Add new rules

clamav/clamav.ldb

@@ -157,3 +157,5 @@ ditekSHen.MALWARE.Osx.Trojan.POOLRAT;Engine:51-255,Target:9;0&1&2&3&4&5&6&7;4d53
 ditekSHen.MALWARE.Linux.Trojan.PondRAT;Engine:51-255,Target:6;0&1&2&3&4&5&6&7;4d7367446f776e;4d73675570;4d736752756e;4d7367436d64;43727970745061796c6f6164;526563765061796c6f6164;63736c65657069;46436f6e6e65637450726f7879
 ditekSHen.MALWARE.Osx.Trojan.PondRAT;Engine:51-255,Target:9;0&1&2&3&4&5&6&7;4d7367446f776e;4d73675570;4d736752756e;4d7367436d64;43727970745061796c6f6164;526563765061796c6f6164;63736c65657069;46436f6e6e65637450726f7879
 ditekSHen.MALWARE.Win.Ransomware.Cicada3301;Engine:51-255,Target:1;(0&5)&((1|2|3|4)>3|(6|7|8|9)>3);636d642f4363686370203635303031203e6e756c6e65742076696577205c5c;6372656174655f66696c655f7265636f76657279;65636e7279707465645f66696c65735f66756c6c;6765745f6578636c756465645f6469726563746f72696573;636f6c6c6563745f66696c65735f657863657074;2d444154412e747874;2e65786534643561;2d61636365707465756c61202d73202d64202222202d2d;5b2a2e6578652a2e4558452a2e444c4c2a2e696e692a2e696e662a2e706f6c2a2e636d642a2e7073312a2e7662732a2e6261742a2e7061676566696c652e7379732a2e686962657266696c2e7379732a2e647276;6d656d746173766565616d737663246261636b757073716c7673736d7365786368616e676573716c246d7973716c6d7973716c24736f70686f734d5345786368616e6765
+ditekSHen.MALWARE.Win.Trojan.FPSpy;Engine:51-255,Target:1;(0|1|2|3|4|5|6|7|8|9|10)>4|(11&12&13);5b416e616c79735f5370795d::w;5b44656c657465506f6f72446c6c5d::w;5b446f776e6c6f616450726f635d::w;5b4a61636b536c6565705d::w;5b4b696c6c436d644578655d::w;5b5073446f776e50726f635d::w;5b5265616446696c6546726f6d5061636b65745d::w;5b52656d6f746544726f70457865635d::w;5b52656d6f7465457865635d::w;5b52656d6f7465496e6a6563745d::w;5b53656e6448747470466f7255706c6f61645d::w;4d617a6546756e63;2573537973496e666f5f253032645f253032645f253032642e747874;636d64202f632073797374656d696e666f203e3e202573
+ditekSHen.MALWARE.Win.Trojan.KLogExe;Engine:51-255,Target:1;(0|1|2|3|4|5|6|7|8)>5;5b636c69705f735d3a202573;2d2d2d2d2d2d2025642f25642f2564203a2025642f2564202d2d2d2d2d2d;5b546f6f206d616e7920636c69705f7461696c5d;6e616d653d227573657266696c65223b2066696c656e616d653d22257322;5b5257696e2b5d;2f77702d636f6e74656e742f696e636c7564652e7068703f5f7379735f::w;5c6465736b746f70732e696e69::w;4b4c6f67457865::wi;64796e616d69635f696d706f72742e637070205b7265736f6c76655f63616c6c5d2063616e606e74::w

