text: ## KeyBoy IOCs
  
  This directory contains IOCs from the Citizen Lab report [It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community](https://citizenlab.org/2016/11/parliament-keyboy/) published the 17th of November 2016.
  
  Files included in this directory:
  * openioc.ioc : IOCs in OpenIOC format
  * stix.xml : IOCs in STIX XML format
  * iocs.csv : IOCs in csv format
  * keyboy.yar : Yara rules related to the KeyBoy samples identified
  * kb_c2Decode.py : script to decode KeyBoy C2 communications (see help hereafter)
  * kb_configDecode.py : script to decode KeyBoy configuration (see help hereafter)
  
  
  ### kb_c2Decode.py
  
  Help:
  ```bash
  $ python kb_c2Decode.py -h
  usage: kb_c2Decode.py [-h] (-k KEY | -b BINARY) [--verbose] PCAPF
  
  Decode KeyBoy C2 traffic from pcap file
  
  positional arguments:
    PCAPF                 PCAP File containing c2 traffic
  
  optional arguments:
    -h, --help            show this help message and exit
    -k KEY, --key KEY     Manually provide C2 decode key
    -b BINARY, --binary BINARY
                          KeyBoy binary
    --verbose, -v         Enable verbose output
  
  ```
  
  Example:
  ```
  $ python kb_c2Decode.py -b wab32res.dll dump.pcap
  ============================
  {KeyBoy C2 Traffic decoder}
  ============================
  
  Found constant: 0x71
  Computing decode value...
  Found decoding multiplier (inverse): 0x91
  Searching PCAP for RAW TCP packets and decoding...
  
  *a*
  HOME-PC
  192.168.100.103
  MyUser
  2016/06/03 00:24:20
  20151108
  ```
  
  
  ### kb_configDecode.py
  
  Help:
  ```
  $ python kb_configDecode.py -h
  usage: kb_configDecode.py [-h] [--verbose] [--skip SKIP] FILE
  
  Decode KeyBoy backdoor configuration files
  
  positional arguments:
    FILE                  KeyBoy encoded config file
  
  optional arguments:
    -h, --help            show this help message and exit
    --verbose, -v         Enable verbose output
    --skip SKIP, -s SKIP  Skip over <SKIP> bytes at beginning of file
  
  ```
  
  Example:
  
  ```
  $ python kb_configDecode.py cfs.dat
  ============================
  {KeyBoy Config file Decoder}
  ============================
  
  Configuration Data:
  ==============================
  Identity Code:	9876543210
  C2 Host/IP #1:	103.242.134.243
  C2 Host/IP #2:	103.242.134.243
  C2 Host/IP #3:	103.242.134.243
  C2 Port #1:	443
  C2 Port #2:	1234
  C2 Port #3:	1234
  Password:	password8888
  Campaign ID:	MyUser
  ```
  