mirror of
https://github.com/Yara-Rules/rules
synced 2026-06-08 12:58:40 +00:00
mmorenog
313 lines
12 KiB
Plaintext
313 lines
12 KiB
Plaintext
// sigs for the various cross-family codes
|
|
import "pe"
|
|
|
|
rule Caracachs: sharedcode
|
|
{
|
|
meta:
|
|
copyright = "2015 Novetta Solutions"
|
|
author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
|
|
Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
|
|
|
|
strings:
|
|
/*
|
|
B9 10 00 00 00 mov ecx, 10h ; ecx = 16
|
|
8B 06 mov eax, [esi] ; eax = lastValue
|
|
C1 EA 10 shr edx, 10h ; edx = val >> 16
|
|
81 E2 FF 7F 00 00 and edx, 7FFFh ; edx = (val >> 16) & 0x7FFF
|
|
03 C2 add eax, edx ; eax = ((val >> 16) & 0x7FFF) + lastValue
|
|
8B D0 mov edx, eax ; edx = ((val >> 16) & 0x7FFF) + lastValue
|
|
8B F8 mov edi, eax ; edi = ((val >> 16) & 0x7FFF) + lastValue
|
|
83 E2 0F and edx, 0Fh ; edx = (((val >> 16) & 0x7FFF) + lastValue) & 0xF
|
|
2B CA sub ecx, edx ; ecx = 16 - ((((val >> 16) & 0x7FFF) + lastValue)) & 0xF
|
|
D3 EF shr edi, cl ; edi = (((val >> 16) & 0x7FFF) + lastValue) >> ((16 - ((val >> 16) & 0x7FFF) + lastValue) & 0xF)
|
|
8B CA mov ecx, edx ; ecx = (((val >> 16) & 0x7FFF) + lastValue) & 0xF
|
|
D3 E0 shl eax, cl ; eax = (((val >> 16) & 0x7FFF) + lastValue) << ((((val >> 16) & 0x7FFF) + lastValue) & 0xF)
|
|
0B F8 or edi, eax ; edi = (((val >> 16) & 0x7FFF) + lastValue) >> ((16 - ((val >> 16) & 0x7FFF) + lastValue) & 0xF) | (((val >> 16) & 0x7FFF) + lastValue) << ((((val >> 16) & 0x7FFF) + lastValue) & 0xF)
|
|
89 3E mov [esi], edi ; pLastValue = (((val >> 16) & 0x7FFF) + lastValue) >> ((16 - ((val >> 16) & 0x7FFF) + lastValue) & 0xF) | (((val >> 16) & 0x7FFF) + lastValue) << ((((val >> 16) & 0x7FFF) + lastValue) & 0xF)
|
|
*/
|
|
|
|
$a = {B? 10 00 00 00 8B ?? C1 ?? 10 81 ?? FF 7F 00 00 03 ?? 8B ?? 8B ?? 83 ?? 0F 2B ?? D3 ?? 8B ?? D3 ?? 0B ?? 89 ?? }
|
|
|
|
condition:
|
|
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
|
|
}
|
|
|
|
|
|
rule StringDotSimplified: sharedcode
|
|
{
|
|
meta:
|
|
copyright = "2015 Novetta Solutions"
|
|
author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
|
|
Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
|
|
|
|
strings:
|
|
/*
|
|
F3 AB rep stosd
|
|
80 3A 00 cmp byte ptr [edx], 0
|
|
74 15 jz short loc_404170
|
|
8A 02 mov al, [edx]
|
|
3C 2E cmp al, 2Eh
|
|
74 07 jz short loc_404168
|
|
3C 20 cmp al, 20h
|
|
74 03 jz short loc_404168
|
|
88 06 mov [esi], al
|
|
46 inc esi
|
|
*/
|
|
|
|
$a = { F3 AB 80 ?? 00 74 ?? 8A 02 3C 2E 74 ?? 3C 20 74 ?? 88 06 46 }
|
|
|
|
condition:
|
|
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
|
|
}
|
|
|
|
rule FakeTLS_ServerHelloGetSelectedCipher: sharedcode
|
|
{
|
|
meta:
|
|
copyright = "2015 Novetta Solutions"
|
|
author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
|
|
Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
|
|
|
|
strings:
|
|
/*
|
|
24 10 and al, 10h
|
|
0C 10 or al, 10h
|
|
89 07 mov [edi], eax
|
|
66 8B 44 24 14 mov ax, [esp+0Ch+wCipherSuiteID]
|
|
66 3D 00 C0 cmp ax, 0C000h
|
|
73 34 jnb short loc_4067C1
|
|
66 2D 35 00 sub ax, 35h
|
|
66 F7 D8 neg ax
|
|
1B C0 sbb eax, eax
|
|
24 80 and al, 80h
|
|
05 00 01 00 00 add eax, 100h
|
|
8B D8 mov ebx, eax
|
|
53 push ebx ; hostshort
|
|
*/
|
|
|
|
$a = { 24 10 0C 10 89 ?? 66 8? [3] 66 3? 00 C0 73 ?? 66 2? 35 00 66 F7 ?? 1B ?? 2? 80 0? 00 01 00 00 8B ?? 5? }
|
|
|
|
condition:
|
|
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
|
|
}
|
|
|
|
rule XORDecodeA7: sharedcode
|
|
{
|
|
meta:
|
|
copyright = "2015 Novetta Solutions"
|
|
author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
|
|
Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
|
|
|
|
strings:
|
|
/*
|
|
8A 04 17 mov al, [edi+edx]
|
|
8B FB mov edi, ebx
|
|
34 A7 xor al, 0A7h
|
|
46 inc esi
|
|
88 02 mov [edx], al
|
|
83 C9 FF or ecx, 0FFFFFFFFh
|
|
33 C0 xor eax, eax
|
|
42 inc edx
|
|
F2 AE repne scasb
|
|
F7 D1 not ecx
|
|
49 dec ecx
|
|
3B F1 cmp esi, ecx
|
|
*/
|
|
|
|
$a = { 8A [2] 8B ?? 34 A7 46 88 ?? 83 ?? FF 33 ?? 4? F2 AE F7 ?? 4? 3B ?? }
|
|
|
|
condition:
|
|
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
|
|
}
|
|
|
|
|
|
rule DynamicAPILoading: sharedcode
|
|
{
|
|
meta:
|
|
copyright = "2015 Novetta Solutions"
|
|
author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
|
|
Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
|
|
|
|
strings:
|
|
/*
|
|
83 C4 04 add esp, 4
|
|
50 push eax ; lpProcName
|
|
56 push esi ; hModule
|
|
FF 15 20 F0 40 00 call ds:GetProcAddress
|
|
68 A8 0C 41 00 push offset aLo_adlIbr_arYw; "Lo.adL ibr.ar yW"
|
|
A3 DC 3E 41 00 mov GetProcAddress_0, eax
|
|
E8 7D FF FF FF call CleanupString
|
|
83 C4 04 add esp, 4
|
|
50 push eax ; _DWORD
|
|
56 push esi ; _DWORD
|
|
FF 15 DC 3E 41 00 call GetProcAddress_0
|
|
68 94 0C 41 00 push offset aLoad_LibR_arYa; "Load. Lib r.ar yA"
|
|
A3 D4 3E 41 00 mov LoadLibraryW, eax
|
|
E8 63 FF FF FF call CleanupString
|
|
83 C4 04 add esp, 4
|
|
50 push eax ; _DWORD
|
|
56 push esi ; _DWORD
|
|
FF 15 DC 3E 41 00 call GetProcAddress_0
|
|
68 80 0C 41 00 push offset a_frE_eliBr_arY; ".Fr e.eLi br.ar y"
|
|
A3 D8 3E 41 00 mov LoadLibraryA_0, eax
|
|
E8 49 FF FF FF call CleanupString
|
|
*/
|
|
|
|
$a = { 83 C4 ?? 5? 5? FF 15 [4] 68 [4] A3 [4] E8 [4] 83 C4 ?? 5? 5? FF 15 [4] 68 [4] A3 [4] E8 [4] 83 C4 ?? 5? 5? FF 15 [4] 68 [4] A3 [4] E8}
|
|
|
|
|
|
condition:
|
|
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
|
|
}
|
|
|
|
|
|
rule DNSCalcStyleEncodeAndDecode: sharedcode
|
|
{
|
|
meta:
|
|
copyright = "2015 Novetta Solutions"
|
|
author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
|
|
Source = "975522bc3e07f7aa2c4a5457e6cc16c49a148b9f731134b8971983225835577e"
|
|
|
|
strings:
|
|
/*
|
|
8A 10 mov dl, [eax]
|
|
80 F2 73 xor dl, 73h <--- for decoding and encoding, this and
|
|
80 EA 3A sub dl, 3Ah <--- this could be reversed, but the sig holds since both are 0x80
|
|
88 10 mov [eax], dl
|
|
40 inc eax
|
|
49 dec ecx
|
|
75 F2 jnz short loc_1000403C
|
|
*/
|
|
|
|
$a = {8A ?? 80 ?? ?? 80 ?? ?? 88 ?? 4? 4? 75 ?? }
|
|
|
|
condition:
|
|
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
|
|
}
|
|
|
|
rule GenerateTLSClientHelloPacket_Test: sharedcode
|
|
{
|
|
meta:
|
|
copyright = "2015 Novetta Solutions"
|
|
author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
|
|
Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
|
|
|
|
strings:
|
|
/*
|
|
25 07 00 00 80 and eax, 80000007h
|
|
79 05 jns short loc_405EC8; um, nope.. this will always happen
|
|
48 dec eax
|
|
