diff --git a/Build/Test/YaraSharp.dll b/Build/Test/YaraSharp.dll index 73f5fb8..1ebcb51 100644 Binary files a/Build/Test/YaraSharp.dll and b/Build/Test/YaraSharp.dll differ diff --git a/Build/Test/YaraTest.exe b/Build/Test/YaraTest.exe index b0b0ca0..d98d9df 100644 Binary files a/Build/Test/YaraTest.exe and b/Build/Test/YaraTest.exe differ diff --git a/README.md b/README.md index 81fa8eb..40692ac 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # YaraSharp C# wrapper around the [Yara pattern matching library](https://github.com/VirusTotal/yara). -Use signatures form [Loki](https://github.com/Neo23x0/signature-base/tree/master/yara). +Use signatures form [Loki](https://github.com/Neo23x0/signature-base/tree/master/yara) or [Yara](https://github.com/Yara-Rules/rules). ## Usage ```C# // All API calls happens here @@ -67,7 +67,7 @@ YSContext.Destroy(); * Metadata supported * Externals supported * Async scanning supported -* Modules not supported +* It seems (through debug sessions) that modules are supported, but i haven't had cases that certanly used them. So this question is opened ## Note Soultion contains 2 projects: diff --git a/YaraSharp/Rules.cpp b/YaraSharp/Rules.cpp index eeddddd..2af8d86 100644 --- a/YaraSharp/Rules.cpp +++ b/YaraSharp/Rules.cpp @@ -16,7 +16,7 @@ namespace YaraSharp Namespace = nullptr; Identifier = nullptr; Tags = gcnew List(); - // Strings = gcnew List(); + Strings = gcnew List(); Meta = gcnew Dictionary(); } CRule::CRule(YR_RULE* Rule) @@ -24,7 +24,7 @@ namespace YaraSharp Namespace = nullptr; Tags = CRule::GetRuleTags(Rule); Meta = CRule::GetRuleMeta(Rule); - // Strings = CRule::GetRuleStrings(Rule); + Strings = CRule::GetRuleStrings(Rule); Identifier = gcnew String(Rule->identifier); } diff --git a/YaraSharp/Rules.h b/YaraSharp/Rules.h index 1dbb3f5..d797dba 100644 --- a/YaraSharp/Rules.h +++ b/YaraSharp/Rules.h @@ -21,9 +21,7 @@ namespace YaraSharp property String^ Identifier; property List^ Tags; property Dictionary^ Meta; - // It's some kind of useless here - // Match has already a section for this - // property List^ Strings; + property List^ Strings; CRule(); CRule(YR_RULE* Rule); diff --git a/YaraSharp/dll.rc b/YaraSharp/dll.rc index 63a4a04..49ce9c4 100644 Binary files a/YaraSharp/dll.rc and b/YaraSharp/dll.rc differ diff --git a/YaraTest/Program.cs b/YaraTest/Program.cs index 6763b56..2d35fa9 100644 --- a/YaraTest/Program.cs +++ b/YaraTest/Program.cs @@ -32,7 +32,7 @@ namespace YaraTest using (YaraSharp.CRules YSRules = YSInstance.CompileFromFiles(Directory.GetFiles(Path.Combine(Directory.GetCurrentDirectory(), "..\\..\\signatures"), "*.yar", SearchOption.AllDirectories).ToList(), Externals, out Errors)) { // Some file to test yara rules - string Filename = @"\\?\D:\_\Magic.apt"; + string Filename = @"\\?\"; // Get matches List Matches = YSInstance.ScanFile(Filename, YSRules, diff --git a/signatures/apt_agent_btz.yar b/signatures/apt_agent_btz.yar deleted file mode 100644 index ffbb1a1..0000000 --- a/signatures/apt_agent_btz.yar +++ /dev/null @@ -1,69 +0,0 @@ -/* - Yara Rule Set - Author: Florian Roth - Date: 2017-08-07 - Identifier: Agent BTZ - Reference: http://www.intezer.com/new-variants-of-agent-btz-comrat-found/ -*/ - -/* Rule Set ----------------------------------------------------------------- */ - -import "pe" - -rule Agent_BTZ_Proxy_DLL_1 { - meta: - description = "Detects Agent-BTZ Proxy DLL - activeds.dll" - author = "Florian Roth" - reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/" - date = "2017-08-07" - hash1 = "9c163c3f2bd5c5181147c6f4cf2571160197de98f496d16b38c7dc46b5dc1426" - hash2 = "628d316a983383ed716e3f827720915683a8876b54677878a7d2db376d117a24" - strings: - $s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Modules" fullword wide - condition: - ( uint16(0) == 0x5a4d and filesize < 300KB and all of them and pe.exports("Entry") ) -} - -rule Agent_BTZ_Proxy_DLL_2 { - meta: - description = "Detects Agent-BTZ Proxy DLL - activeds.dll" - author = "Florian Roth" - reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/" - date = "2017-08-07" - hash1 = "73db4295c5b29958c5d93c20be9482c1efffc89fc4e5c8ba59ac9425a4657a88" - hash2 = "380b0353ba8cd33da8c5e5b95e3e032e83193019e73c71875b58ec1ed389bdac" - hash3 = "f27e9bba6a2635731845b4334b807c0e4f57d3b790cecdc77d8fef50629f51a2" - strings: - $s1 = { 38 21 38 2C 38 37 38 42 38 4D 38 58 38 63 38 6E - 38 79 38 84 38 8F 38 9A 38 A5 38 B0 38 BB 38 C6 - 38 D1 38 DC 38 E7 38 F2 38 FD 38 08 39 13 39 1E - 39 29 39 34 39 3F 39 4A 39 55 39 60 39 6B 39 76 - 39 81 39 8C 39 97 39 A2 39 AD 39 B8 39 C3 39 CE - 39 D9 39 E4 39 EF 39 FA 39 05 3A 10 3A 1B 3A 26 - 3A 31 3A 3C 3A 47 3A 52 3A 5D 3A 68 3A 73 3A 7E - 3A 89 3A 94 3A 9F 3A AA 3A B5 3A C0 3A CB 3A D6 - 3A E1 3A EC 3A F7 3A } - $s2 = "activeds.dll" ascii fullword - condition: - uint16(0) == 0x5a4d and filesize < 200KB and all of them and pe.imphash() == "09b7c73fbe5529e6de7137e3e8268b7b" -} - -rule Agent_BTZ_Aug17 { - meta: - description = "Detects Agent.BTZ" - author = "Florian Roth" - reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/" - date = "2017-08-07" - hash1 = "6ad78f069c3619d0d18eef8281219679f538cfe0c1b6d40b244beb359762cf96" - hash2 = "49c5c798689d4a54e5b7099b647b0596fb96b996a437bb8241b5dd76e974c24e" - hash3 = "e88970fa4892150441c1616028982fe63c875f149cd490c3c910a1c091d3ad49" - strings: - $s1 = "stdole2.tlb" fullword ascii - $s2 = "UnInstallW" fullword ascii - condition: - ( - uint16(0) == 0x5a4d and filesize < 900KB and - all of them and - pe.exports("Entry") and pe.exports("InstallW") and pe.exports("UnInstallW") - ) -} diff --git a/signatures/apt_alienspy_rat.yar b/signatures/apt_alienspy_rat.yar deleted file mode 100644 index afd6bd8..0000000 --- a/signatures/apt_alienspy_rat.yar +++ /dev/null @@ -1,49 +0,0 @@ - -rule crime_win_rat_AlienSpy -{ -meta: - description = "Alien Spy Remote Access Trojan" - author = "General Dynamics Fidelis Cybersecurity Solutions - Threat Research Team" - reference_1 = "www.fidelissecurity.com/sites/default/files/FTA_1015_Alienspy_FINAL.pdf" - reference_2 = "www.fidelissecurity.com/sites/default/files/AlienSpy-Configs2_1_2.csv" - date = "04-Apr-15" - filetype = "Java" - hash_1 = "075fa0567d3415fbab3514b8aa64cfcb" - hash_2 = "818afea3040a887f191ee9d0579ac6ed" - hash_3 = "973de705f2f01e82c00db92eaa27912c" - hash_4 = "7f838907f9cc8305544bd0ad4cfd278e" - hash_5 = "071e12454731161d47a12a8c4b3adfea" - hash_6 = "a7d50760d49faff3656903c1130fd20b" - hash_7 = "f399afb901fcdf436a1b2a135da3ee39" - hash_8 = "3698a3630f80a632c0c7c12e929184fb" - hash_9 = "fdb674cadfa038ff9d931e376f89f1b6" - - strings: - - $sa_1 = "META-INF/MANIFEST.MF" - $sa_2 = "Main.classPK" - $sa_3 = "plugins/Server.classPK" - $sa_4 = "IDPK" - - $sb_1 = "config.iniPK" - $sb_2 = "password.iniPK" - $sb_3 = "plugins/Server.classPK" - $sb_4 = "LoadStub.classPK" - $sb_5 = "LoadStubDecrypted.classPK" - $sb_7 = "LoadPassword.classPK" - $sb_8 = "DecryptStub.classPK" - $sb_9 = "ClassLoaders.classPK" - - $sc_1 = "config.xml" - $sc_2 = "options" - $sc_3 = "plugins" - $sc_4 = "util" - $sc_5 = "util/OSHelper" - $sc_6 = "Start.class" - $sc_7 = "AlienSpy" - $sc_8 = "PK" - - condition: - - uint16(0) == 0x4B50 and filesize < 800KB and ( (all of ($sa_*)) or (all of ($sb_*)) or (all of ($sc_*)) ) -} diff --git a/signatures/apt_apt10.yar b/signatures/apt_apt10.yar deleted file mode 100644 index 363abcc..0000000 --- a/signatures/apt_apt10.yar +++ /dev/null @@ -1,1681 +0,0 @@ -/* - Yara Rule Set - Author: Jonas Lejon - Date: 2017-04-06 - Identifier: APT 10 Malware -*/ - -rule APT10_Malware_Sample_Gen { - meta: - description = "APT 10 / Cloud Hopper malware campaign" - author = "Florian Roth" - reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html" - date = "2017-04-06" - score = 80 - - hash1 = "001B8F696B6576798517168CD0A0FB44" - hash2 = "007F5599898AB9013672226B4C5F57E1" - hash3 = "01468A69CA8676B51A357676E0856C88" - hash4 = "018509C1165817D4B0A3E728EAB41EA0" - hash5 = "0232172544079FF42890DB4FD248CC11" - hash6 = "0506CF6D4E86C9AD1D4EA985F43582C6" - hash7 = "05138BD38F7C63313CB72B4ED5C241FA" - hash8 = "05C974FA1E5C11E472706F98C9923F61" - hash9 = "0687D9CD29D39C98ABA312A0BAAA4506" - hash10 = "076EC3AA6B0CB93E7D4CD607F3CED946" - hash11 = "07ABD6583295061EAC2435AE470EFF78" - hash12 = "08709F35581E0958D1CA4E50B7D86DBA" - hash13 = "08A268A4C473F9920B254A6B6FC62548" - hash14 = "08A3259648AE99053BA24AA60A309770" - hash15 = "08F10881E2C57EB6F7368B7C06735826" - hash16 = "0921D7B4BF06276F4F59C85EB240DA29" - hash17 = "098BFD5C1E7A5CF9F914C09ABACB58F9" - hash18 = "0991C9C0797D5299AD29BA55A87F13A6" - hash19 = "0AD3ED5588EEC7BA4988C8892A5C2946" - hash20 = "0B6845FBFA54511F21D93EF90F77C8DE" - hash21 = "0B87F38F9151EF81E07C2CDD8A602335" - hash22 = "0C0A39E1CAB4FC9896BDF5EF3C96A716" - hash23 = "0DC209A146D163F70A8F7D2A6CFD33E1" - hash24 = "0EA8B5118943827DB26DD07785180909" - hash25 = "0F3F59190054C95B9001BAA3F2AEA917" - hash26 = "0F6B00B0C5A26A5AA8942AE356329945" - hash27 = "102494D665B137BF91E902076F339185" - hash28 = "10C13A817BF7622B2359D1816BE4C122" - hash29 = "11EA8D8DD0FFDE8285F3C0049861A442" - hash30 = "13CDD0D9F222A47589C5C71FA3AC2CBE" - hash31 = "15FAECBBC412A7C3BD1049D77BC7618B" - hash32 = "16AB92CC9A5D40CF0E3FA01FED0DD80F" - hash33 = "17B8E6AC3830AD58AFE1A70DF4319FAE" - hash34 = "184DD07BC91CC915AEBF157A8B28066D" - hash35 = "19417F7551BC54DB6783823325557773" - hash36 = "19609562AE8DF094B1F6E313AFF21359" - hash37 = "19610F0D343657F6842D2045E8818F09" - hash38 = "1A14BD60F4C49D1AEBD245968A3A654F" - hash39 = "1B1588507439CF700F411336E40B94A1" - hash40 = "1B50E838BABCD80AB95CFF14BDF22A69" - hash41 = "1B851BB23578033C79B8B15313B9C382" - hash42 = "1B891BC2E5038615EFAFABE48920F200" - hash43 = "1BC481CB01B205095C86174A171676D8" - hash44 = "1C3FE3EC1148FA72C18E2FCC3CDB354F" - hash45 = "1D0105CF8E076B33ED499F1DFEF9A46B" - hash46 = "1D3EBCED0619F8E399A91735A05CF617" - hash47 = "1ECBFF1A46A8EC9A0C3EE45A390950A0" - hash48 = "200C06F1BE562A09CAFAB07D22838767" - hash49 = "20E5D623AF9AFE095EF449CB9B6C9B46" - hash50 = "21567CCE2C26E7543B977A205845BA77" - hash51 = "223D1396F2B5B7719702C980CBD1D6C0" - hash52 = "22D799E3FE58E5D10341080D370B683E" - hash53 = "233368858A54E5F41F28DBBB7B9BB245" - hash54 = "234257C192CAA419D14096F104B03E06" - hash55 = "23D03EE4BF57DE7087055B230DAE7C5B" - hash56 = "24C2661AECE1C089AA57C6EFA7380E9D" - hash57 = "250495A936DD186B689438AAB3CEA65B" - hash58 = "251A5361EFA82FB66E0832CC2DE63B93" - hash59 = "257B3ED1145C25E3E67F83F61A637034" - hash60 = "25A11276AA992478F4C21C64EE409B35" - hash61 = "25A2BB2EDA3C432A4C1CE481D9CEB2E6" - hash62 = "2685D8EB6009FD7F03956928F08071DE" - hash63 = "26C7326F4449C1337FC42E43CA0790DD" - hash64 = "26F932C0FF3DD6BBF0361A6B97343B1A" - hash65 = "28D5FB5D73C7F9B442827FA1A3C09E29" - hash66 = "291976BA47CEC4B3C0E31CBC50AB1923" - hash67 = "2A92AFF566D6B1253E5C63336C32DF73" - hash68 = "2B7DB3F35255C34676570DCFF88CC7B3" - hash69 = "2BD698AE474B18CF4748EDD99BD6C9E7" - hash70 = "2D1E048030C27E2D57F0448DF78142F6" - hash71 = "312D49A05B6EFFE1F2EF2775C13B4382" - hash72 = "3160654955F818072F6F8A8782E0F16F" - hash73 = "32D85825A7F627CDF8070A379B6B464F" - hash74 = "33C50A7EC7FC4CD601801EED093DC620" - hash75 = "343974937D2A9A83EA08828CF447A53E" - hash76 = "354B40F155BEEFCAC3A41C2FFABBF6C8" - hash77 = "35947B085E4593CCF38A5EB26CA4D4CF" - hash78 = "3643D7D278316EB23E852638CEF4E51C" - hash79 = "37A5D27D49385F4E8EDB94AD83B38164" - hash80 = "37C89F291DBE880B1F3AC036E6B9C558" - hash81 = "392F15C431C00F049BB1282847D8967F" - hash82 = "3AFA9243B3AEB534E02426569D85E517" - hash83 = "3CBB5664D70BBE62F19EE28F26F21D7E" - hash84 = "3D83DF756CC1E575755A7A3A8D9D8AFC" - hash85 = "3DCA6CBF1981AB987987966228D95E55" - hash86 = "40AE680E0F9CF3AE344AD97C55723AA9" - hash87 = "410774441B39165380ECB50598D7A799" - hash88 = "429F5048462FD037E3AD7F8A211004C6" - hash89 = "42C6E38375E46075EB1ABD7A41AE15C5" - hash90 = "433F5DC5546D98CC9E4597B342DF31CF" - hash91 = "454A7F651E366EC0982216AE8D45544D" - hash92 = "45F5B2404EEFE7672534BCD13466987D" - hash93 = "472B1710794D5C420B9D921C484CA9E8" - hash94 = "4840EE7971322E1A6DA801643432B25F" - hash95 = "486A97E513B02BDE9E61F16EC8C55A01" - hash96 = "492C9EA17E215053DB1C214BB369684F" - hash97 = "494E65CF21AD559FCCF3DACDD69ACC94" - hash98 = "4A076785E9786324BB852DD5BC27F10B" - hash99 = "4B7CC736E85F6C2D128A78C69280F12C" - hash100 = "4D3C31E95879CA85CAADAAD0C91974E3" - hash101 = "4D449395552584EF28C7DEA47E54CB30" - hash102 = "4D4ECAA074E5BAB3ECC0C68DE10687E5" - hash103 = "4E6BF299554A356E91E9D230014075FC" - hash104 = "4EB8A6B39B3F8E952473874F99225B2C" - hash105 = "4F505CA0EA4540E6662DEF1C1DDADD03" - hash106 = "50B03A4D7FF45C2D8724DE1292C1B8F4" - hash107 = "51ABC29C8F832A6ED57B6D9BDF05AC1F" - hash108 = "52F6A991FEB2785451D66B49F287E588" - hash109 = "531A86012F2250E97A75323B9B64D63A" - hash110 = "5359C9CD0936D10B88B6BCE295026EA9" - hash111 = "53C8096033DB54E5EC3D5EB9AC080FC4" - hash112 = "55B8690C0AAE4E500E645D5F49CE5A13" - hash113 = "578B17334312F81934ADFED048FFDAFD" - hash114 = "57A797DFF7BB1D26074845A72E2E70D2" - hash115 = "583AB1678588B754899B9D2C58F20AA2" - hash116 = "584F13C639ECF696781515A593234DEB" - hash117 = "58553DCF4F13B6EC1DDE8BA2A58EC8E9" - hash118 = "588F58AFC2298E6B31E44EBC86AEE104" - hash119 = "59A3FF3496740CEEA97FF70A980BC3AE" - hash120 = "5A78974DF88AB6A67BB72A5C7A437FB2" - hash121 = "5B425DCF90DF36706BCDD21438D6D32A" - hash122 = "5C5401FD7D32F481570511C73083E9A1" - hash123 = "5E0091C529D7D43F803C2CFFF5DE28D7" - hash124 = "5E8D1E8518D10893EAB0B1B1EBB6C97D" - hash125 = "5ED1CB6E270A66D593478EBFEFD7213D" - hash126 = "5EF46462597297547BE10A6AC9A28247" - hash127 = "5F3B25E36F6C6637EB08DCCA1C3A8ED6" - hash128 = "61C886305F490C0F1B6A9407AEB01596" - hash129 = "6257E9973EB355B73D7610BE8C1F0663" - hash130 = "6285CBA13FC5C2538E31C7F2529C7069" - hash131 = "62898B77BD9E8E286D6BC760F3E28981" - hash132 = "65EACB6FEC60AD22CA32B47E8F50A907" - hash133 = "667989FFA5E77943F3384E78ADF93510" - hash134 = "66FAE10B1E063CBACA1E1D58D56C13CD" - hash135 = "684888079AAF7ED25E725B55A3695062" - hash136 = "686BB59EA637FB3AF214C8C21761CDA8" - hash137 = "69F8AC18B047AA0C70EAF982FA1E483C" - hash138 = "6A3B8D24C125F3A3C7CFF526E63297F3" - hash139 = "6B27330B779541AE8F3DE7A491A19D8F" - hash140 = "6E311F3AF7FBF98B0AF1241E26E07E4 " - hash141 = "6F3D15CF788E28CA504A6370C4FF6A1E" - hash142 = "6F5648EA4CA8A65C36C328C5AE8AC096" - hash143 = "6FEA7954AB3D31414946D95E72F3152C" - hash144 = "6FF16AFC92CE09ACD2E3890B780EFD86" - hash145 = "7007B54E7E3F84844086D5320806788E" - hash146 = "726788726DFB19231C6FC9C83EE2F392" - hash147 = "72F50A28656FA65B6D770AF89ED82D69" - hash148 = "730C2D11835D2D8804D5A93B67CD8FE2" - hash149 = "75500BB4143A052795EC7D2E61AC3261" - hash150 = "7891F00DCAB0E4A2F928422062E94213" - hash151 = "78A4FEE0E7B471F733F00C6E7BCA3D90" - hash152 = "78C309BE8437E7C1D2DD3F12D7C034C8" - hash153 = "79E5A1D9ADAD4D64C8F5BE2EB8345605" - hash154 = "7AF04A468DE09C519681DCB0BD77030B" - hash155 = "7BEE1D0709169E07DB6182E65DC50B60" - hash156 = "7F9692BA1A14C9C5EA97D6182F07051B" - hash157 = "7FE3E44991C645642119FCC683BD62DF" - hash158 = "80FA12D221ADBA53B8E7F9514960F945" - hash159 = "81F1D7BEC990A29A9552BD430006CED9" - hash160 = "82F926009C06DFA452714608DA21CB77" - hash161 = "8312E9BD38F9116214D32C5A829E9529" - hash162 = "83448FC10F297A6968AEDA7C02B09051" - hash163 = "839698D0419D06A511F421B065E04F5B" - hash164 = "841DFE3EAAFE68CC0B989FBF55A34C9C" - hash165 = "84E767032054E0C2FEF5764FB60679F4" - hash166 = "850A7E877D8E68188714FF5344F6FC15" - hash167 = "89C501BE309678BE8C30F81A328DAAF7" - hash168 = "89CDAE384C49F321A22DFB848CFA46ED" - hash169 = "8A21337BE17E1E921EEB4D1B9C1B4773" - hash170 = "8A93859E5F7079D6746832A3A22FF65C" - hash171 = "8AF979B96C28131F394E267C6210BA91" - hash172 = "8C9E843D62FF89F15C25517EFF02497B" - hash173 = "8D6B6E023B4221BAE8ED37BB18407516" - hash174 = "8ECE7DE82E1BDD4659A122C06EA9533E" - hash175 = "923C0E5DEC753E3B7EB6D8F441A7206F" - hash176 = "93A4328E1E347447044146B53972CD37" - hash177 = "94BDC9DED334ECEEDFA288FFDD03E30F" - hash178 = "95DA3987C6EBD2646E90B7C2A42C19A7" - hash179 = "994FDC67386BD33BF849DD97ADC04244" - hash180 = "99D33C40D22A14F90DD6CDB1D639163B" - hash181 = "9A014C33F9A9958FFBCF99D2A71D52FE" - hash182 = "9A8C76271210324D97A232974CA0A6A3" - hash183 = "9AF4C1E5BB81BF2DF607653FCC25915A" - hash184 = "9DA42D0BCE9F5DBF22D33DF77C561BDA" - hash185 = "9DF608F5BD1E6D2CAC11950CF8A75A80" - hash186 = "9ED1164F4F6A337CDE2BA6E7C72730CF" - hash187 = "9EE006601C5EE9F6F1992EC38FED63F6" - hash188 = "9EE1D2DF2ABE915B84980AF9675F4180" - hash189 = "9FB73E749107447FCCD5BB48627FD6A9" - hash190 = "A02610E760FA15C064931CFAFB90A9E8" - hash191 = "A07FEA56B45D0D1EBB6DF4589E750464" - hash192 = "A1942D1CC7552387393B91A14C9A3D73" - hash193 = "A1D0F8895052B60C4D2860556494F233" - hash194 = "A2768B46A48C72E6F183C99333C14FF6" - hash195 = "A32468828C12657497CDDF57190F5700" - hash196 = "A50C5BA8A92C7B199AC9E20A815D9E69" - hash197 = "A7517905E08EFD0ADD3A0C3C7BA95388" - hash198 = "A75BEA992CEF46C1A4EE5146150540AA" - hash199 = "A79F96647C4CA5527E56057D5173AB47" - hash200 = "AB57A44D58DAD47314048C8B3CCFF60B" - hash201 = "AC0FF4BAD83350B7DDE27AF8728A469F" - hash202 = "AC725400D9A5FE832DD40A1AFB2951F8" - hash203 = "AC86C256B30534D5EDE4A0DF1019507E" - hash204 = "AE3C3741C6FC6FE9BAFAE5FD352E58F7" - hash205 = "AED6EC002370818DDAB2CA164A6B4E18" - hash206 = "B0263050FDC7C6AE3836F43C7FFDD7B0" - hash207 = "B0649C1F7FB15796805CA983FD8F95A3" - hash208 = "B0F541CD6BFF77DE916E58D493F54B10" - hash209 = "B18A316B2CE6E099FE7FBF69283CBC5E" - hash210 = "B2DFE6D3BE38CEF08E9A3141CA3599C0" - hash211 = "B3139B26A2DABB9B6E728884D8FA8B33" - hash212 = "B332234F01EC229A03C0C60045F37072" - hash213 = "B34402586A077B7ED11B44D042C7AABF" - hash214 = "B42062A6947C8801F5A35C365F09BCA4" - hash215 = "B45318FE5C373CF4E252BAEA82FB0337" - hash216 = "B4BEA824C539785DEDB83C8599C90255" - hash217 = "B66816052C2A29CD5449D990341252AE" - hash218 = "B872AD1460AEB948D1E0AD71A92789D2" - hash219 = "B9456BEFF99AE2DC1A5321A10B0014EA" - hash220 = "BABD8CD2F24C809FEDEC1A5642B5FE46" - hash221 = "BD1AE82185D3EB0A8C8C615E710240AC" - hash222 = "BD64660692B84E2B6FCB25D02CECBBCB" - hash223 = "BDD054DE9E710830AC04B6F076FC5F71" - hash224 = "C0C8DCC9DAD39DA8278BF8956E30A3FC" - hash225 = "C1CB28327D3364768D1C1E4CE0D9BC07" - hash226 = "C1E5C46E4EF284F2922BB458C9BA3CE2" - hash227 = "C2A07CA21ECAD714821DF647ADA8ECAA" - hash228 = "C32C1CC761F92E60DD3D92F895ECD4DB" - hash229 = "C578B8DB3869D92482FC77EEEDF41EB0" - hash230 = "C7E6D3EE926BF5D430644C74B25854DE" - hash231 = "C7F6E98E4539BD127573CD5934256C91" - hash232 = "C870CE1CBC120F74059E5F1BB1F76040" - hash233 = "C93EEF1B06805A23E655C3856E7C7A17" - hash234 = "CA507B0DD178471E9CADF4CA313A67E3" - hash235 = "CA9644EF0F7ED355A842F6E2D4511546" - hash236 = "CDDFA154BBE89D4627210EBA087C3504" - hash238 = "D1ADC4F3A766B1BC55E3508C380C6D3D" - hash239 = "D1BAB4A30F2889AD392D17573302F097" - hash240 = "D316848CE47C098CCFE72AA7311AAFFA" - hash241 = "D32BE2F813971EC66C54697D78229653" - hash242 = "D3AE29E3719D5FD68D31BF3C4D9EAC30" - hash243 = "D4398F6F7BA070B6CDEE7204F6862BD9" - hash244 = "D4B7F99669A3EFC94006E5FE9D84EB65" - hash245 = "D508147FED6E41BFC31AD8151BC0BB13" - hash246 = "D537CE1BB88D7BD0D9D30F0554B91F51" - hash247 = "D67E2F5E6A0B046AE3BF5C61F1F384EC" - hash248 = "D69598758998CF5F677BE9312B807938" - hash249 = "D6ADC86BC53E1730A077AF49D9CA27D1" - hash250 = "D7DC970923CC80BE272AAF6BD1A59FE7" - hash251 = "D81B91CD4C6F42EB7049109CB42461ED" - hash252 = "D84851AD131424F04FBFFC3BBAC03BFF" - hash253 = "D9A958D55D457D745998EE70CF025CB9" - hash254 = "D9F87E744DBC898212A9EAA4594301B0" - hash256 = "DB212129BE94FE77362751C557D0E893" - hash257 = "DBB867C2250B5BE4E67D1977FCF721FB" - hash258 = "DC6FFD15D88F15F129F6F00F4FB82A0A" - hash259 = "DE32915056D480B8B722E0A93164DBFE" - hash260 = "DF5BD411F080B55C578AEB9001A4287D" - hash261 = "E03E6807DF25C111F79EAC86907668B9" - hash262 = "E0593F81FDF39EEFD17427ADAC3825E2" - hash263 = "E0AB70FF814592A18864EB05A516A711" - hash264 = "E1663B6462115BA929B05BB75A61ED5F" - hash265 = "E1FBF8D74B622FDE3CF765A3A51CA39F" - hash266 = "E2B61ACF0DB4D64D9FB325922C014969" - hash267 = "E61C043005C16028DD55C04B14041F5E" - hash268 = "E68AC9E407477B29073EBE4A15E1F520" - hash269 = "E696B38AC71B23F50EE68DA06A004AF3" - hash270 = "E6B7DF4E923E701F1F8464C768ECA166" - hash271 = "E6C596CFA163FE9B8883C7618D594018" - hash272 = "E75FE20DD51D32772D5211924D4F8564" - hash273 = "E84B87DB6AE7C34FC7E6BC2F0BEF4AE4" - hash274 = "E85005524E8E6A8612C9D0899BB952D6" - hash275 = "E86531B216DC3F7D92DA5D6C03871B45" - hash276 = "E8F3790CFAC1B104965DEAD841DC20B2" - hash277 = "E96C994B21490EA5C8C7D78FECFEAC87" - hash278 = "E975D5B29D988929E5AD3A8FA19083D1" - hash279 = "ECA515F4D356627969A630434F29CA4B" - hash280 = "EDFA6607207DDBCA961AE7B78405F761" - hash281 = "EF9C0EA7AD447D0841E083534249089E" - hash282 = "EF9D8CD06DE03BD5F07B01C1CCE9761F" - hash283 = "F01A9A2D1E31332ED36C1A4D2839F412" - hash284 = "F03F70D331C6564AEC8931F481949188" - hash285 = "F0BE554B1D9B394BC2A90322CA944FCE" - hash286 = "F0D6B45E96CDBBBEC6403DDB2CA98654" - hash287 = "F310584EB1538CB78CA8C225038B2E54" - hash288 = "F41023D4B0FE091EAEB778C621AC38D7" - hash289 = "F5744D72C6919F994FF452B0E758FFEE" - hash290 = "F586EDD88023F49BC4F9D84F9FB6BD7D" - hash291 = "F68008057FF5DBC67C938B3F5F68A54D" - hash292 = "F6A79B54C6351C32FE35CDA9A78B607F" - hash293 = "F6CAA0160A6F0E5264FD16FA5AE95696" - hash294 = "F847D99EEDFE57949DD598A693A2D35F" - hash295 = "F86C912661DBDA535CBAB464E79E26BE" - hash296 = "FAACABEA42AFBC6CD5CE684E1BBFB073" - hash297 = "FAF9576CE2AF23AAC67D3087EB85A92B" - hash298 = "FB0C714CD2EBDCC6F33817ABE7813C36" - hash299 = "FC26AD639598A92546AF2DAA6F6A7AFD" - hash300 = "FC7487A7F35A510246280589F228ECFC" -strings: - /* C2 Servers */ - $c2_1 = "002562066559681.r3u8.com" ascii - $c2_2 = "031168053846049.r3u8.com" ascii - $c2_3 = "0625.have8000.com" ascii - $c2_4 = "1.gadskysun.com" ascii - $c2_5 = "100fanwen.com" ascii - $c2_6 = "11.usyahooapis.com" ascii - $c2_7 = "19518473326.r3u8.com" ascii - $c2_8 = "1960445709311199.r3u8.com" ascii - $c2_9 = "1j.www1.biz" ascii - $c2_10 = "1z.itsaol.com" ascii - $c2_11 = "2012yearleft.com" ascii - $c2_12 = "2014.zzux.com" ascii - $c2_13 = "202017845.r3u8.com" ascii - $c2_14 = "2139465544784.r3u8.com" ascii - $c2_15 = "2789203959848958.r3u8.com" ascii - $c2_16 = "5590428449750026.r3u8.com" ascii - $c2_17 = "5q.niushenghuo.info" ascii - $c2_18 = "6r.suibian2010.info" ascii - $c2_19 = "9gowg.tech" ascii - $c2_20 = "Hamiltion.catholicmmb.com" ascii - $c2_21 = "a.wubangtu.info" ascii - $c2_22 = "a1.suibian2010.info" ascii - $c2_24 = "abc.wikaba.com" ascii - $c2_25 = "abcd120719.6600.org" ascii - $c2_26 = "abcd120807.3322.org" ascii - $c2_27 = "acc.emailfound.info" ascii - $c2_28 = "acc.lehigtapp.com" ascii - $c2_29 = "acsocietyy.com" ascii - $c2_30 = "ad.getfond.info" ascii - $c2_31 = "ad.webbooting.com" ascii - $c2_32 = "additional.sexidude.com" ascii - $c2_33 = "af.zyns.com" ascii - $c2_34 = "afc.https443.org" ascii - $c2_35 = "ako.ddns.us" ascii - $c2_36 = "androidmusicapp.onmypc.us" ascii - $c2_37 = "announcements.toythieves.com" ascii - $c2_38 = "anvprn.com" ascii - $c2_39 = "aotuo.9966.org" ascii - $c2_40 = "apec.qtsofta.com" ascii - $c2_41 = "app.lehigtapp.com" ascii - $c2_42 = "apple.cmdnetview.com" ascii - $c2_43 = "apple.defensewar.org" ascii - $c2_44 = "apple.ikwb.com" ascii - $c2_45 = "appledownload.ourhobby.com" ascii - $c2_46 = "appleimages.itemdb.com" ascii - $c2_47 = "appleimages.longmusic.com" ascii - $c2_48 = "applelib120102.9966.org" ascii - $c2_49 = "applemirror.organiccrap.com" ascii - $c2_50 = "applemirror.squirly.info" ascii - $c2_51 = "applemusic.isasecret.com" ascii - $c2_52 = "applemusic.itemdb.com" ascii - $c2_53 = "applemusic.wikaba.com" ascii - $c2_54 = "applemusic.xxuz.com" ascii - $c2_55 = "applemusic.zzux.com" ascii - $c2_56 = "apples.sytes.net" ascii - $c2_57 = "appleupdate.itemdb.com" ascii - $c2_58 = "architectisusa.com" ascii - $c2_59 = "area.wthelpdesk.com" ascii - $c2_60 = "army.xxuz.com" ascii - $c2_61 = "art.p6p6.net" ascii - $c2_62 = "asfzx.x24hr.com" ascii - $c2_64 = "availab.wikaba.com" ascii - $c2_65 = "availability.justdied.com" ascii - $c2_66 = "ba.my03.com" ascii - $c2_67 = "baby.macforlinux.net" ascii - $c2_68 = "baby.myie12.com" ascii - $c2_69 = "baby.usmirocomney.net" ascii - $c2_70 = "back.jungleheart.com" ascii - $c2_71 = "back.mofa.dynamic-dns.net" ascii - $c2_72 = "bak.have8000.com" ascii - $c2_73 = "bak.ignorelist.com" ascii - $c2_74 = "bak.un.dnsrd.com" ascii - $c2_75 = "balance1.wikaba.com" ascii - $c2_76 = "balk.n7go.com" ascii - $c2_77 = "banana.cmdnetview.com" ascii - $c2_78 = "barrybaker.6600.org" ascii - $c2_79 = "bbs.jungleheart.com" ascii - $c2_80 = "bdoncloud.com" ascii - $c2_81 = "be.mrslove.com" ascii - $c2_82 = "be.yourtrap.com" ascii - $c2_83 = "belowto.com" ascii - $c2_84 = "bethel.webhop.net" ascii - $c2_85 = "bexm.cleansite.biz" ascii - $c2_86 = "bezu.itemdb.com" ascii - $c2_87 = "bk56.twilightparadox.com" ascii - $c2_88 = "blaaaaaaaaaaaa.windowsupdate.3-a.net" ascii - $c2_89 = "blog.defensewar.org" ascii - $c2_90 = "brand.fartit.com" ascii - $c2_91 = "bridgeluxlightmadness.com" ascii - $c2_92 = "bulletproof.squirly.info" ascii - $c2_93 = "cao.p6p6.net" ascii - $c2_94 = "cata.qtsofta.com" ascii - $c2_95 = "catholicmmb.com" ascii - $c2_96 = "cc.dynamicdns.co.uk" ascii - $c2_97 = "ccfchrist.com" ascii - $c2_98 = "ccupdatedata.authorizeddns.net" ascii - $c2_99 = "cd.usyahooapis.com" ascii - $c2_100 = "cdn.incloud-go.com" ascii - $c2_101 = "center.shenajou.com" ascii - $c2_102 = "cgei493860.r3u8.com" ascii - $c2_103 = "chaindungeons.com" ascii - $c2_104 = "chibashiri.com" ascii - $c2_105 = "childrenstow.com" ascii - $c2_106 = "cia.ezua.com" ascii - $c2_107 = "cia.toh.info" ascii - $c2_108 = "ciaoci.chickenkiller.com" ascii - $c2_109 = "civilwar123.authorizeddns.org" ascii - $c2_110 = "civilwar520.onmypc.org" ascii - $c2_111 = "ckusshani.com" ascii - $c2_112 = "cloud-kingl.com" ascii - $c2_113 = "cloud-maste.com" ascii - $c2_114 = "cloudns.8800.org" ascii - $c2_115 = "cmdnetview.com" ascii - $c2_116 = "cms.sindeali.com" ascii - $c2_117 = "cnnews.mylftv.com" ascii - $c2_118 = "commissioner.shenajou.com" ascii - $c2_119 = "commons.onedumb.com" ascii - $c2_120 = "contactus.myddns.com" ascii - $c2_121 = "contactus.onmypc.us" ascii - $c2_122 = "contract.4mydomain.com" ascii - $c2_123 = "contractus.qpoe.com" ascii - $c2_124 = "contractus.zzux.com" ascii - $c2_125 = "coreck.suayay.com" ascii - $c2_128 = "ctdl.windowsupdate.itsaol.com" ascii - $c2_129 = "ctdl.windowsupdate.nsatcdns.com" ascii - $c2_130 = "ctldl.appledownload.ourhobby.com" ascii - $c2_131 = "ctldl.applemusic.itemdb.com" ascii - $c2_132 = "ctldl.itunesmusic.jkub.com" ascii - $c2_133 = "ctldl.microsoftmusic.onedumb.com" ascii - $c2_134 = "ctldl.microsoftupdate.qhigh.com" ascii - $c2_135 = "ctldl.windowsupdate.authorizeddns.org" ascii - $c2_136 = "ctldl.windowsupdate.authorizeddns.us" ascii - $c2_137 = "ctldl.windowsupdate.dnset.com" ascii - $c2_138 = "ctldl.windowsupdate.esmtp.biz" ascii - $c2_139 = "ctldl.windowsupdate.ezua.com" ascii - $c2_140 = "ctldl.windowsupdate.gettrials.com" ascii - $c2_141 = "ctldl.windowsupdate.itsaol.com" ascii - $c2_142 = "ctldl.windowsupdate.lflinkup.com" ascii - $c2_143 = "ctldl.windowsupdate.mrface.com" ascii - $c2_144 = "ctldl.windowsupdate.nsatcdns.com" ascii - $c2_145 = "ctldl.windowsupdate.organiccrap.com" ascii - $c2_146 = "ctldl.windowsupdate.x24hr.com" ascii - $c2_147 = "cvnx.zyns.com" ascii - $c2_148 = "cwiinatonal.com" ascii - $c2_149 = "daddy.gostudyantivirus.com" ascii - $c2_150 = "dcc.jimingroup.com" ascii - $c2_151 = "dd.ddns.us" ascii - $c2_152 = "de.onmypc.info" ascii - $c2_153 = "dear.loveddos.com" ascii - $c2_154 = "dec.seyesb.acmetoy.com" ascii - $c2_155 = "dedgesuite.net" ascii - $c2_156 = "dedydns.ns01.us" ascii - $c2_157 = "defensewar.org" ascii - $c2_158 = "demoones.com" ascii - $c2_159 = "department.shenajou.com" ascii - $c2_160 = "details.squirly.info" ascii - $c2_161 = "development.shenajou.com" ascii - $c2_162 = "devilcase.acmetoy.com" ascii - $c2_163 = "dfgwerzc.3322.org" ascii - $c2_164 = "dick.ccfchrist.com" ascii - $c2_165 = "digsby.ourhobby.com" ascii - $c2_166 = "disruptive.https443.net" ascii - $c2_167 = "dlmix.ourdvs.com" ascii - $c2_168 = "dnspoddwg.authorizeddns.org" ascii - $c2_170 = "document.methoder.com" ascii - $c2_171 = "document.shenajou.com" ascii - $c2_172 = "domainnow.yourtrap.com" ascii - $c2_173 = "download.applemusic.itemdb.com" ascii - $c2_174 = "download.microsoftmusic.onedumb.com" ascii - $c2_175 = "download.windowsupdate.authorizeddns.org" ascii - $c2_176 = "download.windowsupdate.dedgesuite.net" ascii - $c2_177 = "download.windowsupdate.dnset.com" ascii - $c2_178 = "download.windowsupdate.itsaol.com" ascii - $c2_179 = "download.windowsupdate.lflinkup.com" ascii - $c2_180 = "download.windowsupdate.nsatcdns.com" ascii - $c2_181 = "download.windowsupdate.x24hr.com" ascii - $c2_182 = "downloadlink.mypicture.info" ascii - $c2_183 = "drives.methoder.com" ascii - $c2_184 = "dst.1dumb.com" ascii - $c2_185 = "duosay.com" ascii - $c2_186 = "dyncojinf.6600.org" ascii - $c2_187 = "dynsbluecheck.7766.org" ascii - $c2_188 = "ea.onmypc.info" ascii - $c2_189 = "ea.rebatesrule.net" ascii - $c2_190 = "edgar.ccfchrist.com" ascii - $c2_191 = "ehshiroshima.mylftv.com" ascii - $c2_192 = "emailfound.info" ascii - $c2_193 = "eric-averyanov.wha.la" ascii - $c2_194 = "essashi.com" ascii - $c2_195 = "eu.acmetoy.com" ascii - $c2_196 = "eu.wha.la" ascii - $c2_197 = "eu.zzux.com" ascii - $c2_198 = "everydayfilmlink.com" ascii - $c2_199 = "ewe.toshste.com" ascii - $c2_200 = "eweek.2waky.com" ascii - $c2_201 = "exprenum.com" ascii - $c2_202 = "express.lflinkup.com" ascii - $c2_203 = "extraordinary.dynamic-dns.net" ascii - $c2_204 = "f068v.site" ascii - $c2_205 = "fabian.ccfchrist.com" ascii - $c2_206 = "fastemail.dnsrd.com" ascii - $c2_207 = "fastmail2.com" ascii - $c2_208 = "fbi.sexxxy.biz" ascii - $c2_209 = "fbi.zyns.com" ascii - $c2_210 = "fcztqbg.zj.r3u8.com" ascii - $c2_211 = "feed.jungleheart.com" ascii - $c2_212 = "fftpoor.com" ascii - $c2_213 = "fg.v4.download.windowsupdates.dnsrd.com" ascii - $c2_214 = "fgipv6.download.windowsupdate.com.mwcname.com" ascii - $c2_215 = "file.zzux.com" ascii - $c2_216 = "files.architectisusa.com" ascii - $c2_217 = "film.everydayfilmlink.com" ascii - $c2_218 = "filmlist.everydayfilmlink.com" ascii - $c2_219 = "findme.epac.to" ascii - $c2_220 = "fire.mrface.com" ascii - $c2_221 = "fish.toh.info" ascii - $c2_222 = "fiveavmersi.websegoo.net" ascii - $c2_223 = "fjs.wikaba.com" ascii - $c2_224 = "flea.poulsenv.com" ascii - $c2_225 = "flynews.edns.biz" ascii - $c2_226 = "fo.mysecondarydns.com" ascii - $c2_227 = "foal.wchildress.com" ascii - $c2_228 = "follow.wha.la" ascii - $c2_229 = "foo.shenajou.com" ascii - $c2_230 = "for.ddns.mobi" ascii - $c2_231 = "fr.wikaba.com" ascii - $c2_232 = "franck.demoones.com" ascii - $c2_233 = "ftp.2014.zzux.com" ascii - $c2_234 = "ftp.additional.sexidude.com" ascii - $c2_235 = "ftp.afc.https443.org" ascii - $c2_236 = "ftp.announcements.toythieves.com" ascii - $c2_237 = "ftp.apple.ikwb.com" ascii - $c2_238 = "ftp.appledownload.ourhobby.com" ascii - $c2_239 = "ftp.appleimages.itemdb.com" ascii - $c2_240 = "ftp.appleimages.longmusic.com" ascii - $c2_241 = "ftp.appleimages.organiccrap.com" ascii - $c2_242 = "ftp.applemirror.organiccrap.com" ascii - $c2_243 = "ftp.applemirror.squirly.info" ascii - $c2_244 = "ftp.applemusic.isasecret.com" ascii - $c2_245 = "ftp.applemusic.itemdb.com" ascii - $c2_246 = "ftp.applemusic.wikaba.com" ascii - $c2_247 = "ftp.applemusic.xxuz.com" ascii - $c2_248 = "ftp.applemusic.zzux.com" ascii - $c2_249 = "ftp.appleupdate.itemdb.com" ascii - $c2_250 = "ftp.architectisusa.com" ascii - $c2_251 = "ftp.asfzx.x24hr.com" ascii - $c2_252 = "ftp.availab.wikaba.com" ascii - $c2_253 = "ftp.availability.justdied.com" ascii - $c2_254 = "ftp.back.jungleheart.com" ascii - $c2_255 = "ftp.balance1.wikaba.com" ascii - $c2_256 = "ftp.be.mrslove.com" ascii - $c2_257 = "ftp.brand.fartit.com" ascii - $c2_258 = "ftp.bulletproof.squirly.info" ascii - $c2_259 = "ftp.cia.ezua.com" ascii - $c2_260 = "ftp.cia.toh.info" ascii - $c2_261 = "ftp.civilwar123.authorizeddns.org" ascii - $c2_262 = "ftp.civilwar520.onmypc.org" ascii - $c2_263 = "ftp.cloudfileserverbs.dynamicdns.co.uk" ascii - $c2_264 = "ftp.cnnews.mylftv.com" ascii - $c2_265 = "ftp.commons.onedumb.com" ascii - $c2_266 = "ftp.contractus.qpoe.com" ascii - $c2_267 = "ftp.cvnx.zyns.com" ascii - $c2_268 = "ftp.de.onmypc.info" ascii - $c2_269 = "ftp.details.squirly.info" ascii - $c2_270 = "ftp.devilcase.acmetoy.com" ascii - $c2_271 = "ftp.disruptive.https443.net" ascii - $c2_272 = "ftp.domainnow.yourtrap.com" ascii - $c2_273 = "ftp.ea.onmypc.info" ascii - $c2_274 = "ftp.ehshiroshima.mylftv.com" ascii - $c2_275 = "ftp.eric-averyanov.wha.la" ascii - $c2_276 = "ftp.eu.acmetoy.com" ascii - $c2_277 = "ftp.eu.wha.la" ascii - $c2_278 = "ftp.eu.zzux.com" ascii - $c2_279 = "ftp.fbi.sexxxy.biz" ascii - $c2_280 = "ftp.file.zzux.com" ascii - $c2_281 = "ftp.findme.epac.to" ascii - $c2_282 = "ftp.fire.mrface.com" ascii - $c2_283 = "ftp.fjs.wikaba.com" ascii - $c2_284 = "ftp.fr.wikaba.com" ascii - $c2_285 = "ftp.fuck.ikwb.com" ascii - $c2_286 = "ftp.fuckmm.dns-dns.com" ascii - $c2_287 = "ftp.generat.almostmy.com" ascii - $c2_288 = "ftp.goldtoyota.com" ascii - $c2_289 = "ftp.goodmusic.justdied.com" ascii - $c2_290 = "ftp.helpus.ddns.info" ascii - $c2_291 = "ftp.hii.qhigh.com" ascii - $c2_292 = "ftp.innocent-isayev.sexidude.com" ascii - $c2_293 = "ftp.invoices.sexxxy.biz" ascii - $c2_294 = "ftp.iphone.vizvaz.com" ascii - $c2_295 = "ftp.itlans.isasecret.com" ascii - $c2_296 = "ftp.itunesdownload.jkub.com" ascii - $c2_297 = "ftp.itunesdownload.wikaba.com" ascii - $c2_298 = "ftp.itunesimages.itemdb.com" ascii - $c2_299 = "ftp.itunesimages.itsaol.com" ascii - $c2_300 = "ftp.itunesimages.qpoe.com" ascii - $c2_301 = "ftp.itunesmirror.fartit.com" ascii - $c2_302 = "ftp.itunesmirror.itsaol.com" ascii - $c2_303 = "ftp.itunesmusic.ikwb.com" ascii - $c2_304 = "ftp.itunesmusic.jetos.com" ascii - $c2_305 = "ftp.itunesmusic.jkub.com" ascii - $c2_306 = "ftp.itunesmusic.zzux.com" ascii - $c2_307 = "ftp.itunesupdate.itsaol.com" ascii - $c2_308 = "ftp.itunesupdates.organiccrap.com" ascii - $c2_309 = "ftp.japanfilmsite.ikwb.com" ascii - $c2_310 = "ftp.jimin.mymom.info" ascii - $c2_311 = "ftp.jp.serveuser.com" ascii - $c2_312 = "ftp.key.zzux.com" ascii - $c2_313 = "ftp.knowledge.sellclassics.com" ascii - $c2_314 = "ftp.lan.dynssl.com" ascii - $c2_315 = "ftp.latestnews.epac.to" ascii - $c2_316 = "ftp.latestnews.organiccrap.com" ascii - $c2_317 = "ftp.leedong.longmusic.com" ascii - $c2_318 = "ftp.macfee.mrface.com" ascii - $c2_319 = "ftp.maffc.mrface.com" ascii - $c2_320 = "ftp.malware.dsmtp.com" ascii - $c2_321 = "ftp.manager.jetos.com" ascii - $c2_322 = "ftp.martin.sellclassics.com" ascii - $c2_323 = "ftp.mason.vizvaz.com" ascii - $c2_324 = "ftp.mediapath.organiccrap.com" ascii - $c2_325 = "ftp.microsoft.got-game.org" ascii - $c2_326 = "ftp.microsoft.mrface.com" ascii - $c2_327 = "ftp.microsoftimages.organiccrap.com" ascii - $c2_328 = "ftp.microsoftmusic.mrbasic.com" ascii - $c2_329 = "ftp.microsoftqckmanager.pcanywhere.net" ascii - $c2_330 = "ftp.microsoftupdate.mrbasic.com" ascii - $c2_331 = "ftp.microsoftupdate.qhigh.com" ascii - $c2_332 = "ftp.micrsoftware.dsmtp.com" ascii - $c2_333 = "ftp.mircsoft.compress.to" ascii - $c2_334 = "ftp.mmy.ddns.us" ascii - $c2_335 = "ftp.mod.jetos.com" ascii - $c2_336 = "ftp.mofa.dynamic-dns.net" ascii - $c2_337 = "ftp.mofa.ns01.info" ascii - $c2_338 = "ftp.moscowdic.trickip.org" ascii - $c2_339 = "ftp.msg.ezua.com" ascii - $c2_340 = "ftp.musicfile.ikwb.com" ascii - $c2_341 = "ftp.musicjj.zzux.com" ascii - $c2_342 = "ftp.mymusicbox.vizvaz.com" ascii - $c2_343 = "ftp.myphpwebsite.itsaol.com" ascii - $c2_344 = "ftp.myrestroomimage.isasecret.com" ascii - $c2_345 = "ftp.na.americanunfinished.com" ascii - $c2_346 = "ftp.na.onmypc.org" ascii - $c2_347 = "ftp.newsdata.jkub.com" ascii - $c2_348 = "ftp.newsroom.cleansite.info" ascii - $c2_349 = "ftp.no.authorizeddns.org" ascii - $c2_350 = "ftp.nsa.mefound.com" ascii - $c2_351 = "ftp.nt.mynumber.org" ascii - $c2_352 = "ftp.nttdata.otzo.com" ascii - $c2_353 = "ftp.nz.compress.to" ascii - $c2_354 = "ftp.ol.almostmy.com" ascii - $c2_355 = "ftp.oracleupdate.dns04.com" ascii - $c2_356 = "ftp.portal.mrface.com" ascii - $c2_357 = "ftp.portal.sendsmtp.com" ascii - $c2_358 = "ftp.portalser.dynamic-dns.net" ascii - $c2_359 = "ftp.praskovya-matveyeva.mefound.com" ascii - $c2_360 = "ftp.praskovya-ulyanova.dumb1.com" ascii - $c2_361 = "ftp.products.almostmy.com" ascii - $c2_362 = "ftp.products.cleansite.us" ascii - $c2_363 = "ftp.products.serveuser.com" ascii - $c2_364 = "ftp.purchase.lflinkup.org" ascii - $c2_365 = "ftp.recent.dns-stuff.com" ascii - $c2_366 = "ftp.recent.fartit.com" ascii - $c2_367 = "ftp.referred.gr8domain.biz" ascii - $c2_368 = "ftp.referred.yourtrap.com" ascii - $c2_369 = "ftp.register.ourhobby.com" ascii - $c2_370 = "ftp.registration2.instanthq.com" ascii - $c2_371 = "ftp.registrations.4pu.com" ascii - $c2_372 = "ftp.registrations.organiccrap.com" ascii - $c2_373 = "ftp.remeberdata.iownyour.org" ascii - $c2_374 = "ftp.reserveds.onedumb.com" ascii - $c2_375 = "ftp.rethem.almostmy.com" ascii - $c2_376 = "ftp.sdmsg.onmypc.org" ascii - $c2_377 = "ftp.se.toythieves.com" ascii - $c2_378 = "ftp.secertnews.mrbasic.com" ascii - $c2_379 = "ftp.senseye.ikwb.com" ascii - $c2_380 = "ftp.senseye.mrbonus.com" ascii - $c2_381 = "ftp.septdlluckysystem.jungleheart.com" ascii - $c2_382 = "ftp.seraphim-yurieva.justdied.com" ascii - $c2_383 = "ftp.serv.justdied.com" ascii - $c2_384 = "ftp.server1.proxydns.com" ascii - $c2_385 = "ftp.seyesb.acmetoy.com" ascii - $c2_386 = "ftp.shugiin.jkub.com" ascii - $c2_387 = "ftp.singed.otzo.com" ascii - $c2_388 = "ftp.sstday.jkub.com" ascii - $c2_389 = "ftp.support1.mrface.com" ascii - $c2_390 = "ftp.supportus.mefound.com" ascii - $c2_391 = "ftp.svc.dynssl.com" ascii - $c2_392 = "ftp.synssl.dnset.com" ascii - $c2_393 = "ftp.tamraj.fartit.com" ascii - $c2_394 = "ftp.tfa.longmusic.com" ascii - $c2_395 = "ftp.thunder.wikaba.com" ascii - $c2_396 = "ftp.ticket.instanthq.com" ascii - $c2_397 = "ftp.ticket.serveuser.com" ascii - $c2_398 = "ftp.tokyofile.2waky.com" ascii - $c2_399 = "ftp.tophost.dynamicdns.co.uk" ascii - $c2_400 = "ftp.transfer.lflinkup.org" ascii - $c2_401 = "ftp.transfer.mrbasic.com" ascii - $c2_402 = "ftp.transfer.vizvaz.com" ascii - $c2_403 = "ftp.ugreen.itemdb.com" ascii - $c2_404 = "ftp.uk.dynamicdns.org.uk" ascii - $c2_405 = "ftp.un.ddns.info" ascii - $c2_406 = "ftp.un.dnsrd.com" ascii - $c2_407 = "ftp.usa.itsaol.com" ascii - $c2_408 = "ftp.well.itsaol.com" ascii - $c2_409 = "ftp.well.mrbasic.com" ascii - $c2_410 = "ftp.wike.wikaba.com" ascii - $c2_411 = "ftp.windowfile.itemdb.com" ascii - $c2_412 = "ftp.windowsimages.itemdb.com" ascii - $c2_413 = "ftp.windowsimages.qhigh.com" ascii - $c2_414 = "ftp.windowsmirrors.vizvaz.com" ascii - $c2_415 = "ftp.windowsupdate.2waky.com" ascii - $c2_416 = "ftp.windowsupdate.3-a.net" ascii - $c2_417 = "ftp.windowsupdate.authorizeddns.us" ascii - $c2_418 = "ftp.windowsupdate.dns05.com" ascii - $c2_419 = "ftp.windowsupdate.esmtp.biz" ascii - $c2_420 = "ftp.windowsupdate.ezua.com" ascii - $c2_421 = "ftp.windowsupdate.fartit.com" ascii - $c2_422 = "ftp.windowsupdate.gettrials.com" ascii - $c2_423 = "ftp.windowsupdate.instanthq.com" ascii - $c2_424 = "ftp.windowsupdate.jungleheart.com" ascii - $c2_425 = "ftp.windowsupdate.lflink.com" ascii - $c2_426 = "ftp.windowsupdate.mrface.com" ascii - $c2_427 = "ftp.windowsupdate.mylftv.com" ascii - $c2_428 = "ftp.windowsupdate.rebatesrule.net" ascii - $c2_429 = "ftp.windowsupdate.sellclassics.com" ascii - $c2_430 = "ftp.windowsupdate.serveusers.com" ascii - $c2_431 = "ftp.yandexr.sellclassics.com" ascii - $c2_432 = "fu.epac.to" ascii - $c2_433 = "fuck.ikwb.com" ascii - $c2_434 = "fuckanti.com" ascii - $c2_435 = "fuckdd.8800.org" ascii - $c2_436 = "fuckmm.8800.org" ascii - $c2_437 = "fuckmm.dns-dns.com" ascii - $c2_438 = "fukuoka.cloud-maste.com" ascii - $c2_439 = "g3ypf.online" ascii - $c2_440 = "gadskysun.com" ascii - $c2_441 = "gavin.ccfchrist.com" ascii - $c2_442 = "generat.almostmy.com" ascii - $c2_443 = "generousd.hopto.org" ascii - $c2_444 = "gensuzuki.6600.org" ascii - $c2_445 = "getfond.info" ascii - $c2_446 = "gh.mysecondarydns.com" ascii - $c2_447 = "gifuonlineshopping.mynumber.org" ascii - $c2_448 = "glicense.shenajou.com" ascii - $c2_449 = "globalnews.wikaba.com" ascii - $c2_450 = "gmail.com.mailsserver.com" ascii - $c2_451 = "gmpcw.com" ascii - $c2_452 = "gold.polopurple.com" ascii - $c2_453 = "goldtoyota.com" ascii - $c2_454 = "goodmusic.justdied.com" ascii - $c2_455 = "goodsampjp.com" ascii - $c2_456 = "gooesdataios.instanthq.com" ascii - $c2_457 = "google.macforlinux.net" ascii - $c2_458 = "google.usrobothome.com" ascii - $c2_459 = "googlemeail.com" ascii - $c2_460 = "gostudyantivirus.com" ascii - $c2_461 = "gostudymbaa.com" ascii - $c2_462 = "gotourisma.com" ascii - $c2_463 = "gt4study.com" ascii - $c2_464 = "gtsofta.com" ascii - $c2_465 = "haoyujd.info" ascii - $c2_466 = "happy.workerisgood.com" ascii - $c2_467 = "have8000.com" ascii - $c2_468 = "helpus.ddns.info" ascii - $c2_469 = "helshellfucde.8866.org" ascii - $c2_470 = "hg8fmv.racing" ascii - $c2_471 = "hii.qhigh.com" ascii - $c2_472 = "hk.2012yearleft.com" ascii - $c2_473 = "hk.cmdnetview.com" ascii - $c2_474 = "hk.have8000.com" ascii - $c2_475 = "hk.loveddos.com" ascii - $c2_476 = "home.trickip.org" ascii - $c2_477 = "hostport9.net" ascii - $c2_478 = "hotmai.info" ascii - $c2_479 = "hotmail.com.mailsserver.com" ascii - $c2_480 = "hukuoka.cloud-maste.com" ascii - $c2_481 = "iamges.itunesmusic.jkub.com" ascii - $c2_482 = "ibmmsg.strangled.net" ascii - $c2_483 = "icfeds.cf" ascii - $c2_484 = "idpmus.hostport9.net" ascii - $c2_486 = "im.suibian2010.info" ascii - $c2_487 = "image.websago.info" ascii - $c2_488 = "images.itunesmusic.jkub.com" ascii - $c2_489 = "images.thedomais.info" ascii - $c2_490 = "images.tyoto-go-jp.com" ascii - $c2_491 = "images.windowsupdate.organiccrap.com" ascii - $c2_492 = "imap.architectisusa.com" ascii - $c2_493 = "imap.dnset.com" ascii - $c2_494 = "imap.lflink.com" ascii - $c2_495 = "imap.onmypc.net" ascii - $c2_496 = "imap.ygto.com" ascii - $c2_497 = "img.station155.com" ascii - $c2_498 = "improvejpese.com" ascii - $c2_499 = "incloud-go.com" ascii - $c2_500 = "incloud-obert.com" ascii - $c2_501 = "ingemar.catholicmmb.com" ascii - $c2_502 = "innocent-isayev.sexidude.com" ascii - $c2_503 = "innov-tec.com.ua" ascii - $c2_504 = "inspgon.re26.com" ascii - $c2_505 = "interpreter.shenajou.com" ascii - $c2_506 = "invoices.sexxxy.biz" ascii - $c2_508 = "iphone.vizvaz.com" ascii - $c2_509 = "ipv4.applemusic.itemdb.com" ascii - $c2_510 = "ipv4.itunesmusic.jkub.com" ascii - $c2_511 = "ipv4.japanenvnews.qpoe.com" ascii - $c2_512 = "ipv4.microsoftmusic.onedumb.com" ascii - $c2_513 = "ipv4.microsoftupdate.mrbasic.com" ascii - $c2_514 = "ipv4.microsoftupdate.qhigh.com" ascii - $c2_515 = "ipv4.windowsupdate.3-a.net" ascii - $c2_516 = "ipv4.windowsupdate.authorizeddns.org" ascii - $c2_517 = "ipv4.windowsupdate.authorizeddns.us" ascii - $c2_518 = "ipv4.windowsupdate.dnset.com" ascii - $c2_519 = "ipv4.windowsupdate.esmtp.biz" ascii - $c2_520 = "ipv4.windowsupdate.ezua.com" ascii - $c2_521 = "ipv4.windowsupdate.fartit.com" ascii - $c2_522 = "ipv4.windowsupdate.gettrials.com" ascii - $c2_523 = "ipv4.windowsupdate.itsaol.com" ascii - $c2_524 = "ipv4.windowsupdate.lflink.com" ascii - $c2_525 = "ipv4.windowsupdate.lflinkup.com" ascii - $c2_526 = "ipv4.windowsupdate.mrface.com" ascii - $c2_527 = "ipv4.windowsupdate.mylftv.com" ascii - $c2_528 = "ipv4.windowsupdate.nsatcdns.com" ascii - $c2_529 = "ipv4.windowsupdate.x24hr.com" ascii - $c2_530 = "ipv6microsoft.dlmix.ourdvs.com" ascii - $c2_531 = "itlans.isasecret.com" ascii - $c2_532 = "itunesdownload.jkub.com" ascii - $c2_533 = "itunesdownload.vizvaz.com" ascii - $c2_534 = "itunesdownload.wikaba.com" ascii - $c2_535 = "itunesimages.itemdb.com" ascii - $c2_536 = "itunesimages.itsaol.com" ascii - $c2_537 = "itunesimages.qpoe.com" ascii - $c2_538 = "itunesmirror.fartit.com" ascii - $c2_539 = "itunesmirror.itsaol.com" ascii - $c2_540 = "itunesmusic.ikwb.com" ascii - $c2_541 = "itunesmusic.jetos.com" ascii - $c2_542 = "itunesmusic.jkub.com" ascii - $c2_543 = "itunesmusic.zzux.com" ascii - $c2_544 = "itunesupdate.itsaol.com" ascii - $c2_545 = "itunesupdates.organiccrap.com" ascii - $c2_546 = "iw.mrslove.com" ascii - $c2_547 = "ixrayeye.com" ascii - $c2_548 = "james.tffghelth.com" ascii - $c2_549 = "janpan.bigmoney.biz" ascii - $c2_550 = "janpun.americanunfinished.com" ascii - $c2_551 = "jap.japanmusicinfo.com" ascii - $c2_552 = "japan.fuckanti.com" ascii - $c2_553 = "japan.linuxforover.com" ascii - $c2_554 = "japan.loveddos.com" ascii - $c2_555 = "japanenvnews.qpoe.com" ascii - $c2_556 = "japanfilmsite.ikwb.com" ascii - $c2_557 = "japanfst.japanteam.org" ascii - $c2_558 = "japanmusicinfo.com" ascii - $c2_559 = "japanteam.org" ascii - $c2_560 = "jcie.mofa.ns01.info" ascii - $c2_561 = "jepsen.r3u8.com" ascii - $c2_562 = "jica-go-jp.bike" ascii - $c2_563 = "jica-go-jp.biz" ascii - $c2_564 = "jimin-jp.biz" ascii - $c2_565 = "jimin.jimindaddy.com" ascii - $c2_566 = "jimin.mymom.info" ascii - $c2_567 = "jimindaddy.com" ascii - $c2_568 = "jimingroup.com" ascii - $c2_569 = "jimintokoy.com" ascii - $c2_570 = "jj.mysecondarydns.com" ascii - $c2_571 = "jmuroran.com" ascii - $c2_572 = "jp.rakutenmusic.com" ascii - $c2_573 = "jp.serveuser.com" ascii - $c2_574 = "jpcert.org" ascii - $c2_575 = "jpn.longmusic.com" ascii - $c2_576 = "jpnxzshopdata.authorizeddns.org" ascii - $c2_577 = "jpstarmarket.serveusers.com" ascii - $c2_578 = "kaka.lehigtapp.com" ascii - $c2_579 = "kawasaki.cloud-maste.com" ascii - $c2_580 = "kawasaki.unhamj.com" ascii - $c2_581 = "kennedy.tffghelth.com" ascii - $c2_582 = "key.zzux.com" ascii - $c2_583 = "kikimusic.sellclassics.com" ascii - $c2_584 = "kmd.crabdance.com" ascii - $c2_585 = "knowledge.sellclassics.com" ascii - $c2_586 = "ktgmktanxgvn.r3u8.com" ascii - $c2_587 = "kxsbwappupdate.dhcp.biz" ascii - $c2_588 = "kztmusiclnk.dnsrd.com" ascii - $c2_589 = "lan.dynssl.com" ascii - $c2_590 = "last.p6p6.net" ascii - $c2_591 = "latestnews.epac.to" ascii - $c2_592 = "latestnews.organiccrap.com" ascii - $c2_593 = "leedong.longmusic.com" ascii - $c2_594 = "lehigtapp.com" ascii - $c2_595 = "lennon.fftpoor.com" ascii - $c2_596 = "license.shenajou.com" ascii - $c2_597 = "lie.jetos.com" ascii - $c2_598 = "linuxforover.com" ascii - $c2_599 = "linuxsofta.com" ascii - $c2_600 = "lion.wchildress.com" ascii - $c2_601 = "lizard.poulsenv.com" ascii - $c2_602 = "logon-live.com" ascii - $c2_603 = "lottedfstravel.webbooting.com" ascii - $c2_604 = "loveddos.com" ascii - $c2_605 = "lzf550.r3u8.com" ascii - $c2_606 = "ma.vizvaz.com" ascii - $c2_607 = "mac.goldtoyota.com" ascii - $c2_608 = "mac.methoder.com" ascii - $c2_609 = "macfee.mrface.com" ascii - $c2_610 = "macforlinux.net" ascii - $c2_611 = "maffc.mrface.com" ascii - $c2_612 = "mail.architectisusa.com" ascii - $c2_613 = "mail.macforlinux.net" ascii - $c2_614 = "mailcarriage.co.uk" ascii - $c2_615 = "mailj.hostport9.net" ascii - $c2_616 = "mailserever.com" ascii - $c2_617 = "mailsserver.com" ascii - $c2_618 = "mailvserver.com" ascii - $c2_619 = "malcolm.fftpoor.com" ascii - $c2_620 = "malware.dsmtp.com" ascii - $c2_621 = "manager.architectisusa.com" ascii - $c2_622 = "manager.jetos.com" ascii - $c2_623 = "markabcinfo.dynamicdns.me.uk" ascii - $c2_624 = "martin.sellclassics.com" ascii - $c2_625 = "mason.vizvaz.com" ascii - $c2_626 = "mbaby.macforlinux.net" ascii - $c2_627 = "medexplor.thedomais.info" ascii - $c2_628 = "mediapath.organiccrap.com" ascii - $c2_629 = "meiji-ac-jp.com" ascii - $c2_630 = "mesjm.emailfound.info" ascii - $c2_631 = "message.emailfound.info" ascii - $c2_632 = "message.p6p6.net" ascii - $c2_633 = "messagea.emailfound.info" ascii - $c2_634 = "methoder.com" ascii - $c2_635 = "mf.ddns.info" ascii - $c2_636 = "microcnmlgb.3322.org" ascii - $c2_637 = "microdef.2288.org" ascii - $c2_638 = "microhome.wikaba.com" ascii - $c2_639 = "microsoft.got-game.org" ascii - $c2_640 = "microsoft.mrface.com" ascii - $c2_641 = "microsoftdownload.zzux.com" ascii - $c2_642 = "microsoftempowering.sendsmtp.com" ascii - $c2_643 = "microsoften.com" ascii - $c2_644 = "microsoftgame.mrface.com" ascii - $c2_645 = "microsoftgetstarted.sexidude.com" ascii - $c2_646 = "microsoftimages.organiccrap.com" ascii - $c2_647 = "microsoftmirror.mrbasic.com" ascii - $c2_648 = "microsoftmusic.itemdb.com" ascii - $c2_649 = "microsoftmusic.mrbasic.com" ascii - $c2_650 = "microsoftmusic.onedumb.com" ascii - $c2_651 = "microsoftqckmanager.pcanywhere.net" ascii - $c2_652 = "microsoftstore.jetos.com" ascii - $c2_653 = "microsoftstores.itemdb.com" ascii - $c2_654 = "microsoftupdate.mrbasic.com" ascii - $c2_655 = "microsoftupdate.qhigh.com" ascii - $c2_656 = "microsoftupdates.vizvaz.com" ascii - $c2_657 = "micrsoftware.dsmtp.com" ascii - $c2_658 = "mircsoft.compress.to" ascii - $c2_659 = "mivsee.website0012.net" ascii - $c2_660 = "mmofoojap.2288.org" ascii - $c2_661 = "mmy.ddns.us" ascii - $c2_662 = "mobile.2waky.com" ascii - $c2_663 = "mocha.100fanwen.com" ascii - $c2_664 = "mod.jetos.com" ascii - $c2_665 = "mofa-go-jp.com" ascii - $c2_666 = "mofa.dynamic-dns.net" ascii - $c2_667 = "mofa.ns01.info" ascii - $c2_668 = "mofa.strangled.net" ascii - $c2_669 = "mofaess.com" ascii - $c2_670 = "mongoles.3322.org" ascii - $c2_671 = "monkey.2012yearleft.com" ascii - $c2_672 = "moscowstdsupdate.toythieves.com" ascii - $c2_673 = "mrsloveaqx.mrslove.com" ascii - $c2_674 = "ms.ecc.u-tokyo-ac-jp.com" ascii - $c2_675 = "mseupdate.ourhobby.com" ascii - $c2_676 = "msg.ezua.com" ascii - $c2_677 = "msn.incloud-go.com" ascii - $c2_678 = "muller.exprenum.com" ascii - $c2_679 = "music.applemusic.itemdb.com" ascii - $c2_680 = "music.cleansite.us" ascii - $c2_681 = "music.websegoo.net" ascii - $c2_682 = "musicfile.ikwb.com" ascii - $c2_683 = "musicinfo.everydayfilmlink.com" ascii - $c2_684 = "musiclinker.jkub.com" ascii - $c2_685 = "musicsecph.squirly.info" ascii - $c2_686 = "mx.yetrula.eu" ascii - $c2_687 = "myie12.com" ascii - $c2_688 = "mymusicbox.lflinkup.org" ascii - $c2_689 = "mymusicbox.vizvaz.com" ascii - $c2_690 = "myphpwebsite.itsaol.com" ascii - $c2_691 = "myrestroomimage.isasecret.com" ascii - $c2_692 = "mytwhomeinst.sendsmtp.com" ascii - $c2_693 = "myurinikoreaaps.ninth.biz" ascii - $c2_694 = "na.americanunfinished.com" ascii - $c2_695 = "na.onmypc.org" ascii - $c2_696 = "nasa.xxuz.com" ascii - $c2_697 = "nec.website0012.net" ascii - $c2_698 = "news.100fanwen.com" ascii - $c2_699 = "newsdata.jkub.com" ascii - $c2_700 = "newsfile.toythieves.com" ascii - $c2_701 = "newsreport.justdied.com" ascii - $c2_702 = "newsroom.cleansite.info" ascii - $c2_703 = "nezwq.ezua.com" ascii - $c2_704 = "ngcc.8800.org" ascii - $c2_705 = "niushenghuo.info" ascii - $c2_706 = "nk10.belowto.com" ascii - $c2_707 = "nk20.belowto.com" ascii - $c2_708 = "nlddnsinfo.https443.org" ascii - $c2_709 = "nmrx.mrbonus.com" ascii - $c2_710 = "nn.dynssl.com" ascii - $c2_711 = "no.authorizeddns.org" ascii - $c2_712 = "node.mofaess.com" ascii - $c2_713 = "nodns2.qipian.org" ascii - $c2_714 = "nposnewsinfo.qhigh.com" ascii - $c2_715 = "ns1.belowto.com" ascii - $c2_716 = "ns1.tlchs2.ml" ascii - $c2_717 = "ns2.belowto.com" ascii - $c2_718 = "ns21.belowto.com" ascii - $c2_719 = "ns22.belowto.com" ascii - $c2_720 = "ns4.belowto.com" ascii - $c2_721 = "ns5.belowto.com" ascii - $c2_722 = "nsa.mefound.com" ascii - $c2_723 = "nsatcdns.com" ascii - $c2_724 = "nt.mynumber.org" ascii - $c2_725 = "nttdata.otzo.com" ascii - $c2_726 = "nunluck.re26.com" ascii - $c2_727 = "nz.compress.to" ascii - $c2_728 = "oipbl.com" ascii - $c2_729 = "ol.almostmy.com" ascii - $c2_730 = "oldbmwy.com" ascii - $c2_731 = "oms.sindeali.com" ascii - $c2_732 = "openmofa.8866.org" ascii - $c2_733 = "oracleupdate.dns04.com" ascii - $c2_734 = "osaka-jpgo.com" ascii - $c2_735 = "outlook.otzo.com" ascii - $c2_736 = "owlmedia.mefound.com" ascii - $c2_737 = "p6p6.net" ascii - $c2_738 = "peopleinfodata.3-a.net" ascii - $c2_739 = "phptecinfohelp.itemdb.com" ascii - $c2_740 = "pictures.everydayfilmlink.com" ascii - $c2_741 = "pj.qpoe.com" ascii - $c2_742 = "points.mofaess.com" ascii - $c2_743 = "polopurple.com" ascii - $c2_744 = "pop.architectisusa.com" ascii - $c2_745 = "pop.loveddos.com" ascii - $c2_746 = "portal.mrface.com" ascii - $c2_747 = "portal.sendsmtp.com" ascii - $c2_748 = "portalser.dynamic-dns.net" ascii - $c2_749 = "poulsenv.com" ascii - $c2_750 = "praskovya-matveyeva.mefound.com" ascii - $c2_751 = "praskovya-ulyanova.dumb1.com" ascii - $c2_752 = "premium.redforlinux.com" ascii - $c2_753 = "products.almostmy.com" ascii - $c2_754 = "products.cleansite.us" ascii - $c2_755 = "products.serveuser.com" ascii - $c2_756 = "program.acmetoy.com" ascii - $c2_757 = "prrmes4019.r3u8.com" ascii - $c2_758 = "purchase.lflinkup.org" ascii - $c2_759 = "q6.niushenghuo.info" ascii - $c2_760 = "qtsofta.com" ascii - $c2_761 = "quick.oldbmwy.com" ascii - $c2_762 = "r3u8.com" ascii - $c2_763 = "radiorig.com" ascii - $c2_764 = "rain.orctldl.windowsupdate.authorizeddns.us" ascii - $c2_765 = "rakutenmusic.com" ascii - $c2_766 = "rdns-4.infoproduto1.tk" ascii - $c2_767 = "re26.com" ascii - $c2_768 = "read.xxuz.com" ascii - $c2_769 = "recent.dns-stuff.com" ascii - $c2_770 = "recent.fartit.com" ascii - $c2_771 = "record.hostport9.net" ascii - $c2_772 = "record.webssl9.info" ascii - $c2_773 = "record.wschandler.com" ascii - $c2_774 = "redforlinux.com" ascii - $c2_775 = "referred.gr8domain.biz" ascii - $c2_776 = "referred.yourtrap.com" ascii - $c2_777 = "register.ourhobby.com" ascii - $c2_778 = "registration2.instanthq.com" ascii - $c2_779 = "registrations.4pu.com" ascii - $c2_780 = "registrations.organiccrap.com" ascii - $c2_781 = "reports.tomorrowforgood.com" ascii - $c2_782 = "reserveds.onedumb.com" ascii - $c2_783 = "resources.applemusic.itemdb.com" ascii - $c2_784 = "rethem.almostmy.com" ascii - $c2_785 = "rg197.win" ascii - $c2_786 = "rlbeiydn.hi.r3u8.com" ascii - $c2_787 = "saiyo.exprenum.com" ascii - $c2_788 = "sakai.unhamj.com" ascii - $c2_789 = "salvaiona.com" ascii - $c2_790 = "sappore.cloud-maste.com" ascii - $c2_791 = "sapporo.cloud-maste.com" ascii - $c2_792 = "sapporot.com" ascii - $c2_793 = "sat.suayay.com" ascii - $c2_794 = "saverd.re26.com" ascii - $c2_795 = "sbuudd.webssl9.info" ascii - $c2_796 = "sc.weboot.info" ascii - $c2_797 = "scholz-versand.com" ascii - $c2_798 = "scorpion.poulsenv.com" ascii - $c2_799 = "scrlk.exprenum.com" ascii - $c2_800 = "sdmsg.onmypc.org" ascii - $c2_801 = "se.toythieves.com" ascii - $c2_802 = "sea.websegoo.net" ascii - $c2_803 = "secertnews.mrbasic.com" ascii - $c2_804 = "secmicrosooo.6600.org" ascii - $c2_805 = "secnetshit.com" ascii - $c2_806 = "secserverupdate.toh.info" ascii - $c2_807 = "sell.mofaess.com" ascii - $c2_808 = "sema.linuxsofta.com" ascii - $c2_809 = "send.have8000.com" ascii - $c2_810 = "send.mofa.ns01.info" ascii - $c2_811 = "sendmsg.jumpingcrab.com" ascii - $c2_812 = "senseye.ikwb.com" ascii - $c2_813 = "senseye.mrbonus.com" ascii - $c2_814 = "septdlluckysystem.jungleheart.com" ascii - $c2_815 = "seraphim-yurieva.justdied.com" ascii - $c2_816 = "serv.justdied.com" ascii - $c2_817 = "server1.proxydns.com" ascii - $c2_818 = "seyesb.acmetoy.com" ascii - $c2_819 = "sha.25u.com" ascii - $c2_820 = "sha.ikwb.com" ascii - $c2_821 = "shenajou.com" ascii - $c2_822 = "shoppingcentre.station155.com" ascii - $c2_823 = "shrimp.UsFfUnicef.com" ascii - $c2_824 = "shrimp.bdoncloud.com" ascii - $c2_825 = "shugiin.jkub.com" ascii - $c2_826 = "sindeali.com" ascii - $c2_827 = "singed.otzo.com" ascii - $c2_828 = "siteinit.info" ascii - $c2_829 = "sky.oldbmwy.com" ascii - $c2_830 = "sma.jimindaddy.com" ascii - $c2_831 = "smo.gadskysun.com" ascii - $c2_832 = "smtp.architectisusa.com" ascii - $c2_833 = "smtp.macforlinux.net" ascii - $c2_834 = "smtp230.toldweb.com" ascii - $c2_835 = "somthing.re26.com" ascii - $c2_836 = "sstday.jkub.com" ascii - $c2_837 = "start.usrobothome.com" ascii - $c2_838 = "station155.com" ascii - $c2_839 = "stevenlf.com" ascii - $c2_840 = "stone.jumpingcrab.com" ascii - $c2_841 = "style.u-tokyo-ac-jp.com" ascii - $c2_842 = "suayay.com" ascii - $c2_843 = "suibian2010.info" ascii - $c2_844 = "support1.mrface.com" ascii - $c2_845 = "supportus.mefound.com" ascii - $c2_846 = "suzukigooogle.8866.org" ascii - $c2_847 = "svc.dynssl.com" ascii - $c2_848 = "synssl.dnset.com" ascii - $c2_849 = "sz.thedomais.info" ascii - $c2_850 = "taipei.yourtrap.com" ascii - $c2_851 = "taipeifoodsite.ocry.com" ascii - $c2_852 = "tamraj.fartit.com" ascii - $c2_853 = "telegraph.mefound.com" ascii - $c2_854 = "test.usyahooapis.com" ascii - $c2_855 = "tfa.longmusic.com" ascii - $c2_856 = "tffghelth.com" ascii - $c2_857 = "thedomais.info" ascii - $c2_858 = "ticket.instanthq.com" ascii - $c2_859 = "ticket.jetos.com" ascii - $c2_860 = "ticket.serveuser.com" ascii - $c2_861 = "tidatacenter.shenajou.com" ascii - $c2_862 = "tisdatacenter.shenajou.com" ascii - $c2_863 = "tisupdateinfo.faqserv.com" ascii - $c2_864 = "tokyo-gojp.com" ascii - $c2_865 = "tokyofile.2waky.com" ascii - $c2_866 = "tomorrowforgood.com" ascii - $c2_867 = "tophost.dynamicdns.co.uk" ascii - $c2_868 = "toshste.com" ascii - $c2_869 = "toya.7766.org" ascii - $c2_870 = "transfer.lflinkup.org" ascii - $c2_871 = "transfer.mrbasic.com" ascii - $c2_872 = "transfer.vizvaz.com" ascii - $c2_873 = "trasul.mypicture.info" ascii - $c2_874 = "travelyokogawafz.fartit.com" ascii - $c2_875 = "trendmicroupdate.shenajou.com" ascii - $c2_876 = "trendsecurity.shenajou.com" ascii - $c2_877 = "trout.belowto.com" ascii - $c2_878 = "tv.goldtoyota.com" ascii - $c2_879 = "tw.2012yearleft.com" ascii - $c2_880 = "twmusic.proxydns.com" ascii - $c2_881 = "twpeoplemusicsite.my03.com" ascii - $c2_882 = "twtravelinfomation.toythieves.com" ascii - $c2_883 = "twx.mynumber.org" ascii - $c2_884 = "tyoto-go-jp.com" ascii - $c2_885 = "u-tokyo-ac-jp.com" ascii - $c2_886 = "u1.FartIT.com" ascii - $c2_887 = "u1.haoyujd.info" ascii - $c2_888 = "ubuntusofta.com" ascii - $c2_889 = "ugreen.itemdb.com" ascii - $c2_890 = "ui.hdcdui.com" ascii - $c2_891 = "uk.dynamicdns.org.uk" ascii - $c2_892 = "ukuoka.cloud-maste.com" ascii - $c2_893 = "ultimedia.vmmini.com" ascii - $c2_894 = "un.ddns.info" ascii - $c2_895 = "un.dnsrd.com" ascii - $c2_896 = "unhamj.com" ascii - $c2_897 = "update.yourtrap.com" ascii - $c2_898 = "updatemirrors.fartit.com" ascii - $c2_899 = "updates.itsaol.com" ascii - $c2_900 = "ups.improvejpese.com" ascii - $c2_901 = "urearapetsu.com" ascii - $c2_902 = "usa.got-game.org" ascii - $c2_903 = "usa.itsaol.com" ascii - $c2_904 = "usa.japanteam.org" ascii - $c2_905 = "usffunicef.com" ascii - $c2_906 = "usmirocomney.net" ascii - $c2_907 = "usrobothome.com" ascii - $c2_908 = "usyahooapis.com" ascii - $c2_909 = "uu.logon-live.com" ascii - $c2_910 = "uu.niushenghuo.info" ascii - $c2_911 = "ux.niushenghuo.info" ascii - $c2_912 = "v4.appledownload.ourhobby.com" ascii - $c2_913 = "v4.itunesmusic.jkub.com" ascii - $c2_914 = "v4.microsoftmusic.onedumb.com" ascii - $c2_915 = "v4.microsoftupdate.mrbasic.com" ascii - $c2_916 = "v4.windowsupdate.DEDGESUITE.NET" ascii - $c2_917 = "v4.windowsupdate.authorizeddns.org" ascii - $c2_918 = "v4.windowsupdate.dnset.com" ascii - $c2_919 = "v4.windowsupdate.itsaol.com" ascii - $c2_920 = "v4.windowsupdate.lflinkup.com" ascii - $c2_921 = "v4.windowsupdate.mrface.com" ascii - $c2_922 = "v4.windowsupdate.nsatcdns.com" ascii - $c2_923 = "v4.windowsupdate.x24hr.com" ascii - $c2_924 = "v4.windowsupdates.dnsrd.com" ascii - $c2_925 = "veryhuai.info" ascii - $c2_926 = "video.vmdnsup.org" ascii - $c2_927 = "vmdnsup.org" ascii - $c2_929 = "vmyiersend.WEBSAGO.INFO" ascii - $c2_930 = "vmyisan.website0012.net" ascii - $c2_932 = "wchildress.com" ascii - $c2_934 = "wcxh.mynetav.net" ascii - $c2_935 = "wdsupdates.com" ascii - $c2_936 = "webbooting.com" ascii - $c2_937 = "webdirectnews.dynamicdns.biz" ascii - $c2_938 = "webinfoseco.ygto.com" ascii - $c2_939 = "webmailentry.jetos.com" ascii - $c2_940 = "weboot.info" ascii - $c2_941 = "websago.info" ascii - $c2_942 = "websegoo.net" ascii - $c2_943 = "website0012.net" ascii - $c2_944 = "websiteboo.website0012.net" ascii - $c2_945 = "websqlnewsmanager.ninth.biz" ascii - $c2_946 = "webssl9.info" ascii - $c2_947 = "well.itsaol.com" ascii - $c2_948 = "well.mrbasic.com" ascii - $c2_949 = "whale.toshste.com" ascii - $c2_950 = "whellbuy.wschandler.com" ascii - $c2_951 = "whyis.haoyujd.info" ascii - $c2_952 = "wike.wikaba.com" ascii - $c2_953 = "windowfile.itemdb.com" ascii - $c2_954 = "windowsimages.itemdb.com" ascii - $c2_955 = "windowsimages.qhigh.com" ascii - $c2_956 = "windowsmirrors.vizvaz.com" ascii - $c2_957 = "windowsstores.gettrials.com" ascii - $c2_958 = "windowsstores.organiccrap.com" ascii - $c2_959 = "windowsupdate.2waky.com" ascii - $c2_960 = "windowsupdate.3-a.net" ascii - $c2_961 = "windowsupdate.acmetoy.com" ascii - $c2_962 = "windowsupdate.authorizeddns.net" ascii - $c2_963 = "windowsupdate.authorizeddns.org" ascii - $c2_964 = "windowsupdate.authorizeddns.us" ascii - $c2_965 = "windowsupdate.com.mwcname.com" ascii - $c2_966 = "windowsupdate.dedgesuite.net" ascii - $c2_967 = "windowsupdate.dns05.com" ascii - $c2_968 = "windowsupdate.dnset.com" ascii - $c2_969 = "windowsupdate.esmtp.biz" ascii - $c2_970 = "windowsupdate.ezua.com" ascii - $c2_971 = "windowsupdate.fartit.com" ascii - $c2_972 = "windowsupdate.gettrials.com" ascii - $c2_973 = "windowsupdate.instanthq.com" ascii - $c2_974 = "windowsupdate.itsaol.com" ascii - $c2_975 = "windowsupdate.jungleheart.com" ascii - $c2_976 = "windowsupdate.lflink.com" ascii - $c2_977 = "windowsupdate.mrface.com" ascii - $c2_978 = "windowsupdate.mylftv.com" ascii - $c2_979 = "windowsupdate.nsatcdns.com" ascii - $c2_980 = "windowsupdate.organiccrap.com" ascii - $c2_981 = "windowsupdate.rebatesrule.net" ascii - $c2_982 = "windowsupdate.sellclassics.com" ascii - $c2_983 = "windowsupdate.serveusers.com" ascii - $c2_984 = "windowsupdate.vizvaz.com" ascii - $c2_985 = "windowsupdate.wcwname.com" ascii - $c2_986 = "windowsupdate.x24hr.com" ascii - $c2_987 = "windowsupdate.ygto.com" ascii - $c2_988 = "windowsupdates.dnset.com" ascii - $c2_989 = "windowsupdates.ezua.com" ascii - $c2_990 = "windowsupdates.ikwb.com" ascii - $c2_991 = "windowsupdates.itemdb.com" ascii - $c2_992 = "windowsupdates.proxydns.com" ascii - $c2_993 = "workerisgood.com" ascii - $c2_994 = "woyaofanwen.com" ascii - $c2_995 = "wschandler.com" ascii - $c2_996 = "wthelpdesk.com" ascii - $c2_997 = "wubangtu.info" ascii - $c2_998 = "www-meti-go-jp.tyoto-go-jp.com" ascii - $c2_999 = "www.2014.zzux.com" ascii - $c2_1000 = "www.97sm.com" ascii - $c2_1001 = "www.9gowg.tech" ascii - $c2_1002 = "www.abdominal.faqserv.com" ascii - $c2_1003 = "www.additional.sexidude.com" ascii - $c2_1004 = "www.afc.https443.org" ascii - $c2_1005 = "www.androidmusicapp.onmypc.us" ascii - $c2_1006 = "www.announcements.toythieves.com" ascii - $c2_1007 = "www.anx-own-334.mrbasic.com" ascii - $c2_1008 = "www.apple.ikwb.com" ascii - $c2_1009 = "www.appledownload.ourhobby.com" ascii - $c2_1010 = "www.appleimages.itemdb.com" ascii - $c2_1011 = "www.appleimages.longmusic.com" ascii - $c2_1012 = "www.appleimages.organiccrap.com" ascii - $c2_1013 = "www.applejuice.itemdb.com" ascii - $c2_1014 = "www.applemirror.organiccrap.com" ascii - $c2_1015 = "www.applemirror.squirly.info" ascii - $c2_1016 = "www.applemusic.isasecret.com" ascii - $c2_1017 = "www.applemusic.itemdb.com" ascii - $c2_1018 = "www.applemusic.wikaba.com" ascii - $c2_1019 = "www.applemusic.xxuz.com" ascii - $c2_1020 = "www.applemusic.zzux.com" ascii - $c2_1021 = "www.appleupdate.itemdb.com" ascii - $c2_1022 = "www.appleupdateurl.2waky.com" ascii - $c2_1023 = "www.architectisusa.com" ascii - $c2_1024 = "www.army.xxuz.com" ascii - $c2_1025 = "www.art.p6p6.net" ascii - $c2_1026 = "www.asfzx.x24hr.com" ascii - $c2_1027 = "www.availab.wikaba.com" ascii - $c2_1028 = "www.availability.justdied.com" ascii - $c2_1029 = "www.babymusicsitetr.mymom.info" ascii - $c2_1030 = "www.back.jungleheart.com" ascii - $c2_1031 = "www.balance1.wikaba.com" ascii - $c2_1032 = "www.be.mrslove.com" ascii - $c2_1033 = "www.belowto.com" ascii - $c2_1034 = "www.billing.organiccrap.com" ascii - $c2_1035 = "www.blaaaaaaaaaaaa.windowsupdate.3-a.net" ascii - $c2_1036 = "www.brand.fartit.com" ascii - $c2_1037 = "www.bulletproof.squirly.info" ascii - $c2_1038 = "www.cabbage.iownyour.biz" ascii - $c2_1039 = "www.ccupdatedata.authorizeddns.net" ascii - $c2_1040 = "www.cdn.incloud-go.com" ascii - $c2_1041 = "www.center.shenajou.com" ascii - $c2_1042 = "www.chaindungeons.com" ascii - $c2_1043 = "www.cia.ezua.com" ascii - $c2_1044 = "www.cia.toh.info" ascii - $c2_1045 = "www.civilwar123.authorizeddns.org" ascii - $c2_1046 = "www.civilwar520.onmypc.org" ascii - $c2_1047 = "www.cloud-maste.com" ascii - $c2_1048 = "www.cnnews.mylftv.com" ascii - $c2_1049 = "www.commissioner.shenajou.com" ascii - $c2_1050 = "www.commons.onedumb.com" ascii - $c2_1051 = "www.contractus.qpoe.com" ascii - $c2_1052 = "www.corp-dnsonline.itsaol.com" ascii - $c2_1053 = "www.courier.jetos.com" ascii - $c2_1054 = "www.cress.mynetav.net" ascii - $c2_1055 = "www.ctdl.windowsupdate.nsatcdns.com" ascii - $c2_1056 = "www.ctldl.microsoftupdate.qhigh.com" ascii - $c2_1057 = "www.ctldl.windowsupdate.authorizeddns.us" ascii - $c2_1058 = "www.ctldl.windowsupdate.esmtp.biz" ascii - $c2_1059 = "www.ctldl.windowsupdate.mrface.com" ascii - $c2_1060 = "www.cwiinatonal.com" ascii - $c2_1061 = "www.dasoftactivemodule.toythieves.com" ascii - $c2_1062 = "www.dasonews.youdontcare.com" ascii - $c2_1063 = "www.daughter.vizvaz.com" ascii - $c2_1064 = "www.de.onmypc.info" ascii - $c2_1065 = "www.details.squirly.info" ascii - $c2_1066 = "www.development.shenajou.com" ascii - $c2_1067 = "www.devilcase.acmetoy.com" ascii - $c2_1068 = "www.disruptive.https443.net" ascii - $c2_1069 = "www.dns-hinettw.25u.com" ascii - $c2_1070 = "www.document.shenajou.com" ascii - $c2_1071 = "www.domainnow.yourtrap.com" ascii - $c2_1072 = "www.download.windowsupdate.nsatcdns.com" ascii - $c2_1073 = "www.ea.onmypc.info" ascii - $c2_1074 = "www.eddo.qpoe.com" ascii - $c2_1075 = "www.ehshiroshima.mylftv.com" ascii - $c2_1076 = "www.eric-averyanov.wha.la" ascii - $c2_1077 = "www.eu.acmetoy.com" ascii - $c2_1078 = "www.eu.wha.la" ascii - $c2_1079 = "www.express.lflinkup.com" ascii - $c2_1080 = "www.extraordinary.dynamic-dns.net" ascii - $c2_1081 = "www.f068v.site" ascii - $c2_1082 = "www.facefile.fartit.com" ascii - $c2_1083 = "www.fertile.authorizeddns.net" ascii - $c2_1084 = "www.file.zzux.com" ascii - $c2_1085 = "www.findme.epac.to" ascii - $c2_1086 = "www.fire.mrface.com" ascii - $c2_1087 = "www.firstnews.jkub.com" ascii - $c2_1088 = "www.fjs.wikaba.com" ascii - $c2_1089 = "www.foal.wchildress.com" ascii - $c2_1090 = "www.fr.wikaba.com" ascii - $c2_1091 = "www.freegamecenter.onedumb.com" ascii - $c2_1092 = "www.fruit.qhigh.com" ascii - $c2_1093 = "www.fuck.ikwb.com" ascii - $c2_1094 = "www.fuckmm.dns-dns.com" ascii - $c2_1095 = "www.fukuoka.cloud-maste.com" ascii - $c2_1096 = "www.g3ypf.online" ascii - $c2_1097 = "www.garlic.dyndns.pro" ascii - $c2_1098 = "www.generat.almostmy.com" ascii - $c2_1099 = "www.glicense.shenajou.com" ascii - $c2_1100 = "www.goldtoyota.com" ascii - $c2_1101 = "www.goodmusic.justdied.com" ascii - $c2_1102 = "www.gooesdataios.instanthq.com" ascii - $c2_1103 = "www.grammar.jkub.com" ascii - $c2_1104 = "www.helpus.ddns.info" ascii - $c2_1105 = "www.hii.qhigh.com" ascii - $c2_1106 = "www.hinetonlinedns.dns05.com" ascii - $c2_1107 = "www.incloud-go.com" ascii - $c2_1108 = "www.innocent-isayev.sexidude.com" ascii - $c2_1109 = "www.interpreter.shenajou.com" ascii - $c2_1110 = "www.invoices.sexxxy.biz" ascii - $c2_1111 = "www.iphone.vizvaz.com" ascii - $c2_1112 = "www.ipv4.microsoftupdate.mrbasic.com" ascii - $c2_1113 = "www.ipv4.windowsupdate.3-a.net" ascii - $c2_1114 = "www.ipv4.windowsupdate.esmtp.biz" ascii - $c2_1115 = "www.ipv4.windowsupdate.fartit.com" ascii - $c2_1116 = "www.ipv4.windowsupdate.lflink.com" ascii - $c2_1117 = "www.ipv4.windowsupdate.mrface.com" ascii - $c2_1118 = "www.ipv4.windowsupdate.mylftv.com" ascii - $c2_1119 = "www.ipv4.windowsupdate.nsatcdns.com" ascii - $c2_1120 = "www.itlans.isasecret.com" ascii - $c2_1121 = "www.itunesdownload.jkub.com" ascii - $c2_1122 = "www.itunesdownload.vizvaz.com" ascii - $c2_1123 = "www.itunesdownload.wikaba.com" ascii - $c2_1124 = "www.itunesimages.itemdb.com" ascii - $c2_1125 = "www.itunesimages.itsaol.com" ascii - $c2_1126 = "www.itunesimages.qpoe.com" ascii - $c2_1127 = "www.itunesmirror.fartit.com" ascii - $c2_1128 = "www.itunesmirror.itsaol.com" ascii - $c2_1129 = "www.itunesmusic.ikwb.com" ascii - $c2_1130 = "www.itunesmusic.jetos.com" ascii - $c2_1131 = "www.itunesmusic.jkub.com" ascii - $c2_1132 = "www.itunesmusic.zzux.com" ascii - $c2_1133 = "www.itunesupdate.itsaol.com" ascii - $c2_1134 = "www.itunesupdates.organiccrap.com" ascii - $c2_1135 = "www.japanenvnews.qpoe.com" ascii - $c2_1136 = "www.jd978.com" ascii - $c2_1137 = "www.jimin.jimindaddy.com" ascii - $c2_1138 = "www.jimin.mymom.info" ascii - $c2_1139 = "www.jp.serveuser.com" ascii - $c2_1140 = "www.jpnappstore.ourhobby.com" ascii - $c2_1141 = "www.jpnewslogs.sendsmtp.com" ascii - $c2_1142 = "www.jpnxzshopdata.authorizeddns.org" ascii - $c2_1143 = "www.kawasaki.cloud-maste.com" ascii - $c2_1144 = "www.kawasaki.unhamj.com" ascii - $c2_1145 = "www.key.zzux.com" ascii - $c2_1146 = "www.knowledge.sellclassics.com" ascii - $c2_1147 = "www.lan.dynssl.com" ascii - $c2_1148 = "www.last.p6p6.net" ascii - $c2_1149 = "www.latestnews.epac.to" ascii - $c2_1150 = "www.latestnews.organiccrap.com" ascii - $c2_1151 = "www.leedong.longmusic.com" ascii - $c2_1152 = "www.leeks.mrbonus.com" ascii - $c2_1153 = "www.liberty.acmetoy.com" ascii - $c2_1154 = "www.license.shenajou.com" ascii - $c2_1155 = "www.lion.wchildress.com" ascii - $c2_1156 = "www.loveddos.com" ascii - $c2_1157 = "www.macfee.mrface.com" ascii - $c2_1158 = "www.macforlinux.net" ascii - $c2_1159 = "www.maffc.mrface.com" ascii - $c2_1160 = "www.malware.dsmtp.com" ascii - $c2_1161 = "www.manager.jetos.com" ascii - $c2_1162 = "www.markabcinfo.dynamicdns.me.uk" ascii - $c2_1163 = "www.mason.vizvaz.com" ascii - $c2_1164 = "www.mediapath.organiccrap.com" ascii - $c2_1165 = "www.meiji-ac-jp.com" ascii - $c2_1166 = "www.messagea.emailfound.info" ascii - $c2_1167 = "www.microsoft.got-game.org" ascii - $c2_1168 = "www.microsoft.mrface.com" ascii - $c2_1169 = "www.microsoftempowering.sendsmtp.com" ascii - $c2_1170 = "www.microsoftgame.mrface.com" ascii - $c2_1171 = "www.microsoftgetstarted.sexidude.com" ascii - $c2_1172 = "www.microsoftimages.organiccrap.com" ascii - $c2_1173 = "www.microsoftmirror.mrbasic.com" ascii - $c2_1174 = "www.microsoftmusic.itemdb.com" ascii - $c2_1175 = "www.microsoftmusic.mrbasic.com" ascii - $c2_1176 = "www.microsoftqckmanager.pcanywhere.net" ascii - $c2_1177 = "www.microsoftupdate.mrbasic.com" ascii - $c2_1178 = "www.microsoftupdate.qhigh.com" ascii - $c2_1179 = "www.micrsoftware.dsmtp.com" ascii - $c2_1180 = "www.mircsoft.compress.to" ascii - $c2_1181 = "www.mmy.ddns.us" ascii - $c2_1182 = "www.mod.jetos.com" ascii - $c2_1183 = "www.mofa.dynamic-dns.net" ascii - $c2_1184 = "www.mofa.ns01.info" ascii - $c2_1185 = "www.moonnightthse.zyns.com" ascii - $c2_1186 = "www.moscowdic.trickip.org" ascii - $c2_1187 = "www.moscowstdsupdate.toythieves.com" ascii - $c2_1188 = "www.mseupdate.ourhobby.com" ascii - $c2_1189 = "www.msg.ezua.com" ascii - $c2_1190 = "www.msn.incloud-go.com" ascii - $c2_1191 = "www.musicfile.ikwb.com" ascii - $c2_1192 = "www.musicjj.zzux.com" ascii - $c2_1193 = "www.musicsecph.squirly.info" ascii - $c2_1194 = "www.mymusicbox.lflinkup.org" ascii - $c2_1195 = "www.mymusicbox.vizvaz.com" ascii - $c2_1196 = "www.myrestroomimage.isasecret.com" ascii - $c2_1197 = "www.mytwhomeinst.sendsmtp.com" ascii - $c2_1198 = "www.myurinikoreaaps.ninth.biz" ascii - $c2_1199 = "www.na.americanunfinished.com" ascii - $c2_1200 = "www.na.onmypc.org" ascii - $c2_1201 = "www.networkjpnzee.mynetav.org" ascii - $c2_1202 = "www.newcityoforward.rebatesrule.net" ascii - $c2_1203 = "www.newdnssec-info.4mydomain.com" ascii - $c2_1204 = "www.newsdata.jkub.com" ascii - $c2_1205 = "www.newsfile.toythieves.com" ascii - $c2_1206 = "www.newsroom.cleansite.info" ascii - $c2_1207 = "www.nlddnsinfo.https443.org" ascii - $c2_1208 = "www.no.authorizeddns.org" ascii - $c2_1209 = "www.nposnewsinfo.qhigh.com" ascii - $c2_1210 = "www.nsa.mefound.com" ascii - $c2_1211 = "www.nt.mynumber.org" ascii - $c2_1212 = "www.nttdata.otzo.com" ascii - $c2_1213 = "www.nuisance.serveusers.com" ascii - $c2_1214 = "www.nz.compress.to" ascii - $c2_1215 = "www.ol.almostmy.com" ascii - $c2_1216 = "www.oldbmwy.com" ascii - $c2_1217 = "www.onion.jkub.com" ascii - $c2_1218 = "www.onlinednsserver.sendsmtp.com" ascii - $c2_1219 = "www.oracleupdate.dns04.com" ascii - $c2_1220 = "www.oyster.jkub.com" ascii - $c2_1221 = "www.p6p6.net" ascii - $c2_1222 = "www.packetsdsquery.dns05.com" ascii - $c2_1223 = "www.pepper.sexxxy.biz" ascii - $c2_1224 = "www.phptecinfohelp.itemdb.com" ascii - $c2_1225 = "www.pickled.myddns.com" ascii - $c2_1226 = "www.polopurple.com" ascii - $c2_1227 = "www.portal.mrface.com" ascii - $c2_1228 = "www.portal.sendsmtp.com" ascii - $c2_1229 = "www.portalser.dynamic-dns.net" ascii - $c2_1230 = "www.praskovya-matveyeva.mefound.com" ascii - $c2_1231 = "www.praskovya-ulyanova.dumb1.com" ascii - $c2_1232 = "www.products.almostmy.com" ascii - $c2_1233 = "www.products.cleansite.us" ascii - $c2_1234 = "www.products.serveuser.com" ascii - $c2_1235 = "www.purchase.lflinkup.org" ascii - $c2_1236 = "www.rainbow.mypop3.org" ascii - $c2_1237 = "www.re26.com" ascii - $c2_1238 = "www.read.xxuz.com" ascii - $c2_1239 = "www.recent.dns-stuff.com" ascii - $c2_1240 = "www.recent.fartit.com" ascii - $c2_1241 = "www.redflower.isasecret.com" ascii - $c2_1242 = "www.referred.gr8domain.biz" ascii - $c2_1243 = "www.referred.yourtrap.com" ascii - $c2_1244 = "www.register.ourhobby.com" ascii - $c2_1245 = "www.registration2.instanthq.com" ascii - $c2_1246 = "www.registrations.4pu.com" ascii - $c2_1247 = "www.registrations.organiccrap.com" ascii - $c2_1248 = "www.remeberdata.iownyour.org" ascii - $c2_1249 = "www.reserveds.onedumb.com" ascii - $c2_1250 = "www.rethem.almostmy.com" ascii - $c2_1251 = "www.rg197.win" ascii - $c2_1252 = "www.sakai.unhamj.com" ascii - $c2_1253 = "www.sapporo.cloud-maste.com" ascii - $c2_1254 = "www.sauerkraut.sellclassics.com" ascii - $c2_1255 = "www.saverd.re26.com" ascii - $c2_1256 = "www.sbuudd.webssl9.info" ascii - $c2_1257 = "www.sdmsg.onmypc.org" ascii - $c2_1258 = "www.se.toythieves.com" ascii - $c2_1259 = "www.secertnews.mrbasic.com" ascii - $c2_1260 = "www.secnetshit.com" ascii - $c2_1261 = "www.secserverupdate.toh.info" ascii - $c2_1262 = "www.senseye.ikwb.com" ascii - $c2_1263 = "www.senseye.mrbonus.com" ascii - $c2_1264 = "www.septdlluckysystem.jungleheart.com" ascii - $c2_1265 = "www.seraphim-yurieva.justdied.com" ascii - $c2_1266 = "www.serv.justdied.com" ascii - $c2_1267 = "www.server1.proxydns.com" ascii - $c2_1268 = "www.seyesb.acmetoy.com" ascii - $c2_1269 = "www.showy.almostmy.com" ascii - $c2_1270 = "www.shugiin.jkub.com" ascii - $c2_1271 = "www.sindeali.com" ascii - $c2_1272 = "www.singed.otzo.com" ascii - $c2_1273 = "www.sojourner.mypicture.info" ascii - $c2_1274 = "www.sstday.jkub.com" ascii - $c2_1275 = "www.support1.mrface.com" ascii - $c2_1276 = "www.supportus.mefound.com" ascii - $c2_1277 = "www.svc.dynssl.com" ascii - $c2_1278 = "www.sweetheart.sexxxy.biz" ascii - $c2_1279 = "www.synssl.dnset.com" ascii - $c2_1280 = "www.tamraj.fartit.com" ascii - $c2_1281 = "www.telegraph.mefound.com" ascii - $c2_1282 = "www.tfa.longmusic.com" ascii - $c2_1283 = "www.thunder.wikaba.com" ascii - $c2_1284 = "www.ticket.instanthq.com" ascii - $c2_1285 = "www.ticket.serveuser.com" ascii - $c2_1286 = "www.tisupdateinfo.faqserv.com" ascii - $c2_1287 = "www.tokyofile.2waky.com" ascii - $c2_1288 = "www.tophost.dynamicdns.co.uk" ascii - $c2_1289 = "www.transfer.lflinkup.org" ascii - $c2_1290 = "www.transfer.mrbasic.com" ascii - $c2_1291 = "www.transfer.vizvaz.com" ascii - $c2_1292 = "www.twgovernmentinfo.acmetoy.com" ascii - $c2_1293 = "www.twsslpopservupro.dynssl.com" ascii - $c2_1294 = "www.ugreen.itemdb.com" ascii - $c2_1295 = "www.uk.dynamicdns.org.uk" ascii - $c2_1296 = "www.un.ddns.info" ascii - $c2_1297 = "www.un.dnsrd.com" ascii - $c2_1298 = "www.unhamj.com" ascii - $c2_1299 = "www.usa.itsaol.com" ascii - $c2_1300 = "www.usffunicef.com" ascii - $c2_1301 = "www.usliveupdateonline.ygto.com" ascii - $c2_1302 = "www.ut-portal-u-tokyo-ac-jp.tyoto-go-jp.com" ascii - $c2_1303 = "www.v4.windowsupdate.mrface.com" ascii - $c2_1304 = "www.v4.windowsupdate.nsatcdns.com" ascii - $c2_1305 = "www.vmmini.com" ascii - $c2_1306 = "www.wchildress.com" ascii - $c2_1307 = "www.webdirectnews.dynamicdns.biz" ascii - $c2_1308 = "www.webmailentry.jetos.com" ascii - $c2_1309 = "www.websqlnewsmanager.ninth.biz" ascii - $c2_1310 = "www.well.itsaol.com" ascii - $c2_1311 = "www.well.mrbasic.com" ascii - $c2_1312 = "www.windowfile.itemdb.com" ascii - $c2_1313 = "www.windowsimages.itemdb.com" ascii - $c2_1314 = "www.windowsimages.qhigh.com" ascii - $c2_1315 = "www.windowsmirrors.vizvaz.com" ascii - $c2_1316 = "www.windowsupdate.2waky.com" ascii - $c2_1317 = "www.windowsupdate.3-a.net" ascii - $c2_1318 = "www.windowsupdate.acmetoy.com" ascii - $c2_1319 = "www.windowsupdate.authorizeddns.net" ascii - $c2_1320 = "www.windowsupdate.authorizeddns.org" ascii - $c2_1321 = "www.windowsupdate.authorizeddns.us" ascii - $c2_1322 = "www.windowsupdate.dns05.com" ascii - $c2_1323 = "www.windowsupdate.dnset.com" ascii - $c2_1324 = "www.windowsupdate.esmtp.biz" ascii - $c2_1325 = "www.windowsupdate.ezua.com" ascii - $c2_1326 = "www.windowsupdate.fartit.com" ascii - $c2_1327 = "www.windowsupdate.gettrials.com" ascii - $c2_1328 = "www.windowsupdate.instanthq.com" ascii - $c2_1329 = "www.windowsupdate.itsaol.com" ascii - $c2_1330 = "www.windowsupdate.jungleheart.com" ascii - $c2_1331 = "www.windowsupdate.lflink.com" ascii - $c2_1332 = "www.windowsupdate.mrface.com" ascii - $c2_1333 = "www.windowsupdate.mylftv.com" ascii - $c2_1334 = "www.windowsupdate.nsatcdns.com" ascii - $c2_1335 = "www.windowsupdate.organiccrap.com" ascii - $c2_1336 = "www.windowsupdate.rebatesrule.net" ascii - $c2_1337 = "www.windowsupdate.sellclassics.com" ascii - $c2_1338 = "www.windowsupdate.serveusers.com" ascii - $c2_1339 = "www.windowsupdate.x24hr.com" ascii - $c2_1340 = "www.yahoo.incloud-go.com" ascii - $c2_1341 = "www.yandexr.sellclassics.com" ascii - $c2_1342 = "www.yeahyeahyeahs.3322.org" ascii - $c2_1343 = "www.yokohamajpinstaz.mrbonus.com" ascii - $c2_1344 = "www.zaigawebinfo.rebatesrule.net" ascii - $c2_1345 = "www.zebra.incloud-go.com" ascii - $c2_1346 = "www2.qpoe.com" ascii - $c2_1347 = "www2.zyns.com" ascii - $c2_1348 = "www2.zzux.com" ascii - $c2_1349 = "x7.usyahooapis.com" ascii - $c2_1350 = "xi.dyndns.pro" ascii - $c2_1351 = "xi.sexxxy.biz" ascii - $c2_1352 = "xread10821.9966.org" ascii - $c2_1353 = "xsince.tk" ascii - $c2_1354 = "xt.dnset.com" ascii - $c2_1355 = "xyrn998754.2288.org" ascii - $c2_1356 = "yahoo.incloud-go.com" ascii - $c2_1357 = "yallago.cu.cc" ascii - $c2_1358 = "yandexr.sellclassics.com" ascii - $c2_1359 = "yeahyeahyeahs.3322.org" ascii - $c2_1360 = "yeap1.jumpingcrab.com" ascii - $c2_1361 = "yfrfyhf.youdontcare.com" ascii - $c2_1362 = "yo.acmetoy.com" ascii - $c2_1363 = "za.myftp.info" ascii - $c2_1364 = "zabbix.servercontrols.pw" ascii - $c2_1365 = "zaigawebinfo.rebatesrule.net" ascii - $c2_1367 = "zebra.UsFfUnicef.com" ascii - $c2_1368 = "zebra.bdoncloud.com" ascii - $c2_1369 = "zebra.incloud-go.com" ascii - $c2_1370 = "zebra.unhamj.com" ascii - $c2_1371 = "zebra.wthelpdesk.com" ascii - $c2_1372 = "zero.pcanywhere.net" ascii - $c2_1373 = "zg.ns02.biz" ascii - $c2_1374 = "zone.demoones.com" ascii -condition: - 1 of ($c2_*) -} diff --git a/signatures/apt_apt12_malware.yar b/signatures/apt_apt12_malware.yar deleted file mode 100644 index 587a682..0000000 --- a/signatures/apt_apt12_malware.yar +++ /dev/null @@ -1,23 +0,0 @@ -/* - Yara Rule Set - Author: Florian Roth - Date: 2017-08-30 - Identifier: APT 12 Japanese Incident - Reference: http://blog.macnica.net/blog/2017/08/post-fb81.html -*/ - -/* Rule Set ----------------------------------------------------------------- */ - -import "pe" - -rule APT12_Malware_Aug17 { - meta: - description = "Detects APT 12 Malware" - author = "Florian Roth" - reference = "http://blog.macnica.net/blog/2017/08/post-fb81.html" - date = "2017-08-30" - hash1 = "dc7521c00ec2534cf494c0263ddf67ea4ba9915eb17bdc0b3ebe9e840ec63643" - hash2 = "42da51b69bd6625244921a4eef9a2a10153e012a3213e8e9877cf831aea3eced" - condition: - ( uint16(0) == 0x5a4d and pe.imphash() == "9ba915fd04f248ad62e856c7238c0264" ) -} diff --git a/signatures/apt_apt15.yar b/signatures/apt_apt15.yar deleted file mode 100644 index dac3931..0000000 --- a/signatures/apt_apt15.yar +++ /dev/null @@ -1,292 +0,0 @@ -/* - Yara Rule Set - Author: Florian Roth - Date: 2018-03-10 - Identifier: APT15 Report - Reference: https://goo.gl/HZ5XMN -*/ - -/* Rule Set ----------------------------------------------------------------- */ - -import "pe" - -rule APT15_Malware_Mar18_RoyalCli { - meta: - description = "Detects malware from APT 15 report by NCC Group" - author = "Florian Roth" - reference = "https://goo.gl/HZ5XMN" - date = "2018-03-10" - hash1 = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785" - strings: - $s1 = "\\Release\\RoyalCli.pdb" ascii - $s2 = "%snewcmd.exe" fullword ascii - $s3 = "Run cmd error %d" fullword ascii - $s4 = "%s~clitemp%08x.ini" fullword ascii - $s5 = "run file failed" fullword ascii - $s6 = "Cmd timeout %d" fullword ascii - $s7 = "2 %s %d 0 %d" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 200KB and 2 of them -} - -rule APT15_Malware_Mar18_RoyalDNS { - meta: - description = "Detects malware from APT 15 report by NCC Group" - author = "Florian Roth" - reference = "https://goo.gl/HZ5XMN" - date = "2018-03-10" - hash1 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d" - strings: - $x1 = "del c:\\windows\\temp\\r.exe /f /q" fullword ascii - $x2 = "%s\\r.exe" fullword ascii - - $s1 = "rights.dll" fullword ascii - $s2 = "\"%s\">>\"%s\"\\s.txt" fullword ascii - $s3 = "Nwsapagent" fullword ascii - $s4 = "%s\\r.bat" fullword ascii - $s5 = "%s\\s.txt" fullword ascii - $s6 = "runexe" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 200KB and ( - ( pe.exports("RunInstallA") and pe.exports("RunUninstallA") ) or - 1 of ($x*) or - 2 of them - ) -} - -rule APT15_Malware_Mar18_BS2005 { - meta: - description = "Detects malware from APT 15 report by NCC Group" - author = "Florian Roth" - reference = "https://goo.gl/HZ5XMN" - date = "2018-03-10" - hash1 = "750d9eecd533f89b8aa13aeab173a1cf813b021b6824bc30e60f5db6fa7b950b" - strings: - $x1 = "AAAAKQAASCMAABi+AABnhEBj8vep7VRoAEPRWLweGc0/eiDrXGajJXRxbXsTXAcZAABK4QAAPWwAACzWAAByrg==" fullword ascii - $x2 = "AAAAKQAASCMAABi+AABnhKv3kXJJousn5YzkjGF46eE3G8ZGse4B9uoqJo8Q2oF0AABK4QAAPWwAACzWAAByrg==" fullword ascii - - $a1 = "http://%s/content.html?id=%s" fullword ascii - $a2 = "http://%s/main.php?ssid=%s" fullword ascii - $a3 = "http://%s/webmail.php?id=%s" fullword ascii - $a9 = "http://%s/error.html?tab=%s" fullword ascii - - $s1 = "%s\\~tmp.txt" fullword ascii - $s2 = "%s /C %s >>\"%s\" 2>&1" fullword ascii - $s3 = "DisableFirstRunCustomize" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 200KB and ( - 1 of ($x*) or - 2 of them - ) -} - -rule APT15_Malware_Mar18_MSExchangeTool { - meta: - description = "Detects malware from APT 15 report by NCC Group" - author = "Florian Roth" - reference = "https://goo.gl/HZ5XMN" - date = "2018-03-10" - hash1 = "16b868d1bef6be39f69b4e976595e7bd46b6c0595cf6bc482229dbb9e64f1bce" - strings: - $s1 = "\\Release\\EWSTEW.pdb" ascii - $s2 = "EWSTEW.exe" fullword wide - $s3 = "Microsoft.Exchange.WebServices.Data" fullword ascii - $s4 = "tmp.dat" fullword wide - $s6 = "/v or /t is null" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 40KB and all of them -} - -/* - Identifier: APT15 = Mirage = Ke3chang - Author: NCCGroup - Revised by Florian Roth for performance reasons - see https://gist.github.com/Neo23x0/e3d4e316d7441d9143c7 - > some rules were untightened - Date: 2018-03-09 - Reference: https://github.com/nccgroup/Royal_APT/blob/master/signatures/apt15.yara -*/ - -rule clean_apt15_patchedcmd{ - meta: - author = "Ahmed Zaki" - description = "This is a patched CMD. This is the CMD that RoyalCli uses." - sha256 = "90d1f65cfa51da07e040e066d4409dc8a48c1ab451542c894a623bc75c14bf8f" - strings: - $ = "eisableCMD" wide - $ = "%WINDOWS_COPYRIGHT%" wide - $ = "Cmd.Exe" wide - $ = "Windows Command Processor" wide - condition: - uint16(0) == 0x5A4D and all of them -} - -rule malware_apt15_royalcli_1{ - meta: - description = "Generic strings found in the Royal CLI tool" - author = "David Cannings" - sha256 = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785" - strings: - $ = "%s~clitemp%08x.tmp" fullword - $ = "%s /c %s>%s" fullword - $ = "%snewcmd.exe" fullword - $ = "%shkcmd.exe" fullword - $ = "%s~clitemp%08x.ini" fullword - $ = "myRObject" fullword - $ = "myWObject" fullword - $ = "2 %s %d 0 %d\x0D\x0A" - $ = "2 %s %d 1 %d\x0D\x0A" - $ = "%s file not exist" fullword - condition: - uint16(0) == 0x5A4D and 5 of them -} - -rule malware_apt15_royalcli_2{ - meta: - author = "Nikolaos Pantazopoulos" - description = "APT15 RoyalCli backdoor" - strings: - $string1 = "%shkcmd.exe" fullword - $string2 = "myRObject" fullword - $string3 = "%snewcmd.exe" fullword - $string4 = "%s~clitemp%08x.tmp" fullword - $string6 = "myWObject" fullword - condition: - uint16(0) == 0x5A4D and 2 of them -} - -/* -rule malware_apt15_bs2005{ - meta: - author = "Ahmed Zaki" - md5 = "ed21ce2beee56f0a0b1c5a62a80c128b" - description = "APT15 bs2005" - strings: - $ = "%s&%s&%s&%s" wide ascii - $ = "%s\\%s" wide ascii fullword - $ = "WarOnPostRedirect" wide ascii fullword - $ = "WarnonZoneCrossing" wide ascii fullword - $ = "^^^^^" wide ascii fullword - $ = /"?%s\s*"?\s*\/C\s*"?%s\s*>\s*\\?"?%s\\(\w+\.\w+)?"\s*2>&1\s*"?/ - $ ="IEharden" wide ascii fullword - $ ="DEPOff" wide ascii fullword - $ ="ShownVerifyBalloon" wide ascii fullword - $ ="IEHardenIENoWarn" wide ascii fullword - condition: - ( uint16(0) == 0x5A4D and 5 of them ) or - ( uint16(0) == 0x5A4D and 3 of them and - ( pe.imports("advapi32.dll", "CryptDecrypt") and pe.imports("advapi32.dll", "CryptEncrypt") and - pe.imports("ole32.dll", "CoCreateInstance") - ) - ) -} -*/ - -rule malware_apt15_royaldll { - meta: - author = "David Cannings" - description = "DLL implant, originally rights.dll and runs as a service" - sha256 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d" - strings: - /* - 56 push esi - B8 A7 C6 67 4E mov eax, 4E67C6A7h - 83 C1 02 add ecx, 2 - BA 04 00 00 00 mov edx, 4 - 57 push edi - 90 nop - */ - // JSHash implementation (Justin Sobel's hash algorithm) - $opcodes_jshash = { B8 A7 C6 67 4E 83 C1 02 BA 04 00 00 00 57 90 } - - /* - 0F B6 1C 03 movzx ebx, byte ptr [ebx+eax] - 8B 55 08 mov edx, [ebp+arg_0] - 30 1C 17 xor [edi+edx], bl - 47 inc edi - 3B 7D 0C cmp edi, [ebp+arg_4] - 72 A4 jb short loc_10003F31 - */ - // Encode loop, used to "encrypt" data before DNS request - $opcodes_encode = { 0F B6 1C 03 8B 55 08 30 1C 17 47 3B 7D 0C } - - /* - 68 88 13 00 00 push 5000 # Also seen 3000, included below - FF D6 call esi ; Sleep - 4F dec edi - 75 F6 jnz short loc_10001554 - */ - // Sleep loop - $opcodes_sleep_loop = { 68 (88|B8) (13|0B) 00 00 FF D6 4F 75 F6 } - - // Generic strings - $ = "Nwsapagent" fullword - $ = "\"%s\">>\"%s\"\\s.txt" - $ = "myWObject" fullword - $ = "del c:\\windows\\temp\\r.exe /f /q" - $ = "del c:\\windows\\temp\\r.ini /f /q" - - condition: - 3 of them -} - -rule malware_apt15_royaldll_2 { - meta: - author = "Ahmed Zaki" - sha256 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d" - description = "DNS backdoor used by APT15" - strings: - $= "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" wide ascii - $= "netsvcs" wide ascii fullword - $= "%SystemRoot%\\System32\\svchost.exe -k netsvcs" wide ascii fullword - $= "SYSTEM\\CurrentControlSet\\Services\\" wide ascii - $= "myWObject" wide ascii - condition: - uint16(0) == 0x5A4D and all of them - and pe.exports("ServiceMain") - and filesize > 50KB and filesize < 600KB -} - -rule malware_apt15_exchange_tool { - meta: - author = "Ahmed Zaki" - md5 = "d21a7e349e796064ce10f2f6ede31c71" - description = "This is a an exchange enumeration/hijacking tool used by an APT 15" - strings: - $s1= "subjectname" fullword - $s2= "sendername" fullword - $s3= "WebCredentials" fullword - $s4= "ExchangeVersion" fullword - $s5= "ExchangeCredentials" fullword - $s6= "slfilename" fullword - $s7= "EnumMail" fullword - $s8= "EnumFolder" fullword - $s9= "set_Credentials" fullword - $s18 = "/v or /t is null" wide - $s24 = "2013sp1" wide - condition: - uint16(0) == 0x5A4D and all of them -} - -rule malware_apt15_generic { - meta: - author = "David Cannings" - description = "Find generic data potentially relating to AP15 tools" - strings: - // Appears to be from copy/paste code - $str01 = "myWObject" fullword - $str02 = "myRObject" fullword - - /* - 6A 02 push 2 ; dwCreationDisposition - 6A 00 push 0 ; lpSecurityAttributes - 6A 00 push 0 ; dwShareMode - 68 00 00 00 C0 push 0C0000000h ; dwDesiredAccess - 50 push eax ; lpFileName - FF 15 44 F0 00 10 call ds:CreateFileA - */ - // Arguments for CreateFileA - $opcodes01 = { 6A (02|03) 6A 00 6A 00 68 00 00 00 C0 50 FF 15 } - condition: - 2 of them -} diff --git a/signatures/apt_apt17_mal_sep17.yar b/signatures/apt_apt17_mal_sep17.yar deleted file mode 100644 index 4282630..0000000 --- a/signatures/apt_apt17_mal_sep17.yar +++ /dev/null @@ -1,99 +0,0 @@ -/* - Yara Rule Set - Author: Florian Roth - Date: 2017-10-03 - Identifier: APT17 Oct 10 - Reference: https://goo.gl/puVc9q -*/ - -/* Rule Set ----------------------------------------------------------------- */ - -import "pe" - -rule APT17_Malware_Oct17_1 { - meta: - description = "Detects APT17 malware" - author = "Florian Roth" - reference = "https://goo.gl/puVc9q" - date = "2017-10-03" - hash1 = "dc9b5e8aa6ec86db8af0a7aa897ca61db3e5f3d2e0942e319074db1aaccfdc83" - strings: - $s1 = "\\spool\\prtprocs\\w32x86\\localspl.dll" fullword ascii - $s2 = "\\spool\\prtprocs\\x64\\localspl.dll" fullword ascii - $s3 = "\\msvcrt.dll" fullword ascii - $s4 = "\\TSMSISrv.dll" fullword ascii - condition: - ( uint16(0) == 0x5a4d and filesize < 500KB and all of them ) -} - -rule APT17_Malware_Oct17_2 { - meta: - description = "Detects APT17 malware" - author = "Florian Roth" - reference = "https://goo.gl/puVc9q" - date = "2017-10-03" - hash1 = "20cd49fd0f244944a8f5ba1d7656af3026e67d170133c1b3546c8b2de38d4f27" - strings: - $x1 = "Cookie: __xsptplus=%s" fullword ascii - $x2 = "http://services.fiveemotions.co.jp" fullword ascii - $x3 = "http://%s/ja-JP/2015/%d/%d/%d%d%d%d%d%d%d%d.gif" fullword ascii - - $s1 = "FoxHTTPClient_EXE_x86.exe" fullword ascii - $s2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.3072" ascii - $s3 = "hWritePipe2 Error:%d" fullword ascii - $s4 = "Not Support This Function!" fullword ascii - $s5 = "Global\\PnP_No_Management" fullword ascii - $s6 = "Content-Type: image/x-png" fullword ascii - $s7 = "Accept-Language: ja-JP" fullword ascii - $s8 = "IISCMD Error:%d" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 100KB and ( - pe.exports("_foo@0") or - 1 of ($x*) or - 6 of them - ) -} - -rule APT17_Unsigned_Symantec_Binary_EFA { - meta: - description = "Detects APT17 malware" - author = "Florian Roth" - reference = "https://goo.gl/puVc9q" - date = "2017-10-03" - hash1 = "128aca58be325174f0220bd7ca6030e4e206b4378796e82da460055733bb6f4f" - strings: - $s1 = "Copyright (c) 2007 - 2011 Symantec Corporation" fullword wide - $s2 = "\\\\.\\SYMEFA" fullword wide - condition: - ( uint16(0) == 0x5a4d and filesize < 200KB and all of them and pe.number_of_signatures == 0 ) -} - -rule APT17_Malware_Oct17_Gen { - meta: - description = "Detects APT17 malware" - author = "Florian Roth" - reference = "https://goo.gl/puVc9q" - date = "2017-10-03" - hash1 = "0375b4216334c85a4b29441a3d37e61d7797c2e1cb94b14cf6292449fb25c7b2" - hash2 = "07f93e49c7015b68e2542fc591ad2b4a1bc01349f79d48db67c53938ad4b525d" - hash3 = "ee362a8161bd442073775363bf5fa1305abac2ce39b903d63df0d7121ba60550" - strings: - $x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)" fullword ascii - $x2 = "http://%s/imgres?q=A380&hl=en-US&sa=X&biw=1440&bih=809&tbm=isus&tbnid=aLW4-J8Q1lmYBM" ascii - - $s1 = "hWritePipe2 Error:%d" fullword ascii - $s2 = "Not Support This Function!" fullword ascii - $s3 = "Cookie: SESSIONID=%s" fullword ascii - $s4 = "http://0.0.0.0/1" fullword ascii - $s5 = "Content-Type: image/x-png" fullword ascii - $s6 = "Accept-Language: en-US" fullword ascii - $s7 = "IISCMD Error:%d" fullword ascii - $s8 = "[IISEND=0x%08X][Recv:] 0x%08X %s" fullword ascii - condition: - ( uint16(0) == 0x5a4d and filesize < 200KB and ( - pe.imphash() == "414bbd566b700ea021cfae3ad8f4d9b9" or - 1 of ($x*) or - 6 of them - ) - ) -} diff --git a/signatures/apt_apt17_malware.yar b/signatures/apt_apt17_malware.yar deleted file mode 100644 index 503649a..0000000 --- a/signatures/apt_apt17_malware.yar +++ /dev/null @@ -1,34 +0,0 @@ -/* - Yara Rule Set - Author: Florian Roth - Date: 2015-05-14 - Identifier: APT17 -*/ - -/* Rule Set ----------------------------------------------------------------- */ - -rule APT17_Sample_FXSST_DLL { - meta: - description = "Detects Samples related to APT17 activity - file FXSST.DLL" - author = "Florian Roth" - reference = "https://goo.gl/ZiJyQv" - date = "2015-05-14" - hash = "52f1add5ad28dc30f68afda5d41b354533d8bce3" - strings: - $x1 = "Microsoft? Windows? Operating System" fullword wide - $x2 = "fxsst.dll" fullword ascii - - $y1 = "DllRegisterServer" fullword ascii - $y2 = ".cSV" fullword ascii - - $s1 = "GetLastActivePopup" - $s2 = "Sleep" - $s3 = "GetModuleFileName" - $s4 = "VirtualProtect" - $s5 = "HeapAlloc" - $s6 = "GetProcessHeap" - $s7 = "GetCommandLine" - condition: - uint16(0) == 0x5a4d and filesize < 800KB and - ( all of ($x*) or all of ($y*) ) and all of ($s*) -} diff --git a/signatures/apt_apt19.yar b/signatures/apt_apt19.yar deleted file mode 100644 index a115196..0000000 --- a/signatures/apt_apt19.yar +++ /dev/null @@ -1,65 +0,0 @@ - -/* - Yara Rule Set - Author: Ian.Ahl@fireeye.com @TekDefense, modified by Florian Roth - Date: 2017-06-05 - Identifier: APT19 - Reference: https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html -*/ - -rule Beacon_K5om { - meta: - description = "Detects Meterpreter Beacon - file K5om.dll" - author = "Florian Roth" - reference = "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html" - date = "2017-06-07" - hash1 = "e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9" - strings: - $x1 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii - $x2 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii - $x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii - - $s1 = "Could not open process token: %d (%u)" fullword ascii - $s2 = "0fd00b.dll" fullword ascii - $s3 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii - $s4 = "Could not connect to pipe (%s): %d" fullword ascii - condition: - ( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 3 of them ) ) -} - -/* Rule Set ----------------------------------------------------------------- */ - -rule FE_LEGALSTRIKE_MACRO { - meta: - version=".1" - filetype="MACRO" - author="Ian.Ahl@fireeye.com @TekDefense - modified by Florian Roth" - date="2017-06-02" - description="This rule is designed to identify macros with the specific encoding used in the sample 30f149479c02b741e897cdb9ecd22da7." - strings: - // OBSFUCATION - $ob1 = "ChrW(114) & ChrW(101) & ChrW(103) & ChrW(115) & ChrW(118) & ChrW(114) & ChrW(51) & ChrW(50) & ChrW(46) & ChrW(101)" ascii wide - // wscript - $wsobj1 = "Set Obj = CreateObject(\"WScript.Shell\")" ascii wide - $wsobj2 = "Obj.Run " ascii wide - condition: - all of them -} - -rule FE_LEGALSTRIKE_RTF { - meta: - version=".1" - filetype="MACRO" - author="joshua.kim@FireEye. - modified by Florian Roth" - date="2017-06-02" - description="Rtf Phishing Campaign leveraging the CVE 2017-0199 exploit, to point to the domain 2bunnyDOTcom" - strings: - $lnkinfo = "4c0069006e006b0049006e0066006f" - $encoded1 = "4f4c45324c696e6b" - $encoded2 = "52006f006f007400200045006e007400720079" - $encoded3 = "4f0062006a0049006e0066006f" - $encoded4 = "4f006c0065" - $datastore = "\\*\\datastore" - condition: - uint32be(0) == 0x7B5C7274 and all of them -} diff --git a/signatures/apt_apt28.yar b/signatures/apt_apt28.yar deleted file mode 100644 index 2e7c6db..0000000 --- a/signatures/apt_apt28.yar +++ /dev/null @@ -1,94 +0,0 @@ -/* - Yara Rule Set - Author: YarGen Rule Generator - Date: 2015-06-02 - Identifier: APT28 -*/ - -/* Rule Set ----------------------------------------------------------------- */ - -rule APT28_CHOPSTICK { - meta: - description = "Detects a malware that behaves like CHOPSTICK mentioned in APT28 report" - author = "Florian Roth" - reference = "https://goo.gl/v3ebal" - date = "2015-06-02" - hash = "f4db2e0881f83f6a2387ecf446fcb4a4c9f99808" - score = 60 - strings: - $s0 = "jhuhugit.tmp" fullword ascii /* score: '14.005' */ - $s8 = "KERNEL32.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 14405 times */ - $s9 = "IsDebuggerPresent" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 3518 times */ - $s10 = "IsProcessorFeaturePresent" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 1383 times */ - $s11 = "TerminateProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 13081 times */ - $s13 = "DeleteFileA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 1384 times */ - $s15 = "GetProcessHeap" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 5875 times */ - $s16 = "!This program cannot be run in DOS mode." fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 20908 times */ - $s17 = "LoadLibraryA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 5461 times */ - condition: - uint16(0) == 0x5a4d and filesize < 722KB and all of them -} - -rule APT28_SourFace_Malware1 { - meta: - description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server." - author = "Florian Roth" - reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html" - date = "2015-06-01" - hash1 = "e2450dffa675c61aa43077b25b12851a910eeeb6" - hash2 = "d9c53adce8c35ec3b1e015ec8011078902e6800b" - score = 60 - strings: - $s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */ - $s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */ - $s2 = "\\chkdbg.log" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 62KB and all of them -} - -rule APT28_SourFace_Malware2 { - meta: - description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server." - author = "Florian Roth" - reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html" - date = "2015-06-01" - super_rule = 1 - hash0 = "367d40465fd1633c435b966fa9b289188aa444bc" - hash1 = "cf3220c867b81949d1ce2b36446642de7894c6dc" - hash2 = "ed48ef531d96e8c7360701da1c57e2ff13f12405" - hash3 = "682e49efa6d2549147a21993d64291bfa40d815a" - hash4 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca" - hash5 = "f5b3e98c6b5d65807da66d50bd5730d35692174d" - score = 60 - strings: - $s0 = "coreshell.dll" fullword ascii /* PEStudio Blacklist: strings */ - $s1 = "Applicate" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 550KB and all of them -} - -rule APT28_SourFace_Malware3 { - meta: - description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server." - author = "Florian Roth" - reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html" - date = "2015-06-01" - super_rule = 1 - hash0 = "85522190958c82589fa290c0835805f3d9a2f8d6" - hash1 = "d9c53adce8c35ec3b1e015ec8011078902e6800b" - hash2 = "367d40465fd1633c435b966fa9b289188aa444bc" - hash3 = "d87b310aa81ae6254fff27b7d57f76035f544073" - hash4 = "cf3220c867b81949d1ce2b36446642de7894c6dc" - hash5 = "ed48ef531d96e8c7360701da1c57e2ff13f12405" - hash6 = "682e49efa6d2549147a21993d64291bfa40d815a" - hash7 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca" - hash8 = "f5b3e98c6b5d65807da66d50bd5730d35692174d" - hash9 = "e2450dffa675c61aa43077b25b12851a910eeeb6" - score = 60 - strings: - $s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */ - $s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */ - condition: - uint16(0) == 0x5a4d and filesize < 550KB and all of them -} - diff --git a/signatures/apt_apt29_grizzly_steppe.yar b/signatures/apt_apt29_grizzly_steppe.yar deleted file mode 100644 index d9c9aa3..0000000 --- a/signatures/apt_apt29_grizzly_steppe.yar +++ /dev/null @@ -1,105 +0,0 @@ -/* - Yara Rule Set - Author: Florian Roth - Date: 2016-12-29 - Identifier: GRIZZLY STEPPE -*/ - -/* Rule Set ----------------------------------------------------------------- */ - -rule GRIZZLY_STEPPE_Malware_1 { - meta: - description = "Auto-generated rule - file HRDG022184_certclint.dll" - author = "Florian Roth" - reference = "https://goo.gl/WVflzO" - date = "2016-12-29" - hash1 = "9f918fb741e951a10e68ce6874b839aef5a26d60486db31e509f8dcaa13acec5" - strings: - $s1 = "S:\\Lidstone\\renewing\\HA\\disable\\In.pdb" fullword ascii - $s2 = "Repeat last find command)Replace specific text with different text" fullword wide - $s3 = "l\\Processor(0)\\% Processor Time" fullword wide - $s6 = "Self Process" fullword wide - $s7 = "Default Process" fullword wide - $s8 = "Star Polk.exe" fullword wide - condition: - ( uint16(0) == 0x5a4d and filesize < 300KB and 4 of them ) -} - -rule GRIZZLY_STEPPE_Malware_2 { - meta: - description = "Auto-generated rule - file 9acba7e5f972cdd722541a23ff314ea81ac35d5c0c758eb708fb6e2cc4f598a0" - author = "Florian Roth" - reference = "https://goo.gl/WVflzO" - date = "2016-12-29" - hash1 = "9acba7e5f972cdd722541a23ff314ea81ac35d5c0c758eb708fb6e2cc4f598a0" - hash2 = "55058d3427ce932d8efcbe54dccf97c9a8d1e85c767814e34f4b2b6a6b305641" - strings: - $x1 = "GoogleCrashReport.dll" fullword ascii - - $s1 = "CrashErrors" fullword ascii - $s2 = "CrashSend" fullword ascii - $s3 = "CrashAddData" fullword ascii - $s4 = "CrashCleanup" fullword ascii - $s5 = "CrashInit" fullword ascii - condition: - ( uint16(0) == 0x5a4d and filesize < 1000KB and $x1 ) or ( all of them ) -} - -rule PAS_TOOL_PHP_WEB_KIT_mod { - meta: - description = "Detects PAS Tool PHP Web Kit" - reference = "https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity" - author = "US CERT - modified by Florian Roth due to performance reasons" - date = "2016/12/29" - strings: - $php = " 10KB and filesize < 30KB) and - #cookie == 2 and - #isset == 3 and - all of them -} - -rule WebShell_PHP_Web_Kit_v3 { - meta: - description = "Detects PAS Tool PHP Web Kit" - reference = "https://github.com/wordfence/grizzly" - author = "Florian Roth" - date = "2016/01/01" - strings: - $php = " 8KB and filesize < 100KB and - all of ($s*) -} - -rule WebShell_PHP_Web_Kit_v4 { - meta: - description = "Detects PAS Tool PHP Web Kit" - reference = "https://github.com/wordfence/grizzly" - author = "Florian Roth" - date = "2016/01/01" - strings: - $php = " 8KB and filesize < 100KB and - 2 of ($s*) -} diff --git a/signatures/apt_apt30_backspace.yar b/signatures/apt_apt30_backspace.yar deleted file mode 100644 index e0c9959..0000000 --- a/signatures/apt_apt30_backspace.yar +++ /dev/null @@ -1,1141 +0,0 @@ -/* - Yara Rule to detect Backspace Malware mentioned in FireEye APT30 Report - https://www.fireeye.com/blog/threat-research/2015/04/apt_30_and_the_mecha.html - - 13.04.2015 - v1.0 - please report back false positives via the 'issue' section of the LOKI github page -*/ - -rule APT30_Generic_H { - meta: - description = "FireEye APT30 Report Sample - file db3e5c2f2ce07c2d3fa38d6fc1ceb854" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash1 = "2a4c8752f3e7fde0139421b8d5713b29c720685d" - hash2 = "4350e906d590dca5fcc90ed3215467524e0a4e3d" - strings: - $s0 = "\\Temp1020.txt" fullword ascii - $s1 = "Xmd.Txe" fullword ascii - $s2 = "\\Internet Exp1orer" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_2 { - meta: - description = "FireEye APT30 Report Sample - file c4dec6d69d8035d481e4f2c86f580e81" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "0359ffbef6a752ee1a54447b26e272f4a5a35167" - strings: - $s0 = "ForZRLnkWordDlg.EXE" fullword wide - $s1 = "ForZRLnkWordDlg Microsoft " fullword wide - $s9 = "ForZRLnkWordDlg 1.0 " fullword wide - $s11 = "ForZRLnkWordDlg" fullword wide - $s12 = " (C) 2011" fullword wide - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_3 { - meta: - description = "FireEye APT30 Report Sample - file 59e055cee87d8faf6f701293e5830b5a" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "d0320144e65c9af0052f8dee0419e8deed91b61b" - strings: - $s5 = "Software\\Mic" ascii - $s6 = "HHOSTR" ascii - $s9 = "ThEugh" fullword ascii - $s10 = "Moziea/" ascii - $s12 = "%s%s(X-" ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_C { - meta: - description = "FireEye APT30 Report Sample - file 0c4fcef3b583d0ffffc2b14b9297d3a4" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash1 = "8667f635fe089c5e2c666b3fe22eaf3ff8590a69" - hash2 = "0c4fcef3b583d0ffffc2b14b9297d3a4" - hash3 = "37aee58655f5859e60ece6b249107b87" - hash4 = "4154548e1f8e9e7eb39d48a4cd75bcd1" - hash5 = "a2e0203e665976a13cdffb4416917250" - hash6 = "b4ae0004094b37a40978ef06f311a75e" - hash7 = "e39756bc99ee1b05e5ee92a1cdd5faf4" - strings: - $s0 = "MYUSER32.dll" fullword ascii - $s1 = "MYADVAPI32.dll" fullword ascii - $s2 = "MYWSOCK32.dll" fullword ascii - $s3 = "MYMSVCRT.dll" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_4 { - meta: - description = "FireEye APT30 Report Sample - file 6ba315275561d99b1eb8fc614ff0b2b3" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "75367d8b506031df5923c2d8d7f1b9f643a123cd" - strings: - $s0 = "GetStartupIn" ascii - $s1 = "enMutex" ascii - $s2 = "tpsvimi" ascii - $s3 = "reateProcesy" ascii - $s5 = "FreeLibr1y*S" ascii - $s6 = "foAModuleHand" ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_5 { - meta: - description = "FireEye APT30 Report Sample - file ebf42e8b532e2f3b19046b028b5dfb23" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "1a2dd2a0555dc746333e7c956c58f7c4cdbabd4b" - strings: - $s0 = "Version 4.7.3001" fullword wide - $s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide - $s3 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide - $s7 = "msmsgs" fullword wide - $s10 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_6 { - meta: - description = "FireEye APT30 Report Sample - file ee1b23c97f809151805792f8778ead74" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "00e69b059ad6b51b76bc476a115325449d10b4c0" - strings: - $s0 = "GreateProcessA" fullword ascii - $s1 = "Ternel32.dll" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_7 { - meta: - description = "FireEye APT30 Report Sample - file 74b87086887e0c67ffb035069b195ac7" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "868d1f4c106a08bd2e5af4f23139f0e0cd798fba" - strings: - $s0 = "datain" fullword ascii - $s3 = "C:\\Prog" ascii - $s4 = "$LDDATA$" ascii - $s5 = "Maybe a Encrypted Flash" fullword ascii - $s6 = "Jean-loup Gailly" ascii - $s8 = "deflate 1.1.3 Copyright" ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_E { - meta: - description = "FireEye APT30 Report Sample - file 8ff473bedbcc77df2c49a91167b1abeb" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash1 = "1dbb584e19499e26398fb0a7aa2a01b7" - hash2 = "572c9cd4388699347c0b2edb7c6f5e25" - hash3 = "8ff473bedbcc77df2c49a91167b1abeb" - hash4 = "a813eba27b2166620bd75029cc1f04b0" - hash5 = "b5546842e08950bc17a438d785b5a019" - strings: - $s0 = "Nkfvtyvn}" ascii - $s6 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_8 { - meta: - description = "FireEye APT30 Report Sample - file 44b98f22155f420af4528d17bb4a5ec8" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "9531e21652143b8b129ab8c023dc05fef2a17cc3" - strings: - $s0 = "ateProcessA" ascii - $s1 = "Ternel32.dllFQ" fullword ascii - $s2 = "StartupInfoAModuleHand" fullword ascii - $s3 = "OpenMutex" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_B { - meta: - description = "FireEye APT30 Report Sample - file 29395c528693b69233c1c12bef8a64b3" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash1 = "0fcb4ffe2eb391421ec876286c9ddb6c" - hash2 = "29395c528693b69233c1c12bef8a64b3" - hash3 = "4c6b21e98ca03e0ef0910e07cef45dac" - hash4 = "550459b31d8dabaad1923565b7e50242" - hash5 = "65232a8d555d7c4f7bc0d7c5da08c593" - hash6 = "853a20f5fc6d16202828df132c41a061" - hash7 = "ed151602dea80f39173c2f7b1dd58e06" - strings: - $s2 = "Moziea/4.0" ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_I { - meta: - description = "FireEye APT30 Report Sample - file fe211c7a081c1dac46e3935f7c614549" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash1 = "fe211c7a081c1dac46e3935f7c614549" - hash2 = "8c9db773d387bf9b3f2b6a532e4c937c" - strings: - $s0 = "Copyright 2012 Google Inc. All rights reserved." fullword wide - $s1 = "(Prxy%c-%s:%u)" fullword ascii - $s2 = "Google Inc." fullword wide - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_9 { - meta: - description = "FireEye APT30 Report Sample - file e3ae3cbc024e39121c87d73e87bb2210" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "442bf8690401a2087a340ce4a48151c39101652f" - strings: - $s0 = "\\Windo" ascii - $s2 = "oHHOSTR" ascii - $s3 = "Softwa]\\Mic" ascii - $s4 = "Startup'T" ascii - $s6 = "Ora\\%^" ascii - $s7 = "\\Ohttp=r" ascii - $s17 = "help32Snapshot0L" ascii - $s18 = "TimUmoveH" ascii - $s20 = "WideChc[lobalAl" ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} -rule APT30_Sample_10 { - meta: - description = "FireEye APT30 Report Sample - file 8c713117af4ca6bbd69292a78069e75b" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "eb518cda3c4f4e6938aaaee07f1f7db8ee91c901" - strings: - $s0 = "Version 4.7.3001" fullword wide - $s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide - $s2 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide - $s3 = "!! Use Connect Method !!" fullword ascii - $s4 = "(Prxy%c-%s:%u)" fullword ascii - $s5 = "msmsgs" fullword wide - $s18 = "(Prxy-No)" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_11 { - meta: - description = "FireEye APT30 Report Sample - file d97aace631d6f089595f5ce177f54a39" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "59066d5d1ee3ad918111ed6fcaf8513537ff49a6" - strings: - $s0 = "System\\CurrentControlSet\\control\\ComputerName\\ComputerName" fullword ascii - $s1 = "msofscan.exe" fullword wide - $s2 = "Mozilla/4.0 (compatible; MSIE 5.0; Win32)" fullword ascii - $s3 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide - $s4 = "Windows XP Professional x64 Edition or Windows Server 2003" fullword ascii - $s9 = "NetEagle_Scout - " fullword ascii - $s10 = "Server 4.0, Enterprise Edition" fullword ascii - $s11 = "Windows 3.1(Win32s)" fullword ascii - $s12 = "%s%s%s %s" fullword ascii - $s13 = "Server 4.0" fullword ascii - $s15 = "Windows Millennium Edition" fullword ascii - $s16 = "msofscan" fullword wide - $s17 = "Eagle-Norton360-OfficeScan" fullword ascii - $s18 = "Workstation 4.0" fullword ascii - $s19 = "2003 Microsoft Office system" fullword wide - condition: - filesize < 250KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_12 { - meta: - description = "FireEye APT30 Report Sample - file c95cd106c1fecbd500f4b97566d8dc96" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "b02b5720ff0f73f01eb2ba029a58b645c987c4bc" - strings: - $s0 = "Richic" fullword ascii - $s1 = "Accept: image/gif, */*" fullword ascii - $s2 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii - condition: - filesize < 250KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_13 { - meta: - description = "FireEye APT30 Report Sample - file 95bb314fe8fdbe4df31a6d23b0d378bc" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "a359f705a833c4a4254443b87645fd579aa94bcf" - strings: - $s0 = "msofscan.exe" fullword wide - $s1 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide - $s2 = "Microsoft Office Word Plugin Scan" fullword wide - $s3 = "? 2006 Microsoft Corporation. All rights reserved." fullword wide - $s4 = "msofscan" fullword wide - $s6 = "2003 Microsoft Office system" fullword wide - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_14 { - meta: - description = "FireEye APT30 Report Sample - file 6f931c15789d234881be8ae8ccfe33f4" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "b0740175d20eab79a5d62cdbe0ee1a89212a8472" - strings: - $s0 = "AdobeReader.exe" fullword wide - $s1 = "yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy" fullword ascii - $s4 = "10.1.7.27" fullword wide - $s5 = "Copyright 1984-2012 Adobe Systems Incorporated and its licensors. All ri" wide - $s8 = "Adobe Reader" fullword wide - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_15 { - meta: - description = "FireEye APT30 Report Sample - file e26a2afaaddfb09d9ede505c6f1cc4e3" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "7a8576804a2bbe4e5d05d1718f90b6a4332df027" - strings: - $s0 = "\\Windo" ascii - $s2 = "HHOSTR" ascii - $s3 = "Softwa]\\Mic" ascii - $s4 = "Startup'T" fullword ascii - $s17 = "help32Snapshot0L" fullword ascii - $s18 = "TimUmoveH" ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_16 { - meta: - description = "FireEye APT30 Report Sample - file 37e568bed4ae057e548439dc811b4d3a" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "066d06ac08b48d3382d46bbeda6ad411b6d6130e" - strings: - $s0 = "\\Temp1020.txt" fullword ascii - $s1 = "cmcbqyjs" fullword ascii - $s2 = "SPVSWh\\" fullword ascii - $s4 = "PSShxw@" fullword ascii - $s5 = "VWhHw@" fullword ascii - $s7 = "SVWhHw@" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_A { - meta: - description = "FireEye APT30 Report Sample - file af1c1c5d8031c4942630b6a10270d8f4" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash1 = "9f49aa1090fa478b9857e15695be4a89f8f3e594" - hash2 = "396116cfb51cee090822913942f6ccf81856c2fb" - hash3 = "fef9c3b4b35c226501f7d60816bb00331a904d5b" - hash4 = "7c9a13f1fdd6452fb6d62067f958bfc5fec1d24e" - hash5 = "5257ba027abe3a2cf397bfcae87b13ab9c1e9019" - strings: - $s5 = "WPVWhhiA" fullword ascii - $s6 = "VPWVhhiA" fullword ascii - $s11 = "VPhhiA" fullword ascii - $s12 = "uUhXiA" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_17 { - meta: - description = "FireEye APT30 Report Sample - file 23813c5bf6a7af322b40bd2fd94bd42e" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "c3aa52ff1d19e8fc6704777caf7c5bd120056845" - strings: - $s1 = "Nkfvtyvn}]ty}ztU" fullword ascii - $s4 = "IEXPL0RE" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} -rule APT30_Sample_18 { - meta: - description = "FireEye APT30 Report Sample - file b2138a57f723326eda5a26d2dec56851" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "355436a16d7a2eba8a284b63bb252a8bb1644751" - strings: - $s0 = "w.km-nyc.com" fullword ascii - $s1 = "tscv.exe" fullword ascii - $s2 = "Exit/app.htm" ascii - $s3 = "UBD:\\D" ascii - $s4 = "LastError" ascii - $s5 = "MicrosoftHaveAck" ascii - $s7 = "HHOSTR" ascii - $s20 = "XPL0RE." ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_G { - meta: - description = "FireEye APT30 Report Sample - file 53f1358cbc298da96ec56e9a08851b4b" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "1612b392d6145bfb0c43f8a48d78c75f" - hash = "53f1358cbc298da96ec56e9a08851b4b" - hash = "c2acc9fc9b0f050ec2103d3ba9cb11c0" - hash = "f18be055fae2490221c926e2ad55ab11" - strings: - $s0 = "%s\\%s\\%s=%s" fullword ascii - $s1 = "Copy File %s OK!" fullword ascii - $s2 = "%s Space:%uM,FreeSpace:%uM" fullword ascii - $s4 = "open=%s" fullword ascii - $s5 = "Maybe a Encrypted Flash Disk" fullword ascii - $s12 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_19 { - meta: - description = "FireEye APT30 Report Sample - file 5d4f2871fd1818527ebd65b0ff930a77" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "cfa438449715b61bffa20130df8af778ef011e15" - strings: - $s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii - $s1 = "%s,Volume:%s,Type:%s,TotalSize:%uMB,FreeSize:%uMB" fullword ascii - $s2 = "\\TEMP\\" fullword ascii - $s3 = "\\Temporary Internet Files\\" fullword ascii - $s5 = "%s TotalSize:%u Bytes" fullword ascii - $s6 = "This Disk Maybe a Encrypted Flash Disk!" fullword ascii - $s7 = "User:%-32s" fullword ascii - $s8 = "\\Desktop\\" fullword ascii - $s9 = "%s.