JoeSandbox submission poc

JoeSandbox.yaml

name: Custom.Server.Malware.JoeSandbox
description: |
   This is a POC to submit a sample to JoesSandbox.
   No options beyont TAC and API have been configured.

type: SERVER

parameters:
   - name: JoeSandboxUrl
     default: https://www.joesandbox.com/api/v2/submission/new
   - name: TargetPath
     default: /Users/yolo/malware/samples/beacon/file.ext
   - name: APIKey
     default: 

sources:
  - query: |
        LET file_bytes = read_file(filename=TargetPath)

        LET data_key = '--velociraptor00000011111100000000001111\r\nContent-Disposition: form-data; name="apikey"' + '\r\n\r\n' + APIKey + '\r\n'
        LET data_tac = '--velociraptor00000011111100000000001111\r\nContent-Disposition: form-data; name="accept-tac"' + '\r\n\r\n1\r\n'
        LET data_file= '--velociraptor00000011111100000000001111\r\nContent-Disposition: form-data; name="sample"; filename=' + basename(path=TargetPath) + '\r\nContent-Type: application/octet-stream\r\n\r\n' + file_bytes + '\r\n'
    
        LET data_bytes = data_file + data_key + data_tac
        
        -- create submission
        SELECT *,
            parse_json(data=Content) as Content
        FROM http_client(url=JoeSandboxUrl,method='POST',disable_ssl_security='True',
            headers=dict(`Content-Type`="multipart/form-data;boundary=velociraptor00000011111100000000001111"), 
            data=data_bytes)