83 C8 F8 or eax, 0FFFFFFF8h
|
|
40 inc eax
|
|
*/
|
|
|
|
$a = {25 07 00 00 80 79 ?? 4? 83 ?? F8 4? }
|
|
|
|
condition:
|
|
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
|
|
}
|
|
|
|
rule RC4SboxKeyGen: sharedcode
|
|
{
|
|
meta:
|
|
copyright = "2015 Novetta Solutions"
|
|
author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
|
|
Source = "RT_RCDATA_101.bin.bin"
|
|
|
|
strings:
|
|
/*
|
|
8A 4C 04 08 mov cl, [esp+eax+108h+sbox]; cl = sbox[i]
|
|
8B D0 mov edx, eax
|
|
81 E2 0F 00 00 80 and edx, 8000000Fh ; i % 16
|
|
79 05 jns short loc_10003AC8; dl = key[i & 16]
|
|
4A dec edx
|
|
83 CA F0 or edx, 0FFFFFFF0h
|
|
42 inc edx
|
|
*/
|
|
|
|
$a = { 8A [3] 8B ?? 81 ?? 0F 00 00 80 79 ?? 4? 83 ?? F0 4? }
|
|
|
|
condition:
|
|
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
|
|
}
|
|
|
|
|
|
rule RandomTimestampGenerator: sharedcode
|
|
{
|
|
meta:
|
|
copyright = "2015 Novetta Solutions"
|
|
author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
|
|
Source = "RT_RCDATA_101.bin.bin joanap baseline sample"
|
|
|
|
strings:
|
|
/*
|
|
66 81 44 24 0C FE FF add [esp+1Ch+SystemTime.wYear], 0FFFEh
|
|
FF D6 call esi ; rand
|
|
99 cdq
|
|
B9 0C 00 00 00 mov ecx, 0Ch
|
|
F7 F9 idiv ecx
|
|
42 inc edx
|
|
66 89 54 24 0E mov [esp+1Ch+SystemTime.wMonth], dx
|
|
FF D6 call esi ; rand
|
|
99 cdq
|
|
B9 1C 00 00 00 mov ecx, 1Ch
|
|
F7 F9 idiv ecx
|
|
42 inc edx
|
|
66 89 54 24 12 mov [esp+1Ch+SystemTime.wDay], dx
|
|
FF D6 call esi ; rand
|
|
99 cdq
|
|
B9 17 00 00 00 mov ecx, 17h
|
|
F7 F9 idiv ecx
|
|
42 inc edx
|
|
66 89 54 24 14 mov [esp+1Ch+SystemTime.wHour], dx
|
|
FF D6 call esi ; rand
|
|
99 cdq
|
|
B9 3B 00 00 00 mov ecx, 3Bh
|
|
F7 F9 idiv ecx
|
|
42 inc edx
|
|
66 89 54 24 16 mov [esp+1Ch+SystemTime.wMinute], dx
|
|
FF D6 call esi ; rand
|
|
99 cdq
|
|
B9 3B 00 00 00 mov ecx, 3Bh
|
|
F7 F9 idiv ecx
|
|
*/
|
|
|
|
$a = { 66 81 [3] FE FF FF [1-4] 99 B9 0C 00 00 00 F7 [1-4] 42 66 89 [3] FF D6 99 B9 1C 00 00 00 F7 [1-4] 42 66 89 [3] FF D6 99 B9 17 00 00 00 F7 [1-4] 42 66 89 [3] FF D6 99 B9 3B 00 00 00 F7 [1-4] 42 66 89 [3] FF D6 99 B9 3B 00 00 00 F7 }
|
|
|
|
condition:
|
|
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
|
|
}
|
|
|
|
rule CPUInfoExtraction
|
|
{
|
|
meta:
|
|
copyright = "2015 Novetta Solutions"
|
|
author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
|
|
Source = "Cmd10010_296fcc9d611ca1b8f8288192d6d854cf4072853010cc65cb0c7f958626999fbd.bin"
|
|
|
|
strings:
|
|
/*
|
|
68 00 00 00 80 push 80000000h ; a2
|
|
8B 02 mov eax, [edx]
|
|
8B 4A 04 mov ecx, [edx+4]
|
|
89 4C 24 10 mov [esp+2Ch+var_1C], ecx
|
|
8B 4A 08 mov ecx, [edx+8]
|
|
89 4C 24 14 mov [esp+2Ch+var_18], ecx
|
|
8B 4A 0C mov ecx, [edx+0Ch]
|
|
8D 54 24 1C lea edx, [esp+2Ch+var_10]
|
|
89 8E 70 03 00 00 mov [esi+370h], ecx
|
|
52 push edx ; a1
|
|
8B CE mov ecx, esi
|
|
89 86 6C 03 00 00 mov [esi+36Ch], eax
|
|
E8 29 FF FF FF call GetCPUIDValues
|
|
8B C8 mov ecx, eax
|
|
8B 01 mov eax, [ecx]
|
|
3D 00 00 00 80 cmp eax, 80000000h
|
|
8B 51 04 mov edx, [ecx+4]
|
|
*/
|
|
|
|
$a = {68 00 00 00 80 8B ?? 8B ?? 04 89 [3] 8B ?? 08 89 [3] 8B ?? 0C 8D [3] 89 [5] 5? 8B ?? 89 [5] E8 [4] 8B ?? 8B ?? 3D 00 00 00 80 8B ?? 04 }
|
|
|
|
condition:
|
|
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
|
|
}
|