from datetime import datetime, timedelta
import re
import logging

from core.observables import Ip, Hostname
from core.feed import Feed
from core.errors import ObservableValidationError


class FeodoTracker(Feed):

    descriptions = {'A': "Hosted on compromised webservers running an nginx proxy on port 8080 TCP forwarding all botnet traffic to a tier 2 proxy node. Botnet traffic usually directly hits these hosts on port 8080 TCP without using a domain name.",
                    'B': "Hosted on servers rented and operated by cybercriminals for the exclusive purpose of hosting a Feodo botnet controller. Usually taking advantage of a domain name within ccTLD .ru. Botnet traffic usually hits these domain names using port 80 TCP.",
                    'C': "Successor of Feodo, completely different code. Hosted on the same botnet infrastructure as Version A (compromised webservers, nginx on port 8080 TCP or port 7779 TCP, no domain names) but using a different URL structure. This Version is also known as Geodo.",
                    'D': "Successor of Cridex. This version is also known as Dridex"}

    variants = {'A': "Feodo",
                'B': "Feodo",
                'C': "Geodo",
                'D': "Dridex"}

    default_values = {
        "frequency": timedelta(hours=1),
        "name": "FeodoTracker",
        "source": "https://feodotracker.abuse.ch/feodotracker.rss",
        "description": "Feodo Tracker RSS Feed. This feed shows the latest twenty Feodo C2 servers which Feodo Tracker has identified.",
    }

    def update(self):
        for dict in self.update_xml('item', ["title", "link", "description", "guid"]):
            self.analyze(dict)

    def analyze(self, dict):
        context = dict

        date_string = re.search(r"\((?P<datetime>[\d\- :]+)\)", dict['title']).group('datetime')
        try:
            context['date_added'] = datetime.strptime(date_string, "%Y-%m-%d %H:%M:%S")
        except ValueError:
            pass

        g = re.match(r'^Host: (?P<host>.+), Version: (?P<version>\w)', dict['description'])
        g = g.groupdict()
        context['version'] = g['version']
        context['description'] = FeodoTracker.descriptions[g['version']]
        context['subfamily'] = FeodoTracker.variants[g['version']]
        context['source'] = self.name
        del context['title']

        try:
            if re.search(r"[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}", g['host']):
                new = Ip.get_or_create(value=g['host'])
            else:
                new = Hostname.get_or_create(value=g['host'])
            new.add_context(context)
            new.add_source("feed")
            new.tag(['dridex', 'malware', 'crimeware', 'banker', 'c2'])
        except ObservableValidationError as e:
            logging.error(e)

@@ -1098,24 +1098,136 @@
 n as Dridex%22
+,%0A                    'E': %22Successor of Geodo / Emotet (Version C) called Heodo. First appeared in March 2017.%22
 %7D%0A%0A    varia
@@ -1336,16 +1336,46 @@
 %22Dridex%22
+,%0A                'E': %22Heodo%22
 %7D%0A%0A    d
@@ -2482,16 +2482,82 @@
 itle'%5D%0A%0A
+        variant_tag = FeodoTracker.variants%5Bg%5B'version'%5D%5D.lower()%0A
         
@@ -2879,16 +2879,19 @@
 ag(%5B
-'dridex'
+variant_tag
 , 'm

add variant in FeodoTracker and fix tags