yara/indicator_knownbad_certs.yar

@@ -8937,3 +8937,68 @@ rule INDICATOR_KB_CERT_5ef27fc51ee80b30430947c9967db440 {
             pe.signatures[i].serial == "5e:f2:7f:c5:1e:e8:0b:30:43:09:47:c9:96:7d:b4:40"
         )
 }
+
+rule INDICATOR_KB_CERT_672237253a9b7ef9d02d7d1cb27a3ff4 {
+    meta:
+         author = "ditekSHen"
+         thumbprint = "36a0f423c1fa48f172e4fecd06b8099f0ebbaeb8"
+    condition:
+        uint16(0) == 0x5a4d and
+        for any i in (0..pe.number_of_signatures): (
+            pe.signatures[i].subject contains "Foshan Yongqiheng Trading Co., Ltd." and
+            pe.signatures[i].issuer contains "Certum Extended Validation Code Signing 2021 CA" and
+            pe.signatures[i].serial == "67:22:37:25:3a:9b:7e:f9:d0:2d:7d:1c:b2:7a:3f:f4"
+        )
+}
+
+rule INDICATOR_KB_CERT_708737c791c878d6dd7b7c43 {
+    meta:
+         author = "ditekSHen"
+         thumbprint = "7ed7081ee612fbf9fe0ade46f4a2749da20251e0"
+    condition:
+        uint16(0) == 0x5a4d and
+        for any i in (0..pe.number_of_signatures): (
+            pe.signatures[i].subject contains "Langfang Alkem Material Technology Co., Ltd." and
+            pe.signatures[i].issuer contains "GlobalSign GCC R45 EV CodeSigning CA 2020" and
+            pe.signatures[i].serial == "70:87:37:c7:91:c8:78:d6:dd:7b:7c:43"
+        )
+}
+
+rule INDICATOR_KB_CERT_0bc777f88ddf5f3ce479452f {
+    meta:
+         author = "ditekSHen"
+         thumbprint = "55aa40dea5621f0c0fbc8b9dd8066ff2290a7e82"
+    condition:
+        uint16(0) == 0x5a4d and
+        for any i in (0..pe.number_of_signatures): (
+            pe.signatures[i].subject contains "ARION LLC" and
+            pe.signatures[i].issuer contains "GlobalSign GCC R45 EV CodeSigning CA 2020" and
+            pe.signatures[i].serial == "0b:c7:77:f8:8d:df:5f:3c:e4:79:45:2f"
+        )
+}
+
+rule INDICATOR_KB_CERT_691ed2236cca78d180f29dfd {
+    meta:
+         author = "ditekSHen"
+         thumbprint = "8c8a043f51bb8d59182fb268c0db2f1b9d876dbe"
+    condition:
+        uint16(0) == 0x5a4d and
+        for any i in (0..pe.number_of_signatures): (
+            pe.signatures[i].subject contains "COSMART LLC" and
+            pe.signatures[i].issuer contains "GlobalSign GCC R45 EV CodeSigning CA 2020" and
+            pe.signatures[i].serial == "69:1e:d2:23:6c:ca:78:d1:80:f2:9d:fd"
+        )
+}
+
+rule INDICATOR_KB_CERT_3b0e3879266f3bc98225b390 {
+    meta:
+         author = "ditekSHen"
+         thumbprint = "2eab64a4eaf37060d27620a822df2e1f18ac28f6"
+    condition:
+        uint16(0) == 0x5a4d and
+        for any i in (0..pe.number_of_signatures): (
+            pe.signatures[i].subject contains "Hangzhou Yueju Apparel Co., Ltd." and
+            pe.signatures[i].issuer contains "GlobalSign GCC R45 EV CodeSigning CA 2020" and
+            pe.signatures[i].serial == "3b:0e:38:79:26:6f:3b:c9:82:25:b3:90"
+        )
+}

yara/malware.yar

@@ -11883,3 +11883,55 @@ rule MALWARE_Win_Cicada3301 {
     condition: 
         uint16(0) == 0x5a4d and (6 of ($s*) or (4 of ($c*) and 4 of ($s*)) or (all of ($c*) and 2 of ($s*)) or 9 of them)
 }
+
+rule MALWARE_Win_FPSpy {
+    meta:
+        author = "ditekshen"
+        description = "FPSpy"
+        clamav1 = "MALWARE.Win.Trojan.FPSpy"
+    strings:
+        $f1 = "[Analys_Spy]" wide
+        $f2 = "[DeletePoorDll]" wide
+        $f3 = "[DownloadProc]" wide
+        $f4 = "[DragWarp]" wide
+        $f5 = "[GetCoolDir]" wide
+        $f6 = "[JackSleep]" wide
+        $f7 = "[KillCmdExe]" wide
+        $f8 = "[PsDownProc]" wide
+        $f9 = "[PsUpProc]" wide
+        $f10 = "[ReadFileFromPacket]" wide
+        $f11 = "[RemoteDropExec]" wide
+        $f12 = "[RemoteExec]" wide
+        $f13 = "[RemoteInject]" wide
+        $f14 = "[SendHttpForUpload]" wide
+        $s1 = "MazeFunc" fullword ascii
+        $s2 = /(Exit|Update|Drop)_EVT/ fullword ascii
+        $s3 = "Key.dat" fullword ascii
+        $s4 = "%sSysInfo_%02d_%02d_%02d.txt" fullword ascii
+        $s5 = "cmd /c systeminfo >> %s" fullword ascii
+        $s6 = "Content-Disposition: form-data; name=\"MAX_FILE_SIZE\"" fullword ascii
+        $s7 = "FPSpy" fullword wide
+    condition: 
+        uint16(0) == 0x5a4d and ((pe.exports("MazeFunc") and 2 of ($f*) and 1 of ($s*)) or (6 of ($f*) and 1 of ($s*)) or (5 of ($s*) and 1 of ($f*)) or (8 of ($f*)))
+}
+
+rule MALWARE_Win_KLogExe {
+    meta:
+        author = "ditekshen"
+        description = "Detects KLogExe"
+        clamav1 = "MALWARE.Win.Trojan.KLogExe"
+    strings:
+        $s1 = "[clip_s]: %s" ascii
+        $s2 = "------ %d/%d/%d : %d/%d ------" ascii
+        $s3 = "[RWin+]" ascii
+        $s4 = "[Too many clip_tail]" ascii
+        $s5 = "name=\"userfile\"; filename=\"%s\"" ascii
+        $s6 = "Origin: http://" wide
+        $s7 = "%s_%d_%d_%d_%d" wide
+        $s8 = "/wp-content/include.php?_sys_" wide
+        $s9 = "\\desktops.ini" wide
+        $s10 = "KLogExe" wide nocase
+        $s11 = "dynamic_import.cpp [resolve_call] can`nt" wide
+    condition: 
+        uint16(0) == 0x5a4d and 6 of them
+}