlights

Agent Status Handling: Introduced TERMINAL_STATUSES to correctly manage the async_subprocess state when an analysis reaches a final status (COMPLETE, FAILED, EXCEPTION), ensuring accurate reporting of the analysis state.
YARA Rule Enhancements: Added new YARA rules for RhadaAnti and RhadUnhook, introduced a new NitroBunnyDownloader rule, and refined existing rules for AdaptixBeacon, Rhadamanthys (split into payload and loader rules), and SmokeLoader to improve malware detection capabilities.
Documentation and Typo Corrections: Updated documentation related to cape-rooter service usage and removed an outdated warning about resultserver IP configuration. Several typos, such as 'cretated' to 'created' and 'surihhost' to 'surihost', were corrected in templates and search fields.
Dependency Updates: Updated Poetry version, Django to 5.1.14, and pypdf to 6.4.0, along with corresponding hash updates for stpyv8 in poetry.lock and requirements.txt.
Codebase Refinements: Implemented various minor code improvements, including adjusting machine lookup logic, refining PCAP analysis, ensuring proper string conversion for file paths, and enhancing error message formatting in demux_sample.

Ignored Files

Ignored by pattern: .github/workflows/** (1)
- .github/workflows/auto_answer.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request appears to be a synchronization of various changes, including bug fixes, documentation updates, dependency updates, and improvements to YARA rules. The changes generally improve code quality and fix issues. For example, there are fixes for potential None access in templates, a bug in demux.py when creating error entries, and a fix for looking up KVM machine domains. However, there is a concern regarding the removal of a test case for error handling in analyzer/windows/tests/test_analyzer.py, which reduces the robustness of the pipe command handling.

enzok and others added 30 commits October 28, 2025 10:10

Update AdaptixBeacon yara and add NitrogenBunnyDownloader yara

3837aea

add missing hash

378edda

add missing update

26d76a5

Gemini nags

3b89448

Additional Rhadamanthys patterns

281a704

Switch Suricata installation to version 7.0

e644ed4

Comment out the repository for Suricata 8 and use Suricata 7.0 instead.

Remove test_handle_process_invalid_data() from tests/test_analyzer.py

c462d0b

Tweak Rhadamanthys patterns

6ea9cca

- removed highly variable jump size in conditional jump (0x2e6 bytes code, size highly brittle) - replaced eax register in nice characteristic pattern as it can only be eax, since pattern contains the xor eax, eax instruction by which the code zeroes)

Merge pull request #2737 from YungBinary/master

9469619

Rhadamanthys Yara Rule Update

Merge pull request #2734 from enzok/yara_updates_01

c27e2b3

Yara updates 01

Rhadamanthys anti-anti detonation bypass

b7cf955

Rhadamanthys detection patterns

c75cb93

Enable protocol extended information to be generated without a TLS ma…

b2048f4

…ster secret (#2739)

Update NitroBunnyDownloader yara

efeb9d7

Update startup.py

c1cf7eb

Fix path handling for SHA256 calculation

fc099b9

Update startup.py

a088fca

Monitor updates: see changelog for details

d7d9f35

analyzer: remove obsolete 'suspended' parameter from CommandPipeHandler

4fe8e23

Update routing.rst

2d2c923

Fix error list entry format in demux.py

f812eab

prevent linux parsing errors (#2744)

6c5b5c3

Rhadamanthys unhook bypass

9cf8bf5

Monitor update: Add config option for monitor injection into supplied…

e11ada6

… pid or "explorer" for shell: monitor=<pid/"explorer">

SmokeLoader 2025

bbf509e

Update installation step to include KnowledgeBaseBot

e56dd1e

Install dependencies from both requirements files.

ci: Update requirements.txt

e046f87

doomedraven and others added 8 commits November 19, 2025 13:04

Refactor auto_answer.yml to streamline dependency installation

5f8eb09

Updated the workflow to install dependencies using uv run with specified requirements files.

Merge pull request #2741 from enzok/update-01

0d42a6f

Update NitroBunnyDownloader yara

fix docs

37b6e65

Fix a bug that prevents terminal status from being reported by the ag…

b8e0bca

…ent (#2753) Updates the POST /status endpoint to unset the async subprocess if the new status is terminal. This makes GET /status report the final analysis state, rather than the child process state.

Fix 'machines' vars on Azure (#2755)

2debad2

Monitor update: Fix issue with RESUME: monitor message from NtResumeP…

bd2b2a1

…rocess hook

Prevent on_complete execution for matched signatures (#2758)

c34f847

gemini-code-assist bot reviewed Nov 30, 2025

View reviewed changes

doomedraven merged commit 2e2391e into staging Nov 30, 2025
9 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

sync#2761

sync#2761
doomedraven merged 38 commits intostagingfrom
master

doomedraven commented Nov 30, 2025

Uh oh!

gemini-code-assist bot commented Nov 30, 2025

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

Conversation

doomedraven commented Nov 30, 2025

Uh oh!

gemini-code-assist bot commented Nov 30, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants