// DocBunker browser subset of YARA-Forge core 20261026; original rules unchanged. import "dotnet" import "hash" import "pe" /* * YARA Rule Set * Repository Name: ESET * Repository: https://github.com/eset/malware-ioc * Retrieval Date: 2026-10-26 * Git Commit: 59745502656e813f9f79fc8005243edbc04f9397 * Number of Rules: 57 * Skipped: 39 (age), 20 (quality), 2 (score), 0 (importance) * * * LICENSE * * Copyright (c) 2014-2018 ESET spol. s r.o. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ private rule ESET_Invisimole_Blob_PRIVATE { meta: description = "Detects InvisiMole blobs by magic values" author = "ESET Research" id = "6a179d91-50f1-5400-b141-0f162efd2431" date = "2021-05-17" modified = "2021-05-17" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/invisimole/invisimole.yar#L34-L52" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "8bddaf874da58fbe6362498f8979b511f39531fe2b98d4be8c099bdafb6d0067" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" strings: $magic_old_32 = {F9 FF D0 DE} $magic_old_64 = {64 FF D0 DE} $magic_new_32 = {86 DA 11 CE} $magic_new_64 = {64 DA 11 CE} condition: ($magic_old_32 at 0 ) or ( $magic_old_64 at 0 ) or ( $magic_new_32 at 0 ) or ( $magic_new_64 at 0 ) } private rule ESET_IIS_Native_Module_PRIVATE : FILE { meta: description = "Signature to match an IIS native module (clean or malicious)" author = "ESET Research" id = "e3bacdc8-fde1-5e83-ac94-79fc345e888d" date = "2021-08-04" modified = "2021-08-04" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/badiis/badiis.yar#L34-L92" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "5a388dc3253df606e2648d1f9c018e6dde373bbddce66dba69b7aecdd95bac18" score = 75 quality = 55 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $e1 = "This module subscribed to event" $e2 = "CHttpModule::OnBeginRequest" $e3 = "CHttpModule::OnPostBeginRequest" $e4 = "CHttpModule::OnAuthenticateRequest" $e5 = "CHttpModule::OnPostAuthenticateRequest" $e6 = "CHttpModule::OnAuthorizeRequest" $e7 = "CHttpModule::OnPostAuthorizeRequest" $e8 = "CHttpModule::OnResolveRequestCache" $e9 = "CHttpModule::OnPostResolveRequestCache" $e10 = "CHttpModule::OnMapRequestHandler" $e11 = "CHttpModule::OnPostMapRequestHandler" $e12 = "CHttpModule::OnAcquireRequestState" $e13 = "CHttpModule::OnPostAcquireRequestState" $e14 = "CHttpModule::OnPreExecuteRequestHandler" $e15 = "CHttpModule::OnPostPreExecuteRequestHandler" $e16 = "CHttpModule::OnExecuteRequestHandler" $e17 = "CHttpModule::OnPostExecuteRequestHandler" $e18 = "CHttpModule::OnReleaseRequestState" $e19 = "CHttpModule::OnPostReleaseRequestState" $e20 = "CHttpModule::OnUpdateRequestCache" $e21 = "CHttpModule::OnPostUpdateRequestCache" $e22 = "CHttpModule::OnLogRequest" $e23 = "CHttpModule::OnPostLogRequest" $e24 = "CHttpModule::OnEndRequest" $e25 = "CHttpModule::OnPostEndRequest" $e26 = "CHttpModule::OnSendResponse" $e27 = "CHttpModule::OnMapPath" $e28 = "CHttpModule::OnReadEntity" $e29 = "CHttpModule::OnCustomRequestNotification" $e30 = "CHttpModule::OnAsyncCompletion" $e31 = "CGlobalModule::OnGlobalStopListening" $e32 = "CGlobalModule::OnGlobalCacheCleanup" $e33 = "CGlobalModule::OnGlobalCacheOperation" $e34 = "CGlobalModule::OnGlobalHealthCheck" $e35 = "CGlobalModule::OnGlobalConfigurationChange" $e36 = "CGlobalModule::OnGlobalFileChange" $e37 = "CGlobalModule::OnGlobalApplicationStart" $e38 = "CGlobalModule::OnGlobalApplicationResolveModules" $e39 = "CGlobalModule::OnGlobalApplicationStop" $e40 = "CGlobalModule::OnGlobalRSCAQuery" $e41 = "CGlobalModule::OnGlobalTraceEvent" $e42 = "CGlobalModule::OnGlobalCustomNotification" $e43 = "CGlobalModule::OnGlobalThreadCleanup" $e44 = "CGlobalModule::OnGlobalApplicationPreload" condition: uint16( 0 ) == 0x5A4D and pe.exports ( "RegisterModule" ) and any of ( $e* ) } rule ESET_Sparklinggoblin_Chacha20Loader_Richheader { meta: description = "Rule matching ChaCha20 loaders rich header" author = "ESET Research" id = "e1dac369-f25e-5cb3-aafa-b0c45f05b295" date = "2021-03-30" modified = "2021-08-26" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/sparklinggoblin/SparklingGoblin.yar#L33-L57" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" hash = "09ffe37a54bc4ebebd8d56098e4c76232f35d821" hash = "29b147b76bb0d9e09f7297487cb972e6a2905586" hash = "33f2c3de2457b758fc5824a2b253ad7c7c2e9e37" hash = "45bef297ce78521eac6ee39e7603e18360e67c5a" hash = "4cec7cdc78d95c70555a153963064f216dae8799" hash = "4d4c1a062a0390b20732ba4d65317827f2339b80" hash = "4f6949a4906b834e83ff951e135e0850fe49d5e4" logic_hash = "a5c9595036dec0e0aef0a030c590189752217d15d3f53bf3dc537f5b43fae63e" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" condition: pe.rich_signature.length>= 104 and pe.rich_signature.length <= 112 and pe.rich_signature.toolid ( 241 , 40116 ) >= 5 and pe.rich_signature.toolid ( 241 , 40116 ) <= 10 and pe.rich_signature.toolid ( 147 , 30729 ) == 11 and pe.rich_signature.toolid ( 264 , 24215 ) >= 15 and pe.rich_signature.toolid ( 264 , 24215 ) <= 16 } rule ESET_Sparklinggoblin_Chacha20 : FILE { meta: description = "SparklingGoblin ChaCha20 implementations" author = "ESET Research" id = "c0caceca-f685-5786-82f6-3ab7435f8061" date = "2021-05-20" modified = "2021-08-26" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/sparklinggoblin/SparklingGoblin.yar#L59-L368" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" hash = "2edbea43f5c40c867e5b6bbd93cc972525df598b" hash = "b6d245d3d49b06645c0578804064ce0c072cbe0f" hash = "8be6d5f040d0085c62b1459afc627707b0de89cf" hash = "4668302969fe122874fb2447a80378dcb671c86b" hash = "9bdecb08e16a23d271d0a3e836d9e7f83d7e2c3b" hash = "9ce7650f2c08c391a35d69956e171932d116b8bd" hash = "91b32e030a1f286e7d502ca17e107d4bfbd7394a" logic_hash = "b742bc22e0ebbce40607cb109b4d6fb03a40c1fb223c8092d93346dd3dd22789" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" strings: $chunk_1 = { 8B 4D ?? 56 8B 75 ?? 57 8B 7D ?? 8B 04 BB 01 04 93 8B 04 B3 33 04 93 C1 C0 10 89 04 B3 01 04 8B 8B 04 BB 33 04 8B C1 C0 0C 89 04 BB 01 04 93 8B 04 B3 33 04 93 C1 C0 08 89 04 B3 01 04 8B 8B 04 BB 33 04 8B C1 C0 07 89 04 BB } $chunk_2 = { 03 4D ?? 44 03 C0 03 55 ?? 33 F1 45 33 D8 C1 C6 10 44 33 F2 41 C1 C3 10 41 03 FB 41 C1 C6 10 45 03 E6 41 03 DA 44 33 CB 44 03 EE 41 C1 C1 10 8B C7 33 45 ?? 45 03 F9 C1 C0 0C 44 03 C0 45 33 D8 44 89 45 ?? 41 C1 C3 08 41 03 FB 44 8B C7 44 33 C0 41 8B C5 33 45 ?? C1 C0 0C 03 C8 41 C1 C0 07 33 F1 89 4D ?? C1 C6 08 44 03 EE 41 8B CD 33 C8 41 8B C4 33 45 ?? C1 C0 0C 03 D0 C1 C1 07 44 33 F2 89 55 ?? 41 C1 C6 08 45 03 E6 41 8B D4 33 D0 41 8B C7 41 33 C2 C1 C2 07 C1 C0 0C 03 D8 44 33 CB 41 C1 C1 08 45 03 F9 45 8B D7 44 33 D0 8B 45 ?? 03 C1 41 C1 C2 07 44 33 C8 89 45 ?? 41 C1 C1 10 45 03 E1 41 8B C4 33 C1 8B 4D ?? C1 C0 0C 03 C8 44 33 C9 89 4D ?? 89 4D ?? 41 C1 C1 08 45 03 E1 41 8B CC 33 C8 8B 45 ?? C1 C1 07 89 4D ?? 89 4D ?? 03 C2 41 03 D8 89 45 ?? 41 33 C3 C1 C0 10 44 03 F8 41 8B CF 33 CA 8B 55 ?? } $chunk_3 = { C7 45 ?? 65 78 70 61 4C 8D 45 ?? C7 45 ?? 6E 64 20 33 4D 8B F9 C7 45 ?? 32 2D 62 79 4C 2B C1 C7 45 ?? 74 65 20 6B } $chunk_4 = { 0F B6 02 0F B6 4A ?? C1 E1 08 0B C8 0F B6 42 ?? C1 E1 08 0B C8 0F B6 42 ?? C1 E1 08 0B C8 41 89 0C 10 48 8D 52 ?? 49 83 E9 01 } $chunk_5 = { 03 4D ?? 44 03 C0 03 55 ?? 33 F1 41 33 F8 C1 C6 10 44 33 F2 C1 C7 10 44 03 DF 41 C1 C6 10 45 03 E6 44 03 CB 45 33 D1 44 03 EE 41 C1 C2 10 41 8B C3 33 45 ?? 45 03 FA C1 C0 0C 44 03 C0 41 33 F8 44 89 45 ?? C1 C7 08 44 03 DF 45 8B C3 44 33 C0 41 8B C5 33 45 ?? C1 C0 0C 03 C8 41 C1 C0 07 33 F1 89 4D ?? C1 C6 08 44 03 EE 41 8B CD 33 C8 41 8B C4 33 45 ?? C1 C0 0C 03 D0 C1 C1 07 44 33 F2 89 55 ?? 41 C1 C6 08 45 03 E6 41 8B D4 33 D0 41 8B C7 33 C3 C1 C2 07 C1 C0 0C 44 03 C8 45 33 D1 41 C1 C2 08 45 03 FA 41 8B DF 33 D8 8B 45 ?? 03 C1 C1 C3 07 44 33 D0 89 45 ?? 41 C1 C2 10 45 03 E2 41 8B C4 33 C1 8B 4D ?? C1 C0 0C 03 C8 44 33 D1 89 4D ?? 89 4D ?? 41 C1 C2 08 45 03 E2 41 8B CC 33 C8 8B 45 ?? C1 C1 07 89 4D ?? 89 4D ?? 03 C2 45 03 C8 89 45 ?? 33 C7 C1 C0 10 44 03 F8 41 8B CF 33 CA 8B 55 ?? C1 C1 0C 03 D1 8B FA 89 55 ?? 33 F8 89 55 ?? 8B 55 ?? 03 D3 C1 C7 08 44 03 FF 41 8B C7 33 C1 C1 C0 07 89 45 ?? 89 45 ?? 8B C2 33 C6 C1 C0 10 44 03 D8 41 33 DB C1 C3 0C 03 D3 8B F2 89 55 ?? 33 F0 41 8B C1 41 33 C6 C1 C6 08 C1 C0 10 44 03 DE 44 03 E8 41 33 DB 41 8B CD C1 C3 07 41 33 C8 44 8B 45 ?? C1 C1 0C 44 03 C9 45 8B F1 44 33 F0 41 C1 C6 08 45 03 EE 41 8B C5 33 C1 8B 4D ?? C1 C0 07 } condition: any of them and filesize < 450KB } rule ESET_Sparklinggoblin_Etweventwrite { meta: description = "SparklingGoblin EtwEventWrite patching" author = "ESET Research" id = "27b36ee1-a98c-5174-a156-8e0b0d0a58cd" date = "2021-05-20" modified = "2021-08-26" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/sparklinggoblin/SparklingGoblin.yar#L370-L463" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" hash = "2edbea43f5c40c867e5b6bbd93cc972525df598b" hash = "b6d245d3d49b06645c0578804064ce0c072cbe0f" hash = "8be6d5f040d0085c62b1459afc627707b0de89cf" hash = "4668302969fe122874fb2447a80378dcb671c86b" hash = "9bdecb08e16a23d271d0a3e836d9e7f83d7e2c3b" hash = "9ce7650f2c08c391a35d69956e171932d116b8bd" logic_hash = "45615dcc5302392c18052818071623a9d1a1008c460bdb24a4acfb4300356c6b" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" strings: $chunk_1 = { 48 8D 0D ?? ?? ?? ?? C7 44 24 ?? 48 31 C0 C3 FF 15 ?? ?? ?? ?? 48 8B C8 48 8D 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 64 24 ?? 00 4C 8D 4C 24 ?? BF 04 00 00 00 48 8B C8 8B D7 48 8B D8 44 8D 47 ?? FF 15 ?? ?? ?? ?? 44 8B C7 48 8D 54 24 ?? 48 8B CB E8 ?? ?? ?? ?? 44 8B 44 24 ?? 4C 8D 4C 24 ?? 8B D7 48 8B CB FF 15 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? } $chunk_2 = { 55 8B EC 51 51 57 68 08 1A 41 00 66 C7 45 ?? C2 14 C6 45 ?? 00 FF 15 ?? ?? ?? ?? 68 10 1A 41 00 50 FF 15 ?? ?? ?? ?? 83 65 ?? 00 8B F8 8D 45 ?? 50 6A 40 6A 03 57 FF 15 ?? ?? ?? ?? 6A 03 8D 45 ?? 50 57 E8 ?? ?? ?? ?? 83 C4 0C 8D 45 ?? 50 FF 75 ?? 6A 03 57 FF 15 ?? ?? ?? ?? } $chunk_3 = { 48 8D 0D ?? ?? ?? ?? C7 44 24 ?? 48 31 C0 C3 FF 15 ?? ?? ?? ?? 48 8B C8 48 8D 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? } condition: any of them } rule ESET_Sparklinggoblin_Mutex { meta: description = "SparklingGoblin ChaCha20 loaders mutexes" author = "ESET Research" id = "e33d2bc1-29d6-5117-8e0f-31f8bced0979" date = "2021-05-20" modified = "2021-08-26" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/sparklinggoblin/SparklingGoblin.yar#L465-L489" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" hash = "2edbea43f5c40c867e5b6bbd93cc972525df598b" hash = "b6d245d3d49b06645c0578804064ce0c072cbe0f" hash = "8be6d5f040d0085c62b1459afc627707b0de89cf" hash = "4668302969fe122874fb2447a80378dcb671c86b" hash = "9bdecb08e16a23d271d0a3e836d9e7f83d7e2c3b" hash = "9ce7650f2c08c391a35d69956e171932d116b8bd" logic_hash = "00fbd514c8e2d6dea3b0f175e857a613e158b64caf1f970e814d62f1ebe9d35c" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" strings: $mutex_1 = "kREwdFrOlvASgP4zWZyV89m6T2K0bIno" $mutex_2 = "v5EPQFOImpTLaGZes3Nl1JSKHku8AyCw" condition: any of them } rule ESET_Mozi_Killswitch : FILE { meta: description = "Mozi botnet kill switch" author = "Ivan Besina" id = "e3d34ae0-de06-5ff4-b44b-44d264b6dd29" date = "2023-09-29" modified = "2023-10-31" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/mozi/mozi.yar#L32-L51" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "90eaed2f7f5595b145b2678a46ef6179082192215369fa9235024b0ce1574a49" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $iptables1 = "iptables -I INPUT -p tcp --destination-port 7547 -j DROP" $iptables2 = "iptables -I OUTPUT -p tcp --sport 30005 -j DROP" $haha = "/haha" $networks = "/usr/networks" condition: all of them and filesize < 500KB } rule ESET_IIS_Group02 { meta: description = "Detects Group 2 native IIS malware family" author = "ESET Research" id = "945e3748-1072-55f3-abaa-903dfc250294" date = "2021-08-04" modified = "2021-08-04" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/badiis/badiis.yar#L134-L155" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "3fa2b8fed3c580f446b55412a920a5cfed2317b06aa93d059e9f89fdbec8f683" score = 75 quality = 76 tags = "" license = "BSD 2-Clause" version = "1" strings: $s1 = "HttpModule.pdb" ascii wide $s2 = "([\\w+%]+)=([^&]*)" $s3 = "([\\w+%]+)=([^!]*)" $s4 = "cmd.exe" $s5 = "C:\\Users\\Iso\\Documents\\Visual Studio 2013\\Projects\\IIS 5\\x64\\Release\\Vi.pdb" ascii wide $s6 = "AVRSAFunction" condition: ESET_IIS_Native_Module_PRIVATE and 3 of ( $s* ) } rule ESET_IIS_Group03 { meta: description = "Detects Group 3 native IIS malware family" author = "ESET Research" id = "9caf9b3e-611e-5e0e-a7ee-9e7515679022" date = "2021-08-04" modified = "2021-08-04" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/badiis/badiis.yar#L157-L176" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "d811c2ac610780bf968e86e8fd302cffc9434902e547399d06fdeb30d1719f51" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" strings: $s1 = "IIS-Backdoor.dll" $s2 = "CryptStringToBinaryA" $s3 = "CreateProcessA" $s4 = "X-Cookie" condition: ESET_IIS_Native_Module_PRIVATE and 3 of ( $s* ) } rule ESET_IIS_Group04_Rgdoor { meta: description = "Detects Group 4 native IIS malware family (RGDoor)" author = "ESET Research" id = "64a0e664-a4d9-555b-a11b-5f7d9d0678b1" date = "2021-08-04" modified = "2021-08-04" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/badiis/badiis.yar#L178-L199" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "be615dc0cc8bf0fd52cc5a88a3759c1cb1cd18703de74d16f5cce3eabccf91c6" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" strings: $i1 = "RGSESSIONID=" $s2 = "upload$" $s3 = "download$" $s4 = "cmd$" $s5 = "cmd.exe" condition: ESET_IIS_Native_Module_PRIVATE and ( $i1 or all of ( $s* ) ) } rule ESET_IIS_Group05_Iistealer { meta: description = "Detects Group 5 native IIS malware family (IIStealer)" author = "ESET Research" id = "598ec6b2-0349-5da7-acad-72ef2468b927" date = "2021-08-04" modified = "2021-08-04" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/badiis/badiis.yar#L201-L232" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "5dff445121fda59df805d6fcb5db3f8f8e52a6e63e2da2a6875f8c9ad9cafc72" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" strings: $s1 = "tojLrGzFMbcDTKcH" ascii wide $s2 = "4vUOj3IutgtrpVwh" ascii wide $s3 = "SoUnRCxgREXMu9bM" ascii wide $s4 = "9Zr1Z78OkgaXj1Xr" ascii wide $s5 = "cache.txt" ascii wide $s6 = "/checkout/checkout.aspx" ascii wide $s7 = "/checkout/Payment.aspx" ascii wide $s8 = "/privacy.aspx" $s9 = "X-IIS-Data" $s10 = "POST" $s11 = {C7 ?? CF 2F 00 63 00 C7 ?? D3 68 00 65 00 C7 ?? D7 63 00 6B 00 C7 ?? DB 6F 00 75 00 C7 ?? DF 74 00 2F 00 C7 ?? E3 63 00 68 00 C7 ?? E7 65 00 63 00 C7 ?? EB 6B 00 6F 00 C7 ?? EF 75 00 74 00 C7 ?? F3 2E 00 61 00 C7 ?? F7 73 00 70 00 C7 ?? FB 78 00 00 00} $s12 = {C7 ?? AF 2F 00 70 00 C7 ?? B3 72 00 69 00 C7 ?? B7 76 00 61 00 C7 ?? BB 63 00 79 00 C7 ?? BF 2E 00 61 00 C7 ?? C3 73 00 70 00 C7 ?? C7 78 00 00 00} condition: ESET_IIS_Native_Module_PRIVATE and 3 of ( $s* ) } rule ESET_IIS_Group06_ISN { meta: description = "Detects Group 6 native IIS malware family (ISN)" author = "ESET Research" id = "1f68fc42-61a3-5a7d-9daa-31ae3b561837" date = "2021-08-04" modified = "2021-08-04" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/badiis/badiis.yar#L234-L259" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "2f59034a642a9b92fc88922433cd5923be02332159cba5e16d99d9523ed43205" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" strings: $s1 = "isn7 config reloaded" $s2 = "isn7 config NOT reloaded, not found or empty" $s3 = "isn7 log deleted" $s4 = "isn7 log not deleted, ERROR 0x%X" $s5 = "isn7 log NOT found" $s6 = "isn_reloadconfig" $s7 = "D:\\soft\\Programming\\C++\\projects\\isapi\\isn7" $s8 = "get POST failed %d" $s9 = "isn7.dll" condition: ESET_IIS_Native_Module_PRIVATE and 3 of ( $s* ) } rule ESET_IIS_Group07_Iispy { meta: description = "Detects Group 7 native IIS malware family (IISpy)" author = "ESET Research" id = "64ed0189-a0be-5592-b9c6-1622700a7ed7" date = "2021-08-04" modified = "2021-08-04" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/badiis/badiis.yar#L261-L296" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "ec5db5f36d06f9b0bdfe598fc72431da35afc1473dcc29f437a0f48ea9835a03" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" strings: $s1 = "/credential/username" $s2 = "/credential/password" $s3 = "/computer/domain" $s4 = "/computer/name" $s5 = "/password" $s6 = "/cmd" $s7 = "%.8s%.8s=%.8s%.16s%.8s%.16s" $s8 = "ImpersonateLoggedOnUser" $s9 = "WNetAddConnection2W" $t1 = "X-Forwarded-Proto" $t2 = "Sec-Fetch-Mode" $t3 = "Sec-Fetch-Site" $t4 = "Cookie" $t5 = {49 45 4E 44 AE 42 60 82} $t6 = {89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52} condition: ESET_IIS_Native_Module_PRIVATE and 2 of ( $s* ) and any of ( $t* ) } rule ESET_IIS_Group09 { meta: description = "Detects Group 9 native IIS malware family" author = "ESET Research" id = "69d176bc-73b1-5c4d-bb7e-463d26e8e6a9" date = "2021-08-04" modified = "2021-08-04" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/badiis/badiis.yar#L339-L387" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "5f89f9488221b8db8d493b3c23b7f5edd957c15511148eca890558886c128192" score = 75 quality = 76 tags = "" license = "BSD 2-Clause" version = "1" strings: $i1 = "FliterSecurity.dll" $i2 = {56565656565656565656565656565656} $i3 = "app|hot|alp|svf|fkj|mry|poc|doc|20" xor $i4 = "yisouspider|yisou|soso|sogou|m.sogou|sogo|sogou|so.com|baidu|bing|360" xor $i5 = "baidu|m.baidu|soso|sogou|m.sogou|sogo|sogou|so.com|google|youdao" xor $i6 = "118|abc|1go|evk" xor $s1 = "AVCFuckHttpModuleFactory" $s2 = "X-Forward" $s3 = "fuck32.dat" $s4 = "fuck64.dat" $s5 = "&ipzz1=" $s6 = "&ipzz2=" $s7 = "&uuu=" $s8 = "http://20.3323sf.c" xor $s9 = "http://bj.whtjz.c" xor $s10 = "http://bj2.wzrpx.c" xor $s11 = "http://cs.whtjz.c" xor $s12 = "http://df.e652.c" xor $s13 = "http://dfcp.yyphw.c" xor $s14 = "http://es.csdsx.c" xor $s15 = "http://hz.wzrpx.c" xor $s16 = "http://id.3323sf.c" xor $s17 = "http://qp.008php.c" xor $s18 = "http://qp.nmnsw.c" xor $s19 = "http://sc.300bt.c" xor $s20 = "http://sc.wzrpx.c" xor $s21 = "http://sf2223.c" xor $s22 = "http://sx.cmdxb.c" xor $s23 = "http://sz.ycfhx.c" xor $s24 = "http://xpq.0660sf.c" xor $s25 = "http://xsc.b1174.c" xor condition: ESET_IIS_Native_Module_PRIVATE and any of ( $i* ) and 3 of ( $s* ) } rule ESET_IIS_Group10 { meta: description = "Detects Group 10 native IIS malware family" author = "ESET Research" id = "31368b38-9128-594d-888d-e97d3edc7a1f" date = "2021-08-04" modified = "2021-08-04" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/badiis/badiis.yar#L389-L423" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "48701168d7da726222227ef757f1a4005a49c0bf300123319ce03db09445b3ef" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" strings: $s1 = "IIS7.dll" $s2 = "(.*?)title(.*?)>" $s3 = "<meta(.*?)name(.*?)=(.*?)keywords(.*?)>" $s4 = "<meta(.*?)name(.*?)=(.*?)description(.*?)>" $s5 = "js.breakavs.co" $s6 = "微信群-赛车PK10群【进群微信fun57644】_幸运飞艇_幸运28群" $s7 = "北京赛车微信群,北京微信赛车群,北京赛车微信群,PK10群,北京赛车pk10微信群,PK10微信群,赛车微信群,北京赛车群," $s8 = "北京赛车微信群,北京微信赛车群【进群微信号fun57644】北京微信赛车群,北京微信赛车" $e1 = "Baiduspider" $e2 = "Sosospider" $e3 = "Sogou web spider" $e4 = "360Spider" $e5 = "YisouSpider" $e6 = "sogou.com" $e7 = "soso.com" $e8 = "uc.cn" $e9 = "baidu.com" $e10 = "sm.cn" condition: ESET_IIS_Native_Module_PRIVATE and 2 of ( $e* ) and 3 of ( $s* ) } rule ESET_IIS_Group11 { meta: description = "Detects Group 11 native IIS malware family" author = "ESET Research" id = "e9dac67a-1675-5198-ad26-d555696844f9" date = "2021-08-04" modified = "2021-08-04" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/badiis/badiis.yar#L425-L455" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "a67b6b49b5fc2c7f260c06201c59478f5472de63091c510af82d526c410abb0c" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" strings: $s1 = "DnsQuery_A" $s2 = "&reurl=" $s3 = "&jump=1" $s4 = "JVVRaeof" $s5 = "ncpmg::0" $s6 = "zkpzz0cnnuqwnw0eqo" $s7 = "jvvr<11yyy0cnnuqwnw0eqo130rjrAeofqwv?" condition: ESET_IIS_Native_Module_PRIVATE and 3 of ( $s* ) } rule ESET_IIS_Group12 { meta: description = "Detects Group 12 native IIS malware family" author = "ESET Research" id = "7278f2df-d18a-5d95-9c21-37906629a7f0" date = "2021-08-04" modified = "2021-08-04" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/badiis/badiis.yar#L457-L495" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "8da03328e3702aff8ea5de77fc220f326030c31972d27c0bd9b5918dca550aba" score = 75 quality = 78 tags = "" license = "BSD 2-Clause" version = "1" strings: $s1 = "C:\\inetpub\\temp\\IIS Temporary Compressed Files\\" $s2 = "F5XFFHttpModule.dll" $s3 = "gtest_redir" $s4 = "\\cmd.exe" nocase $s5 = "iuuq;00" $s6 = "?xhost=" $s7 = "&reurl=" $s8 = "?jump=1" $s9 = "app|zqb" $s10 = "ifeng|ivc|sogou|so.com|baidu|google|youdao|yahoo|bing|118114|biso|gougou|sooule|360|sm|uc" $s11 = "sogou|so.com|baidu|google|youdao|yahoo|bing|gougou|sooule|360|sm.cn|uc" $s12 = "Hotcss/|Hotjs/" $s13 = "HotImg/|HotPic/" $s14 = "msf connect error !!" $s15 = "download ok !!" $s16 = "download error !! " $s17 = "param error !!" $s18 = "Real Path: " $s19 = "unknown cmd !" $b1 = {15 BD 01 2E [-] 5E 40 08 97 [-] CF 8C BE 30 [-] 28 42 C6 3B} $b2 = {E1 0A DC 39 [-] 49 BA 59 AB [-] BE 56 E0 57 [-] F2 0F 88 3E} condition: ESET_IIS_Native_Module_PRIVATE and 5 of them } rule ESET_IIS_Group13_Iiserpent { meta: description = "Detects Group 13 native IIS malware family (IISerpent)" author = "ESET Research" id = "f22dffb1-466f-5a7b-b9aa-de7ba991db1a" date = "2021-08-04" modified = "2021-08-04" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/badiis/badiis.yar#L497-L523" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "7077b842c53ee1581ad4150cdfaac3502bfc0fbd3b823190ad648e09f36e442d" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" strings: $s1 = "/mconfig/lunlian.txt" $s2 = "http://sb.qrfy.ne" $s3 = "folderlinkpath" $s4 = "folderlinkcount" $s5 = "onlymobilespider" $s6 = "redirectreferer" $s7 = "loadSuccessfull : " $s8 = "spider" $s9 = "<a href=" $s11 = "?ReloadModuleConfig=1" $s12 = "?DisplayModuleConfig=1" condition: ESET_IIS_Native_Module_PRIVATE and 5 of them } rule ESET_IIS_Group14 { meta: description = "Detects Group 14 native IIS malware family" author = "ESET Research" id = "c773b09e-9f24-5e75-ba80-4be69af70b06" date = "2021-08-04" modified = "2021-08-04" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/badiis/badiis.yar#L525-L552" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "ef10a4dfb1a9164533677416a7c9ada715ce10bfc1e5f92b56cf54bd890d4575" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" strings: $i1 = "agent-self: %s" $i2 = "/utf.php?key=" $i3 = "/self.php?v=" $i4 = "<script type=\"text/javascript\" src=\"//speed.wlaspsd.co" $i5 = "now.asmkpo.co" $s1 = "Baiduspider" $s2 = "360Spider" $s3 = "Sogou" $s4 = "YisouSpider" $s6 = "HTTP_X_FORWARDED_FOR" condition: ESET_IIS_Native_Module_PRIVATE and 2 of ( $i* ) or 5 of them } rule ESET_Apt_Windows_Invisimole_Logs : FILE { meta: description = "Detects log files with collected created by InvisiMole's RC2CL backdoor" author = "ESET Research" id = "151883ad-1f44-55b4-b12a-f0d399527189" date = "2021-05-17" modified = "2021-05-17" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/invisimole/invisimole.yar#L54-L77" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "d42423ccc768f1823c76d5cb2aec26434c796fc35bd4e2fbf435fcf7997d3ff0" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" condition: uint32( 0 ) == 0x08F1CAA1 or uint32( 0 ) == 0x08F1CAA2 or uint32( 0 ) == 0x08F1CCC0 or uint32( 0 ) == 0x08F2AFC0 or uint32( 0 ) == 0x083AE4DF or uint32( 0 ) == 0x18F2CBB1 or uint32( 0 ) == 0x1900ABBA or uint32( 0 ) == 0x24F2CEA1 or uint32( 0 ) == 0xDA012193 or uint32( 0 ) == 0xDA018993 or uint32( 0 ) == 0xDA018995 or uint32( 0 ) == 0xDD018991 } rule ESET_Apt_Windows_Invisimole_SFX_Dropper : FILE { meta: description = "Detects trojanized InvisiMole files: patched RAR SFX droppers with added InvisiMole blobs (config encrypted XOR 2A at the end of a file)" author = "ESET Research" id = "08490bcd-3139-5fac-9c6c-5a32acb7217a" date = "2021-05-17" modified = "2021-05-17" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/invisimole/invisimole.yar#L79-L95" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "6ca248d42c1e889988e5931d80df071cb20e623fb0c4a208044cabe073f71ce4" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $encrypted_config = {5F 59 4F 58 19 18 04 4E 46 46 2A 5D 59 5A 58 43 44 5E 4C 7D 2A 0F 2A 59 2A 78 2A 4B 2A 58 2A 0E 2A 6F 2A 72 2A 4B 2A 0F 2A 4E 2A 04 2A 0F 2A 4E 2A 76 2A 0F 2A 79 2A 2A 2A 79 42 4F 46 46 6F 52 4F 49 5F 5E 4F 7D 2A 79 42 4F 46 46 19 18 04 4E 46 46 2A 7C 43 58 5E 5F 4B 46 6B 46 46 45 49 2A 66 45 4B 4E 66 43 48 58 4B 58 53 6B} condition: uint16( 0 ) == 0x5A4D and $encrypted_config } rule ESET_Apt_Windows_Invisimole_CPL_Loader : FILE { meta: description = "CPL loader" author = "ESET Research" id = "feff8627-6085-5835-ac1b-d4522245f7db" date = "2021-05-17" modified = "2021-05-17" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/invisimole/invisimole.yar#L97-L118" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "cd5c19e14faa7fd3758b30193ccf2bed3692ad29d8216466523ca25d2abcfe88" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $s1 = "WScr%steObject(\"WScr%s.Run(\"::{20d04fe0-3a%s30309d}\\\\::{21EC%sDD-08002B3030%s\", 0);" $s2 = "\\Control.js" wide $s3 = "\\Control Panel.lnk" wide $s4 = "FPC 3.0.4 [2019/04/13] for x86_64 - Win64" $s5 = "FPC 3.0.4 [2019/04/13] for i386 - Win32" $s6 = "imageapplet.dat" wide $s7 = "wkssvmtx" condition: uint16( 0 ) == 0x5A4D and ( 3 of them ) } rule ESET_Apt_Windows_Invisimole_Wrapper_DLL { meta: description = "Detects InvisiMole wrapper DLL with embedded RC2CL and RC2FM backdoors, by export and resource names" author = "ESET Research" id = "b9609b09-3ef5-5793-a3aa-4692cec367d9" date = "2021-05-17" modified = "2021-05-17" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/invisimole/invisimole.yar#L120-L138" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "156bc5bc7b0ed5c77a5a15e7799a3077d40150896476a60935cf21a9afe36856" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" condition: pe.exports( "GetDataLength" ) and for any y in ( 0 .. pe.number_of_resources - 1 ) : ( pe.resources [ y ] . type == pe.RESOURCE_TYPE_RCDATA and pe.resources [ y ] . name_string == "R\x00C\x002\x00C\x00L\x00" ) and for any y in ( 0 .. pe.number_of_resources - 1 ) : ( pe.resources [ y ] . type == pe.RESOURCE_TYPE_RCDATA and pe.resources [ y ] . name_string == "R\x00C\x002\x00F\x00M\x00" ) } rule ESET_Apt_Windows_Invisimole_DNS_Downloader : FILE { meta: description = "InvisiMole DNS downloader" author = "ESET Research" id = "1caa6c8b-3798-556e-835e-885b7f3f4511" date = "2021-05-17" modified = "2021-05-17" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/invisimole/invisimole.yar#L140-L170" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "88d6ed7ec1331153d19afc18473a4be2b214ad8af29fcf7051a2a8e40e088231" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $d = "DnsQuery_A" $s1 = "Wireshark-is-running-{9CA78EEA-EA4D-4490-9240-FC01FCEF464B}" xor $s2 = "AddIns\\" ascii wide xor $s3 = "pcornomeex." xor $s4 = "weriahsek.rxe" xor $s5 = "dpmupaceex." xor $s6 = "TCPViewClass" xor $s7 = "PROCMON_WINDOW_CLASS" xor $s8 = "Key%C" $s9 = "AutoEx%C" xor $s10 = "MSO~" $s11 = "MDE~" $s12 = "DNS PLUGIN, Step %d" xor $s13 = "rundll32.exe \"%s\",StartUI" condition: (( uint16( 0 ) == 0x5A4D ) or ESET_Invisimole_Blob_PRIVATE ) and $d and 5 of ( $s* ) } rule ESET_Apt_Windows_Invisimole_RC2CL_Backdoor : FILE { meta: description = "InvisiMole RC2CL backdoor" author = "ESET Research" id = "0228b8ee-bf03-504e-8cdf-8a1c9a79d54e" date = "2021-05-17" modified = "2021-05-17" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/invisimole/invisimole.yar#L172-L213" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "c38550023515d33eaaf0669cc8b874bcfd09653a07c7edbf72e3344d1cf31541" score = 75 quality = 78 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $s1 = "RC2CL" wide $s2 = "hp12KsNh92Dwd" wide $s3 = "ZLib package %s: files: %d, total size: %d" wide $s4 = "\\Un4seen" wide $s5 = {9E 01 3A AD} $s6 = "~mrc_" wide $s7 = "~src_" wide $s8 = "~wbc_" wide $s9 = "zdf_" wide $s10 = "~S0PM" wide $s11 = "~A0FM" wide $s12 = "~70Z63\\" wide $s13 = "~E070C" wide $s14 = "~N031E" wide $s15 = "%szdf_%s.data" wide $s16 = "%spicture.crd" wide $s17 = "%s70zf_%s.cab" wide $s18 = "%spreview.crd" wide $s19 = "Value_Bck" wide $s20 = "Value_WSFX_ZC" wide $s21 = "MachineAccessStateData" wide $s22 = "SettingsSR2" wide condition: (( uint16( 0 ) == 0x5A4D ) or ESET_Invisimole_Blob_PRIVATE ) and 5 of ( $s* ) } rule ESET_Apt_Windows_Invisimole : FILE { meta: description = "InvisiMole magic values, keys and strings" author = "ESET Research" id = "4d48996b-9792-57ba-a302-349220323712" date = "2021-05-17" modified = "2021-05-17" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/invisimole/invisimole.yar#L215-L255" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "7a2cff9febe77d718089ba4e1a33f3487594588892e418cec685bf22b156fa2b" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $s1 = "CryptProtectData" $s2 = "CryptUnprotectData" $s3 = {9E 01 3A AD} $s4 = "GET /getversion2a/%d%.2X%.2X/U%sN HTTP/1.1" $s5 = "PULSAR_LOADER.dll" $check_magic_old_32 = {3? F9 FF D0 DE} $check_magic_old_64 = {3? 64 FF D0 DE} $check_magic_new_32 = {81 3? 86 DA 11 CE} $check_magic_new_64 = {81 3? 64 DA 11 CE} condition: (( uint16( 0 ) == 0x5A4D ) or ESET_Invisimole_Blob_PRIVATE ) and ( any of ( $check_magic* ) ) and ( 2 of ( $s* ) ) } rule ESET_Apt_Windows_Invisimole_C2 : FILE { meta: description = "InvisiMole C&C servers" author = "ESET Research" id = "9279c8cd-2c16-5f90-a7f5-e668d57c805b" date = "2021-05-17" modified = "2021-05-17" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/invisimole/invisimole.yar#L257-L297" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "aff8456ce7a9ebe875c02e51c09b77ee7b1fddfc11d4ad236e12c8c5240a01a8" score = 75 quality = 78 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $s1 = "46.165.220.228" ascii wide $s2 = "80.255.3.66" ascii wide $s3 = "85.17.26.174" ascii wide $s4 = "185.193.38.55" ascii wide $s5 = "194.187.249.157" ascii wide $s6 = "195.154.255.211" ascii wide $s7 = "153.re" ascii wide fullword $s8 = "adstat.red" ascii wide $s9 = "adtrax.net" ascii wide $s10 = "akamai.sytes.net" ascii wide $s11 = "amz-eu401.com" ascii wide $s12 = "blabla234342.sytes.net" ascii wide $s13 = "mx1.be" ascii wide fullword $s14 = "statad.de" ascii wide $s15 = "time.servehttp.com" ascii wide $s16 = "upd.re" ascii wide fullword $s17 = "update.xn--6frz82g" ascii wide $s18 = "updatecloud.sytes.net" ascii wide $s19 = "updchecking.sytes.net" ascii wide $s20 = "wlsts.net" ascii wide $s21 = "ro2.host" ascii wide fullword $s22 = "2ld.xyz" ascii wide fullword $s23 = "the-haba.com" ascii wide $s24 = "82.202.172.134" ascii wide $s25 = "update.xn--6frz82g" ascii wide condition: (( uint16( 0 ) == 0x5A4D ) or ESET_Invisimole_Blob_PRIVATE ) and $s21 and any of them } rule ESET_Apt_Windows_TA410_Tendyron_Dropper { meta: description = "TA410 Tendyron Dropper" author = "ESET Research" id = "8d1e16d9-b5c2-5427-a0b4-7dd00a9df5ec" date = "2020-12-09" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L34-L53" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "45f7300a4b85624ad3fda5c73a24f53f53cb7990def4d84e04dcd8e5747f4f2e" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" strings: $s1 = "Global\\{F473B3BE-08EE-4710-A727-9E248F804F4A}" wide $s2 = "Global\\8D32CCB321B2" wide $s3 = "Global\\E4FE94F75490" wide $s4 = "Program Files (x86)\\Internet Explorer\\iexplore.exe" wide $s5 = "\\RPC Control\\OLE" wide $s6 = "ALPC Port" wide condition: int16 ( 0 ) == 0x5A4D and 4 of them } rule ESET_Apt_Windows_TA410_Tendyron_Installer { meta: description = "TA410 Tendyron Installer" author = "ESET Research" id = "95ccad1c-99fb-5d38-aec0-650db3e06b35" date = "2020-12-09" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L55-L73" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "9c3afb924747614f27c31cf2c3d98f4932a9d11597a3ac94263bf93be02801da" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" strings: $s1 = "Tendyron" wide $s2 = "OnKeyToken_KEB.dll" wide $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide $s4 = "Global\\8D32CCB321B2" $s5 = "\\RTFExploit\\" condition: int16 ( 0 ) == 0x5A4D and 3 of them } rule ESET_Apt_Windows_TA410_Tendyron_Downloader { meta: description = "TA410 Tendyron Downloader" author = "ESET Research" id = "afd8a2a7-8d58-5a96-b9e0-6f8b859e83c5" date = "2020-12-09" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L75-L107" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "16030a78ae9af8783f5913644294ceff861c8264ead8ca99435032be6d7949ef" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" strings: $chunk_1 = { 8A 10 80 F2 5C 80 C2 5C 88 10 40 83 E9 01 75 ?? } $s1 = "startModule" fullword condition: int16 ( 0 ) == 0x5A4D and all of them } rule ESET_Apt_Windows_TA410_X4_Strings { meta: description = "Matches various strings found in TA410 X4" author = "ESET Research" id = "e6af4516-8b79-5182-8571-7dd530632ddc" date = "2020-10-09" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L109-L125" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "d4b2321a6d0eb0ca8d7c47596af2a45c22b3aef15d1832d64d6588a62cab312a" score = 75 quality = 74 tags = "" license = "BSD 2-Clause" version = "1" strings: $s1 = "[X]InLoadSC" ascii wide nocase $s3 = "MachineKeys\\Log\\rsa.txt" ascii wide nocase $s4 = "MachineKeys\\Log\\output.log" ascii wide nocase condition: any of them } rule ESET_Apt_Windows_TA410_X4_Hash_Values : FILE { meta: description = "Matches X4 hash function found in TA410 X4" author = "ESET Research" id = "859bb977-82d0-5314-b1a8-fb3bb06a1b28" date = "2020-10-09" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L127-L149" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "bcf3891ff888ca99af9aa0e239b29241ae819022607fb829c5731267add308ea" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $s1 = {D1 10 76 C2 B6 03} $s2 = {71 3E A8 0D} $s3 = {DC 78 94 0E} $s4 = {40 0D E7 D6 06} $s5 = {83 BB FD E8 06} $s6 = {92 9D 9B FF EC 03} $s7 = {DD 0E FC FA F5 03} $s8 = {15 60 1E FB F5 03} condition: uint16( 0 ) == 0x5a4d and 4 of them } rule ESET_Apt_Windows_TA410_X4_Hash_Fct : FILE { meta: description = "Matches X4 hash function found in TA410 X4" author = "ESET Research" id = "5ca435a4-7c6e-594d-8c4d-d577735884e6" date = "2020-10-09" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L151-L187" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "3b2d44cb7685a99e9aeb08f886f6876d43ee99d1e52e40705c3fa97ce3bfa9a0" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $chunk_1 = { 0F B6 01 84 C0 74 ?? 48 69 D2 83 00 00 00 48 0F BE C0 48 03 D0 48 FF C1 E9 ?? ?? ?? ?? } condition: uint16( 0 ) == 0x5a4d and any of them } rule ESET_Apt_Windows_TA410_Lookback_Decryption : FILE { meta: description = "Matches encryption/decryption function used by LookBack." author = "ESET Research" id = "91947c6b-f357-5cf8-8522-4dcd517d01cb" date = "2021-10-12" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L189-L254" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "016dca6be654fcd193acc481e6a998efbb77e7ebd09b26614422be1136dd02c0" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $initialize = { 8B C6 //mov eax, esi 99 //cdq 83 E2 03 //and edx, 3 03 C2 //add eax, edx C1 F8 02 //sar eax, 2 8A C8 //mov cl, al 02 C0 //add al, al 02 C8 //add cl, al 88 4C 34 10 //mov byte ptr [esp + esi + 0x10], cl 46 //inc esi 81 FE 00 01 00 00 //cmp esi, 0x100 72 ?? } $generate = { 8A 94 1C 10 01 ?? ?? //mov dl, byte ptr [esp + ebx + 0x110] 8D 8C 24 10 01 ?? ?? //lea ecx, [esp + 0x110] 0F B6 C3 //movzx eax, bl 0F B6 44 04 10 //movzx eax, byte ptr [esp + eax + 0x10] 32 C2 //xor al, dl 02 F0 //add dh, al 0F B6 C6 //movzx eax, dh 03 C8 //add ecx, eax 0F B6 01 //movzx eax, byte ptr [ecx] 88 84 1C 10 01 ?? ?? //mov byte ptr [esp + ebx + 0x110], al 43 //inc ebx 88 11 //mov byte ptr [ecx], dl 81 FB 00 06 00 00 //cmp ebx, 0x600 72 ?? //jb 0x10025930 } $decrypt = { 0F B6 C6 //movzx eax, dh 8D 8C 24 10 01 ?? ?? //lea ecx, [esp + 0x110] 03 C8 //add ecx, eax 8A 19 //mov bl, byte ptr [ecx] 8A C3 //mov al, bl 02 C6 //add al, dh FE C6 //inc dh 02 F8 //add bh, al 0F B6 C7 //movzx eax, bh 8A 94 04 10 01 ?? ?? //mov dl, byte ptr [esp + eax + 0x110] 88 9C 04 10 01 ?? ?? //mov byte ptr [esp + eax + 0x110], bl 88 11 //mov byte ptr [ecx], dl 0F B6 C2 //movzx eax, dl 0F B6 CB //movzx ecx, bl 33 C8 //xor ecx, eax 8A 84 0C 10 01 ?? ?? //mov al, byte ptr [esp + ecx + 0x110] 30 04 2E //xor byte ptr [esi + ebp], al 46 //inc esi 3B F7 //cmp esi, edi 7C ?? //jl 0x10025980 } condition: uint16( 0 ) == 0x5a4d and all of them } rule ESET_Apt_Windows_TA410_Lookback_Loader : FILE { meta: description = "Matches the modified function in LookBack libcurl loader." author = "ESET Research" id = "d0aac4f6-f72f-5adf-8f8f-9251bad70131" date = "2021-10-12" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L256-L309" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "98390dd664227ad747e5572771d12e7ebd2475d26db27e85508347ac6f44f3bf" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $chunk_1 = { FF 15 ?? ?? ?? ?? //call dword ptr [0x100530e0] 6A 40 //push 0x40 68 00 10 00 00 //push 0x1000 68 F0 04 00 00 //push 0x4f0 6A 00 //push 0 FF 15 ?? ?? ?? ?? //call dword ptr [0x100530d4] 8B E8 //mov ebp, eax B9 3C 01 00 00 //mov ecx, 0x13c BE 60 30 06 10 //mov esi, 0x10063060 8B FD //mov edi, ebp 68 F0 04 00 00 //push 0x4f0 F3 A5 //rep movsd dword ptr es:[edi], dword ptr [esi] 55 //push ebp E8 ?? ?? ?? ?? //call 0x100258d0 8B 0D ?? ?? ?? ?? //mov ecx, dword ptr [0x100530e4] A1 ?? ?? ?? ?? //mov eax, dword ptr [0x100530c8] 68 6C 02 00 00 //push 0x26c 89 4C 24 ?? //mov dword ptr [esp + 0x1c], ecx 89 44 24 ?? //mov dword ptr [esp + 0x20], eax FF 15 ?? ?? ?? ?? //call dword ptr [0x10063038] 8B D8 //mov ebx, eax B9 9B 00 00 00 //mov ecx, 0x9b BE 50 35 06 10 //mov esi, 0x10063550 8B FB //mov edi, ebx 68 6C 02 00 00 //push 0x26c F3 A5 //rep movsd dword ptr es:[edi], dword ptr [esi] 53 //push ebx E8 ?? ?? ?? ?? //call 0x100258d0 83 C4 14 //add esp, 0x14 8D 44 24 ?? //lea eax, [esp + 0x10] 50 //push eax 53 //push ebx 8D 44 24 ?? //lea eax, [esp + 0x3c] 50 //push eax A1 ?? ?? ?? ?? //mov eax, dword ptr [0x10063058] FF 74 24 ?? //push dword ptr [esp + 0x28] 03 C5 //add eax, ebp FF D0 //call eax } condition: uint16( 0 ) == 0x5a4d and all of them } rule ESET_Apt_Windows_TA410_Lookback_Strings : FILE { meta: description = "Matches multiple strings and export names in TA410 LookBack." author = "ESET Research" id = "b693c468-5abf-579d-bc03-67f67339feb9" date = "2021-10-12" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L311-L331" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "d17ed604e3691c20fe489f95197b7b802ec951ed13d538fa6643449485b326b2" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $s1 = "SodomMainFree" ascii wide $s2 = "SodomMainInit" ascii wide $s3 = "SodomNormal.bin" ascii wide $s4 = "SodomHttp.bin" ascii wide $s5 = "sodom.ini" ascii wide $s6 = "SodomMainProc" ascii wide condition: uint16( 0 ) == 0x5a4d and ( 2 of them or pe.exports ( "SodomBodyLoad" ) or pe.exports ( "SodomBodyLoadTest" ) ) } rule ESET_Apt_Windows_TA410_Lookback_HTTP : FILE { meta: description = "Matches LookBack's hardcoded HTTP request" author = "ESET Research" id = "ca4ee437-5ac9-5715-90fb-e0e74a817bb5" date = "2021-10-12" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L333-L349" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "0e777f56136cd11d62abdf4f120410d5fe9cd522cfc06afbf085414a96279bf7" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $s1 = "POST http://%s/status.php?r=%d%d HTTP/1.1\x0d\nAccept: text/html, application/xhtml+xml, */*\x0d\nAccept-Language: en-us\x0d\nUser-Agent: %s\x0d\nContent-Type: application/x-www-form-urlencoded\x0d\nAccept-Encoding: gzip, deflate\x0d\nHost: %s\x0d\nContent-Length: %d\x0d\nConnection: Keep-Alive\x0d\nCache-Control: no-cache\x0d\n\x0d\n" ascii wide $s2 = "id=1&op=report&status=" condition: uint16( 0 ) == 0x5a4d and all of them } rule ESET_Apt_Windows_TA410_Lookback_Magic : FILE { meta: description = "Matches message header creation in LookBack." author = "ESET Research" id = "5a40a307-772b-5600-9e58-f4bc6dfe6711" date = "2021-10-12" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L351-L377" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "442a08a77fd2db03e507c0d5a32b17ab4e5936a209f7af23ef3c33a4b9f3d0d5" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $s1 = { C7 03 C2 2E AB 48 //mov dword ptr [ebx], 0x48ab2ec2 ( A1 | 8B 15 ) ?? ?? ?? ?? //mov (eax | edx), x [0-1] //push ebp 89 ?3 04 //mov dword ptr [ebc + 4], reg 8B 4? 24 ?? //mov reg, dword ptr [esp + X] 89 4? 08 //mov dword ptr [ebx + 8], ?? 89 ?? 0C //mov dword ptr [ebx + 0xc], ?? 8B 4? 24 ?? //mov reg, dword ptr [esp + X] [1-2] //push 1 or 2 args E8 ?? ?? ?? ?? //call } condition: uint16( 0 ) == 0x5a4d and all of them } rule ESET_Apt_Windows_TA410_Flowcloud_Loader_Strings : FILE { meta: description = "Matches various strings found in TA410 FlowCloud first stage." author = "ESET Research" id = "a3fb894f-8e26-5cbd-a1f2-8a9ab1db0901" date = "2021-10-12" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L379-L415" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "3c90723e009ffe2603910566ac52a324256676ee3ff128d94427681010e10e8b" score = 75 quality = 78 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $key = "y983nfdicu3j2dcn09wur9*^&initialize(y4r3inf;'fdskaf'SKF" $s2 = "startModule" fullword $s4 = "auto_start_module" wide $s5 = "load_main_module_after_install" wide $s6 = "terminate_if_fail" wide $s7 = "clear_run_mru" wide $s8 = "install_to_vista" wide $s9 = "load_ext_module" wide $s10 = "sll_only" wide $s11 = "fail_if_already_installed" wide $s12 = "clear_hardware_info" wide $s13 = "av_check" wide fullword $s14 = "check_rs" wide $s15 = "check_360" wide $s16 = "responsor.dat" wide ascii $s17 = "auto_start_after_install_check_anti" wide fullword $s18 = "auto_start_after_install" wide fullword $s19 = "extern_config.dat" wide fullword $s20 = "is_hhw" wide fullword $s21 = "SYSTEM\\Setup\\PrintResponsor" wide $event = "Global\\Event_{201a283f-e52b-450e-bf44-7dc436037e56}" wide ascii $s23 = "invalid encrypto hdr while decrypting" condition: uint16( 0 ) == 0x5a4d and ( $key or $event or 5 of ( $s* ) ) } rule ESET_Apt_Windows_TA410_Flowcloud_Header_Decryption : FILE { meta: description = "Matches the function used to decrypt resources headers in TA410 FlowCloud" author = "ESET Research" id = "403c1845-bc25-5a49-8553-8a0be18d6970" date = "2026-01-26" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L417-L496" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "74b6c42bf2de159b2b0a15637e6bd94069367e3000c887714d6e3b50aa3646be" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" strings: $chunk_1 = { 8B 1E 8B CF D3 CB 8D 0C 28 83 C7 06 30 18 8B 1E D3 CB 8D 0C 02 30 58 ?? 8B 1E D3 CB 8B 4C 24 ?? 03 C8 30 58 ?? 8B 1E D3 CB 8B 4C 24 ?? 03 C8 30 58 ?? 8B 1E D3 CB 8B 4C 24 ?? 03 C8 83 C0 06 30 58 ?? 8B 1E D3 CB 30 58 ?? 83 FF 10 72 ?? } condition: uint16( 0 ) == 0x5a4d and all of them } rule ESET_Apt_Windows_TA410_Flowcloud_Dll_Hijacking_Strings : FILE { meta: description = "Matches filenames inside TA410 FlowCloud malicious DLL." author = "ESET Research" id = "6636d4d0-0a7f-5971-a7f4-58803042d874" date = "2021-10-12" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L498-L517" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "e8082d4216364a12ba395f772b5caed94b3068d26a2b3a97ef711d61a82f65b3" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $dat1 = "emedres.dat" wide $dat2 = "vviewres.dat" wide $dat3 = "setlangloc.dat" wide $dll1 = "emedres.dll" wide $dll2 = "vviewres.dll" wide $dll3 = "setlangloc.dll" wide condition: uint16( 0 ) == 0x5a4d and ( all of ( $dat* ) or all of ( $dll* ) ) } rule ESET_Apt_Windows_TA410_Flowcloud_Malicious_Dll_Antianalysis : FILE { meta: description = "Matches anti-analysis techniques used in TA410 FlowCloud hijacking DLL." author = "ESET Research" id = "b38a1d4d-5053-5a6d-be8c-c00261936417" date = "2021-10-12" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L519-L552" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "8f14352118d32a43c17f70bd753acc48bd314965f10ab97818e8a434bbda96d9" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $chunk_1 = { 33 C0 E8 ?? ?? ?? ?? 83 C0 10 3D 00 00 00 80 7D 01 EB FF E0 50 C3 } condition: uint16( 0 ) == 0x5a4d and all of them } rule ESET_Apt_Windows_TA410_Flowcloud_Pdb : FILE { meta: description = "Matches PDB paths found in TA410 FlowCloud." author = "ESET Research" id = "8bf25768-941e-55c6-bd21-f6b614c9d75d" date = "2021-10-12" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L554-L567" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "ff95ab0f8e68efe612a6e0d70cebd8bf815d6b5e3877c098ac0761382dc310d6" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" condition: uint16( 0 ) == 0x5a4d and ( pe.pdb_path contains "\\FlowCloud\\trunk\\" or pe.pdb_path contains "\\flowcloud\\trunk\\" ) } rule ESET_Apt_Windows_TA410_Flowcloud_Shellcode_Decryption : FILE { meta: description = "Matches the decryption function used in TA410 FlowCloud self-decrypting DLL" author = "ESET Research" id = "8af7b2fa-be40-5ec8-8413-1c982a463a9a" date = "2021-10-12" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L569-L615" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "939ffe6a41c957aa5d6c012484b2deab49a5e71a4b7e203a41c180f872803921" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $chunk_1 = { 33 D2 8B 45 ?? BB 6B 04 00 00 F7 F3 81 C2 A8 01 00 00 81 E2 FF 00 00 00 8B 7D ?? 33 C9 EB ?? 30 14 39 00 14 39 41 3B 4D ?? 72 ?? } condition: uint16( 0 ) == 0x5a4d and all of them } rule ESET_Apt_Windows_TA410_Flowcloud_Fcclient_Strings : FILE { meta: description = "Strings found in fcClient/rescure.dat module." author = "ESET Research" id = "876bae0b-2612-559b-9ead-b633a3789663" date = "2021-10-12" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L617-L639" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "c05b7031a5aec1bcf29eca06c010c402edeb24a093a2043dbc21781dff22c7fe" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $s1 = "df257bdd-847c-490e-9ef9-1d7dc883d3c0" $s2 = "\\{2AFF264E-B722-4359-8E0F-947B85594A9A}" $s3 = "Global\\{26C96B51-2B5D-4D7B-BED1-3DCA4848EDD1}" wide $s4 = "{804423C2-F490-4ac3-BFA5-13DEDE63A71A}" wide $s5 = "{A5124AF5-DF23-49bf-B0ED-A18ED3DEA027}" wide $s6 = "XXXModule_func.dll" $driver1 = "\\drivers\\hidmouse.sys" wide fullword $driver2 = "\\drivers\\hidusb.sys" wide fullword condition: uint16( 0 ) == 0x5a4d and ( any of ( $s* ) or all of ( $driver* ) ) } rule ESET_Apt_Windows_TA410_Flowcloud_Fcclientdll_Strings : FILE { meta: description = "Strings found in fcClientDll/responsor.dat module." author = "ESET Research" id = "80ecaf51-406f-590c-8f9c-59672683de02" date = "2021-10-12" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L641-L669" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "3a93f58cf14b57a96157077ec14aa6fb181e3da80f4ba46c0379a58b67c08a0e" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $s1 = "http://%s/html/portlet/ext/draco/resources/draco_manager.swf/[[DYNAMIC]]/1" $s2 = "Cookie: COOKIE_SUPPORT=true; JSESSIONID=5C7E7A60D01D2891F40648DAB6CB3DF4.jvm1; COMPANY_ID=10301; ID=666e7375545678695645673d; PASSWORD=7a4b48574d746470447a303d; LOGIN=6863303130; SCREEN_NAME=4a2b455377766b657451493d; GUEST_LANGUAGE_ID=en-US" $fc_msg = ".fc_net.msg" $s4 = "\\pipe\\namedpipe_keymousespy_english" wide $s5 = "8932910381748^&*^$58876$%^ghjfgsa413901280dfjslajflsdka&*(^7867=89^&*F(^&*5678f5ds765f76%&*%&*5" $s6 = "cls_{CACB140B-0B82-4340-9B05-7983017BA3A4}" wide $s7 = "HTTP/1.1 200 OK\x0d\nServer: Apache-Coyote/1.1\x0d\nPragma: No-cache\x0d\nCache-Control: no-cache\x0d\nExpires: Thu, 01 Jan 1970 08:00:00 CST\x0d\nLast-Modified: Fri, 27 Apr 2012 08:11:04 GMT\x0d\nContent-Type: application/xml\x0d\nContent-Length: %d\x0d\nDate: %s GMT" $sql1 = "create table if not exists table_filed_space" $sql2 = "create table if not exists clipboard" $sql3 = "create trigger if not exists file_after_delete after delete on file" $sql4 = "create trigger if not exists file_data_after_insert after insert on file_data" $sql5 = "create trigger if not exists file_data_after_delete after delete on file_data" $sql6 = "create trigger if not exists file_data_after_update after update on file_data" $sql7 = "insert into file_data(file_id, ofs, data, status)" condition: uint16( 0 ) == 0x5a4d and ( any of ( $s* ) or #fc_msg >= 8 or 4 of ( $sql* ) ) } rule ESET_Apt_Windows_TA410_Rootkit_Strings : FILE { meta: description = "Strings found in TA410's Rootkit" author = "ESET Research" id = "a6a97721-571e-5414-9b00-5789d7bcd078" date = "2021-10-12" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L671-L697" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "1d3ad63508c5e4bca32b9a44b738cb4a7384ccfa5704ce329260adb342ea4e60" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" strings: $driver1 = "\\Driver\\kbdclass" wide $driver2 = "\\Driver\\mouclass" wide $device1 = "\\Device\\KeyboardClass0" wide $device2 = "\\Device\\PointerClass0" wide $driver3 = "\\Driver\\tcpip" wide $device3 = "\\Device\\tcp" wide $driver4 = "\\Driver\\nsiproxy" wide $device4 = "\\Device\\Nsi" wide $reg1 = "\\Registry\\Machine\\SYSTEM\\Setup\\AllowStart\\ceipCommon" wide $reg2 = "RHH%d" wide $reg3 = "RHP%d" wide $s1 = "\\SystemRoot\\System32\\drivers\\hidmouse.sys" wide condition: uint16( 0 ) == 0x5a4d and all of ( $s1 , $reg* ) and ( all of ( $driver* ) or all of ( $device* ) ) } rule ESET_Apt_Windows_TA410_Flowcloud_V5_Resources : FILE { meta: description = "Matches sequence of PE resource IDs found in TA410 FlowCloud version 5.0.2" author = "ESET Research" id = "05a233f0-a823-5154-a47d-cede722d4710" date = "2021-10-12" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L699-L720" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "58f75dda53c6d4b3d88f464c452d855ac6dc88add5f4fba2641f52e7a1ae00ed" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" condition: uint16( 0 ) == 0x5a4d and pe.number_of_resources >= 13 and for 12 resource in pe.resources : ( resource.type == 10 and resource.language == 1033 and ( resource.name_string == "1\x000\x000\x00" or resource.name_string == "1\x000\x000\x000\x00" or resource.name_string == "1\x000\x000\x000\x000\x00" or resource.name_string == "1\x000\x000\x001\x00" or resource.name_string == "1\x000\x001\x00" or resource.name_string == "1\x000\x002\x00" or resource.name_string == "1\x000\x003\x00" or resource.name_string == "1\x000\x004\x00" or resource.name_string == "1\x000\x005\x00" or resource.name_string == "1\x000\x006\x00" or resource.name_string == "1\x000\x007\x00" or resource.name_string == "1\x000\x008\x00" or resource.name_string == "1\x000\x009\x00" or resource.name_string == "1\x001\x000\x00" or resource.name_string == "2\x000\x000\x000\x00" or resource.name_string == "2\x000\x000\x001\x00" ) ) } rule ESET_Apt_Windows_TA410_Flowcloud_V4_Resources : FILE { meta: description = "Matches sequence of PE resource IDs found in TA410 FlowCloud version 4.1.3" author = "ESET Research" id = "57b98823-439f-5a2c-a8cb-ac5e98953b06" date = "2021-10-12" modified = "2022-04-27" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/ta410/ta410.yar#L722-L741" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "7b475cfddb5f995f7e8e3293b8e6ae59a9e36143998bc444499b5dce467f8e9d" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = "1" condition: uint16( 0 ) == 0x5a4d and pe.number_of_resources >= 6 and for 5 resource in pe.resources : ( resource.type == 10 and resource.language == 1033 and ( resource.name_string == "1\x000\x000\x000\x000\x00" or resource.name_string == "1\x000\x000\x000\x001\x00" or resource.name_string == "1\x000\x000\x000\x002\x00" or resource.name_string == "1\x000\x000\x000\x003\x00" or resource.name_string == "1\x000\x000\x000\x004\x00" or resource.name_string == "1\x000\x000\x000\x005\x00" or resource.name_string == "1\x000\x001\x000\x000\x00" ) ) } rule ESET_Kobalos { meta: description = "Kobalos malware" author = "Marc-Etienne M.Léveillé" id = "cdffbe3d-c19d-53a8-9051-48affae00c8a" date = "2020-11-02" modified = "2021-02-01" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/kobalos/kobalos.yar#L32-L56" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "9161d22f9fbb1700dc3121e32104240e34512cb280aaf950aec61513f89061ef" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" strings: $encrypted_strings_sizes = { 05 00 00 00 09 00 00 00 04 00 00 00 06 00 00 00 08 00 00 00 08 00 00 00 02 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 05 00 00 00 07 00 00 00 05 00 00 00 05 00 00 00 05 00 00 00 0A 00 00 00 } $password_md5_digest = { 3ADD48192654BD558A4A4CED9C255C4C } $rsa_512_mod_header = { 10 11 02 00 09 02 00 } $strings_rc4_key = { AE0E05090F3AC2B50B1BC6E91D2FE3CE } condition: any of them } rule ESET_Kobalos_Ssh_Credential_Stealer { meta: description = "Kobalos SSH credential stealer seen in OpenSSH client" author = "Marc-Etienne M.Léveillé" id = "b1fc5163-de48-57fc-8ae7-1f2be6c64d8a" date = "2020-11-02" modified = "2021-02-01" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/kobalos/kobalos.yar#L58-L73" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" logic_hash = "be238f5c2cc976a5638584a8c0fc580f2076735aadfe374e8d4162ba723bce10" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = "1" strings: $ = "user: %.128s host: %.128s port %05d user: %.128s password: %.128s" condition: any of them } rule ESET_Richheaders_Lazarus_Nukesped_Iconicpayloads_3CX_Q12023 { meta: description = "Rich Headers-based rule covering the IconicLoader and IconicStealer from the 3CX supply chain incident, and also payloads from the cryptocurrency campaigns from 2022-12" author = "ESET Research" id = "5c815d14-8a3e-5c6a-9dc3-988e0f31c094" date = "2023-03-31" modified = "2023-04-19" reference = "https://github.com/eset/malware-ioc" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/nukesped_lazarus/rich_headers_IconicPayloads_3CX.yar#L6-L23" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" hash = "3b88cda62cdd918b62ef5aa8c5a73a46f176d18b" hash = "cad1120d91b812acafef7175f949dd1b09c6c21a" hash = "5b03294b72c0caa5fb20e7817002c600645eb475" hash = "7491bd61ed15298ce5ee5ffd01c8c82a2cdb40ec" logic_hash = "f11a1db798bfcc534982bdf6afaae154b095b6a1e0896e75e2791c01e51a1c16" score = 75 quality = 80 tags = "" condition: pe.rich_signature.toolid( 259 , 30818 ) == 9 and pe.rich_signature.toolid ( 256 , 31329 ) == 1 and pe.rich_signature.toolid ( 261 , 30818 ) >= 30 and pe.rich_signature.toolid ( 261 , 30818 ) <= 38 and pe.rich_signature.toolid ( 261 , 29395 ) >= 134 and pe.rich_signature.toolid ( 261 , 29395 ) <= 164 and pe.rich_signature.toolid ( 257 , 29395 ) >= 6 and pe.rich_signature.toolid ( 257 , 29395 ) <= 14 } rule ESET_Ebury_V1_7_Crypto { meta: description = "This rule detects the strings decryption routine in Ebury v1.7 and v1.8" author = "ESET, spol. s r.o." id = "93dadf5f-b572-5217-8c82-4957c6d24955" date = "2023-08-01" modified = "2024-04-29" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/windigo/ebury.yar#L56-L97" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" hash = "e7debd6e453192ad8376db5bab03ed0d87566591" logic_hash = "41908951069a472d7528f2f228f3681f008d16a0436e341d339909efc4933e66" score = 75 quality = 80 tags = "" license = "BSD 2-Clause" version = 1 strings: $64 = { 48 69 ( 9C 24 ?? ?? ?? ?? | 5C 24 ?? | D2) 6D 4E C6 41 // imul rbx, [rsp+_buf], 41C64E6Dh 8B (0C 16 | 34 07) // mov ecx, [rsi+rdx] 48 81 C? 39 30 00 00 // add rbx, 12345 ( 31 D? | // xor ecx, ebx 31 D? 48 89 9C 24 ?? ?? ?? ?? | // mov [rsp+_buf], rbx 31 D? 48 89 5C 24 ?? ) // ^ optional 89 (0C 10 | 34 01) // mov [rax+rdx], ecx 48 83 C? 04 // add rdx, 4 48 (81 FA | 3D ) ?? ?? ?? ?? // cmp rdx, _size 75 D? // jnz short _begin } $32 = { 69 C9 6D 4E C6 41 // imul ecx, 41C64E6Dh 8B B4 1A ?? ?? ?? ?? // mov esi, [edx+ebx+_data] 81 C1 39 30 00 00 // add ecx, 12345 31 CE // xor esi, ecx 89 34 10 // mov [eax+edx], esi 83 C2 04 // add edx, 4 81 FA ?? ?? ?? ?? // cmp edx, _size 75 DD // jnz short loc_69A5 } condition: any of them } rule ESET_Cw_Windows_Redline_Panel_Tab_Headers : FILE { meta: description = "Matches view headers in Redline Panel" author = "ESET Research" id = "44a95845-b0a3-59c1-8188-86d415eff0bf" date = "2022-10-11" modified = "2024-11-12" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/redline/redline.yar#L32-L55" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" hash = "a154dfaedc237c047f419eb6884dab1ef4e2a17d" logic_hash = "3198aa9df2814a5f1d5568c6eed5f3189b2f72b3928cc97645f9bf57eebab9ac" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = 2 strings: $ = "RedLine | Log In" $ = "RedLine | Autofilles Viewer" $ = "RedLine | Choose Browser" $ = "RedLine | Cookie Viewer" $ = "RedLine | Credit Card Viewer" $ = "RedLine | Files Viewer" $ = "RedLine | Log saver" $ = "RedLine | System Info Viewer" condition: uint16( 0 ) == 0x5A4D and 6 of them } rule ESET_Cw_Windows_Redline_Panel_Distinctive_Strings : FILE { meta: description = "Matches rare strings found in Redline panel" author = "ESET Research" id = "d40ccb6b-e777-5c05-b97c-ead910047649" date = "2022-10-11" modified = "2024-11-12" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/redline/redline.yar#L57-L77" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" hash = "a154dfaedc237c047f419eb6884dab1ef4e2a17d" logic_hash = "7ff0239426c4c3b46a269fad71232295c038c09f276cdc3c7f1142c830260a6d" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = 2 strings: $env_var = "%DSK_23%" $fn_name = "IsGratherThan" $telegram0 = "Telegram: @REDLINESUPPORT" $telegram1 = "https://t.me/REDLINESUPPORT" condition: uint16( 0 ) == 0x5A4D and any of them } rule ESET_Cw_Windows_Redline_Panel_Prompts : FILE { meta: description = "Matches prompt messages in Redline panel" author = "ESET Research" id = "3481586b-ed4b-5a27-82a0-0bbb3eea279e" date = "2022-10-11" modified = "2024-11-12" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/redline/redline.yar#L79-L113" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" hash = "a154dfaedc237c047f419eb6884dab1ef4e2a17d" logic_hash = "0dfab05a9383ba13b3c610f1ab0c81e95804470002f27171ab39706f7723983a" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = 2 strings: $ = "Choose directory to save log" $ = "Select log to set comment" $ = "Please enter an action to create new task" $ = "Please enter a target to create new task" $ = "Please enter a final point to create new task" $ = "Please enter a correct action to create new task" $ = "Please enter a correct final point to create new task" $ = "Please enter an action to edit task" $ = "Please enter a target to edit task" $ = "Please enter a final point to edit task" $ = "Please enter a correct action to edit task" $ = "Please enter a correct final point to edit task" $ = "Please enter a correct status to edit task" $ = "Please, enter a domains" $ = "Please, enter a valid server ip" $ = "Choose a file to pump" $ = "Enter a valid count of bytes" $ = "Enter a valid count of bytes. Must be more then zero" $ = "Disconnected. Reboot your panel" condition: uint16( 0 ) == 0x5A4D and 10 of them } rule ESET_Cw_Windows_Redline_Panel_Status_Message_Strings : FILE { meta: description = "Matches error/success messages in Redline panel" author = "ESET Research" id = "70bdff10-9c86-57e3-b839-e86173a44855" date = "2022-10-11" modified = "2024-11-12" reference = "https://github.com/eset/malware-ioc/" source_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/redline/redline.yar#L115-L142" license_url = "https://github.com/eset/malware-ioc/blob/59745502656e813f9f79fc8005243edbc04f9397/LICENSE" hash = "a154dfaedc237c047f419eb6884dab1ef4e2a17d" logic_hash = "c60fabc81967b083be72ff564af744ab60441de5d563ea6d88d873c0a99bfbdd" score = 75 quality = 80 tags = "FILE" license = "BSD 2-Clause" version = 1 strings: $ = "All Browsers are empty" $ = "Client [{0}:{1}:{2}] completed task with {3} ID." $ = "A List of logs cleared" $ = "Browsers not found" $ = "Browsers is empty" $ = "Done. Check your build file" $ = "You must to enable assembly info or certificate in settings" $ = "Duplicate log from " $ = "Password list is empty" $ = "Cookie list is empty" $ = "FTPs not found" $ = "Files not found" condition: uint16( 0 ) == 0x5A4D and 8 of them } /* * YARA Rule Set * Repository Name: FireEye-RT * Repository: https://github.com/mandiant/red_team_tool_countermeasures/ * Retrieval Date: 2026-10-26 * Git Commit: 3561b71724dbfa3e2bb78106aaa2d7f8b892c43b * Number of Rules: 148 * Skipped: 0 (age), 16 (quality), 7 (score), 0 (importance) * * * LICENSE * * BSD 2-Clause License Copyright (c) 2023, MANDIANT Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ rule FIREEYE_RT_Hacktool_MSIL_Sharphound_3 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project." author = "FireEye" id = "456b3208-1e8d-5eb7-81ee-39f1c886c5a7" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PUPPYHOUND/production/yara/HackTool_MSIL_SharpHound_3.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "eeedc09570324767a3de8205f66a5295" logic_hash = "baeea6cae42c755ee389378229b2b206c82f60f75a5ce5f9cfa06871fc9507d1" score = 75 quality = 73 tags = "FILE" rev = 4 strings: $typelibguid1 = "A517A8DE-5834-411D-ABDA-2D0E1766539C" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1 } rule FIREEYE_RT_Hacktool_MSIL_Puppyhound_1 : FILE { meta: description = "This is a modification of an existing FireEye detection for SharpHound. However, it looks for the string 'PuppyHound' instead of 'SharpHound' as this is all that was needed to detect the PuppyHound variant of SharpHound." author = "FireEye" id = "1155f959-c8bc-597a-8a80-abee8d95b6ec" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PUPPYHOUND/production/yara/HackTool_MSIL_PuppyHound_1.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "eeedc09570324767a3de8205f66a5295" logic_hash = "39073bbfef15ecd28c1772e5d01e54c3d5774ecb4c90f0076bda5dc400abacba" score = 75 quality = 75 tags = "FILE" rev = 6 strings: $1 = "PuppyHound" $2 = "UserDomainKey" $3 = "LdapBuilder" $init = { 28 [2] 00 0A 0A 72 [2] 00 70 1? ?? 28 [2] 00 0A 72 [2] 00 70 1? ?? 28 [2] 00 0A 28 [2] 00 0A 0B 1F 2D } $msil = /\x00_Cor(Exe|Dll)Main\x00/ condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_Builder_MSIL_G2JS_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the Gadget2JScript project." author = "FireEye" id = "484202c2-ac7d-5e6c-8bf1-3452a357c668" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/G2JS/production/yara/Builder_MSIL_G2JS_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "fa255fdc88ab656ad9bc383f9b322a76" logic_hash = "487d8e8deef218412f241d99ce32b63bfeb3568d23048b9dd4afff8f401bfea5" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid1 = "AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1 } rule FIREEYE_RT_APT_Trojan_Linux_REDFLARE_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "220302bc-4ed3-5e10-9bd2-a8ed2bdaef73" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/supplemental/yara/APT_Trojan_Linux_REDFLARE_1.yar#L4-L20" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e" logic_hash = "282f11c4c86d88d05f11e92f5483701d9a54c2dd39f21316cd271aa78a338d0f" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $s1 = "find_applet_by_name" fullword $s2 = "bb_basename" fullword $s3 = "hk_printf_chk" fullword $s4 = "runCommand" fullword $s5 = "initialize" fullword condition: ( uint32( 0 ) == 0x464c457f ) and all of them } rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_6 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "5875a9ec-c3ee-57f0-a430-4443db585def" date = "2020-12-01" date = "2020-12-01" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/supplemental/yara/APT_Trojan_Win_REDFLARE_6.yar#L4-L20" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "294b1e229c3b1efce29b162e7b3be0ab, 6902862bd81da402e7ac70856afbe6a2" logic_hash = "1e6f8320e0c0b601fc72fa4d9c61e46adfbcd84638c97da5988ca848e036312a" score = 75 quality = 75 tags = "FILE" rev = 2 strings: $s1 = "RevertToSelf" fullword $s2 = "Unsuccessful" fullword $s3 = "Successful" fullword $s4 = "runCommand" fullword $s5 = "initialize" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Loader_Win64_REDFLARE_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "dc162f26-66d3-5359-b1d7-ef2208b359e2" date = "2020-11-27" date = "2020-11-27" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win64_REDFLARE_1.yar#L4-L17" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "f20824fa6e5c81e3804419f108445368" logic_hash = "2cae245a6aa36dccc2228cccefdc4ca0eb278901f063e072a369000f67d73a55" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $alloc_n_load = { 41 B9 40 00 00 00 41 B8 00 30 00 00 33 C9 [1-10] FF 50 [4-80] F3 A4 [30-120] 48 6B C9 28 [3-20] 48 6B C9 28 } $const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them } rule FIREEYE_RT_APT_Controller_Linux_REDFLARE_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "79a69740-7209-5c56-ad6f-eb4d0b29beaf" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Controller_Linux_REDFLARE_1.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e" logic_hash = "d6b0cc5f386da9bff8a8293f2b3857406044ab42f7c1bb23d5096052a3c42ce4" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $1 = "/RedFlare/gorat_server" $2 = "RedFlare/sandals" $3 = "goratsvr.CommandResponse" fullword $4 = "goratsvr.CommandRequest" fullword condition: ( uint32( 0 ) == 0x464c457f ) and all of them } rule FIREEYE_RT_APT_Loader_Raw64_REDFLARE_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "8e937f6a-404f-53bd-9de2-ed63b1cf48b2" date = "2020-11-27" date = "2020-11-27" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Raw64_REDFLARE_1.yar#L4-L16" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "5e14f77f85fd9a5be46e7f04b8a144f5" logic_hash = "dac122ccece8a6dd35a5fe9d37860a612aa50ab469b79f4375dbe776f60c7b57" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $load = { EB ?? 58 48 8B 10 4C 8B 48 ?? 48 8B C8 [1-10] 48 83 C1 ?? 48 03 D1 FF } condition: ( uint16( 0 ) != 0x5A4D ) and all of them } rule FIREEYE_RT_APT_Downloader_Win64_REDFLARE_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "15a5e22b-84b0-5b36-8772-1d496ac447b2" date = "2020-11-27" date = "2020-11-27" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Downloader_Win64_REDFLARE_1.yar#L4-L17" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "9529c4c9773392893a8a0ab8ce8f8ce1" logic_hash = "1b9bece6083403615841c752eac48fd20095e918d6e175563dd122be2885d875" score = 75 quality = 75 tags = "FILE" rev = 2 strings: $const = "Cookie: SID1=%s" fullword $http_req = { 00 00 08 80 81 3D [4] BB 01 00 00 75 [1-10] 00 00 80 00 [1-4] 00 10 00 00 [1-4] 00 20 00 00 89 [6-20] 00 00 00 00 [6-20] 00 00 00 00 [2-10] 00 00 00 00 45 33 C9 [4-20] 48 8D 15 [4] 48 8B 0D [4] FF 15 [4-50] B9 14 00 00 00 E8 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them } rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_2 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "84881e5c-05df-5911-af42-ec82e559588c" date = "2020-11-27" date = "2020-11-27" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_2.yar#L4-L20" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "9529c4c9773392893a8a0ab8ce8f8ce1,05b99d438dac63a5a993cea37c036673" logic_hash = "1f2e1f644b1932486444dfda30b7dad7f50121f59fa493eb8a1a0528ae46db26" score = 75 quality = 75 tags = "FILE" rev = 2 strings: $1 = "initialize" fullword $2 = "getData" fullword $3 = "putData" fullword $4 = "fini" fullword $5 = "Cookie: SID1=%s" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_4 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "6e8621b0-a0ee-5fc7-a2b8-1973a42d6e37" date = "2020-12-01" date = "2020-12-01" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_4.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "a8b5dcfea5e87bf0e95176daa243943d, 9dcb6424662941d746576e62712220aa" logic_hash = "d027e98ad8fa6d03a49ceffd81fba6a621173e2dbabae652bee2f4e8489bb378" score = 75 quality = 75 tags = "FILE" rev = 2 strings: $s1 = "LogonUserW" fullword $s2 = "ImpersonateLoggedOnUser" fullword $s3 = "runCommand" fullword $user_logon = { 22 02 00 00 [1-10] 02 02 00 00 [0-4] E8 [4-40] ( 09 00 00 00 [1-10] 03 00 00 00 | 6A 03 6A 09 ) [4-30] FF 15 [4] 85 C0 7? } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_7 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "f891e477-9ff2-57be-9ca5-dd87d9baee29" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_7.yar#L4-L21" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "e7beece34bdf67cbb8297833c5953669, 8025bcbe3cc81fc19021ad0fbc11cf9b" logic_hash = "6d7822256ac1bef05304d3396df773e2b20a397311ad820d6ec5fe4cb6bdfbbc" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $1 = "initialize" fullword $2 = "getData" fullword $3 = "putData" fullword $4 = "fini" fullword $5 = "NamedPipe" $named_pipe = { 88 13 00 00 [1-8] E8 03 00 00 [20-60] 00 00 00 00 [1-8] 00 00 00 00 [1-40] ( 6A 00 6A 00 6A 03 6A 00 6A 00 68 | 00 00 00 00 [1-6] 00 00 00 00 [1-6] 03 00 00 00 45 33 C? 45 33 C? BA ) 00 00 00 C0 [2-10] FF 15 [4-30] FF 15 [4-7] E7 00 00 00 [4-40] FF 15 [4] 85 C0 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Loader_Win64_REDFLARE_2 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "043f4e29-710d-5e17-a0ed-82cd3a565194" date = "2020-11-27" date = "2020-11-27" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win64_REDFLARE_2.yar#L4-L18" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "100d73b35f23b2fe84bf7cd37140bf4d" logic_hash = "9fad845ed963fae46ac7ddc44407d5f6ed0a061f6a106764b9f912ef718279b4" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $alloc = { 45 8B C0 33 D2 [2-6] 00 10 00 00 [2-6] 04 00 00 00 [1-6] FF 15 [4-60] FF 15 [4] 85 C0 [4-40] 20 00 00 00 [4-40] FF 15 [4] 85 C0 } $inject = { 83 F8 01 [2-20] 33 C0 45 33 C9 [3-10] 45 33 C0 [3-10] 33 D2 [30-100] FF 15 [4] 85 C0 [20-100] 01 00 10 00 [0-10] FF 15 [4] 85 C0 [4-30] FF 15 [4] 85 C0 [2-20] FF 15 [4] 83 F8 FF } $s1 = "ResumeThread" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them } rule FIREEYE_RT_APT_Keylogger_Win32_REDFLARE_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "ad14db66-d640-5712-b2c8-a3d42d5a90f3" date = "2020-12-01" date = "2020-12-01" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Keylogger_Win32_REDFLARE_1.yar#L4-L17" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "d7cfb9fbcf19ce881180f757aeec77dd" logic_hash = "aebbaa050bee3775ffac4214ea4ab58284384e7eb41e66ee4838b9359e72821e" score = 75 quality = 75 tags = "FILE" rev = 2 strings: $create_window = { 6A 00 68 [4] 6A 00 6A 00 68 00 00 00 80 68 00 00 00 80 68 00 00 00 80 68 00 00 00 80 68 00 00 CF 00 68 [4] 68 [4] 6A 00 FF 15 } $keys_check = { 6A 14 [0-5] FF [1-5] 6A 10 [0-5] FF [1-5] B9 00 80 FF FF 66 85 C1 75 ?? 68 A0 00 00 00 FF [1-5] B9 00 80 FF FF 66 85 C1 75 ?? 68 A1 00 00 00 FF [1-5] B9 00 80 FF FF 66 85 C1 74 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them } rule FIREEYE_RT_APT_Loader_Win32_REDFLARE_2 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "6a585401-bfd3-5aad-b484-09b6a30d9af5" date = "2020-11-27" date = "2020-11-27" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win32_REDFLARE_2.yar#L4-L17" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "4e7e90c7147ee8aa01275894734f4492" logic_hash = "98dfb71adbde4f8965e612c19f0965d8fa95805825569290fdf72eb1d86cfb70" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $inject = { 83 F8 01 [4-50] 6A 00 6A 00 68 04 00 00 08 6A 00 6A 00 6A 00 6A 00 5? [10-70] FF 15 [4] 85 C0 [1-20] 6A 04 68 00 10 00 00 5? 6A 00 5? [1-10] FF 15 [4-8] 85 C0 [1-20] 5? 5? 5? 8B [1-4] 5? 5? FF 15 [4] 85 C0 [1-20] 6A 20 [4-20] FF 15 [4] 85 C0 [1-40] 01 00 01 00 [2-20] FF 15 [4] 85 C0 [1-30] FF 15 [4] 85 C0 [1-20] FF 15 [4] 83 F8 FF } $s1 = "ResumeThread" condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them } rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_3 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "2f6785c4-f4d0-52ff-8c46-da953e2ca92a" date = "2020-12-01" date = "2020-12-01" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_3.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "9ccda4d7511009d5572ef2f8597fba4e,ece07daca53dd0a7c23dacabf50f56f1" logic_hash = "ee104bc145686a134e4d6d620dae7d1dacff7645d47f1a8d7a212327352b8e87" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $calc_image_size = { 28 00 00 00 [2-30] 83 E2 1F [4-20] C1 F8 05 [0-8] 0F AF C? [0-30] C1 E0 02 } $str1 = "CreateCompatibleBitmap" fullword $str2 = "BitBlt" fullword $str3 = "runCommand" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Downloader_Win32_REDFLARE_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "e8d7ee31-568e-58ac-98ad-49baa2eb37ea" date = "2020-11-27" date = "2020-11-27" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Downloader_Win32_REDFLARE_1.yar#L4-L17" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "05b99d438dac63a5a993cea37c036673" logic_hash = "a340a2a732a9b1aa74ca9d84009a88d1b14b6a03140a859384c0d6e745e4a90a" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $const = "Cookie: SID1=%s" fullword $http_req = { 00 00 08 80 81 3D [4] BB 01 00 00 75 [1-10] 00 00 80 00 [1-4] 00 10 00 00 [1-4] 00 20 00 00 89 [1-10] 6A 00 8B [1-8] 5? 6A 00 6A 00 6A 00 8B [1-8] 5? 68 [4] 8B [1-8] 5? FF 15 [4-40] 6A 14 E8 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them } rule FIREEYE_RT_APT_Keylogger_Win64_REDFLARE_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "3c980f5a-c775-5c25-ba28-91a93a1b9a85" date = "2020-12-01" date = "2020-12-01" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Keylogger_Win64_REDFLARE_1.yar#L4-L17" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "fbefb4074f1672a3c29c1a47595ea261" logic_hash = "26fe577ba637c484d9a8ccc2173b5892a76328a90a39a2bebbae6bd2a6329485" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $create_window = { 41 B9 00 00 CF 00 [4-40] 33 C9 [2-10] 00 00 00 80 [2-10] 00 00 00 80 [2-10] 00 00 00 80 [2-10] 00 00 00 80 FF 15 } $keys_check = { B9 14 00 00 00 FF 15 [4-8] B9 10 00 00 00 FF 15 [4] BE 00 80 FF FF 66 85 C6 75 ?? B9 A0 00 00 00 FF 15 [4] 66 85 C6 75 ?? B9 A1 00 00 00 FF 15 [4] 66 85 C6 74 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them } rule FIREEYE_RT_APT_Builder_PY_REDFLARE_1 { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "3b5ad25d-ce66-572e-9a91-40a73b8fd447" date = "2020-11-27" date = "2020-11-27" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Builder_PY_REDFLARE_1.yar#L4-L22" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "d0a830403e56ebaa4bfbe87dbfdee44f" logic_hash = "1948cadb7242eb69bffbc222802ce9c1af38d7a846da09b6343b1449fe054e42" score = 75 quality = 75 tags = "" rev = 1 strings: $1 = "LOAD_OFFSET_32 = 0x612" $2 = "LOAD_OFFSET_64 = 0x611" $3 = "class RC4:" $4 = "struct.pack('<Q' if is64b else '<L'" $5 = "stagerConfig['comms']['config']" $6 = "_x86.dll" $7 = "_x64.dll" condition: all of them and @1 [ 1 ] < @2 [ 1 ] and @2 [ 1 ] < @3 [ 1 ] and @3 [ 1 ] < @4 [ 1 ] and @4 [ 1 ] < @5 [ 1 ] } rule FIREEYE_RT_APT_Loader_Win32_REDFLARE_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "b8a2c388-3b27-5075-b0ee-2773ae0c67ad" date = "2020-11-27" date = "2020-11-27" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win32_REDFLARE_1.yar#L4-L17" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "01d68343ac46db6065f888a094edfe4f" logic_hash = "f9165aabe4bad215211cf98559099030ddb8a76175fbfcfee3c6f25d7614bdad" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $alloc_n_load = { 6A 40 68 00 30 00 00 [0-20] 6A 00 [0-20] FF D0 [4-60] F3 A4 [30-100] 6B C0 28 8B 4D ?? 8B 4C 01 10 8B 55 ?? 6B D2 28 } $const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them } rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_8 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "b090df60-8f4e-51ca-944c-6f9ce2d9c913" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_8.yar#L4-L22" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "9c8eb908b8c1cda46e844c24f65d9370, 9e85713d615bda23785faf660c1b872c" logic_hash = "5b8a0402886daebefb995e7df0877d51727c5b8dc58eeb8ff16ceec5e7811a20" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $1 = "PSRunner.PSRunner" fullword $2 = "CorBindToRuntime" fullword $3 = "ReportEventW" fullword $4 = "InvokePS" fullword wide $5 = "runCommand" fullword $6 = "initialize" fullword $trap = { 03 40 00 80 E8 [4] CC } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_5 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "892981d6-f310-5ee8-95b5-dd4bd720a86c" date = "2020-12-01" date = "2020-12-01" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_5.yar#L4-L20" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dfbb1b988c239ade4c23856e42d4127b, 3322fba40c4de7e3de0fda1123b0bf5d" logic_hash = "ab38e5ebded026829672941709797b40f8e13fb244b6a8ed3545de4358f727b8" score = 75 quality = 75 tags = "FILE" rev = 3 strings: $s1 = "AdjustTokenPrivileges" fullword $s2 = "LookupPrivilegeValueW" fullword $s3 = "ImpersonateLoggedOnUser" fullword $s4 = "runCommand" fullword $steal_token = { FF 15 [4] 85 C0 [1-40] C7 44 24 ?? 01 00 00 00 [0-20] C7 44 24 ?? 02 00 00 00 [0-20] FF 15 [4] FF [1-5] 85 C0 [4-40] 00 04 00 00 FF 15 [4-5] 85 C0 [2-20] ( BA 0F 00 00 00 | 6A 0F ) [1-4] FF 15 [4] 85 C0 74 [1-20] FF 15 [4] 85 C0 74 [1-20] ( 6A 0B | B9 0B 00 00 00 ) E8 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Loader_Raw32_REDFLARE_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "8f8ec27f-afac-5da5-b76f-b984e14e0066" date = "2020-11-27" date = "2020-11-27" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Raw32_REDFLARE_1.yar#L4-L16" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "4022baddfda3858a57c9cbb0d49f6f86" logic_hash = "05ed89bd82600b4d5ef01ece2e0a9bd84e968988fd2bda1bab4ec316a9a9906b" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $load = { EB ?? 58 [0-4] 8B 10 8B 48 [1-3] 8B C8 83 C1 ?? 03 D1 83 E9 [1-3] 83 C1 [1-4] FF D? } condition: ( uint16( 0 ) != 0x5A4D ) and all of them } rule FIREEYE_RT_Hacktool_MSIL_Sharpersist_2 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "49d7891e-b97a-52a8-acfd-bbf986732d6c" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPERSIST/production/yara/HackTool_MSIL_SharPersist_2.yar#L4-L23" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "98ecf58d48a3eae43899b45cec0fc6b7" logic_hash = "57387352f8fd08e8b859dffc1164d46370f248b337526c265634160010572a00" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $a1 = "SharPersist.lib" $a2 = "SharPersist.exe" $b1 = "ERROR: Invalid hotkey location option given." ascii wide $b2 = "ERROR: Invalid hotkey given." ascii wide $b3 = "ERROR: Keepass configuration file not found." ascii wide $b4 = "ERROR: Keepass configuration file was not found." ascii wide $b5 = "ERROR: That value already exists in:" ascii wide $b6 = "ERROR: Failed to delete hidden registry key." ascii wide $pdb1 = "\\SharPersist\\" $pdb2 = "\\SharPersist.pdb" condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( ( @pdb2 [ 1 ] < @pdb1 [ 1 ] + 50 ) or ( 1 of ( $a* ) and 2 of ( $b* ) ) ) } rule FIREEYE_RT_Hacktool_MSIL_Sharpersist_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPersist project." author = "FireEye" id = "586e6c91-6970-57d1-8d8c-05ae9eb6117a" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPERSIST/production/yara/HackTool_MSIL_SharPersist_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "98ecf58d48a3eae43899b45cec0fc6b7" logic_hash = "cf480026c31b522850e25ba2d7986773d9c664242a2667ecd33151621c98c91e" score = 75 quality = 73 tags = "FILE" rev = 1 strings: $typelibguid1 = "9D1B853E-58F1-4BA5-AEFC-5C221CA30E48" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1 } rule FIREEYE_RT_APT_Loader_Win32_Dshell_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "dad763bd-0e4a-542a-9920-ece11d23ce24" date = "2020-11-27" date = "2020-11-27" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_1.yar#L4-L20" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "12c3566761495b8353f67298f15b882c" logic_hash = "79643f9c252765647d80f6fe1ee7bb698fbc6a6c3a0ff1fd819a09bff031907c" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 } $sb2 = { FF 7? 0C B? [4-16] FF 7? 08 5? [0-12] E8 [4] 84 C0 74 05 B? 01 00 00 00 [0-16] 80 F2 01 0F 84 } $ss1 = "\x00CreateThread\x00" $ss2 = "base64.d" fullword $ss3 = "core.sys.windows" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them } rule FIREEYE_RT_APT_Loader_Win32_Dshell_2 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "ae34d547-d979-5ce2-bcf8-a5b4e4567de3" date = "2020-11-27" date = "2020-11-27" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_2.yar#L4-L21" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "590d98bb74879b52b97d8a158af912af" logic_hash = "958ff45add46c0a43e839e8007c1d9296ee89ddd8c045b8ec6b031b225207a6c" score = 75 quality = 75 tags = "FILE" rev = 2 strings: $sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 } $ss1 = "\x00CreateThread\x00" $ss2 = "base64.d" fullword $ss3 = "core.sys.windows" fullword $ss4 = "C:\\Users\\config.ini" fullword $ss5 = "Invalid config file" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them } rule FIREEYE_RT_APT_Loader_Win32_Dshell_3 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "6b6fccef-ac93-5f1b-b9b6-c2d3ee4d8da7" date = "2020-11-27" date = "2020-11-27" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_3.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "12c3566761495b8353f67298f15b882c" logic_hash = "ec2a8b0abc6cb6d1861199b892fbe84782b42babb08e3ea203d10ab17ff7a20a" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 } $ss1 = "\x00CreateThread\x00" $ss2 = "base64.d" fullword $ss3 = "core.sys.windows" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them } rule FIREEYE_RT_Hacktool_MSIL_Keefarce_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeeFarce' project." author = "FireEye" id = "c17add0c-e09f-5ced-a4e1-bf60afad4725" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/KEEFARCE/production/yara/HackTool_MSIL_KeeFarce_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "8db86230849137608880dbe448737fc70068d308772e294cc69301b18ae10908" score = 75 quality = 73 tags = "FILE" rev = 3 strings: $typelibguid0 = "17589ea6-fcc9-44bb-92ad-d5b3eea6af03" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Hacktool_MSIL_SAFETYKATZ_4 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SafetyKatz project." author = "FireEye" id = "e160b75d-cc39-5e16-86e1-cba9fe64a6b6" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SAFETYKATZ/production/yara/HackTool_MSIL_SAFETYKATZ_4.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "45736deb14f3a68e88b038183c23e597" logic_hash = "a02b4acea691d485f427ed26487f2f601065901324a8dcd6cd8de9502d8cd897" score = 75 quality = 73 tags = "FILE" rev = 3 strings: $typelibguid1 = "8347E81B-89FC-42A9-B22C-F59A6A572DEC" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1 } rule FIREEYE_RT_Hacktool_MSIL_Prepshellcode_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'PrepShellcode' project." author = "FireEye" id = "32fb6b1d-e01f-5555-8516-088dca2166cf" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PREPSHELLCODE/production/yara/HackTool_MSIL_PrepShellcode_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "aedae87d84275f6589c982c04175ddc0aee3e4f3ae959ced4b4e2294675522e6" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "d16ed275-70d5-4ae5-8ce7-d249f967616c" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Hacktool_MSIL_GETDOMAINPASSWORDPOLICY_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the recon utility 'getdomainpasswordpolicy' project." author = "FireEye" id = "69745e99-33cc-5171-ae7a-5c98439a0b6d" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/GETDOMAINPASSWORDPOLICY/production/yara/HackTool_MSIL_GETDOMAINPASSWORDPOLICY_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "6b2ea3ebfea2c87f16052f4a43b64eb2d595c2dd4a64d45dfce1642668dcf602" score = 75 quality = 73 tags = "FILE" rev = 4 strings: $typelibguid0 = "a5da1897-29aa-45f4-a924-561804276f08" ascii nocase wide condition: filesize < 10MB and ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Hacktool_MSIL_INVEIGHZERO_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'inveighzero' project." author = "FireEye" id = "f46fe365-ea50-5597-828e-61a7225e4c6e" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/INVEIGHZERO/production/yara/HackTool_MSIL_INVEIGHZERO_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "5d10557a83dae9508469fe87f4c0c91beec4d2812856eee461a82d5dbb89aa35" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "113ae281-d1e5-42e7-9cc2-12d30757baf1" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Methodology_OLE_CHARENCODING_2 : FILE { meta: description = "Looking for suspicious char encoding" author = "FireEye" id = "7abd1a11-7a55-50ac-aa6b-537e7c59a5ab" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SINFULOFFICE/supplemental/yara/Methodology_OLE_CHARENCODING_2.yar#L4-L23" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "41b70737fa8dda75d5e95c82699c2e9b" logic_hash = "20843295531dfd88934fe0902a5101c5c0828e82df3289d7f263f16df9c92324" score = 65 quality = 75 tags = "FILE" rev = 4 strings: $echo1 = "101;99;104;111;32;111;102;102;" ascii wide $echo2 = "101:99:104:111:32:111:102:102:" ascii wide $echo3 = "101x99x104x111x32x111x102x102x" ascii wide $pe1 = "77;90;144;" ascii wide $pe2 = "77:90:144:" ascii wide $pe3 = "77x90x144x" ascii wide $pk1 = "80;75;3;4;" ascii wide $pk2 = "80:75:3:4:" ascii wide $pk3 = "80x75x3x4x" ascii wide condition: ( uint32( 0 ) == 0xe011cfd0 ) and filesize < 10MB and any of them } rule FIREEYE_RT_Builder_MSIL_Sinfuloffice_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SinfulOffice' project." author = "FireEye" id = "cf020fb3-751b-5346-8c0d-dc0a552599a3" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SINFULOFFICE/production/yara/Builder_MSIL_SinfulOffice_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "b5d49a8720e4daa21e95ec66299daec42e65906017de886ea91f7bb6bfb04c77" score = 75 quality = 73 tags = "FILE" rev = 1 strings: $typelibguid0 = "9940e18f-e3c7-450f-801a-07dd534ccb9a" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "d438575f-3cb2-5cff-b5d4-733044f62e61" date = "2020-12-18" modified = "2020-12-18" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_1.yar#L5-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" logic_hash = "56237d686b954950849adeedc87d5f9fbff2335a0ff033ba8571b3e3b93f587c" score = 75 quality = 75 tags = "FILE" strings: $create_thread_injected = { 7E [2] 00 0A 0A 16 0B 16 8D [2] 00 01 0C 28 [2] 00 06 2? ?? 2A 28 [2] 00 0A 1E 3? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 2? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 7E [2] 00 0A 08 8E 69 7E [2] 00 04 7E [2] 00 04 28 [2] 00 06 0D 09 7E [2] 00 0A 28 [2] 00 0A } $iz1 = /_Cor(Exe|Dll)Main/ fullword $suspended_process = { 12 ?? FE 15 [2] 00 02 1? ?? FE 15 [2] 00 02 02 14 7E [2] 00 0A 7E [2] 00 0A 16 20 [2] 00 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_Hacktool_MSIL_HOLSTER_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the a customized version of the 'DUEDLLIGENCE' project." author = "FireEye" id = "e1e8979e-2dee-5061-a11d-00dcfba476c3" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/HackTool_MSIL_HOLSTER_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "a91bf61cc18705be2288a0f6f125068f" logic_hash = "bc254a1ab71f2a6092f139ce5a85347a7a4976f963603ffbbebb9b0d6ce6573c" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid1 = "a8bdbba4-7291-49d1-9a1b-372de45a9d88" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_3 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "42e4e777-6d51-5733-97df-dc27f13a27b7" date = "2020-12-18" modified = "2020-12-18" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_3.yar#L5-L16" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" logic_hash = "41cc6a4c7765b1e5e88d12660b69e434c83938ca974b9ccf6545b4dd5dd78378" score = 75 quality = 75 tags = "FILE" strings: $create_thread_injected = { 7E [2] 00 0A 0A 16 0B 16 8D [2] 00 01 0C 28 [2] 00 06 2? ?? 2A 28 [2] 00 0A 1E 3? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 2? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 7E [2] 00 0A 08 8E 69 7E [2] 00 04 7E [2] 00 04 28 [2] 00 06 0D 09 7E [2] 00 0A 28 [2] 00 0A } $iz1 = /_Cor(Exe|Dll)Main/ fullword $rc4 = { 20 00 01 00 00 8D [2] 00 01 1? ?? 20 00 01 00 00 8D [2] 00 01 1? ?? 03 8E 69 8D [2] 00 01 1? ?? 16 0B 2B ?? 1? ?? 07 02 07 02 8E 69 5D 91 9E 1? ?? 07 07 9E 07 17 58 0B 07 20 00 01 00 00 32 } $suspended_process = { 12 ?? FE 15 [2] 00 02 1? ?? FE 15 [2] 00 02 02 14 7E [2] 00 0A 7E [2] 00 0A 16 20 [2] 00 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_2 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "b10b476a-0d38-53e4-80cf-559618729268" date = "2020-12-18" modified = "2020-12-18" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_2.yar#L5-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" logic_hash = "5a2e0559e3b47c1957a42929fbbeba7a53c21619125381b01dcd8453b6ec4802" score = 75 quality = 75 tags = "FILE" strings: $1 = "DueDLLigence" fullword $2 = "CPlApplet" fullword $iz1 = /_Cor(Exe|Dll)Main/ fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_MSIL_Launcher_DUEDLLIGENCE_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'DUEDLLIGENCE' project." author = "FireEye" id = "86f0ebe5-110b-53e2-bba5-676f00c2cddd" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/MSIL_Launcher_DUEDLLIGENCE_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "a91bf61cc18705be2288a0f6f125068f" logic_hash = "bd6abaa909f0c776d81ed1115e875888336661c91df3881f4f3ea5dd27e115f8" score = 75 quality = 73 tags = "FILE" rev = 1 strings: $typelibguid0 = "73948912-cebd-48ed-85e2-85fcd1d4f560" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Loader_MSIL_Netshshellcoderunner_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'NetshShellCodeRunner' project." author = "FireEye" id = "b3521812-7ea3-5f80-89bd-3bdd71b687f2" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/NETSHSHELLCODERUNNER/production/yara/Loader_MSIL_NetshShellCodeRunner_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "97f6475a9d42697f633e06a9b04a85021ca4920145eb4af257d71b431448f0e9" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "49c045bc-59bb-4a00-85c3-4beb59b2ee12" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_FE_APT_Loader_MSIL_REVOLVER_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "d99620e0-39ed-58db-acce-0d885a9e0bf7" date = "2020-12-18" modified = "2020-12-18" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REVOLVER/production/yara/APT_Loader_MSIL_REVOLVER_1.yar#L5-L14" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" logic_hash = "1231f4c961dec122ebcb142052c2c7c03acf9b556cdb71a3efabde6bcf50a939" score = 75 quality = 75 tags = "FILE" strings: $inject = { 28 [2] 00 06 0? 0? 7B [2] 00 04 7E [2] 00 0A 28 [2] 00 0A [2-40] 7E [2] 00 0A 0? 20 00 10 00 00 28 [2] 00 0A 0? 28 [2] 00 0A 6F [2] 00 0A 1? ?? 7E [2] 00 0A 1? ?? 20 00 30 00 00 1F 40 28 [2] 00 06 [2-40] 28 [2] 00 0A 1? 3? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 1? ?? 1? ?? 1? 0? 1? ?? 8? 6? 28 [2] 00 0A 2? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 1? ?? 1? ?? 1? 0? 1? ?? 8? 6? 28 [2] 00 0A 1? ?? FE 15 [2] 00 02 1? ?? 72 [2] 00 70 28 [2] 00 06 1? ?? FE 15 [2] 00 02 1? ?? 1? ?? 1? 28 [2] 00 06 2? 7E [2] 00 0A 1? ?? 0? 7B [2] 00 04 1? ?? 1? 1? ?? 28 [2] 00 06 2? ?? 1? ?? 7E [2] 00 0A 28 [2] 00 0A [2-10] 7E [2] 00 0A 1? ?? 1? ?? 20 [2] 1F 00 7E [2] 00 0A 28 [2] 00 0A 6F [2] 00 0A 1? ?? 7E [2] 00 0A 1? 1? 20 [2] 00 00 20 [2] 00 00 7E [2] 00 0A 28 [2] 00 06 2? 1? ?? 7E [2] 00 0A 28 [2] 00 0A [2-40] 1? ?? 0? 7E [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 2? ?? 2? 1? 1? ?? 1? ?? 1? ?? 28 [2] 00 06 } $iz1 = /_Cor(Exe|Dll)Main/ fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Hacktool_MSIL_REVOLVER_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'revolver' project." author = "FireEye" id = "8fa5adb7-dc66-51bc-9f60-2308515f33a8" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REVOLVER/production/yara/APT_HackTool_MSIL_REVOLVER_1.yar#L4-L16" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "8df8a56ed55b7857adb95daa643d544a49eb5f1952b4ad3ef757c34dad2ce317" score = 75 quality = 71 tags = "FILE" rev = 2 strings: $typelibguid0 = "a8bdbba4-7291-49d1-9a1b-372de45a9d88" ascii nocase wide $typelibguid1 = "b214d962-7595-440b-abef-f83ecdb999d2" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Backdoor_Win_GORAT_5 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "73102bd2-7b94-5c7b-b9a4-cfc9cf5e3212" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_5.yar#L4-L23" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "cdf58a48757010d9891c62940c439adb, a107850eb20a4bb3cc59dbd6861eaf0f" logic_hash = "67f85fb3bedfd18a1226c92318f387be3c7ff9566ca2d554c49cf62389482552" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $1 = "comms.BeaconData" fullword $2 = "comms.CommandResponse" fullword $3 = "rat.BaseChannel" fullword $4 = "rat.Config" fullword $5 = "rat.Core" fullword $6 = "platforms.AgentPlatform" fullword $7 = "GetHostID" fullword $8 = "/rat/cmd/gorat_shared/dllmain.go" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Backdoor_Macos_GORAT_1 : FILE { meta: description = "This rule is looking for specific strings associated with network activity found within the MacOS generated variant of GORAT" author = "FireEye" id = "4646eadb-7acf-582f-9ad6-00f012ceed8a" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_MacOS_GORAT_1.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "68acf11f5e456744262ff31beae58526" logic_hash = "2df5f87d44968670511880d21ad184779d0561c7c426a5d6426bcefd0904a9b7" score = 75 quality = 75 tags = "FILE" rev = 3 strings: $s1 = "SID1=%s" ascii wide $s2 = "http/http.dylib" ascii wide $s3 = "Mozilla/" ascii wide $s4 = "User-Agent" ascii wide $s5 = "Cookie" ascii wide condition: (( uint32( 0 ) == 0xBEBAFECA ) or ( uint32( 0 ) == 0xFEEDFACE ) or ( uint32( 0 ) == 0xFEEDFACF ) or ( uint32( 0 ) == 0xCEFAEDFE ) ) and all of them } rule FIREEYE_RT_APT_Backdoor_Win_GORAT_1 : FILE { meta: description = "This detects if a sample is less than 50KB and has a number of strings found in the Gorat shellcode (stage0 loader). The loader contains an embedded DLL (stage0.dll) that contains a number of unique strings. The 'Cookie' string found in this loader is important as this cookie is needed by the C2 server to download the Gorat implant (stage1 payload)." author = "FireEye" id = "5ac84cf1-49fb-533d-b211-b1a92239063b" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_1.yar#L4-L23" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "66cdaa156e4d372cfa3dea0137850d20" logic_hash = "f6a0a923f64375e7ffdc080aec41db19a9e162405f1290ed0bbcce5a342bdadb" score = 75 quality = 75 tags = "FILE" rev = 4 strings: $s1 = "httpComms.dll" ascii wide $s2 = "Cookie: SID1=%s" ascii wide $s3 = "Global\\" ascii wide $s4 = "stage0.dll" ascii wide $s5 = "runCommand" ascii wide $s6 = "getData" ascii wide $s7 = "initialize" ascii wide $s8 = "Windows NT %d.%d;" ascii wide $s9 = "!This program cannot be run in DOS mode." ascii wide condition: filesize < 50KB and all of them } rule FIREEYE_RT_APT_Backdoor_Win_Gorat_Memory { meta: description = "Identifies GoRat malware in memory based on strings." author = "FireEye" id = "16fb1db7-711c-5d8d-9203-738c94f253fe" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GoRat_Memory.yar#L4-L27" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "3b926b5762e13ceec7ac3a61e85c93bb" logic_hash = "88272e59325d106f96d6b6f1d57daf968823c1e760067dee0334c66c521ce8c2" score = 75 quality = 75 tags = "" rev = 1 strings: $murica = "murica" fullword $rat1 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword $rat2 = "rat.(*Core).generateBeacon" fullword $rat3 = "rat.gJitter" fullword $rat4 = "rat/comms.(*protectedChannel).SendCmdResponse" fullword $rat5 = "rat/modules/filemgmt.(*acquire).NewCommandExecution" fullword $rat6 = "rat/modules/latlisten.(*latlistensrv).handleCmd" fullword $rat7 = "rat/modules/netsweeper.(*netsweeperRunner).runSweep" fullword $rat8 = "rat/modules/netsweeper.(*Pinger).listen" fullword $rat9 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword $rat10 = "rat/platforms/win/dyloader.(*memoryLoader).ExecutePluginFunction" fullword $rat11 = "rat/platforms/win/modules/namedpipe.(*dummy).Open" fullword $winblows = "rat/platforms/win.(*winblows).GetStage" fullword condition: $winblows or #murica > 10 or 3 of ( $rat* ) } rule FIREEYE_RT_Trojan_MSIL_GORAT_Module_Powershell_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Module - PowerShell' project." author = "FireEye" id = "b0fba130-9cd9-5b7f-a806-9ff8099f5731" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/Trojan_MSIL_GORAT_Module_PowerShell_1.yar#L4-L16" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "e596bc0316a4ef85f04c2683ebc7c94bf9b831843232c33e62c84991e4caeb97" score = 75 quality = 71 tags = "FILE" rev = 1 strings: $typelibguid0 = "38d89034-2dd9-4367-8a6e-5409827a243a" ascii nocase wide $typelibguid1 = "845ee9dc-97c9-4c48-834e-dc31ee007c25" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Trojan_MSIL_GORAT_Plugin_DOTNET_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Plugin - .NET' project." author = "FireEye" id = "faa73d64-4bb1-5c06-a3a5-1f1aa99ea932" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/Trojan_MSIL_GORAT_Plugin_DOTNET_1.yar#L4-L16" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "e979822273c6d1ccdfebd341c9e2cb1040fe34a04e8b41c024885063fd946ad5" score = 75 quality = 71 tags = "FILE" rev = 1 strings: $typelibguid0 = "cd9407d0-fc8d-41ed-832d-da94daa3e064" ascii nocase wide $typelibguid1 = "fc3daedf-1d01-4490-8032-b978079d8c2d" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Dropper_HTA_Wildchild_1 : FILE { meta: description = "This rule looks for strings present in unobfuscated HTAs generated by the WildChild builder." author = "FireEye" id = "f570baa5-7d58-5a0a-b713-769e62076f76" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WILDCHILD/production/yara/Dropper_HTA_WildChild_1.yar#L4-L24" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "3e61ca5057633459e96897f79970a46d" logic_hash = "60c1d53b8a43b9b7518f3260a4d61c6806641ee894a2a331a3a0a2ea0aff9d99" score = 75 quality = 75 tags = "FILE" rev = 5 strings: $s1 = "processpath" ascii wide $s2 = "v4.0.30319" ascii wide $s3 = "v2.0.50727" ascii wide $s4 = "COMPLUS_Version" ascii wide $s5 = "FromBase64Transform" ascii wide $s6 = "MemoryStream" ascii wide $s7 = "entry_class" ascii wide $s8 = "DynamicInvoke" ascii wide $s9 = "Sendoff" ascii wide $script_header = "<script language=" ascii wide condition: $script_header at 0 and all of ( $s* ) } rule FIREEYE_RT_Loader_MSIL_Wildchild_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the WildChild project." author = "FireEye" id = "350dd658-46c9-573b-b532-07e4b437ba8d" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WILDCHILD/production/yara/Loader_MSIL_WildChild_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "7e6bc0ed11c2532b2ae7060327457812" logic_hash = "e4320e33770613542182518ec787e4ccbb32f83c8afca5ec957d4846e6f4eb04" score = 75 quality = 73 tags = "FILE" rev = 4 strings: $typelibguid1 = "2e71d5ff-ece4-4006-9e98-37bb724a7780" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1 } rule FIREEYE_RT_APT_Loader_MSIL_WILDCHILD_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "b9e0707e-98eb-55da-ad1d-6a84bd113747" date = "2020-12-01" date = "2020-12-01" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WILDCHILD/production/yara/APT_Loader_MSIL_WILDCHILD_1.yar#L4-L18" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "6f04a93753ae3ae043203437832363c4" logic_hash = "a600c3d127f77dc1f99160e4a242e005970de0abd1798296b6a351b968ca1350" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $s1 = "\x00QueueUserAPC\x00" $s2 = "\x00WriteProcessMemory\x00" $sb1 = { 6F [2] 00 0A 28 [2] 00 0A 6F [2] 00 0A 13 ?? 