#!/bin/bash
#####
# Description: Some information about the source
#
# Name: Feodo Bot TRacker
# Frequency: Daily
# Types: IPv4, domain, MD5, SHA256
#####
# Some Variables
HOME="/tmp/osint"
SOURCES="/tmp/osint/sources"
HEADER="Accept: text/html"
UA21="Mozilla/5.0 Gecko/20100101 Firefox/21.0"
UA22="Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13; ) Gecko/20101203"
TODAY=$(date +"%Y-%m-%d")
if [ ! -d "/tmp/ossint/sources/malwaredru" ]; then
        mkdir -p /tmp/osint/sources/malwaredru;
fi
cd $HOME
datadirs=( ipv4 domains hashes rules )
for i in "${datadirs[@]}"; do
        if [ ! -d "$HOME/$i" ]; then
                mkdir -p $HOME/$i
        fi
done
#####################################
cd $SOURCES/malwaredru
#
# Grab some files from this site
wget --header="$HEADER" --user-agent="$UA21" "http://malwared.ru/db/index.php?page=1" -O "malwaredru_homepage_$TODAY.txt"
sleep 2;
wget --header="$HEADER" --user-agent="$UA21" "http://malwared.ru/rss_bin.php" -O "malwaredru_rssbin_$TODAY.txt"
sleep 6;
wget --header="$HEADER" --user-agent="$UA21" "http://malwared.ru/rss.php" -O "malwaredru_rsscnc_$TODAY.txt"
sleep 19;
wget --header="$HEADER" --user-agent="$UA21" "http://malwared.ru/db/fulllist.php" -O "malwaredru_fulllist_$TODAY.txt"
sleep 11;
#
# Grab some samples
for i in {1..25}; do
	wget --header="$HEADER" --user-agent="$UA21" "http://malwared.ru/samples/file.php?vir=$i" -O malwaredru_samples_$i.html
	sleep 17;
done
#
# Let's grab some hashes from the sampels files
for i in malwaredru_samples_*.html; do
	cat $i | grep MD5 | grep -a -o -e "[0-9a-f]\{32\}" >> malwaredru_md5_working_$TODAY.txt
	cat $i | grep SHA1 | grep -a -o -e "[0-9a-f]\{40\}" >> malwaredru_sha1_working_$TODAY.txt
	cat $i | grep SHA256 | grep -a -o -e "[0-9a-f]\{64\}" >> malwaredru_sha256_working_$TODAY.txt
done
#
#
for i in malwaredru_*.txt; do 
	cat $i | grep -E -o '(25[0-5]|2[0-5][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-5][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-5][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-5][0-9]|[01]?[0-9][0-9]?)' >> malwaredru_ipv4_working_$TODAY.txt
done
cat malwaredru_ipv4_working_$TODAY.txt | sort | uniq >> malwaredru_ipv4_$TODAY.txt
cp malwaredru_ipv4_$TODAY.txt /tmp/osint/ipv4/malwaredru_ipv4_$TODAY.txt
#
while read i; do
	echo "$i, " >> malwaredru_siem_ipv4_$TODAY.csv;
	echo "ALL:    $i" >> malwaredru_hostsdeny_$TODAY.deny
	echo "iptables -A INPUT -s $i -j DROP LOG --log-prefix 'feodo tracker' " >> malwaredru_iptables_$TODAY.sh
	echo "iptables -A OUTPUT -s $i -j DROP LOG --log-prefix 'feodo tracker' " >> malwaredru_iptables_$TODAY.sh
	echo "iptables -A FORWARD -s $i -j DROP LOG --log-prefix 'feodo tracker' " >> malwaredru_iptables_$TODAY.sh
done < malwaredru_ipv4_$TODAY.txt
#
cp malwaredru_iptables_$TODAY.sh /tmp/osint/rules/malwaredru_iptables_$TODAY.sh
cp malwaredru_siem_ipv4_$TODAY.csv /tmp/osint/rules/malwaredru_siem_ipv4_$TODAY.csv
#
#####
#
cat malwaredru_rssbin_$TODAY.txt | grep -a -o -e "[0-9a-f]\{64\}" >> malwaredru_sha256_working_$TODAY.txt
cat malwaredru_sha256_working_$TODAY.txt | sort | uniq >> malwaredru_sha256_$TODAY.txt
cat malwaredru_rssbin_$TODAY.txt | sed 's#<description>#,#g' | sed 's#<\/description>#,#g' | awk '{split($0,a,","); for (i=1; i<=100; i++) print a[i]}' | grep -v link | grep -a -o -e "[0-9a-f]\{32\}" >> malwaredru_md5_working_$TODAY.txt
# Grab some domains
cat malwaredru_homepage_$TODAY.txt | grep -o '<td>.*</td>' | grep -v "virustotal" | grep "http" >> malwaredru_domains_working_$TODAY.txt 
cat malwaredru_rsscnc_$TODAY.txt | sed 's#<link>#,#g' | sed 's#<\/link>#,#g' | awk '{split($0,a,","); for (i=1; i<=100; i++) print a[i]}' | grep http >> malwaredru_domains_working_$TODAY.txt


#
# EOF