%u_%u" fullword ascii - $s10 = "Nick:%-32s" fullword ascii - $s11 = "E-mail:%-32s" fullword ascii - $s13 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii - $s14 = "Type:%-8s" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and 8 of them -} - -rule APT30_Generic_E_v2 { - meta: - description = "FireEye APT30 Report Sample - file 71f25831681c19ea17b2f2a84a41bbfb" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "eca53a9f6251ddf438508b28d8a483f91b99a3fd" - strings: - $s0 = "Nkfvtyvn}duf_Z}{Ys" fullword ascii - $s1 = "Nkfvtyvn}*Zrswru1i" fullword ascii - $s2 = "Nkfvtyvn}duf_Z}{V" fullword ascii - $s3 = "Nkfvtyvn}*ZrswrumT\\b" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_20 { - meta: - description = "FireEye APT30 Report Sample - file 5ae51243647b7d03a5cb20dccbc0d561" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "b1c37632e604a5d1f430c9351f87eb9e8ea911c0" - strings: - $s0 = "dizhi.gif" fullword ascii - $s2 = "Mozilla/u" ascii - $s3 = "XicrosoftHaveAck" ascii - $s4 = "flyeagles" ascii - $s10 = "iexplore." ascii - $s13 = "WindowsGV" fullword ascii - $s16 = "CatePipe" fullword ascii - $s17 = "'QWERTY:/webpage3" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_21 { - meta: - description = "FireEye APT30 Report Sample - file 78c4fcee5b7fdbabf3b9941225d95166" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "d315daa61126616a79a8582145777d8a1565c615" - strings: - $s0 = "Service.dll" fullword ascii - $s1 = "(%s:%s %s)" fullword ascii - $s2 = "%s \"%s\",%s %s" fullword ascii - $s5 = "Proxy-%s:%u" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_22 { - meta: - description = "FireEye APT30 Report Sample - file fad06d7b4450c4631302264486611ec3" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "0d17a58c24753e5f8fd5276f62c8c7394d8e1481" - strings: - $s1 = "(\\TEMP" fullword ascii - $s2 = "Windows\\Cur" fullword ascii - $s3 = "LSSAS.exeJ" fullword ascii - $s4 = "QC:\\WINDOWS" fullword ascii - $s5 = "System Volume" fullword ascii - $s8 = "PROGRAM FILE" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_F { - meta: - description = "FireEye APT30 Report Sample - file 4c10a1efed25b828e4785d9526507fbc" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash1 = "09010917cd00dc8ddd21aeb066877aa2" - hash2 = "4c10a1efed25b828e4785d9526507fbc" - hash3 = "b7b282c9e3eca888cbdb5a856e07e8bd" - hash4 = "df1799845b51300b03072c6569ab96d5" - strings: - $s0 = "\\~zlzl.exe" fullword ascii - $s2 = "\\Internet Exp1orer" fullword ascii - $s3 = "NodAndKabIsExcellent" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_23 { - meta: - description = "FireEye APT30 Report Sample - file a5ca2c5b4d8c0c1bc93570ed13dcab1a" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "9865e24aadb4480bd3c182e50e0e53316546fc01" - strings: - $s0 = "hostid" ascii - $s1 = "\\Window" ascii - $s2 = "%u:%u%s" fullword ascii - $s5 = "S2tware\\Mic" ascii - $s6 = "la/4.0 (compa" ascii - $s7 = "NameACKernel" fullword ascii - $s12 = "ToWideChc[lo" fullword ascii - $s14 = "help32SnapshotfL" ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_24 { - meta: - description = "FireEye APT30 Report Sample - file 062fe1336459a851bd0ea271bb2afe35" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "572caa09f2b600daa941c60db1fc410bef8d1771" - strings: - $s1 = "dizhi.gif" fullword ascii - $s3 = "Mozilla/4.0" fullword ascii - $s4 = "lyeagles" fullword ascii - $s6 = "HHOSTR" ascii - $s7 = "#MicrosoftHaveAck7" ascii - $s8 = "iexplore." fullword ascii - $s17 = "ModuleH" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_25 { - meta: - description = "FireEye APT30 Report Sample - file c4c068200ad8033a0f0cf28507b51842" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "44a21c8b3147fabc668fee968b62783aa9d90351" - strings: - $s1 = "C:\\WINDOWS" fullword ascii - $s2 = "aragua" fullword ascii - $s4 = "\\driver32\\7$" fullword ascii - $s8 = "System V" fullword ascii - $s9 = "Compu~r" fullword ascii - $s10 = "PROGRAM L" fullword ascii - $s18 = "GPRTMAX" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_26 { - meta: - description = "FireEye APT30 Report Sample - file 428fc53c84e921ac518e54a5d055f54a" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "e26588113417bf68cb0c479638c9cd99a48e846d" - strings: - $s1 = "forcegue" fullword ascii - $s3 = "Windows\\Cur" fullword ascii - $s4 = "System Id" fullword ascii - $s5 = "Software\\Mic" fullword ascii - $s6 = "utiBy0ToWideCh&$a" fullword ascii - $s10 = "ModuleH" fullword ascii - $s15 = "PeekNamed6G" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_D { - meta: - description = "FireEye APT30 Report Sample - file 597805832d45d522c4882f21db800ecf" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash1 = "35dfb55f419f476a54241f46e624a1a4" - hash2 = "4fffcbdd4804f6952e0daf2d67507946" - hash3 = "597805832d45d522c4882f21db800ecf" - hash4 = "6bd422d56e85024e67cc12207e330984" - hash5 = "82e13f3031130bd9d567c46a9c71ef2b" - hash6 = "b79d87ff6de654130da95c73f66c15fa" - strings: - $s0 = "Windows Security Service Feedback" fullword wide - $s1 = "wssfmgr.exe" fullword wide - $s2 = "\\rb.htm" fullword ascii - $s3 = "rb.htm" fullword ascii - $s4 = "cook5" ascii - $s5 = "5, 4, 2600, 0" fullword wide - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_27 { - meta: - description = "FireEye APT30 Report Sample - file d38e02eac7e3b299b46ff2607dd0f288" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "959573261ca1d7e5ddcd19447475b2139ca24fe1" - strings: - $s0 = "Mozilla/4.0" fullword ascii - $s1 = "dizhi.gif" fullword ascii - $s5 = "oftHaveAck+" ascii - $s10 = "HlobalAl" fullword ascii - $s13 = "$NtRND1$" fullword ascii - $s14 = "_NStartup" fullword ascii - $s16 = "GXSYSTEM" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_28 { - meta: - description = "FireEye APT30 Report Sample - file e62a63307deead5c9fcca6b9a2d51fb0" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash1 = "e62a63307deead5c9fcca6b9a2d51fb0" - hash2 = "5b590798da581c894d8a87964763aa8b" - strings: - $s0 = "www.flyeagles.com" fullword ascii - $s1 = "iexplore.exe" fullword ascii - $s2 = "www.km-nyc.com" fullword ascii - $s3 = "cmdLine.exe" fullword ascii - $s4 = "Software\\Microsoft\\CurrentNetInf" fullword ascii - $s5 = "/dizhi.gif" ascii - $s6 = "/connect.gif" ascii - $s7 = "USBTest.sys" fullword ascii - $s8 = "/ver.htm" fullword ascii - $s11 = "\\netscv.exe" fullword ascii - $s12 = "/app.htm" fullword ascii - $s13 = "\\netsvc.exe" fullword ascii - $s14 = "/exe.htm" fullword ascii - $s18 = "MicrosoftHaveAck" fullword ascii - $s19 = "MicrosoftHaveExit" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and 7 of them -} - -rule APT30_Sample_29 { - meta: - description = "FireEye APT30 Report Sample - file 1b81b80ff0edf57da2440456d516cc90" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "44492c53715d7c79895904543843a321491cb23a" - strings: - $s0 = "LSSAS.exe" fullword ascii - $s1 = "Software\\Microsoft\\FlashDiskInf" fullword ascii - $s2 = ".petite" fullword ascii - $s3 = "MicrosoftFlashExit" fullword ascii - $s4 = "MicrosoftFlashHaveExit" fullword ascii - $s5 = "MicrosoftFlashHaveAck" fullword ascii - $s6 = "\\driver32" fullword ascii - $s7 = "MicrosoftFlashZJ" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_30 { - meta: - description = "FireEye APT30 Report Sample - file bf8616bbed6d804a3dea09b230c2ab0c" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "3b684fa40b4f096e99fbf535962c7da5cf0b4528" - strings: - $s0 = "5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)" fullword wide - $s3 = "RnhwtxtkyLRRMf{jJ}ny" fullword ascii - $s4 = "RnhwtxtkyLRRJ}ny" fullword ascii - $s5 = "ZRLDownloadToFileA" fullword ascii - $s9 = "5.1.2600.2180" fullword wide - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_31 { - meta: - description = "FireEye APT30 Report Sample - file d8e68db503f4155ed1aeba95d1f5e3e4" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "8b4271167655787be1988574446125eae5043aca" - strings: - $s0 = "\\ZJRsv.tem" fullword ascii - $s1 = "forceguest" fullword ascii - $s4 = "\\$NtUninstallKB570317$" fullword ascii - $s8 = "[Can'tGetIP]" fullword ascii - $s14 = "QWERTY:,`/" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_J { - meta: - description = "FireEye APT30 Report Sample - file baff5262ae01a9217b10fcd5dad9d1d5" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash1 = "49aca228674651cba776be727bdb7e60" - hash2 = "5c7a6b3d1b85fad17333e02608844703" - hash3 = "649fa64127fef1305ba141dd58fb83a5" - hash4 = "9982fd829c0048c8f89620691316763a" - hash5 = "baff5262ae01a9217b10fcd5dad9d1d5" - hash6 = "9982fd829c0048c8f89620691316763a" - strings: - $s0 = "Launcher.EXE" fullword wide - $s1 = "Symantec Security Technologies" fullword wide - $s2 = "\\Symantec LiveUpdate.lnk" fullword ascii - $s3 = "Symantec Service Framework" fullword wide - $s4 = "\\ccSvcHst.exe" fullword ascii - $s5 = "\\wssfmgr.exe" fullword ascii - $s6 = "Symantec Corporation" fullword wide - $s7 = "\\5.1.0.29" fullword ascii - $s8 = "\\Engine" fullword ascii - $s9 = "Copyright (C) 2000-2010 Symantec Corporation. All rights reserved." fullword wide - $s10 = "Symantec LiveUpdate" fullword ascii - $s11 = "\\Norton360" fullword ascii - $s15 = "BinRes" fullword ascii - $s16 = "\\readme.lz" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Microfost { - meta: - description = "FireEye APT30 Report Sample - file 310a4a62ba3765cbf8e8bbb9f324c503" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "57169cb4b8ef7a0d7ebd7aa039d1a1efd6eb639e" - strings: - $s1 = "Copyright (c) 2007 Microfost All Rights Reserved" fullword wide - $s2 = "Microfost" fullword wide - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_K { - meta: - description = "FireEye APT30 Report Sample - file b5a343d11e1f7340de99118ce9fc1bbb" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "142bc01ad412799a7f9ffed994069fecbd5a2f93" - strings: - $x1 = "Maybe a Encrypted Flash" fullword ascii - - $s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii - $s1 = "\\TEMP\\" fullword ascii - $s2 = "\\Temporary Internet Files\\" fullword ascii - $s5 = "%s Size:%u Bytes" fullword ascii - $s7 = "$.DATA$" fullword ascii - $s10 = "? Size:%u By s" fullword ascii - $s12 = "Maybe a Encrypted Flash" fullword ascii - $s14 = "Name:%-32s" fullword ascii - $s15 = "NickName:%-32s" fullword ascii - $s19 = "Email:%-32s" fullword ascii - $s21 = "C:\\Prog" ascii - $s22 = "$LDDATA$" ascii - $s31 = "Copy File %s OK!" fullword ascii - $s32 = "%s Space:%uM,FreeSpace:%uM" fullword ascii - $s34 = "open=%s" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and ( all of ($x*) and 3 of ($s*) ) -} - -rule APT30_Sample_33 { - meta: - description = "FireEye APT30 Report Sample - file 5eaf3deaaf2efac92c73ada82a651afe" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "72c568ee2dd75406858c0294ccfcf86ad0e390e4" - strings: - $s0 = "Version 4.7.3001" fullword wide - $s1 = "msmsgr.exe" fullword wide - $s2 = "MYUSER32.dll" fullword ascii - $s3 = "MYADVAPI32.dll" fullword ascii - $s4 = "CeleWare.NET1" fullword ascii - $s6 = "MYMSVCRT.dll" fullword ascii - $s7 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the" wide - $s8 = "WWW.CeleWare.NET1" ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and 6 of them -} - -rule APT30_Sample_34 { - meta: - description = "FireEye APT30 Report Sample - file a9e8e402a7ee459e4896d0ba83543684" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "216868edbcdd067bd2a9cce4f132d33ba9c0d818" - strings: - $s0 = "dizhi.gif" ascii - $s1 = "eagles.vip.nse" ascii - $s4 = "o%S:S0" ascii - $s5 = "la/4.0" ascii - $s6 = "s#!<4!2>s02==<'s1" ascii - $s7 = "HlobalAl" ascii - $s9 = "vcMicrosoftHaveAck7" ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_35 { - meta: - description = "FireEye APT30 Report Sample - file 414854a9b40f7757ed7bfc6a1b01250f" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "df48a7cd6c4a8f78f5847bad3776abc0458499a6" - strings: - $s0 = "WhBoyIEXPLORE.EXE.exe" fullword ascii - $s5 = "Startup>A" fullword ascii - $s18 = "olhelp32Snapshot" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Sample_1 { - meta: - description = "FireEye APT30 Report Sample - file 4c6b21e98ca03e0ef0910e07cef45dac" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - hash = "8cea83299af8f5ec6c278247e649c9d91d4cf3bc" - strings: - $s0 = "#hostid" fullword ascii - $s1 = "\\Windows\\C" ascii - $s5 = "TimUmove" fullword ascii - $s6 = "Moziea/4.0 (c" fullword ascii - $s7 = "StartupNA" fullword ascii - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_1 { - meta: - description = "FireEye APT30 Report Sample" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - super_rule = 1 - hash0 = "aaa5c64200ff0818c56ebe4c88bcc1143216c536" - hash1 = "cb4263cab467845dae9fae427e3bbeb31c6a14c2" - hash2 = "b69b95db8a55a050d6d6c0cba13d73975b8219ca" - hash3 = "5c29e21bbe8873778f9363258f5e570dddcadeb9" - hash4 = "d5cb07d178963f2dea2c754d261185ecc94e09d6" - hash5 = "626dcdd7357e1f8329e9137d0f9883f57ec5c163" - hash6 = "843997b36ed80d3aeea3c822cb5dc446b6bfa7b9" - strings: - $s0 = "%s\\%s.txt" fullword - $s1 = "\\ldsysinfo.txt" fullword - $s4 = "(Extended Wansung)" fullword - $s6 = "Computer Name:" fullword - $s7 = "%s %uKB %04u-%02u-%02u %02u:%02u" fullword - $s8 = "ASSAMESE" fullword - $s9 = "BELARUSIAN" fullword - $s10 = "(PR China)" fullword - $s14 = "(French)" fullword - $s15 = "AdvancedServer" fullword - $s16 = "DataCenterServer" fullword - $s18 = "(Finland)" fullword - $s19 = "%s %04u-%02u-%02u %02u:%02u" fullword - $s20 = "(Chile)" fullword - condition: - filesize < 250KB and uint16(0) == 0x5A4D and all of them -} -rule APT30_Generic_2 { - meta: - description = "FireEye APT30 Report Sample - from many files" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - super_rule = 1 - hash0 = "aba8b9fa213e5e2f1f0404d13fecc20ea8651b57" - hash1 = "7f11f5c9475240e5dd2eea7726c9229972cffc1f" - hash2 = "94d3f91d1e50ecea729617729013c3d143bf2c3e" - hash3 = "7e516ec04f28c76d67b8111ddfe58bbd628362cc" - hash4 = "6b27bc0b0460b0a25b45d897ed4f399106c284d9" - hash5 = "6df5b4b3da0964153bad22fb1f69483ae8316655" - hash6 = "b68bce61dfd8763c3003480ba4066b3cb1ef126e" - hash7 = "cc124682246d098740cfa7d20aede850d49b6597" - hash8 = "1ef415bca310575944934fc97b0aa720943ba512" - hash9 = "0559ab9356dcc869da18b2c96f48b76478c472b3" - hash10 = "f15272042a4f9324ad5de884bd50f4072f4bdde3" - hash11 = "1d93d5f5463cdf85e3c22c56ed1381957f4efaac" - hash12 = "b6f1fb0f8a2fb92a3c60e154f24cfbca1984529f" - hash13 = "9967a99a1b627ddb6899919e32a0f544ea498b48" - hash14 = "95a3c812ca0ad104f045b26c483495129bcf37ca" - hash15 = "bde9a72b2113d18b4fa537cc080d8d8ba1a231e8" - hash16 = "ce1f53e06feab1e92f07ed544c288bf39c6fce19" - hash17 = "72dae031d885dbf492c0232dd1c792ab4785a2dc" - hash18 = "a2ccba46e40d0fb0dd3e1dba160ecbb5440862ec" - hash19 = "c8007b59b2d495029cdf5b7b8fc8a5a1f7aa7611" - hash20 = "9c6f470e2f326a055065b2501077c89f748db763" - hash21 = "af3e232559ef69bdf2ee9cd96434dcec58afbe5a" - hash22 = "e72e67ba32946c2702b7662c510cc1242cffe802" - hash23 = "8fc0b1618b61dce5f18eba01809301cb7f021b35" - hash24 = "6a8159da055dac928ba7c98ea1cdbe6dfb4a3c22" - hash25 = "47463412daf0b0a410d3ccbb7ea294db5ff42311" - hash26 = "e6efa0ccfddda7d7d689efeb28894c04ebc72be2" - hash27 = "43a3fc9a4fee43252e9a570492e4efe33043e710" - hash28 = "7406ebef11ca9f97c101b37f417901c70ab514b1" - hash29 = "53ed9b22084f89b4b595938e320f20efe65e0409" - strings: - $s0 = "%s\\%s\\KB985109.log" fullword - $s1 = "%s\\%s\\KB989109.log" fullword - $s2 = "Opera.exe" fullword wide - $s3 = "%s:All online success on %u!" fullword - $s4 = "%s:list online success on %u!" fullword - $s5 = "%s:All online fail!" fullword - $s6 = "Copyright Opera Software 1995-" fullword wide - $s7 = "%s:list online fail!" fullword - $s8 = "OnlineTmp.txt" fullword - $s9 = "Opera Internet Browser" fullword wide - $s12 = "Opera Software" fullword wide - $s15 = "Check lan have done!!!" fullword - $s16 = "List End." fullword - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_3 { - meta: - description = "FireEye APT30 Report Sample" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - super_rule = 1 - hash0 = "b90ac3e58ed472829e2562023e6e892d2d61ac44" - hash1 = "342036ace2e9e6d504b0dec6399e4fa92de46c12" - hash2 = "5cdf397dfd9eb66ff5ff636777f6982c1254a37a" - strings: - $s0 = "Acrobat.exe" fullword wide - $s14 = "********************************" fullword - $s16 = "FFFF:>>>>>>>>>>>>>>>>>@" fullword - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_4 { - meta: - description = "FireEye APT30 Report Sample" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - super_rule = 1 - hash0 = "bb390f99bfde234bbed59f6a0d962ba874b2396c" - hash1 = "b47e20ac5889700438dc241f28f4e224070810d2" - hash2 = "a9a50673ac000a313f3ddba55d63d9773b9f4143" - hash3 = "ac96d7f5957aef09bd983465c497de24c6d17a92" - strings: - $s0 = "del NetEagle_Scout.bat" fullword - $s1 = "NetEagle_Scout.bat" fullword - $s2 = "\\visit.exe" fullword - $s3 = "\\System.exe" fullword - $s4 = "\\System.dat" fullword - $s5 = "\\ieupdate.exe" fullword - $s6 = "GOTO ERROR" fullword - $s7 = ":ERROR" fullword - $s9 = "IF EXIST " fullword - $s10 = "ioiocn" fullword - $s11 = "SetFileAttribute" fullword - $s12 = "le_0*^il" fullword - $s13 = "le_.*^il" fullword - $s14 = "le_-*^il" fullword - condition: - filesize < 250KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_5 { - meta: - description = "FireEye APT30 Report Sample" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - super_rule = 1 - hash0 = "cb4833220c508182c0ccd4e0d5a867d6c4e675f8" - hash1 = "dfc9a87df2d585c479ab02602133934b055d156f" - hash2 = "bf59d5ff7d38ec5ffb91296e002e8742baf24db5" - strings: - $s0 = "regsvr32 /s \"%ProgramFiles%\\Norton360\\Engine\\5.1.0.29\\ashelper.dll\"" fullword - $s1 = "name=\"ftpserver.exe\"/>" fullword - $s2 = "LiveUpdate.EXE" fullword wide - $s3 = "FTP Explorer" fullword - $s4 = "\\ashelper.dll" fullword - $s5 = "LiveUpdate" fullword wide - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_6 { - meta: - description = "FireEye APT30 Report Sample" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - super_rule = 1 - hash0 = "b9aafb575d3d1732cb8fdca5ea226cebf86ea3c9" - hash1 = "2c5e347083b77c9ead9e75d41e2fabe096460bba" - hash2 = "5d39a567b50c74c4a921b5f65713f78023099933" - strings: - $s0 = "GetStar" fullword - $s1 = ".rdUaS" fullword - $s2 = "%sOTwp/&A\\L" fullword - $s3 = "a Encrt% Flash Disk" fullword - $s4 = "ypeAutoRuChec" fullword - $s5 = "NoDriveT" fullword - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_7 { - meta: - description = "FireEye APT30 Report Sample" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - super_rule = 1 - hash0 = "2415f661046fdbe3eea8cd276b6f13354019b1a6" - hash1 = "e814914079af78d9f1b71000fee3c29d31d9b586" - hash2 = "0263de239ccef669c47399856d481e3361408e90" - strings: - $s1 = "Xjapor_*ata" fullword - $s2 = "Xjapor_o*ata" fullword - $s4 = "Ouopai" fullword - condition: - filesize < 100KB and uint16(0) == 0x5A4D and all of them -} -rule APT30_Generic_8 { - meta: - description = "FireEye APT30 Report Sample" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - super_rule = 1 - hash0 = "b47e20ac5889700438dc241f28f4e224070810d2" - hash1 = "a9a50673ac000a313f3ddba55d63d9773b9f4143" - hash2 = "ac96d7f5957aef09bd983465c497de24c6d17a92" - strings: - $s0 = "Windows NT4.0" fullword - $s1 = "Windows NT3.51" fullword - $s2 = "%d;%d;%d;%ld;%ld;%ld;" fullword - $s3 = "%s %d.%d Build%d %s" fullword - $s4 = "MSAFD Tcpip [TCP/IP]" fullword - $s5 = "SQSRSS" fullword - $s8 = "WM_COMP" fullword - $s9 = "WM_MBU" fullword - $s11 = "WM_GRID" fullword - $s12 = "WM_RBU" fullword - condition: - filesize < 250KB and uint16(0) == 0x5A4D and all of them -} - -rule APT30_Generic_9 { - meta: - description = "FireEye APT30 Report Sample" - author = "Florian Roth" - reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf" - date = "2015/04/13" - super_rule = 1 - hash0 = "00d9949832dc3533592c2ce06a403ef19deddce9" - hash1 = "27a2b981d4c0bb8c3628bfe990db4619ddfdff74" - hash2 = "05f66492c163ec2a24c6a87c7a43028c5f632437" - hash3 = "263f094da3f64e72ef8dc3d02be4fb33de1fdb96" - strings: - $s0 = "%s\\%s\\$NtRecDoc$" fullword - $s1 = "%s(%u)%s" fullword - $s2 = "http://%s%s%s" fullword - $s3 = "1.9.1.17" fullword wide - $s4 = "(C)Firefox and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL" wide - condition: - filesize < 250KB and uint16(0) == 0x5A4D and all of them -} diff --git a/signatures/apt_apt34.yar b/signatures/apt_apt34.yar deleted file mode 100644 index 3f49837..0000000 --- a/signatures/apt_apt34.yar +++ /dev/null @@ -1,55 +0,0 @@ - -/* - Yara Rule Set - Author: Florian Roth - Date: 2017-12-07 - Identifier: APT 34 - Reference: https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html -*/ - -/* Rule Set ----------------------------------------------------------------- */ - -rule APT34_Malware_HTA { - meta: - description = "Detects APT 34 malware" - author = "Florian Roth" - reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html" - date = "2017-12-07" - hash1 = "f6fa94cc8efea0dbd7d4d4ca4cf85ac6da97ee5cf0c59d16a6aafccd2b9d8b9a" - strings: - $x1 = "WshShell.run \"cmd.exe /C C:\\ProgramData\\" ascii - $x2 = ".bat&ping 127.0.0.1 -n 6 > nul&wscript /b" ascii - $x3 = "cmd.exe /C certutil -f -decode C:\\ProgramData\\" ascii - $x4 = "a.WriteLine(\"set Shell0 = CreateObject(" ascii - $x5 = "& vbCrLf & \"Shell0.run" ascii - - $s1 = "Blog.tkacprow.pl: HTA Hello World!" fullword ascii - $s2 = "" fullword ascii - condition: - filesize < 60KB and ( 1 of ($x*) or all of ($s*) ) -} - -rule APT34_Malware_Exeruner { - meta: - description = "Detects APT 34 malware" - author = "Florian Roth" - reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html" - date = "2017-12-07" - hash1 = "c75c85acf0e0092d688a605778425ba4cb2a57878925eee3dc0f4dd8d636a27a" - strings: - $x1 = "\\obj\\Debug\\exeruner.pdb" ascii - $x2 = "\"wscript.shell`\")`nShell0.run" wide - $x3 = "powershell.exe -exec bypass -enc \" + ${global:$http_ag} +" wide - $x4 = "/c powershell -exec bypass -window hidden -nologo -command " fullword wide - $x5 = "\\UpdateTasks\\JavaUpdatesTasksHosts\\" wide - $x6 = "schtasks /create /F /ru SYSTEM /sc minute /mo 1 /tn" wide - $x7 = "UpdateChecker.ps1 & ping 127.0.0.1" wide - $s8 = "exeruner.exe" fullword wide - $s9 = "${global:$address1} = $env:ProgramData + \"\\Windows\\Microsoft\\java\";" fullword wide - $s10 = "C:\\ProgramData\\Windows\\Microsoft\\java" fullword wide - $s11 = "function runByVBS" fullword wide - $s12 = "$84e31856-683b-41c0-81dd-a02d8b795026" fullword ascii - $s13 = "${global:$dns_ag} = \"aQBmACAAKAAoAEcAZQB0AC0AVwBtAGk" wide - condition: - uint16(0) == 0x5a4d and filesize < 100KB and 1 of them -} \ No newline at end of file diff --git a/signatures/apt_apt6_malware.yar b/signatures/apt_apt6_malware.yar deleted file mode 100644 index 8494804..0000000 --- a/signatures/apt_apt6_malware.yar +++ /dev/null @@ -1,54 +0,0 @@ -/* - Yara Rule Set - Author: Florian Roth - Date: 2016-04-09 - Identifier: APT 6 Malware -*/ - -rule APT6_Malware_Sample_Gen { - meta: - description = "Rule written for 2 malware samples that communicated to APT6 C2 servers" - author = "Florian Roth" - reference = "https://otx.alienvault.com/pulse/56c4d1664637f26ad04e5b73/" - date = "2016-04-09" - score = 80 - type = "file" - hash1 = "321ec239bfa6927d39155ef5f10741ed786219489bbbb1dc8fee66e22f9f8e80" - hash2 = "7aef130b19d1f940e4c4cee6efe0f190f1402d2e0f741ee605c77518a04cb6d7" - strings: - /* Specific strings from samples */ - $x2 = "SPCK!it is a [(?riddle?) wrapped in a {mystery}] inside an !" fullword ascii - $x3 = "636C7369643A46334430443336462D323346382D343638322D413139352D373443393242303344344146" fullword ascii - - /* Malware Strings */ - $s1 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" fullword ascii - $s2 = "DUMPTHIN" fullword ascii - $s3 = "\"C:\\WINDOWS\\system32\\" fullword ascii - $s4 = "window.eval(f.decodeURIComponent(a));" fullword ascii - $s5 = "/tbedrs.dll" fullword ascii - $s6 = "NSISDL/1.2 (Mozilla)" fullword ascii - $s7 = "NSIS_Inetc (Mozilla)" fullword ascii - $s8 = "/logos.gif" fullword ascii - $s9 = "synflood" fullword ascii - $s10 = "IconFile=C:\\WINDOWS\\system32\\SHELL32.dll" fullword ascii - $s11 = "udpflood" fullword ascii - $s12 = "shellcode" fullword ascii - $s13 = "&PassWord=" fullword ascii - $s14 = "SystemPropertiesProtection.exe" fullword ascii - $s15 = "SystemPropertiesRemote.exe" fullword ascii - - /* C2 Server user by APT 6 group */ - $c1 = "jobcall.org" ascii - $c2 = "sportsinfinite.com" ascii - $c3 = "milsatcom.us" ascii - $c4 = "geographicphotographer.com" ascii - $c5 = "snowsmooth.com" ascii - $c6 = "goodre.net" ascii - $c7 = "gloflabs.com" ascii - condition: - ( - uint16(0) == 0x5a4d and filesize < 1000KB and - ( ( 1 of ($x*) and 3 of ($s*) ) or 1 of ($c*) ) - ) or - ( 6 of them ) -} diff --git a/signatures/apt_backdoor_ssh_python.yar b/signatures/apt_backdoor_ssh_python.yar deleted file mode 100644 index f687c74..0000000 --- a/signatures/apt_backdoor_ssh_python.yar +++ /dev/null @@ -1,18 +0,0 @@ - -rule custom_ssh_backdoor_server { - meta: - description = "Custome SSH backdoor based on python and paramiko - file server.py" - author = "Florian Roth" - reference = "https://goo.gl/S46L3o" - date = "2015-05-14" - hash = "0953b6c2181249b94282ca5736471f85d80d41c9" - strings: - $s0 = "command= raw_input(\"Enter command: \").strip('n')" fullword ascii - $s1 = "print '[-] (Failed to load moduli -- gex will be unsupported.)'" fullword ascii - $s2 = "print '[-] Listen/bind/accept failed: ' + str(e)" fullword ascii - $s3 = "chan.send(command)" fullword ascii - $s4 = "print '[-] SSH negotiation failed.'" fullword ascii - $s5 = "except paramiko.SSHException, x:" fullword ascii - condition: - filesize < 10KB and 5 of them -} diff --git a/signatures/apt_backspace.yar b/signatures/apt_backspace.yar deleted file mode 100644 index 9bc2a91..0000000 --- a/signatures/apt_backspace.yar +++ /dev/null @@ -1,18 +0,0 @@ -/* -Author: Bit Byte Bitten -Date: 5/14/2015 -*/ - -rule apt_backspace{ - meta: - description = "Detects APT backspace" - author = "Bit Byte Bitten" - date = "2015-05-14" - hash = "6cbfeb7526de65eb2e3c848acac05da1e885636d17c1c45c62ad37e44cd84f99" - strings: - $s1 = "!! Use Splice Socket !!" - $s2 = "User-Agent: SJZJ (compatible; MSIE 6.0; Win32)" - $s3 = "g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" - condition: - uint16(0) == 0x5a4d and all of them -} \ No newline at end of file diff --git a/signatures/apt_beepservice.yar b/signatures/apt_beepservice.yar deleted file mode 100644 index 5dbfd71..0000000 --- a/signatures/apt_beepservice.yar +++ /dev/null @@ -1,29 +0,0 @@ -/* - Yara Rule Set - Author: Florian Roth - Date: 2016-05-12 - Identifier: -*/ - -/* Rule Set ----------------------------------------------------------------- */ - -rule BeepService_Hacktool { - meta: - description = "Detects BeepService Hacktool used by Chinese APT groups" - author = "Florian Roth" - reference = "https://goo.gl/p32Ozf" - date = "2016-05-12" - score = 85 - hash1 = "032df812a68852b6f3822b9eac4435e531ca85bdaf3ee99c669134bd16e72820" - hash2 = "e30933fcfc9c2a7443ee2f23a3df837ca97ea5653da78f782e2884e5a7b734f7" - hash3 = "ebb9c4f7058e19b006450b8162910598be90428998df149977669e61a0b7b9ed" - hash4 = "6db2ffe7ec365058f9d3b48dcca509507c138f19ade1adb5f13cf43ea0623813" - strings: - $x1 = "\\\\%s\\admin$\\system32\\%s" fullword ascii - - $s1 = "123.exe" fullword ascii - $s2 = "regclean.exe" fullword ascii - $s3 = "192.168.88.69" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 100KB and $x1 and 1 of ($s*) -} diff --git a/signatures/apt_between-hk-and-burma.yar b/signatures/apt_between-hk-and-burma.yar deleted file mode 100644 index b2571e7..0000000 --- a/signatures/apt_between-hk-and-burma.yar +++ /dev/null @@ -1,215 +0,0 @@ -rule dubseven_file_set -{ - meta: - author = "Matt Brooks, @cmatthewbrooks" - date = "2016/04/18" - score = 75 - description = "Searches for service files loading UP007" - - strings: - $file1 = "\\Microsoft\\Internet Explorer\\conhost.exe" - $file2 = "\\Microsoft\\Internet Explorer\\dll2.xor" - $file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL" - $file4 = "\\Microsoft\\Internet Explorer\\main.dll" - $file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe" - $file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll" - $file7 = "\\Microsoft\\Internet Explorer\\mon" - $file8 = "\\Microsoft\\Internet Explorer\\runas.exe" - - condition: - //MZ header - uint16(0) == 0x5A4D and - - //PE signature - uint32(uint32(0x3C)) == 0x00004550 and - - //Just a few of these as they differ - 3 of ($file*) -} - -rule dubseven_dropper_registry_checks -{ - meta: - author = "Matt Brooks, @cmatthewbrooks" - date = "2016/04/18" - score = 75 - description = "Searches for registry keys checked for by the dropper" - - strings: - $reg1 = "SOFTWARE\\360Safe\\Liveup" - $reg2 = "Software\\360safe" - $reg3 = "SOFTWARE\\kingsoft\\Antivirus" - $reg4 = "SOFTWARE\\Avira\\Avira Destop" - $reg5 = "SOFTWARE\\rising\\RAV" - $reg6 = "SOFTWARE\\JiangMin" - $reg7 = "SOFTWARE\\Micropoint\\Anti-Attack" - - condition: - //MZ header - uint16(0) == 0x5A4D and - - //PE signature - uint32(uint32(0x3C)) == 0x00004550 and - - all of ($reg*) -} - -rule dubseven_dropper_dialog_remains -{ - meta: - author = "Matt Brooks, @cmatthewbrooks" - date = "2016/04/18" - score = 75 - description = "Searches for related dialog remnants. How rude." - - strings: - $dia1 = "fuckMessageBox 1.0" wide - $dia2 = "Rundll 1.0" wide - - condition: - //MZ header - uint16(0) == 0x5A4D and - - //PE signature - uint32(uint32(0x3C)) == 0x00004550 and - - any of them -} - - -rule maindll_mutex -{ - meta: - author = "Matt Brooks, @cmatthewbrooks" - date = "2016/04/18" - score = 75 - description = "Matches on the maindll mutex" - - strings: - $mutex = "h31415927tttt" - - condition: - //MZ header - uint16(0) == 0x5A4D and - - //PE signature - uint32(uint32(0x3C)) == 0x00004550 and - - $mutex -} - - -rule SLServer_dialog_remains -{ - meta: - author = "Matt Brooks, @cmatthewbrooks / modified by Florian Roth" - date = "2016/04/18" - score = 75 - description = "Searches for related dialog remnants." - - strings: - $slserver = "SLServer" wide fullword - - $fp1 = "Dell Inc." wide fullword - $fp2 = "ScriptLogic Corporation" wide - - $extra1 = "SLSERVER" wide fullword - $extra2 = "\\SLServer.pdb" ascii - - condition: - //MZ header - uint16(0) == 0x5A4D and - - //PE signature - uint32(uint32(0x3C)) == 0x00004550 and - - // Reduce false positives - not 1 of ($fp*) and - 1 of ($extra*) and - - $slserver -} - -rule SLServer_mutex -{ - meta: - author = "Matt Brooks, @cmatthewbrooks" - date = "2016/04/18" - score = 75 - description = "Searches for the mutex." - - strings: - $mutex = "M&GX^DSF&DA@F" - - condition: - //MZ header - uint16(0) == 0x5A4D and - - //PE signature - uint32(uint32(0x3C)) == 0x00004550 and - - $mutex -} - -rule SLServer_command_and_control -{ - meta: - author = "Matt Brooks, @cmatthewbrooks" - date = "2016/04/18" - score = 75 - description = "Searches for the C2 server." - - strings: - $c2 = "safetyssl.security-centers.com" - - condition: - //MZ header - uint16(0) == 0x5A4D and - - //PE signature - uint32(uint32(0x3C)) == 0x00004550 and - - $c2 -} - -rule SLServer_campaign_code -{ - meta: - author = "Matt Brooks, @cmatthewbrooks" - date = "2016/04/18" - score = 75 - description = "Searches for the related campaign code." - - strings: - $campaign = "wthkdoc0106" - - condition: - //MZ header - uint16(0) == 0x5A4D and - - //PE signature - uint32(uint32(0x3C)) == 0x00004550 and - - $campaign -} - -rule SLServer_unknown_string -{ - meta: - author = "Matt Brooks, @cmatthewbrooks" - date = "2016/04/18" - score = 75 - description = "Searches for a unique string." - - strings: - $string = "test-b7fa835a39" - - condition: - //MZ header - uint16(0) == 0x5A4D and - - //PE signature - uint32(uint32(0x3C)) == 0x00004550 and - - $string -} diff --git a/signatures/apt_blackenergy.yar b/signatures/apt_blackenergy.yar deleted file mode 100644 index 911ce9d..0000000 --- a/signatures/apt_blackenergy.yar +++ /dev/null @@ -1,171 +0,0 @@ -/* - Yara Rule Set - Author: Florian Roth - Date: 2015-02-19 - Identifier: BlackEnergy Malware -*/ - -rule BlackEnergy_BE_2 { - meta: - description = "Detects BlackEnergy 2 Malware" - author = "Florian Roth" - reference = "http://goo.gl/DThzLz" - date = "2015/02/19" - hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77" - strings: - $s0 = " Windows system utility service " fullword ascii - $s1 = "WindowsSysUtility - Unicode" fullword wide - $s2 = "msiexec.exe" fullword wide - $s3 = "WinHelpW" fullword ascii - $s4 = "ReadProcessMemory" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 250KB and all of ($s*) -} - -/* - Yara Rule Set - Author: Florian Roth - Date: 2016-01-03 - Identifier: BlackEnergy Malware -*/ - -rule BlackEnergy_VBS_Agent { - meta: - description = "Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs" - author = "Florian Roth" - reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/" - date = "2016-01-03" - hash = "b90f268b5e7f70af1687d9825c09df15908ad3a6978b328dc88f96143a64af0f" - strings: - $s0 = "WshShell.Run \"dropbear.exe -r rsa -d dss -a -p 6789\", 0, false" fullword ascii - $s1 = "WshShell.CurrentDirectory = \"C:\\WINDOWS\\TEMP\\Dropbear\\\"" fullword ascii - $s2 = "Set WshShell = CreateObject(\"WScript.Shell\")" fullword ascii /* Goodware String - occured 1 times */ - condition: - filesize < 1KB and 2 of them -} - -rule DropBear_SSH_Server { - meta: - description = "Detects DropBear SSH Server (not a threat but used to maintain access)" - author = "Florian Roth" - reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/" - date = "2016-01-03" - score = 50 - hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd" - strings: - $s1 = "Dropbear server v%s https://matt.ucc.asn.au/dropbear/dropbear.html" fullword ascii - $s2 = "Badly formatted command= authorized_keys option" fullword ascii - $s3 = "This Dropbear program does not support '%s' %s algorithm" fullword ascii - $s4 = "/etc/dropbear/dropbear_dss_host_key" fullword ascii - $s5 = "/etc/dropbear/dropbear_rsa_host_key" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them -} - -rule BlackEnergy_BackdoorPass_DropBear_SSH { - meta: - description = "Detects the password of the backdoored DropBear SSH Server - BlackEnergy" - author = "Florian Roth" - reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/" - date = "2016-01-03" - hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd" - strings: - $s1 = "passDs5Bu9Te7" fullword ascii - condition: - uint16(0) == 0x5a4d and $s1 -} - -/* Super Rules ------------------------------------------------------------- */ - -rule BlackEnergy_KillDisk_1 { - meta: - description = "Detects KillDisk malware from BlackEnergy" - author = "Florian Roth" - reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/" - date = "2016-01-03" - score = 80 - super_rule = 1 - hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80" - hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6" - hash3 = "c7536ab90621311b526aefd56003ef8e1166168f038307ae960346ce8f75203d" - hash4 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95" - strings: - $s0 = "system32\\cmd.exe" fullword ascii - $s1 = "system32\\icacls.exe" fullword wide - $s2 = "/c del /F /S /Q %c:\\*.*" fullword ascii - $s3 = "shutdown /r /t %d" fullword ascii - $s4 = "/C /Q /grant " fullword wide - $s5 = "%08X.tmp" fullword ascii - $s6 = "/c format %c: /Y /X /FS:NTFS" fullword ascii - $s7 = "/c format %c: /Y /Q" fullword ascii - $s8 = "taskhost.exe" fullword wide /* Goodware String - occured 1 times */ - $s9 = "shutdown.exe" fullword wide /* Goodware String - occured 1 times */ - condition: - uint16(0) == 0x5a4d and filesize < 500KB and 8 of them -} - -rule BlackEnergy_KillDisk_2 { - meta: - description = "Detects KillDisk malware from BlackEnergy" - author = "Florian Roth" - reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/" - date = "2016-01-03" - score = 80 - super_rule = 1 - hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80" - hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6" - hash3 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95" - strings: - $s0 = "%c:\\~tmp%08X.tmp" fullword ascii - $s1 = "%s%08X.tmp" fullword ascii - $s2 = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" fullword wide - $s3 = "%ls_%ls_%ls_%d.~tmp" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 500KB and 3 of them -} - -rule BlackEnergy_Driver_USBMDM { - meta: - description = "Black Energy Driver" - author = "Florian Roth" - reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/" - date = "2016-01-04" - super_rule = 1 - hash1 = "7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094" - hash2 = "b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a" - hash3 = "edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281" - hash4 = "ac13b819379855af80ea3499e7fb645f1c96a4a6709792613917df4276c583fc" - hash5 = "7a393b3eadfc8938cbecf84ca630e56e37d8b3d23e084a12ea5a7955642db291" - hash6 = "405013e66b6f137f915738e5623228f36c74e362873310c5f2634ca2fda6fbc5" - hash7 = "244dd8018177ea5a92c70a7be94334fa457c1aab8a1c1ea51580d7da500c3ad5" - hash8 = "edcd1722fdc2c924382903b7e4580f9b77603110e497393c9947d45d311234bf" - strings: - $s1 = "USB MDM Driver" fullword wide - $s2 = "KdDebuggerNotPresent" fullword ascii /* Goodware String - occured 50 times */ - $s3 = "KdDebuggerEnabled" fullword ascii /* Goodware String - occured 69 times */ - condition: - uint16(0) == 0x5a4d and filesize < 180KB and all of them -} - -rule BlackEnergy_Driver_AMDIDE { - meta: - description = "Black Energy Malware" - author = "Florian Roth" - reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/" - date = "2016-01-04" - super_rule = 1 - hash1 = "32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614" - hash2 = "3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2" - hash3 = "90ba78b6710462c2d97815e8745679942b3b296135490f0095bdc0cd97a34d9c" - hash4 = "97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1" - hash5 = "5111de45210751c8e40441f16760bf59856ba798ba99e3c9532a104752bf7bcc" - hash6 = "cbc4b0aaa30b967a6e29df452c5d7c2a16577cede54d6d705ca1f095bd6d4988" - hash7 = "1ce0dfe1a6663756a32c69f7494ad082d293d32fe656d7908fb445283ab5fa68" - strings: - $s1 = " AMD IDE driver" fullword wide - $s2 = "SessionEnv" fullword wide - $s3 = "\\DosDevices\\{C9059FFF-1C49-4445-83E8-" wide - $s4 = "\\Device\\{C9059FFF-1C49-4445-83E8-" wide - condition: - uint16(0) == 0x5a4d and filesize < 150KB and all of them -} diff --git a/signatures/apt_blackenergy_installer.yar b/signatures/apt_blackenergy_installer.yar deleted file mode 100644 index dd85ed6..0000000 --- a/signatures/apt_blackenergy_installer.yar +++ /dev/null @@ -1,15 +0,0 @@ - -rule blackenergy3_installer -{ - meta: - author = "Mike Schladt" - date = "2015-05-29" - description = "Matches unique code block for import name construction " - md5 = "78387651DD9608FCDF6BFB9DF8B84DB4" - sha1 = "78636F7BBD52EA80D79B4E2A7882403092BBB02D" - reference = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf" - strings: - $import_names = { C7 45 D0 75 73 65 72 C7 45 D4 33 32 2E 64 66 C7 45 D8 6C 6C 88 5D DA C7 45 84 61 64 76 61 C7 45 88 70 69 33 32 C7 45 8C 2E 64 6C 6C 88 5D 90 C7 45 B8 77 69 6E 69 C7 45 BC 6E 65 74 2E C7 45 C0 64 6C 6C 00 C7 45 C4 77 73 32 5F C7 45 C8 33 32 2E 64 66 C7 45 CC 6C 6C 88 5D CE C7 45 94 73 68 65 6C C7 45 98 6C 33 32 2E C7 45 9C 64 6C 6C 00 C7 45 E8 70 73 61 70 C7 45 EC 69 2E 64 6C 66 C7 45 F0 6C 00 C7 85 74 FF FF FF 6E 65 74 61 C7 85 78 FF FF FF 70 69 33 32 C7 85 7C FF FF FF 2E 64 6C 6C 88 5D 80 C7 85 64 FF FF FF 6F 6C 65 61 C7 85 68 FF FF FF 75 74 33 32 C7 85 6C FF FF FF 2E 64 6C 6C 88 9D 70 FF FF FF C7 45 DC 6F 6C 65 33 C7 45 E0 32 2E 64 6C 66 C7 45 E4 6C 00 C7 45 A0 76 65 72 73 C7 45 A4 69 6F 6E 2E C7 45 A8 64 6C 6C 00 C7 85 54 FF FF FF 69 6D 61 67 C7 85 58 FF FF FF 65 68 6C 70 C7 85 5C FF FF FF 2E 64 6C 6C 88 9D 60 FF FF FF C7 45 AC 61 70 70 68 C7 45 B0 65 6C 70 2E C7 45 B4 64 6C 6C 00 C7 45 F4 2E 64 6C 6C 88 5D F8 } - condition : - any of them -} \ No newline at end of file diff --git a/signatures/apt_bluetermite_emdivi.yar b/signatures/apt_bluetermite_emdivi.yar deleted file mode 100644 index e4d1c92..0000000 --- a/signatures/apt_bluetermite_emdivi.yar +++ /dev/null @@ -1,136 +0,0 @@ - -/* - Yara Rule Set - Author: Florian Roth @Cyber0ps - Date: 2015-08-20 - Identifier: Emdivi -*/ - -rule Emdivi_SFX { - meta: - description = "Detects Emdivi malware in SFX Archive" - author = "Florian Roth @Cyber0ps" - reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/" - date = "2015-08-20" - score = 70 - hash1 = "7a3c81b2b3c14b9cd913692347019887b607c54152b348d6d3ccd3ecfd406196" - hash2 = "8c3df4e4549db3ce57fc1f7b1b2dfeedb7ba079f654861ca0b608cbfa1df0f6b" - strings: - $x1 = "Setup=unsecess.exe" fullword ascii - $x2 = "Setup=leassnp.exe" fullword ascii - - $s1 = "&Enter password for the encrypted file:" fullword wide - $s2 = ";The comment below contains SFX script commands" fullword ascii - $s3 = "Path=%temp%" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 740KB and (1 of ($x*) and all of ($s*)) -} - -/* Super Rules ------------------------------------------------------------- */ - -rule Emdivi_Gen1 { - meta: - description = "Detects Emdivi Malware" - author = "Florian Roth @Cyber0ps" - reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/" - date = "2015-08-20" - score = 80 - super_rule = 1 - hash1 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24" - hash2 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1" - hash3 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662" - hash4 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86" - strings: - $x1 = "wmic nteventlog where filename=\"SecEvent\" call cleareventlog" fullword wide - $x2 = "del %Temp%\\*.exe %Temp%\\*.dll %Temp%\\*.bat %Temp%\\*.ps1 %Temp%\\*.cmd /f /q" fullword wide - $x3 = "userControl-v80.exe" fullword ascii - - $s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword wide - $s2 = "http://www.msftncsi.com" fullword wide - $s3 = "net use | find /i \"c$\"" fullword wide - $s4 = " /del /y & " fullword wide - $s5 = "\\auto.cfg" fullword wide - $s6 = "/ncsi.txt" fullword wide - $s7 = "Dcmd /c" fullword wide - $s8 = "/PROXY" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 800KB and all of them -} - -rule Emdivi_Gen2 { - meta: - description = "Detects Emdivi Malware" - author = "Florian Roth @Cyber0ps" - reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/" - date = "2015-08-20" - super_rule = 1 - score = 80 - hash1 = "9a351885bf5f6fec466f30021088504d96e9db10309622ed198184294717add1" - hash2 = "a5be7cb1f37030c9f9211c71e0fbe01dae19ff0e6560c5aab393621f18a7d012" - hash3 = "9183abb9b639699cd2ad28d375febe1f34c14679b7638d1a79edb49d920524a4" - strings: - $s1 = "%TEMP%\\IELogs\\" fullword ascii - $s2 = "MSPUB.EXE" fullword ascii - $s3 = "%temp%\\" fullword ascii - $s4 = "\\NOTEPAD.EXE" fullword ascii - $s5 = "%4d-%02d-%02d %02d:%02d:%02d " fullword ascii - $s6 = "INTERNET_OPEN_TYPE_PRECONFIG" fullword ascii - $s7 = "%4d%02d%02d%02d%02d%02d" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 1300KB and 6 of them -} - -rule Emdivi_Gen3 { - meta: - description = "Detects Emdivi Malware" - author = "Florian Roth @Cyber0ps" - reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/" - date = "2015-08-20" - super_rule = 1 - score = 80 - hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e" - hash2 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d" - strings: - $x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword ascii - - $s2 = "\\Mozilla\\Firefox\\Profiles\\" fullword ascii - $s4 = "\\auto.cfg" fullword ascii - $s5 = "/ncsi.txt" fullword ascii - $s6 = "/en-us/default.aspx" fullword ascii - $s7 = "cmd /c" fullword ascii - $s9 = "APPDATA" fullword ascii /* Goodware String - occured 25 times */ - condition: - uint16(0) == 0x5a4d and filesize < 850KB and - ( - ( $x1 and 1 of ($s*) ) or - ( 4 of ($s*) ) - ) -} - -rule Emdivi_Gen4 { - meta: - description = "Detects Emdivi Malware" - author = "Florian Roth @Cyber0ps" - reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/" - date = "2015-08-20" - super_rule = 1 - score = 80 - hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e" - hash2 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24" - hash3 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1" - hash4 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662" - hash5 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86" - hash6 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d" - strings: - $s1 = ".http_port\", " fullword wide - $s2 = "UserAgent: " fullword ascii - $s3 = "AUTH FAILED" fullword ascii - $s4 = "INVALID FILE PATH" fullword ascii - $s5 = ".autoconfig_url\", \"" fullword wide - $s6 = "FAILED TO WRITE FILE" fullword ascii - $s7 = ".proxy" fullword wide - $s8 = "AuthType: " fullword ascii - $s9 = ".no_proxies_on\", \"" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 853KB and all of them -} diff --git a/signatures/apt_bronze_butler.yar b/signatures/apt_bronze_butler.yar deleted file mode 100644 index ab7dd75..0000000 --- a/signatures/apt_bronze_butler.yar +++ /dev/null @@ -1,183 +0,0 @@ -/* - Yara Rule Set - Author: Florian Roth - Date: 2017-10-14 - Identifier: Bronze Butler - Reference: https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses -*/ - -/* Rule Set ----------------------------------------------------------------- */ - -import "pe" - -rule BronzeButler_Daserf_Delphi_1 { - meta: - description = "Detects malware / hacktool sample from Bronze Butler incident" - author = "Florian Roth" - reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses" - date = "2017-10-14" - hash1 = "89a80ca92600af64eb9c32cab4e936c7d675cf815424d72438973e2d6788ef64" - hash2 = "b1bd03cd12638f44d9ace271f65645e7f9b707f86e9bcf790e0e5a96b755556b" - hash3 = "22e1965154bdb91dd281f0e86c8be96bf1f9a1e5fe93c60a1d30b79c0c0f0d43" - strings: - $s1 = "Services.exe" fullword ascii - $s2 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii - $s3 = "l32.dll" fullword ascii - $s4 = "tProcess:" fullword ascii - $s5 = " InjectPr" ascii - $s6 = "Write$Error creating variant or safe arrayInvalid argument to time encode" fullword wide - $s7 = "on\\run /v " fullword ascii - $s8 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\run" fullword ascii - $s9 = "ms1ng2d3d2.exe" fullword ascii - condition: - ( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them ) -} - -rule BronzeButler_Daserf_C_1 { - meta: - description = "Detects malware / hacktool sample from Bronze Butler incident" - author = "Florian Roth" - reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses" - date = "2017-10-14" - hash1 = "a4afd9df1b4cc014c3a89d7b4a560fa3e368b02286c42841762714b23e68cc05" - hash2 = "90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2" - hash3 = "331ac0965b50958db49b7794cc819b2945d7b5e5e919c185d83e997e205f107b" - hash4 = "b1fdc6dc330e78a66757b77cc67a0e9931b777cd7af9f839911eecb74c04420a" - hash5 = "15abe7b1355cd35375de6dde57608f6d3481755fdc9e71d2bfc7c7288db4cd92" - hash6 = "85544d2bcaf8e6ca32bbc0a9e9583c9db1dce837043f555a7ff66363d5858439" - hash7 = "2dc24622c1e91642a21a64c0dd31cbe953e8f77bd3d6abcf2c4676c3b11bb162" - hash8 = "2bdb88fa24cffba240b60416835189c76a9920b6c3f6e09c3c4b171c2f57031c" - strings: - $s1 = "(c) 2010 DYAMAR EnGineerinG, All rights reserved, http://www.dyamar.com." fullword ascii - $s2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1)" fullword ascii - - $a1 = "ndkkwqgcm" fullword ascii - $a2 = "RtlGetCo" fullword ascii - $a3 = "hutils" fullword ascii - - $b1 = "%USERPROFILE%\\System" fullword ascii - $b2 = "msid.dat" fullword ascii - $b3 = "DRIVE_REMOTE" fullword wide - $b4 = "%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii - $b5 = "jcbhe.asp" fullword ascii - $b6 = "edset.asp" fullword ascii - $b7 = "bxcve.asp" fullword ascii - $b8 = "hcvery.php" fullword ascii - $b9 = "ynhkef.php" fullword ascii - $b10 = "dkgwey.php" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 300KB and ( - pe.imphash() == "088382f4887e3b2c4bd5157f2d72b618" or - all of ($a*) or - 4 of them - ) -} - -rule BronzeButler_DGet_1 { - meta: - description = "Detects malware / hacktool sample from Bronze Butler incident" - author = "Florian Roth" - reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses" - date = "2017-10-14" - hash1 = "bd81521445639aaa5e3bcb5ece94f73feda3a91880a34a01f92639f8640251d6" - strings: - $s2 = "DGet Tool Made by XZ" fullword ascii - condition: - ( uint16(0) == 0x5a4d and filesize < 10KB and 1 of them ) -} - -rule BronzeButler_UACBypass_1 { - meta: - description = "Detects malware / hacktool sample from Bronze Butler incident" - author = "Florian Roth" - reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses" - date = "2017-10-14" - hash1 = "fe06b99a0287e2b2d9f7faffbda3a4b328ecc05eab56a3e730cfc99de803b192" - strings: - $x1 = "\\Release\\BypassUacDll.pdb" ascii - $x2 = "%programfiles%internet exploreriexplore.exe" fullword wide - $x3 = "Elevation:Administrator!new:{3ad055" fullword wide - $x4 = "BypassUac.pdb" fullword ascii - $x5 = "[bypassUAC] started X64" fullword wide - $x6 = "[bypassUAC] started X86" fullword wide - condition: - ( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them ) -} - -rule BronzeButler_xxmm_1 { - meta: - description = "Detects malware / hacktool sample from Bronze Butler incident" - author = "Florian Roth" - reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses" - date = "2017-10-14" - hash1 = "7197de18bc5a4c854334ff979f3e4dafa16f43d7bf91edfe46f03e6cc88f7b73" - strings: - $x1 = "\\Release\\ReflectivLoader.pdb" ascii - $x3 = "\\Projects\\xxmm2\\Release\\" ascii - $x5 = "http://127.0.0.1/phptunnel.php" fullword ascii - - $s1 = "xxmm2.exe" fullword ascii - $s2 = "\\AvUpdate.exe" fullword wide - $s3 = "stdapi_fs_file_download" fullword ascii - $s4 = "stdapi_syncshell_open" fullword ascii - $s5 = "stdapi_execute_sleep" fullword ascii - $s6 = "stdapi_syncshell_kill" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 700KB and ( - 1 of ($x*) or - 4 of them - ) -} - -rule BronzeButler_RarStar_1 { - meta: - description = "Detects malware / hacktool sample from Bronze Butler incident" - author = "Florian Roth" - reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses" - date = "2017-10-14" - hash1 = "0fc1b4fdf0dc5373f98de8817da9380479606f775f5aa0b9b0e1a78d4b49e5f4" - strings: - $s1 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+6.0;+SV1)" fullword wide - $s2 = "http://www.google.co.jp" fullword wide - $s3 = "16D73E22-873D-D58E-4F42-E6055BC9825E" fullword ascii - $s4 = "\\*.rar" fullword ascii - condition: - ( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them ) -} - -/* - Yara Rule Set - Author: Florian Roth - Date: 2017-11-08 - Identifier: Bronze Butler - Reference: https://goo.gl/ffeCfd -*/ - -/* Rule Set ----------------------------------------------------------------- */ - -rule Daserf_Nov1_BronzeButler { - meta: - description = "Detects Daserf malware used by Bronze Butler" - author = "Florian Roth" - reference = "https://goo.gl/ffeCfd" - date = "2017-11-08" - hash1 = "5ede6f93f26ccd6de2f93c9bd0f834279df5f5cfe3457915fae24a3aec46961b" - strings: - $x1 = "mstmp1845234.exe" fullword ascii - /* Bronce Butler UA String - see google search */ - $x2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)" fullword ascii - $x3 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii - - $s1 = "Content-Type: */*" fullword ascii - $s2 = "ProxyEnable" ascii fullword - $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer" ascii fullword - $s4 = "iexplore.exe" ascii fullword - /* Looks random but present in many samples */ - $s5 = "\\SOFTWARE\\Microsoft\\Windows\\Cu" fullword ascii - $s6 = "rrentVersion\\Internet Settings" fullword ascii - $s7 = "ws\\CurrentVersion\\Inter" fullword ascii - $s8 = "Documents an" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 700KB and ( 1 of ($x*) or 5 of them ) -} - diff --git a/signatures/apt_buckeye.yar b/signatures/apt_buckeye.yar deleted file mode 100644 index 4df8a7c..0000000 --- a/signatures/apt_buckeye.yar +++ /dev/null @@ -1,68 +0,0 @@ -/* - Yara Rule Set - Author: Florian Roth - Date: 2016-09-05 - Identifier: Buckeye -*/ - -/* Rule Set ----------------------------------------------------------------- */ - -rule Buckeye_Osinfo { - meta: - description = "Detects OSinfo tool used by the Buckeye APT group" - author = "Florian Roth" - reference = "http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong" - date = "2016-09-05" - strings: - $s1 = "-s ShareInfo ShareDir" fullword ascii - $s2 = "-a Local And Global Group User Info" fullword ascii - $s3 = "-f //input server list from infile, OneServerOneLine" fullword ascii - $s4 = "info <\\server> " fullword ascii - $s5 = "-c Connect Test" fullword ascii - $s6 = "-gd Group Domain Admins" fullword ascii - $s7 = "-n NetuseInfo" fullword ascii - condition: - uint16(0) == 0x5a4d and 3 of ($s*) -} - -rule RemoteCmd { - meta: - description = "Detects a remote access tool used by APT groups - file RemoteCmd.exe" - author = "Florian Roth" - reference = "http://goo.gl/igxLyF" - date = "2016-09-08" - hash1 = "5264d1de687432f8346617ac88ffcb31e025e43fc3da1dad55882b17b44f1f8b" - strings: - $s1 = "RemoteCmd.exe" fullword wide - $s2 = "\\Release\\RemoteCmd.pdb" fullword ascii - $s3 = "RemoteCmd [ComputerName] [Executable] [Param1] [Param2] ..." fullword wide - $s4 = "http://{0}:65101/CommandEngine" fullword wide - $s5 = "Brenner.RemoteCmd.Client" fullword ascii - $s6 = "$b1888995-1ee5-4f6d-82df-d2ab8ae73d63" fullword ascii - condition: - ( uint16(0) == 0x5a4d and filesize < 50KB and 2 of them ) or ( 4 of them ) -} - -rule ChromePass { - meta: - description = "Detects a tool used by APT groups - file ChromePass.exe" - author = "Florian Roth" - reference = "http://goo.gl/igxLyF" - date = "2016-09-08" - hash1 = "5ff43049ae18d03dcc74f2be4a870c7056f6cfb5eb636734cca225140029de9a" - strings: - $x1 = "\\Release\\ChromePass.pdb" fullword ascii - $x2 = "Windows Protect folder for getting the encryption keys" wide - $x3 = "Chrome User Data folder where the password file is stored" wide - - $s1 = "Opera Software\\Opera Stable\\Login Data" fullword wide - $s2 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword wide - $s3 = "Load the passwords from another Windows user or external drive: " fullword wide - $s4 = "Chrome Passwords List!Select the windows profile folder" fullword wide - $s5 = "Load the passwords of the current logged-on user" fullword wide - $s6 = "Windows Login Password:" fullword wide - $s7 = "SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created fr" ascii - $s8 = "Chrome Password Recovery" fullword wide - condition: - ( uint16(0) == 0x5a4d and filesize < 700KB and 1 of ($x*) ) or ( 5 of them ) -} diff --git a/signatures/apt_carbon_paper_turla.yar b/signatures/apt_carbon_paper_turla.yar deleted file mode 100644 index 702ab09..0000000 --- a/signatures/apt_carbon_paper_turla.yar +++ /dev/null @@ -1,69 +0,0 @@ -// For feedback or questions contact us at: github@eset.com -// https://github.com/eset/malware-ioc/ -// -// These yara rules are provided to the community under the two-clause BSD -// license as follows: -// -// Copyright (c) 2017, ESET -// All rights reserved. -// -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are met: -// -// 1. Redistributions of source code must retain the above copyright notice, this -// list of conditions and the following disclaimer. -// -// 2. Redistributions in binary form must reproduce the above copyright notice, -// this list of conditions and the following disclaimer in the documentation -// and/or other materials provided with the distribution. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -// -import "pe" - -rule generic_carbon -{ - meta: - author = "ESET Research" - date = "2017-03-30" - description = "Turla Carbon malware" - reference = "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/" - source = "https://github.com/eset/malware-ioc/" - contact = "github@eset.com" - license = "BSD 2-Clause" - - strings: - $s1 = "ModStart" - $t1 = "STOP|OK" - $t2 = "STOP|KILL" - - condition: - (uint16(0) == 0x5a4d) and (1 of ($s*)) and (1 of ($t*)) -} - -rule carbon_metadata -{ - meta: - author = "ESET Research" - date = "2017-03-30" - description = "Turla Carbon malware" - reference = "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/" - source = "https://github.com/eset/malware-ioc/" - contact = "github@eset.com" - license = "BSD 2-Clause" - - condition: - (pe.version_info["InternalName"] contains "SERVICE.EXE" or - pe.version_info["InternalName"] contains "MSIMGHLP.DLL" or - pe.version_info["InternalName"] contains "MSXIML.DLL") - and pe.version_info["CompanyName"] contains "Microsoft Corporation" -} diff --git a/signatures/apt_casper.yar b/signatures/apt_casper.yar deleted file mode 100644 index a5955d9..0000000 --- a/signatures/apt_casper.yar +++ /dev/null @@ -1,97 +0,0 @@ - -/* State-sponsored Casper Malware Rules by @4nc4p - attribution and analysis by @pinkflawd @r00tbsd @circl_lu */ - -rule Casper_Backdoor_x86 { - meta: - description = "Casper French Espionage Malware - Win32/ProxyBot.B - x86 Payload http://goo.gl/VRJNLo" - author = "Florian Roth" - reference = "http://goo.gl/VRJNLo" - date = "2015/03/05" - hash = "f4c39eddef1c7d99283c7303c1835e99d8e498b0" - score = 80 - strings: - $s1 = "\"svchost.exe\"" fullword wide - $s2 = "firefox.exe" fullword ascii - $s3 = "\"Host Process for Windows Services\"" fullword wide - - $x1 = "\\Users\\*" fullword ascii - $x2 = "\\Roaming\\Mozilla\\Firefox\\Profiles\\*" fullword ascii - $x3 = "\\Mozilla\\Firefox\\Profiles\\*" fullword ascii - $x4 = "\\Documents and Settings\\*" fullword ascii - - $y1 = "%s; %S=%S" fullword wide - $y2 = "%s; %s=%s" fullword ascii - $y3 = "Cookie: %s=%s" fullword ascii - $y4 = "http://%S:%d" fullword wide - - $z1 = "http://google.com/" fullword ascii - $z2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)" fullword ascii - $z3 = "Operating System\"" fullword wide - condition: - ( all of ($s*) ) or - ( 3 of ($x*) and 2 of ($y*) and 2 of ($z*) ) -} - -rule Casper_EXE_Dropper { - meta: - description = "Casper French Espionage Malware - Win32/ProxyBot.B - Dropper http://goo.gl/VRJNLo" - author = "Florian Roth" - reference = "http://goo.gl/VRJNLo" - date = "2015/03/05" - hash = "e4cc35792a48123e71a2c7b6aa904006343a157a" - score = 80 - strings: - $s0 = "" fullword ascii - $s1 = "" fullword ascii - $s2 = "\" /d \"" fullword ascii - $s4 = "'%s' %s" fullword ascii - $s5 = "nKERNEL32.DLL" fullword wide - $s6 = "@ReturnValue" fullword wide - $s7 = "ID: 0x%x" fullword ascii - $s8 = "Name: %S" fullword ascii - condition: - 7 of them -} - -rule Casper_Included_Strings { - meta: - description = "Casper French Espionage Malware - String Match in File - http://goo.gl/VRJNLo" - author = "Florian Roth" - reference = "http://goo.gl/VRJNLo" - date = "2015/03/06" - score = 50 - strings: - $a0 = "cmd.exe /C FOR /L %%i IN (1,1,%d) DO IF EXIST" - $a1 = "& SYSTEMINFO) ELSE EXIT" - - $mz = { 4d 5a } - $c1 = "domcommon.exe" wide fullword // File Name - $c2 = "jpic.gov.sy" fullword // C2 Server - $c3 = "aiomgr.exe" wide fullword // File Name - $c4 = "perfaudio.dat" fullword // Temp File Name - $c5 = "Casper_DLL.dll" fullword // Name - $c6 = { 7B 4B 59 DE 37 4A 42 26 59 98 63 C6 2D 0F 57 40 } // Decryption Key - $c7 = "{4216567A-4512-9825-7745F856}" fullword // Mutex - condition: - all of ($a*) or - ( $mz at 0 ) and ( 1 of ($c*) ) -} - -rule Casper_SystemInformation_Output { - meta: - description = "Casper French Espionage Malware - System Info Output - http://goo.gl/VRJNLo" - author = "Florian Roth" - reference = "http://goo.gl/VRJNLo" - date = "2015/03/06" - score = 70 - strings: - $a0 = "***** SYSTEM INFORMATION ******" - $a1 = "***** SECURITY INFORMATION ******" - $a2 = "Antivirus: " - $a3 = "Firewall: " - $a4 = "***** EXECUTION CONTEXT ******" - $a5 = "Identity: " - $a6 = "" fullword ascii /* Goodware String - occured 65 times */ - condition: - uint16(0) == 0x5a4d and filesize < 900KB and 2 of ($x*) and 2 of ($s*) -} -rule Codoso_PlugX_1 { - meta: - description = "Detects Codoso APT PlugX Malware" - author = "Florian Roth" - reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks" - date = "2016-01-30" - super_rule = 1 - hash1 = "0b8cbc9b4761ab35acce2aa12ba2c0a283afd596b565705514fd802c8b1e144b" - hash2 = "448711bd3f689ceebb736d25253233ac244d48cb766834b8f974c2e9d4b462e8" - hash3 = "fd22547497ce52049083092429eeff0599d0b11fe61186e91c91e1f76b518fe2" - strings: - $s1 = "GETPASSWORD1" fullword ascii - $s2 = "NvSmartMax.dll" fullword ascii - $s3 = "LICENSEDLG" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 800KB and all of them -} -rule Codoso_PGV_PVID_3 { - meta: - description = "Detects Codoso APT PGV PVID Malware" - author = "Florian Roth" - reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks" - date = "2016-01-30" - super_rule = 1 - hash1 = "126fbdcfed1dfb31865d4b18db2fb963f49df838bf66922fea0c37e06666aee1" - hash2 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75" - hash3 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761" - hash4 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1" - hash5 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3" - hash6 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe" - strings: - $x1 = "Copyright (C) Microsoft Corporation. All rights reserved.(C) 2012" fullword wide - condition: - $x1 -} -rule Codoso_PGV_PVID_2 { - meta: - description = "Detects Codoso APT PGV PVID Malware" - author = "Florian Roth" - reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks" - date = "2016-01-30" - super_rule = 1 - hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75" - hash2 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3" - hash3 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe" - strings: - $s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii - $s1 = "regsvr32.exe /s \"%s\"" fullword ascii - $s2 = "Help and Support" fullword ascii - $s3 = "netsvcs" fullword ascii - $s9 = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" fullword ascii /* Goodware String - occured 4 times */ - $s10 = "winlogon" fullword ascii /* Goodware String - occured 4 times */ - $s11 = "System\\CurrentControlSet\\Services" fullword ascii /* Goodware String - occured 11 times */ - condition: - uint16(0) == 0x5a4d and filesize < 907KB and all of them -} -rule Codoso_PGV_PVID_1 { - meta: - description = "Detects Codoso APT PGV PVID Malware" - author = "Florian Roth" - reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks" - date = "2016-01-30" - super_rule = 1 - hash1 = "41a936b0d1fd90dffb2f6d0bcaf4ad0536f93ca7591f7b75b0cd1af8804d0824" - hash2 = "58334eb7fed37e3104d8235d918aa5b7856f33ea52a74cf90a5ef5542a404ac3" - hash3 = "934b87ddceabb2063b5e5bc4f964628fe0c63b63bb2346b105ece19915384fc7" - hash4 = "ce91ea20aa2e6af79508dd0a40ab0981f463b4d2714de55e66d228c579578266" - hash5 = "e770a298ae819bba1c70d0c9a2e02e4680d3cdba22d558d21caaa74e3970adf1" - strings: - $x1 = "Cookie: pgv_pvid=" ascii - $x2 = "DRIVERS\\ipinip.sys" fullword wide - - $s1 = "TsWorkSpaces.dll" fullword ascii - $s2 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide - $s3 = "/selfservice/microsites/search.php?%016I64d" fullword ascii - $s4 = "/solutions/company-size/smb/index.htm?%016I64d" fullword ascii - $s5 = "Microsoft Chart ActiveX Control" fullword wide - $s6 = "MSChartCtrl.ocx" fullword wide - $s7 = "{%08X-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X}" fullword ascii - $s8 = "WUServiceMain" fullword ascii /* Goodware String - occured 2 times */ - condition: - ( uint16(0) == 0x5a4d and ( 1 of ($x*) or 3 of them ) ) or - 5 of them -} diff --git a/signatures/apt_coreimpact_agent.yar b/signatures/apt_coreimpact_agent.yar deleted file mode 100644 index 7c3db12..0000000 --- a/signatures/apt_coreimpact_agent.yar +++ /dev/null @@ -1,44 +0,0 @@ -/* - Core Impact Agent known from RocketKitten and WoolenGoldfish APT -*/ - - -rule CoreImpact_sysdll_exe { - meta: - description = "Detects a malware sysdll.exe from the Rocket Kitten APT" - author = "Florian Roth" - score = 70 - date = "27.12.2014" - hash = "f89a4d4ae5cca6d69a5256c96111e707" - strings: - $s0 = "d:\\nightly\\sandbox_avg10_vc9_SP1_2011\\source\\avg10\\avg9_all_vs90\\bin\\Rele" ascii - - $x1 = "Mozilla/5.0" fullword ascii - $x2 = "index.php?c=%s&r=%lx&u=1&t=%s" fullword ascii - $x3 = "index.php?c=%s&r=%lx" fullword ascii - $x4 = "index.php?c=%s&r=%x" fullword ascii - $x5 = "127.0.0.1" fullword ascii - $x6 = "/info.dat" fullword ascii - - $z1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide - $z2 = "Encountered error sending error message to client" fullword ascii - $z3 = "Encountered error building error message to client" fullword ascii - $z4 = "Attempting to unlock uninitialized lock!" fullword ascii - $z5 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii - $z6 = "select_event_get(): fd not found" fullword ascii - $z7 = "Encountered error sending syscall response to client" fullword ascii - $z8 = "GetProcAddress() error" fullword ascii - $z9 = "Error entering thread lock" fullword ascii - $z10 = "Error exiting thread lock" fullword ascii - $z11 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii - $z12 = "event_add() failed for ev." fullword ascii - $z13 = "Uh, oh, exit() failed" fullword ascii - $z14 = "event_add() failed for ev." fullword ascii - $z15 = "event_add() failed." fullword ascii - $z16 = "needroot" fullword ascii - $z17 = "./plugins/" fullword ascii - condition: - $s0 or - all of ($x*) or - 8 of ($z*) -} \ No newline at end of file diff --git a/signatures/apt_crash_override.yar b/signatures/apt_crash_override.yar deleted file mode 100644 index 6a09a37..0000000 --- a/signatures/apt_crash_override.yar +++ /dev/null @@ -1,60 +0,0 @@ -/* - Yara Rule Set - Author: Dragos Inc - Date: 2016-06-12 - Identifier: Crash Override -*/ - -import "pe" - -rule dragos_crashoverride_suspcious -{ - meta: - description = "CRASHOVERRIDE v1 Wiper" - author = "Dragos Inc" - reference = "https://t.co/h8QaIP4FU8" - strings: - $s0 = "SYS_BASCON.COM" fullword nocase wide - $s1 = ".pcmp" fullword nocase wide - $s2 = ".pcmi" fullword nocase wide - $s3 = ".pcmt" fullword nocase wide - $s4 = ".cin" fullword nocase wide - condition: - pe.exports("Crash") and any of ($s*) -} - -rule dragos_crashoverride_exporting_dlls { - meta: - description = "CRASHOVERRIDE v1 Suspicious Export" - author = "Dragos Inc" - reference = "https://t.co/h8QaIP4FU8" - condition: - pe.exports("Crash") & pe.characteristics -} - -rule dragos_crashoverride_name_search { - meta: - description = "CRASHOVERRIDE v1 Suspicious Strings and Export" - author = "Dragos Inc" - reference = "https://t.co/h8QaIP4FU8" - strings: - $s0 = "101.dll" fullword nocase wide - $s1 = "Crash101.dll" fullword nocase wide - $s2 = "104.dll" fullword nocase wide - $s3 = "Crash104.dll" fullword nocase wide - $s4 = "61850.dll" fullword nocase wide - $s5 = "Crash61850.dll" fullword nocase wide - $s6 = "OPCClientDemo.dll" fullword nocase wide - $s7 = "OPC" fullword nocase wide - $s8 = "CrashOPCClientDemo.dll" fullword nocase wide - $s9 = "D2MultiCommService.exe" fullword nocase wide - $s10 = "CrashD2MultiCommService.exe" fullword nocase wide $s11 = "61850.exe" fullword nocase wide - $s12 = "OPC.exe" fullword nocase wide - $s13 = "haslo.exe" fullword nocase wide - $s14 = "haslo.dat" fullword nocase wide - condition: - any of ($s*) and pe.exports("Crash") -} - - - \ No newline at end of file diff --git a/signatures/apt_danti_svcmondr.yar b/signatures/apt_danti_svcmondr.yar deleted file mode 100644 index b02be11..0000000 --- a/signatures/apt_danti_svcmondr.yar +++ /dev/null @@ -1,70 +0,0 @@ -/* - Yara Rule Set - Author: Florian Roth - Date: 2016-05-25 - Identifier: Kaspersky Report on threats involving CVE-2015-2545 -*/ - -/* Rule Set ----------------------------------------------------------------- */ - -rule Mal_Dropper_httpEXE_from_CAB { - meta: - description = "Detects a dropper from a CAB file mentioned in the article" - author = "Florian Roth" - reference = "https://goo.gl/13Wgy1" - date = "2016-05-25" - score = 60 - hash1 = "9e7e5f70c4b32a4d5e8c798c26671843e76bb4bd5967056a822e982ed36e047b" - strings: - $s1 = "029.Hdl" fullword ascii - $s2 = "http.exe" fullword ascii - condition: - ( uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) ) ) -} - -rule Mal_http_EXE { - meta: - description = "Detects trojan from APT report named http.exe" - author = "Florian Roth" - reference = "https://goo.gl/13Wgy1" - date = "2016-05-25" - score = 80 - hash1 = "ad191d1d18841f0c5e48a5a1c9072709e2dd6359a6f6d427e0de59cfcd1d9666" - strings: - $x1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"%s\"" fullword ascii - $x2 = "%ALLUSERSPROFILE%\\Accessories\\wordpade.exe" fullword ascii - $x3 = "\\dumps.dat" fullword ascii - $x4 = "\\wordpade.exe" fullword ascii - $x5 = "\\%s|%s|4|%d|%4d-%02d-%02d %02d:%02d:%02d|" fullword ascii - $x6 = "\\%s|%s|5|%d|%4d-%02d-%02d %02d:%02d:%02d|" fullword ascii - $x7 = "cKaNBh9fnmXgJcSBxx5nFS+8s7abcQ==" fullword ascii - $x8 = "cKaNBhFLn1nXMcCR0RlbMQ==" fullword ascii /* base64: pKY1[1 */ - - $s1 = "SELECT * FROM moz_logins;" fullword ascii - $s2 = "makescr.dat" fullword ascii - $s3 = "%s\\Mozilla\\Firefox\\profiles.ini" fullword ascii - $s4 = "?moz-proxy://" fullword ascii - $s5 = "[%s-%s] Title: %s" fullword ascii - $s6 = "Cforeign key mismatch - \"%w\" referencing \"%w\"" fullword ascii - $s7 = "Windows 95 SR2" fullword ascii - $s8 = "\\|%s|0|0|" fullword ascii - condition: - ( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) and 2 of ($s*) ) ) or ( 3 of ($x*) ) -} - -rule Mal_PotPlayer_DLL { - meta: - description = "Detects a malicious PotPlayer.dll" - author = "Florian Roth" - reference = "https://goo.gl/13Wgy1" - date = "2016-05-25" - score = 70 - hash1 = "705409bc11fb45fa3c4e2fa9dd35af7d4613e52a713d9c6ea6bc4baff49aa74a" - strings: - $x1 = "C:\\Users\\john\\Desktop\\PotPlayer\\Release\\PotPlayer.pdb" fullword ascii - - $s3 = "PotPlayer.dll" fullword ascii - $s4 = "\\update.dat" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 200KB and $x1 or all of ($s*) -} diff --git a/signatures/apt_darkcaracal.yar b/signatures/apt_darkcaracal.yar deleted file mode 100644 index cc06d13..0000000 --- a/signatures/apt_darkcaracal.yar +++ /dev/null @@ -1,28 +0,0 @@ - -/* - Yara Rule Set - Author: Florian Roth - Date: 2018-01-22 - Identifier: Dark Caracal - Reference: https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news -*/ - -/* Rule Set ----------------------------------------------------------------- */ - -rule MiniRAT_Gen_1 { - meta: - description = "Detects Mini RAT malware" - author = "Florian Roth" - reference = "https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news" - date = "2018-01-22" - hash1 = "091ae8d5649c4e040d25550f2cdf7f1ddfc9c698e672318eb1ab6303aa1cf85b" - hash2 = "b6ac374f79860ae99736aaa190cce5922a969ab060d7ae367dbfa094bfe4777d" - hash3 = "ba4e063472a2559b4baa82d5272304a1cdae6968145c5ef221295c90e88458e2" - hash4 = "ed97719c008422925ae21ff34448a8c35ee270a428b0478e24669396761d0790" - hash5 = "675c3d96070dc9a0e437f3e1b653b90dbc6700b0ec57379d4139e65f7d2799cd" - strings: - $x1 = "\\Mini rat\\" ascii - $x2 = "\\Projects\\ali\\Clever Components v7\\" ascii - condition: - uint16(0) == 0x5a4d and filesize < 7000KB and 1 of them -} diff --git a/signatures/apt_deeppanda.yar b/signatures/apt_deeppanda.yar deleted file mode 100644 index 188ad2c..0000000 --- a/signatures/apt_deeppanda.yar +++ /dev/null @@ -1,82 +0,0 @@ -/* Deep Panda APT */ - -rule DeepPanda_sl_txt_packed { - meta: - description = "Hack Deep Panda - ScanLine sl-txt-packed" - author = "Florian Roth" - date = "2015/02/08" - hash = "ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34" - strings: - $s0 = "Command line port scanner" fullword wide - $s1 = "sl.exe" fullword wide - $s2 = "CPports.txt" fullword ascii - $s3 = ",GET / HTTP/.}" fullword ascii - $s4 = "Foundstone Inc." fullword wide - $s9 = " 2002 Foundstone Inc." fullword wide - $s15 = ", Inc. 2002" fullword ascii - $s20 = "ICMP Time" fullword ascii - condition: - all of them -} - -rule DeepPanda_lot1 { - meta: - description = "Hack Deep Panda - lot1.tmp-pwdump" - author = "Florian Roth" - date = "2015/02/08" - hash = "5d201a0fb0f4a96cefc5f73effb61acff9c818e1" - strings: - $s0 = "Unable to open target process: %d, pid %d" fullword ascii - $s1 = "Couldn't delete target executable from remote machine: %d" fullword ascii - $s2 = "Target: Failed to load SAM functions." fullword ascii - $s5 = "Error writing the test file %s, skipping this share" fullword ascii - $s6 = "Failed to create service (%s/%s), error %d" fullword ascii - $s8 = "Service start failed: %d (%s/%s)" fullword ascii - $s12 = "PwDump.exe" fullword ascii - $s13 = "GetAvailableWriteableShare returned an error of %ld" fullword ascii - $s14 = ":\\\\.\\pipe\\%s" fullword ascii - $s15 = "Couldn't copy %s to destination %s. (Error %d)" fullword ascii - $s16 = "dump logon session" fullword ascii - $s17 = "Timed out waiting to get our pipe back" fullword ascii - $s19 = "SetNamedPipeHandleState failed, error %d" fullword ascii - $s20 = "%s\\%s.exe" fullword ascii - condition: - 10 of them -} - -rule DeepPanda_htran_exe { - meta: - description = "Hack Deep Panda - htran-exe" - author = "Florian Roth" - date = "2015/02/08" - hash = "38e21f0b87b3052b536408fdf59185f8b3d210b9" - strings: - $s0 = "%s -