28 [2] 00 0A 28 [2] 00 0A 13 ?? 11 ?? 11 ?? 28 [2] 00 0A [0-16] 7B [2] 00 04 1? 20 [4] 28 [2] 00 0A 11 ?? 28 [2] 00 0A 28 [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 [0-16] 14 7E [2] 00 0A 7E [2] 00 0A 1? 20 04 00 08 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 [0-16] 7B [2] 00 04 7E [2] 00 0A [0-16] 8E ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 06 [4-120] 28 [2] 00 06 [0-80] 6F [2] 00 0A 6F [2] 00 0A 28 [2] 00 06 13 ?? 11 ?? 11 ?? 7E [2] 00 0A 28 [2] 00 06 } condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSACK_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsack' project." author = "FireEye" id = "8e344acb-73c4-5509-be9d-85cf6fe94445" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSACK/production/yara/APT_HackTool_MSIL_SHARPSACK_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "ecc3250e65e34595b4b827add3eb3062edad6a3373930048bfd6225d4a229e93" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "1946808a-1a01-40c5-947b-8b4c3377f742" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Loader_Win64_MATRYOSHKA_2 : FILE { meta: description = "matryoshka.rs" author = "FireEye" id = "25f916bc-6ee1-5175-903c-4266b0a086e1" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Loader_Win64_MATRYOSHKA_2.yar#L4-L20" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "7f8102b789303b7861a03290c79feba0" logic_hash = "daa6f6d526bf959c268b2c5a4cae33307cfec5e9ca51283131bbfa66a582b505" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { 4D [2] 00 49 [2] 08 B? 02 00 00 00 31 ?? E8 [4] 48 89 ?? 48 89 ?? 4C 89 ?? 49 89 ?? E8 [4] 4C 89 ?? 48 89 ?? E8 [4] 83 [2] 01 0F 84 [4] 48 89 ?? 48 8B [2] 48 8B [2] 48 89 [5] 48 89 [5] 48 89 [5] 41 B? [4] 4C 89 ?? 31 ?? E8 [4] C7 45 [5] 48 89 ?? 4C 89 ?? E8 [4] 85 C0 } $sb2 = { 4C [2] 0F 83 [4] 41 0F [3] 01 41 32 [2] 00 48 8B [5] 48 3B [5] 75 ?? 41 B? 01 00 00 00 4C 89 ?? E8 [4] E9 } $si1 = "CreateToolhelp32Snapshot" fullword $si2 = "Process32Next" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them } rule FIREEYE_RT_APT_Dropper_Win64_MATRYOSHKA_1 : FILE { meta: description = "matryoshka_dropper.rs" author = "FireEye" id = "1406aafd-6217-51ef-b3af-107ee88f9c99" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Dropper_Win64_MATRYOSHKA_1.yar#L4-L18" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "edcd58ba5b1b87705e95089002312281" logic_hash = "23f811f8e9387ca6a1257a31af66de9739733e4728adba0a3e3f74b5e5c0a556" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { 8D 8D [4] E8 [4] 49 89 D0 C6 [2-6] 01 C6 [2-6] 01 [0-8] C7 44 24 ?? 0E 00 00 00 4C 8D 0D [4] 48 8D 8D [4] 48 89 C2 E8 [4] C6 [2-6] 01 C6 [2-6] 01 48 89 E9 48 8D 95 [4] E8 [4] 83 [2] 01 0F 8? [4] 48 01 F3 48 29 F7 48 [2] 08 48 89 85 [4] C6 [2-6] 01 C6 [2-6] 01 C6 [2-6] 01 48 8D 8D [4] 48 89 DA 49 89 F8 E8 } $sb2 = { 0F 29 45 ?? 48 C7 45 ?? 00 00 00 00 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 48 C7 45 ?? 00 00 00 00 C7 45 ?? 68 00 00 00 48 8B [2] 48 8D [2] 48 89 [3] 48 89 [3] 0F 11 44 24 ?? C7 44 24 ?? 08 00 00 0C C7 44 24 ?? 00 00 00 00 31 ?? 48 89 ?? 31 ?? 45 31 ?? 45 31 ?? E8 [4] 83 F8 01 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them } rule FIREEYE_RT_APT_Loader_Win_MATRYOSHKA_1 : FILE { meta: description = "matryoshka_process_hollow.rs" author = "FireEye" id = "c07fb67e-ded5-593d-b5dc-d0e2c3b5a352" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Loader_Win_MATRYOSHKA_1.yar#L4-L24" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "44887551a47ae272d7873a354d24042d" logic_hash = "8f762684ffd3984630bf41ededa78b8993b53b22591a59912cabfe635775de53" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $s1 = "ZwQueryInformationProcess" fullword $s2 = "WriteProcessMemory" fullword $s3 = "CreateProcessW" fullword $s4 = "WriteProcessMemory" fullword $s5 = "\x00Invalid NT Signature!\x00" $s6 = "\x00Error while creating and mapping section. NTStatus: " $s7 = "\x00Error no process information - NTSTATUS:" $s8 = "\x00Error while erasing pe header. NTStatus: " condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them } rule FIREEYE_RT_APT_Dropper_Win_MATRYOSHKA_1 : FILE { meta: description = "matryoshka_dropper.rs" author = "FireEye" id = "7fd305c7-0b1b-5d91-b968-7f1fb0a8ae47" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Dropper_Win_MATRYOSHKA_1.yar#L4-L20" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "edcd58ba5b1b87705e95089002312281" logic_hash = "a7bf7599ec9b4b1d09a8c90b70ae565a9396fb31d449da3c1492d6fa336d9c5e" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $s1 = "\x00matryoshka.exe\x00" $s2 = "\x00Unable to write data\x00" $s3 = "\x00Error while spawning process. NTStatus: \x0a\x00" $s4 = "\x00.execmdstart/Cfailed to execute process\x00" condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Builder_Win64_MATRYOSHKA_1 : FILE { meta: description = "matryoshka_pe_to_shellcode.rs" author = "FireEye" id = "0afcf13e-5cd3-5c1c-897e-b6d0c283ab0f" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Builder_Win64_MATRYOSHKA_1.yar#L4-L20" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "8d949c34def898f0f32544e43117c057" logic_hash = "b370d7dea44bccc92fc8dbd4ea0ee9bec523820108bf8bc67acb17ebf9835f74" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { 4D 5A 45 52 [0-32] E8 [0-32] 00 00 00 00 [0-32] 5B 48 83 EB 09 53 48 81 [0-32] C3 [0-32] FF D3 [0-32] C3 } $ss1 = "\x00Stub Size: " $ss2 = "\x00Executable Size: " $ss3 = "\x00[+] Writing out to file" condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them } rule FIREEYE_RT_APT_Loader_Win64_MATRYOSHKA_1 : FILE { meta: description = "matryoshka_process_hollow.rs" author = "FireEye" id = "69919a80-8ed1-5b8c-911a-ceb75570f11f" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Loader_Win64_MATRYOSHKA_1.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "44887551a47ae272d7873a354d24042d" logic_hash = "46e5480dc95ce8b9d8385c2e44a50b21629301535b93833c13cc3db319ac15dd" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { 48 8B 45 ?? 48 89 85 [0-64] C7 45 ?? 00 00 00 00 31 ?? E8 [4-64] BA 00 10 00 00 [0-32] 41 B8 04 00 00 00 E8 [4] 83 F8 01 [2-32] BA [4] E8 } $sb2 = { E8 [4] 83 F8 01 [2-64] 41 B9 00 10 00 00 [0-32] E8 [4] 83 F8 01 [2-32] 3D 4D 5A 00 00 [0-32] 48 63 ?? 3C [0-32] 50 45 00 00 [4-64] 0F B7 [2] 18 81 ?? 0B 01 00 00 [2-32] 81 ?? 0B 02 00 00 [2-32] 8B [2] 28 } $sb3 = { 66 C7 45 ?? 48 B8 48 C7 45 ?? 00 00 00 00 66 C7 45 ?? FF E0 [0-64] 41 B9 40 00 00 00 [0-32] E8 [4] 83 F8 01 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them } rule FIREEYE_RT_APT_Builder_PY_MATRYOSHKA_1 { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "0135f3bb-28b3-5fc4-85a2-b12c46c8bc45" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Builder_PY_MATRYOSHKA_1.yar#L4-L22" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "25a97f6dba87ef9906a62c1a305ee1dd" logic_hash = "71b26f4b319429ac356b55d22bccd1da85894d61f8c96452422de78d2d893420" score = 75 quality = 75 tags = "" rev = 1 strings: $s1 = ".pop(0)])" $s2 = "[1].replace('unsigned char buf[] = \"'" $s3 = "binascii.hexlify(f.read()).decode(" $s4 = "os.system(\"cargo build {0} --bin {1}\".format(" $s5 = "shutil.which('rustc')" $s6 = "~/.cargo/bin" $s7 = /[\x22\x27]\\\\x[\x22\x27]\.join\(\[\w{1,64}\[\w{1,64}:\w{1,64}[\x09\x20]{0,32}\+[\x09\x20]{0,32}2\]/ condition: all of them } rule FIREEYE_RT_Hacktool_MSIL_Sharpschtask_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpSchtask' project." author = "FireEye" id = "5c7a5dee-3bc2-54b2-a7e2-be05ba74d4a1" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSCHTASK/production/yara/HackTool_MSIL_SharpSchtask_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "7437fde82920f4d015a7f149b58924baf6cb220c6f6857d9509e23795ff0811c" score = 75 quality = 73 tags = "FILE" rev = 1 strings: $typelibguid0 = "0a64a5f4-bdb6-443c-bdc7-f6f0bf5b5d6c" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Hacktool_MSIL_JUSTASK_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'justask' project." author = "FireEye" id = "06a03d82-db69-5b5a-a578-a8053814e917" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/JUSTASK/production/yara/APT_HackTool_MSIL_JUSTASK_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "24d2f8e3838c4f02cd80644a396ce7cf105761d2feba54e39973564ca5e97571" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "aa59be52-7845-4fed-9ea5-1ea49085d67a" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Hacktool_MSIL_Keepersist_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeePersist' project." author = "FireEye" id = "950a4744-2696-5eb7-8524-7f689cb5dbb0" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/KEEPERSIST/production/yara/HackTool_MSIL_KeePersist_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "eae67c77a64ca07f9ef59a356bb2c3f3131f14e7f17c898ef8857a21090ace0e" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "1df47db2-7bb8-47c2-9d85-5f8d3f04a884" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Hacktool_Win32_Andrewspecial_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "69e27e92-d68e-5543-bada-170e32733dbb" date = "2020-11-25" date = "2020-11-25" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/HackTool_Win32_AndrewSpecial_1.yar#L4-L18" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "e89efa88e3fda86be48c0cc8f2ef7230" logic_hash = "529a49fb21250069111d03a174901dc2e1623ee2a1f446aae1bdb1579a227dd3" score = 75 quality = 75 tags = "FILE" rev = 4 strings: $dump = { 6A 00 68 FF FF 1F 00 FF 15 [4] 89 45 ?? 83 [2] 00 [1-50] 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 10 68 [4] FF 15 [4] 89 45 [10-70] 6A 00 6A 00 6A 00 6A 02 8B [2-4] 5? 8B [2-4] 5? 8B [2-4] 5? E8 [4-20] FF 15 } $shellcode_x86 = { B8 3C 00 00 00 33 C9 8D 54 24 04 64 FF 15 C0 00 00 00 83 C4 04 C2 14 00 } $shellcode_x86_inline = { C6 45 ?? B8 C6 45 ?? 3C C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 33 C6 45 ?? C9 C6 45 ?? 8D C6 45 ?? 54 C6 45 ?? 24 C6 45 ?? 04 C6 45 ?? 64 C6 45 ?? FF C6 45 ?? 15 C6 45 ?? C0 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 83 C6 45 ?? C4 C6 45 ?? 04 C6 45 ?? C2 C6 45 ?? 14 C6 45 ?? 00 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and $dump and any of ( $shellcode* ) } rule FIREEYE_RT_Credtheft_MSIL_Titospecial_2 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the TitoSpecial project. There are 2 GUIDs in this rule as the x86 and x64 versions of this tool use a different ProjectGuid." author = "FireEye" id = "0262c720-e6b8-5bf2-a242-19a7f044973f" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/CredTheft_MSIL_TitoSpecial_2.yar#L4-L16" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "4bf96a7040a683bd34c618431e571e26" logic_hash = "2f621f8de2a4679e6cbce7f41859eaa3095ca54090c8bfccd3b767590ac91f2c" score = 75 quality = 71 tags = "FILE" rev = 4 strings: $typelibguid1 = "C6D94B4C-B063-4DEB-A83A-397BA08515D3" ascii nocase wide $typelibguid2 = "3b5320cf-74c1-494e-b2c8-a94a24380e60" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( $typelibguid1 or $typelibguid2 ) } rule FIREEYE_RT_APT_Hacktool_MSIL_TITOSPECIAL_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "b12490ba-41f6-5469-bcbb-0d2e0055c193" date = "2020-11-25" date = "2020-11-25" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/APT_HackTool_MSIL_TITOSPECIAL_1.yar#L4-L20" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "4bf96a7040a683bd34c618431e571e26" logic_hash = "6def0c667d38c1bad9233628e509bdcaed322e75be4ff3823b0f788c391e090c" score = 75 quality = 75 tags = "FILE" rev = 5 strings: $ind_dump = { 1F 10 16 28 [2] 00 0A 6F [2] 00 0A [50-200] 18 19 18 73 [2] 00 0A 13 [1-4] 06 07 11 ?? 6F [2] 00 0A 18 7E [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 } $ind_s1 = "NtReadVirtualMemory" fullword wide $ind_s2 = "WriteProcessMemory" fullword $shellcode_x64 = { 4C 8B D1 B8 3C 00 00 00 0F 05 C3 } $shellcode_x86 = { B8 3C 00 00 00 33 C9 8D 54 24 04 64 FF 15 C0 00 00 00 83 C4 04 C2 14 00 } condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of ( $ind* ) and any of ( $shellcode* ) } rule FIREEYE_RT_Credtheft_MSIL_Titospecial_1 : FILE { meta: description = "This rule looks for .NET PE files that have the strings of various method names in the TitoSpecial code." author = "FireEye" id = "932bb013-03de-5cf7-89e9-b3232151d303" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/CredTheft_MSIL_TitoSpecial_1.yar#L4-L27" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "4bf96a7040a683bd34c618431e571e26" logic_hash = "4ac9a5ede4aea5d73545b459eb635f87ce08ba521afa48b76d2cfa94f1379226" score = 75 quality = 75 tags = "FILE" rev = 4 strings: $str1 = "Minidump" ascii wide $str2 = "dumpType" ascii wide $str3 = "WriteProcessMemory" ascii wide $str4 = "bInheritHandle" ascii wide $str5 = "GetProcessById" ascii wide $str6 = "SafeHandle" ascii wide $str7 = "BeginInvoke" ascii wide $str8 = "EndInvoke" ascii wide $str9 = "ConsoleApplication1" ascii wide $str10 = "getOSInfo" ascii wide $str11 = "OpenProcess" ascii wide $str12 = "LoadLibrary" ascii wide $str13 = "GetProcAddress" ascii wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of ( $str* ) } rule FIREEYE_RT_Hacktool_Win64_Andrewspecial_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "20ce4902-4eb3-5ecf-aa8c-0515965dde57" date = "2020-11-25" date = "2020-11-25" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/HackTool_Win64_AndrewSpecial_1.yar#L4-L18" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "4456e52f6f8543c3ba76cb25ea3e9bd2" logic_hash = "96f06c46dfec795fcfd08c188853d0a3f781003ae118833719a175eb59049c0d" score = 75 quality = 75 tags = "FILE" rev = 5 strings: $dump = { 33 D2 B9 FF FF 1F 00 FF 15 [10-90] 00 00 00 00 [2-6] 80 00 00 00 [2-6] 02 00 00 00 45 33 C9 45 33 C0 BA 00 00 00 10 48 8D 0D [4] FF 15 [4-120] 00 00 00 00 [2-6] 00 00 00 00 [2-6] 00 00 00 00 41 B9 02 00 00 00 [6-15] E8 [4-20] FF 15 } $shellcode_x64 = { 4C 8B D1 B8 3C 00 00 00 0F 05 C3 } $shellcode_x64_inline = { C6 44 24 ?? 4C C6 44 24 ?? 8B C6 44 24 ?? D1 C6 44 24 ?? B8 C6 44 24 ?? 3C C6 44 24 ?? 00 C6 44 24 ?? 00 C6 44 24 ?? 00 C6 44 24 ?? 0F C6 44 24 ?? 05 C6 44 24 ?? C3 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and $dump and any of ( $shellcode* ) } rule FIREEYE_RT_Dropper_LNK_Lnksmasher_1 : FILE { meta: description = "The LNKSmasher project contains a prebuilt LNK file that has pieces added based on various configuration items. Because of this, several artifacts are present in every single LNK file generated by LNKSmasher, including the Drive Serial #, the File Droid GUID, and the GUID CLSID." author = "FireEye" id = "1b93ddf8-9578-5e47-b479-4c9e8a40b4f4" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LNKSMASHER/production/yara/Dropper_LNK_LNKSmasher_1.yar#L4-L18" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "0a86d64c3b25aa45428e94b6e0be3e08" logic_hash = "61d1ac67ac0d332ad842a522cbebe1b9af1482d58a210b50fb45209355c0aeeb" score = 75 quality = 75 tags = "FILE" rev = 6 strings: $drive_serial = { 12 F7 26 BE } $file_droid_guid = { BC 96 28 4F 0A 46 54 42 81 B8 9F 48 64 D7 E9 A5 } $guid_clsid = { E0 4F D0 20 EA 3A 69 10 A2 D8 08 00 2B 30 30 9D } $header = { 4C 00 00 00 01 14 02 } condition: $header at 0 and all of them } rule FIREEYE_RT_Tool_MSIL_Sharpgrep_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGrep' project." author = "FireEye" id = "c7569d33-f57d-5f9c-aa2a-78866c680b5b" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPPGREP/production/yara/Tool_MSIL_SharpGrep_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "c22bfc50b3ab3c4082006aad3c3c89684cffe1e429b001b0bb08758856a47d04" score = 75 quality = 73 tags = "FILE" rev = 1 strings: $typelibguid0 = "f65d75b5-a2a6-488f-b745-e67fc075f445" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Hacktool_MSIL_SHARPZEROLOGON_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'sharpzerologon' project." author = "FireEye" id = "51f22eee-fb96-55b0-8c02-1a0e9910a93e" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPZEROLOGON/production/yara/HackTool_MSIL_SHARPZEROLOGON_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "ed6a9bef5c6ee03aff969b8765b284ace517f2e6a1ef114acb04cf094c69cfa5" score = 75 quality = 73 tags = "FILE" rev = 3 strings: $typelibguid0 = "15ce9a3c-4609-4184-87b2-e29fc5e2b770" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Hacktool_MSIL_PXELOOT_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the PXE And Loot project." author = "FireEye" id = "5a72a6ff-bae4-57f5-a19b-a4595ac57293" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PXELOOT/production/yara/HackTool_MSIL_PXELOOT_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "82e33011ac34adfcced6cddc8ea56a81" logic_hash = "c9892adcb9ff5471235e45988f6662d3b8f984fdafca7024a5781eed50f6c0b3" score = 75 quality = 73 tags = "FILE" rev = 7 strings: $typelibguid1 = "78B2197B-2E56-425A-9585-56EDC2C797D6" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1 } rule FIREEYE_RT_Trojan_Macro_RESUMEPLEASE_1 { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "068662f6-28b8-5538-8bc3-6506565305ae" date = "2020-12-01" date = "2020-12-01" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/RESUMEPLEASE/production/yara/Trojan_Macro_RESUMEPLEASE_1.yar#L4-L21" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "d5d3d23c8573d999f1c48d3e211b1066" logic_hash = "040457bc446e496431129ff4623ddda5d9c2ce339ba65a7fbe42114626f36c60" score = 75 quality = 75 tags = "" rev = 1 strings: $str00 = "For Binary As" $str01 = "Range.Text" $str02 = "Environ(" $str03 = "CByte(" $str04 = ".SpawnInstance_" $str05 = ".Create(" condition: all of them } rule FIREEYE_RT_APT_Hacktool_MSIL_FLUFFY_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "6593202d-9b30-59ed-98c0-3e730fb5ceb7" date = "2020-12-04" date = "2020-12-04" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/FLUFFY/production/yara/APT_HackTool_MSIL_FLUFFY_1.yar#L4-L18" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "11b5aceb428c3e8c61ed24a8ca50553e" logic_hash = "4d91c96ab7b628e88f79ee193612acc959448fe2220ef54371f5f5c6e7305d86" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { 0E ?? 1? 72 [4] 28 [2] 00 06 [0-16] 28 [2] 00 0A [2-80] 1F 58 0? [0-32] 28 [2] 00 06 [2-32] 1? 28 [2] 00 06 0? 0? 6F [2] 00 06 [2-4] 1F 0B } $sb2 = { 73 [2] 00 06 13 ?? 11 ?? 11 ?? 7D [2] 00 04 11 ?? 73 [2] 00 0A 7D [2] 00 04 0E ?? 2D ?? 11 ?? 7B [2] 00 04 72 [4] 28 [2] 00 0A [2-32] 0? 28 [2] 00 0A [2-16] 11 ?? 7B [2] 00 04 0? 28 [2] 00 0A 1? 28 [2] 00 0A [2-32] 7E [2] 00 0A [0-32] FE 15 [2] 00 02 [0-16] 7D [2] 00 04 28 [2] 00 06 [2-32] 7B [2] 00 04 7D [2] 00 04 [2-32] 7C [2] 00 04 FE 15 [2] 00 02 [0-16] 11 ?? 8C [2] 00 02 28 [2] 00 0A 28 [2] 00 0A [2-80] 8C [2] 00 02 28 [2] 00 0A 12 ?? 12 ?? 12 ?? 28 [2] 00 06 } $ss1 = "\x00Fluffy\x00" condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Hacktool_MSIL_FLUFFY_2 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "ce39710e-7649-5f7d-bbbe-65dc30f678e8" date = "2020-12-04" date = "2020-12-04" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/FLUFFY/production/yara/APT_HackTool_MSIL_FLUFFY_2.yar#L4-L21" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "11b5aceb428c3e8c61ed24a8ca50553e" logic_hash = "872ab717668375a49d6c7b1927a680747b405c0198fe4fc6f43ccc562870eb37" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $s1 = "\x00Asktgt\x00" $s2 = "\x00Kerberoast\x00" $s3 = "\x00HarvestCommand\x00" $s4 = "\x00EnumerateTickets\x00" $s5 = "[*] Action: " wide $s6 = "\x00Fluffy.Commands\x00" condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Hacktool_MSIL_NOAMCI_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'noamci' project." author = "FireEye" id = "48066258-528f-5a70-81e1-15d6dfd9ff4f" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/NOAMCI/production/yara/APT_HackTool_MSIL_NOAMCI_1.yar#L4-L16" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "6278cfb4e9af20bbe943f4b99227c7fba276315a9f0059575b3ed4ef96a848c4" score = 75 quality = 71 tags = "FILE" rev = 4 strings: $typelibguid0 = "7bcccf21-7ecd-4fd4-8f77-06d461fd4d51" ascii nocase wide $typelibguid1 = "ef86214e-54de-41c3-b27f-efc61d0accc3" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Loader_MSIL_PGF_1 : FILE { meta: description = "base.cs" author = "FireEye" id = "39d9821f-86e8-528a-a0a9-287dbe325484" date = "2020-11-24" date = "2020-11-24" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_MSIL_PGF_1.yar#L4-L17" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "a495c6d11ff3f525915345fb762f8047" logic_hash = "4174ed53336f3951d26282dc81b99b2044ac6350d4b4c0074194a9b4acecefee" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { 72 [4] 6F [2] 00 0A 26 [0-16] 0? 6F [2] 00 0A [1-3] 0? 28 [2] 00 0A [0-1] 0? 72 [4-5] 0? 28 [2] 00 0A [0-1] 0? 6F [2] 00 0A 13 ?? 1? 13 ?? 38 [8-16] 91 [3-6] 8E 6? 5D 91 61 D2 9C 11 ?? 1? 58 13 [3-5] 8E 6? 3F } condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Loader_Win64_PGF_5 : FILE { meta: description = "PGF payload, generated rule based on symfunc/8167a6d94baca72bac554299d7c7f83c" author = "FireEye" id = "4fa4a1d6-cb63-582d-801c-b4c89c44d9ca" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_5.yar#L4-L18" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "150224a0ccabce79f963795bf29ec75b" logic_hash = "16495ad1e5ce4d4a79f4067f3d687911a1a0a3bfe4c6409ff9de4d111b1ddca6" score = 75 quality = 75 tags = "FILE" rev = 3 strings: $cond1 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF 15 13 FA FF FF 8B 44 24 48 89 44 24 20 83 7C 24 20 01 74 02 EB 17 48 8B 44 24 40 48 89 05 66 23 00 00 48 8B 4C 24 40 FF 15 EB F9 FF FF B8 01 00 00 00 48 83 C4 38 C3 } $cond2 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF 15 A3 FA FF FF 8B 44 24 48 89 44 24 20 83 7C 24 20 01 74 02 EB 17 48 8B 44 24 40 48 89 05 F6 20 00 00 48 8B 4C 24 40 FF 15 7B FA FF FF B8 01 00 00 00 48 83 C4 38 C3 } $cond3 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF ?? ?? ?? ?? ?? 8B 44 24 48 89 44 24 20 83 7C 24 2? ?1 74 ?? EB ?? 48 8B 44 24 40 48 ?? ?? ?? ?? ?? ?? 48 8B 4C 24 40 FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? 48 83 C4 38 C3 } $cond4 = { 4C 89 44 24 ?? 89 54 24 ?? 48 89 4C 24 ?? 48 83 EC 38 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 83 7C 24 ?? 01 74 ?? EB ?? 48 8B 44 24 ?? 48 89 05 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? B8 01 00 00 00 48 83 C4 38 C3 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and any of them } rule FIREEYE_RT_APT_Loader_Win_PGF_2 : FILE { meta: description = "PE rich header matches PGF backdoor" author = "FireEye" id = "595c9e2a-3d9d-5366-9449-de1bcf333f78" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win_PGF_2.yar#L4-L21" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "226b1ac427eb5a4dc2a00cc72c163214" hash = "2398ed2d5b830d226af26dedaf30f64a" hash = "24a7c99da9eef1c58f09cf09b9744d7b" hash = "aeb0e1d0e71ce2a08db9b1e5fb98e0aa" logic_hash = "b8c024c6b4c3ce9915700b62da8a1f12440215b46f3a56078707f5257e575811" score = 75 quality = 75 tags = "FILE" rev = 4 strings: $rich1 = { A8 B7 17 3A EC D6 79 69 EC D6 79 69 EC D6 79 69 2F D9 24 69 E8 D6 79 69 E5 AE EC 69 EA D6 79 69 EC D6 78 69 A8 D6 79 69 E5 AE EA 69 EF D6 79 69 E5 AE FA 69 D0 D6 79 69 E5 AE EB 69 ED D6 79 69 E5 AE FD 69 E2 D6 79 69 CB 10 07 69 ED D6 79 69 E5 AE E8 69 ED D6 79 69 } $rich2 = { C1 CF 75 A4 85 AE 1B F7 85 AE 1B F7 85 AE 1B F7 8C D6 88 F7 83 AE 1B F7 0D C9 1A F6 87 AE 1B F7 0D C9 1E F6 8F AE 1B F7 0D C9 1F F6 8F AE 1B F7 0D C9 18 F6 84 AE 1B F7 DE C6 1A F6 86 AE 1B F7 85 AE 1A F7 BF AE 1B F7 84 C3 12 F6 81 AE 1B F7 84 C3 E4 F7 84 AE 1B F7 84 C3 19 F6 84 AE 1B F7 } $rich3 = { D6 60 82 B8 92 01 EC EB 92 01 EC EB 92 01 EC EB 9B 79 7F EB 94 01 EC EB 1A 66 ED EA 90 01 EC EB 1A 66 E9 EA 98 01 EC EB 1A 66 E8 EA 9A 01 EC EB 1A 66 EF EA 90 01 EC EB C9 69 ED EA 91 01 EC EB 92 01 ED EB AF 01 EC EB 93 6C E5 EA 96 01 EC EB 93 6C 13 EB 93 01 EC EB 93 6C EE EA 93 01 EC EB } $rich4 = { 41 36 64 33 05 57 0A 60 05 57 0A 60 05 57 0A 60 73 CA 71 60 01 57 0A 60 0C 2F 9F 60 04 57 0A 60 0C 2F 89 60 3D 57 0A 60 0C 2F 8E 60 0A 57 0A 60 05 57 0B 60 4A 57 0A 60 0C 2F 99 60 06 57 0A 60 73 CA 67 60 04 57 0A 60 0C 2F 98 60 04 57 0A 60 0C 2F 80 60 04 57 0A 60 22 91 74 60 04 57 0A 60 0C 2F 9B 60 04 57 0A 60 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and filesize < 15MB and ( ( $rich1 at 128 ) or ( $rich2 at 128 ) or ( $rich3 at 128 ) or ( $rich4 at 128 ) ) } rule FIREEYE_RT_APT_Loader_Win32_PGF_5 : FILE { meta: description = "PGF payload, generated rule based on symfunc/a86b004b5005c0bcdbd48177b5bac7b8" author = "FireEye" id = "376875f3-00f2-58d0-ae22-7f52ea566da2" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_5.yar#L4-L18" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "8c91a27bbdbe9fb0877daccd28bd7bb5" logic_hash = "dfff615a1d329cf181294f7b0a32c11a21d66ff8a6aa6b9fcd183c9738369623" score = 75 quality = 75 tags = "FILE" rev = 3 strings: $cond1 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 00 30 00 10 33 C5 89 45 E0 56 C7 45 F8 00 00 00 00 C6 85 D8 FE FF FF 00 68 03 01 00 00 6A 00 8D 85 D9 FE FF FF 50 E8 F9 07 00 00 83 C4 0C C7 45 F4 00 00 00 00 C6 45 E7 00 C7 45 E8 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 F0 00 00 00 00 6A 01 6A 00 8D 8D D8 FE FF FF 51 6A 00 68 9C 10 00 10 8B 15 10 30 00 10 52 E8 31 01 00 00 89 45 F8 6A 14 FF 15 5C 10 00 10 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 C2 0C 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF 00 00 00 00 EB 0F 8B 85 D4 FE FF FF 83 C0 01 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D 1F 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB C9 8B 55 F8 8B 42 08 89 45 FC 6A 40 68 00 30 00 00 8B 4D FC 51 6A 00 FF 15 00 10 00 10 89 45 EC 8B 55 FC 52 8B 45 F8 83 C0 20 50 8B 4D EC 51 E8 F0 06 00 00 83 C4 0C C7 85 D0 FE FF FF 00 00 00 00 EB 0F 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 30 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE 14 00 00 00 F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB B6 8B 4D EC 89 4D F0 FF 55 F0 5E 8B 4D E0 33 CD E8 6D 06 00 00 8B E5 5D C3 } $cond2 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 00 30 00 10 33 C5 89 45 E0 56 C7 45 F8 00 00 00 00 C6 85 D8 FE FF FF 00 68 03 01 00 00 6A 00 8D 85 D9 FE FF FF 50 E8 F9 07 00 00 83 C4 0C C7 45 F4 00 00 00 00 C6 45 E7 00 C7 45 E8 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 F0 00 00 00 00 6A 01 6A 00 8D 8D D8 FE FF FF 51 6A 00 68 9C 10 00 10 8B 15 20 33 00 10 52 E8 31 01 00 00 89 45 F8 6A 14 FF 15 58 10 00 10 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 C2 0C 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF 00 00 00 00 EB 0F 8B 85 D4 FE FF FF 83 C0 01 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D 1F 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB C9 8B 55 F8 8B 42 08 89 45 FC 6A 40 68 00 30 00 00 8B 4D FC 51 6A 00 FF 15 2C 10 00 10 89 45 EC 8B 55 FC 52 8B 45 F8 83 C0 20 50 8B 4D EC 51 E8 F0 06 00 00 83 C4 0C C7 85 D0 FE FF FF 00 00 00 00 EB 0F 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 30 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE 14 00 00 00 F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB B6 8B 4D EC 89 4D F0 FF 55 F0 5E 8B 4D E0 33 CD E8 6D 06 00 00 8B E5 5D C3 } $cond3 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 C7 45 ?? 00 00 00 00 C6 85 ?? ?? ?? ?? 00 68 03 01 00 00 6A 00 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 0C C7 45 ?? 00 00 00 00 C6 45 ?? 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 6A 01 6A 00 8D 8D ?? ?? ?? ?? 51 6A 00 68 9C 10 00 10 8B 15 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 ?? 6A 14 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 ?? 8B 45 ?? 8A 48 ?? 88 4D ?? 8B 55 ?? 83 C2 0C 8B 45 ?? 8B 0A 89 08 8B 4A ?? 89 48 ?? 8B 4A ?? 89 48 ?? 8B 4A ?? 89 48 ?? 8B 52 ?? 89 50 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 8B 85 ?? ?? ?? ?? 83 C0 01 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 14 7D ?? 8B 4D ?? 03 8D ?? ?? ?? ?? 0F B6 11 0F B6 45 ?? 33 D0 8B 4D ?? 03 8D ?? ?? ?? ?? 88 11 EB ?? 8B 55 ?? 8B 42 ?? 89 45 ?? 6A 40 68 00 30 00 00 8B 4D ?? 51 6A 00 FF 15 ?? ?? ?? ?? 89 45 ?? 8B 55 ?? 52 8B 45 ?? 83 C0 20 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 0C C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 8B 95 ?? ?? ?? ?? 83 C2 01 89 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 45 ?? 73 ?? 8B 4D ?? 03 8D ?? ?? ?? ?? 0F B6 09 8B 85 ?? ?? ?? ?? 99 BE 14 00 00 00 F7 FE 8B 45 ?? 0F B6 14 10 33 CA 8B 45 ?? 03 85 ?? ?? ?? ?? 88 08 EB ?? 8B 4D ?? 89 4D ?? FF 55 ?? 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 } $cond4 = { 8B FF 55 8B EC 81 EC 3? ?1 ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 E0 56 C7 45 F8 ?? ?? ?? ?? C6 85 D8 FE FF FF ?? 68 ?? ?? ?? ?? 6A ?? 8D 85 D9 FE FF FF 50 E8 ?? ?? ?? ?? 83 C4 0C C7 45 F4 ?? ?? ?? ?? C6 45 E7 ?? C7 45 E8 ?? ?? ?? ?? C7 45 EC ?? ?? ?? ?? C7 45 FC ?? ?? ?? ?? C7 45 F? ?? ?? ?? ?0 6A ?? 6A ?? 8D 8D D8 FE FF FF 51 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 F8 6A ?? FF ?? ?? ?? ?? ?? 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 ?? ?? 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF ?? ?? ?? ?? EB ?? 8B 85 D4 FE FF FF 83 C? ?1 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D ?? 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB ?? 8B 55 F8 8B 42 08 89 45 FC 6A ?? 68 ?? ?? ?? ?? 8B 4D FC 51 6A ?? FF ?? ?? ?? ?? ?? 89 45 EC 8B 55 FC 52 8B 45 F8 83 ?? ?? 50 8B 4D EC 51 E8 ?? ?? ?? ?? 83 C4 0C C7 85 D0 FE FF FF ?? ?? ?? ?? EB ?? 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 ?? 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE ?? ?? ?? ?? F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB ?? 8B 4D EC 89 4D F0 FF ?? ?? 5E 8B 4D E0 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and any of them } rule FIREEYE_RT_APT_Loader_Win32_PGF_1 : FILE { meta: description = "base dlls: /lib/payload/techniques/unmanaged_exports/" author = "FireEye" id = "1af4f2ce-c540-5836-a749-43a0b08609b1" date = "2020-11-25" date = "2020-11-25" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_1.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "383161e4deaf7eb2ebeda2c5e9c3204c" logic_hash = "d3fb0bd7b678b19ee2e0e846f4e13e4ce7e2629ecda123f34ef52f2af42d2a8e" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { 6A ?? FF 15 [4-32] 8A ?? 04 [0-32] 8B ?? 89 ?? 8B [2] 89 [2] 8B [2] 89 ?? 08 8B [2] 89 [2] 8B [2] 89 [2-64] 8B [5] 83 ?? 01 89 [5] 83 [5-32] 0F B6 [1-2] 0F B6 [1-2] 33 [1-16] 88 ?? EB } $sb2 = { 6A 40 [0-32] 68 00 30 00 00 [0-32] 6A 00 [0-16] FF 15 [4-32] 89 45 [4-64] E8 [4-32] 83 ?? 01 [4-80] 0F B6 [1-64] 33 [1-32] 88 [2-64] FF ( D? | 55 ) } $sb3 = { 8B ?? 08 03 ?? 3C [2-32] 0F B? ?? 14 [0-32] 8D [2] 18 [2-64] 0F B? ?? 06 [3-64] 6B ?? 28 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them } rule FIREEYE_RT_APT_Loader_Win_PGF_1 : FILE { meta: description = "PDB string used in some PGF DLL samples" author = "FireEye" id = "14e2102c-3572-5314-999c-ff3f6c94de03" date = "2020-12-08" modified = "2024-03-04" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win_PGF_1.yar#L4-L17" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "013c7708f1343d684e3571453261b586" logic_hash = "9dede268d33a38e980026917bd01bc47a72bfe60ba4a999c91eb727a2f377462" score = 75 quality = 73 tags = "FILE" rev = 6 strings: $pdb1 = /RSDS[\x00-\xFF]{20}c:\\source\\dllconfig-master\\dllsource[\x00-\xFF]{0,500}\.pdb\x00/ nocase $pdb2 = /RSDS[\x00-\xFF]{20}C:\\Users\\Developer\\Source[\x00-\xFF]{0,500}\\Release\\DllSource\.pdb\x00/ nocase $pdb3 = /RSDS[\x00-\xFF]{20}q:\\objchk_win7_amd64\\amd64\\init\.pdb\x00/ nocase condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and filesize < 15MB and any of them } rule FIREEYE_RT_APT_Loader_MSIL_PGF_2 : FILE { meta: description = "base.js, ./lib/payload/techniques/jscriptdotnet/jscriptdotnet_payload.py" author = "FireEye" id = "c5f2ec90-cd9b-53ce-893b-e44192fcd507" date = "2020-11-25" date = "2020-11-25" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_MSIL_PGF_2.yar#L4-L20" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "7c2a06ceb29cdb25f24c06f2a8892fba" logic_hash = "b962ea30c063009c0383e25edda3a65202bea4496d0d6228549dcea82bba0d03" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { 2? 00 10 00 00 0A 1? 40 0? 72 [4] 0? 0? 28 [2] 00 0A 0? 03 28 [2] 00 0A 74 [2] 00 01 6F [2] 00 0A 03 1? 0? 74 [2] 00 01 28 [2] 00 0A 6? 0? 0? 28 [2] 00 06 D0 [2] 00 01 28 [2] 00 0A 1? 28 [2] 00 0A 79 [2] 00 01 71 [2] 00 01 13 ?? 0? 1? 11 ?? 0? 74 [2] 00 01 28 [2] 00 0A 28 [2] 00 0A 7E [2] 00 0A 13 ?? 1? 13 ?? 7E [2] 00 0A 13 ?? 03 28 [2] 00 0A 74 [2] 00 01 6F [2] 00 0A 03 1? 1? 11 ?? 11 ?? 1? 11 ?? 28 [2] 00 06 } $ss1 = "\x00CreateThread\x00" $ss2 = "\x00ScriptObjectStackTop\x00" $ss3 = "\x00Microsoft.JScript\x00" condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Loader_Win64_PGF_2 : FILE { meta: description = "base dlls: /lib/payload/techniques/dllmain/" author = "FireEye" id = "5253cb2a-28fd-57ab-be3d-f11cf2ea24cf" date = "2020-11-25" date = "2020-11-25" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_2.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "4326a7e863928ffbb5f6bdf63bb9126e" logic_hash = "074f6d9ad78ecd4dd8e3d0b5c8b0f61a48374f3935b85c4222305b207b447ec7" score = 75 quality = 75 tags = "FILE" rev = 2 strings: $sb1 = { B9 [4] FF 15 [4-32] 8B ?? 1C [0-16] 0F B? ?? 04 [0-64] F3 0F 6F 00 [0-64] 66 0F EF C8 [0-64] F3 0F 7F 08 [0-64] 30 ?? 48 8D 40 01 48 83 ?? 01 7? } $sb2 = { 44 8B ?? 08 [0-32] 41 B8 00 30 00 00 [0-16] FF 15 [4-32] 48 8B C8 [0-16] E8 [4-64] 4D 8D 49 01 [0-32] C1 ?? 04 [0-64] 0F B? [2-16] 41 30 ?? FF 45 3? ?? 7? } $sb3 = { 63 ?? 3C [0-16] 03 [1-32] 0F B? ?? 14 [0-16] 8D ?? 18 [0-16] 03 [1-16] 66 ?? 3B ?? 06 7? [1-64] 48 8D 15 [4-32] FF 15 [4-16] 85 C0 [2-32] 41 0F B? ?? 06 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them } rule FIREEYE_RT_APT_Loader_Win64_PGF_4 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "4c93ba76-d3a5-568d-88b8-79a6ebc2edbb" date = "2020-11-26" date = "2020-11-26" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_4.yar#L4-L17" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "3bb34ebd93b8ab5799f4843e8cc829fa" logic_hash = "fcc92674e58ec6418d7c709e3f3bc2e1ec859fe0cb444412964a978fb69f5234" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { 41 B9 04 00 00 00 41 B8 00 10 00 00 BA [4] B9 00 00 00 00 [0-32] FF [1-24] 7? [1-150] 8B 45 [0-32] 44 0F B? ?? 8B [2-16] B? CD CC CC CC [0-16] C1 ?? 04 [0-16] C1 ?? 02 [0-16] C1 ?? 02 [0-16] 48 8? 05 [4-32] 31 [1-4] 88 } $sb2 = { C? 45 ?? 48 [0-32] B8 [0-64] FF [0-32] E0 [0-32] 41 B8 40 00 00 00 BA 0C 00 00 00 48 8B [2] 48 8B [2-32] FF [1-16] 48 89 10 8B 55 ?? 89 ?? 08 48 8B [2] 48 8D ?? 02 48 8B 45 18 48 89 02 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them } rule FIREEYE_RT_APT_Loader_Win32_PGF_2 : FILE { meta: description = "base dlls: /lib/payload/techniques/dllmain/" author = "FireEye" id = "e11a626b-ce91-5f6c-a514-9a8a02a29cbd" date = "2020-11-25" date = "2020-11-25" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_2.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "04eb45f8546e052fe348fda2425b058c" logic_hash = "d69f3f31c4964fe933295563e08bdbb36abadd6611541b9ffa55b6829ced1d21" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { 6A ?? FF 15 [4-16] 8A ?? 04 [0-16] 8B ?? 1C [0-64] 0F 10 ?? 66 0F EF C8 0F 11 [0-32] 30 [2] 8D [2] 4? 83 [2] 7? } $sb2 = { 8B ?? 08 [0-16] 6A 40 68 00 30 00 00 5? 6A 00 [0-32] FF 15 [4-32] 5? [0-16] E8 [4-64] C1 ?? 04 [0-32] 8A [2] 3? [2] 4? 3? ?? 24 ?? 7? } $sb3 = { 8B ?? 3C [0-16] 03 [1-64] 0F B? ?? 14 [0-32] 83 ?? 18 [0-32] 66 3? ?? 06 [4-32] 68 [4] 5? FF 15 [4-16] 85 C0 [2-32] 83 ?? 28 0F B? ?? 06 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them } rule FIREEYE_RT_APT_Loader_Win32_PGF_4 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "d46d9ae9-cb7d-5a25-9ee2-766097c14af6" date = "2020-11-26" date = "2020-11-26" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_4.yar#L4-L17" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "4414953fa397a41156f6fa4f9462d207" logic_hash = "4256bfd3713f330d76cad9d1ddbba91e588dbca2e2b6842e9482525805ddc1e8" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { C7 44 24 0C 04 00 00 00 C7 44 24 08 00 10 00 00 [4-32] C7 04 24 00 00 00 00 [0-32] FF [1-16] 89 45 ?? 83 7D ?? 00 [2-150] 0F B? ?? 8B [2] B? CD CC CC CC 89 ?? F7 ?? C1 ?? 04 89 ?? C1 ?? 02 [0-32] 0F B? [5-32] 3? [1-16] 88 } $sb2 = { C? 45 ?? B8 [0-4] C? 45 ?? 00 [0-64] FF [0-32] E0 [0-32] C7 44 24 08 40 00 00 00 [0-32] C7 44 24 04 07 00 00 00 [0-32] FF [1-64] 89 ?? 0F B? [2-3] 89 ?? 04 0F B? [2] 88 ?? 06 8B ?? 08 8D ?? 01 8B 45 0C } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them } rule FIREEYE_RT_APT_Loader_Win64_PGF_1 : FILE { meta: description = "base dlls: /lib/payload/techniques/unmanaged_exports/" author = "FireEye" id = "1f2280c0-0fdd-5930-947a-931274bccd6f" date = "2020-11-25" date = "2020-11-25" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_1.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "2b686a8b83f8e1d8b455976ae70dab6e" logic_hash = "2e84d614c34b0b7f93fa70fa3312f22e3ff23f2abd33b2e19c00dd6cba7dcfdc" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { B9 14 00 00 00 FF 15 [4-32] 0F B6 ?? 04 [0-32] F3 A4 [0-64] 0F B6 [2-3] 0F B6 [2-3] 33 [0-32] 88 [1-9] EB } $sb2 = { 41 B8 00 30 00 00 [0-32] FF 15 [8-64] 83 ?? 01 [4-80] 0F B6 [1-64] 33 [1-32] 88 [1-64] FF ( D? | 5? ) } $sb3 = { 48 89 4C 24 08 [4-64] 48 63 48 3C [0-32] 48 03 C1 [0-64] 0F B7 48 14 [0-64] 48 8D 44 08 18 [8-64] 0F B7 40 06 [2-32] 48 6B C0 28 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them } rule FIREEYE_RT_APT_Loader_Win64_PGF_3 : FILE { meta: description = "PGF payload, generated rule based on symfunc/8a2f2236fdfaa3583ab89076025c6269. Identifies dllmain_hook x64 payloads." author = "FireEye" id = "340ea6d4-7111-520c-9bd4-0465a43ea235" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_3.yar#L4-L18" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "3bb34ebd93b8ab5799f4843e8cc829fa" logic_hash = "fd82bdec54a76eed12cc8820ef39899f31ea6df21d905530a0d53770b3d9901b" score = 75 quality = 75 tags = "FILE" rev = 4 strings: $cond1 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 80 8B 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 5A B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 E9 FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 AC 96 01 00 48 8D 45 AF 48 89 C1 E8 F0 FE 00 00 48 8B 05 25 8B 06 00 FF D0 89 C2 B9 08 00 00 00 E8 6B B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 AA B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 61 F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 4F B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 20 8A 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 0E C8 05 00 48 8B 05 69 8A 06 00 FF D0 48 8D 15 0A C8 05 00 48 89 C1 48 8B 05 5E 8A 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 19 8A 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 01 8A 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 E0 F9 FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 87 F9 FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 CB 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 37 FC 00 00 48 89 D8 48 89 C1 E8 4C AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 9A 9C 01 00 48 89 D8 48 89 C1 E8 2F AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 } $cond2 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 ?? ?? ?? ?? FF D0 48 89 C1 48 8D 85 ?? ?? ?? ?? 41 B8 04 01 00 00 48 89 C2 E8 ?? ?? ?? ?? 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 4D ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 89 C2 B9 08 00 00 00 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? 00 75 ?? BB 00 00 00 00 E9 ?? ?? ?? ?? 48 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 38 04 00 00 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? 00 74 ?? 48 8D 85 ?? ?? ?? ?? 48 8D 50 ?? 48 8D 85 ?? ?? ?? ?? 41 B8 00 00 00 00 48 89 C1 E8 ?? ?? ?? ?? 48 83 F8 FF 0F 95 C0 84 C0 74 ?? 48 8B 85 ?? ?? ?? ?? 48 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 89 45 ?? EB ?? 48 8B 45 ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? BB 00 00 00 00 E9 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 89 45 ?? 48 89 E8 48 89 45 ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 C7 45 ?? 00 00 00 00 48 8B 55 ?? 48 8B 85 ?? ?? ?? ?? 48 39 C2 0F 83 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 39 45 ?? 73 ?? 48 8B 45 ?? 48 8B 00 48 8B 55 ?? 48 81 C2 00 10 00 00 48 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 39 45 ?? 0F 83 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 8B 4D ?? 48 8B 55 ?? 48 01 CA 48 39 D0 0F 83 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 8B 45 ?? 48 8B 00 48 8D 95 ?? ?? ?? ?? 41 B8 30 00 00 00 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 48 8B 45 ?? 48 8B 00 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? BB 00 00 00 00 EB ?? 90 EB ?? 90 48 83 45 ?? 08 E9 ?? ?? ?? ?? 48 8B 45 ?? 48 89 45 ?? 48 8B 45 ?? 8B 40 ?? 48 63 D0 48 8B 45 ?? 48 01 D0 48 89 45 ?? 48 8B 45 ?? 8B 40 ?? 89 C2 48 8B 45 ?? 48 01 D0 48 89 45 ?? 48 8B 45 ?? 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? BB 01 00 00 00 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 83 FB 01 EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 90 48 81 C4 28 07 00 00 5B 5D C3 } $cond3 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 C1 7C 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 33 B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 B2 FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 75 96 01 00 48 8D 45 AF 48 89 C1 E8 B9 FE 00 00 48 8B 05 66 7C 06 00 FF D0 89 C2 B9 08 00 00 00 E8 3C B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 83 B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 2A F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 28 B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 69 7B 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 11 B9 05 00 48 8B 05 A2 7B 06 00 FF D0 48 8D 15 0D B9 05 00 48 89 C1 48 8B 05 97 7B 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 5A 7B 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 22 7B 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 59 FB FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 00 FB FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 94 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 00 FC 00 00 48 89 D8 48 89 C1 E8 45 AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 63 9C 01 00 48 89 D8 48 89 C1 E8 28 AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 } $cond4 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 D3 8B 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 65 B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 EC FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 AF 96 01 00 48 8D 45 AF 48 89 C1 E8 F3 FE 00 00 48 8B 05 78 8B 06 00 FF D0 89 C2 B9 08 00 00 00 E8 6E B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 B5 B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 64 F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 5A B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 73 8A 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 45 C8 05 00 48 8B 05 B4 8A 06 00 FF D0 48 8D 15 41 C8 05 00 48 89 C1 48 8B 05 A9 8A 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 6C 8A 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 54 8A 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 33 FA FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 DA F9 FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 CE 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 3A FC 00 00 48 89 D8 48 89 C1 E8 4F AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 9D 9C 01 00 48 89 D8 48 89 C1 E8 32 AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and any of them } rule FIREEYE_RT_APT_Loader_Win32_PGF_3 : FILE { meta: description = "PGF payload, generated rule based on symfunc/c02594972dbab6d489b46c5dee059e66. Identifies dllmain_hook x86 payloads." author = "FireEye" id = "adf91482-6e04-5d11-bc00-4b1c7a802c49" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_3.yar#L4-L20" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "4414953fa397a41156f6fa4f9462d207" logic_hash = "24d2caad1d740ccbff0cf111a05ecad20ed06f311d530d8de86050d916da32ce" score = 75 quality = 75 tags = "FILE" rev = 4 strings: $cond1 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF 90 EE 01 6D C7 85 30 F9 FF FF 6C FE 01 6D 8D 85 34 F9 FF FF 89 28 BA CC 19 00 6D 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 BB A6 00 00 A1 48 A1 05 6D C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 B8 AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 56 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 DF B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 52 0B 01 00 A1 4C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 51 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 EF AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 82 FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 84 AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 2C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 0C 40 05 6D A1 5C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 18 40 05 6D 89 04 24 A1 60 A1 05 6D FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 54 A1 05 6D FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 9C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 00 6D 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 00 6D 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 5D BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 48 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 A0 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 FD BB 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 75 A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 76 A3 00 00 8D 65 F4 5B 5E 5F 5D C3 } $cond2 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF B0 EF 3D 6A C7 85 30 F9 FF FF 8C FF 3D 6A 8D 85 34 F9 FF FF 89 28 BA F4 1A 3C 6A 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 B3 A6 00 00 A1 64 A1 41 6A C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 B0 AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 4E 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 D7 B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 4A 0B 01 00 A1 68 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 49 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 E7 AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 7A FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 7C AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 44 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 62 40 41 6A A1 78 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 6E 40 41 6A 89 04 24 A1 7C A1 41 6A FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 70 A1 41 6A FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 C8 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 3C 6A 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 3C 6A 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 55 BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 40 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 98 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 F5 BB 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 6D A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 6E A3 00 00 8D 65 F4 5B 5E 5F 5D C3 } $cond3 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF F0 EF D5 63 C7 85 30 F9 FF FF CC FF D5 63 8D 85 34 F9 FF FF 89 28 BA 28 1B D4 63 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 BF A6 00 00 A1 64 A1 D9 63 C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 BC AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 5A 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 E3 B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 56 0B 01 00 A1 68 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 55 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 F3 AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 86 FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 88 AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 44 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 7E 40 D9 63 A1 7C A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 8A 40 D9 63 89 04 24 A1 80 A1 D9 63 FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 70 A1 D9 63 FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 C8 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 D4 63 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 D4 63 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 61 BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 4C 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 A4 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 01 BC 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 79 A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 7A A3 00 00 8D 65 F4 5B 5E 5F 5D C3 } $cond4 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? 90 EE 01 6D C7 85 ?? ?? ?? ?? 6C FE 01 6D 8D 85 ?? ?? ?? ?? 