mirror of
https://github.com/mandiant/capa-rules
synced 2026-06-08 15:41:20 +00:00
raymondlleong
32dc1ea9e8
* Adding rules for TEA, XTEA, XXTEA and RIPEMD hashing Adding to current rules for TEA encrypt & decrypt Adding rules for XTEA, XXTEA, RIPEMD-128, 160, 256, 320 * Description edited for clarity * byte pattern correction * updates - rules with examples moved out of nursery - unneeded examples removed from rules and their example files removed from the PR for capa-testfiles - DS_store files deleted - Descriptions edited to reflect shared magic constants with SHA1 * ripemd128 update updated to include magic array not present in MD5 * MD5 & SHA1 documentation update + RIPEMD160 removal Updating MD5 & SHA1 rules to document magic constants shared with other hashing routines. Removing RIPEMD160 rule using magic constants due to likelihood of false positives with SHA1 routines * ripemd320 description update
46 lines
1.4 KiB
YAML
Executable File
46 lines
1.4 KiB
YAML
Executable File
rule:
|
|
meta:
|
|
name: decrypt data using TEA
|
|
namespace: data-manipulation/encryption/tea
|
|
authors:
|
|
- william.ballenthin@mandiant.com
|
|
- raymond.leong@mandiant.com
|
|
scope: function
|
|
att&ck:
|
|
- Defense Evasion::Obfuscated Files or Information [T1027]
|
|
mbc:
|
|
- Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]
|
|
references:
|
|
- https://en.wikipedia.org/wiki/Tiny_Encryption_Algorithm
|
|
examples:
|
|
- 5B99FA01C72CEBC53A76CC72E9581189:0x180001027
|
|
- 7FD2E2E3C88675D877190ABAA3002B55:0x010004EC0
|
|
features:
|
|
- and:
|
|
- basic block:
|
|
- and:
|
|
- instruction:
|
|
- mnemonic: shr
|
|
- operand[1].number: 0x5
|
|
- instruction:
|
|
- mnemonic: shl
|
|
- operand[1].number: 0x4
|
|
- count(mnemonic(shr)): 0x2
|
|
- characteristic: nzxor
|
|
- or:
|
|
- operand[1].number: 0x9E3779B9 = key schedule constant
|
|
- operand[1].number: 0x61C88647 = key schedule constant two's complement
|
|
- operand[1].number: 0xC6EF3720 = sum
|
|
- not:
|
|
- basic block:
|
|
- and:
|
|
- description: q setup only in XXTEA
|
|
- instruction:
|
|
- mnemonic: mov
|
|
- operand[1].number: 0x34
|
|
- instruction:
|
|
- mnemonic: add
|
|
- operand[1].number: 0x6
|
|
- instruction:
|
|
- mnemonic: idiv
|