in nightMARE/src/nightmare/malware/stealc/configuration.py [0:0]
def find_uris(uri_list: list[bytes]):
"""
This function will take a list of strings and return a list of URI
strings that match regular expression pattern with a URI containing
a slash and TLD.
Example: /de4846fc29f26952.php
"""
uris = []
uri_pattern = re.compile(URI_TLD_REGEX)
for byte_string in uri_list:
try:
string = byte_string.decode("utf-8")
except UnicodeDecodeError:
continue
if len(string) > 8:
matches = re.findall(uri_pattern, string)
uris.extend(matches)
return uris