89 28 BA CC 19 00 6D 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 0C 40 05 6D A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 18 40 05 6D 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 00 6D 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 00 6D 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 } $cond5 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? B0 EF 3D 6A C7 85 ?? ?? ?? ?? 8C FF 3D 6A 8D 85 ?? ?? ?? ?? 89 28 BA F4 1A 3C 6A 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 62 40 41 6A A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 6E 40 41 6A 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 3C 6A 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 3C 6A 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 } $cond6 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? F0 EF D5 63 C7 85 ?? ?? ?? ?? CC FF D5 63 8D 85 ?? ?? ?? ?? 89 28 BA 28 1B D4 63 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 7E 40 D9 63 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 8A 40 D9 63 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 D4 63 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 D4 63 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 } condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and any of them } rule FIREEYE_RT_Loader_MSIL_Inmemorycompilation_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'In-MemoryCompilation' project." author = "FireEye" id = "80234352-a449-5292-9f0c-beb7a1d39a6c" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MEMCOMP/production/yara/Loader_MSIL_InMemoryCompilation_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "a964a186eb02a2792db01727a31ddaa2414fe9df83cda9b1c9db15d94603303a" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "524d2687-0042-4f93-b695-5579f3865205" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Loader_MSIL_Allthethings_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'AllTheThings' project." author = "FireEye" id = "1805b406-2531-56bf-8e08-e63a59ffcc84" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ALLTHETHINGS/production/yara/Loader_MSIL_AllTheThings_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "e3058095f2a49f8c0f78cb392024795367609b04c1da80210ab8d72c6613ee71" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "542ccc64-c4c3-4c03-abcd-199a11b26754" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Hacktool_MSIL_Corehound_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CoreHound' project." author = "FireEye" id = "8c914b34-3e3d-53ae-a5e4-9dbfdff45a24" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/COREHOUND/production/yara/HackTool_MSIL_CoreHound_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "b0f759709428d5c9404507a13259bf85cb8c405d38b807539098f7cc871023d8" score = 75 quality = 73 tags = "FILE" rev = 1 strings: $typelibguid0 = "1fff2aee-a540-4613-94ee-4f208b30c599" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Trojan_Win64_Generic_23 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "470bfeed-e000-58c6-b115-dfa8aea25bef" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/supplemental/yara/Trojan_Win64_Generic_23.yar#L4-L22" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "b66347ef110e60b064474ae746701d4a" logic_hash = "4c1860801b26abbab8c4aea730bf69f388c902083b9945e11e6782af3ab22789" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $api1 = "VirtualAllocEx" fullword $api2 = "UpdateProcThreadAttribute" fullword $api3 = "DuplicateTokenEx" fullword $api4 = "CreateProcessAsUserA" fullword $inject = { 8B 85 [4] C7 44 24 20 40 00 00 00 41 B9 00 30 00 00 44 8B C0 33 D2 48 8B 8D [4] FF 15 [4] 48 89 45 ?? 48 83 7D ?? 00 75 ?? 48 8B 45 ?? E9 [4] 8B 85 [4] 48 C7 44 24 20 00 00 00 00 44 8B C8 4C 8B 85 [4] 48 8B 55 ?? 48 8B 8D [4] FF 15 [4] 85 C0 75 ?? 48 8B 45 ?? EB ?? 8B 85 [4] 48 8B 4D ?? 48 03 C8 48 8B C1 48 89 45 48 48 8D 85 [4] 48 89 44 24 30 C7 44 24 28 00 00 00 00 48 8B 85 [4] 48 89 44 24 20 4C 8B 4D ?? 41 B8 00 00 10 00 33 D2 48 8B 8D [4] FF 15 } $process = { 48 C7 44 24 30 00 00 00 00 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 08 00 00 00 4C 8D 8D [4] 41 B8 00 00 02 00 33 D2 48 8B 8D [4] FF 15 [4] 85 C0 75 ?? E9 [4] 48 8B 85 [4] 48 89 85 [4] 48 8D 85 [4] 48 89 44 24 50 48 8D 85 [4] 48 89 44 24 48 48 C7 44 24 40 00 00 00 00 48 C7 44 24 38 00 00 00 00 C7 44 24 30 04 00 08 00 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 45 33 C9 4C 8D 05 [4] 33 D2 48 8B [2-5] FF 15 } $token = { FF 15 [4] 4C 8D 45 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 75 ?? E9 [4] 48 8D [2-5] 48 89 44 24 28 C7 44 24 20 02 00 00 00 41 B9 02 00 00 00 45 33 C0 BA 0B 00 00 00 48 8B 4D ?? FF 15 [4] 85 C0 75 ?? E9 [4] 4C 8D 8D [4] 45 33 C0 BA 01 00 00 00 33 C9 FF 15 } condition: (( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) ) and all of them } rule FIREEYE_RT_Trojan_Win64_Generic_22 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "e79661a8-5254-5e8e-b92b-edf1ddb072ff" date = "2020-11-26" date = "2020-11-26" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/supplemental/yara/Trojan_Win64_Generic_22.yar#L4-L22" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "f7d9961463b5110a3d70ee2e97842ed3" logic_hash = "52fbe5c0ee7c05df5fcd62c26caaa5498e32352da9c5940e522aa31d6c808028" score = 75 quality = 75 tags = "FILE" rev = 2 strings: $api1 = "VirtualAllocEx" fullword $api2 = "UpdateProcThreadAttribute" fullword $api3 = "DuplicateTokenEx" fullword $api4 = "CreateProcessAsUserA" fullword $inject = { C7 44 24 20 40 00 00 00 33 D2 41 B9 00 30 00 00 41 B8 [4] 48 8B CB FF 15 [4] 48 8B F0 48 85 C0 74 ?? 4C 89 74 24 20 41 B9 [4] 4C 8D 05 [4] 48 8B D6 48 8B CB FF 15 [4] 85 C0 75 [5-10] 4C 8D 0C 3E 48 8D 44 24 ?? 48 89 44 24 30 44 89 74 24 28 4C 89 74 24 20 33 D2 41 B8 [4] 48 8B CB FF 15 } $process = { 89 74 24 30 ?? 8D 4C 24 [2] 89 74 24 28 33 D2 41 B8 00 00 02 00 48 C7 44 24 20 08 00 00 00 48 8B CF FF 15 [4] 85 C0 0F 84 [4] 48 8B [2-3] 48 8D 45 ?? 48 89 44 24 50 4C 8D 05 [4] 48 8D 45 ?? 48 89 7D 08 48 89 44 24 48 45 33 C9 ?? 89 74 24 40 33 D2 ?? 89 74 24 38 C7 44 24 30 04 00 08 00 [0-1] 89 74 24 28 ?? 89 74 24 20 FF 15 } $token = { FF 15 [4] 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 0F 84 [4] 48 8B 4C 24 ?? 48 8D [2-3] 41 B9 02 00 00 00 48 89 44 24 28 45 33 C0 C7 44 24 20 02 00 00 00 41 8D 51 09 FF 15 [4] 85 C0 0F 84 [4] 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 01 FF 15 } condition: (( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) ) and all of them } rule FIREEYE_RT_Credtheft_Win_EXCAVATOR_1 : FILE { meta: description = "This rule looks for the binary signature of the 'Inject' method found in the main Excavator PE." author = "FireEye" id = "7cabc230-e55b-5096-996a-b6a8c9693bdc" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/CredTheft_Win_EXCAVATOR_1.yar#L4-L18" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "f7d9961463b5110a3d70ee2e97842ed3" logic_hash = "bf4b776f34a1a9aa5438504f63a63ef452a747363de3b70cec52145d777055bd" score = 75 quality = 75 tags = "FILE" rev = 4 strings: $bytes1 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 20 01 00 00 48 8B 05 75 BF 01 00 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 8D 0D 12 A1 01 00 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 00 FF 15 CB 1F 01 00 48 85 C0 75 1B FF 15 80 1F 01 00 8B D0 48 8D 0D DF A0 01 00 E8 1A FF FF FF 33 C0 E9 B4 02 00 00 48 8D 15 D4 A0 01 00 48 89 9C 24 30 01 00 00 48 8B C8 FF 15 4B 1F 01 00 48 8B D8 48 85 C0 75 19 FF 15 45 1F 01 00 8B D0 48 8D 0D A4 A0 01 00 E8 DF FE FF FF E9 71 02 00 00 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 45 66 66 0F 1F 84 00 00 00 00 00 48 8B 4C 24 60 FF 15 4D 1F 01 00 3B C6 74 22 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 D1 EB 0A 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A0 01 00 48 8D 05 A6 C8 01 00 B9 C8 05 00 00 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 B2 FF 15 CC 1E 01 00 4C 8D 44 24 78 BA 0A 00 00 00 48 8B C8 FF 15 01 1E 01 00 85 C0 0F 84 66 01 00 00 48 8B 4C 24 78 48 8D 45 80 41 B9 02 00 00 00 48 89 44 24 28 45 33 C0 C7 44 24 20 02 00 00 00 41 8D 51 09 FF 15 D8 1D 01 00 85 C0 0F 84 35 01 00 00 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 50 01 FF 15 5C 1E 01 00 FF 15 06 1E 01 00 4C 8B 44 24 68 33 D2 48 8B C8 FF 15 DE 1D 01 00 48 8B F8 48 85 C0 0F 84 FF 00 00 00 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 50 01 FF 15 25 1E 01 00 85 C0 0F 84 E2 00 00 00 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 B8 00 00 02 00 48 C7 44 24 20 08 00 00 00 48 8B CF FF 15 6C 1D 01 00 85 C0 0F 84 B1 00 00 00 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C 8D 05 58 39 03 00 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 44 24 30 04 00 08 00 44 89 74 24 28 4C 89 74 24 20 FF 15 0C 1D 01 00 85 C0 74 65 48 8B 4C 24 70 8B 5D 98 FF 15 1A 1D 01 00 48 8B 4D 88 FF 15 10 1D 01 00 48 8B 4D 90 FF 15 06 1D 01 00 44 8B C3 33 D2 B9 3A 04 00 00 FF 15 4E 1D 01 00 48 8B D8 48 85 C0 74 2B 48 8B C8 E8 4E 06 00 00 48 85 C0 74 1E BA FF FF FF FF 48 8B C8 FF 15 3B 1D 01 00 48 8B CB FF 15 CA 1C 01 00 B8 01 00 00 00 EB 24 FF 15 DD 1C 01 00 8B D0 48 8D 0D 58 9E 01 00 E8 77 FC FF FF 48 85 FF 74 09 48 8B CF FF 15 A9 1C 01 00 33 C0 48 8B 9C 24 30 01 00 00 48 8B 4D 10 48 33 CC E8 03 07 00 00 4C 8D 9C 24 20 01 00 00 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 } $bytes2 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 2? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 ?? FF ?? ?? ?? ?? ?? 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 9C 24 3? ?1 ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 66 0F 1F 84 ?? ?? ?? ?? ?? 48 8B 4C 24 60 FF ?? ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A? ?1 ?? 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 ?? FF ?? ?? ?? ?? ?? 4C 8D 44 24 78 BA 0A ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 78 48 8D 45 80 41 B9 02 ?? ?? ?? 48 89 44 24 28 45 33 C0 C7 44 24 2? ?2 ?? ?? ?? 41 8D 51 09 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 5? ?1 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 4C 8B 44 24 68 33 D2 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 5? ?1 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 ?? ?? ?? ?? ?? 48 C7 44 24 2? ?8 ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C ?? ?? ?? ?? ?? ?? 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 ?? ?? ?? ?? ?? ?? ?? 44 89 74 24 28 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 70 8B 5D 98 FF ?? ?? ?? ?? ?? 48 8B 4D 88 FF ?? ?? ?? ?? ?? 48 8B 4D 90 FF ?? ?? ?? ?? ?? 44 8B C3 33 D2 B9 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? EB ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF ?? ?? ?? ?? ?? 33 C0 48 8B 9C 24 3? ?1 ?? ?? 48 8B 4D 10 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 2? ?1 ?? ?? 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 } $bytes3 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 2? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 ?? FF ?? ?? ?? ?? ?? 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 9C 24 3? ?1 ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 66 0F 1F 84 ?? ?? ?? ?? ?? 48 8B 4C 24 60 FF ?? ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A? ?1 ?? 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 ?? FF ?? ?? ?? ?? ?? 4C 8D 44 24 78 BA 0A ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 78 48 8D 45 80 41 B9 02 ?? ?? ?? 48 89 44 24 28 45 33 C0 C7 44 24 2? ?2 ?? ?? ?? 41 8D 51 09 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 5? ?1 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 4C 8B 44 24 68 33 D2 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 5? ?1 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 ?? ?? ?? ?? ?? 48 C7 44 24 2? ?8 ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C ?? ?? ?? ?? ?? ?? 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 ?? ?? ?? ?? ?? ?? ?? 44 89 74 24 28 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 70 8B 5D 98 FF ?? ?? ?? ?? ?? 48 8B 4D 88 FF ?? ?? ?? ?? ?? 48 8B 4D 90 FF ?? ?? ?? ?? ?? 44 8B C3 33 D2 B9 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? EB ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF ?? ?? ?? ?? ?? 33 C0 48 8B 9C 24 3? ?1 ?? ?? 48 8B 4D 10 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 2? ?1 ?? ?? 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 } $bytes4 = { 48 89 74 24 ?? 48 89 7C 24 ?? 4C 89 74 24 ?? 55 48 8D 6C 24 ?? 48 81 EC 20 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 45 ?? 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 ?? 48 8D 0D ?? ?? ?? ?? 4C 89 74 24 ?? 0F 11 45 ?? 41 8B FE 4C 89 74 24 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? FF 15 ?? ?? ?? ?? 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 66 0F 1F 84 00 ?? ?? 00 00 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 ?? 48 89 44 24 ?? 66 0F 6F 15 ?? ?? 01 00 48 8D 05 ?? ?? ?? ?? B9 C8 05 00 00 90 F3 0F 6F 40 ?? 48 8D 40 ?? 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? F3 0F 6F 40 ?? 66 0F EF C2 F3 0F 7F 40 ?? 48 83 E9 01 75 ?? FF 15 ?? ?? ?? ?? 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 45 ?? 41 B9 02 00 00 00 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 02 00 00 00 41 8D 51 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8B 44 24 ?? 33 D2 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 48 8B C8 41 8D 50 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 ?? 4C 8D 4C 24 ?? 4C 89 74 24 ?? 33 D2 41 B8 00 00 02 00 48 C7 44 24 ?? 08 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D ?? 48 8D 45 ?? 48 89 44 24 ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 45 ?? 48 89 7D ?? 48 89 44 24 ?? 45 33 C9 4C 89 74 24 ?? 33 D2 4C 89 74 24 ?? C7 44 24 ?? 04 00 08 00 44 89 74 24 ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 8B 5D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 44 8B C3 33 D2 B9 3A 04 00 00 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA FF FF FF FF 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? B8 01 00 00 00 EB ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF 15 ?? ?? ?? ?? 33 C0 48 8B 9C 24 ?? ?? ?? ?? 48 8B 4D ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 73 ?? 49 8B 7B ?? 4D 8B 73 ?? 49 8B E3 5D C3 } condition: uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and any of ( $bytes* ) } rule FIREEYE_RT_APT_Hacktool_Win64_EXCAVATOR_2 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "4b7640e8-5621-5cc3-8ac9-84347f23f5eb" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/APT_HackTool_Win64_EXCAVATOR_2.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "4fd62068e591cbd6f413e1c2b8f75442" logic_hash = "14263c17323cd78df10f7f101bd7a9c74f7818b34a2e42125d45205067399381" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $api1 = "PssCaptureSnapshot" fullword $api2 = "MiniDumpWriteDump" fullword $dump = { C7 [2-5] FD 03 00 AC 4C 8D 4D ?? 41 B8 1F 00 10 00 8B [2-5] 48 8B 4D ?? E8 [4] 89 [2-5] 83 [2-5] 00 74 ?? 48 8B 4D ?? FF 15 [4] 33 C0 E9 [4] 41 B8 10 00 00 00 33 D2 48 8D 8D [4] E8 [4] 48 8D 05 [4] 48 89 85 [4] 48 C7 85 [8] 48 C7 44 24 30 00 00 00 00 C7 44 24 28 80 00 00 00 C7 44 24 20 01 00 00 00 45 33 C9 45 33 C0 BA 00 00 00 10 48 8D 0D [4] FF 15 [4] 48 89 85 [4] 48 83 BD [4] FF 75 ?? 48 8B 4D ?? FF 15 [4] 33 C0 EB [0-17] 48 8D [5] 48 89 ?? 24 30 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 41 B9 02 00 00 00 4C 8B 85 [4] 8B [1-5] 48 8B 4D ?? E8 } $enable_dbg_pri = { 4C 8D 45 ?? 48 8D 15 [4] 33 C9 FF 15 [4] 85 C0 0F 84 [4] C7 45 ?? 01 00 00 00 B8 0C 00 00 00 48 6B C0 00 48 8B 4D ?? 48 89 4C 05 ?? B8 0C 00 00 00 48 6B C0 00 C7 44 05 ?? 02 00 00 00 FF 15 [4] 4C 8D 45 ?? BA 20 00 00 00 48 8B C8 FF 15 [4] 85 C0 74 ?? 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 45 33 C9 4C 8D 45 ?? 33 D2 48 8B 4D ?? FF 15 } condition: (( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) ) and all of them } rule FIREEYE_RT_Credtheft_Win_EXCAVATOR_2 : FILE { meta: description = "This rule looks for the binary signature of the routine that calls PssFreeSnapshot found in the Excavator-Reflector DLL." author = "FireEye" id = "89037b9a-78b0-5a8c-bb60-3d54842d81e1" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/CredTheft_Win_EXCAVATOR_2.yar#L4-L18" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "6a9a114928554c26675884eeb40cc01b" logic_hash = "408e8862f0c470105648fdba00dc5531ffcd739fa544f89acb70f0fa1b105c03" score = 75 quality = 75 tags = "FILE" rev = 3 strings: $bytes1 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A0 01 00 00 48 8B 05 4C 4A 01 00 48 33 C4 48 89 85 90 00 00 00 BA 50 00 00 00 C7 05 CB 65 01 00 43 00 3A 00 66 89 15 EC 65 01 00 4C 8D 44 24 68 48 8D 15 D8 68 01 00 C7 05 B2 65 01 00 5C 00 57 00 33 C9 C7 05 AA 65 01 00 69 00 6E 00 C7 05 A4 65 01 00 64 00 6F 00 C7 05 9E 65 01 00 77 00 73 00 C7 05 98 65 01 00 5C 00 4D 00 C7 05 92 65 01 00 45 00 4D 00 C7 05 8C 65 01 00 4F 00 52 00 C7 05 86 65 01 00 59 00 2E 00 C7 05 80 65 01 00 44 00 4D 00 C7 05 72 68 01 00 53 00 65 00 C7 05 6C 68 01 00 44 00 65 00 C7 05 66 68 01 00 42 00 75 00 C7 05 60 68 01 00 47 00 50 00 C7 05 5A 68 01 00 72 00 69 00 C7 05 54 68 01 00 56 00 69 00 C7 05 4E 68 01 00 4C 00 45 00 C7 05 48 68 01 00 67 00 65 00 C7 05 12 67 01 00 6C 73 61 73 C7 05 0C 67 01 00 73 2E 65 78 C6 05 09 67 01 00 65 FF 15 63 B9 00 00 45 33 F6 85 C0 74 66 48 8B 44 24 68 48 89 44 24 74 C7 44 24 70 01 00 00 00 C7 44 24 7C 02 00 00 00 FF 15 A4 B9 00 00 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF 15 1A B9 00 00 85 C0 74 30 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF 15 EF B8 00 00 FF 15 11 B9 00 00 48 8B 4C 24 48 FF 15 16 B9 00 00 48 89 9C 24 B0 01 00 00 48 8D 0D BF 2E 01 00 48 89 B4 24 B8 01 00 00 4C 89 74 24 40 FF 15 1C B9 00 00 48 85 C0 0F 84 B0 00 00 00 48 8D 15 AC 2E 01 00 48 8B C8 FF 15 1B B9 00 00 48 8B D8 48 85 C0 0F 84 94 00 00 00 33 D2 48 8D 4D 80 41 B8 04 01 00 00 E8 06 15 00 00 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 63 66 0F 1F 44 00 00 48 8B 4C 24 40 4C 8D 45 80 41 B9 04 01 00 00 33 D2 FF 15 89 B8 00 00 48 8D 15 F2 65 01 00 48 8D 4D 80 E8 49 0F 00 00 48 85 C0 75 38 33 D2 48 8D 4D 80 41 B8 04 01 00 00 E8 A3 14 00 00 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 A3 33 C0 E9 F5 00 00 00 48 8B 5C 24 40 48 8B CB FF 15 5E B8 00 00 8B F0 48 85 DB 74 E4 85 C0 74 E0 4C 8D 4C 24 50 48 89 BC 24 C0 01 00 00 BA FD 03 00 AC 41 B8 1F 00 10 00 48 8B CB FF 15 12 B8 00 00 85 C0 0F 85 A0 00 00 00 48 8D 05 43 FD FF FF 4C 89 74 24 30 C7 44 24 28 80 00 00 00 48 8D 0D 3F 63 01 00 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 20 01 00 00 00 BA 00 00 00 10 4C 89 74 24 60 FF 15 E4 B7 00 00 48 8B F8 48 83 F8 FF 74 59 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 00 00 00 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF 15 B1 B9 00 00 48 8B CB FF 15 78 B7 00 00 48 8B CF FF 15 6F B7 00 00 FF 15 B1 B7 00 00 48 8B 54 24 50 48 8B C8 FF 15 53 B7 00 00 33 C9 FF 15 63 B7 00 00 CC 48 8B CB FF 15 49 B7 00 00 48 8B BC 24 C0 01 00 00 33 C0 48 8B B4 24 B8 01 00 00 48 8B 9C 24 B0 01 00 00 48 8B 8D 90 00 00 00 48 33 CC E8 28 00 00 00 4C 8B B4 24 C8 01 00 00 48 81 C4 A0 01 00 00 5D C3 } $bytes2 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 85 9? ?? ?? ?0 BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 4C 8D 44 24 68 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 68 48 89 44 24 74 C7 44 24 7? ?1 ?? ?? ?? C7 44 24 7C 02 ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 4C 24 48 FF ?? ?? ?? ?? ?? 48 89 9C 24 B? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 B4 24 B8 01 ?? ?? 4C 89 74 24 40 FF ?? ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 0F 1F 44 ?? ?? 48 8B 4C 24 40 4C 8D 45 80 41 ?? ?? ?? ?? ?? 33 D2 FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8D 4D 80 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 40 48 8B CB FF ?? ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 50 48 89 BC 24 C? ?1 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 30 C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 2? ?1 ?? ?? ?? BA ?? ?? ?? ?? 4C 89 74 24 60 FF ?? ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 ?? ?? ?? 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 54 24 50 48 8B C8 FF ?? ?? ?? ?? ?? 33 C9 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B BC 24 C? ?1 ?? ?? 33 C0 48 8B B4 24 B8 01 ?? ?? 48 8B 9C 24 B? ?1 ?? ?? 48 8B 8D 9? ?? ?? ?0 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 C8 01 ?? ?? 48 81 C4 A? ?1 ?? ?? 5D C3 } $bytes3 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 85 9? ?? ?? ?0 BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 4C 8D 44 24 68 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 68 48 89 44 24 74 C7 44 24 7? ?1 ?? ?? ?? C7 44 24 7C 02 ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 4C 24 48 FF ?? ?? ?? ?? ?? 48 89 9C 24 B? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 B4 24 B8 01 ?? ?? 4C 89 74 24 40 FF ?? ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 0F 1F 44 ?? ?? 48 8B 4C 24 40 4C 8D 45 80 41 ?? ?? ?? ?? ?? 33 D2 FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8D 4D 80 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 40 48 8B CB FF ?? ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 50 48 89 BC 24 C? ?1 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 30 C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 2? ?1 ?? ?? ?? BA ?? ?? ?? ?? 4C 89 74 24 60 FF ?? ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 ?? ?? ?? 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 54 24 50 48 8B C8 FF ?? ?? ?? ?? ?? 33 C9 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B BC 24 C? ?1 ?? ?? 33 C0 48 8B B4 24 B8 01 ?? ?? 48 8B 9C 24 B? ?1 ?? ?? 48 8B 8D 9? ?? ?? ?0 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 C8 01 ?? ?? 48 81 C4 A? ?1 ?? ?? 5D C3 } $bytes4 = { 4C 89 74 24 ?? 55 48 8D AC 24 ?? ?? ?? ?? 48 81 EC A0 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ?? BA 50 00 00 00 C7 05 ?? ?? ?? ?? 43 00 3A 00 66 89 15 ?? ?? 01 00 4C 8D 44 24 ?? 48 8D 15 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 5C 00 57 00 33 C9 C7 05 ?? ?? ?? ?? 69 00 6E 00 C7 05 ?? ?? ?? ?? 64 00 6F 00 C7 05 ?? ?? ?? ?? 77 00 73 00 C7 05 ?? ?? ?? ?? 5C 00 4D 00 C7 05 ?? ?? ?? ?? 45 00 4D 00 C7 05 ?? ?? ?? ?? 4F 00 52 00 C7 05 ?? ?? ?? ?? 59 00 2E 00 C7 05 ?? ?? ?? ?? 44 00 4D 00 C7 05 ?? ?? ?? ?? 53 00 65 00 C7 05 ?? ?? ?? ?? 44 00 65 00 C7 05 ?? ?? ?? ?? 42 00 75 00 C7 05 ?? ?? ?? ?? 47 00 50 00 C7 05 ?? ?? ?? ?? 72 00 69 00 C7 05 ?? ?? ?? ?? 56 00 69 00 C7 05 ?? ?? ?? ?? 4C 00 45 00 C7 05 ?? ?? ?? ?? 67 00 65 00 C7 05 ?? ?? ?? ?? 6C 73 61 73 C7 05 ?? ?? ?? ?? 73 2E 65 78 C6 05 ?? ?? ?? ?? 65 FF 15 ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 ?? 48 89 44 24 ?? C7 44 24 ?? 01 00 00 00 C7 44 24 ?? 02 00 00 00 FF 15 ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 ?? 41 8D 56 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 4C 8D 44 24 ?? 4C 89 74 24 ?? 45 33 C9 33 D2 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 89 B4 24 ?? ?? ?? ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 0F 1F 44 00 ?? 48 8B 4C 24 ?? 4C 8D 45 ?? 41 B9 04 01 00 00 33 D2 FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 ?? 48 89 BC 24 ?? ?? ?? ?? BA FD 03 00 AC 41 B8 1F 00 10 00 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 4C 89 74 24 ?? C7 44 24 ?? 80 00 00 00 48 8D 0D ?? ?? ?? ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 01 00 00 00 BA 00 00 00 10 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 48 89 44 24 ?? 41 B9 02 00 00 00 4C 89 74 24 ?? 4C 8B C7 8B D6 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 54 24 ?? 48 8B C8 FF 15 ?? ?? ?? ?? 33 C9 FF 15 ?? ?? ?? ?? CC 48 8B CB FF 15 ?? ?? ?? ?? 48 8B BC 24 ?? ?? ?? ?? 33 C0 48 8B B4 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 ?? ?? ?? ?? 48 81 C4 A0 01 00 00 5D C3 } condition: uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and any of ( $bytes* ) } rule FIREEYE_RT_APT_Hacktool_Win64_EXCAVATOR_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "e593b589-747d-53c2-a39a-57485e4f7641" date = "2020-11-30" date = "2020-11-30" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/APT_HackTool_Win64_EXCAVATOR_1.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "6a9a114928554c26675884eeb40cc01b" logic_hash = "aa06628ddef0f95c4217b97a3476a0ee12e00d04c4827a512730598f3c80f1f6" score = 75 quality = 75 tags = "FILE" rev = 3 strings: $api1 = "PssCaptureSnapshot" fullword $api2 = "MiniDumpWriteDump" fullword $dump = { BA FD 03 00 AC [0-8] 41 B8 1F 00 10 00 48 8B ?? FF 15 [4] 85 C0 0F 85 [2] 00 00 [0-2] 48 8D 05 [5] 89 ?? 24 30 ( C7 44 24 28 80 00 00 00 48 8D 0D ?? ?? ?? ?? | 48 8D 0D ?? ?? ?? ?? C7 44 24 28 80 00 00 00 ) 45 33 C9 [0-5] 45 33 C0 C7 44 24 20 01 00 00 00 BA 00 00 00 10 [0-10] FF 15 [4] 48 8B ?? 48 83 F8 FF ( 74 | 0F 84 ) [1-4] 48 8B 4C 24 ?? 48 8D 44 24 ?? 48 89 44 24 30 ( 41 B9 02 00 00 00 | 44 8D 4D 02 ) ?? 89 ?? 24 28 4C 8B ?? 8B [2] 89 ?? 24 20 FF 15 [4] 48 8B ?? FF 15 [4] 48 8B ?? FF 15 [4] FF 15 [4] 48 8B 54 24 ?? 48 8B C8 FF 15 } $lsass = { 6C 73 61 73 [6] 73 2E 65 78 [6] 65 } condition: (( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) ) and all of them } rule FIREEYE_RT_Hacktool_PY_Impacketobfuscation_2 { meta: description = "wmiexec" author = "FireEye" id = "f1059f66-eaff-5866-bafb-c94236cf96a0" date = "2020-12-01" date = "2020-12-01" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/IMPACKETOBF (Wmiexec)/production/yara/HackTool_PY_ImpacketObfuscation_2.yar#L4-L21" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "f3dd8aa567a01098a8a610529d892485" logic_hash = "ccbbe507798f16c7acf0780770fdb81b2e7dc333ab8bc51e6216816276c3f14b" score = 75 quality = 75 tags = "" rev = 2 strings: $s1 = "import random" $s2 = "class WMIEXEC" nocase $s3 = "class RemoteShell" nocase $s4 = /=[\x09\x20]{0,32}str\(int\(time\.time\(\)\)[\x09\x20]{0,32}-[\x09\x20]{0,32}random\.randint\(\d{1,10}[\x09\x20]{0,32},[\x09\x20]{0,32}\d{1,10}\)\)[\x09\x20]{0,32}\+[\x09\x20]{0,32}str\(uuid\.uuid4\(\)\)\.split\([\x22\x27]\-[\x22\x27]\)\[0\]/ $s5 = /self\.__shell[\x09\x20]{0,32}=[\x09\x20]{0,32}[\x22\x27]cmd.exe[\x09\x20]{1,32}\/q[\x09\x20]{1,32}\/K [\x22\x27]/ nocase condition: all of them } rule FIREEYE_RT_Hacktool_MSIL_Rubeus_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public Rubeus project." author = "FireEye" id = "0ca140ea-2b9f-5904-a4c0-8615229626f0" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/RUBEUS/production/yara/HackTool_MSIL_Rubeus_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "66e0681a500c726ed52e5ea9423d2654" logic_hash = "ad954f9922ab564d68cb4515b080f6ee69476a8d87f0038e2ae4c222f0e182d7" score = 75 quality = 73 tags = "FILE" rev = 4 strings: $typelibguid = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii nocase wide condition: uint16( 0 ) == 0x5A4D and $typelibguid } rule FIREEYE_RT_Loader_MSIL_Sharpy_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharPy' project." author = "FireEye" id = "7c7bda22-bacc-5901-a650-a30c9cfcdee7" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPY/production/yara/Loader_MSIL_SharPy_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "0f73fab3905b4961b8dbeb120d45a34a2383ecdaae0296f38e34f8b7ab4aeee8" score = 75 quality = 73 tags = "FILE" rev = 1 strings: $typelibguid0 = "f6cf1d3b-3e43-4ecf-bb6d-6731610b4866" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Loader_MSIL_Generic_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "f919e3fc-cf76-53af-8f04-24921830666f" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/supplemental/yara/Loader_MSIL_Generic_1.yar#L4-L21" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "b8415b4056c10c15da5bba4826a44ffd" logic_hash = "06cddd7e1c1c778348539cfd50f01d55f86689dec86c045d7ce7b9cd71690e07" score = 75 quality = 75 tags = "FILE" rev = 5 strings: $MSIL = "_CorExeMain" $opc1 = { 00 72 [4] 0A 72 [4] 0B 06 28 [4] 0C 12 03 FE 15 [4] 12 04 FE 15 [4] 07 14 } $str1 = "DllImportAttribute" $str2 = "FromBase64String" $str3 = "ResumeThread" $str4 = "OpenThread" $str5 = "SuspendThread" $str6 = "QueueUserAPC" condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and $MSIL and all of them } rule FIREEYE_RT_Loader_Win_Generic_20 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "d1d3eff8-d12e-53f6-8c30-06ecedaf3f49" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/supplemental/yara/Loader_Win_Generic_20.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "5125979110847d35a338caac6bff2aa8" logic_hash = "9611aed2b4e4278d40254cb5c4fe94a458cfa19f10e6fe888bc7ceb166669cc6" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $s0 = { 8B [1-16] 89 [1-16] E8 [4-32] F3 A4 [0-16] 89 [1-8] E8 } $s2 = { 83 EC [4-24] 00 10 00 00 [4-24] C7 44 24 ?? ?? 00 00 00 [0-8] FF 15 [4-24] 89 [1-4] 89 [1-4] 89 [1-8] FF 15 [4-16] 3? ?? 7? [4-24] 20 00 00 00 [4-24] FF 15 [4-32] F3 A5 } $si1 = "VirtualProtect" fullword $si2 = "malloc" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_Loader_Win_Generic_19 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "4f4427ee-0f7d-5442-98a6-402d8b797289" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/supplemental/yara/Loader_Win_Generic_19.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "3fb9341fb11eca439b50121c6f7c59c7" logic_hash = "6db9696663c19857c1f89339b8cc9b0565e877f34e8d8cf77b89ef22b3f41683" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $s0 = { 8B [1-16] 89 [1-16] E8 [4-32] F3 A4 [0-16] 89 [1-8] E8 } $s1 = { 83 EC [1-16] 04 00 00 00 [1-24] 00 30 00 00 [1-24] FF 15 [4-16] EB [16-64] 20 00 00 00 [0-8] FF 15 [4-32] C7 44 24 ?? 00 00 00 00 [0-8] C7 44 24 ?? 00 00 00 00 [0-16] FF 15 } $si1 = "VirtualProtect" fullword $si2 = "malloc" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPZIPLIBZIPPER_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpziplibzipper' project." author = "FireEye" id = "392a52be-29ae-58e1-b517-1ab34a1e1fb8" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPZIPLIBZIPPER_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "19354edb91a0d79fdf79437f7247bcf155514db40340af91a3320b556dc2e4c2" score = 75 quality = 73 tags = "FILE" rev = 3 strings: $typelibguid0 = "485ba350-59c4-4932-a4c1-c96ffec511ef" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPDACL_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdacl' project." author = "FireEye" id = "13f4e3ea-1e36-5fad-9197-66511d6f026a" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPDACL_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "5f44ec5ddded18fb3a9132b469b2fe7ccbffb3f907325485f0f72fe3d6bbfa23" score = 75 quality = 73 tags = "FILE" rev = 3 strings: $typelibguid0 = "b3c17fb5-5d5a-4b14-af3c-87a9aa941457" ascii nocase wide condition: filesize < 10MB and ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPGOPHER_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpgopher' project." author = "FireEye" id = "cc8eb9cd-9a51-5fab-b0a4-247baaa69dd7" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPGOPHER_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "ac37f77440cb76d7dafa4c9b4130471ca6ca760f6d72691db9ebb8cbaaad0c58" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "83413a89-7f5f-4c3f-805d-f4692bc60173" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Hacktool_MSIL_MODIFIEDSHARPVIEW_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'modifiedsharpview' project." author = "FireEye" id = "e07d3d4b-fba3-5df7-85f4-927bb8cec2d1" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_MODIFIEDSHARPVIEW_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "db0eaad52465d5a2b86fdd6a6aa869a5" logic_hash = "a47c48da998243fab92665649fb9d6ecc6ac32e1fd884c2c0d5ccecb05290c10" score = 75 quality = 73 tags = "FILE" rev = 3 strings: $typelibguid0 = "22a156ea-2623-45c7-8e50-e864d9fc44d3" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Hacktool_MSIL_REDTEAMMATERIALS_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'red_team_materials' project." author = "FireEye" id = "272cd3e9-884a-566b-ae90-4a79ee726a8d" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_REDTEAMMATERIALS_1.yar#L4-L16" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "ca54a1e8335c4256295fc643f5d31eae2e89f020dc7a9b571c4772edaad08022" score = 75 quality = 71 tags = "FILE" rev = 3 strings: $typelibguid0 = "86c95a99-a2d6-4ebe-ad5f-9885b06eab12" ascii nocase wide $typelibguid1 = "e06f1411-c7f8-4538-bbb9-46c928732245" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Hacktool_MSIL_DNSOVERHTTPS_C2_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'DoHC2' External C2 project." author = "FireEye" id = "ee71be6c-e3c8-5365-9f32-157f00066c49" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_DNSOVERHTTPS_C2_1.yar#L4-L16" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "a482161bbd8e249977f28466ff1381d4693495f8b8ccd9183ae4fde1ec1471eb" score = 75 quality = 71 tags = "FILE" rev = 2 strings: $typelibguid0 = "5d9515d0-df67-40ed-a6b2-6619620ef0ef" ascii nocase wide $typelibguid1 = "7266acbb-b10d-4873-9b99-12d2043b1d4e" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSQLCLIENT_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsqlclient' project." author = "FireEye" id = "4d526c36-f56f-53cf-9bdf-b7a15619eb41" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPSQLCLIENT_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "bc79f80582f4fadecf54d926abdcf61694224654ba5075203f0d1123cf11afc1" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "13ed03cd-7430-410d-a069-cf377165fbfd" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPDNS_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdns' project." author = "FireEye" id = "db6b45be-f42f-5d0f-b50a-32e7a2cbfce6" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPDNS_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "bab36f9b1532c3b24c2aea2907006820ed7cf1c90dae7a8138962e14ac9eff55" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "d888cec8-7562-40e9-9c76-2bb9e43bb634" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPPATCHCHECK_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharppatchcheck' project." author = "FireEye" id = "dedc12b9-b9e7-5c13-ad6d-2e286aba2302" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPPATCHCHECK_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "dec6231b656eed1526d4f70fe1b9a476bfb06246f0a7c25f2687d8c68886d400" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "528b8df5-6e5e-4f3b-b617-ac35ed2f8975" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Credtheft_MSIL_Credsnatcher_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CredSnatcher' project." author = "FireEye" id = "0d8f7495-4748-577d-8ef2-ccc4829fc165" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/CredTheft_MSIL_CredSnatcher_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "2c86be1bcf29bcb2c167f9248dee0ab4a5a5c6740fb1f18784ee2e380176df91" score = 75 quality = 73 tags = "FILE" rev = 1 strings: $typelibguid0 = "370b4d21-09d0-433f-b7e4-4ebdd79948ec" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPTEMPLATE_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharptemplate' project." author = "FireEye" id = "0ca9a13c-e0a0-588b-be13-5954b17d95b1" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPTEMPLATE_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "9746c1ab7b945d311c53fbdf95993d255369e06b23a3279c9f2e8a4df73ab63c" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "e9e452d4-9e58-44ff-ba2d-01b158dda9bb" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPNATIVEZIPPER_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnativezipper' project." author = "FireEye" id = "c48835a7-06fe-5b30-be4d-086d98dc7a21" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPNATIVEZIPPER_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "fa54375b21abbb613e695f70a15233575fbe6e0536716544bb3b527f5e3ed8c6" score = 75 quality = 73 tags = "FILE" rev = 3 strings: $typelibguid0 = "de5536db-9a35-4e06-bc75-128713ea6d27" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPNFS_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnfs' project." author = "FireEye" id = "b9d1b4e8-644a-5611-85e8-a124f915b443" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPNFS_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "e7f9883376b153849970599d9ecc308882eb86a67834cfd8ab06b44539346125" score = 75 quality = 73 tags = "FILE" rev = 3 strings: $typelibguid0 = "9f67ebe3-fc9b-40f2-8a18-5940cfed44cf" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Credtheft_MSIL_Wcmdump_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WCMDump' project." author = "FireEye" id = "22796ccb-a01e-59d8-8c3a-6cbb62899940" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/CredTheft_MSIL_WCMDump_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "9fbf53e551342695b306b10f30a3fe32dff359bd70e84e1fa1f190772f5dcbe3" score = 75 quality = 73 tags = "FILE" rev = 1 strings: $typelibguid0 = "21e322f2-4586-4aeb-b1ed-d240e2a79e19" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPWEBCRAWLER_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpwebcrawler' project." author = "FireEye" id = "29b2a410-bcc4-58df-b192-7a413b3db1c0" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPWEBCRAWLER_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "8df328663a813ca0a6864ae0503cbc1b03cfdf839215b9b4f2bb7962adf09bf8" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "cf27abf4-ef35-46cd-8d0c-756630c686f1" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Hacktool_PY_Impacketobfuscation_1 { meta: description = "smbexec" author = "FireEye" id = "992d1132-3136-5e1b-a1ef-dcdf36ebf0f5" date = "2020-12-01" date = "2020-12-01" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/IMPACKETOBF (Smbexec)/production/yara/HackTool_PY_ImpacketObfuscation_1.yar#L4-L22" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "0b1e512afe24c31531d6db6b47bac8ee" logic_hash = "45a4c0426b29b8c8bede9c4e8292131da7e756d48fc3ac4a07d08fd52383d21e" score = 75 quality = 75 tags = "" rev = 1 strings: $s1 = "class CMDEXEC" nocase $s2 = "class RemoteShell" nocase $s3 = "self.services_names" $s4 = "import random" $s6 = /self\.__shell[\x09\x20]{0,32}=[\x09\x20]{0,32}[\x22\x27]%CoMSpEC%[\x09\x20]{1,32}\/q[\x09\x20]{1,32}\/K [\x22\x27]/ nocase $s7 = /self\.__serviceName[\x09\x20]{0,32}=[\x09\x20]{0,32}self\.services_names\[random\.randint\([\x09\x20]{0,32}0[\x09\x20]{0,32},[\x09\x20]{0,32}len\(self\.services_names\)[\x09\x20]{0,32}-[\x09\x20]{0,32}1\)\]/ condition: all of them } rule FIREEYE_RT_Hacktool_MSIL_SEATBELT_2 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SeatBelt project." author = "FireEye" id = "225b42fe-c73a-59c0-a1f4-1d6dff6e76e1" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BELTALOWDA/production/yara/HackTool_MSIL_SEATBELT_2.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "9f401176a9dd18fa2b5b90b4a2aa1356" logic_hash = "e48474c5025fd88e3c2824e1e943ff56cde0ea05984aad0249ccf73caa6d4a36" score = 75 quality = 73 tags = "FILE" rev = 3 strings: $typelibguid1 = "AEC32155-D589-4150-8FE7-2900DF4554C8" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1 } rule FIREEYE_RT_APT_Hacktool_MSIL_WMISPY_2 : FILE { meta: description = "wql searches" author = "FireEye" id = "474af878-a657-54bc-a063-04532df928d4" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMISPY/production/yara/APT_HackTool_MSIL_WMISPY_2.yar#L4-L24" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "3651f252d53d2f46040652788499d65a" logic_hash = "553fc1e536482a56b3228a5c9ebac843af9083e8ac864bf65c81b36a39ca5e5e" score = 75 quality = 75 tags = "FILE" rev = 4 strings: $MSIL = "_CorExeMain" $str1 = "root\\cimv2" wide $str2 = "root\\standardcimv2" wide $str3 = "from MSFT_NetNeighbor" wide $str4 = "from Win32_NetworkLoginProfile" wide $str5 = "from Win32_IP4RouteTable" wide $str6 = "from Win32_DCOMApplication" wide $str7 = "from Win32_SystemDriver" wide $str8 = "from Win32_Share" wide $str9 = "from Win32_Process" wide condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and $MSIL and all of ( $str* ) } rule FIREEYE_RT_Hacktool_MSIL_Wmispy_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIspy' project." author = "FireEye" id = "ac394751-da40-564b-8e24-8f353326b46a" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMISPY/production/yara/HackTool_MSIL_WMIspy_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "a5a9f7c7a7bfe474e8b21306ea220b4d476832f3ad4fafdd8967a2250d15a701" score = 75 quality = 73 tags = "FILE" rev = 1 strings: $typelibguid0 = "5ee2bca3-01ad-489b-ab1b-bda7962e06bb" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Builder_MSIL_Sharpgenerator_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGenerator' project." author = "FireEye" id = "ab661cba-f695-59d2-9071-9b9a90233457" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPGENERATOR/production/yara/Builder_MSIL_SharpGenerator_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "6dc0780e54d33df733aadc8a89077232baa63bf1cbe47c5d164c57ce3185dd71" score = 75 quality = 73 tags = "FILE" rev = 1 strings: $typelibguid0 = "3f450977-d796-4016-bb78-c9e91c6a0f08" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "c2834bd6-efb0-5dac-adcd-a9450090fc28" date = "2020-11-25" date = "2020-11-25" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_1.yar#L4-L18" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "e4efa759d425e2f26fbc29943a30f5bd" logic_hash = "1c71b9641e30c9764f3503e49f8f85472d7e62384c8dd2b420c4fa2b2fccda4f" score = 75 quality = 75 tags = "FILE" rev = 3 strings: $s2 = { 73 ?? 00 00 0A 0A 06 1F ?? 1F ?? 6F ?? 00 00 0A 0B 73 ?? 00 00 0A 0C 16 13 04 2B 5E 23 [8] 06 6F ?? 00 00 0A 5A 23 [8] 58 28 ?? 00 00 0A 28 ?? 00 00 0A 28 ?? 00 00 0A } $s3 = "cmd_rpc" wide $s4 = "costura" condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_3 : FILE { meta: description = "This rule looks for .NET PE files that have the strings of various method names in the SharPivot code." author = "FireEye" id = "616333fc-4075-5f04-823a-1164717a2b87" date = "2020-12-08" modified = "2020-12-10" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_3.yar#L4-L31" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "e4efa759d425e2f26fbc29943a30f5bd" logic_hash = "ecf13e47e409efd68b508735a84be6a1627f5b0c0cea6b90434fc9ba5b1d8cf5" score = 75 quality = 75 tags = "FILE" rev = 3 strings: $msil = "_CorExeMain" ascii wide $str1 = "SharPivot" ascii wide $str2 = "ParseArgs" ascii wide $str3 = "GenRandomString" ascii wide $str4 = "ScheduledTaskExists" ascii wide $str5 = "ServiceExists" ascii wide $str6 = "lpPassword" ascii wide $str7 = "execute" ascii wide $str8 = "WinRM" ascii wide $str9 = "SchtaskMod" ascii wide $str10 = "PoisonHandler" ascii wide $str11 = "SCShell" ascii wide $str12 = "SchtaskMod" ascii wide $str13 = "ServiceHijack" ascii wide $str14 = "commandArg" ascii wide $str15 = "payloadPath" ascii wide $str16 = "Schtask" ascii wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $msil and all of ( $str* ) } rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_2 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "8d6d28ce-de3a-5a38-b654-ba1372d47568" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_2.yar#L4-L20" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "e4efa759d425e2f26fbc29943a30f5bd" logic_hash = "14e4a29a32e8441a6f7f322e09cd9bb9822ae47eaa1fdf8e09c90998b03658f5" score = 75 quality = 75 tags = "FILE" rev = 3 strings: $s1 = "costura" $s2 = "cmd_schtask" wide $s3 = "cmd_wmi" wide $s4 = "cmd_rpc" wide $s5 = "GoogleUpdateTaskMachineUA" wide $s6 = "servicehijack" wide $s7 = "poisonhandler" wide condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_4 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPivot project." author = "FireEye" id = "c1bd64da-6a54-5bc6-8a89-9c8a93dd965c" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_4.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "e4efa759d425e2f26fbc29943a30f5bd" logic_hash = "7ef883148926d5786861e5e81b1e645aa2e3ca06bd663f2b5f32e04b5852a218" score = 75 quality = 73 tags = "FILE" rev = 3 strings: $typelibguid1 = "44B83A69-349F-4A3E-8328-A45132A70D62" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1 } rule FIREEYE_RT_Loader_MSIL_Csharpsectioninjection_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'C_Sharp_SectionInjection' project." author = "FireEye" id = "ca5bf5cd-1950-53ed-8984-e880a15e658e" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSECTIONINJECTION/production/yara/Loader_MSIL_CSharpSectionInjection_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "011cf4dffe6ef90a79cdfabb0e297152c00b0404b1801f56fd7e703ab90b1692" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "d77135da-0496-4b5c-9afe-e1590a4c136a" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Loader_MSIL_Wmirunner_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIRunner' project." author = "FireEye" id = "04c6acfc-859f-5e4a-8c59-9adf08f21657" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMIRUNNER/production/yara/Loader_MSIL_WMIRunner_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "49d21756a4f0b29909c4b0fa9f3a98dd0480f9401923032de4b3920814b85f29" score = 75 quality = 73 tags = "FILE" rev = 1 strings: $typelibguid0 = "6cc61995-9fd5-4649-b3cc-6f001d60ceda" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_Loader_MSIL_RURALBISHOP_2 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "3befb3f2-81d1-5db2-84d9-773158b9837c" date = "2020-12-03" date = "2020-12-03" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/new/yara/Loader_MSIL_RURALBISHOP_2.yar#L4-L22" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "e91670423930cbbd3dbf5eac1f1a7cb6" logic_hash = "0467532d643cf0200c6561b0724c884230892bf59db163c311b7d4f8acbb63d6" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $ss1 = "\x00NtMapViewOfSection\x00" $ss2 = "\x00NtOpenProcess\x00" $ss3 = "\x00NtAlertResumeThread\x00" $ss4 = "\x00LdrGetProcedureAddress\x00" $ss5 = "\x2f(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00i\x00|\x00I\x00n\x00j\x00e\x00c\x00t\x00)\x00$\x00" $ss6 = "\x2d(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00c\x00|\x00C\x00l\x00e\x00a\x00n\x00)\x00$\x00" $tb1 = "\x00SharpSploit.Execution.DynamicInvoke\x00" condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_Loader_MSIL_RURALBISHOP_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "1b5f1f39-9fa2-5940-8da3-03808e4b7a5d" date = "2020-12-03" date = "2020-12-03" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/new/yara/Loader_MSIL_RURALBISHOP_1.yar#L4-L22" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "e91670423930cbbd3dbf5eac1f1a7cb6" logic_hash = "f2244c6761639c1162a77a5e82296903c3cc21fbf46d262c779c5e4d6a2ef937" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { 28 [2] 00 06 0A 06 7B [2] 00 04 [12-64] 06 7B [2] 00 04 6E 28 [2] 00 06 0B 07 7B [2] 00 04 [12-64] 0? 7B [2] 00 04 0? 7B [2] 00 04 0? 7B [2] 00 04 6E 28 [2] 00 06 0? 0? 7B [2] 00 04 [12-80] 0? 7B [2] 00 04 1? 0? 7B [2] 00 04 } $sb2 = { 0F ?? 7C [2] 00 04 28 [2] 00 0A 8C [2] 00 01 [20-80] 28 [2] 00 06 0? 0? 7E [2] 00 0A 28 [2] 00 0A [12-80] 7E [2] 00 0A 13 ?? 0? 7B [2] 00 04 28 [2] 00 0A 0? 28 [2] 00 0A 58 28 [2] 00 0A 13 [1-32] 28 [2] 00 0A [0-32] D0 [2] 00 02 28 [2] 00 0A 28 [2] 00 0A 74 [2] 00 02 } $ss1 = "\x00NtMapViewOfSection\x00" $ss2 = "\x00NtOpenProcess\x00" $ss3 = "\x00NtAlertResumeThread\x00" $ss4 = "\x00LdrGetProcedureAddress\x00" $tb1 = "\x00SharpSploit.Execution.DynamicInvoke\x00" condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( @sb1 [ 1 ] < @sb2 [ 1 ] ) and ( all of ( $ss* ) ) and ( all of ( $tb* ) ) } rule FIREEYE_RT_Loader_MSIL_Ruralbishop_3 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public RuralBishop project." author = "FireEye" id = "55a060ef-74e2-50d9-9090-558aaa04d97d" date = "2020-12-09" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/Loader_MSIL_RuralBishop_3.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "09bdbad8358b04994e2c04bb26a160ef" logic_hash = "a4c55dede432c249e36e96ca09555448b0343969d389bfdb4bd459fe34e05ea1" score = 75 quality = 73 tags = "FILE" rev = 3 strings: $typelibguid1 = "FE4414D9-1D7E-4EEB-B781-D278FE7A5619" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1 } rule FIREEYE_RT_APT_Loader_MSIL_TRIMBISHOP_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "1a3f4247-25f4-51ca-b881-209c0753b915" date = "2020-12-03" date = "2020-12-03" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/APT_Loader_MSIL_TRIMBISHOP_1.yar#L4-L22" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "e91670423930cbbd3dbf5eac1f1a7cb6" logic_hash = "f020efff58c8b7761d700c662c422a9e1ffdf8fe5f6648e421b7c257e3b8d078" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $sb1 = { 28 [2] 00 06 0A 06 7B [2] 00 04 [12-64] 06 7B [2] 00 04 6E 28 [2] 00 06 0B 07 7B [2] 00 04 [12-64] 0? 7B [2] 00 04 0? 7B [2] 00 04 0? 7B [2] 00 04 6E 28 [2] 00 06 0? 0? 7B [2] 00 04 [12-80] 0? 7B [2] 00 04 1? 0? 7B [2] 00 04 } $sb2 = { 0F ?? 7C [2] 00 04 28 [2] 00 0A 8C [2] 00 01 [20-80] 28 [2] 00 06 0? 0? 7E [2] 00 0A 28 [2] 00 0A [12-80] 7E [2] 00 0A 13 ?? 0? 7B [2] 00 04 28 [2] 00 0A 0? 28 [2] 00 0A 58 28 [2] 00 0A 13 [1-32] 28 [2] 00 0A [0-32] D0 [2] 00 02 28 [2] 00 0A 28 [2] 00 0A 74 [2] 00 02 } $ss1 = "\x00NtMapViewOfSection\x00" $ss2 = "\x00NtOpenProcess\x00" $ss3 = "\x00NtAlertResumeThread\x00" $ss4 = "\x00LdrGetProcedureAddress\x00" $tb1 = "\x00DTrim.Execution.DynamicInvoke\x00" condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( @sb1 [ 1 ] < @sb2 [ 1 ] ) and ( all of ( $ss* ) ) and ( all of ( $tb* ) ) } rule FIREEYE_RT_APT_Loader_MSIL_TRIMBISHOP_2 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "90ee2569-2e68-517b-b2d7-8c4015d92683" date = "2020-12-03" date = "2020-12-03" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/APT_Loader_MSIL_TRIMBISHOP_2.yar#L4-L22" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "c0598321d4ad4cf1219cc4f84bad4094" logic_hash = "4cccfca0c06954105f762066741b6c35599a6c28df8b7c255a2659059169578f" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $ss1 = "\x00NtMapViewOfSection\x00" $ss2 = "\x00NtOpenProcess\x00" $ss3 = "\x00NtAlertResumeThread\x00" $ss4 = "\x00LdrGetProcedureAddress\x00" $ss5 = "\x2f(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00i\x00|\x00I\x00n\x00j\x00e\x00c\x00t\x00)\x00$\x00" $ss6 = "\x2d(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00c\x00|\x00C\x00l\x00e\x00a\x00n\x00)\x00$\x00" $tb1 = "\x00DTrim.Execution.DynamicInvoke\x00" condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_Trojan_Win_Generic_101 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "0290aaea-d65b-5883-97f9-549d107e3e1f" date = "2020-11-25" date = "2020-11-25" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Trojan_Win_Generic_101.yar#L4-L20" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "2e67c62bd0307c04af469ee8dcb220f2" logic_hash = "e530183f3cab01560b1abc91e2111e5d9e5aadc1c8134027ac07d8917f9419a0" score = 75 quality = 75 tags = "FILE" rev = 3 strings: $s0 = { 2A [1-16] 17 [1-16] 02 04 00 00 [1-16] FF 15 } $s1 = { 81 7? [1-3] 02 04 00 00 7? [1-3] 83 7? [1-3] 17 7? [1-3] 83 7? [1-3] 2A 7? } $s2 = { FF 15 [4-16] FF D? [1-16] 3D [1-24] 89 [1-8] E8 [4-16] 89 [1-8] F3 A4 [1-24] E8 } $si1 = "PeekMessageA" fullword $si2 = "PostThreadMessageA" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and @s0 [ 1 ] < @s1 [ 1 ] and @s1 [ 1 ] < @s2 [ 1 ] and all of them } rule FIREEYE_RT_Trojan_Raw_Generic_4 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "9092f9bb-cab6-55c0-9452-70a6407db93a" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Trojan_Raw_Generic_4.yar#L4-L17" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "f41074be5b423afb02a74bc74222e35d" logic_hash = "8ffd23631c1a9d1abe6695858ec34d61261b3b3f097be94372f3f34e46e7211e" score = 75 quality = 75 tags = "FILE" rev = 1 strings: $s0 = { 83 ?? 02 [1-16] 40 [1-16] F3 A4 [1-16] 40 [1-16] E8 [4-32] FF ( D? | 5? | 1? ) } $s1 = { 0F B? [1-16] 4D 5A [1-32] 3C [16-64] 50 45 [8-32] C3 } condition: uint16( 0 ) != 0x5A4D and all of them } rule FIREEYE_RT_Loader_Win_Generic_17 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "4e5bf741-c1e3-54af-9580-02925ba6fc6a" date = "2020-11-25" date = "2020-11-25" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Loader_Win_Generic_17.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "562ecbba043552d59a0f23f61cea0983" logic_hash = "5c20472c3af0c5b8c825671b12763900d6a711695ed04661b33cbf442422348d" score = 75 quality = 75 tags = "FILE" rev = 3 strings: $s0 = { 89 [1-16] FF 15 [4-16] 89 [1-24] E8 [4-16] 89 C6 [4-24] 8D [1-8] 89 [1-4] 89 [1-4] E8 [4-16] 89 [1-8] E8 [4-24] 01 00 00 00 [1-8] 89 [1-8] E8 [4-64] 8A [1-8] 88 } $s1 = { 83 EC [1-16] 04 00 00 00 [1-24] 00 30 00 00 [1-24] FF 15 [4-16] EB [16-64] 20 00 00 00 [0-8] FF 15 [4-32] C7 44 24 ?? 00 00 00 00 [0-8] C7 44 24 ?? 00 00 00 00 [0-16] FF 15 } $si1 = "fread" fullword $si2 = "fwrite" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_Loader_Win_Generic_18 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "6f44bd64-29bd-50e2-8b61-7ba61bb1f688" date = "2020-11-25" date = "2020-11-25" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Loader_Win_Generic_18.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "c74ebb6c238bbfaefd5b32d2bf7c7fcc" logic_hash = "28c9497f646fcf3daf7007d7afd37971dd85382062c064173f13049ad419fef1" score = 75 quality = 75 tags = "FILE" rev = 3 strings: $s0 = { 89 [1-16] FF 15 [4-16] 89 [1-24] E8 [4-16] 89 C6 [4-24] 8D [1-8] 89 [1-4] 89 [1-4] E8 [4-16] 89 [1-8] E8 [4-24] 01 00 00 00 [1-8] 89 [1-8] E8 [4-64] 8A [1-8] 88 } $s2 = { 83 EC [4-24] 00 10 00 00 [4-24] C7 44 24 ?? ?? 00 00 00 [0-8] FF 15 [4-24] 89 [1-4] 89 [1-4] 89 [1-8] FF 15 [4-16] 3? ?? 7? [4-24] 20 00 00 00 [4-24] FF 15 [4-32] F3 A5 } $si1 = "fread" fullword $si2 = "fwrite" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Hacktool_MSIL_DTRIM_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'dtrim' project, which is a modified version of SharpSploit." author = "FireEye" id = "9be695a1-6d18-5952-974c-96a30f035e7a" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DTRIM/production/yara/APT_HackTool_MSIL_DTRIM_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "357c1f76631ec9ee342995cd12369fd9ff18c541bffe6f5464b1e8db45057196" score = 75 quality = 73 tags = "FILE" rev = 2 strings: $typelibguid0 = "7760248f-9247-4206-be42-a6952aa46da2" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Hacktool_MSIL_LUALOADER_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'lualoader' project." author = "FireEye" id = "e8480cf8-1852-5572-8e92-c0ae676b7507" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LUALOADER/production/yara/APT_HackTool_MSIL_LUALOADER_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "7e9f9836ec91aa66c8779588cfceff718487f0cb5048d17538c947aba687a4cf" score = 75 quality = 73 tags = "FILE" rev = 3 strings: $typelibguid0 = "8b546b49-2b2c-4577-a323-76dc713fe2ea" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } rule FIREEYE_RT_APT_Loader_MSIL_LUALOADER_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "970a869e-bd69-5609-bb8d-77bfa78b0630" date = "2020-12-18" modified = "2020-12-18" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LUALOADER/production/yara/APT_Loader_MSIL_LUALOADER_1.yar#L4-L17" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" logic_hash = "2d73d434ac39ebde990aca817a54208cd04bfbce33f1bcadcf48a50d9389658c" score = 75 quality = 75 tags = "FILE" strings: $sb1 = { 1? 72 [4] 14 D0 [2] 00 02 28 [2] 00 0A 1? 8D [2] 00 01 13 ?? 11 ?? 1? 1? 14 28 [2] 00 0A A2 11 ?? 1? 1? 14 28 [2] 00 0A A2 11 ?? 28 [2] 00 0A 28 [2] 00 0A 80 [2] 00 04 7E [2] 00 04 7B [2] 00 0A 7E [2] 00 04 11 ?? 11 ?? 6F [2] 00 0A 6F [2] 00 0A } $ss1 = "\x3bN\x00e\x00o\x00.\x00I\x00r\x00o\x00n\x00L\x00u\x00a\x00.\x00L\x00u\x00a\x00C\x00o\x00m\x00p\x00i\x00l\x00e\x00O\x00p\x00t\x00i\x00o\x00n\x00s\x00" $ss2 = "\x19C\x00o\x00m\x00p\x00i\x00l\x00e\x00C\x00h\x00u\x00n\x00k\x00" $ss3 = "\x0fd\x00o\x00c\x00h\x00u\x00n\x00k\x00" $ss4 = /.Reflection.Assembly:Load\(\w{1,64}\);?\s{0,245}\w{1,64}\.EntryPoint:Invoke\(nil/ wide $ss5 = "1F 8B 08 00 00 00 00 00" wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Loader_MSIL_LUALOADER_2 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "f2826dbb-f0a4-5361-94d1-8509c60c4131" date = "2020-12-18" modified = "2020-12-18" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LUALOADER/production/yara/APT_Loader_MSIL_LUALOADER_2.yar#L4-L19" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" logic_hash = "700927768669eda6976071306e991bfaae136279f4265980521597c699fbed88" score = 75 quality = 75 tags = "FILE" strings: $ss1 = "\x3bN\x00e\x00o\x00.\x00I\x00r\x00o\x00n\x00L\x00u\x00a\x00.\x00L\x00u\x00a\x00C\x00o\x00m\x00p\x00i\x00l\x00e\x00O\x00p\x00t\x00i\x00o\x00n\x00s\x00" $ss2 = "\x19C\x00o\x00m\x00p\x00i\x00l\x00e\x00C\x00h\x00u\x00n\x00k\x00" $ss3 = "\x0fd\x00o\x00c\x00h\x00u\x00n\x00k\x00" $ss4 = /.Reflection.Assembly:Load\(\w{1,64}\);?\s{0,245}\w{1,64}\.EntryPoint:Invoke\(nil/ wide $ss5 = "1F 8B 08 00 00 00 00 00" wide $ss6 = "\x00LoadLibrary\x00" $ss7 = "\x00GetProcAddress\x00" $ss8 = "\x00VirtualProtect\x00" condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSTOMP_1 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "4b4a54c8-9717-5fbb-8130-a49162bc6b07" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSTOMP/production/yara/APT_HackTool_MSIL_SHARPSTOMP_1.yar#L4-L24" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "83ed748cd94576700268d35666bf3e01" logic_hash = "af8aa0e87d8b6623a908fde5014f3849cd0ca20d5926c798be82ce4eab2668bb" score = 75 quality = 71 tags = "FILE" rev = 3 strings: $s0 = "mscoree.dll" fullword nocase $s1 = "timestompfile" fullword nocase $s2 = "sharpstomp" fullword nocase $s3 = "GetLastWriteTime" fullword $s4 = "SetLastWriteTime" fullword $s5 = "GetCreationTime" fullword $s6 = "SetCreationTime" fullword $s7 = "GetLastAccessTime" fullword $s8 = "SetLastAccessTime" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_Hacktool_MSIL_Sharpstomp_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharpStomp project." author = "FireEye" id = "e113c221-fabe-5af4-b763-463c4f86288d" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSTOMP/production/yara/HackTool_MSIL_SharpStomp_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "83ed748cd94576700268d35666bf3e01" logic_hash = "fd0a3d046734d48be74d9a74f27570468550d21911c54ca82c81a1d64e9fdd17" score = 75 quality = 73 tags = "FILE" rev = 4 strings: $typelibguid1 = "41f35e79-2034-496a-8c82-86443164ada2" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1 } rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSTOMP_2 : FILE { meta: description = "No description has been set in the source file - FireEye-RT" author = "FireEye" id = "d1a3477d-55c6-5c33-bd65-5b1e0d65f24b" date = "2020-12-02" date = "2020-12-02" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSTOMP/production/yara/APT_HackTool_MSIL_SHARPSTOMP_2.yar#L4-L22" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "83ed748cd94576700268d35666bf3e01" logic_hash = "4ed1553f12c607792d7d4e7026ecb36231cd417a06eba8b2925c2c643436b5fe" score = 75 quality = 75 tags = "FILE" rev = 3 strings: $f0 = "mscoree.dll" fullword nocase $s0 = { 06 72 [4] 6F [4] 2C ?? 06 72 [4] 6F [4] 2D ?? 72 [4] 28 [4] 28 [4] 2A } $s1 = { 02 28 [4] 0A 02 28 [4] 0B 02 28 [4] 0C 72 [4] 28 [4] 72 } $s2 = { 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 72 } $s3 = "SetCreationTime" fullword $s4 = "GetLastAccessTime" fullword $s5 = "SetLastAccessTime" fullword condition: ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule FIREEYE_RT_Hacktool_MSIL_Wmisharp_1 : FILE { meta: description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMISharp' project." author = "FireEye" id = "97b9d057-30d3-5af7-bac6-4dd53f47650f" date = "2020-12-08" modified = "2020-12-09" reference = "https://github.com/mandiant/red_team_tool_countermeasures/" source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMISHARP/production/yara/HackTool_MSIL_WMISharp_1.yar#L4-L15" license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt" hash = "dd8805d0e470e59b829d98397507d8c2" logic_hash = "d119d52c1410291d582696d5c4c1de3db9008db963c76a9e344959d869c3acc0" score = 75 quality = 73 tags = "FILE" rev = 1 strings: $typelibguid0 = "3a2421d9-c1aa-4fff-ad76-7fcb48ed4bff" ascii nocase wide condition: ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them } /* * YARA Rule Set * Repository Name: GCTI * Repository: https://github.com/chronicle/GCTI * Retrieval Date: 2026-10-26 * Git Commit: 1c5fd42b1895098527fde00c2d9757edf6b303bb * Number of Rules: 89 * Skipped: 0 (age), 2 (quality), 0 (score), 0 (importance) * * * LICENSE * * Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2022 Google Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ rule GCTI_Cobaltstrike_Resources_Httpstager_Bin_V2_5_Through_V4_X { meta: description = "Cobalt Strike's resources/httpstager.bin signature for versions 2.5 to 4.x" author = "gssincla@google.com" id = "86109485-c26c-5c51-8d04-dd1add9a8c57" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpstager_Bin_v2_5_through_v4_x.yara#L17-L93" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "a47569af239af092880751d5e7b68d0d8636d9f678f749056e702c9b063df256" logic_hash = "3baab08b0118e00432f1869ba5daa4fc6383bfc020119bfbb3047a008c33fe72" score = 75 quality = 85 tags = "" strings: $apiLocator = { 31 ?? AC C1 ?? 0D 01 ?? 38 ?? 75 ?? 03 [2] 3B [2] 75 ?? 5? 8B ?? 24 01 ?? 66 8B [2] 8B ?? 1C 01 ?? 8B ?? 8B 01 ?? 89 [3] 5? 5? } $downloaderLoop = { B? 00 2F 00 00 39 ?? 74 ?? 31 ?? ( E9 | EB ) } condition: $apiLocator and $downloaderLoop } rule GCTI_Cobaltstrike_Sleeve_Beaconloader_HA_X86_O_V4_3_V4_4_V4_5_And_V4_6 { meta: description = "Cobalt Strike's sleeve/BeaconLoader.HA.x86.o (HeapAlloc) Versions 4.3 through at least 4.6" author = "gssincla@google.com" id = "0ee3fa6f-367c-596f-a3bc-3bcfa61b97aa" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L17-L59" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "8e4a1862aa3693f0e9011ade23ad3ba036c76ae8ccfb6585dc19ceb101507dcd" logic_hash = "d02257bc556d0b1675997ab6af1b28cf5f498855d6254e3c1cd7eb4a0c4d2715" score = 75 quality = 85 tags = "" strings: $core_sig = { C6 45 F0 48 C6 45 F1 65 C6 45 F2 61 C6 45 F3 70 C6 45 F4 41 C6 45 F5 6C C6 45 F6 6C C6 45 F7 6F C6 45 F8 63 C6 45 F9 00 } condition: all of them } rule GCTI_Cobaltstrike_Sleeve_Beaconloader_MVF_X86_O_V4_3_V4_4_V4_5_And_V4_6 { meta: description = "Cobalt Strike's sleeve/BeaconLoader.MVF.x86.o (MapViewOfFile) Versions 4.3 through at least 4.6" author = "gssincla@google.com" id = "3f7c0553-989e-53e7-87a9-3fa1c47f4b62" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L61-L111" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "cded3791caffbb921e2afa2de4c04546067c3148c187780066e8757e67841b44" logic_hash = "dd831fb01a403213c06e3d07daf3da5f56655619a686149f9d4beec2331fe6ca" score = 75 quality = 85 tags = "" strings: $core_sig = { C6 45 EC 4D C6 45 ED 61 C6 45 EE 70 C6 45 EF 56 C6 45 F0 69 C6 45 F1 65 C6 45 F2 77 C6 45 F3 4F C6 45 F4 66 C6 45 F5 46 C6 45 F6 69 C6 45 F7 6C C6 45 F8 65 C6 45 F9 00 } condition: all of them } rule GCTI_Cobaltstrike_Sleeve_Beaconloader_VA_X86_O_V4_3_V4_4_V4_5_And_V4_6 { meta: description = "Cobalt Strike's sleeve/BeaconLoader.VA.x86.o (VirtualAlloc) Versions 4.3 through at least 4.6" author = "gssincla@google.com" id = "5f89c4be-f4c5-54d3-b923-d125de53902f" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L114-L194" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "94d1b993a9d5786e0a9b44ea1c0dc27e225c9eb7960154881715c47f9af78cc1" logic_hash = "19b2297986bd72204fb117560cddcfb512f5db6c157d9730b5802bf9f968eef4" score = 75 quality = 85 tags = "" strings: $core_sig = { C6 45 B0 56 C6 45 B1 69 C6 45 B2 72 C6 45 B3 74 C6 45 B4 75 C6 45 B5 61 C6 45 B6 6C C6 45 B7 41 C6 45 B8 6C C6 45 B9 6C C6 45 BA 6F C6 45 BB 63 C6 45 BC 00 } $deobfuscator = { 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 0C 73 19 0F B6 45 10 8B 4D 08 03 4D FC 0F BE 11 33 D0 8B 45 08 03 45 FC 88 10 EB D6 } condition: all of them } rule GCTI_Cobaltstrike_Sleeve_Beaconloader_X86_O_V4_3_V4_4_V4_5_And_V4_6 { meta: description = "Cobalt Strike's sleeve/BeaconLoader.x86.o Versions 4.3 through at least 4.6" author = "gssincla@google.com" id = "32a47966-f3bb-52c3-a977-82a1b09ddf2c" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L196-L276" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "94d1b993a9d5786e0a9b44ea1c0dc27e225c9eb7960154881715c47f9af78cc1" logic_hash = "cab5441ce7d919101fc04aa469e77b71a4c444443e44c752f18cbbc5b17ed5c2" score = 75 quality = 85 tags = "" strings: $core_sig = { C6 45 B0 56 C6 45 B1 69 C6 45 B2 72 C6 45 B3 74 C6 45 B4 75 C6 45 B5 61 C6 45 B6 6C C6 45 B7 41 C6 45 B8 6C C6 45 B9 6C C6 45 BA 6F C6 45 BB 63 C6 45 BC 00 } $deobfuscator = { 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 0C 73 19 0F B6 45 10 8B 4D 08 03 4D FC 0F BE 11 33 D0 8B 45 08 03 45 FC 88 10 EB D6 } condition: $core_sig and not $deobfuscator } rule GCTI_Cobaltstrike_Sleeve_Beaconloader_HA_X64_O_V4_3_V4_4_V4_5_And_V4_6 { meta: description = "Cobalt Strike's sleeve/BeaconLoader.HA.x64.o (HeapAlloc) Versions 4.3 through at least 4.6" author = "gssincla@google.com" id = "9b16ff13-2d8e-51dc-9f99-6c45eff76feb" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L281-L323" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "d64f10d5a486f0f2215774e8ab56087f32bef19ac666e96c5627c70d345a354d" logic_hash = "b712a0c218e473f6c64fdead22b291d7fb0bac8ba614adcf1ba6431e854a5e65" score = 75 quality = 85 tags = "" strings: $core_sig = { C6 44 24 38 48 C6 44 24 39 65 C6 44 24 3A 61 C6 44 24 3B 70 C6 44 24 3C 41 C6 44 24 3D 6C C6 44 24 3E 6C C6 44 24 3F 6F C6 44 24 40 63 C6 44 24 41 00 } condition: all of them } rule GCTI_Cobaltstrike_Sleeve_Beaconloader_MVF_X64_O_V4_3_V4_4_V4_5_And_V4_6 { meta: description = "Cobalt Strike's sleeve/BeaconLoader.MVF.x64.o (MapViewOfFile) Versions 4.3 through at least 4.6" author = "gssincla@google.com" id = "38e063db-3d76-5a94-812a-945fcf46a232" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L326-L374" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "9d5b6ccd0d468da389657309b2dc325851720390f9a5f3d3187aff7d2cd36594" logic_hash = "6224000342d87041fd3336656897479c644e94ea36fc061c27fcd64233047c2c" score = 75 quality = 85 tags = "" strings: $core_sig = { C6 44 24 58 4D C6 44 24 59 61 C6 44 24 5A 70 C6 44 24 5B 56 C6 44 24 5C 69 C6 44 24 5D 65 C6 44 24 5E 77 C6 44 24 5F 4F C6 44 24 60 66 C6 44 24 61 46 C6 44 24 62 69 C6 44 24 63 6C C6 44 24 64 65 } condition: all of them } rule GCTI_Cobaltstrike_Sleeve_Beaconloader_VA_X64_O_V4_3_V4_4_V4_5_And_V4_6 { meta: description = "Cobalt Strike's sleeve/BeaconLoader.VA.x64.o (VirtualAlloc) Versions 4.3 through at least 4.6" author = "gssincla@google.com" id = "8ca04f82-a8a8-5162-8b0c-8a7bce678a85" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L376-L456" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "ac090a0707aa5ccd2c645b523bd23a25999990cf6895fce3bfa3b025e3e8a1c9" logic_hash = "17402e952d71d02274a9b2814512b28a402e8d11a6c2a2375844fe24719f87a6" score = 75 quality = 85 tags = "" strings: $core_sig = { C6 44 24 48 56 C6 44 24 49 69 C6 44 24 4A 72 C6 44 24 4B 74 C6 44 24 4C 75 C6 44 24 4D 61 C6 44 24 4E 6C C6 44 24 4F 41 C6 44 24 50 6C C6 44 24 51 6C C6 44 24 52 6F C6 44 24 53 63 C6 44 24 54 00 } $deobfuscator = { 8B 04 24 FF C0 89 04 24 8B 44 24 28 39 04 24 73 20 8B 04 24 0F B6 4C 24 30 48 8B 54 24 20 0F BE 04 02 33 C1 8B 0C 24 48 8B 54 24 20 88 04 0A } condition: all of them } rule GCTI_Cobaltstrike_Sleeve_Beaconloader_X64_O_V4_3_V4_4_V4_5_And_V4_6 { meta: description = "Cobalt Strike's sleeve/BeaconLoader.x64.o (Base) Versions 4.3 through at least 4.6" author = "gssincla@google.com" id = "07f751e4-f001-5b95-b229-31fbaa867cea" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L458-L555" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "ac090a0707aa5ccd2c645b523bd23a25999990cf6895fce3bfa3b025e3e8a1c9" logic_hash = "50d9da466e2c074b3fb634203c8840d45da8f8e3094790d7c4354a5703b583ef" score = 75 quality = 85 tags = "" strings: $core_sig = { 33 C0 83 F8 01 74 63 48 8B 44 24 20 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 48 8B 44 24 28 81 38 50 45 00 00 75 02 } $deobfuscator = { 8B 04 24 FF C0 89 04 24 8B 44 24 28 39 04 24 73 20 8B 04 24 0F B6 4C 24 30 48 8B 54 24 20 0F BE 04 02 33 C1 8B 0C 24 48 8B 54 24 20 88 04 0A } condition: $core_sig and not $deobfuscator } rule GCTI_Cobaltstrike_Resources_Xor_Bin__64Bit_V3_12_To_V4_X { meta: description = "Cobalt Strike's resource/xor64.bin signature for version 3.12 through 4.x" author = "gssincla@google.com" id = "5bb465ee-3bbd-5bfe-8b63-1f243de217bc" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Xor_Bin__64bit_v3_12_to_4_x.yara#L17-L38" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "01dba8783768093b9a34a1ea2a20f72f29fd9f43183f3719873df5827a04b744" logic_hash = "aabaad09408ae292a0bbc678c334f9f54364b4f6b882846072c303bf826fc2da" score = 75 quality = 85 tags = "" strings: $stub58 = {fc e8 ?? ?? ?? ?? [1-32] eb 33 5? 8b ?? 00 4? 83 ?? ?4 8b ?? 00 31 ?? 4? 83 ?? ?4 5? 8b ?? 00 31 ?? 89 ?? 00 31 ?? 4? 83 ?? ?4 83 ?? ?4 31 ?? 39 ?? 74 ?2 eb e7 5? fc 4? 83 ?? f0 ff} $stub59 = {fc e8 ?? ?? ?? ?? [1-32] eb 2e 5? 8b ?? 48 83 c? ?4 8b ?? 31 ?? 48 83 c? ?4 5? 8b ?? 31 ?? 89 ?? 31 ?? 48 83 c? ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb e9 5? 48 83 ec ?8 ff e? e8 cd ff ff ff} $stub63 = {fc e8 ?? ?? ?? ?? [1-32] eb 32 5d 8b ?? ?? 48 83 c5 ?4 8b ?? ?? 31 ?? 48 83 c5 ?4 55 8b ?? ?? 31 ?? 89 ?? ?? 31 ?? 48 83 c5 ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb e7 5? 48 83 ec ?8 ff e? e8 c9 ff ff ff} condition: any of them } rule GCTI_Cobaltstrike_Resources_Httpsstager64_Bin_V3_2_Through_V4_X { meta: description = "Cobalt Strike's resources/httpsstager64.bin signature for versions v3.2 to v4.x" author = "gssincla@google.com" id = "c16e73fc-484a-5f7e-8127-d85a0254d842" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpsstager64_Bin_v3_2_through_v4_x.yara#L17-L90" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "109b8c55816ddc0defff360c93e8a07019ac812dd1a42209ea7e95ba79b5a573" logic_hash = "4889a23c1f2780044b9fb2a0207676d57e82e6c1275614b684a5a9cbe984b761" score = 75 quality = 85 tags = "" strings: $apiLocator = { 48 [2] AC 41 [2] 0D 41 [2] 38 ?? 75 ?? 4C [4] 45 [2] 75 ?? 5? 44 [2] 24 49 [2] 66 [4] 44 [2] 1C 49 [2] 41 [3] 48 } $InternetSetOptionA = { BA 1F 00 00 00 6A 00 68 80 33 00 00 49 [2] 41 ?? 04 00 00 00 41 ?? 75 46 9E 86 } condition: $apiLocator and $InternetSetOptionA } rule GCTI_Cobaltstrike_Resources_Template_Py_V3_3_To_V4_X { meta: description = "Cobalt Strike's resources/template.py signature for versions v3.3 to v4.x" author = "gssincla@google.com" id = "16aef9a9-b217-5462-93dc-f6273c99ddd0" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_Py_v3_3_to_v4_x.yara#L17-L36" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "d5cb406bee013f51d876da44378c0a89b7b3b800d018527334ea0c5793ea4006" logic_hash = "3c26cea4b8f2b200bf58e939ae9ead7a7339d4ec0de8c72b3d9c7da897600081" score = 75 quality = 85 tags = "" strings: $arch = "platform.architecture()" $nope = "WindowsPE" $alloc = "ctypes.windll.kernel32.VirtualAlloc" $movemem = "ctypes.windll.kernel32.RtlMoveMemory" $thread = "ctypes.windll.kernel32.CreateThread" $wait = "ctypes.windll.kernel32.WaitForSingleObject" condition: all of them } rule GCTI_Cobaltstrike_Resources_Bind_Bin_V2_5_Through_V4_X { meta: description = "Cobalt Strike's resources/bind.bin signature for versions 2.5 to 4.x" author = "gssincla@google.com" id = "32f129c1-9845-5843-9e16-7d9af217b8e2" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bind_Bin_v2_5_through_v4_x.yara#L17-L111" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "3727542c0e3c2bf35cacc9e023d1b2d4a1e9e86ee5c62ee5b66184f46ca126d1" logic_hash = "cf04e257590cf0673059348f5c15926918eb8aee40e864ae65979360aca80013" score = 75 quality = 85 tags = "" strings: $apiLocator = { 31 ?? AC C1 ?? 0D 01 ?? 38 ?? 75 ?? 03 [2] 3B [2] 75 ?? 5? 8B ?? 24 01 ?? 66 8B [2] 8B ?? 1C 01 ?? 8B ?? 8B 01 ?? 89 [3] 5? 5? } $ws2_32 = { 5D 68 33 32 00 00 68 77 73 32 5F } $listenaccept = { 5? 5? 68 B7 E9 38 FF FF ?? 5? 5? 5? 68 74 EC 3B E1 } condition: $apiLocator and $ws2_32 and $listenaccept } rule GCTI_Cobaltstrike_Resources_Template_Sct_V3_3_To_V4_X { meta: description = "Cobalt Strike's resources/template.sct signature for versions v3.3 to v4.x" author = "gssincla@google.com" id = "9d2b1dfa-5f76-503f-9198-6ed0d039e0cb" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_Sct_v3_3_to_v4_x.yara#L17-L38" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "fc66cb120e7bc9209882620f5df7fdf45394c44ca71701a8662210cf3a40e142" logic_hash = "8868445ced4945c469764b7f311d6cb11c99cf0f2d770113e5e617e0187a962c" score = 75 quality = 85 tags = "" strings: $scriptletstart = "<scriptlet>" nocase $registration = "<registration progid=" nocase $classid = "classid=" nocase $scriptlang = "<script language=\"vbscript\">" nocase $cdata = "<![CDATA[" $scriptend = "</script>" nocase $antiregistration = "</registration>" nocase $scriptletend = "</scriptlet>" condition: all of them and @scriptletstart [ 1 ] < @registration [ 1 ] and @registration [ 1 ] < @classid [ 1 ] and @classid [ 1 ] < @scriptlang [ 1 ] and @scriptlang [ 1 ] < @cdata [ 1 ] } rule GCTI_Cobaltstrike_Resources_Covertvpn_Dll_V2_1_To_V4_X { meta: description = "Cobalt Strike's resources/covertvpn.dll signature for version v2.2 to v4.4" author = "gssincla@google.com" id = "a65b855c-5703-5b9f-bb57-da8ebf898f9b" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Covertvpn_Dll_v2_1_to_v4_x.yara#L17-L120" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "0a452a94d53e54b1df6ba02bc2f02e06d57153aad111171a94ec65c910d22dcf" logic_hash = "1f6e4254fdfd4f9b13c2000333aabbb7da90d2df7ee1b12faa6ea3c066351468" score = 75 quality = 85 tags = "" strings: $dropComponentsAndActivateDriver_prologue = { 5? 68 [4] 68 [4] C7 [3-5] 00 00 00 00 FF 15 [4] 50 FF 15 [4] 8B ?? 85 ?? 74 ?? 8D [3-5] 5? FF 15 [4] 50 } $dropFile = { 6A 00 5? E8 [4] 83 C4 08 83 F8 FF 74 ?? 5? [0-5] E8 [4] 83 C4 ?? [0-2] 6A 00 68 80 01 00 00 6A 02 6A 00 6A 05 68 00 00 00 40 5? FF 15 [4] 8B ?? 83 ?? FF 75 ?? FF 15 [4] 5? } $nfp = "npf.sys" nocase $wpcap = "wpcap.dll" nocase condition: all of them } rule GCTI_Cobaltstrike_Resources_Template_X86_Vba_V3_8_To_V4_X { meta: description = "Cobalt Strike's resources/template.x86.vba signature for versions v3.8 to v4.x" author = "gssincla@google.com" id = "11c7758e-93b2-5fe3-873d-b98de579d2b4" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_x86_Vba_v3_8_to_v4_x.yara#L17-L37" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "fc66cb120e7bc9209882620f5df7fdf45394c44ca71701a8662210cf3a40e142" logic_hash = "7114515477d82651806eccef34f599f6ffd4614f987dee29417ac6ef7a1a1c38" score = 75 quality = 85 tags = "" strings: $createstuff = "Function CreateStuff Lib \"kernel32\" Alias \"CreateRemoteThread\"" nocase $allocstuff = "Function AllocStuff Lib \"kernel32\" Alias \"VirtualAllocEx\"" nocase $writestuff = "Function WriteStuff Lib \"kernel32\" Alias \"WriteProcessMemory\"" nocase $runstuff = "Function RunStuff Lib \"kernel32\" Alias \"CreateProcessA\"" nocase $vars = "Dim rwxpage As Long" nocase $res = "RunStuff(sNull, sProc, ByVal 0&, ByVal 0&, ByVal 1&, ByVal 4&, ByVal 0&, sNull, sInfo, pInfo)" $rwxpage = "AllocStuff(pInfo.hProcess, 0, UBound(myArray), &H1000, &H40)" condition: all of them and @vars [ 1 ] < @res [ 1 ] and @allocstuff [ 1 ] < @rwxpage [ 1 ] } rule GCTI_Cobaltstrike_Resources_Bypassuac_Dll_V1_49_To_V3_14_And_Sleeve_Bypassuac_Dll_V4_0_To_V4_X { meta: description = "Cobalt Strike's resources/bypassuac(-x86).dll from v1.49 to v3.14 (32-bit version) and sleeve/bypassuac.dll from v4.0 to at least v4.4" author = "gssincla@google.com" id = "614046b5-cf81-56a5-8824-b3a7e14a8ed5" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuac_Dll_v1_49_to_v3_14_and_Sleeve_Bypassuac_Dll_v4_0_to_v4_x.yara#L17-L94" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "91d12e1d09a642feedee5da966e1c15a2c5aea90c79ac796e267053e466df365" logic_hash = "7d59c0286f1936e386519a919472d01581b68a8167c89bd3cd3108d45251119a" score = 75 quality = 85 tags = "" strings: $deleteFileCOM = { A1 [4] 6A 00 8B ?? 5? 5? FF ?? 48 85 ?? 75 ?? A1 [4] 5? 8B ?? FF ?? 54 } $copyFileCOM = { A1 [4] 6A 00 FF [2] 8B ?? FF [5] FF [5] 5? FF ?? 40 85 ?? [2 - 6] A1 [4] 5? 8B ?? FF ?? 54 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Elevate_Dll_V3_0_To_V3_14_And_Sleeve_Elevate_Dll_V4_X { meta: description = "Cobalt Strike's resources/elevate.dll signature for v3.0 to v3.14 and sleeve/elevate.dll for v4.x" author = "gssincla@google.com" id = "170f62a2-ba4f-5be8-9ec5-402eb7bbde4e" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Elevate_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_Dll_v4_x.yara#L17-L68" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "6deeb2cafe9eeefe5fc5077e63cc08310f895e9d5d492c88c4e567323077aa2f" logic_hash = "766a0a390ed8cefe43d82a054a9b2cfec7eced75e0d7ee10231215043577b75e" score = 75 quality = 85 tags = "" strings: $wnd_proc = { 6A 00 6A 28 68 00 01 00 00 5? C7 [5] 01 00 00 00 FF ?? 6A 00 6A 27 68 00 01 00 00 5? FF ?? 6A 00 6A 00 68 01 02 00 00 5? FF ?? } condition: $wnd_proc } rule GCTI_Cobaltstrike_Resources_Template_X64_Ps1_V3_0_To_V4_X_Excluding_3_12_3_13 { meta: description = "Cobalt Strike's resources/template.x64.ps1, resources/template.hint.x64.ps1 and resources/template.hint.x32.ps1 from v3.0 to v4.x except 3.12 and 3.13" author = "gssincla@google.com" id = "5a808113-aacb-56ca-b3ec-166c73c54b85" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_x64_Ps1_v3_0_to_v4_x_excluding_3_12_3_13.yara#L17-L37" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "ff743027a6bcc0fee02107236c1f5c96362eeb91f3a5a2e520a85294741ded87" logic_hash = "80823b8590004686ebd83958cad16094ea2f6958a837d87934507531a00df77a" score = 75 quality = 81 tags = "" strings: $dda = "[AppDomain]::CurrentDomain.DefineDynamicAssembly" nocase $imm = "InMemoryModule" nocase $mdt = "MyDelegateType" nocase $rd = "New-Object System.Reflection.AssemblyName('ReflectedDelegate')" nocase $data = "[Byte[]]$var_code = [System.Convert]::FromBase64String(" nocase $64bitSpecific = "[IntPtr]::size -eq 8" $mandatory = "Mandatory = $True" condition: all of them } rule GCTI_Cobaltstrike_Resources_Bind64_Bin_V2_5_Through_V4_X { meta: description = "Cobalt Strike's resources/bind64.bin signature for versions v2.5 to v4.x" author = "gssincla@google.com" id = "a01e7bc3-40e9-5f87-8fd6-926972be273b" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bind64_Bin_v2_5_through_v4_x.yara#L17-L109" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "5dd136f5674f66363ea6463fd315e06690d6cb10e3cc516f2d378df63382955d" logic_hash = "ba79abc5cfeaccb94699c0d85c16b2ddf6820bc148c0fd1c9b33c07222e36cb6" score = 75 quality = 85 tags = "" strings: $apiLocator = { 48 [2] AC 41 [2] 0D 41 [2] 38 ?? 75 ?? 4C [4] 45 [2] 75 ?? 5? 44 [2] 24 49 [2] 66 [4] 44 [2] 1C 49 [2] 41 [3] 48 } $calls = { 41 BA C2 DB 37 67 FF D5 48 [2] 48 [2] 41 BA B7 E9 38 FF FF D5 4D [2] 48 [2] 48 [2] 41 BA 74 EC 3B E1 FF D5 48 [2] 48 [2] 41 BA 75 6E 4D 61 } condition: $apiLocator and $calls } rule GCTI_Cobaltstrike_Resources_Bypassuac_X64_Dll_V3_3_To_V3_14_And_Sleeve_Bypassuac_X64_Dll_V4_0_And_V4_X { meta: description = "Cobalt Strike's resources/bypassuac-x64.dll from v3.3 to v3.14 (64-bit version) and sleeve/bypassuac.x64.dll from v4.0 to at least v4.4" author = "gssincla@google.com" id = "eef83901-63d9-55a3-b115-03f420416177" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuac_x64_Dll_v3_3_to_v3_14_and_Sleeve_Bypassuac_x64_Dll_v4_0_and_v4_x.yara#L17-L86" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "9ecf56e9099811c461d592c325c65c4f9f27d947cbdf3b8ef8a98a43e583aecb" logic_hash = "d76e3601f61ae164a8df9048d59d15cd6913e64adb93132244e83f40bf67d86a" score = 75 quality = 85 tags = "" strings: $deleteFileCOM = { 48 8B [5] 45 33 ?? 48 8B ?? FF 90 90 00 00 00 85 C0 75 ?? 48 8B [5] 48 8B ?? FF 92 A8 00 00 00 85 C0 } $copyFileCOM = { 48 8B [5] 4C 8B [5] 48 8B [5] 48 8B ?? 4C 8B ?? 48 89 [3] FF 90 80 00 00 00 85 C0 0F 85 [4] 48 8B [5] 48 8B 11 FF 92 A8 00 00 00 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Artifact32Svc_Exe_V3_1_V3_2_V3_14_And_V4_X { meta: description = "Cobalt Strike's resources/artifact32svc(big).exe signature for versions 3.1 and 3.2 (with overlap with v3.14 through v4.x)" author = "gssincla@google.com" id = "732169be-e334-5774-b0ac-54b217a8b681" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32svc_Exe_v1_49_to_v4_x.yara#L53-L77" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "871390255156ce35221478c7837c52d926dfd581173818620b738b4b029e6fd9" logic_hash = "b55211fc2dbe100edb19c3f3a000be513144e3556c4bce8a29a3c0b77451ba96" score = 75 quality = 85 tags = "" strings: $decoderFunc = { 89 ?? B? 04 00 00 00 99 F7 FF 8B [2] 8A [2] 30 } condition: $decoderFunc } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_44 { meta: description = "Cobalt Strike's resources/beacon.dll Version 1.44" author = "gssincla@google.com" id = "935ee27f-ce1b-5491-b4a3-cb78f199ab1b" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L17-L49" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "75102e8041c58768477f5f982500da7e03498643b6ece86194f4b3396215f9c2" logic_hash = "ebed8b6dc0b929164b1aa25b491b9d2fbb61d380a8b1268df7d424afe90f613d" score = 75 quality = 85 tags = "" strings: $version_sig = { 0F B7 D2 4A 53 8B D9 83 FA 04 77 36 FF 24 } $decode = { B1 ?? 30 88 [4] 40 3D 28 01 00 00 7C F2 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_45 { meta: description = "Cobalt Strike's resources/beacon.dll Version 1.45" author = "gssincla@google.com" id = "04d4d0ee-f1ee-5888-8108-ca55243c770a" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L51-L84" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "1a92b2024320f581232f2ba1e9a11bef082d5e9723429b3e4febb149458d1bb1" logic_hash = "b1472907e0fe0cb26219c268f23483681cc076dab96c1b0f2f0ee472ad319b4f" score = 75 quality = 85 tags = "" strings: $version_sig = { 51 0F B7 D2 4A 53 56 83 FA 08 77 6B FF 24 } $decode = { B1 ?? 30 88 [4] 40 3D 28 01 00 00 7C F2 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_46 { meta: description = "Cobalt Strike's resources/beacon.dll Version 1.46" author = "gssincla@google.com" id = "79715042-1963-5e48-8b64-7d915da58d84" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L86-L115" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "44e34f4024878024d4804246f57a2b819020c88ba7de160415be38cd6b5e2f76" logic_hash = "1a5c63c8b5527c0442830a73ded8458cf82a9d8ecb9b31e9a02c10b27ed6195e" score = 75 quality = 85 tags = "" strings: $version_sig = { 8B F2 83 F9 0C 0F 87 8E 00 00 00 FF 24 } $decode = { B1 ?? 30 88 [4] 40 3D A8 01 00 00 7C F2 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_47 { meta: description = "Cobalt Strike's resources/beacon.dll Version 1.47" author = "gssincla@google.com" id = "ac2249a9-210c-581f-8dd1-7619356dca7d" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L117-L144" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "8ff6dc80581804391183303bb39fca2a5aba5fe13d81886ab21dbd183d536c8d" logic_hash = "8c463d3122f3f79ff5d9b88e3d4f5ed14e6c581edfdfafba8a0c596c494ac1b1" score = 75 quality = 85 tags = "" strings: $version_sig = { 83 F8 12 77 10 FF 24 } $decode = { B1 ?? 30 88 [4] 40 3D A8 01 00 00 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_48 { meta: description = "Cobalt Strike's resources/beacon.dll Version 1.48" author = "gssincla@google.com" id = "dd15099f-ad19-58df-9ed4-ce66d7ee8540" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L146-L178" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "dd4e445572cd5e32d7e9cc121e8de337e6f19ff07547e3f2c6b7fce7eafd15e4" logic_hash = "3f789eaf334c9bb3236d2834f38156aa92b22a5b674450977086378d195dd216" score = 75 quality = 85 tags = "" strings: $version_sig = { 48 57 8B F1 8B DA 83 F8 17 77 12 FF 24 } $decode = { B1 ?? 30 88 [4] 40 3D A8 01 00 00 7C F2 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_49 { meta: description = "Cobalt Strike's resources/beacon.dll Version 1.49" author = "gssincla@google.com" id = "871e28c9-b580-5a32-8529-2290ded1a1b6" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L180-L211" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "52b4bd87e21ee0cbaaa0fc007fd3f894c5fc2c4bae5cbc2a37188de3c2c465fe" logic_hash = "935232d5ddccdc0401b4d911cdc73a48305347b495219c8c893615fe918f32f1" score = 75 quality = 85 tags = "" strings: $version_sig = { 48 56 83 F8 1E 0F 87 23 01 00 00 FF 24 } $decoder = { B1 ?? 90 30 88 [4] 40 3D A8 01 00 00 7C F2 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_0_49 { meta: description = "Cobalt Strike's resources/beacon.dll Version 2.0.49" author = "gssincla@google.com" id = "087c584a-5ceb-536a-8842-53fbd668df54" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L213-L243" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "ed08c1a21906e313f619adaa0a6e5eb8120cddd17d0084a30ada306f2aca3a4e" logic_hash = "3616579dabcfd0ba413d17b4fbd0da5313b9beca94f7bf8e41f05d6679b4a215" score = 75 quality = 85 tags = "" strings: $version_sig = { 83 F8 22 0F 87 96 01 00 00 FF 24 } $decoder = { B1 ?? EB 03 8D 49 00 30 88 [4] 40 3D 30 05 00 00 72 F2 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_1_And_V2_2 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 2.1 and 2.2" author = "gssincla@google.com" id = "384fb247-aae7-52e1-a45d-6bda0f80a04e" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L245-L276" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "ae7a1d12e98b8c9090abe19bcaddbde8db7b119c73f7b40e76cdebb2610afdc2" logic_hash = "eee3702d6fde08b8e9f5533f903fa33fb3da808a3b76ca43e4d5029f9ce91ad0" score = 75 quality = 85 tags = "" strings: $version_sig = { 49 56 57 83 F9 24 0F 87 8A 01 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_3 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 2.3" author = "gssincla@google.com" id = "aed092f1-fbb1-5efe-be8d-fb7c5aba1cde" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L278-L308" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "00dd982cb9b37f6effb1a5a057b6571e533aac5e9e9ee39a399bb3637775ff83" logic_hash = "286d7ffa83634b82160788abaf1c5b319a09c4a1243af2401799f327be76ad75" score = 75 quality = 85 tags = "" strings: $version_sig = { 49 56 57 83 F9 26 0F 87 A9 01 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_4 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 2.4" author = "gssincla@google.com" id = "347a6b06-84a8-53ff-80a1-05fa1a48a412" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L310-L340" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "78c6f3f2b80e6140c4038e9c2bcd523a1b205d27187e37dc039ede4cf560beed" logic_hash = "087ec6f585e90b84c00e746beb37cb8365cb7b4d07ebd0c48e3ba3d5df94dba2" score = 75 quality = 85 tags = "" strings: $version_sig = { 4A 56 57 83 FA 2F 0F 87 F9 01 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_5 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 2.5" author = "gssincla@google.com" id = "a89f9239-099c-5b97-b1df-e8ce2b95ea52" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L342-L372" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "d99693e3e521f42d19824955bef0cefb79b3a9dbf30f0d832180577674ee2b58" logic_hash = "f2d0ca1414a60bf855543d99777ae5e83c451db41aba5e255e4c10b1e0bb7b47" score = 75 quality = 85 tags = "" strings: $version_sig = { 48 57 8B F2 83 F8 3A 0F 87 6E 02 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_0 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 3.0" author = "gssincla@google.com" id = "132a1be8-f529-5141-ba03-fdf6df3d55d4" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L374-L404" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "30251f22df7f1be8bc75390a2f208b7514647835f07593f25e470342fd2e3f52" logic_hash = "951f1b52c14010261022f9f920d53d3c1e88f41461798a23e72083c981f9de76" score = 75 quality = 85 tags = "" strings: $version_sig = { 48 57 8B F2 83 F8 3C 0F 87 89 02 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_1 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 3.1" author = "gssincla@google.com" id = "aa511dee-69ea-53bd-be90-d2d03d08c550" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L406-L461" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "4de723e784ef4e1633bbbd65e7665adcfb03dd75505b2f17d358d5a40b7f35cf" logic_hash = "2d91add3aefe69b4525f93f7ea9f2fcbd7a6c506a224997ff73a2eeef63a8cd4" score = 75 quality = 85 tags = "" strings: $version_sig = { 55 8B EC 83 EC 58 A1 [4] 33 C5 89 45 FC E8 DF F5 FF FF 6A 50 8D 45 A8 50 FF 15 [4] 8D 45 ?? 50 FF 15 [4] 85 C0 74 14 8B 40 0C 83 38 00 74 0C 8B 00 FF 30 FF 15 [4] EB 05 B8 [4] 8B 4D FC 33 CD E8 82 B7 00 00 C9 } $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_2 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 3.2" author = "gssincla@google.com" id = "3ccbc0f2-241c-5c10-8930-4a3d264d3b57" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L463-L528" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "b490eeb95d150530b8e155da5d7ef778543836a03cb5c27767f1ae4265449a8d" logic_hash = "e1fe0d58d86ad8c845d65608314007ce08e3e524fb92cdb33ddae860c640e3e9" score = 75 quality = 85 tags = "" rs2 = "a93647c373f16d61c38ba6382901f468247f12ba8cbe56663abb2a11ff2a5144" strings: $version_sig = { 48 57 8B F2 83 F8 3D 0F 87 83 02 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 } $version3_1_sig = { 55 8B EC 83 EC 58 A1 [4] 33 C5 89 45 FC E8 DF F5 FF FF 6A 50 8D 45 A8 50 FF 15 [4] 8D 45 ?? 50 FF 15 [4] 85 C0 74 14 8B 40 0C 83 38 00 74 0C 8B 00 FF 30 FF 15 [4] EB 05 B8 [4] 8B 4D FC 33 CD E8 82 B7 00 00 C9 } condition: $version_sig and $decoder and not $version3_1_sig } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_3 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 3.3" author = "gssincla@google.com" id = "7cce26c9-1403-535f-bd9d-19667c7e313c" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L530-L560" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "158dba14099f847816e2fc22f254c60e09ac999b6c6e2ba6f90c6dd6d937bc42" logic_hash = "f9b9b669aacc156a4e07eab0c6a638f9b9d828e018d1db89e9e2c922641744ac" score = 75 quality = 85 tags = "" strings: $version_sig = { 48 57 8B F1 83 F8 41 0F 87 F0 02 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_4 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 3.4" author = "gssincla@google.com" id = "58a34ab6-c061-59a2-b929-8519d3d844e7" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L562-L592" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "5c40bfa04a957d68a095dd33431df883e3a075f5b7dea3e0be9834ce6d92daa3" logic_hash = "f3372bc538092e30c62d9599f76f2115dc73faf7a5fd6f86c8d4cfaa35473810" score = 75 quality = 85 tags = "" strings: $version_sig = { 48 57 8B F1 83 F8 42 0F 87 F0 02 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_5_Hf1_And_3_5_1 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 3.5-hf1 and 3.5.1 (3.5.x)" author = "gssincla@google.com" id = "1532596e-be0e-58c2-8d3b-5120c793d677" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L594-L625" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "c78e70cd74f4acda7d1d0bd85854ccacec79983565425e98c16a9871f1950525" logic_hash = "c2e975678815638803b04261d46bca216bc0b2f894a1f72fd0d5b949493401d1" score = 75 quality = 85 tags = "" strings: $version_sig = { 48 57 8B F1 83 F8 43 0F 87 07 03 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_6 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 3.6" author = "gssincla@google.com" id = "7e7b5c22-82b3-5298-b794-b06d94a668d5" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L627-L657" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "495a744d0a0b5f08479c53739d08bfbd1f3b9818d8a9cbc75e71fcda6c30207d" logic_hash = "3bd3f0b8625e131726fa92d68de041dae6c3d5642cbf22ac596d1d82da1d4a07" score = 75 quality = 85 tags = "" strings: $version_sig = { 48 57 8B F9 83 F8 47 0F 87 2F 03 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_7 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 3.7" author = "gssincla@google.com" id = "6352a31c-34b8-5886-8e34-ef9221c22e6e" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L659-L689" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "f18029e6b12158fb3993f4951dab2dc6e645bb805ae515d205a53a1ef41ca9b2" logic_hash = "6ceb2cec8402a4679bad42d367156c74e897af4188442fdebc70d6ce2dd78bd6" score = 75 quality = 85 tags = "" strings: $version_sig = { 48 57 8B F9 83 F8 49 0F 87 47 03 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_8 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 3.8" author = "gssincla@google.com" id = "f76712a4-df1c-5e6b-b5ac-9c74f2e202fc" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L691-L731" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "67b6557f614af118a4c409c992c0d9a0cc800025f77861ecf1f3bbc7c293d603" logic_hash = "a0c78dd7cda055bc76a8661b0416a302d7b05d03eeea483d2d1695093cd6dc90" score = 75 quality = 85 tags = "" strings: $version_sig = { 48 57 8B F9 83 F8 4B 0F 87 5D 03 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 } $xmrig_srcpath = "C:/Users/SKOL-NOTE/Desktop/Loader/script.go" $c2_1 = "ns7.softline.top" xor $c2_2 = "ns8.softline.top" xor $c2_3 = "ns9.softline.top" xor condition: $version_sig and $decoder and not ( 2 of ( $c2_* ) or $xmrig_srcpath ) } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_11 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 3.11" author = "gssincla@google.com" id = "00e42396-db81-5d43-90ee-5a97b379019e" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L739-L770" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "2428b93464585229fd234677627431cae09cfaeb1362fe4f648b8bee59d68f29" logic_hash = "24ca0a9c2249d1872a53dc228234bdc6803bdfe9e80847995e0951184a8d935c" score = 75 quality = 85 tags = "" strings: $version_sig = { 48 57 8B FA 83 F8 50 0F 87 11 03 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_11_Bugfix_And_V3_12 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 3.11-bugfix and 3.12" author = "gssincla@google.com" id = "08ff2a2f-97bd-5839-b414-d67fbf2cdb0f" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L772-L804" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "5912c96fffeabb2c5c5cdd4387cfbfafad5f2e995f310ace76ca3643b866e3aa" logic_hash = "566eb14f918ad422d5a273390263e63ac37b00cd10ac3561e038fb1a27f85d80" score = 75 quality = 85 tags = "" rs2 = "4476a93abe48b7481c7b13dc912090b9476a2cdf46a1c4287b253098e3523192" strings: $version_sig = { 48 57 8B FA 83 F8 50 0F 87 0D 03 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_13 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 3.13" author = "gssincla@google.com" id = "98dd32e6-9bb5-57b2-a5e5-1c74a0d1e6d3" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L806-L836" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "362119e3bce42e91cba662ea80f1a7957a5c2b1e92075a28352542f31ac46a0c" logic_hash = "adafac8692ad676b0168b3e829bc7948db72953b95c79d483ae1a05f1d4f9b2b" score = 75 quality = 85 tags = "" strings: $version_sig = { 4A 56 57 83 FA 5A 0F 87 2D 03 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_14 { meta: description = "Cobalt Strike's resources/beacon.dll Versions 3.14" author = "gssincla@google.com" id = "00edfc72-c7b8-5100-8275-ae3548b96e49" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L838-L866" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "254c68a92a7108e8c411c7b5b87a2f14654cd9f1324b344f036f6d3b6c7accda" logic_hash = "6faed2b69647b87d86d46ae73ad92cfe7b2746c306cd7480dc9f0c484c8882e2" score = 75 quality = 85 tags = "" rs2 = "87b3eb55a346b52fb42b140c03ac93fc82f5a7f80697801d3f05aea1ad236730" strings: $version_sig = { 83 FA 5B 77 15 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_0_Suspected { meta: description = "Cobalt Strike's sleeve/beacon.dll Versions 4.0 (suspected, not confirmed)" author = "gssincla@google.com" id = "50ff6e44-ebc0-5000-a816-b385a6675768" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L868-L901" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "e2b2b72454776531bbc6a4a5dd579404250901557f887a6bccaee287ac71b248" logic_hash = "6875099bc6df26f829f9f64e70bd7fdac6ac7b83a5596fc9359c127fef4e6db5" score = 75 quality = 85 tags = "" strings: $version_sig = { 51 4A 56 57 83 FA 62 0F 87 8F 03 00 00 FF 24 95 56 7B 00 10 } $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_1_And_V4_2 { meta: description = "Cobalt Strike's sleeve/beacon.dll Versions 4.1 and 4.2" author = "gssincla@google.com" id = "793df916-bdf7-5743-b008-0113caf38bae" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L903-L934" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "daa42f4380cccf8729129768f3588bb98e4833b0c40ad0620bb575b5674d5fc3" logic_hash = "7280a5c3f478ea40b6b72fb4669d5b8c21603e7fbfbc3815a83bc462ee19c0f5" score = 75 quality = 85 tags = "" rs2 = "9de55f27224a4ddb6b2643224a5da9478999c7b2dea3a3d6b3e1808148012bcf" strings: $version_sig = { 48 57 8B F2 83 F8 63 0F 87 3C 03 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_3_V4_4_V4_5_And_V4_6 { meta: description = "Cobalt Strike's sleeve/beacon.dll Versions 4.3 and 4.4" author = "gssincla@google.com" id = "976e087c-f371-5fc6-85f8-9c803a91f549" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L936-L967" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "51490c01c72c821f476727c26fbbc85bdbc41464f95b28cdc577e5701790845f" logic_hash = "6608a84c4fd3bf77fd5b426da8be250d8b99878bd746fa23789f4791a164ce33" score = 75 quality = 85 tags = "" rs2 = "78a6fbefa677eeee29d1af4a294ee57319221b329a2fe254442f5708858b37dc" strings: $version_sig = { 48 57 8B F2 83 F8 65 0F 87 47 03 00 00 FF 24 } $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_7_Suspected { meta: description = "Cobalt Strike's sleeve/beacon.dll Versions 4.7 (suspected, not confirmed)" author = "gssincla@google.com" id = "4b6f90dd-69f3-5555-9195-6a0aed0fff58" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L969-L1002" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "da9e91b3d8df3d53425dd298778782be3bdcda40037bd5c92928395153160549" logic_hash = "297ff7c3acfe6f9676dc6c265c548f017f39ccc5217617344e3bccc704ac4c78" score = 75 quality = 85 tags = "" strings: $version_sig = { 53 56 48 57 8B F2 83 F8 67 0F 87 5E 03 00 00 } $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_2 { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.2" author = "gssincla@google.com" id = "61188243-0b90-5bff-bcc8-50f10ed941f6" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1029-L1068" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "5993a027f301f37f3236551e6ded520e96872723a91042bfc54775dcb34c94a1" logic_hash = "3803aaac537aec0b188870177e510a3789a71c19be576569b59aa146b2ba62c5" score = 75 quality = 85 tags = "" strings: $version_sig = { 4C 8D 05 9F F8 FF FF 8B D3 48 8B CF E8 05 1A 00 00 EB 0A 8B D3 48 8B CF E8 41 21 00 00 48 8B 5C 24 30 48 83 C4 20 } $decoder = { 80 31 ?? FF C2 48 FF C1 48 63 C2 48 3D 10 06 00 00 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_3 { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.3" author = "gssincla@google.com" id = "fb96ecff-809e-5704-974e-a2d8ef022daa" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1070-L1109" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "7b00721efeff6ed94ab108477d57b03022692e288cc5814feb5e9d83e3788580" logic_hash = "514d491b8066ed7127ebb152a27efbe65e1121da3b5460afe6987920a91f2863" score = 75 quality = 85 tags = "" strings: $version_sig = { 8B D3 48 8B CF E8 89 66 00 00 E9 23 FB FF FF 41 B8 01 00 00 00 E9 F3 FD FF FF 48 8D 0D 2A F8 FF FF E8 8D 2B 00 00 48 8B 5C 24 30 48 83 C4 20 } $decoder = { 80 31 ?? FF C2 48 FF C1 48 63 C2 48 3D 10 06 00 00 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_4 { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.4" author = "gssincla@google.com" id = "97ef152c-86c7-513c-a881-e7d594d38dcf" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1111-L1148" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "5a4d48c2eda8cda79dc130f8306699c8203e026533ce5691bf90363473733bf0" logic_hash = "65aa42265133038f6f568c021c0228440e84e236829af50796a73f6923f46395" score = 75 quality = 85 tags = "" strings: $version_sig = { 8B D3 48 8B CF E8 56 6F 00 00 E9 17 FB FF FF 41 B8 01 00 00 00 8B D3 48 8B CF E8 41 4D 00 00 48 8B 5C 24 30 48 83 C4 20 } $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_5_Hf1_And_V3_5_1 { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.5-hf1 and 3.5.1" author = "gssincla@google.com" id = "0c0e87d3-e0e2-5ddc-9d89-5e56443da4b8" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1150-L1189" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "934134ab0ee65ec76ae98a9bb9ad0e9571d80f4bf1eb3491d58bacf06d42dc8d" logic_hash = "5cd69554edb91956f4ec4c3c5e55f4cd9c3665656c318220ba3a270c0bb0a690" score = 75 quality = 85 tags = "" strings: $version_sig = { 8B D3 48 8B CF E8 38 70 00 00 E9 FD FA FF FF 41 B8 01 00 00 00 8B D3 48 8B CF E8 3F 4D 00 00 48 8B 5C 24 30 48 83 C4 20 5F } $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_6 { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.6" author = "gssincla@google.com" id = "9651a1ca-d8ea-5b0b-bcba-a850c2e07791" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1191-L1233" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "92b0a4aec6a493bcb1b72ce04dd477fd1af5effa0b88a9d8283f26266bb019a1" logic_hash = "d6aff186a01386992f004cb775d280f9b6e7e16d7ecee662d61e3485b0bc088b" score = 75 quality = 85 tags = "" strings: $version_sig = { 48 89 5C 24 08 57 48 83 EC 20 41 8B D8 48 8B FA 83 F9 27 0F 87 47 03 00 00 0F 84 30 03 00 00 83 F9 14 0F 87 A4 01 00 00 0F 84 7A 01 00 00 83 F9 0C 0F 87 C8 00 00 00 0F 84 B3 00 00 00 } $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_7 { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.7" author = "gssincla@google.com" id = "27fad98a-2882-5c52-af6e-c7dcf5559624" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1235-L1274" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "81296a65a24c0f6f22208b0d29e7bb803569746ce562e2fa0d623183a8bcca60" logic_hash = "89499e01acd607b2fbcdd134c74ca4a901c00c7c9cf70dd241cc538c1c0d083a" score = 75 quality = 85 tags = "" strings: $version_sig = { 48 89 5C 24 08 57 48 83 EC 20 41 8B D8 48 8B FA 83 F9 28 0F 87 7F 03 00 00 0F 84 67 03 00 00 83 F9 15 0F 87 DB 01 00 00 0F 84 BF 01 00 00 } $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_8 { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.8" author = "gssincla@google.com" id = "89809d81-9a8b-5cf3-a251-689bf52e98e0" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1276-L1310" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "547d44669dba97a32cb9e95cfb8d3cd278e00599e6a11080df1a9d09226f33ae" logic_hash = "8845b71ce4401fd194eb88f04dbf1f313af8b4853da004e63261ca3158fcb1d4" score = 75 quality = 85 tags = "" strings: $version_sig = { 8B D3 48 8B CF E8 7A 52 00 00 EB 0D 45 33 C0 8B D3 48 8B CF E8 8F 55 00 00 } $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_11 { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.11 (two subversions)" author = "gssincla@google.com" id = "bf0c7661-2583-5fca-beb5-abb2b50c860d" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1312-L1366" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "64007e104dddb6b5d5153399d850f1e1f1720d222bed19a26d0b1c500a675b1a" logic_hash = "9c34b23b659463a0ab92949031a9b3246aa95256d1548b2f0ad53fe3d379997d" score = 75 quality = 85 tags = "" rs2 = "815f313e0835e7fdf4a6d93f2774cf642012fd21ce870c48ff489555012e0047" strings: $version_sig = { 48 83 EC 20 41 8B D8 48 8B FA 83 F9 2D 0F 87 B2 03 00 00 0F 84 90 03 00 00 83 F9 17 0F 87 F8 01 00 00 0F 84 DC 01 00 00 83 F9 0E 0F 87 F9 00 00 00 0F 84 DD 00 00 00 FF C9 0F 84 C0 00 00 00 83 E9 02 0F 84 A6 00 00 00 FF C9 } $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_12 { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.12" author = "gssincla@google.com" id = "6eeae9f4-96e0-5a98-a8dc-779c916cd968" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1368-L1404" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "8a28b7a7e32ace2c52c582d0076939d4f10f41f4e5fa82551e7cc8bdbcd77ebc" logic_hash = "7457b20f2a7dc7e8c3317cedbcfccae30ecc8dc164188c0321f9485fdfab0f6e" score = 75 quality = 85 tags = "" strings: $version_sig = { 8B D3 48 8B CF E8 F8 2E 00 00 EB 16 8B D3 48 8B CF E8 00 5C 00 00 EB 0A 8B D3 48 8B CF E8 64 4F 00 00 } $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_13 { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.13" author = "gssincla@google.com" id = "202eb8ea-7afb-515b-9306-67514abf5e55" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1407-L1440" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "945e10dcd57ba23763481981c6035e0d0427f1d3ba71e75decd94b93f050538e" logic_hash = "81571a6c30802430d0df9980e005736d58464bde98c0889b48bf8d0c7e88d247" score = 75 quality = 85 tags = "" strings: $version_sig = { 48 8D 0D 01 5B FF FF 48 83 C4 28 E9 A8 54 FF FF 8B D0 49 8B CA E8 22 55 FF FF } $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_14 { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.14" author = "gssincla@google.com" id = "d69171e3-86f4-5187-8874-5eee2045f746" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1442-L1477" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "297a8658aaa4a76599a7b79cb0da5b8aa573dd26c9e2c8f071e591200cf30c93" logic_hash = "87cf465154d4294eeda9cf99c6c160da80cfa8a65244bc083737c0c87163431d" score = 75 quality = 85 tags = "" rs2 = "39b9040e3dcd1421a36e02df78fe031cbdd2fb1a9083260b8aedea7c2bc406bf" strings: $version_sig = { 8B D0 49 8B CA 48 83 C4 28 E9 B1 1F 00 00 8B D0 49 8B CA 48 83 C4 28 } $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_X86_V4_0_Suspected { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.0 (suspected, not confirmed)" author = "gssincla@google.com" id = "28a735c4-87d1-5e14-9379-46a6fd0cdd2a" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1480-L1515" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "55aa2b534fcedc92bb3da54827d0daaa23ece0f02a10eb08f5b5247caaa63a73" logic_hash = "0dbf6a75dc74f4c2a7604072a01e2dbaaee15f5e57c765f24138d85c248fb305" score = 75 quality = 85 tags = "" strings: $version_sig = { 41 B8 01 00 00 00 8B D0 49 8B CA 48 83 C4 28 E9 D1 B3 FF FF 8B D0 49 8B CA 48 83 C4 28 E9 AF F5 FF FF 45 33 C0 4C 8D 0D 8D 70 FF FF 8B D0 49 8B CA E8 9B B0 FF FF } $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_1_And_V_4_2 { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.1 and 4.2" author = "gssincla@google.com" id = "dc320d17-98fc-5df3-ba05-4d134129317e" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1517-L1553" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "29ec171300e8d2dad2e1ca2b77912caf0d5f9d1b633a81bb6534acb20a1574b2" logic_hash = "9b262ec18f79ab5ae63ad26d3685af088b5feb2d66de6ad3ba584cafbe2ee221" score = 75 quality = 85 tags = "" strings: $version_sig = { 83 F9 34 0F 87 8E 03 00 00 0F 84 7A 03 00 00 83 F9 1C 0F 87 E6 01 00 00 0F 84 D7 01 00 00 83 F9 0E 0F 87 E9 00 00 00 0F 84 CE 00 00 00 FF C9 0F 84 B8 00 00 00 83 E9 02 0F 84 9F 00 00 00 FF C9 } $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_3 { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Version 4.3" author = "gssincla@google.com" id = "572616c7-d1ec-5aa1-b142-4f2edf73737f" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1555-L1590" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "3ac9c3525caa29981775bddec43d686c0e855271f23731c376ba48761c27fa3d" logic_hash = "0c8934e997583339145749a3167ac010d8c77b2ed878d2c999de68ec2a98101d" score = 75 quality = 85 tags = "" strings: $version_sig = { 8B D0 49 8B CA 48 83 C4 28 E9 D3 88 FF FF 4C 8D 05 84 6E FF FF 8B D0 49 8B CA 48 83 C4 28 } $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_4_V_4_5_And_V4_6 { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.4 through at least 4.6" author = "gssincla@google.com" id = "79b6bfd4-1e45-5bd9-ac5c-19eb176ce698" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1593-L1628" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "3280fec57b7ca94fd2bdb5a4ea1c7e648f565ac077152c5a81469030ccf6ab44" logic_hash = "be0bbf58a176f8089924b3ce58268d906f49dde51d863524971e46f4bada43a3" score = 75 quality = 85 tags = "" strings: $version_sig = { 8B D0 49 8B CA 48 83 C4 28 E9 83 88 FF FF 4C 8D 05 A4 6D FF FF 8B D0 49 8B CA 48 83 C4 28 } $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_5_Variant { meta: description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.5 (variant)" author = "gssincla@google.com" id = "45715da9-8f16-5304-b216-1ca36c508c77" date = "2022-11-18" modified = "2023-12-04" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1630-L1665" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "8f0da7a45945b630cd0dfb5661036e365dcdccd085bc6cff2abeec6f4c9f1035" logic_hash = "31a108168489a24d1bc297d722741f3fd19abd1bed4c76d54967c73986d18123" score = 75 quality = 85 tags = "" strings: $version_sig = { 41 B8 01 00 00 00 8B D0 49 8B CA 48 83 C4 28 E9 E8 AB FF FF 8B D0 49 8B CA E8 1A EB FF FF 48 83 C4 28 } $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 } condition: all of them } rule GCTI_Cobaltstrike__Resources_Browserpivot_Bin_V1_48_To_V3_14_And_Sleeve_Browserpivot_Dll_V4_0_To_V4_X { meta: description = "Cobalt Strike's resources/browserpivot.bin from v1.48 to v3.14 and sleeve/browserpivot.dll from v4.0 to at least v4.4" author = "gssincla@google.com" id = "55086544-6684-526b-914f-505a562be458" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Browserpivot_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_Dll_v4_0_to_v4_x.yara#L17-L60" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "12af9f5a7e9bfc49c82a33d38437e2f3f601639afbcdc9be264d3a8d84fd5539" logic_hash = "416554d31c105fd96aeaef508847efe2889590909c8d0025e3862e5b24078131" score = 75 quality = 85 tags = "" strings: $socket_recv = { FF [1-5] 83 ?? FF 74 ?? 85 C0 (74 | 76) ?? 03 ?? 83 ?? 02 72 ?? 80 ?? 3E FF 0A 75 ?? 80 ?? 3E FE 0D } $fmt = "%1024[^ ] %8[^:]://%1016[^/]%7168[^ ] %1024[^ ]" condition: all of them } rule GCTI_Cobaltstrike_Resources__Template_Vbs_V3_3_To_V4_X { meta: description = "Cobalt Strike's resources/btemplate.vbs signature for versions v3.3 to v4.x" author = "gssincla@google.com" id = "62f35d02-1e4e-5651-b575-888ce06b8bdd" date = "2022-11-18" modified = "2022-11-22" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_Vbs_v3_3_to_v4_x.yara#L17-L41" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "e0683f953062e63b2aabad7bc6d76a78748504b114329ef8e2ece808b3294135" logic_hash = "c9df0e287eb0eacf7c6cfcf3f6d1043ae6f2fdacd3b22bd42ac71f4b0d7226ff" score = 75 quality = 83 tags = "" strings: $ea = "Excel.Application" nocase $vis = "Visible = False" nocase $wsc = "Wscript.Shell" nocase $regkey1 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" nocase $regkey2 = "\\Excel\\Security\\AccessVBOM" nocase $regwrite = ".RegWrite" nocase $dw = "REG_DWORD" $code = ".CodeModule.AddFromString" $ao = { 41 75 74 6f 5f 4f 70 65 6e } $da = ".DisplayAlerts" condition: all of them } rule GCTI_Cobaltstrike_Resources_Command_Ps1_V2_5_To_V3_7_And_Resources_Compress_Ps1_V3_8_To_V4_X { meta: description = "Cobalt Strike's resources/command.ps1 for versions 2.5 to v3.7 and resources/compress.ps1 from v3.8 to v4.x" author = "gssincla@google.com" id = "c0b81deb-ed20-5f7e-8e15-e6a9e9362594" date = "2022-11-18" modified = "2022-11-22" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Command_Ps1_v2_5_to_v3_7_and_Resources_Compress_Ps1_v3_8_to_v4_x.yara#L17-L33" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "932dec24b3863584b43caf9bb5d0cfbd7ed1969767d3061a7abdc05d3239ed62" logic_hash = "31cf47060757b086d325cd205724a7be8931bbbc6ff2f4be67a6179ee99c42ca" score = 75 quality = 85 tags = "" strings: $ps1 = "$s=New-Object \x49O.MemoryStream(,[Convert]::\x46romBase64String(" nocase $ps2 = "));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();" nocase condition: all of them } rule GCTI_Cobaltstrike_Resources_Httpsstager_Bin_V2_5_Through_V4_X { meta: description = "Cobalt Strike's resources/httpsstager.bin signature for versions 2.5 to 4.x" author = "gssincla@google.com" id = "f45aa40a-3936-50f9-a60e-de7181862d19" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpsstager_Bin_v2_5_through_v4_x.yara#L17-L95" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "5ebe813a4c899b037ac0ee0962a439833964a7459b7a70f275ac73ea475705b3" logic_hash = "d2f722809a59faf8ecd85e46eadf58bf23ba5f515ad9c949843f1e6bfeec1fbf" score = 75 quality = 85 tags = "" strings: $apiLocator = { 31 ?? AC C1 ?? 0D 01 ?? 38 ?? 75 ?? 03 [2] 3B [2] 75 ?? 5? 8B ?? 24 01 ?? 66 8B [2] 8B ?? 1C 01 ?? 8B ?? 8B 01 ?? 89 [3] 5? 5? } $InternetSetOptionA = { 6A 04 5? 6A 1F 5? 68 75 46 9E 86 FF } condition: $apiLocator and $InternetSetOptionA } rule GCTI_Cobaltstrike_Resources_Artifact64_V1_49_V2_X_V3_0_V3_3_Thru_V3_14 { meta: description = "Cobalt Strike's resources/artifact64{.dll,.exe,big.exe,big.dll,bigsvc.exe,big.x64.dll} and resources/rtifactuac(alt)64.dll signature for versions v1.49, v2.x, v3.0, and v3.3 through v3.14" author = "gssincla@google.com" id = "67902782-500e-5a89-8b2a-59ee21bcba3e" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact64_v1_49_to_v4_x.yara#L17-L54" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "9ec57d306764517b5956b49d34a3a87d4a6b26a2bb3d0fdb993d055e0cc9920d" logic_hash = "289950e89fc743ff4a1b7dcb91c561c7d829cfe3ade1c2f1a09f2e9701cce461" score = 75 quality = 85 tags = "" strings: $a = { 8B [2] 48 98 48 [2] 48 [3] 8B [2] 48 98 48 [3] 44 [3] 8B [2] 89 ?? C1 ?? 1F C1 ?? 1E 01 ?? 83 ?? 03 29 ?? 48 98 48 [3] 0F B6 00 44 [2] 88 } condition: $a } rule GCTI_Cobaltstrike_Resources_Artifact64_V3_1_V3_2_V3_14_And_V4_0 { meta: description = "Cobalt Strike's resources/artifact64{svcbig.exe,.dll,big.dll,svc.exe} and resources/artifactuac(big)64.dll signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x" author = "gssincla@google.com" id = "c9e9b8e0-16fe-5abc-b1fe-0e3e586f6db6" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact64_v1_49_to_v4_x.yara#L56-L84" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "2e7a39bd6ac270f8f548855b97c4cef2c2ce7f54c54dd4d1aa0efabeecf3ba90" logic_hash = "e5af04baa1d18d5a2a2c005b40bf93fe6a7b2d7116dfcf3c5b3fa36657448eb9" score = 75 quality = 85 tags = "" strings: $decoderFunction = { 31 ?? EB 0F 41 [2] 03 47 [3] 44 [3] 48 [2] 39 ?? 41 [2] 7C EA 4C [6] E9 } condition: $decoderFunction } rule GCTI_Cobaltstrike_Resources_Artifact64_V3_14_To_V4_X { meta: description = "Cobalt Strike's resources/artifact64{.exe,.dll,svc.exe,svcbig.exe,big.exe,big.dll,.x64.dll,big.x64.dll} and resource/artifactuac(alt)64.exe signature for versions v3.14 through v4.x" author = "gssincla@google.com" id = "1c7731d3-429b-57aa-9c17-8de7d0841b1e" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact64_v1_49_to_v4_x.yara#L86-L128" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "decfcca0018f2cec4a200ea057c804bb357300a67c6393b097d52881527b1c44" logic_hash = "af8ba6ba62bf1179510b0940e60f893f61b3ba10c81001dd90fe4c3521e56a37" score = 75 quality = 85 tags = "" strings: $fmtBuilder = { 41 ?? 5C 00 00 00 C7 [3] 5C 00 00 00 C7 [3] 65 00 00 00 C7 [3] 70 00 00 00 C7 [3] 69 00 00 00 C7 [3] 70 00 00 00 C7 [3] 5C 00 00 00 C7 [3] 2E 00 00 00 89 [3] 48 [6] E8 } $fmtString = "%c%c%c%c%c%c%c%c%cMSSE-%d-server" condition: all of them } rule GCTI_Cobaltstrike_Resources_Xor_Bin_V2_X_To_V4_X { meta: description = "Cobalt Strike's resource/xor.bin signature for version 2.x through 4.x" author = "gssincla@google.com" id = "1754746c-3a42-5f7d-808a-ba2e1c0a270e" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Xor_Bin__32bit_v2_x_to_4_x.yara#L17-L36" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "211ccc5d28b480760ec997ed88ab2fbc5c19420a3d34c1df7991e65642638a6f" logic_hash = "ad662a263ede6c3ba964baf8abe4848ed1e994f2c236d4315cb60c1d51442620" score = 75 quality = 85 tags = "" strings: $stub52 = {fc e8 ?? ?? ?? ?? [1-32] eb 27 5? 8b ?? 83 c? ?4 8b ?? 31 ?? 83 c? ?4 5? 8b ?? 31 ?? 89 ?? 31 ?? 83 c? ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb ea 5? ff e? e8 d4 ff ff ff} $stub56 = {fc e8 ?? ?? ?? ?? [1-32] eb 2b 5d 8b ?? ?? 83 c5 ?4 8b ?? ?? 31 ?? 83 c5 ?4 55 8b ?? ?? 31 ?? 89 ?? ?? 31 ?? 83 c5 ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb e8 5? ff e? e8 d? ff ff ff} condition: any of them } rule GCTI_Cobaltstrike_Resources_Smbstager_Bin_V2_5_Through_V4_X { meta: description = "Cobalt Strike's resources/smbstager.bin signature for versions 2.5 to 4.x" author = "gssincla@google.com" id = "074b7d83-e3d8-541c-804b-2417c21f54d5" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Smbstager_Bin_v2_5_through_v4_x.yara#L17-L95" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "946af5a23e5403ea1caccb2e0988ec1526b375a3e919189f16491eeabc3e7d8c" logic_hash = "b0f6535069df16a64de44ca0638ec060c1ff264a7820c94710d61ca7e8474450" score = 75 quality = 85 tags = "" strings: $apiLocator = { 31 ?? AC C1 ?? 0D 01 ?? 38 ?? 75 ?? 03 [2] 3B [2] 75 ?? 5? 8B ?? 24 01 ?? 66 8B [2] 8B ?? 1C 01 ?? 8B ?? 8B 01 ?? 89 [3] 5? 5? } $smb = { 68 C6 96 87 52 } $smbstart = { 6A 40 68 00 10 00 00 68 FF FF 07 00 6A 00 68 58 A4 53 E5 } condition: $apiLocator and $smb and $smbstart } rule GCTI_Cobaltstrike_Resources_Template__X32_X64_Ps1_V1_45_To_V2_5_And_V3_11_To_V3_14 { meta: description = "Cobalt Strike's resources/template.x64.ps1, resources/template.x32 from v3.11 to v3.14 and resources/template.ps1 from v1.45 to v2.5 " author = "gssincla@google.com" id = "c9fa6a39-0098-5dde-9762-94bc6b2df299" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template__x32_x64_Ps1_v1_45_to_v2_5_and_v3_11_to_v3_14.yara#L17-L43" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "ff743027a6bcc0fee02107236c1f5c96362eeb91f3a5a2e520a85294741ded87" logic_hash = "5196f111f257239d2e7e4ca342e7fc8bac1687743bc8c7ff23addf1f094b2e93" score = 75 quality = 85 tags = "" strings: $importVA = "[DllImport(\"kernel32.dll\")] public static extern IntPtr VirtualAlloc" nocase $importCT = "[DllImport(\"kernel32.dll\")] public static extern IntPtr CreateThread" nocase $importWFSO = "[DllImport(\"kernel32.dll\")] public static extern int WaitForSingleObject" nocase $compiler = "New-Object Microsoft.CSharp.CSharpCodeProvider" nocase $params = "New-Object System.CodeDom.Compiler.CompilerParameters" nocase $paramsSys32 = ".ReferencedAssemblies.AddRange(@(\"System.dll\", [PsObject].Assembly.Location))" nocase $paramsGIM = ".GenerateInMemory = $True" nocase $result = "$compiler.CompileAssemblyFromSource($params, $assembly)" nocase condition: all of them } rule GCTI_Cobaltstrike_Resources_Elevate_X64_Dll_V3_0_To_V3_14_And_Sleeve_Elevate_X64_Dll_V4_X { meta: description = "Cobalt Strike's resources/elevate.x64.dll signature for v3.0 to v3.14 and sleeve/elevate.x64.dll for v4.x" author = "gssincla@google.com" id = "91d5c343-1084-5cfc-9dfa-46f530eb9625" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Elevate_X64_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_X64_Dll_v4_x.yara#L17-L71" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "c3ee8a9181fed39cec3bd645b32b611ce98d2e84c5a9eff31a8acfd9c26410ec" logic_hash = "6f23bcf6a0c360d2f83140ce633440b13d8b691e75c5560c65656cf8a6114224" score = 75 quality = 85 tags = "" strings: $wnd_proc = { 81 ?? 21 01 00 00 75 ?? 83 [5] 00 75 ?? 45 33 ?? 8D [2] C7 [5] 01 00 00 00 45 [2] 28 FF 15 [4] 45 33 ?? 8D [2] 45 [2] 27 48 [2] FF 15 [4] 45 33 ?? 45 33 ?? BA 01 02 00 00 48 } condition: $wnd_proc } rule GCTI_Cobaltstrike_Resources_Covertvpn_Injector_Exe_V1_44_To_V2_0_49 { meta: description = "Cobalt Strike's resources/covertvpn-injector.exe signature for version v1.44 to v2.0.49" author = "gssincla@google.com" id = "48485ae2-1d99-5fa8-b8e8-0047e92ef447" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Covertvpn_injector_Exe_v1_44_to_v2_0_49.yara#L17-L116" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "d741751520f46602f5a57d1ed49feaa5789115aeeba7fa4fc7cbb534ee335462" logic_hash = "119602efe6243d8c0dc7b8f4468eb9b3be292620920f69dc8a560f900ac7f622" score = 75 quality = 85 tags = "" strings: $dropComponentsAndActivateDriver_prologue = { C7 04 24 [4] E8 [4] 83 EC 04 C7 44 24 04 [4] 89 04 24 E8 59 14 00 00 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? E8 [4] 8D [2] 89 [3] 89 04 24 } $dropFile = { C7 44 24 04 00 00 00 00 8B [2] 89 ?? 24 E8 [4] 83 F8 FF 74 ?? 8B [2] 89 ?? 24 04 C7 04 24 [4] E8 [4] E9 [4] C7 44 24 18 00 00 00 00 C7 44 24 14 80 01 00 00 C7 44 24 10 02 00 00 00 C7 44 24 0C 00 00 00 00 C7 44 24 08 05 00 00 00 C7 44 24 04 00 00 00 40 8B [2] 89 04 24 E8 [4] 83 EC 1C 89 45 ?? } $nfp = "npf.sys" nocase $wpcap = "wpcap.dll" nocase condition: all of them } rule GCTI_Cobaltstrike_Resources_Bypassuactoken_Dll_V3_11_To_V3_14 { meta: description = "Cobalt Strike's resources/bypassuactoken.dll from v3.11 to v3.14 (32-bit version)" author = "gssincla@google.com" id = "b9f25fa5-bd1d-5ba0-9b1d-bb97e1dbf76b" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuactoken_Dll_v3_11_to_v3_14.yara#L17-L151" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "df1c7256dfd78506e38c64c54c0645b6a56fc56b2ffad8c553b0f770c5683070" logic_hash = "fe0780b7f4c16b55cfa00ea7de4da8ce349ec8a72de763b72e816ebc8e934b6d" score = 75 quality = 85 tags = "" strings: $isHighIntegrityProcess = { 5? 5? 5? 8B ?? 6A 19 5? FF 15 [4] 85 C0 75 ?? FF 15 [4] 83 ?? 7A 75 ?? FF [2] 5? FF 15 [4] 8B ?? 8D [2] 5? FF [2] 5? 6A 19 5? FF 15 [4] 85 C0 74 ?? FF ?? FF 15 [4] 8A ?? FE C8 0F B6 C0 5? FF ?? FF 15 [4] B? 01 00 00 00 5? 81 ?? 00 30 00 00 } $executeTaskmgr = { 6A 3C 8D ?? C4 8B ?? 6A 00 5? 8B ?? E8 [4] 83 C4 0C C7 [2] 3C 00 00 00 8D [2] C7 [2] 40 00 00 00 C7 [6] C7 [2] 00 00 00 00 5? C7 [2] 00 00 00 00 C7 [6] C7 [2] 00 00 00 00 FF 15 [4] FF 75 FC } condition: all of them } rule GCTI_Cobaltstrike_Resources_Dnsstager_Bin_V1_47_Through_V4_X { meta: description = "Cobalt Strike's resources/dnsstager.bin signature for versions 1.47 to 4.x" author = "gssincla@google.com" id = "e1b0e368-9bcf-5d9b-b2b3-8414742f213e" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Dnsstager_Bin_v1_47_through_v4_x.yara#L17-L78" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "10f946b88486b690305b87c14c244d7bc741015c3fef1c4625fa7f64917897f1" logic_hash = "d4500d8a83a821e1df9e808b17a87c1207d78ea0e03886544a632176fe93ccd0" score = 75 quality = 83 tags = "" strings: $apiLocator = { 31 ?? AC C1 ?? 0D 01 ?? 38 ?? 75 ?? 03 [2] 3B [2] 75 ?? 5? 8B ?? 24 01 ?? 66 8B [2] 8B ?? 1C 01 ?? 8B ?? 8B 01 ?? 89 [3] 5? 5? } $dnsapi = { 68 64 6E 73 61 } condition: $apiLocator and $dnsapi } rule GCTI_Cobaltstrike_Resources_Reverse64_Bin_V2_5_Through_V4_X { meta: description = "Cobalt Strike's resources/reverse64.bin signature for versions v2.5 to v4.x" author = "gssincla@google.com" id = "966e6e4c-85e2-5c94-8245-25367802b7d2" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Reverse64_Bin_v2_5_through_v4_x.yara#L17-L99" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "d2958138c1b7ef681a63865ec4a57b0c75cc76896bf87b21c415b7ec860397e8" logic_hash = "c657234156293b9ac363b677490739ab0b5cc2ef149c9d9c37332dab9bb012f6" score = 75 quality = 85 tags = "" strings: $apiLocator = { 48 [2] AC 41 [2] 0D 41 [2] 38 ?? 75 ?? 4C [4] 45 [2] 75 ?? 5? 44 [2] 24 49 [2] 66 [4] 44 [2] 1C 49 [2] 41 [3] 48 } $calls = { 48 89 C1 41 BA EA 0F DF E0 FF D5 48 [2] 6A ?? 41 ?? 4C [2] 48 [2] 41 BA 99 A5 74 61 FF D5 } condition: $apiLocator and $calls } rule GCTI_Cobaltstrike_Resources_Reverse_Bin_V2_5_Through_V4_X { meta: description = "Cobalt Strike's resources/reverse.bin signature for versions 2.5 to 4.x" author = "gssincla@google.com" id = "182dbcd0-1180-5516-abe3-cf2eebbd0e39" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Reverse_Bin_v2_5_through_v4_x.yara#L17-L104" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "887f666d6473058e1641c3ce1dd96e47189a59c3b0b85c8b8fccdd41b84000c7" logic_hash = "c6c4fc477c7654ec07eb6ef4c6d53805a9b4881ba288754e1f50b3e4b134333c" score = 75 quality = 85 tags = "" strings: $apiLocator = { 31 ?? AC C1 ?? 0D 01 ?? 38 ?? 75 ?? 03 [2] 3B [2] 75 ?? 5? 8B ?? 24 01 ?? 66 8B [2] 8B ?? 1C 01 ?? 8B ?? 8B 01 ?? 89 [3] 5? 5? } $ws2_32 = { 5D 68 33 32 00 00 68 77 73 32 5F } $connect = { 6A 10 5? 5? 68 99 A5 74 61 } condition: $apiLocator and $ws2_32 and $connect } rule GCTI_Cobaltstrike_Resources_Artifact32_And_Resources_Dropper_V1_49_To_V3_14 { meta: description = "Cobalt Strike's resources/artifact32{.exe,.dll,big.exe,big.dll} and resources/dropper.exe signature for versions 1.49 to 3.14" author = "gssincla@google.com" id = "243e3761-cbea-561c-97da-f6ba12ebc7ee" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32_and_Resources_Dropper_v1_45_to_v4_x.yara#L17-L32" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "40fc605a8b95bbd79a3bd7d9af73fbeebe3fada577c99e7a111f6168f6a0d37a" logic_hash = "437706c808bca28384a6e8e24fa3ae120a4ebe4166fa4ca3564c58b881fb23a8" score = 75 quality = 85 tags = "" strings: $payloadDecoder = { 8B [2] 89 ?? 03 [2] 8B [2] 03 [2] 0F B6 18 8B [2] 89 ?? C1 ?? 1F C1 ?? 1E 01 ?? 83 ?? 03 29 ?? 03 [2] 0F B6 00 31 ?? 88 ?? 8B [2] 89 ?? 03 [2] 8B [2] 03 [2] 0F B6 12 } condition: any of them } rule GCTI_Cobaltstrike_Resources_Artifact32_V3_1_And_V3_2 { meta: description = "Cobalt Strike's resources/artifact32{.dll,.exe,svc.exe,big.exe,big.dll,bigsvc.exe} and resources/artifact32uac(alt).dll signature for versions 3.1 and 3.2" author = "gssincla@google.com" id = "4fff7f42-9f50-5945-8ec0-2438ac5c7000" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32_and_Resources_Dropper_v1_45_to_v4_x.yara#L34-L60" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "4f14bcd7803a8e22e81e74d6061d0df9e8bac7f96f1213d062a29a8523ae4624" logic_hash = "7a0d33d0260c762b4aa67e4084d7474338c60aa684fd3e622614745d90350da8" score = 75 quality = 85 tags = "" strings: $decoderFunc = { 89 ?? B? 04 00 00 00 99 F7 FF 8B [2] 8A [2] 30 ?? 8A ?? 4? 88 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Artifact32_V3_14_To_V4_X { meta: description = "Cobalt Strike's resources/artifact32{.dll,.exe,big.exe,big.dll,bigsvc.exe} signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x and resources/artifact32uac.dll for v3.14 and v4.0" author = "gssincla@google.com" id = "8a010305-dce5-55f4-b2dd-a736721efe22" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32_and_Resources_Dropper_v1_45_to_v4_x.yara#L62-L89" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "888bae8d89c03c1d529b04f9e4a051140ce3d7b39bc9ea021ad9fc7c9f467719" logic_hash = "fc5c353c568e33df80fa5bab14d11112ca211e269043b83dba8b7d1a6a008a7b" score = 75 quality = 85 tags = "" strings: $pushFmtStr = { C7 [3] 5C 00 00 00 C7 [3] 65 00 00 00 C7 [3] 70 00 00 00 C7 [3] 69 00 00 00 C7 [3] 70 00 00 00 F7 F1 C7 [3] 5C 00 00 00 C7 [3] 2E 00 00 00 C7 [3] 5C 00 00 00 } $fmtStr = "%c%c%c%c%c%c%c%c%cMSSE-%d-server" condition: all of them } rule GCTI_Cobaltstrike_Resources_Bypassuactoken_X64_Dll_V3_11_To_V3_14 { meta: description = "Cobalt Strike's resources/bypassuactoken.x64.dll from v3.11 to v3.14 (64-bit version)" author = "gssincla@google.com" id = "c89befcd-a622-5947-9ce3-a6031901a45a" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuactoken_x64_Dll_v3_11_to_v3_14.yara#L17-L118" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "853068822bbc6b1305b2a9780cf1034f5d9d7127001351a6917f9dbb42f30d67" logic_hash = "adfd212f2e470f666ab8a2168e976c11d3032c31dab7cf56963dae5fc0f6c5f9" score = 75 quality = 85 tags = "" strings: $isHighIntegrityProcess = { 83 ?? 7A 75 ?? 8B [3] 33 ?? FF 15 [4] 44 [4] 8D [2] 48 8B ?? 48 8D [3] 48 8B ?? 4C 8B ?? 48 89 [3] FF 15 [4] 85 C0 74 ?? 48 8B ?? FF 15 [4] 8D [2] 8A ?? 40 [2] 0F B6 D1 48 8B 0F FF 15 [4] 81 ?? 00 30 00 00 } $executeTaskmgr = { 44 8D ?? 70 48 8D [3] E8 [4] 83 [3] 00 48 8D [5] 0F 57 ?? 66 0F 7F [3] 48 89 [3] 48 8D [5] 48 8D [3] C7 [3] 70 00 00 00 C7 [3] 40 00 00 00 48 89 [3] FF 15 } condition: all of them } rule GCTI_Cobaltstrike_Resources_Httpstager64_Bin_V3_2_Through_V4_X { meta: description = "Cobalt Strike's resources/httpstager64.bin signature for versions v3.2 to v4.x" author = "gssincla@google.com" id = "5530dce8-e5a1-5133-9b05-464e3397084a" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpstager64_Bin_v3_2_through_v4_x.yara#L17-L85" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "ad93d1ee561bc25be4a96652942f698eac9b133d8b35ab7e7d3489a25f1d1e76" logic_hash = "23666169565c6b3e5fa71767dc31096e7a25be049eeab16b074053d76c97c70b" score = 75 quality = 85 tags = "" strings: $apiLocator = { 48 [2] AC 41 [2] 0D 41 [2] 38 ?? 75 ?? 4C [4] 45 [2] 75 ?? 5? 44 [2] 24 49 [2] 66 [4] 44 [2] 1C 49 [2] 41 [3] 48 } $postInternetOpenJmp = { 41 ?? 3A 56 79 A7 FF ?? EB } condition: $apiLocator and $postInternetOpenJmp } rule GCTI_Cobaltstrike_Resources_Browserpivot_X64_Bin_V1_48_To_V3_14_And_Sleeve_Browserpivot_X64_Dll_V4_0_To_V4_X { meta: description = "Cobalt Strike's resources/browserpivot.x64.bin from v1.48 to v3.14 and sleeve/browserpivot.x64.dll from v4.0 to at least v4.4" author = "gssincla@google.com" id = "a5dfae85-ff9c-5ca5-9ac0-041c6108a6ed" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Browserpivot_x64_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_x64_Dll_v4_0_to_v4_x.yara#L17-L64" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "0ad32bc4fbf3189e897805cec0acd68326d9c6f714c543bafb9bc40f7ac63f55" logic_hash = "a59f19b6e258b724ed88b4255717d066319ba5fb0838d6c6ed11355e9d9b1c22" score = 75 quality = 85 tags = "" strings: $socket_recv = { FF 15 [4] 83 ?? FF 74 ?? 85 ?? 74 ?? 03 ?? 83 ?? 02 72 ?? 8D ?? FF 80 [2] 0A 75 ?? 8D ?? FE 80 [2] 0D } $fmt = "%1024[^ ] %8[^:]://%1016[^/]%7168[^ ] %1024[^ ]" condition: all of them } rule GCTI_Sliver_Implant_64Bit { meta: description = "Sliver 64-bit implant (with and without --debug flag at compile)" author = "gssincla@google.com" id = "b84db933-0e11-5871-821d-43697c015665" date = "2022-11-18" modified = "2022-11-19" reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse" source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/Sliver/Sliver__Implant_64bit.yara#L17-L84" license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE" hash = "2d1c9de42942a16c88a042f307f0ace215cdc67241432e1152080870fe95ea87" logic_hash = "ad4ceef08a732174c8ccbcacf0370b26acb9e5ec0784d8827c8104618e018a26" score = 75 quality = 85 tags = "" strings: $s_tcppivot = { 48 ?? 74 63 70 70 69 76 6F 74 } $s_namedpipe = { 48 ?? 6E 61 6D 65 64 70 69 70 [2-32] 80 ?? 08 65 } $s_https = { 81 ?? 68 74 74 70 [2-32] 80 ?? 04 73 } $s_wg = {66 81 ?? 77 67} $s_dns = { 66 81 ?? 64 6E [2-20] 80 ?? 02 73 } $s_mtls = { 81 ?? 6D 74 6C 73 } $fp1 = "cloudfoundry" ascii fullword condition: 5 of ( $s* ) and not 1 of ( $fp* ) } /* * YARA Rule Set * Repository Name: Trellix ARC * Repository: https://github.com/advanced-threat-research/Yara-Rules/ * Retrieval Date: 2026-10-26 * Git Commit: 1919562a59f190bda60c982424f6a24c542ee3e0 * Number of Rules: 57 * Skipped: 67 (age), 40 (quality), 3 (score), 0 (importance) * * * LICENSE * * Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ private rule TRELLIX_ARC_Ransom_Xinof_Chunk_PRIVATE : RANSOMWARE { meta: description = "Detect chunk of Xinof ransomware" author = "Thomas Roccia | McAfee ATR Team" id = "243c39fd-b5f6-5f64-8058-43da182480c0" date = "2020-11-20" date = "2020-11-20" modified = "2020-11-20" reference = "https://labs.sentinelone.com/the-fonix-raas-new-low-key-threat-with-unnecessary-complexities/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_xinof.yar#L1-L51" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "0c1e6299a2392239dbe7fead33ef4146" logic_hash = "f0266962357a7cb26995cdbfcc99749b73fc4ed09c813fa8e2ed0f5143cde554" score = 75 quality = 70 tags = "RANSOMWARE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransom/XINOF" actor_type = "Cybercrime" actor_group = "FONIX" strings: $chunk1 = { C6 45 ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 53 50 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 56 50 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8B CC 57 50 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? } condition: any of them } rule TRELLIX_ARC_Redline_Payload : BACKDOOR FILE { meta: description = "Rule to detect the RedLine payload" author = "Marc Rivero | McAfee ATR Team" id = "61c2032f-1e6b-5123-8f99-ff83ae95e8a9" date = "2020-04-16" modified = "2020-08-14" reference = "https://www.proofpoint.com/us/threat-insight/post/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_redline.yar#L1-L38" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "5df956f08d6ad0559efcdb7b7a59b2f3b95dee9e2aa6b76602c46e2aba855eff" logic_hash = "44df161b7434b9137ca5bb919eb314f8447b216b3f6e1214606a898fb36ee4f4" score = 75 quality = 70 tags = "BACKDOOR, FILE" rule_version = "v1" malware_type = "backdoor" malware_family = "Backdoor:W32/RedLine" actor_type = "Cybercrime" actor_group = "Unknown" strings: $s1 = "Cambrel.exe" fullword ascii $s2 = { 22 00 54 00 65 00 78 00 74 00 49 00 6e 00 70 00 75 00 74 00 46 00 72 00 61 00 6d 00 65 00 77 00 6f 00 72 00 6b 00 2e 00 44 00 59 00 4e 00 4c 00 49 00 4e 00 4b 00 22 00 } $op0 = { 06 7c 34 00 00 04 7b 17 00 00 04 7e 21 00 00 0a } $op1 = { 96 00 92 0e 83 02 02 00 f4 20 } $op2 = { 03 00 c6 01 d9 08 1b 03 44 } $p0 = { 80 00 96 20 83 11 b7 02 10 } $p1 = { 20 01 00 72 0f 00 20 02 00 8a 0f 00 20 03 00 61 } $p2 = { 03 00 c6 01 cd 06 13 03 79 } condition: uint16( 0 ) == 0x5a4d and filesize < 60KB and all of ( $s* ) and all of ( $op* ) or all of ( $p* ) } rule TRELLIX_ARC_Shifu : FINANCIAL { meta: description = "No description has been set in the source file - Trellix ARC" author = "McAfee Labs" id = "81e9ad25-1df0-5196-be8b-1d1d5d8e4387" date = "2026-10-01" modified = "2020-08-14" reference = "https://blogs.mcafee.com/mcafee-labs/japanese-banking-trojan-shifu-combines-malware-tools/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_Shifu.yar#L1-L24" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" logic_hash = "dfa6165f8d2750330c71dedbde293780d2bb27e8eb3635e47ca770ff7b9a9d63" score = 75 quality = 70 tags = "FINANCIAL" malware_type = "financial" malware_family = "Backdoor:W32/Shifu" actor_type = "Cybercrime" actor_group = "Unknown" strings: $b = "RegCreateKeyA" $a = "CryptCreateHash" $c = {2F 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 22 00 22 00 20 00 22 00 25 00 73 00 22 00 20 00 25 00 73 00 00 00 00 00 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 00 00 72 00 75 00 6E} $d = {53 00 6E 00 64 00 56 00 6F 00 6C 00 2E 00 65 00 78 00 65} $e = {52 00 65 00 64 00 69 00 72 00 65 00 63 00 74 00 45 00 58 00 45} condition: all of them } rule TRELLIX_ARC_MALW_Fritzfrog : BOTNET FILE { meta: description = "Rule to detect Fritzfrog" author = "Marc Rivero | McAfee ATR Team" id = "4c553279-7e0c-5602-944d-ad8a47edf4ea" date = "2020-08-20" modified = "2020-08-20" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_fritzfrog.yar#L1-L26" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046" logic_hash = "488c807ecf0a9e981b2c1f2f5bb2e3072952d11f7cbf3a354bc85dc8e88b8b09" score = 75 quality = 70 tags = "BOTNET, FILE" rule_version = "v1" malware_type = "botnet" malware_family = "Botnet:W32/Fritzfrog" actor_type = "Cybercrime" actor_type = "Cybercrime" actor_group = "Unknown" strings: $pattern = { 7F454C4602010100000000000000000002003E000100000090D34500000000004000000000000000C8010000000000000000000040003800070040000D000300060000000400000040000000000000004000400000000000400040000000000088010000000000008801000000000000001000000000000004000000040000009C0F0000000000009C0F4000000000009C0F400000000000640000000000000064000000000000000400000000000000010000000500000000000000000000000000400000000000000040000000000083F23E000000000083F23E00000000000010000000000000010000000400000000003F000000000000007F000000000000007F00000000006C834500000000006C834500000000000010000000000000010000000600000000908400000000000090C400000000000090C4000000000060EC0400000000005809070000000000001000000000000051E574640600000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000080150465002A000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000006000000000000000010400000000000001000000000000083E23E00000000000000000000000000100000000000000000000000000000004100000001000000020000000000000000007F000000000000003F0000000000C0271B0000000000000000000000000020000000000000000000000000000000720000000300000000000000000000000000000000000000C0275A00000000007C000000000000000000000000000000010000000000000000000000000000004900000001000000020000000000000040289A000000000040285A0000000000D83600000000000000000000000000002000000000000000000000000000000053000000010000000200000000000000185F9A0000000000185F5A0000000000380D0000000000000000000000000000080000000000000000000000000000005D000000010000000200000000000000506C9A0000000000506C5A0000000000000000000000000000000000000000000100000000000000000000000000000067000000010000000200000000000000606C9A0000000000606C5A00000000000C172A0000000000000000000000000020000000000000000000000000000000070000000100000003000000000000000090C400000000000090840000000000004B0300000000000000000000000000200000000000000000000000000000001200000001000000030000000000000000DBC7000000000000DB87000000000050A101000000000000000000000000002000000000000000000000000000000018000000080000000300000000000000607CC90000000000607C890000000000D0E80100000000000000000000000000200000000000000000000000000000001D0000000800000003000000000000004065CB000000000040658B00000000001834000000000000000000000000000020000000000000000000000000000000270000000700000002000000000000009C0F4000000000009C0F00000000000064000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 } condition: uint16( 0 ) == 0x457f and filesize < 26000KB and all of them } rule TRELLIX_ARC_MALW_Emotet : FINANCIAL FILE { meta: description = "Rule to detect unpacked Emotet" author = "Marc Rivero | McAfee ATR Team" id = "5bc83065-dfdd-56b7-9983-200bff35c8b1" date = "2020-07-21" modified = "2020-08-14" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_emotet.yar#L1-L32" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "a6621c093047446e0e8ae104769af93a5a8ed147ab8865afaafbbd22adbd052d" logic_hash = "223e4453a6c3b56b0bc0f91147fa55ea59582d64b8a5c08f1f8d06026044065e" score = 75 quality = 70 tags = "FINANCIAL, FILE" rule_version = "v1" malware_type = "financial" malware_family = "Backdoor:W32/Emotet" actor_type = "Cybercrime" actor_type = "Cybercrime" actor_group = "Unknown" strings: $pattern_0 = { 8b45fc 8be5 5d c3 55 8bec } $pattern_1 = { 3c39 7e13 3c61 7c04 3c7a 7e0b 3c41 } $pattern_2 = { 7c04 3c39 7e13 3c61 7c04 3c7a 7e0b } $pattern_3 = { 5f 8bc6 5e 5b 8be5 } $pattern_4 = { 5f 668906 5e 5b } $pattern_5 = { 3c30 7c04 3c39 7e13 3c61 7c04 } $pattern_6 = { 53 56 57 8bfa 8bf1 } $pattern_7 = { 3c39 7e13 3c61 7c04 3c7a 7e0b } $pattern_8 = { 55 8bec 83ec14 53 } $pattern_9 = { 5e 8be5 5d c3 55 8bec } condition: 7 of them and filesize < 180224 } rule TRELLIX_ARC_Malw_Eicar : EICAR { meta: description = "Rule to detect the EICAR pattern" author = "Marc Rivero | McAfee ATR Team" id = "16307b03-7fab-5d68-ad3b-0efcea952fcf" date = "2026-10-01" modified = "2020-08-14" reference = "https://www.eicar.org/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_Eicar.yar#L1-L22" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f" logic_hash = "564b0592f40582fe71e2dab0c0f25c168462f9297c13e7c9f06ac51b492e4533" score = 75 quality = 70 tags = "EICAR" malware_type = "eicar" malware_family = "W32/Eicar" actor_type = "Unknown" actor_group = "Unknown" strings: $s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii condition: any of them } rule TRELLIX_ARC_Cyaxsharp_Rezer0 : LOADER { meta: description = "Detects CyaX-Sharp/ReZer0 loader samples based on the embedded scheduled task template" author = "Max 'Libra' Kersten for McAfee's Advanced Threat Research Team" id = "7a1addcf-4e8f-5290-8788-9b0738128160" date = "2021-04-08" modified = "2021-08-04" reference = "This rule was published in combination with the following McAfee ATR blog: https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/see-ya-sharp-a-loaders-tale/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MAL_cyax_sharp_loader.yar#L1-L16" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" logic_hash = "3d6daaf7a85a9b3898e4ce5d5293b09f26965f9f7280b34ba8f6814b7f14dec2" score = 75 quality = 70 tags = "LOADER" version = "1.0" malware_type = "loader" strings: $template = { 01A10C3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3136223F3E0D0A3C5461736B2076657273696F6E3D22312E322220786D6C6E733D22687474703A2F2F736368656D61732E6D6963726F736F66742E636F6D2F77696E646F77732F323030342F30322F6D69742F7461736B223E0D0A20203C526567697374726174696F6E496E666F3E0D0A202020203C446174653E323031342D31302D32355431343A32373A34342E383932393032373C2F446174653E0D0A202020203C417574686F723E5B5553455249445D3C2F417574686F723E0D0A20203C2F526567697374726174696F6E496E666F3E0D0A20203C54726967676572733E0D0A202020203C4C6F676F6E547269676765723E0D0A2020202020203C456E61626C65643E747275653C2F456E61626C65643E0D0A2020202020203C5573657249643E5B5553455249445D3C2F5573657249643E0D0A202020203C2F4C6F676F6E547269676765723E0D0A202020203C526567697374726174696F6E547269676765723E0D0A2020202020203C456E61626C65643E66616C73653C2F456E61626C65643E0D0A202020203C2F526567697374726174696F6E547269676765723E0D0A20203C2F54726967676572733E0D0A20203C5072696E636970616C733E0D0A202020203C5072696E636970616C2069643D22417574686F72223E0D0A2020202020203C5573657249643E5B5553455249445D3C2F5573657249643E0D0A2020202020203C4C6F676F6E547970653E496E746572616374697665546F6B656E3C2F4C6F676F6E547970653E0D0A2020202020203C52756E4C6576656C3E4C6561737450726976696C6567653C2F52756E4C6576656C3E0D0A202020203C2F5072696E636970616C3E0D0A20203C2F5072696E636970616C733E0D0A20203C53657474696E67733E0D0A202020203C4D756C7469706C65496E7374616E636573506F6C6963793E53746F704578697374696E673C2F4D756C7469706C65496E7374616E636573506F6C6963793E0D0A202020203C446973616C6C6F77537461727449664F6E4261747465726965733E66616C73653C2F446973616C6C6F77537461727449664F6E4261747465726965733E0D0A202020203C53746F704966476F696E674F6E4261747465726965733E747275653C2F53746F704966476F696E674F6E4261747465726965733E0D0A202020203C416C6C6F77486172645465726D696E6174653E66616C73653C2F416C6C6F77486172645465726D696E6174653E0D0A202020203C53746172745768656E417661696C61626C653E747275653C2F53746172745768656E417661696C61626C653E0D0A202020203C52756E4F6E6C7949664E6574776F726B417661696C61626C653E66616C73653C2F52756E4F6E6C7949664E6574776F726B417661696C61626C653E0D0A202020203C49646C6553657474696E67733E0D0A2020202020203C53746F704F6E49646C65456E643E747275653C2F53746F704F6E49646C65456E643E0D0A2020202020203C526573746172744F6E49646C653E66616C73653C2F526573746172744F6E49646C653E0D0A202020203C2F49646C6553657474696E67733E0D0A202020203C416C6C6F7753746172744F6E44656D616E643E747275653C2F416C6C6F7753746172744F6E44656D616E643E0D0A202020203C456E61626C65643E747275653C2F456E61626C65643E0D0A202020203C48696464656E3E66616C73653C2F48696464656E3E0D0A202020203C52756E4F6E6C79496649646C653E66616C73653C2F52756E4F6E6C79496649646C653E0D0A202020203C57616B65546F52756E3E66616C73653C2F57616B65546F52756E3E0D0A202020203C457865637574696F6E54696D654C696D69743E505430533C2F457865637574696F6E54696D654C696D69743E0D0A202020203C5072696F726974793E373C2F5072696F726974793E0D0A20203C2F53657474696E67733E0D0A20203C416374696F6E7320436F6E746578743D22417574686F72223E0D0A202020203C457865633E0D0A2020202020203C436F6D6D616E643E5B4C4F434154494F4E5D3C2F436F6D6D616E643E0D0A202020203C2F457865633E0D0A20203C2F416374696F6E733E0D0A3C2F5461736B3E } condition: $template } rule TRELLIX_ARC_MALW_Cobaltrike : BACKDOOR FILE { meta: description = "Rule to detect CobaltStrike beacon" author = "Felix Bilstein - yara-signator at cocacoding dot com" id = "a7dae4c7-672e-58fb-8542-90fa90d991a4" date = "2020-07-19" modified = "2021-08-30" reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_cobaltstrike.yar#L1-L38" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "f47a627880bfa4a117fec8be74ab206690e5eb0e9050331292e032cd22883f5b" logic_hash = "fc91d40c6544c7ab7c60b3cb8fc542bd4a6fac79dbe00cad8f612854f2a6dcd1" score = 75 quality = 70 tags = "BACKDOOR, FILE" rule_version = "v1" malware_type = "backdoor" malware_family = "Backdoor:W32/CobaltStrike" actor_type = "Cybercrime" actor_group = "Unknown" strings: $pattern_0 = { e9???????? eb0a b801000000 e9???????? } $pattern_1 = { 3bc7 750d ff15???????? 3d33270000 } $pattern_2 = { 8bd0 e8???????? 85c0 7e0e } $pattern_3 = { 50 8d8d24efffff 51 e8???????? } $pattern_4 = { 03b5d4eeffff 89b5c8eeffff 3bf7 72bd 3bf7 } $pattern_5 = { 8b450c 8945f4 8d45f4 50 } $pattern_6 = { 33c5 8945fc 8b4508 53 56 ff750c 33db } $pattern_7 = { e8???????? e9???????? 833d????????01 7505 e8???????? } $pattern_8 = { 53 53 8d85f4faffff 50 } $pattern_9 = { 68???????? 53 50 e8???????? 83c424 } $pattern_10 = { 488b4c2420 8b0401 8b4c2408 33c8 8bc1 89442408 } $pattern_11 = { 488d4d97 e8???????? 4c8d9c24d0000000 418bc7 498b5b20 498b7328 498b7b30 } $pattern_12 = { bd08000000 85d2 7459 ffcf 4d85ed } $pattern_13 = { 4183c9ff 33d2 ff15???????? 4c63c0 4983f8ff } $pattern_14 = { 49c1e002 e8???????? 03f3 4d8d349e 3bf5 7d13 } $pattern_15 = { 752c 4c8d45af 488d55af 488d4d27 } condition: 7 of them and filesize < 696320 } rule TRELLIX_ARC_Rtf_Bluetea_Builder : MALDOC FILE { meta: description = "Rule to detect the RTF files created to distribute BlueTea trojan" author = "Marc Rivero | McAfee ATR Team" id = "20e4f7b2-b36c-5724-a3aa-4216ed6265ab" date = "2020-04-21" modified = "2020-08-14" reference = "https://blog.360totalsecurity.com/en/bluetea-action-drive-the-life-trojan-update-email-worm-module-and-spread-through-covid-19-outbreak/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALDOC_rtf_bluetea_builder.yar#L1-L30" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "4a3eeaed22342967a95302a4f087b25f50d61314facc6791f756dcd113d4f277" logic_hash = "6c4007fb7ef4819141db63050215dcbb3d2c17e7cdcdbb6cfb4f4b045bb5736b" score = 75 quality = 70 tags = "MALDOC, FILE" rule_version = "v1" malware_type = "maldoc" malware_family = "Maldoc:W32/BlueTea" actor_type = "Cybercrime" actor_group = "Unknown" strings: $sequence = { 7B??72??6631??????65666C616E6731??32??????????69??????????????67????36??75??32??????656666????35????????656666????????73??666462????33??35????????74??68????????68????????36??73??73??66??????68????????36??73??73??6662????5C646566??616E6731??33??5C646566??616E67666532??35????????656D656C616E6731??33??5C74??656D656C616E67666532??35????????656D656C616E6763????7B??666F6E74??62??????6630??????69??????????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????0A????6631??5C6662????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??2763????2763????2763????276535????????66616C74??5369????????????7D??5C6633????6662????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??34??35????????30????3630??30??30????????????72??6120????74??3B????0A????6633??5C6662????69??????????69????????????6172??6574??5C6670??71??7B??2A??????6E6F73??20??32??6630??????????30??30????33??32??34??43616C69????????????5C6633??5C6662????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??5C2763????2763????2763????276535????????7B??666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????5C666462????6A??72??6633??35????????62????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??2763????2763????2763????276535????????66616C74??5369????????????7D??0A????66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??34??35????????30????3630??30??30????????????72??613B????5C6662????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????0A????666C6F6D69????????????31??????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????5C666462????6E6F72??6633??35????????62????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??2763????2763????2763????276535????????66616C74??5369????????????7D??0A????66??????69????????????31??????????62????69??????????69????????????6172??6574??5C6670??71??7B??2A??????6E6F73??20??32??6630??????????30??30????33??32??34??43616C69????????????5C6662????69????????????31??????