Add signatures

yara/indicator_knownbad_id.yar

@@ -1706,3 +1706,18 @@ rule INDICATOR_KB_ID_Ransomware_Payola {
     condition:
         any of them
 }
+
+rule INDICATOR_KB_ID_Ransomware_Xorist {
+    meta:
+        author = "ditekShen"
+        description = "Detects files referencing identities associated with Xorist ransomware"
+    strings:
+        $s1 = "@root_backdoor_synaptics_V" ascii wide nocase
+        $s2 = "@DosX_Plus" ascii wide nocase
+        $s3 = "@Cinoshi_Adm" ascii wide nocase
+        $s4 = "@ac3ss0r" ascii wide nocase
+        $s4 = "MCwRK1Z7K4GYHt9ZrbTR2SMCEqzqQaTbRF" ascii wide
+        $s5 = "0x334F093c9De6552AF4cC0B252dA82aC77FeB467D" ascii wide
+    condition:
+        any of them
+}

yara/indicator_tools.yar

@@ -1753,3 +1753,22 @@ rule INDICATOR_TOOL_Pandora {
     condition:
         uint16(0) == 0x5a4d and 5 of them
 }
+
+rule INDICATOR_TOOL_Havoc {
+    meta:
+        author = "ditekSHen"
+        description = "Detects Havoc Demon"
+    strings:
+        $x1 = "X-Havoc:" wide
+        $x2 = "X-Havoc-Agent:" wide
+        $s1 = "\\Werfault.exe" wide
+        $s2 = "/funny_cat.gif" wide
+    condition:
+        uint16(0) == 0x5a4d and (all of ($x*) or 3 of them or
+            (
+                pe.number_of_imports == 0 and 
+                pe.number_of_exports == 0 and 
+                2 of them
+            ) 
+        )
+}

yara/malware.yar

@@ -11204,3 +11204,50 @@ rule MALWARE_Win_SapphireStealer {
     condition:
        uint16(0) == 0x5a4d and 5 of them
 }
+
+rule MALWARE_Win_R77 {
+    meta:
+        author = "ditekSHen"
+        description = "Detects r77 rootkit"
+    strings:
+        $s1 = "startup" fullword wide
+        $s2 = "process_names" fullword wide
+        $s3 = "paths" fullword wide
+        $s4 = "service_names" fullword wide
+        $s5 = "tcp_local" fullword wide
+        $s6 = "tcp_remote" fullword wide
+        $s7 = "\\\\.\\pipe\\" wide
+        $s8 = "SOFTWARE\\" wide
+    condition:
+        uint16(0) == 0x5a4d and (
+            all of ($s*) or 
+            (5 of them and pe.exports("ReflectiveDllMain")) or
+            (5 of them and 
+                for any i in (0 .. pe.number_of_sections) : (
+                    (
+                        pe.sections[i].name == ".detourd"
+                    )
+                )
+            )
+        )
+}
+
+rule MALWARE_Win_Disco_NightClub {
+    meta:
+        author = "ditekSHen"
+        description = "Hunts for Disco NightClub"
+    strings:
+        $s1 = "\\OfficeBroker\\OfficeBroker.exe" ascii wide nocase
+        $s2 = "\\EDGEUPDATE\\EDGEAOUT" ascii wide nocase
+        $s3 = "\\EDGEUPDATE\\update" ascii wide nocase
+        $s4 = "windows.system.update.com" ascii wide nocase
+        $s5 = "edgeupdate-security-windows.com" ascii wide nocase
+        $s6 = "nightclub::" ascii wide nocase
+        $s7 = "EncryptedPasswordFlt" ascii wide nocase
+        $s8 = "Microsoft\\def\\Gfr45.cfg" ascii wide nocase
+        $s9 = "::keylog::" ascii wide nocase
+        $pdb1 = "\\AbcdMainProject\\Rootsrc\\Projects\\MainS\\Ink\\" ascii wide nocase
+        $pdb2 = "\\Autogen\\Kh\\AutogenAlg\\" ascii wide nocase
+    condition: 
+        uint16(0) == 0x5a4d and ((1 of ($pdb*) and 2 of ($s*)) or (4 of ($s*)))
+}