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????5C6634??5C6662????69??????????6D616E5C6663????72??6574??33??5C6670??71??20??????6573??4E6577??526F6D616E20????3B????0A????6634??5C6662????69??????????6D616E5C6663????72??6574??30????6670??71??20??????6573??4E6577??526F6D616E20????72??7D??5C6634??5C6662????69??????????6D616E5C6663????72??6574??3631??????72??32??5469????????????77??526F6D616E20????6565??????7B??6634??5C6662????69??????????6D616E5C6663????72??6574??3632??????72??32??5469????????????77??526F6D616E20??????3B????5C6634??5C6662????69??????????6D616E5C6663????72??6574??37375C6670??71??20??????6573??4E6577??526F6D616E20??486562????77??3B????0A????6634??5C6662????69??????????6D616E5C6663????72??6574??3738??????72??32??5469????????????77??526F6D616E20??4172??62????29??7D??5C6634??5C6662????69??????????6D616E5C6663????72??6574??38??5C6670??71??20??????6573??4E6577??526F6D616E20????6C74??63??7D??5C6634??5C6662????69??????????6D616E5C6663????72??6574??3633??????72??32??5469????????????77??526F6D616E20??5669????????????73??29??7D??0A????6631??32??????69??????????????6C5C6663????72??6574??5C6670??71??20????6D5375??20????73??6572??7B??2A??????6C74??5369????????????7D??5C6633??30??????69??????????????6D616E5C6663????72??6574??33??5C6670??71??20????6D62????6120????74??20????3B????5C6633??31??????69??????????????6D616E5C6663????72??6574??30????6670??71??20????6D62????6120????74??20????72??7D??5C6633??33??????69??????????????6D616E5C6663????72??6574??3631??????72??32??43616D62????6120????74??20????6565??????0D????????33??34??6662????69??????????6D616E5C6663????72??6574??3632??????72??32??43616D62????6120????74??20??????3B????5C6633??375C6662????69??????????6D616E5C6663????72??6574??38??5C6670??71??20????6D62????6120????74??20????6C74??63??7D??5C6633??38??????69??????????????6D616E5C6663????72??6574??3633??????72??32??43616D62????6120????74??20??5669????????????73??29??7D??5C6634??30??????69??????????????69????????????6172??6574??33??5C6670??71??20????6C69????????????3B????0A????6634??31??????69??????????????69????????????6172??6574??30????6670??71??20????6C69????????????72??7D??5C6634??33??????69??????????????69????????????6172??6574??3631??????72??32??43616C69????????????6565??????7B??6634??34??6662????69??????????69????????????6172??6574??3632??????72??32??43616C69????????????72??7D??5C6634??375C6662????69??????????69????????????6172??6574??38??5C6670??71??20????6C69????????????6C74??63??7D??0A????6634??38??????69??????????????69????????????6172??6574??3633??????72??32??43616C69????????????69????????????73??29??7D??5C6634??32??????69??????????????6C5C6663????72??6574??5C6670??71??20????2763????2763????2763????276535????????74??72??3B????5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??33??5C6670??71??20??????6573??4E6577??526F6D616E20????3B????0A????666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??30????6670??71??20??????6573??4E6577??526F6D616E20????72??7D??5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3631??????72??32??5469????????????77??526F6D616E20????6565??????7B??666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3632??????72??32??5469????????????77??526F6D616E20??????3B????0A????666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??37375C6670??71??20??????6573??4E6577??526F6D616E20??486562????77??3B????5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3738??????72??32??5469????????????77??526F6D616E20??4172??62????29??7D??5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??38??5C6670??71??20??????6573??4E6577??526F6D616E20????6C74??63??7D??0A????666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3633??????72??32??5469????????????77??526F6D616E20??5669????????????73??29??7D??5C666462????6A??72??6633??35????????62????69??????????6C5C6663????72??6574??5C6670??71??20????6D5375??20????73??6572??7B??2A??????6C74??5369????????????7D??5C66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??33??5C6670??71??20????6D62????6120????3B????0A????66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??30????6670??71??20????6D62????6120????72??7D??5C66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3631??????72??32??43616D62????6120????6565??????7B??66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3632??????72??32??43616D62????6120??????3B????0A????66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??38??5C6670??71??20????6D62????6120????6C74??63??7D??5C66??????616A?? } condition: uint16( 0 ) == 0x5c7b and filesize < 100KB and all of them } rule TRELLIX_ARC_Nionspy : FILEINFECTOR FILE { meta: description = "Triggers on old and new variants of W32/NionSpy file infector" author = "Trellix ARC Team" id = "86051ef8-a18b-553c-b06c-490f8d6df5cf" date = "2026-10-01" modified = "2020-08-14" reference = "https://blogs.mcafee.com/mcafee-labs/taking-a-close-look-at-data-stealing-nionspy-file-infector" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_NionSpy.yar#L1-L25" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" logic_hash = "982ba52f39352aee9e2d2dcadfb0816c439e92d0e5947afa7860630720913742" score = 75 quality = 70 tags = "FILEINFECTOR, FILE" malware_type = "fileinfector" malware_family = "FileInfector:W32/NionSpy" actor_type = "Cybercrime" actor_group = "Unknown" strings: $variant2015_infmarker = "aCfG92KXpcSo4Y94BnUrFmnNk27EhW6CqP5EnT" $variant2013_infmarker = "ad6af8bd5835d19cc7fdc4c62fdf02a1" $variant2013_string = "%s?cstorage=shell&comp=%s" condition: uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and 1 of ( $variant* ) } rule TRELLIX_ARC_MALW_Liquorbot : MALWARE FILE { meta: description = "Rule to detect LiquorBot malware" author = "Marc Rivero | McAfee ATR Team" id = "73898df8-b5eb-50ac-a2fe-ef9233c251c5" date = "2020-08-19" modified = "2020-08-19" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_liquorbot.yar#L1-L23" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "5b2a9cbda99ed903f75c3b37f0a6b1b9f6c39671a76ed652f3ddba117fd43bc9" logic_hash = "2448e3ede809331b2370fe9d42d603ad6508be6531a1a8764e0e0621867b6e89" score = 75 quality = 70 tags = "MALWARE, FILE" rule_version = "v1" malware_type = "malware" malware_family = "Botnet:W32/LiquorBot" actor_type = "Cybercrime" actor_group = "Unknown" strings: $pattern = { 7F454C4602010100000000000000000002003E0001000000605A4600000000004000000000000000700200000000000000000000400038000A0040001B00090006000000040000004000000000000000400040000000000040004000000000003002000000000000300200000000000000100000000000000300000004000000E00F000000000000E00F400000000000E00F40000000000020000000000000002000000000000000010000000000000004000000040000007C0F0000000000007C0F4000000000007C0F400000000000640000000000000064000000000000000400000000000000010000000500000000000000000000000000400000000000000040000000000040FB29000000000040FB2900000000000010000000000000010000000400000000002A000000000000006A000000000000006A0000000000E4492C0000000000E4492C000000000000100000000000000100000006000000005056000000000000509600000000000050960000000000E014040000000000681307000000000000100000000000000200000006000000405156000000000040519600000000004051960000000000300100000000000030010000000000000800000000000000070000000400000000000000000000000000000000000000000000000000000000000000000000000800000000000000080000000000000051E574640600000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000080150465002A00000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000010000000600000000000000001040000000000000100000000000001FE9290000000000000000000000000010000000000000000000000000000000F000000001000000060000000000000020F969000000000020F929000000000020020000000000000000000000000000100000000000000010000000000000007000000001000000020000000000000000006A000000000000002A0000000000A678110000000000000000000000000020000000000000000000000000000000E0000000040000000200000000000000A8787B0000000000A8783B000000000018000000000000000B0000000000000008000000000000001800000000000000E6000000040000000200000000000000C0787B0000000000C0783B000000000018030000000000000B0000000200000008000000000000001800000000000000F5000000FF } condition: uint16( 0 ) == 0x457f and all of them } rule TRELLIX_ARC_Rietspoof_Loader : RANSOMWARE FILE { meta: description = "Rule to detect the Rietspoof loader" author = "Marc Rivero | McAfee ATR Team" id = "f306e381-e2ae-528e-937b-aced72356d77" date = "2026-10-01" modified = "2020-08-14" reference = "https://blog.avast.com/rietspoof-malware-increases-activity" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_rietspoof_loader.yar#L1-L22" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" logic_hash = "d72b58ff452070e03d0b25bc433ef5c677df77dd440adc1ecdb592cee24235fb" score = 75 quality = 70 tags = "RANSOMWARE, FILE" malware_type = "ransomware" malware_family = "Loader:W32/Rietspoof" actor_type = "Cybercrime" actor_group = "Unknown" strings: $x1 = "\\Work\\d2Od7s43\\techloader\\loader" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule TRELLIX_ARC_Trojan_Coinminer : FILE { meta: description = "Rule to detect Coinminer malware" author = "Trellix ATR" id = "ec1f4fb7-bce3-5d5b-bbff-50f9bfc90298" date = "2021-07-22" modified = "2022-01-19" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/miners/Trojan_CoinMiner.yar#L3-L23" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "3bdac08131ba5138bcb5abaf781d6dc7421272ce926bc37fa27ca3eeddcec3c2" hash = "d60766c4e6e77de0818e59f687810f54a4e08505561a6bcc93c4180adb0f67e7" logic_hash = "0d9d502eb0a54f90044f42f8ce485a2df6814064172cb7bf006a8c8a51976acd" score = 75 quality = 70 tags = "FILE" version = "v1" strings: $seq0 = { df 75 ab 7b 80 bf 83 c1 48 b3 18 74 70 01 24 5c } $seq1 = { 08 37 4e 6e 0f 50 0b 11 d0 98 0f a8 b8 27 47 4e } $seq2 = { bf 17 5a 08 09 ab 80 2f a1 b0 b1 da 47 9f e1 61 } $seq3 = { 53 36 34 b2 94 01 cc 05 8c 36 aa 8a 07 ff 06 1f } $seq4 = { 25 30 ae c4 44 d1 97 82 a5 06 05 63 07 02 28 3a } $seq5 = { 01 69 8e 1c 39 7b 11 56 38 0f 43 c8 5f a8 62 d0 } condition: ( uint16( 0 ) == 0x5a4d and filesize < 5000KB and pe.imphash ( ) == "e4290fa6afc89d56616f34ebbd0b1f2c" and 3 of ( $seq* ) ) } rule TRELLIX_ARC_Ransom_Egregor : RANSOMWARE FILE { meta: description = "Detect Egregor ransomware" author = "Thomas Roccia | McAfee ATR team" id = "b9f1a712-c168-5e0f-8b9e-cb03a6c43fc3" date = "2020-10-28" modified = "2020-10-28" reference = "https://bazaar.abuse.ch/sample/004a2dc3ec7b98fa7fe6ae9c23a8b051ec30bcfcd2bc387c440c07ff5180fe9a/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_egregor.yar#L4-L31" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "5f9fcbdf7ad86583eb2bbcaa5741d88a" logic_hash = "8077c656eed0b1633da54f8d017d4eff122f2f4e486c4e1af6f6434ea33c0675" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransom/Egregor" actor_type = "Cybercrime" actor_group = "egregor" strings: $p1 = "ewdk.pdb" fullword ascii $p2 = "testbuild.pdb" fullword ascii $s1 = "M:\\" nocase ascii $s2 = "1z1M9U9" fullword wide $s3 = "C:\\Logmein\\{888-8888-9999}\\Logmein.log" fullword wide condition: uint16( 0 ) == 0x5a4d and filesize < 2000KB and hash.sha256 ( pe.rich_signature.clear_data ) == "b030ed1a7ca222a0923a59f321be7e55b8d0fc24c1134df1ba775bcf0994c79c" or ( pe.sections [ 4 ] . name == ".gfids" and pe.sections [ 5 ] . name == ".00cfg" ) and ( any of ( $p* ) or 2 of ( $s* ) ) } rule TRELLIX_ARC_Ransom_Win_Blackcat : RANSOMWARE FILE { meta: description = "Detecting variants of Windows BlackCat malware" author = " Trellix ATR" id = "65483ffb-6b10-5fd5-8a5f-fc885a5f2e98" date = "2022-01-06" modified = "2022-01-19" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/Ransom_Win_BlackCat_public.yar#L2-L24" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" logic_hash = "8faad28ab26690221f6e2130c886446615dbd505f76490cfaf999d130d0de6e3" score = 75 quality = 70 tags = "RANSOMWARE, FILE" malware_type = "Ransomware" detection_name = "Ransom_Win_BlackCat" actor_group = "Unknown" strings: $URL1 = "zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion" ascii wide $URL2 = "mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion" ascii wide $API = { 3a 7c d8 3f } condition: uint16( 0 ) == 0x5a4d and filesize < 3500KB and 1 of ( $URL* ) and $API } rule TRELLIX_ARC_RANSOM_Makop : RANSOMWARE FILE { meta: description = "Rule to detect the unpacked Makop ransomware samples" author = "Marc Rivero | McAfee ATR Team" id = "2828f2f9-4702-5cef-8b4e-7e98146c0332" date = "2020-07-19" modified = "2020-08-14" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_makop.yar#L1-L32" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "008e4c327875110b96deef1dd8ef65cefa201fef60ca1cbb9ab51b5304e66fe1" logic_hash = "2b4f8b90d46530421b66dbb04df6e84d268709fbee884536d8acc91e1b85f8a4" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransom:W32/Makop" actor_type = "Cybercrime" actor_group = "Unknown" strings: $pattern_0 = { 50 8d7c2420 e8???????? 84c0 0f84a6020000 8b742460 ba???????? } $pattern_1 = { 51 52 53 ffd5 85c0 746d 8b4c240c } $pattern_2 = { 7521 68000000f0 6a18 6a00 6a00 56 ff15???????? } $pattern_3 = { 83c40c 8d4e0c 51 66c7060802 66c746041066 c6460820 } $pattern_4 = { 51 ffd3 50 ffd7 8b4628 85c0 } $pattern_5 = { 85c9 741e 8b4508 8b4d0c 8a11 } $pattern_6 = { 83c002 6685c9 75f5 2bc6 d1f8 66390c46 8d3446 } $pattern_7 = { 895a2c 8b7f04 85ff 0f85f7feffff 55 6a00 } $pattern_8 = { 8b3d???????? 6a01 6a00 ffd7 50 ff15???????? } $pattern_9 = { 85c0 7407 50 ff15???????? } condition: 7 of them and filesize < 237568 } rule TRELLIX_ARC_Nefilim_Ransomware : RANSOMWARE FILE { meta: description = "Rule to detect Nefilim ransomware" author = "Marc Rivero | McAfee ATR Team" id = "55d9cb20-5071-5dce-a46f-a20816ba379f" date = "2020-03-17" modified = "2020-04-03" reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_NEFILIM.yar#L3-L48" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "5ab834f599c6ad35fcd0a168d93c52c399c6de7d1c20f33e25cb1fdb25aec9c6" logic_hash = "d8cd5d2dd552d3e9f57f7bd244e941fe89a96ab16bbcc71911e8e2a519f53f03" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransom:W32/Nefilim" actor_type = "Cybercrime" actor_group = "Unknown" strings: $s1 = "C:\\Users\\Administrator\\Desktop\\New folder\\Release\\NEFILIM.pdb" fullword ascii $s2 = "oh how i did it??? bypass sofos hah" fullword ascii $s3 = " /c timeout /t 3 /nobreak && del \"" fullword wide $s4 = "NEFILIM-DECRYPT.txt" fullword wide $op0 = { db ff ff ff 55 8b ec 83 ec 24 53 56 57 89 55 f4 } $op1 = { 60 be 00 d0 40 00 8d be 00 40 ff ff 57 eb 0b 90 } $op2 = { 84 e0 40 00 90 d1 40 00 08 } $bp = { 558B??83????53565789????29????6A??8D????8D????5A8B??89????8A????88????8B????8A????88??8A????88????8A??88????03??03??FF????75??89????8D????8D????8D????89????89????29????89????29????89????29????8D????8D????89????29????89????29????8B????89????29????8D????F6??????8B????8A????8B????8A????8A??88????8B????8A????88????75??0FB6??8A??????????0FB6??88????8A??????????0FB6????8A??????????88????0FB6????8A??????????88????8B????C1????32??????????8B????8A????32??8B????88????8A????32??88????8A??32????83????88????8B????8A????32????FF????88??83????83????83??????0F82????????5F5E5BC9C3558B??560FB6??57C1????03????6A??5F6A??5E8A??30??40414E75??4F75??5F5E5DC356576A??5F6A??8B??5E0FB6??8A??????????88??83????4E75??414F75??5F5EC38A????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????88????C3558B??5153566A??83????5E8A????32??8A????8A????88????32??32??88????88????32??8A??C0????B3??F6??02??32??32????8A????32????32??88????8A??C0????F6??02??32??32????8A????32????88????8A??C0????F6??02??32??32??8A????32????32????88??8A??C0????F6??02??32??32????83????32????4E88????75??5E5BC9C3558B??53FF????8B??32??E8????????59B3??8B??E8????????8B??E8????????8B??E8????????FF????8B??8A??E8????????FE??5980????72??8B??E8????????8B??E8????????5B8B??B0??5DE9????????558B??81??????????53568D??????????E8????????33??6A??5939????76??5783????75??8B????8D????A5A5A58D??????????A5508D????E8????????596A??588B????8D????80????75??48C6????79??EB??FE????33??8A??????8B????30????43413B????72??5F8B????8B????6A??2B??5E8A????88??404E75??5E5BC9C3558B??81??????????53FF????8D??????????50FF??????????68????????8D??????????50FF??????????33??53536A??535368????????8D??????????50FF??????????89????3B??0F84????????56578D????5053BE????????5689????FF??????????5056E8????????83????85??75??53FF??????????FF????8B??????????53FF??50FF??????????8D????51505689????FF??????????5056E8????????83????85??74??8B????89????8D????50FF????E8????????59595385??74??8D????50FF????FF????FF????FF??????????FF????53FF??50FF??????????5F5E5BC9C3558B??83????81??????????535657FF????8D????????????50FF??????????8B??????????68????????8D????????????50FF??8D??????508D????????????50FF??????????89??????83????0F84????????8B??????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????F6????????FF????8D????????????5074??FF??????????8D??????508D????????????50FF??68????????8D????????????50FF??8D????????????50E8????????E9????????FF??????????8D??????508D????????????50FF??8D??????50E8????????8B??C7????????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????8D??????50FF??85??74??8D????????????50E8????????598D??????50FF??????FF??????????85??0F85????????FF??????FF??????????5F5E5B8B??5DC3558B??81??????????53565768????????FF??????????8B??????????5033??57FF??8B??????????50FF??68????????89????FF??????????89????B8????????39????74??8B????2B??8A??FF????88????4039????75??57576A??575768????????FF????FF??????????89????3B??0F84????????8D????5150FF??????????6A??57FF??50FF??6A??5789????FF??50FF??FF????89????E8????????FF????E8????????595968????????57FF??50FF??68????????5789????FF??50FF??FF????8B????89????E8????????FF????8B????E8????????8B??????????59595757FF????FF????FF????FF??57FF??????????578D????5068????????FF????FF????FF??????????FF??????????83????0F84????????FF??????????83????0F84????????8B????8B????5705????????5713??5150FF????FF??578D????5068????????FF????FF????FF??????????8B????8B????5705????????5713??5150FF????FF??578D????5068????????FF??????????50FF????FF????FF??????????8B????8B????3B??0F8C????????7F??81??????????0F86????????89????89????3B??0F8C????????7F??3B??0F86????????EB??8B????2B????1B????89????0F88????????7F??81??????????0F82????????68????????57FF??50FF??????????5757FF????89????FF????FF????FF??578D????5068????????FF????FF????FF??????????FF????8B????FF????68????????FF????E8????????83????5757FF????FF????FF????FF??578D????5068????????FF????FF????FF??????????FF??FF????5750FF??????????81????????????8B????11????39????0F8C????????0F8F????????8B????39????0F82????????E9????????3B??7C??7F??81??????????76??68????????57FF??50FF??????????575733??89????5133??50FF????FF??578D????5068????????FF????FF????FF??????????FF????8B????FF????68????????FF????E8????????83????575733??5050FF????FF??578D????5068????????EB??5157FF??50FF??????????575733??89????5133??50FF????FF??578D????50FF????FF????FF????FF??????????FF????8B????FF????FF????FF????E8????????83????575733??5050FF????FF??578D????50FF????FF????FF????FF??????????FF????57FF??50FF??????????FF????FF??????????FF????57FF??8B??????????50FF??FF???? } condition: uint16( 0 ) == 0x5a4d and filesize < 200KB and all of ( $s* ) or all of ( $op* ) or $bp } rule TRELLIX_ARC_Nefilim_Signed : RANSOMWARE FILE { meta: description = "Rule to detect Nefilim samples digitally signed" author = "Marc Rivero | McAfee ATR Team" id = "a9a5daf0-4cfb-556a-b20a-72283fb1a0f9" date = "2020-04-02" modified = "2020-08-14" reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_NEFILIM.yar#L50-L72" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "353ee5805bc5c7a98fb5d522b15743055484dc47144535628d102a4098532cd5" logic_hash = "7625eb7de1ebb2f5410552b8983379f213d639f5e146a5d951975b69eb8111d3" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransom:W32/Nefilim" actor_type = "Cybercrime" actor_group = "Unknown" condition: uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "Red GmbH/CN=Red GmbH" and pe.signatures [ i ] . serial == "00:b8:81:a7:2d:41:17:bb:c3:8b:81:d3:c6:5c:79:2c:1a" or pe.signatures [ i ] . thumbprint == "5b:19:58:8b:78:74:0a:4c:5d:08:41:99:dc:0f:52:a6:1f:38:00:99" ) } rule TRELLIX_ARC_RANSOM_Nefilim_Go : RANSOMWARE FILE { meta: description = "Rule to detect the new Nefilim written in GO" author = "Marc Rivero | McAfee ATR Team" id = "a8809060-c646-5d54-88e7-c8054305ee6c" date = "2020-07-13" modified = "2020-08-14" reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_NEFILIM.yar#L74-L98" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "a51fec27e478a1908fc58c96eb14f3719608ed925f1b44eb67bbcc67bd4c4099" logic_hash = "f0b10286fb1623a32bcf1f30cadce2901f7711cb36db6bbe812f6c2e03862270" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransom:W32/Nefilim" actor_type = "Cybercrime" actor_group = "Unknown" strings: $pattern = { FF20476F206275696C642049443A20226A744368374D37436A4A5732634C5F636633374A2F49625946794336635A64735F4D796A56633461642F486B6D36694A4D39327847785F4F2D65746744692F664E37434C43622D59716E374D795947565A686F220A20FFCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108766B83EC0CC744241400000000C7442418000000008B4424108400890424E88D0200008B44240485C0740789C183F8FF7514C744241400000000C74424180000000083C40CC3894C24088B44241083C004890424E8570200008B4424048B4C2408894C24148944241883C40CC3E8AE5A0400E979FFFFFFCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86EC00000083EC108B44241885C00F84C30000008B4424148400890424E8FD0100008B44240485C0742E89C183F8FF74E38B44241839C10F85800000008B44241C894424048B44241483C004890424E88B12000083C410C3E8620303008B442414890424C744240400000000C7442408FFFFFFFFE8A61200000FB644240C84C07507E868030300EB8B8B44241C894424048B4424148D4804890C24E83F1200008B442418894424048B442414890424E82B120000E83603030083C410C38D05408E4E008904248D05B8CC510089442404E8DA3F02000F0B8D05408E4E008904248D05B0CC510089442404E8C03F02000F0BE899590400E9F4FEFFFFCCCCCCCCE90B000000CCCCCCCCCCCCCCCCCCCCCC8B6C24048B4424088B4C240CF00FB14D000F94442410C3CCCCCCCCCCCCCCCCCCE9DBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B05000000008B4424088B54240C8B5C24108B4C2414F00FC74D000F94442418C3CCCCCCE90B000000CCCCCCCCCCCCCCCCCCCCCC8B6C24048B44240889C1F00FC1450001C1894C240CC3CCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B05000000008B7424088B7C240C8B45008B550489C389D101F311F9F00FC74D0075F1895C2410894C2414C3CCCCCCCCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC8B442404A90700000074068B05000000000F6F000F7F4424080F77C3CCCCCCCCE9CBFFFFFFCCCCCCCCCCCCCCCCCCCCCCE9BBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C24048B442408874500C3CCCCCCCCE9EBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B4424040FBCC074058944240CC38B4424080FBCC0740883C0208944240CC3C744240C40000000C3CCCCCCCCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC83EC208B4424248B088B54242889CB01D1894C241C8B6804890424895C2404896C2408894C240C8B5C242C11DD896C2418896C2410E8160100000FB644241484C074C08B44241C894424308B4424188944243483C420C3CCCCCCCCCCCCCCCCCC83EC208B4424248B08894C24188B50048954241C890424894C2404895424088B5C2428895C240C8B6C242C896C2410E8BC0000000FB644241484C074C68B442418894424308B44241C8944243483C420C3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC8B5C24048B4424088B4C240CF00FB10B0F94442410C3CCCCCCCCCCCCCCCCCCCCE9DBFFFFFFCCCCCCCCCCCCCCCCCCCCCCE9EBFEFFFFCCCCCCCCCCCCCCCCCCCCCCE9DBFEFFFFCCCCCCCCCCCCCCCCCCCCCCE9DB000000CCCCCCCCCCCCCCCCCCCCCCE97B000000CCCCCCCCCCCCCCCCCCCCCCE9CB000000CCCCCCCCCCCCCCCCCCCCCCE9BBFEFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B2D000000008B4424088B54240C8B5C24108B4C2414F00FC74D000F94442418C3CCCCCC8B5C24048B4424088B4C240CF00FB10B0F94442410C3CCCCCCCCCCCCCCCCCCCC8B5C24048B44240889C1F00FC10301C88944240CC3CCCCCCCCCCCCCCCCCCCCCC8B5C24048B44240887038944240CC3CCE9EBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B5C24048B4424088703C3CCCCCCCCCC8B5C24048B4424088703C3CCCCCCCCCC8B442404A90700000074068B05000000008D5C24080F6F000F7F030F77C3CCCC8B442404A90700000074068B05000000000F6F4424080F7F000F77B800000000F00FC10424C3CCCCCCCCCCCCCCCCCCCC8B4424048A5C2408F00818C3CCCCCCCC8B4424048A5C2408F02018C3CCCCCCCC648B0D140000008B89000000003B610876098B4424088944240CC3E860550400EBDECCCCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240801000000E8AF4400008B44240C8944241C83C410C3E80E550400EBBCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240802000000E85F4400008B44240C8944241C83C410C3E8BE540400EBBCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240810000000E80F4400008B44240C8944241C83C410C3E86E540400EBBCCCCCCCCCCCCCCCCCCCCCCCCC83EC108D42048B008B4C2414890C248B4C2418894C240489442408E8D04300008B44240C8944241C83C410C3CCCCCCCC648B0D140000008B89000000003B6108762C83EC108B4424148B088B400489442408890C248B44241889442404E88E4300008B44240C8944241C83C410C3E8ED530400EBBBCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86B600000083EC108B442414F30F10000F57C90F2EC175060F8B860000000F2EC075027B5B648B05140000008B80000000008B40188B88940000008B909800000089909400000089CBC1E11131D989D331CAC1E90731D189DAC1EB1031CB8998980000008D041A8B4C241831C835A98E7FAA69C0CD76BAC28944241C83C410C38904248B44241889442404C744240804000000E8C74200008B44240C8944241C83C410C38B44241835A98E7FAA69C0CD76BAC28944241C83C410C3E80F530400E92AFFFFFFCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86B800000083EC108B442414F20F10000F57C9660F2EC175060F8B87000000660F2EC075027B5B648B05140000008B80000000008B40188B88940000008B909800000089909400000089CBC1E11131D989D331CAC1E90731D189DAC1EB1031CB8998980000008D041A8B4C241831C835A98E7FAA69C0CD76BAC28944241C83C410C38904248B44241889442404C744240808000000E8E54100008B44240C8944241C83C410C38B44241835A98E7FAA69C0CD76BAC28944241C83C410C3E82D520400E928FFFFFFCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108763C83EC0C8B44241084008904248B4C2414894C2404E815FEFFFF8B44241083C0048B4C2408890424894C2404E8FEFDFFFF8B4424088944241883C40CC3E8CD510400EBABCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108763C83EC0C8B44241084008904248B4C2414894C2404E895FEFFFF8B44241083C0088B4C2408890424894C2404E87EFEFFFF8B4424088944241883C40CC3E86D510400EBABCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86F200000083EC248B4424288B0885C974678B49048B59108B1385D274670FB6490FF6C120742983C0048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B40048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B44242C8944243083C424C3890C24E8B2FA03008B4424088B4C2404C70424000000008D15A279500089542404C744240818000000894C240C89442410E8F46603008B4424188B4C2414894C241C894424208D05C0D24E008904248D44241C89442404E81E8E00008B44240C8B4C2408890C2489442404E87A3602000F0BE853500400E9EEFEFFFFCCCCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86EF00000083EC248B4424288B0885C974648B59108B1385D274670FB6490FF6C120742983C0048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B40048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B44242C8944243083C424C3890C24E895F903008B4424088B4C2404C70424000000008D15A279500089542404C744240818000000894C240C89442410E8D76503008B4424188B4C2414894C241C894424208D05C0D24E008904248D44241C89442404E8018D00008B44240C8B4C2408890C2489442404E85D3502000F0BE8364F0400E9F1FEFFFFCC648B0D140000008B89000000003B61087606C644240C01C3 } condition: uint16( 0 ) == 0x5a4d and filesize < 8000KB and all of them } rule TRELLIX_ARC_Snake_Ransomware : RANSOMWARE FILE { meta: description = "Rule to detect Snake ransomware" author = "McAfee ATR Team" id = "b8f50af5-5568-5676-93a1-e818f08df0ce" date = "2020-02-20" modified = "2020-10-12" reference = "https://dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_snake_ransomware.yar#L1-L26" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60" logic_hash = "3ae64fbacbf886b8d09abc3f5f8eb9c8bff809909a251f2d055056e6d12217a2" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransom:W32/EKANS" actor_type = "Cybercrime" actor_group = "Unknown" strings: $snake = { 43 3A 2F 55 73 ?? 72 ?? 2F 57 49 4E 31 2F 67 6F 2F 73 ?? 63 2F 6A 6F 62 6E 68 62 67 6E 6E 69 66 70 6F 64 68 68 70 ?? 6D 66 2F 6E 66 64 6C 68 6F 70 68 6B 65 69 6A 61 64 67 66 64 64 69 6D 2F 6E 66 64 6C 68 6F 70 68 6B 65 69 6A 61 64 67 66 64 64 69 6D 2F 76 74 5F 73 74 ?? 69 6E 67 2E 67 6F 00 } condition: ( uint16( 0 ) == 0x5a4d and filesize < 11000KB ) and all of them } rule TRELLIX_ARC_Ransom_Linux_Hellokitty_0721 : RANSOMWARE FILE { meta: description = "rule to detect Linux variant of the Hello Kitty Ransomware" author = "Christiaan @ ATR" id = "097b02e7-93d8-5d4f-9964-7b660b3cd7b9" date = "2021-07-19" modified = "2021-07-19" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Linux_HelloKitty0721.yar#L1-L28" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "ca607e431062ee49a21d69d722750e5edbd8ffabcb54fa92b231814101756041" hash = "556e5cb5e4e77678110961c8d9260a726a363e00bf8d278e5302cb4bfccc3eed" logic_hash = "77a3809df4c7c591a855aaecd702af62935952937bb81661aa7f68e64dcf4fb4" score = 75 quality = 70 tags = "RANSOMWARE, FILE" Rule_Version = "v1" malware_type = "ransomware" malware_family = "Ransom:Linux/HelloKitty" strings: $v1 = "esxcli vm process kill -t=force -w=%d" fullword ascii $v2 = "esxcli vm process kill -t=hard -w=%d" fullword ascii $v3 = "esxcli vm process kill -t=soft -w=%d" fullword ascii $v4 = "error encrypt: %s rename back:%s" fullword ascii $v5 = "esxcli vm process list" fullword ascii $v6 = "Total VM run on host:" fullword ascii $v7 = "error lock_exclusively:%s owner pid:%d" fullword ascii $v8 = "Error open %s in try_lock_exclusively" fullword ascii $v9 = "Mode:%d Verbose:%d Daemon:%d AESNI:%d RDRAND:%d " fullword ascii $v10 = "pthread_cond_signal() error" fullword ascii $v11 = "ChaCha20 for x86_64, CRYPTOGAMS by <appro@openssl.org>" fullword ascii condition: ( uint16( 0 ) == 0x457f and filesize < 200KB and ( 8 of them ) ) or ( all of them ) } rule TRELLIX_ARC_RANSOM_Babuk_Packed_Feb2021 : RANSOM T1027_005 T1027 T1083 T1082 T1059 T1129 FILE { meta: description = "Rule to detect Babuk Locker packed" author = "McAfee ATR" id = "f5f3a3a6-2531-56c4-9153-b698c7bdc3d3" date = "2021-02-19" modified = "2021-02-24" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Babuk_Packed_Feb2021.yar#L1-L30" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "48e0f7d87fe74a2b61c74f0d32e6a8a5" logic_hash = "f3312b9c9147e9f892dbfb329cb95d3ee3ae67eefeec2d089b8c89fd26531953" score = 75 quality = 70 tags = "RANSOM, T1027.005, T1027, T1083, T1082, T1059, T1129, FILE" rule_version = "v1" malware_family = "Ransom:Win/Babuk" malware_type = "Ransom" mitre_attack = "T1027.005, T1027, T1083, T1082, T1059, T1129" strings: $first_stage1 = { 81 ec 30 04 00 00 68 6c 49 43 00 ff 15 74 20 43 00 a3 60 4e f8 02 b8 db d9 2b 00 ba c5 62 8e 76 b9 35 11 5f 39 eb 09 8d a4 24 00 00 00 00 8b ff 89 14 24 89 4c 24 04 81 04 24 25 10 a3 3b 81 04 24 cf e0 fb 07 81 04 24 35 26 9f 42 81 04 24 65 2b 39 06 81 04 24 3c 37 33 5b 81 44 24 04 48 4f c2 5d 83 e8 01 c7 05 54 4e f8 02 00 00 00 00 75 bf 8b 0d 54 aa 43 00 53 8b 1d 58 20 43 00 55 8b 2d 60 20 43 00 56 81 c1 01 24 0a 00 57 8b 3d 50 20 43 00 89 0d 64 4e f8 02 33 f6 eb 03 8d 49 00 81 f9 fc 00 00 00 75 08 6a 00 ff 15 40 20 43 00 6a 00 ff d7 8b 0d 64 4e f8 02 81 f9 7c 0e 00 00 75 19 6a 00 ff d3 6a 00 6a 00 8d 44 24 48 50 6a 00 6a 00 ff d5 8b 0d 64 4e f8 02 81 fe e5 84 c1 09 7e 0a 81 7c 24 2c 0f 11 00 00 75 12 46 8b c6 99 83 fa 14 7c aa 7f 07 3d 30 c1 cf c7 72 a1 51 6a 00 ff 15 2c 20 43 00 8b 0d 08 a4 43 00 33 f6 a3 f4 31 f8 02 89 0d f4 07 fb 02 39 35 64 4e f8 02 76 10 8b c6 e8 56 e4 ff ff 46 3b 35 64 4e f8 02 72 f0 8b 35 80 20 43 00 bf f0 72 e9 00 8b ff 81 3d 64 4e f8 02 4d 09 00 00 75 04 6a 00 ff d6 83 ef 01 75 eb e8 d6 e3 ff ff e8 11 fe ff ff e8 0c e4 ff ff 5f 5e 5d 33 c0 5b 81 c4 30 04 00 00 c3 } $first_stage2 = {81ec3??4????68????????ff??????????a3????????b8????????ba????????b9????????eb??891424894c240481????????????81????????????81????????????81????????????81????????????81??????????????83e801c7??????????????????75??8b??????????538b??????????558b??????????5681??????????578b??????????89??????????33f6eb??81??????????75??6a??ff??????????6a??ffd78b??????????81??????????75??6a??ffd36a??6a??8d442448506a??6a??ffd58b??????????81??????????7e??817c242c0f11????75??468bc69983????7c??7f??3d????????72??516a??ff??????????8b??????????33f6a3????????89??????????39??????????76??8bc6e8????????463b??????????72??8b??????????bf????????8bff81??????????????????75??6a??ffd683ef0175??e8????????e8????????e8????????5f5e5d33c05b81c43??4????c3} $first_stage3 = {81ec3??4????68????????ff??????????a3????????b8????????ba????????b9????????[2-6]891424894c240481????????????81????????????81????????????81????????????81????????????81??????????????83e801c7??????????????????[2-6]8b??????????538b??????????558b??????????5681??????????578b??????????89??????????33f6[2-6]81??????????[2-6]6a??ff??????????6a??ffd78b??????????81??????????[2-6]6a??ffd36a??6a??8d442448506a??6a??ffd58b??????????81??????????[2-6]817c242c0f11????[2-6]468bc69983????[2-6][2-6]3d????????[2-6]516a??ff??????????8b??????????33f6a3????????89??????????39??????????[2-6]8bc6e8????????463b??????????[2-6]8b??????????bf????????8bff81??????????????????[2-6]6a??ffd683ef01[2-6]e8????????e8????????e8????????5f5e5d33c05b81c43??4????c3} $first_stage4 = { 81 EC 30 04 00 00 68 6C 49 43 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? B8 DB D9 2B 00 BA C5 62 8E 76 B9 35 11 5F 39 EB ?? 8D A4 24 ?? ?? ?? ?? 8B FF 89 14 24 89 4C 24 ?? 81 04 24 25 10 A3 3B 81 04 24 CF E0 FB 07 81 04 24 35 26 9F 42 81 04 24 65 2B 39 06 81 04 24 3C 37 33 5B 81 44 24 ?? 48 4F C2 5D 83 E8 01 C7 05 ?? ?? ?? ?? 00 00 00 00 75 ?? 8B 0D ?? ?? ?? ?? 53 8B 1D ?? ?? ?? ?? 55 8B 2D ?? ?? ?? ?? 56 81 C1 01 24 0A 00 57 8B 3D ?? ?? ?? ?? 89 0D ?? ?? ?? ?? 33 F6 EB ?? 8D 49 ?? 81 F9 FC 00 00 00 75 ?? 6A 00 FF 15 ?? ?? ?? ?? 6A 00 FF D7 8B 0D ?? ?? ?? ?? 81 F9 7C 0E 00 00 75 ?? 6A 00 FF D3 6A 00 6A 00 8D 44 24 ?? 50 6A 00 6A 00 FF D5 8B 0D ?? ?? ?? ?? 81 FE E5 84 C1 09 7E ?? 81 7C 24 ?? 0F 11 00 00 75 ?? 46 8B C6 99 83 FA 14 7C ?? 7F ?? 3D 30 C1 CF C7 72 ?? 51 6A 00 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 33 F6 A3 ?? ?? ?? ?? 89 0D ?? ?? ?? ?? 39 35 ?? ?? ?? ?? 76 ?? 8B C6 E8 ?? ?? ?? ?? 46 3B 35 ?? ?? ?? ?? 72 ?? 8B 35 ?? ?? ?? ?? BF F0 72 E9 00 8B FF 81 3D ?? ?? ?? ?? 4D 09 00 00 75 ?? 6A 00 FF D6 83 EF 01 75 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5D 33 C0 5B 81 C4 30 04 00 00 C3} $files_encryption1 = { 8a 46 02 c1 e9 02 88 47 02 83 ee 02 83 ef 02 83 f9 08 72 88 fd f3 a5 fc ff 24 95 20 81 40 00 } $files_encryption2 = {8a4602c1e90288470283ee0283ef0283????72??fdf3a5fcff????????????} $files_encryption3 = { 8A 46 ?? C1 E9 02 88 47 ?? 83 EE 02 83 EF 02 83 F9 08 72 ?? FD F3 A5 FC FF 24 95 ?? ?? ?? ??} condition: filesize <= 300KB and any of ( $first_stage* ) and any of ( $files_encryption* ) } rule TRELLIX_ARC_RANSOM_Exorcist : RANSOMWARE FILE { meta: description = "Rule to detect Exorcist" author = "McAfee ATR Team" id = "38ab069d-b030-5459-a42f-7ecd5963e68f" date = "2020-09-01" modified = "2020-10-12" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Exorcist.yar#L1-L25" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "793dcc731fa2c6f7406fd52c7ac43926ac23e39badce09677128cce0192e19b0" logic_hash = "c376382e60aae0f661151495097d3d93f185faebb11781dbf083324c23a07247" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransomware:W32/Exorcist" actor_type = "Cybercrime" actor_type = "Cybercrime" actor_group = "Unknown" strings: $sq1 = { 48 8B C4 48 89 58 08 48 89 70 10 48 89 78 18 4C 89 60 20 55 41 56 41 57 48 8D 68 A1 48 81 EC 90 00 00 00 49 8B F1 49 8B F8 4C 8B FA 48 8B D9 E8 ?? ?? ?? ?? 45 33 E4 85 C0 0F 85 B1 00 00 00 48 8B D7 48 8B CB E8 9E 02 00 00 85 C0 0F 85 9E 00 00 00 33 D2 48 8B CB E8 ?? ?? ?? ?? 45 33 C0 48 8D 15 ?? ?? ?? ?? 48 8B CB E8 ?? ?? ?? ?? 45 8D 44 24 01 48 8B D7 48 8B C8 E8 ?? ?? ?? ?? 48 8B D0 48 8B CB 48 8B F8 FF 15 ?? ?? ?? ?? 4C 89 64 24 30 45 33 C9 C7 44 24 28 80 00 00 E8 45 33 C0 BA 00 00 00 C0 C7 44 24 20 03 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 4C 8B F0 48 8D 48 FF 48 83 F9 FD 77 25 48 8D 55 2F 48 8B C8 FF 15 ?? ?? ?? ?? 4C 39 65 2F 75 3B 49 8B CE FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 48 8B CF E8 ?? ?? ?? ?? 4C 8D 9C 24 90 00 00 00 49 8B 5B 20 49 8B 73 28 49 8B 7B 30 4D 8B 63 38 49 8B E3 41 5F 41 5E 5D C3 48 8D 45 FB 4C 89 65 1F 4C 8D 4D FF 48 89 44 24 20 4C 8B C6 4C 89 65 07 48 8D 55 07 4C 89 65 FF 48 8D 4D 1F 44 89 65 FB E8 ?? ?? ?? ?? 45 33 C9 4C 8D 05 3C F5 FF FF 49 8B D7 49 8B CE FF 15 ?? ?? ?? ?? 48 8D 55 17 49 8B CE FF 15 ?? ?? ?? ?? 49 8B CE 44 89 65 F7 E8 ?? ?? ?? ?? 49 8B F4 4C 89 65 0F 4C 39 65 17 0F 8E 9D 00 00 00 C1 E0 10 44 8B F8 F0 FF 45 F7 B9 50 00 00 00 E8 ?? ?? ?? ?? 8B 4D 13 48 8B D8 89 48 14 89 70 10 4C 89 60 18 44 89 60 28 4C 89 70 30 48 8B 4D 07 48 89 48 48 48 8D 45 F7 B9 00 00 01 00 48 89 43 40 E8 ?? ?? ?? ?? 33 D2 48 89 43 20 41 B8 00 00 01 00 48 8B C8 E8 ?? ?? ?? ?? 48 8B 53 20 4C 8D 4B 38 41 B8 00 00 01 00 48 89 5C 24 20 49 8B CE FF 15 ?? ?? ?? ?? EB 08 33 C9 FF 15 ?? ?? ?? ?? 8B 45 F7 3D E8 03 00 00 77 EE 49 03 F7 48 89 75 0F 48 3B 75 17 0F 8C 6B FF FF FF EB 03 8B 45 F7 85 C0 74 0E 33 C9 FF 15 ?? ?? ?? ?? 44 39 65 F7 77 F2 48 8B 4D 07 E8 ?? ?? ?? ?? 48 8B 4D 1F 33 D2 E8 ?? ?? ?? ?? 49 8B CE FF 15 ?? ?? ?? ?? 4C 89 64 24 30 45 33 C9 C7 44 24 28 80 00 00 00 45 33 C0 BA 00 00 00 C0 C7 44 24 20 03 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 48 8B D8 48 8D 48 FF 48 83 F9 FD 77 51 48 8D 55 37 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B 55 37 45 33 C9 45 33 C0 48 8B CB FF 15 ?? ?? ?? ?? 44 8B 45 FB 4C 8D 4D 27 48 8B 55 FF 48 8B CB 4C 89 64 24 20 FF 15 ?? ?? ?? ?? 48 8B 4D FF E8 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? E9 14 FE FF FF 48 8B CF E8 ?? ?? ?? ?? 48 8B 4D FF E9 06 FE FF FF } $sq2 = { 48 8B C4 48 81 EC 38 01 00 00 48 8D 50 08 C7 40 08 04 01 00 00 48 8D 4C 24 20 FF 15 ?? ?? ?? ?? 48 8D 4C 24 20 E8 ?? ?? ?? ?? 48 81 C4 38 01 00 00 C3 } condition: uint16( 0 ) == 0x5a4d and any of them } rule TRELLIX_ARC_RANSOM_Darkside : RANSOMWARE FILE { meta: description = "Rule to detect packed and unpacked samples of DarkSide" author = "Marc Rivero | McAfee ATR Team" id = "ecbee92f-236a-5385-9566-502ef1c0aeda" date = "2020-08-11" modified = "2023-07-27" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Darkside.yar#L1-L23" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "9cee5522a7ca2bfca7cd3d9daba23e9a30deb6205f56c12045839075f7627297" logic_hash = "be16d65911336809be103ea667167228e6445de85fd47ecd9ff8b3d91e056693" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransom:W32/DarkSide" actor_type = "Cybercrime" actor_group = "Unknown" strings: $pattern_0 = { CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC558BEC5053515256570FEFC0660FEFC033DB8B7D088B450C33D2B910000000F7F185C0740B0F110783C7104885C075F585D27502EB5892B908000000F7F185C0740B0F7F0783C7084885C075F585D27502EB3B92B904000000F7F185C0740A891F83C7044885C075F685D27502EB1F92B902000000F7F185C0740B66891F83C7024885C075F585D27502EB02881F5F5E5A595B585DC20800558BEC5053515256578B750C8B7D088B451033D2B910000000F7F185C074110F10060F110783C61083C7104885C075EF85D27502EB6892B908000000F7F185C074110F6F060F7F0783C60883C7084885C075EF85D27502EB4592B904000000F7F185C0740F8B1E891F83C60483C7044885C075F185D27502EB2492B902000000F7F185C0740E66891F83C60283C7024885C075F285D27502EB048A1E881F5F5E5A595B585DC20C00558BEC53515256578B4D0C8B75088B7D1033C033DBAC8AD8C0E80480E30F3C0072063C09770204303C0A72063C0F7702045780FB00720880FB09770380C33080FB0A720880FB0F770380C35766AB8AC366AB4985C975BE6633C066AB5F5E5A595B5DC20C00558BEC53515256578B75088B7D0C55FCB2808A0683C601880783C701BB0200000002D275058A164612D273E602D275058A164612D2734F33C002D275058A164612D20F83DB00000002D275058A164612D213C002D275058A164612D213C002D275058A164612D213C002D275058A164612D213C074068BDF2BD88A03880747BB02000000EB9BB80100000002D275058A164612D213C002D275058A164612D272EA2BC3BB010000007528B90100000002D275058A164612D213C902D275058A164612D272EA568BF72BF5F3A45EE94FFFFFFF48C1E0088A06468BE8B90100000002D275058A164612D213C902D275058A164612D272EA3D007D000083D9FF3D0005000083D9FF3D8000000083D1003D8000000083D100568BF72BF0F3A45EE9FEFEFFFF8A064633C9C0E801741783D1028BE8568BF72BF0F3A45EBB01000000E9DDFEFFFF5D2B7D0C8BC75F5E5A595B5DC20800558BEC53515256578B7D088B450CB9FF00000033D2F7F185C074188BD868FF00000057E8AD00000081C7FF0000004B85DB75EA85D274075257E8970000005F5E5A595B5DC20800558BEC5351525657B9F0000000BEB2B640008B45088B108B58048B78088B400C89540E0C89440E08895C0E04893C0E81EA101010102D1010101081EB1010101081EF1010101083E91079D533D233C98B750C33DB8B7D108A81B2B6400002141E02D08AA2B2B64000438882B2B6400088A1B2B640003BDF7306FEC175DAEB0633DBFEC175D25F5E5A595B5DC20C00558BEC535152565733C0A3C2B84000A3C6B84000B9400000008D35B2B640008D3DB2B74000F3A58B7D088B15C2B840008B4D0C8B1DC6B840004F33C0029AB3B740008A82B3B740008AABB2B740008883B2B7400088AAB3B7400002C5478A80B2B74000FEC23007FEC975D18915C2B84000891DC6B840005F5E5A595B5DC2080053515256578D35047040008D3DCAB84000FF76FC56E891FEFFFF56E8864500008BD8FF76FC56E888FBFFFF8B46FC8D3406B915000000E85C010000AD5056E868FEFFFF56E85D4500008BD8FF76FC56E85FFBFFFF8B46FC8D3406B93D000000E833010000AD5056E83FFEFFFF5256E8334500008BD85AFF76FC56E834FBFFFF8B46FC8D3406B915000000E808010000AD5056E814FEFFFF5256E8084500008BD85AFF76FC56E809FBFFFF8B46FC8D3406B904000000E8DD000000AD5056E8E9FDFFFF5256E8DD4400008BD85AFF76FC56E8DEFAFFFF8B46FC8D3406B906000000E8B2000000AD5056E8BEFDFFFF5256E8B24400008BD85AFF76FC56E8B3FAFFFF8B46FC8D3406B901000000E887000000AD5056E893FDFFFF5256E8874400008BD85AFF76FC56E888FAFFFF8B46FC8D3406B903000000E85C000000AD5056E868FDFFFF5256E85C4400008BD85AFF76FC56E85DFAFFFF8B46FC8D3406B901000000E831000000AD5056E83DFDFFFF5256E8314400008BD85AFF76FC56E832FAFFFF8B46FC8D3406B902000000E8060000005F5E5A595BC3ADFF76FC56E80AFDFFFF515653E8F743000059ABFF76FC56E8FFF9FFFF8B46FC8D34064985C975D8C3558BEC81EC1401000053515256578D85ECFEFFFF50FF1516B940008BB5F0FEFFFF8BBDF4FEFFFF83FE05750583FF01720583FE057313B8000000005F5E5A595B8BE55DC3E9DA00000083FE05751883FF017513B8330000005F5E5A595B8BE55DC3E9BD00000083FE05751883FF027513B8340000005F5E5A595B8BE55DC3E9A000000083FE06751785FF7513B83C0000005F5E5A595B8BE55DC3E98400000083FE06751583FF017510B83D0000005F5E5A595B8BE55DC3EB6A83FE06751583FF027510B83E0000005F5E5A595B8BE55DC3EB5083FE06751583FF037510B83F0000005F5E5A595B8BE55DC3EB3683FE0A751485FF7510B8640000005F5E5A595B8BE55DC3EB1D83FE0A750583FF00770583FE0A760EB8FFFFFF7F5F5E5A595B8BE55DC3B8FFFFFFFF5F5E5A595B8BE55DC3558BEC83C4F853515256576A0068800000006A026A006A006800000040FF7508FF1526B940008945FC837DFCFF74226A008D45F850FF7510FF750CFF75FCFF1536B9400085C07409FF75FCFF153EB940005F5E5A595B8BE55DC20C008BFF558BEC5351525657837D0C0074728D3DAABA4000837D100075086A1057E842F8FFFFFF750CFF750868EFBEADDEFF15F6B84000FF750CFF750850FF15F6B840003107FF750CFF750850FF15F6B84000314704FF750CFF750850FF15F6B84000314708FF750CFF750850FF15F6B8400031470CB8AABA40005F5E5A595B5DC20C00B8000000005F5E5A595B5DC20C00558BEC5351525657FF7508FF15DEB8400083C4048BD88D045D02000000506A00FF35AEB64000FF15BEB940008BF085F67434FF750856FF15CEB8400083C4088D43016A006A0050FF75086AFF566A006A00FF1506BA4000566A00FF35AEB64000FF15C6B940008BC35F5E5A595B5DC2040053515657833DBABA400000750B68BABA4000FF15F2B8400068BABA4000FF15F2B840008BD15F5E595BC3558BEC5351525657BB080000008B7508E8C1FFFFFF83FB05750433C033D28944DEFC8954DEF84B85DB75E55F5E5A595B5DC204008D4000558BEC81EC0001000053515256578D45B083C00F83E0F089850CFFFFFF8D8560FFFFFF83C00F83E0F0898508FFFFFF8D8510FFFFFF83C00F83E0F0898504FFFFFF837D14000F84750300008BB504FFFFFF0F57C00F11060F1146100F1146200F1146308B75088BBD0CFFFFFF0F10060F104E100F1056200F105E300F11070F114F100F1157200F115F30837D1440732A8B4510898500FFFFFF8B9504FFFFFF8BFA8B750C8B4D148A440EFF88440FFF4985C975F389550C8955108BB50CFFFFFF8BBD08FFFFFF0F10060F104E100F1056200F105E300F11070F114F100F1157200F115F305556BD0A0000008B078B5F108B4F208B57308BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C68907895F10894F208957308B47148B5F248B4F348B57048BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C6894714895F24894F348957048B47288B5F388B4F088B57188BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C6894728895F38894F088957188B473C8B5F0C8B4F1C8B572C8BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C689473C } $pattern_1 = { 70211F3B6E97C50000473D000000A000004602003EBBFF1F92CC558BEC5053515256570FEFC0660333DBFBFFEDFF8B7D088B450C33D2B9100000F7F185C0740B0F110783C710480A692EFB7F75F585D27502EB5892B9081C7F08B60F592E3B040A891F38049B641979F61F02661CD6FEBFEC023802881F5F5E5A595B585DC25D977E20634F8B750C9110110F1006252383FD94C61097EF6819AC59BA226F7F089DEFD8EE0119450F8B1E82C604A23E033232F1240EC602B9EC91C1A5F2048A1EA70CA12CCBD9A64D757D42E9FEFFBFAC8AD8C0E80480E30F3C0072063C09770204303C0A090FB66F6DBB5780FB140804150380C3300C0ADADFFE790F5766AB8AC3034985C975BE6646FF252CD6096564610C55FCB2806FDF86DB8A069701887801BBAD0299058A164FD62EFB4612D273E60A4F430C0F83DB7F2A7B602613C00A74068BDF2BD821EC63DB8A03644762EB9BB80142900BFBFB72EA2BC3BB1C7528B923C96F7FFB1F568BF72BF5F3A45EE94D01D248C1E008C3468BE8DE1EC26E0C0449303D007D4B83D9FF0DD93CD907058000D100BDB01BF250F04C33C974017417B1D8B0B61902561B96204B06E1C25D2B398BC75208111AEE18EDB9FF2660F4F8EFDDF7188BD8680E579B03D981C70B4B85DB75EAEE94CD5EFE7407521546B9F0256F7F6BB7BE02A6B24D50108B58048B7807400C895FF7FFDB540E03440E08895C0E04893C0E81EA10002D048168ED9FB1EB05EF83E91079D57EC0DFFFFDE4EC80108A814A02141E02D08AA20A436BFFBFDF88820688A1053BDF7306FEC175DAEB062C076E0B29A3D227F8A327A8C27DFBEDFE04C6B940998D35378D3D05A7B2F3A57DBC8FF7F31520B41D242A9A1BFB8DDD1CB38A8205AB28888305AA11D88DFFFE02C5478A800EFEC23007FEA0D189402F9684D8893D0D7C6BF07BF8CF6004A8CAFF76FC5630040549FF33FFDBAC59109C0C8B46FC8D3406B9150F477291BD05F0AD50283D52C252D961295A532A02B902BB04550608B902B90103E10843260299C3AD8615B2BF2751565333F959AB329FE0EEF874D8C33F81EC1468C885ECFE7777DFF0FFFF50FF4FA9168BB5F00C8BBDF40583FE055877F74BA483FF017205097313B86D00695BF36DFA8BE55DC36C073C2118751C3300D21C210234DF04D2FD06751785FF1B3C1555109AC11EC8B83DEB6A19023EA419644250033FC866DE2636690A75141864FECDEE4C1DDE00770A760EB8FFFFFF7F1B927C490DFF3083C4AEFD7A84F82D6A0068976A02080AFE8FB07509405A083B268945FC837DFCFF7422916D73DF188D45F85072020C1DFC34ECB0AE3672090C3E59746B43DACC8BFFCE3C0D7472E1AD44FB51AAAA0B04576A1057BC67BF3F16470868EFBEADDE3FA8F6105090BDB0670C31070E47040F92F50EC9080CB8624E071B5913D85CD6A8DE6D1FDF6AF9E4D88D045D6D50DAFF58F78F7D63AEC6BE8BF085F6743429562ADDDCE1CBCE088D430119FDBDFF56B027ECEF0A1AAA065639C68BC37077FB9C630484FAF4BAF10B6807A31DB0B14CF20A8BD12DE09A3871989ABBFD24E84013CB376608A783FB048DD2D90317B87FDEFC87DEF8C4E55D49C628308D17EE000DC32FF145B083C027E0F089850CE3FD202387B960051108102B99FE37040B7D14000F8475C41E0FA6DBC5F60F571C119846100320ED17EF8930B1BD4EB0104E17D32CDBCB1056105E3026074F57CDE6E26E5F304840732AE457008B6FF017BF954D8BFAFB4D148A3FFF88447B6DFBD30FFFA3F389550C02106E5359FDF0A964085556BD0A14078B5F6FFFDFBE354F208B5792F003F2C1C60733DE8BF303F0080933CEED2FFFF28BF103F30D33D68BF203F11233C68907892ECBB26D96898947143A243404CBD612202F3B24342CCBB22C0428380818CBB25C802838081820CBB22C3C0C1C2CDFB22C173C0C1C2CED0463476063760CED04750C53606363ED187510ED18D80863637510ED2C6424ED3036C2142C6524ED30234C818D6538ED3065386DA30DFC4D85ED0F851B975E5DF30702CBE5726BC80357105F1867206FB6022F972877307F380F0C024EE572B9DC1EFE56FE5EFE66FE6EA6D996CBFE76FE7E7F3D7F7F94A6699A7F7F7F7F7F9AE5C8708D6B5757575D8C966B57BED8FE2011BFE4B834118B9DA7274320837B2086F1B195000824E977EF1866C335DB32C500E4B2BD154E8B55BA338942200524B5655BFA24EB16831940030C6D370297C0237485CAFC86C21297EE1A818880308D7D80F3B920B16FE21DF2F3ABB900DF518D7580F810CD33E7FED1168D7604E2F92175128B06194DA6ECED078D7F17F473181911C9600933C441290CD5BB0A5B5B59F033E476B05505E00CEDAA9BBDB266E03AA5D908A6BFB960DDDFFCDD4FE0C64580018BA98F7EF05D0C81C379B981A849B1BE07D84150F8510851FC8DAB8360115F547B8D626FADBB1D508D3B50E874D3815240D3E0BF6563F02203740F9908199BBB4B1961646306AE9B780C830627307DC7E63041B73BDB06F8410ECB8A369391B8D51A68A41F000B8278E2C406CE1F0926023676729008AA12F80C1A24446B4B22170E54206317F226F8C37EF45B18B8C3F8EF238B71C65E4E62F475F8F46A0514066C737F01CE04EB43EB3F3D310A1B1CB5D84CD837C2EBC60D2C5A839117A1C12C4468F7BBA5196AD2C86AD6616CDBD8288E2E33ED3CAD1D14C3999178FF733C02CA74D72E71A1A14402EBFC1C332275D4565858CA5D4F846D35570F06E6AC62895FE9BF454B183B480875278D1F30AABEC220586C3BEA0F2C3A0E186BD5E850C63826070017E40793C5F30C0262CC0D776B110D6F68081017F4FDDD58B2C77568040110976256A3D8B3C4B2CC11D3D23DE2DB4636F677FC57FB571F34102048BC03A1088DA3ADD5456CD8C2BE227A30C3A3B18D922A9B1C2C6A9BDB095B62106E38E18B5E12C37BD86CB0403753132F6E56A573B367B10FBC59A8EE97CD409E848530675464A1183064849F924030C31A2C72E1248313F88D1DCF6C125B166CECFC53EC531BB519E4027936286BC0D263936C0F6A245FD4C70B24B15766738C09E89B4A2C585392A89C53325426816407AA7E5111040C8D9913E810EF52A937B527344930AA660C5E017648727CC960E3F07304ADA50B27ACDB8F2D60F0B5833EAF15107A641F05D019EBCCCBACDD2578763D4FA9744A4A0FFC0618E9E3147A6517C1293AECB517D9F88B122E0146336C2CD67D7C5224760B1D0E08506FC8096E7ACA96504FB6B1B1463FD3A6521911F424E1FC5A0142A91AD9A722EC3EEE6B18B26B1C3D7DB1D75EAFFC8D7531831C8535BF8E68EB803FAA5219367958D984534FBE3C1B690664B0B03CCC09209966A401B44050C83336C9ECA29D0004D88465B109215A244576CF58C96AF0346AF4AE9D3DB360BC0E3989C005A9247508F153A7A564036F644553F675A3D4253BAC3956120C5AEBE66EC682D922722568F4C058B36FD730DAEDB57D14450DAA0BD716168151969EAE69921D76C8D85E08626E130C9C11C00D07C160C7846481EDFF72C8A1BDE3DF9F813C18DEADBEEF980340EBF2C631F9EC4E04136DA456A4A1FC8EAC7E73C8C1E0068BD82373CCBB46C6DE01B16A1630408086A44CB2810B2C2F3616500A17F3DE5F0BAB8EAEA556561FFBE5B2F6150A374D358D83E6070A67B303593A5A56223D5A89E4C8254EB60FE492B3D95E56223D5E4FD9EC447286176256223D223972C96250561FB9E46C766656223D6641363B911C26276A56223D488E5C726A51F62E72362B90C7223D6E9D488E5C52C6367256472E399B223D724B963E9CCD4E247656223D7627922397537E427A56964BCE66223D7A545890672269727E72CCA759E47E0AC8A912678203C11A01B23557FBC2E08A53D968243106BE91ACB86472A8C319698152773D833C038C907C420BB3345B061008091C095EE251887010EBDE251B5A160CE0FD66B80904A10B9566ABE74C161266A4D19EE614ECA72DE3F8DC0F84A129461DF421D89E3DE828139F83DA062D4FEEF350ECD3AEFCF6EB6399F833D285D255B390DB6BFDC90530940107A842EB14BB162E2CC12B8B1BD4CB4D33C9192BFFAE400830040E4183F9080E04AC5F713904576A57014C7042E2C8681122C63664F381D8ED9E70B470B8182C883DA58E0EFFE62C080B5B180C256C469348D2C1B408AC1CEC840704300A44AA0EBBB6044381DC0C4BA62EEA1D487CDA4AE10E58D4DC194871F43A5F5DB37064FBF086F034798B83C9A26B096057B0571E7F83172666FD47FE5CFA66C704475C00D565F15702444702D9EB3D62598B151A11EA0B3531B614F06592BA0E46348A5D3932DAC81B1A386C90410C03802C26E0B1CCCD19502B1B035C4379AA3ACD09D534968523BBEB6953CCECBFEC511DB68B27C8F4CB75EC39326FD94ED2820BEB1E27F41821E12E7548293B02750759AC12C23B9616FF57C6082997A5EC1C846C4EC80C6D026D0630968DE46D06251CA43358A41AF84F9CD06CEBA91B5C107EDA562CE1F7C049A5AE83702B0CCB523367A364CD46000B08DD35AD8C91877A08E63C5798CC25C3AC9C86AD927DC615A3A3DC53E7CA217946B6431A1010E864489E911414F0183891906718F8A44D6148561EEBA0D3363ACC9DD08BC8C45110BA36D092BA42CE140510960626A37C49D0736C658C67F0524156E89E609103 } condition: $pattern_0 or $pattern_1 and filesize < 5831344 } rule TRELLIX_ARC_RANSOM_Darkside_DLL_May2021 : RANSOM FILE { meta: description = "Rule to detect Darkside Ransomware as a DLL" author = "TS @ McAfee ATR" id = "e9d64637-dc8f-5650-81e1-34e27e6ee912" date = "2021-05-14" modified = "2023-07-27" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Darkside.yar#L26-L47" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "f587adbd83ff3f4d2985453cd45c7ab1" logic_hash = "39930b6f352642647ea6b80f941201b93d6a9defd42cb75f9e4f7239ff17a4ec" score = 75 quality = 70 tags = "RANSOM, FILE" rule_type = "Public" rule_version = "v1" malware_type = "Ransom" strings: $s1 = "encryptor2.dll" wide ascii $s2 = "DisableThreadLibraryCalls" wide ascii $s3 = "KERNEL32.dll" wide ascii $pattern1 = {D24DC8855EDD487B3CD2D545F11031E1FA85C2F2440712445F67D105B326533A77BA75B3383A98CE97EAA2B95798DCFA6B75B5573662F9ED5DC9B7D2E582FD94104E210F3EA62A1826B26B952FFBD5A70A97E6EC3D14794577A2980A0ED1EE02CA291623DD3721A7E68223EDA56F9E1325FE36E191D5C41F7227D55EDC3D5B9359C819} $pattern2 = {87FC982E066F585B73D417C0D5F75B86B9F9F8286B4CC42BB2053912D595A68C07C0EDD0159AC785880C5483E246D3501F6523D05078B9B7510711423948D4CB367C83C0833BD04AD6DC655E1BEEA38770470BB48B6EBA70944E952526E4D87A03BAA485D7B4DA1318A00EF07FA76C0D} $pattern3 = {1B6F099F1C3C62BBF5543FA03B919C7BF5E477D256CE79D98C55ACE8D69CDC9373B2F0A2B51414776D5226B74BF9A7CB935C9DD04BCFC19FC81418F7A39244A730697E1BC05418BF41DE50E4C8609533591CE80617D476E686B36CF2AE914CB3AFD720A33C0D5DE438F1CD0B} $pattern4 = {5060E373F1D3B3BB8D15C851BBFC73F60390681C488F7C0B80FC2EDBC1ED88CEA82014B9223A70EA0BB7DD0D2560A29D39381FEE7B73AE22683AE05C369918F8C5772678A9F29CEF65854238D1C2B762CC12706637154F57A9} $pattern5 = {EE452560DBD5A4F46FB562C9C707C8D014BB8F1C18E4467E249F5AC69A87954F5B69650B7A759CE2DD075E99CBCBA37A9C5A0650EDF06285F8F990AF6B94FBA08E3C0B2EBDE3C155ECDB06C30F95D76695} condition: filesize >= 45KB and filesize <= 70KB and all of ( $s* ) and 4 of ( $pattern* ) } rule TRELLIX_ARC_Megacortex_Signed : RANSOMWARE FILE { meta: description = "Rule to detect MegaCortex samples digitally signed" author = "Marc Rivero | McAfee ATR Team" id = "78a74e30-4de0-5e63-8ca5-31251c296f98" date = "2026-10-01" modified = "2020-08-14" reference = "https://blog.malwarebytes.com/detections/ransom-megacortex/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_MegaCortex.yar#L3-L26" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" logic_hash = "8ffced3aca837682fbd7ee68f559f73b8299cbfbe198f48124c4857680735249" score = 75 quality = 70 tags = "RANSOMWARE, FILE" malware_type = "ransomware" malware_family = "Ransom:W32/MegaCortex" actor_type = "Cybercrime" actor_group = "Unknown" condition: uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "/C=GB/L=ROMFORD/O=3AN LIMITED/CN=3AN LIMITED" and pe.signatures [ i ] . serial == "04:c7:cd:cc:16:98:e2:5b:49:3e:b4:33:8d:5e:2f:8b" or pe.signatures [ i ] . subject contains "/C=GB/postalCode=RM6 4DE/ST=ROMFORD/L=ROMFORD/street=8 Quarles Park Road/O=3AN LIMITED/CN=3AN LIMITED" and pe.signatures [ i ] . serial == "53:cc:4c:69:e5:6a:7d:bc:36:67:d5:ff:d5:24:aa:4b" or pe.signatures [ i ] . subject contains "/C=GB/postalCode=RM6 4DE/ST=ROMFORD/L=ROMFORD/street=8 Quarles Park Road/O=3AN LIMITED/CN=3AN LIMITED" or pe.signatures [ i ] . serial == "00:ad:72:9a:65:f1:78:47:ac:b8:f8:49:6a:76:80:ff:1e" ) } rule TRELLIX_ARC_Cryptonar_Ransomware : RANSOMWARE FILE { meta: description = "Rule to detect CryptoNar Ransomware" author = "Marc Rivero | McAfee ATR Team" id = "0911250f-fc1f-58bc-ac09-d77d2a2ed3ce" date = "2026-10-01" modified = "2020-08-14" reference = "https://www.bleepingcomputer.com/news/security/cryptonar-ransomware-discovered-and-quickly-decrypted/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_CryptoNar.yar#L1-L36" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" logic_hash = "04c1c4f45ad3552aa0876c3b645c6ca92493018f7fdc5d9d9ed26cf67199d21b" score = 75 quality = 70 tags = "RANSOMWARE, FILE" malware_type = "ransomware" malware_family = "Ransom:W32/CryptoNar" actor_type = "Cybercrime" actor_group = "Unknown" strings: $s1 = "C:\\narnar\\CryptoNar\\CryptoNarDecryptor\\obj\\Debug\\CryptoNar.pdb" fullword ascii $s2 = "CryptoNarDecryptor.exe" fullword wide $s3 = "server will eliminate the key after 72 hours since its generation (since the moment your computer was infected). Once this has " fullword ascii $s4 = "Do not delete this file, else the decryption process will be broken" fullword wide $s5 = "key you received, and wait until the decryption process is done." fullword ascii $s6 = "In order to receive your decryption key, you will have to pay $200 in bitcoins to this bitcoin address: [bitcoin address]" fullword ascii $s7 = "Decryption process failed" fullword wide $s8 = "CryptoNarDecryptor.KeyValidationWindow.resources" fullword ascii $s9 = "Important note: Removing CryptoNar will not restore access to your encrypted files." fullword ascii $s10 = "johnsmith987654@tutanota.com" fullword wide $s11 = "Decryption process will start soon" fullword wide $s12 = "CryptoNarDecryptor.DecryptionProgressBarForm.resources" fullword ascii $s13 = "DecryptionProcessProgressBar" fullword wide $s14 = "CryptoNarDecryptor.Properties.Resources.resources" fullword ascii condition: ( uint16( 0 ) == 0x5a4d and filesize < 2000KB ) and all of them } rule TRELLIX_ARC_Wannaren_Ransomware : RANSOMWARE FILE { meta: description = "Rule to detect WannaRen Ransomware" author = "McAfee ATR Team" id = "f4f30d12-547d-5044-a4e5-b88bf359480f" date = "2020-04-25" modified = "2020-10-12" reference = "https://blog.360totalsecurity.com/en/attention-you-may-have-become-a-susceptible-group-of-wannaren-ransomware/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_wannaren.yar#L1-L34" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "7b364f1c854e6891c8d09766bcc9a49420e0b5b4084d74aa331ae94e2cfb7e1d" logic_hash = "0feb913b84eb0ecdda688f0cf0a5051798fe4fbce8a6ea959825985a81a6699c" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransom:W32/WannaRen" actor_type = "Cybercrime" actor_group = "Unknown" strings: $sq0 = { 92 93 a91c2ea521 59 334826 } $sq1 = { d0ce 6641 c1e9c0 41 80f652 49 c1f94d } $sq2 = { 80f8b5 4d 63c9 f9 4d 03d9 41 } $sq3 = { 34b7 d2ea 660fbafa56 0f99c2 32d8 660fbafaed 99 } $sq4 = { f9 f7c70012355f 35c01f5226 f9 8d8056c800b0 f6c4b2 f9 } $sq5 = { f5 f9 44 3aeb 45 33cd 41 } $sq6 = { 890f c0ff12 44 b4a3 ee 2b4e70 7361 } $sq7 = { 81c502000000 6689542500 6681d97a1e 660fabe1 660fbae1a5 8b0f 8dbf04000000 } $sq8 = { 8d13 de11 d7 677846 f1 0d8cd45f87 bb34b98f33 } $sq9 = { 1440 4b 41 e8???????? 397c0847 } condition: uint16( 0 ) == 0x5a4d and filesize < 21000KB and 7 of them } rule TRELLIX_ARC_Ransom_Babuk : RANSOM T1027 T1083 T1057 T1082 T1129 T1490 T1543_003 FILE { meta: description = "Rule to detect Babuk Locker" author = "TS @ McAfee ATR" id = "7c0a3b4e-90aa-5442-aa5e-1a7fcae9bec8" date = "2021-01-19" modified = "2021-02-24" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_BabukLocker_Jan2021.yar#L1-L25" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "e10713a4a5f635767dcd54d609bed977" logic_hash = "123cebd1c2e66f3e91ee235cb9288df63dfaeba02e6df45f896cb50f38851a8f" score = 75 quality = 70 tags = "RANSOM, T1027, T1083, T1057, T1082, T1129, T1490, T1543.003, FILE" rule_version = "v2" malware_family = "Ransom:Win/Babuk" malware_type = "Ransom" mitre_attack = "T1027, T1083, T1057, T1082, T1129, T1490, T1543.003" strings: $s1 = {005C0048006F007700200054006F00200052006500730074006F0072006500200059006F00750072002000460069006C00650073002E007400780074} $s2 = "delete shadows /all /quiet" fullword wide $pattern1 = {006D656D74617300006D65706F63730000736F70686F730000766565616D0000006261636B7570000047785673730000004778426C7200000047784657440000004778435644000000477843494D67720044656657617463680000000063634576744D67720000000063635365744D677200000000536176526F616D005254567363616E0051424643536572766963650051424944505365727669636500000000496E747569742E517569636B426F6F6B732E46435300} $pattern2 = {004163725363683253766300004163726F6E69734167656E74000000004341534144324457656253766300000043414152435570646174655376630000730071} $pattern3 = {FFB0154000C78584FDFFFFB8154000C78588FDFFFFC0154000C7858CFDFFFFC8154000C78590FDFFFFD0154000C78594FDFFFFD8154000C78598FDFFFFE0154000C7859CFDFFFFE8154000C785A0FDFFFFF0154000C785A4FDFFFFF8154000C785A8FDFFFF00164000C785ACFDFFFF08164000C785B0FDFFFF10164000C785B4FDFFFF18164000C785B8FDFFFF20164000C785BCFDFFFF28164000C785C0FDFFFF30164000C785C4FDFFFF38164000C785C8FDFFFF40164000C785CCFDFFFF48164000C785D0FDFFFF50164000C785D4FDFFFF581640} $pattern4 = {400010104000181040002010400028104000301040003810400040104000481040005010400058104000601040006C10400078104000841040008C10400094104000A0104000B0104000C8104000DC104000E8104000F01040000011400008114000181140002411400038114000501140005C11400064114000741140008C114000A8114000C0114000E0114000F4114000101240002812400034124000441240005412400064124000741240008C124000A0124000B8124000D4124000EC1240000C1340002813400054134000741340008C134000A4134000C4134000E8134000FC134000141440003C144000501440006C144000881440009C144000B4144000CC144000E8144000FC144000141540003415400048154000601540007815} condition: filesize >= 15KB and filesize <= 90KB and 1 of ( $s* ) and 3 of ( $pattern* ) } rule TRELLIX_ARC_Netwalker_Ransomware : RANSOMWARE FILE { meta: description = "Rule to detect Netwalker ransomware" author = "McAfee ATR Team" id = "6fe75a64-77b8-5cb8-9365-a5336d4d1617" date = "2020-03-30" modified = "2020-11-20" reference = "https://www.ccn-cert.cni.es/comunicacion-eventos/comunicados-ccn-cert/9802-publicado-un-informe-de-codigo-danino-sobre-netwalker.html" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_netwalker.yar#L3-L28" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" logic_hash = "11da4b57f8d9ed1fdf053053a51870af2cbf4062cc1340087ee70c3e92a1baf6" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" note = "The rule doesn't detect the samples packed with UPX" strings: $pattern = { 8B????8B????89??C7????????????EB??8B????52E8????????83????8B????8B??5DC3CCCCCCCCCCCCCCCCCCCCCCCC558B??83????C7????????????83??????74??83??????72??83??????75??8B????E9????????C7????????????8B????33??B9????????F7??83????89????8B????8B????8D????51E8????????83????89????83??????0F84????????C7????????????C7????????????C6??????C6??????C6??????8B????3B????0F84????????8B????2B????39????73??8B????89????EB??8B????2B????89????8B????89????C7????????????8B????03????8B????2B??89????74??83??????7E??83??????7D??C7????????????8B????03????89????8B????518B????03????528B????03????50E8????????83????8B????03????89????83??????75??6A??8D????528B????03????50E8????????83????8B????83????89????8B????03????89????E9????????8B????8B????89??83??????74??8B????52E8????????83????8B????89??C7????????????8B????8B??5DC3CCCCCCCC558B??51B8????????6B????8B????0FB6????B9????????C1????8B????0FB6????C1????0B??BA????????D1??8B????0FB6????C1????0B??B9????????6B????8B????0FB6????C1????0B??B9????????C1????8B????89????B8????????6B????8B????0FB6??????B9????????C1????8B????0FB6??????C1????0B??BA????????D1??8B????0FB6??????C1????0B??B9????????6B????8B????0FB6??????C1????0B??B9????????6B????8B????89????BA????????6B????8B????0FB6??????B8????????C1????8B????0FB6??????C1????0B??B9????????D1??8B????0FB6??????C1????0B??B8????????6B????8B????0FB6??????C1????0B??B8????????6B????8B????89????B9????????6B????8B????0FB6??????BA????????C1????8B????0FB6??????C1????0B??B8????????D1??8B????0FB6??????C1????0B??BA????????6B????8B????0FB6??????C1????0B??BA????????6B????8B????89????81????????????75??8B????83????89????C7????????????EB??C7????????????B9????????6B????8B????0FB6????BA????????C1????8B????0FB6????C1????0B??B8????????D1??8B????0FB6????C1????0B??BA????????6B????8B????0FB6????C1????0B??BA????????C1????8B????89????B9????????6B????8B????0FB6??????BA????????C1????8B????0FB6??????C1????0B??B8????????D1??8B????0FB6??????C1????0B??BA????????6B????8B????0FB6??????C1????0B??BA????????6B????8B????89????B8????????6B????8B????0FB6??????B9????????C1????8B????0FB6??????C1????0B??BA????????D1??8B????0FB6??????C1????0B??B9????????6B????8B????0FB6??????C1????0B??B9????????6B????8B????89????BA????????6B????8B????0FB6??????B8????????C1????8B????0FB6??????C1????0B??B9????????D1??8B????0FB6??????C1????0B??B8????????6B????8B????0FB6??????C1????0B??B8????????6B????8B????89????B9????????6B????8B????0FBE????BA????????C1????8B????0FBE????C1????0B??B8????????D1??8B????0FBE????C1????0B??BA????????6B????8B????0FBE????C1????0B??BA????????6B????8B????89????B8????????6B????8B????0FBE??????B9????????C1????8B????0FBE??????C1????0B??BA????????D1??8B????0FBE??????C1????0B??B9????????6B????8B????0FBE??????C1????0B??B9????????C1????8B????89????B8????????6B????8B????0FBE??????B9????????C1????8B????0FBE??????C1????0B??BA????????D1??8B????0FBE??????C1????0B??B9????????6B????8B????0FBE??????C1????0B??B9????????D1??8B????89????B8????????6B????8B????0FBE??????B9????????C1????8B????0FBE??????C1????0B??BA????????D1??8B????0FBE??????C1????0B??B9????????6B????8B????0FBE??????C1????0B??B9????????6B????8B????89????8B??5DC3CCCCCC558B??B8????????6B????8B????C7????????????B8????????6B????8B????C7????????????B8????????6B????8B????0FB6????B9????????C1????8B????0FB6????C1????0B??BA????????D1??8B????0FB6????C1????0B??B9????????6B????8B????0FB6????C1????0B??B9????????6B????8B????89????BA????????6B????8B????0FB6??????B8????????C1????8B????0FB6??????C1????0B??B9????????D1??8B????0FB6??????C1????0B??B8????????6B????8B????0FB6??????C1????0B??B8????????6B????8B????89????5DC3CCCCCC558B??83????83??????75??E9????????8B????508D????51E8????????83????BA????????6B????8B????8B????83????B8????????6B????8B????89????B9????????6B????8B????83??????75??B9????????6B????8B????8B????83????BA????????6B????8B????89????83??????77??C7????????????EB??8B????83????89????8B????3B????73??8B????03????0FB6??8B????0FB6??????33??8B????03????88??EB??EB??C7????????????EB??8B????83????89????83??????73??8B????03????0FB6??8B????0FB6??????33??8B????03????88??EB??8B????83????89????8B????83????89????8B????83????89????E9????????8B??5DC3CCCCCCCCCCCCCCCC558B??83????C7????????????EB??8B????83????89????83??????7D??8B????8B????8B????8B????89??????EB??C7????????????EB??8B????83????89????83??????0F8E????????B9????????6B????B8????????C1????8B??????03??????BA????????6B????89??????B9????????6B????B8????????6B????8B??????33??????C1????B8????????6B????B8????????6B????8B??????33??????C1????0B??B8????????6B????89??????BA????????C1????B8????????6B????8B??????03??????B8????????C1????89??????B9????????C1????BA????????C1????8B??????33??????C1????B9????????C1????BA????????C1????8B??????33??????C1????0B??BA????????C1????89??????B8????????6B????BA????????C1????8B??????03??????B9????????6B????89??????B8????????6B????BA????????6B????8B??????33??????C1????BA????????6B????BA????????6B????8B??????33??????C1????0B??BA????????6B????89??????B9????????C1????BA????????6B????8B??????03??????BA????????C1????89??????B8????????C1????B9????????C1????8B??????33??????C1????B8????????C1????B9????????C1????8B??????33??????C1????0B??B9????????C1????89??????BA????????C1????B8????????6B????8B??????03??????B8????????C1????89??????B9????????6B????B8????????C1????8B??????33??????C1????BA????????6B????BA????????C1????8B??????33??????C1????0B??BA????????6B????89??????B9????????6B????B8????????6B????8B??????03??????B8????????6B????89??????BA????????6B????B9????????6B????8B??????33??????C1????B9????????6B????B9????????6B????8B??????33??????C1????0B??B9????????6B????89??????B8????????C1????B9????????6B????8B??????03??????B9????????C1????89??????BA????????6B????B9????????C1????8B??????33??????C1????B8????????6B????B8????????C1????8B??????33??????C1????0B??B8????????6B????89??????BA????????6B????B9????????6B????8B??????03??????B9????????6B????89??????B8????????6B????BA????????6B????8B??????33??????C1????BA????????6B????BA????????6B????8B??????33??????C1????0B??BA????????6B????89??????B9????????D1??BA????????6B????8B??????03??????BA????????D1??89??????B8????????6B????BA????????D1??8B??????33??????C1????B9????????6B????B9????????D1??8B??????33??????C1????0B??B9????????6B????89??????B8????????6B????BA????????6B????8B??????03??????BA????????6B????89??????B9????????6B????B8????????6B????8B??????33??????C1????B8????????6B????B8????????6B????8B??????33??????C1????0B??B8????????6B????89??????BA????????D1??B8????????6B????8B??????03??????B8????????D1??89??????B9????????6B????B8????????D1??8B??????33??????C1????BA????????6B????BA????????D1??8B??????33??????C1????0B??BA????????6B????89??????B9????????6B????B8????????6B????8B??????03??????B8????????6B????89??????BA????????6B????B9????????6B????8B??????33??????C1????B9????????6B????B9????????6B????8B??????33??????C1????0B??B9????????6B????89??????B8????????6B????BA????????6B????8B??????03??????BA????????6B????89??????B9????????6B????B8????????6B????8B??????33??????C1????B8????????6B????B8????????6B????8B??????33??????C1????0B??B8????????6B????89??????BA????????6B???? } $pattern2 = { CCCCCCCCCCA1????????C3CCCCCCCCCCCCCCCCCCCC538B??????5533??5785??74??8B??????85??74??8B????85??74??C1????50E8????????83????89??85??74??8B????5633??85??74??5653E8????????83????85??74??8B????85??74??8D??????89??????5150E8????????83????85??74??8B????8B??8B??????89????FF????8B????463B??72??39????B9????????5E0F44??5F8B??5D5BC35F5D33??5BC3CCCCCCCCCCCCCCCCCCCCCCCCCCCC535556578B??????85??74??83????74??8B????85??74??8B??????85??74??33??85??74??8B??????660F1F??????85??74??8B??53FF????E8????????EB??E8????????8D????8B??FF????8B??53FF??83????85??75??463B????72??5F5E5D33??5BC35F5E5DB8????????5BC3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC6A??FF??????FF??????E8????????83????C3CCCCCCCCCCCCCCCCCCCCCCCCCC6A??FF??????FF??????E8????????83????C3CCCCCCCCCCCCCCCCCCCCCCCCCC83????????????5674??8B??????85??74??56E8????????8B????50E8????????83????85??75??A1????????6A??83????5650E8????????83????85??75??56E8????????83????85??74??8D????66??????74??83????83????75??33??5EC383????74??A1????????6A??83????5150E8????????83????85??74??B8????????5EC3CCCCCCCCCCCCCCCCCCCC83????????????74??8B??????85??74??A1????????6A??83????5150E8????????83????85??74??B8????????C333??C3CCCCCCCCCCCCCCCCCCCCCCCCCCCC83????????????5674??A1????????83??????74??8B??????85??74??56E8????????8B??????????83????83????75??83??????74??66????????75??0FB7??83????72??83????76??83????66??????76??6A??8D????5650E8????????83????85??74??B8????????5EC333??5EC3CCCCCCCCCCCCCCCCCCCCCCCCCCCC83????????????74??A1????????83????????????74??8B??????85??74??6A??05????????5150E8????????83????85??74??B8????????C333??C3CCCCCC83????????????74??A1????????83????????????74??8B??????85??74??6A??05????????5150E8????????83????85??74??B8????????C333??C3CCCCCC83????????????74??8B??????85??74??A1????????83??????74??6A??83????5150E8????????83????85??74??B8????????C333??C3CCCCCCCCCCCCCCCC83????????????74??8B??????85??74??A1????????83??????74??6A??83????5150E8????????83????85??74??B8????????C333??C3CCCCCCCCCCCCCCCC83????????????5674??8B??????85??74??A1????????83??????74??51E8????????8B??83????85??74??8B??????????6A??83????5651E8????????83????85??74??B8????????5EC356E8????????83????33??5EC3CCCCCCCCCCCCCC535556576A??E8????????8B??83????85??0F84????????8B??660F1F??????0FB7????83????51E8????????8B??83????85??74??0FB7????51FF????57E8????????83????83????????????74??A1????????83??????74??6A??83????5750E8????????83????85??74??E8????????8B????3B????74??6A??51E8????????8B??83????85??74??E8????????6A??538B????FF??E8????????538B??????????FF??57E8????????83????8B??03??85??0F85????????55E8????????83????E8????????6A??8B??????????FF??E9????????CCCCCCCCCCCCCC83????5533??565739??????????0F84????????8B??????85??0F84????????8B??????85??0F84????????53E8????????8B??????????FF??83??????8B??74??E8????????FF????8B??????????FF??89??????E8????????8D??????516A??8B??????????8D??????516A??57FF??85??74??8B??????89????83????74??E8????????8B??????????FF??2B??3D????????77??83??????75??5B5F5E8B??5D83????C3BD????????5B5F5E8B??5D83????C35F5E33??5D83????C383????558B??????85??0F84????????5333??5733??89??????89??????E8????????8D??????518D??????8B??????????5157576A??FF????FF??85??0F85????????E8????????8B??????????FF??3D????????0F85????????FF??????E8????????83????89??????85??0F84????????56E8????????8D??????518D??????8B??????????51FF??????FF??????6A??FF????FF??85??74??33??39??????76??8B??????0F1F??????????E8????????8B??????68????????FF????8B??????????FF??FF??89??????8D????????????5053E8????????8B??83????85??74??FF??????68????????E8????????83????89????474683????3B??????72??8B??????FF??????E8????????83????85??74??85??74??E8????????6A??6A??538B??????????57FF??33??85??74??E8????????FF????8B??????????FF??463B??72??53E8????????83????5EE8????????8D??????516A??FF????8B??????????FF??5F5B85??74??8D??????50FF????E8????????83????E8????????FF????8B??????????FF??55E8????????83????33??5D83????C2????CCCCCCCCCCCCCCCCCCCCCCCC83????568B??????85??74??E8????????8D??????516A??8B??????????56FF??85??74??8D??????5056E8????????83????E8????????568B??????????FF??33??5E83????C2????CCCCCCCCCCCC83????83????????????5356570F84????????A1????????83??????0F84????????55E8????????68????????6A??6A??8B??????????FF??8B??89??????85??0F84????????660F1F????????????C7??????????????C7??????????????C7??????????????E8????????8D??????518D??????8B??????????518D??????516A??6A??6A??6A??55FF??85??0F85????????E8????????8B??????????FF??3D????????0F85????????FF??????E8????????83????89??????85??0F84????????E8????????8B??????8D??????518D??????8B??????????518D??????51FF??????566A??6A??55FF??85??0F84????????33??33??89??????39??????0F86????????0F1F??????????FF??E8????????83????85??75??FF????E8????????83????85??74??E8????????68????????FF??8B??????????55FF??89??????85??74??6A??E8????????8B??83????85??74??8B??????8D????????????5189????8B??????5389????E8????????8B??83????85??74??5568????????E8????????83????89????478B??????8B??????83????4089??????3B??????0F82????????85??74??85??74??E8????????6A??6A??538B??????????57FF??33??85??74??0F1F????E8????????FF????8B??????????FF??463B??72??53E8????????83????FF??????E8????????83????E8????????68????????8B??????????FF??E9????????5D5F5E33??5B83????C2????CCCCCC83????53558B??????565785??0F84????????8B????8D??????516A??55C7??????????????FF????85??0F88????????8B??????8D??????C7??????????????52508B??FF????85??0F88????????6A??8D??????6A??50E8????????33??83????B8????????66????????39??????0F8E????????8B??????8D??????5083????C7??????????????438B??89??????0F10??????8B??510F11??FF????85??0F88????????8B??????8D??????C7??????????????52508B??FF????85??0F88????????8B??????8D??????C7??????????????33??52508B??FF????83????????0F84????????FF??????E8????????83????85??0F85????????8B??????8D??????89??????52508B??FF????85??0F88????????8B??????8D??????89??????52508B??FF????85??0F88????????8B??????8D??????89??????52508B??FF????85??0F88????????33?? } $pattern3 = { CCCCCCCCCC558B??FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF?????????? } condition: uint16( 0 ) == 0x5a4d and any of ( $pattern* ) } rule TRELLIX_ARC_Netwalker_Signed : FILE { meta: description = "Rule to detect Netwalker ransomware digitally signed." author = "Marc Rivero | McAfee ATR Team" id = "6806b917-2e02-57e3-887a-b4c12db83653" date = "2020-03-30" modified = "2020-11-20" reference = "https://www.ccn-cert.cni.es/comunicacion-eventos/comunicados-ccn-cert/9802-publicado-un-informe-de-codigo-danino-sobre-netwalker.html" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_netwalker.yar#L30-L47" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" logic_hash = "d78ed22771d7c93516375afb8fd2fd7baa40a357ec3c247939a10d11f80ae226" score = 75 quality = 70 tags = "FILE" note = "The rule will hit also some Dridex samples digitally signed" condition: uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "/CN=EWBTCAXQKUMDTHCXCZ" and pe.signatures [ i ] . serial == "17:16:bb:93:fb:a9:a2:41:ba:a8:2e:c7:5e:ff:0c" or pe.signatures [ i ] . thumbprint == "a4:28:e9:4a:61:3a:1f:cf:ff:08:bf:e7:61:51:64:31:1a:6f:87:bc" ) } rule TRELLIX_ARC_Netwalker : RANSOMWARE FILE { meta: description = "Rule based on code overlap in RagnarLocker ransomware" author = "McAfee ATR team" id = "80097a40-534a-5e1b-8fde-e4d832d76698" date = "2020-06-14" modified = "2020-11-20" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_netwalker.yar#L49-L75" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" logic_hash = "8c56ebed9e097d294045de46942c708da9ba7e01475dcecb0c3d41fcc8004780" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" actor_group = "Unknown" strings: $0 = {C88BF28B4330F76F3803C88B434813F2F76F2003C88B433813F2F76F3003C88B434013F2F76F2803C88B432813F2F76F4003C8894D6813F289756C8B4338F76F388BC88BF28B4328F76F4803C88B434813F2F76F2803C88B433013F2F76F400FA4CE} $1 = {89542414895424108BEA8BDA8BFA423C22747C3C5C75588A023C5C744F3C2F744B3C2274473C6275078D5702B008EB3F3C6675078D5302B00CEB343C6E75078D5502B00AEB293C72750B8B542410B00D83C202EB1A3C74750B8B542414B00983C2} $2 = {C8894D7013F28975748B4338F76F408BC88BF28B4340F76F3803C88B433013F2F76F4803C88B434813F2F76F3003C8894D7813F289757C8B4348F76F388BC88BF28B4338F76F4803C88B434013F2F76F400FA4CE} $3 = {C07439473C2F75E380FB2A74DEEB2D8D4ABF8D422080F9190FB6D80FB6C28AD60F47D88AC6042080EA410FB6C880FA190FB6C60F47C83ACB754B46478A1684D2} $4 = {8B433013F2F76F0803C88B432013F2F76F1803C88B0313F2F76F3803C88B430813F2F76F3003C88B433813F2F72F03C8894D3813F289753C8B4338F76F088BC8} $5 = {F73101320E32213234329832E3320C332D334733643383339133A833BD33053463347C34543564358335AE36C3362937E9379A39BA390A3A203A443A183B2B3B} $6 = {8B431813F2F76F4803C88B432813F2F76F3803C88B434013F2F76F200FA4CE0103C903C88B432013F2F76F4003C88B433013F2F76F3003C8894D6013F2897564} condition: uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and all of them } rule TRELLIX_ARC_RANSOM_Suncrypt : RANSOMWARE FILE { meta: description = "Rule to detect SunCrypt ransomware" author = "McAfee ATR Team" id = "92655f3e-f8e4-5c9f-ae3f-0796bd31d660" date = "2020-10-02" modified = "2020-11-02" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Suncrypt.yar#L1-L25" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80" hash = "63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806" logic_hash = "9f27c6c5bfe0d01ed517d55687bf699814679488f95ce4942306f09f39e29d85" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransomware:W32/Suncrypt" actor_type = "Cybercrime" actor_group = "Unknown" strings: $pattern = { 77??2F475263????78??58436463????77??7A??5263????78??5846534D5A4678??48475263??????6B??????4D5A4679??7A??5263????78??584C5163????7A??44475264??5778??58526163????30????475264??30????58556463????31????475264??73??6B??????63????32????4752646C73??6B??????38????32??5047526477??6A??5738????68????????41555039????496C46374931????46446F62????414146442F565169????????????5039????466D4A526669??????????64??63????4F6D38????414169??????????586F69??????????33????30????69????????????6F41444141414974??38????41554542516167??2F5665??4478??434A526679??6666????64??63????4F6D444141414169??????????33??69????????????77??33????2F33????2F33????36??49464141434478??7A??64667A??64??7A??64??6A??73??7A??2F34??454449584164??517A??4F74??69??????????5834??5558672F33????2F33????36??6E362F2F39????59584164??517A??4F73??69??????????33??69????????????554B30????69????????????30????5838????5830????5549554974??4446434C525268????????30??39????77??444A77??574C37495073??4D5A4634??62????65??70??6B??????73??4634??54475265??31????586C5963????35????????65????78??586F63????4636??2F47526570??78??5872??63????37475047526531??78??5875??4931????46446F534163????46442F565169????????????66??51616B??????52434C51416A??63????4C5252442F63????2F566679??78??434677??55454D38??????475368????????41496C462B????462B????4E454974??49496C49434974??454974??434974??454974??49414E494B496C4E39????4639????517A??5041514D6E44565976??555974??434974??434974??434974??494474??4E4855464D38????367A??4C525169??????????????6C72??51574466??68????????454D38??????6F74??434974??434974??434974??494374??4E496C4E2F5039??2F4974??435039????4F6A??2B????2F57566E4A77??574C37494873??41414141494E6C6C4143445A6141416733??514148554969??????????30??????44475266??75??6B??????4D5A4638????475266??73??6B??????4D5A4639????475266??6B??????33????5A462B????4752666B??????5867??73??4634??6E475265??79??6B??????4D5A4635????????65??68????????62????4635????????65??????????70??63????366E4C47526574??78??5873??4D5A4630????475264??70??6B??????73??4630??54475264??31????58565963????31????475264????78??585962????4632????47526470??78??5862????5A4633????475262????78??5739????5A4676??54475262??4478??58416463????77??4C475263????78??58445A63????78??37475263????78??5847554D5A4678??4C475263????78??584A5938????79??58475263??????6B??????38????7A??44475261526178??576C64??????70??584752616475??6B??????63????71??4847526170??78??5772??73??4672??6E47526131??????5775??38????72??2F475262????78??5778??38????73??58475262????78??5730??????4674??6E475262????78??5733????5A4675??434E5265??5136??4D46414142512F31????69????????????51554F677A??514141555039????496C466E4931????46446F4977??414146442F565169????????????6152516A??5877??5039????46442F565169????????????52434C514269????????????4932????502F2F2F31??????667A??565A434677??515A67??32????414142414855433677??4C526677??68????????2F2B????667A??31????46454974??434974??454974??4E4474??47484A4D69??????????414969??????????5838????36??6661414164??69??????????????6A??565978??2F31????68????????32????61414177??41434C5252434C514169??????????????74??454974??435039????5039????495045454974??45496C4249476F4561414177??41434C5252434C514169??????????????74??454974??435039????5039????495045454974??45496C42494974??45494E34??414231????74??454974??43476F49575776??42594E38????77??64??474C5252434C514169??????????????534A51534472??476F4561414177??41434C5252434C514169??????????????6F412F31????67??????69??????????456769??????????67????48554636??67??4141434C5252434C51416A??63????4C5252442F63????4C5252442F63????6F30????4141495045444974??454974??434974??454974??43412B??5352534E524167??69????????????38????73??69??????????6C462F4974??454974??43412B??51415935????????4F5774??2F4369??????????????45516130????4B4974??454974??454974??6D414E4D4168????????5838????74??454974??494974??6D414E4D416778??36??59424141434478??7A??73??64??6C4145414141417A??412B????50372F2F34??466C4D6E44565976??555974??434974??434974??45496C49424974??434974??42412B??414431????67??4164??517A??4F73??69??????????414569??????????6B??????67??????554969????????????4969??????????68????????4164??517A?? } condition: uint16( 0 ) == 0x6441 and all of them } rule TRELLIX_ARC_RANSOM_Suncrypt_Decryptor : RANSOMWARE FILE { meta: description = "Rule to detect SunCrypt ransomware decryptor" author = "McAfee ATR Team" id = "ec0d3811-6083-5537-bf29-32ee02d43b5e" date = "2020-10-02" modified = "2020-11-02" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Suncrypt.yar#L27-L50" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "a0f99367b0a0a358ed6e5ae25904016d02aef6aa7c0423c34aa3ec3fd6354310" logic_hash = "59d1193bb0f8d3983a181394b5dd5247470d9e118cc4fe0674167f162bcdb6e1" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransomware:W32/Suncrypt" actor_type = "Cybercrime" actor_group = "Unknown" strings: $pattern = { 558BEC81EC88000000837D08008BC10F101A89957CFFFFFF0F104A10898578FFFFFF0F1062200F106A300F115D940F114DA40F1165B40F116DC40F8E340200008B45D08B4DC48B55B08945F88B45CC8945E08B45C88945E88B45C08945F08B45BC8945F48B45B8538B5DA88945EC8B45AC568B75A48945D48B45A0578975DC8945E48B459403C68BF033F18B4DB4C1C61003CE8BF9337DDCC1C70C03C78945DC33C6C1C0088945D803C18B4DEC89458833C7C1C0078945848B459803C38BF03375E8C1C61003CE8BF933FBC1C70C03C78945E833C6C1C00889458C03C18B4DF48BD88945EC33DF8B459C0345D48B7DE48BF03375E003FAC1C61003CEC1C307894DF4334DD4C1C10C03C133F08945908B45F0C1C6088975800375F433CEC1C107894DE08B4DF833CFC1C11003C133D08945F0C1C20C8D043A8B7DF033C88945E48B45DCC1C10803F9894DF833D7C1C20703C38BC8334DF8C1C11003F18975FC315DFC8B5DFCC1C30C03C389459433C1C1C0088945F88945D003C633D88945F48945BC8B45E80345E08BC8C1C307334DD8C1C110895DFC895DA88B5DEC8D340F8BFE337DE0C1C70C03C789459833C1C1C0088945D88945C403C68B758833F88945F08945C08B459003C2C1C7078BC8897DD4334D8CC1C11003F1897DAC8B7DE433D6037D84C1C20C03C289459C33C1C1C0088945E88945C803C633D08945B48BC7C1C207334580C1C01003D88BCB334D84C1C10C03F98BF7897DE433F0897DA0C1C60803DE8975E08975CC895DEC8B45088BF333F1895DB88B5DFC488B4DD8C1C6078975DC8975A489450885C00F8F30FEFFFF0F106DC48B8578FFFFFF0F1065B45F0F105D948955B00F104DA48B957CFFFFFF5E5B0F10020F105210660FFED80F104230660FFED10F104A200F1118660FFECC660FFEC50F1150100F1148200F1140308BE55DC3CCCCCCCCCCCCCCCCCCCC558BEC83E4F081EC58020000568BC18B4D1489442420578BFA897C24283D000100000F82680A0000660F6E07660F70C800660F6E4704660F70D000660F6E4708660F70D800660F6E470C660F70E000660F6E4710660F70E800660F6E47148B7508660F70F000660F6E47188B550C660F70F8008D8EC0000000660F6E471C660F70C0000F29842430010000660F6E4720660F70C0000F29842440010000660F6E4724660F70C0000F29842450010000660F6E4728660F70C0000F29842460010000660F6E472C894C240C8D8AC0000000660F70C000894C241C8D8E800000000F29842470010000660F6E4738894C24148D8A80000000660F70C000894C24188D4E400F29842480010000660F6E473C894C242C8D4A40660F70C000C1E8080F298C24A00100000F299424B00100000F299C24C00100000F29A424D00100000F29AC24E00100000F29B424F00100000F29BC24000200000F29842490010000894C24108944242066660F1F8400000000000F2884243001000033C00B47308B4F340F298424800000000F288424400100000F298424900000000F288424500100000F294424600F288424600100000F298424100100000F28842470010000894C244C8944244883C0040F298C24D0000000F30F7E4C244883D1000F298424200100000F288424900100000F299424E00000000F2815A02B4200660F6CC90F29442430660FD4D10F2805B02B42000F29A424A0000000660FD4C10F28E20F29B42400010000660F62E0660F6AD00F28F40F299C24F00000000F28DD0F28AC2480010000660F62F20F297C24700F28FE660F6AE2894F348B4D140F295C24500F29AC24C00000000F29A424B00000000F29BC24400200000F29A4245002000089473085C90F84820400000F287C24708BC166900F28D3660FFE9424D0000000660FEFF2660F380035C02B42000F28DE660FFE9C24900000000F28C3660FEF4424500F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942400010000660FFE9424E0000000660FEFF0660F380035D02B42000F29842490000000660FEFE2660F380025C02B42000F28C60F29742470660FFEC30F28DC660FFE5C24600F29842410020000660FEFC10F28C8660F72F007660F72D119660FEBC80F28C3660FEF8424000100000F298C24200200000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28D7660FFE9424F0000000660FEFE0660F380025D02B42000F29442460660FEFEA660F38002DC02B42000F28C40F29A424B0000000660FFEC30F28DD660FFE9C24100100000F29842430020000660FEFC10F28F0660F72F007660F72D619660FEBF00F28C3660FEFC70F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942480000000660FFE9424A0000000660FEFE8660F38002DD02B42000F294424500F28E50F29AC24C0000000660FFEE30F28C4660FEFC10F28F8660F72F007660F72D719660FEBF80F286C2430660FEFEA660F38002DC02B42000F28DD660FFE9C24200100000F28C3660FEF8424800000000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28D6660FEFE8660FFE942490000000660F38002DD02B42000F298424A00000000F296C2430660FFEEB0F28C5660FEFC10F28C8660F72F007660F72D119660FEBC80F28442430660FEFC20F298C2480000000660F380005C02B42000F28D80F29442430660FFEDC0F28C3660FEFC60F287424700F28C8660F72F00C660F72D114660FEBC80F284424300F28E1660FFEE20F28D7660FFE542460660FEFC4660F380005D02B4200660FEFF20F29A424D0000000660F380035C02B42000F29442430660FFEC30F298424100100000F28DE660FEFC1660FFEDD0F28C8660F72F007660F72D119660FEBC80F28C3660FEFC70F298C24000100000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942480000000660FEFF00F298424E0000000660F380035D02B42000F28C6660FFEC30F29842420010000660FEFC10F28F8660F72F007660F72D719660FEBF8660FFE5424500F28A424B00000000F28AC24C0000000660FEFE2660F380025C02B42000F28DC660FFE9C24100200000F28C3660FEF8424800000000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942420020000660FFE9424A0000000660FEFE00F298424F0000000660FEFEA660F380025D02B4200660F38002DC02B42000F29A424B00000000F28C4660FFEC30F28DD660FFE9C24300200000F29842490000000660FEFC10F28C8660F72F007660F72D119660FEBC80F28C3660FEF8424200200000F298C24800000000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F298424A0000000660FEFE8660F38002DD02B42000F29AC24C00000000F28C5660FFEC30F29442460660FEFC10F28D8660F72F007660F72D319660FEBD80F295C245083E8010F8594FBFFFF0F297C24700F28BC24400200000F28AC24A0010000660FFEAC24D00000000F28A424C00100000F28DD660FFEA424F00000000F288C24B00100000F28D4660FFE8C24E00000000F288424D0010000660FFE8424A00000008B44242C8B7C2414660F62D9660F6AE90F28CB660F6AE0660F62D00F10068344241410660F6CCA660FEFC8660F6DDA0F110A0F10008B4424100F28CD660F6DEC660FEFD8660F6CCC0F28A424000200000F111883C0100F10078B7C2418660FFE642470660FEFC883442418100F28D4894424100F110F8B7C240C0F288C24F0010000660FFE8C24000100008344240C100F10078B7C241C8344241C10660FEFE80F28842430010000660FFE8424800000000F112F8B7C242C0F28AC24E0010000660FFE6C24500F28DD660F62D0660F62D9660F6AE90F28CB660F6AE00F104610660F6CCA660FEFC8660F6DDA0F114A100F1047100F28CD660F6DEC660FEFD8660F6CCC0F11188B4424140F10008B442418660FEFC80F11088B44240C0F10008B44241C660FEFE80F11280F28AC2440010000660FFEFE660FFEAC24900000000F28A424600100000F28DD660FFEA424100100000F288C24500100000F28D4660FFE4C24600F28842470010000660FFE84242001000083442410108B4424108344241410660F62D98344241810660F6AE90F28CB660F6AE0660F62D00F1046208344240C10660F6CCA660FEFC88344241C100F114A200F104720660F6DDA0F28CD660FEFD8660F6CCC0F11188B44241483442414100F28DF660F6DEC0F28A424800100000F10008B442418660FFEA424C0000000660FEFC883442418100F28D40F11088B44240C0F288C2450020000660FFE8C24B00000008344240C100F10008B44241C660F62D9660FEFE8660F6AF90F288424900100000F28CB660FFE4424300F11288B442410660F62D083C010660F6AE00F1046308344241C10660F6CCA660FEFC8660F6DDA0F114A30894424100F1047300F28CF660F6DFC660FEFD8660F6CCC0F11188B4424140F10008B442418660FEFC80F11088B44240C0F10008B44241C660FEFF881442410D000000081C70001000081442418D000000081C2000100008144241CD000000081C60001000081442414D00000008144240CD00000000F288C24A00100000F289424B00100000F289C24C00100000F28A424D00100000F28AC24E00100000F28B424F00100000F11388B4424240F28BC24000200002D00010000836C242001897C242C8B7C2428894424240F85E2F6FFFFEB068B550C8B75088954241083F8400F829A010000C1E80689442420660F1F4400000F10370F1057100F107F200F106F3085C90F84F60000008BC10F1F80000000000F28DA660FFEDE660FEFEB660F38002DC02B42000F28E5660FFEE70F28C4660FEFC20F28C8660F72F00C660F72D114660FEFC80F28D1660FFED3660FEFEA660F70D293660F38002DD02B42000F28DD660F70ED4E660FFEDC660F70E3390F28C3660FEFC10F28C8660F72F007660F72D119660FEFC8660FFED1660FEFEA660F38002DC02B4200660FFEE50F28C4660FEFC10F28D8660F72F00C660F72D314660FEFD80F28C3660FFEC2660F70F039660FEFE8660F38002DD02B42000F28C5660F70ED4E660FFEC4660F70F8930F28C8660FEFCB0F28D1 } condition: uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them } rule TRELLIX_ARC_Sodinokobi : RANSOMWARE { meta: description = "This rule detect Sodinokobi Ransomware in memory in old samples and perhaps future." author = "McAfee ATR team" id = "dd05ce31-9699-50a9-944c-5883340791af" date = "2026-10-01" modified = "2025-03-18" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Sodinokibi.yar#L32-L53" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" logic_hash = "f25039ac743223756461bbeeb349c674473608f9959bf3c79ce4a7587fde3ab2" score = 75 quality = 70 tags = "RANSOMWARE" malware_type = "ransomware" malware_family = "Ransom:W32/Sodinokibi" actor_type = "Cybercrime" actor_group = "Unknown" version = "1.0" strings: $a = { 40 0F B6 C8 89 4D FC 8A 94 0D FC FE FF FF 0F B6 C2 03 C6 0F B6 F0 8A 84 35 FC FE FF FF 88 84 0D FC FE FF FF 88 94 35 FC FE FF FF 0F B6 8C 0D FC FE FF FF } $b = { 0F B6 C2 03 C8 8B 45 14 0F B6 C9 8A 8C 0D FC FE FF FF 32 0C 07 88 08 40 89 45 14 8B 45 FC 83 EB 01 75 AA } condition: all of them } rule TRELLIX_ARC_Ransom_Xinof : RANSOMWARE FILE { meta: description = "Detect Xinof ransomware" author = "Thomas Roccia | McAfee ATR team" id = "3b064ce4-cd5b-5a4a-bb55-a2c2c361791e" date = "2020-11-20" modified = "2020-11-20" reference = "https://labs.sentinelone.com/the-fonix-raas-new-low-key-threat-with-unnecessary-complexities/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_xinof.yar#L53-L82" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "0c1e6299a2392239dbe7fead33ef4146" logic_hash = "42110ee8869d56c53dc201cbc83652c6457541b8d502aa12b37ef6200e735a15" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransom/XINOF" actor_type = "Cybercrime" actor_group = "FONIX" strings: $s1 = "XINOF.exe" nocase ascii $s2 = "C:\\Users\\Phoenix" nocase ascii $s3 = "How To Decrypt Files.hta" nocase ascii $s4 = "C:\\ProgramData\\norunanyway" nocase ascii $s5 = "C:\\ProgramData\\clast" nocase ascii $s6 = "fonix1" nocase ascii $s7 = "C:\\Windows\\System32\\shatdown.exe" nocase ascii $s8 = "XINOF Ransomw" nocase ascii $s9 = "XINOF v4.2" nocase ascii $s10 = "XINOF Ransomware Version 3.3" nocase ascii condition: uint16( 0 ) == 0x5a4d and filesize < 2000KB and 5 of ( $s* ) or TRELLIX_ARC_Ransom_Xinof_Chunk_PRIVATE } rule TRELLIX_ARC_Nemty_Ransomware : RANSOMWARE FILE { meta: description = "Rule to detect Nemty Ransomware" author = "Marc Rivero | McAfee ATR Team" id = "e9b133d6-fd77-5201-995d-c42bae7cde46" date = "2020-02-23" modified = "2020-08-14" reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Nemty.yar#L1-L45" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "73bf76533eb0bcc4afb5c72dcb8e7306471ae971212d05d0ff272f171b94b2d4" logic_hash = "d055286670516318c14dcf4e5873b96eede5e1dfb3ee978553fc11f1ac6b3252" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransom:W32/Nemty" actor_type = "Cybercrime" actor_group = "Unknown" strings: $x1 = "/c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default}" fullword ascii $s2 = "https://pbs.twimg.com/media/Dn4vwaRW0AY-tUu.jpg:large :D" fullword ascii $s3 = "MSDOS.SYS" fullword wide $s4 = "/c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} " ascii $s5 = "recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowcopy delete" fullword ascii $s6 = "DECRYPT.txt" fullword ascii $s7 = "pv3mi+NQplLqkkJpTNmji/M6mL4NGe5IHsRFJirV6HSyx8mC8goskf5lXH2d57vh52iqhhEc5maLcSrIKbukcnmUwym+In1OnvHp070=" fullword ascii $s8 = "\\NEMTY-DECRYPT.txt\"" fullword ascii $s9 = "rfyPvccxgVaLvW9OOY2J090Mq987N9lif/RoIDP89luS9Ouv9gUImpgCTVGWvJzrqiS8hQ5El02LdEvKcJ+7dn3DxiXSNG1PwLrY59KzGs/gUvXnYcmT6t34qfZmr8g8" ascii $s10 = "IO.SYS" fullword wide $s11 = "QgzjKXcD1Jh/cOLBh1OMb+rWxUbToys2ArG9laNWAWk0rNIv2dnIDpc+mSbp91E8qVN8Mv8K5jC3EBr4TB8jh5Ns/onBhPZ9rLXR7wIkaXGeTZi/4/XOtO3DFiad4+vf" ascii $s12 = "NEMTY-DECRYPT.txt" fullword wide $s13 = "pvXmjPQRoUmjj0g9QZ24wvEqyvcJVvFWXc0LL2XL5DWmz8me5wElh/48FHKcpbnq8C2kwQ==" fullword ascii $s14 = "a/QRAGlNLvqNuONkUWCQTNfoW45DFkZVjUPn0t3tJQnHWPhJR2HWttXqYpQQIMpn" fullword ascii $s15 = "KeoJrLFoTgXaTKTIr+v/ObwtC5BKtMitXq8aaDT8apz98QQvQgMbncLSJWJG+bHvaMhG" fullword ascii $s16 = "pu/hj6YerUnqlUM9A8i+i/UhnvsIE+9XTYs=" fullword ascii $s17 = "grQkLxaGvL0IBGGCRlJ8Q4qQP/midozZSBhFGEDpNElwvWXhba6kTH1LoX8VYNOCZTDzLe82kUD1TSAoZ/fz+8QN7pLqol5+f9QnCLB9QKOi0OmpIS1DLlngr9YH99vt" ascii $s18 = "BOOTSECT.BAK" fullword wide $s19 = "bbVU/9TycwPO+5MgkokSHkAbUSRTwcbYy5tmDXAU1lcF7d36BTpfvzaV5/VI6ARRt2ypsxHGlnOJQUTH6Ya//Eu0jPi/6s2MmOk67csw/msiaaxuHXDostsSCC+kolVX" ascii $s20 = "puh4wXjVYWJzFN6aIgnClL4W/1/5Eg6bm5uEv6Dru0pfOvhmbF1SY3zav4RQVQTYMfZxAsaBYfJ+Gx+6gDEmKggypl1VcVXWRbxAuDIXaByh9aP4B2QvhLnJxZLe+AG5" ascii condition: ( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) and 4 of them ) ) } rule TRELLIX_ARC_Nemty_Ransomware_2_6 : RANSOMWARE FILE { meta: description = "Rule to detect Nemty Ransomware version 2.6" author = "Marc Rivero | McAfee ATR Team" id = "335dff33-d078-58ba-b68b-a949895b710f" date = "2020-04-06" modified = "2020-08-14" reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Nemty.yar#L47-L80" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "52b7d20d358d1774a360bb3897a889e14d416c3b2dff26156a506ff199c3388d" logic_hash = "dacf709838ef2ef65d25bdbbd92007ab46a95953031d7bee75eac046f670171a" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransom:W32/Nemty" actor_type = "Cybercrime" actor_group = "Unknown" strings: $pattern = { 558B??83????53565789????29????6A??8D????8D????5A8B??89????8A????88????8B????8A????88??8A????88????8A??88????03??03??FF????75??89????8D????8D????8D????89????89????29????89????29????89????29????8D????8D????89????29????89????29????8B????89????29????8D????F6??????8B????8A????8B????8A????8A??88????8B????8A????88????75??0FB6??8A??????????0FB6??88????8A??????????0FB6????8A??????????88????0FB6????8A??????????88????8B????C1????32??????????8B????8A????32??8B????88????8A????32??88????8A??32????83????88????8B????8A????32????FF????88??83????83????83??????0F82????????5F5E5BC9C3558B??560FB6??57C1????03????6A??5F6A??5E8A??30??40414E75??4F75??5F5E5DC356576A??5F6A??8B??5E0FB6??8A??????????88??83????4E75??414F75??5F5EC38A????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????88????C3558B??5153566A??83????5E8A????32??8A????8A????88????32??32??88????88????32??8A??C0????B3??F6??02??32??32????8A????32????32??88????8A??C0????F6??02??32??32????8A????32????88????8A??C0????F6??02??32??32??8A????32????32????88??8A??C0????F6??02??32??32????83????32????4E88????75??5E5BC9C3558B??53FF????8B??32??E8????????59B3??8B??E8????????8B??E8????????8B??E8????????FF????8B??8A??E8????????FE??5980????72??8B??E8????????8B??E8????????5B8B??B0??5DE9????????558B??81??????????A1????????33??89????8B????578D??????????89??????????E8????????33??6A??5839????76??5683????75??508D????5350E8????????8D??????????508D????E8????????83????6A??5880??????75??C6??????4879??EB??FE????33??8A??????8B??????????30????47403B????72??5E8B????33??5FE8????????C9C3558B??51515333??5633??32??89????39????0F86????????578B????8B????8A????8B??83????74??4F74??4F75??21????0FB6??0FB6??83????8B??C1????C1????0B??8A??????????83????88????8A??????????8B????88??????83????EB??0FB6??0FB6??83????6A??C1????C1????5E0B??EB??33??0FB6??46C1????8A??????????88????40FF????8A??8B????3B????72??5F4E74??4E75??0FB6??83????8A????????????88????C6????????83????EB??0FB6??83????C1????8A??????????88????66????????????83????5EC6??????5BC9C3558B??33??F6??????75??5733??39????76??8B????8A????80????74??80????7C??80????7F??0FB6??8A??????????80????74??8B??83????83????74??4A74??4A74??4A75??08????40EB??8A??C0????80????08????40C0????EB??8A??C0????80????08????40C0????EB??C0????88????473B????72??EB??33??5F5DC3558B??518B??85??74??8B????568B??89????3B??74??576A??33??E8????????83????3B????75??5FFF??E8????????595E33??89??89????89????C9C3558B??80??????74??83??????72??538B??85??74??575356E8????????83????53E8????????595BC7????????????89????C6??????5DC2????C7??????????E9????????558B??568B??C7??????????E8????????F6??????74??56E8????????598B??5E5DC2????558B??83????81??????????A1????????33??89????????????5356578D????508D??????E8????????68????????8D????????????E8????????6A??5F33??83????66????????8D????8B??33??5089??????89??????E8????????E8????????33??66????????8B????????????03??????83????8D??????89??????89??????E8????????538D??????5083????8D??????E8????????538D????????????5083????E8????????8B??8D??????E8????????6A??33??E8????????83????????8B??????73??8D??????8D????????????5150FF??????????89??????83????0F84????????8B??????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????F6??????????????8D????????????508D??????8D??????74??E8????????598D??????51E8????????8B??598D??????E8????????6A??33??8D??????E8????????6A??8D??????E8????????83????8D??????8B??50E8????????E8????????83????E9????????E8????????8B??598D??????E8????????6A??33??8D??????E8????????8D????????????50FF??????????508D??????E8????????8B??????6A??5F39??????73??8D??????8B??????????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??74??8B??????39??????73??8D??????68????????50FF??85??74??83????8B??68????????E8????????83????8D????????????8B??51E8????????E8????????83????85??75??8B??????39??????73??8D??????83????8B??51E8????????E8????????83????6A??33??8D??????E8????????8D????????????50FF??????FF??????????85??0F85????????FF??????FF??????????33??435333??8D?????? } condition: uint16( 0 ) == 0x5a4d and filesize < 1500KB and $pattern } rule TRELLIX_ARC_Ransom_Avoslocker : FILE { meta: description = "Rule to detect Avoslocker Ransomware" author = "CB @ ATR" id = "50f029c8-154e-583d-8264-8d86d01075f6" date = "2021-07-22" modified = "2021-07-22" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Avoslocker.yar#L3-L27" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "fb544e1f74ce02937c3a3657be8d125d5953996115f65697b7d39e237020706f" hash = "43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856" logic_hash = "316aaab225797eedd62f9cfde1fdbd799a10441b3b15a8abc76141b57b36b1d3" score = 75 quality = 70 tags = "FILE" Version = "v1" DetectionName = "Ransom_Win_Avoslocker" strings: $v1 = "CryptImportPublicKeyInfo failed. error: %d" fullword ascii $v2 = "CryptStringToBinary failed. Err: %d" fullword ascii $v3 = "encrypting %ls failed" fullword wide $v4 = "CryptDecodeObjectEx 1 failed. Err: %p" fullword ascii $v5 = "operator co_await" fullword ascii $v6 = "drive %s took %f seconds" fullword ascii $seq0 = { 8d 4e 04 5e e9 b1 ff ff ff 55 8b ec ff 75 08 ff } $seq1 = { 33 c0 80 fb 2d 0f 94 c0 05 ff ff ff 7f eb 02 f7 } $seq2 = { 8b 40 0c 89 85 1c ff ff ff 8b 40 0c 89 85 18 ff } condition: ( uint16( 0 ) == 0x5a4d and filesize < 1000KB and pe.imphash ( ) == "a24c2b5bf84a5465eb75f1e6aa8c1eec" and ( 5 of them ) and all of ( $seq* ) ) or ( all of them ) } rule TRELLIX_ARC_Ransom_Conti : RANSOMWARE FILE { meta: description = "Conti ransomware is havnig capability too scan and encrypt oover the network" author = "McAfee ATR team" id = "8fc6943d-fb99-5957-929b-4c264d9fba2d" date = "2020-07-09" modified = "2020-10-12" reference = "https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/Ransom_Conti.yar#L3-L37" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "eae876886f19ba384f55778634a35a1d975414e83f22f6111e3e792f706301fe" logic_hash = "953471c130309bbc712197d49d2072bd45838f49d2b25f86273a15c6baa87354" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransom:W32/Conti" actor_type = "Cybercrime" actor_group = "Unknown" strings: $string1 = "HOW_TO_DECRYPTP" fullword ascii $string2 = "The system is LOCKED." fullword ascii $string3 = "The network is LOCKED." fullword ascii $code1 = { ff b4 b5 48 ff ff ff 53 ff 15 bc b0 41 00 85 c0 } $code2 = { 6a 02 6a 00 6a ff 68 ec fd ff ff ff 76 0c ff 15 } $code3 = { 56 8d 85 38 ff ff ff 50 ff d7 85 c0 0f 84 f2 01 } condition: uint16( 0 ) == 0x5a4d and filesize < 300KB and pe.number_of_sections == 5 and ( pe.imphash ( ) == "30fe3f044289487cddc09bfb16ee1fde" or ( all of them and all of ( $code* ) ) ) } rule TRELLIX_ARC_RANSOM_Wastedlocker : RANSOMWARE FILE { meta: description = "Rule to detect unpacked samples of WastedLocker" author = "McAfee ATR Team" id = "900923cf-75c0-5342-858d-fe1ffa9486bd" date = "2020-07-27" modified = "2020-10-12" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_wastedlocker.yar#L1-L32" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "ae255679f487e2e9075ffd5e8c7836dd425229c1e3bd40cfc46fbbceceec7cf4" logic_hash = "c5adf88a46c34c8683d0e3d70529b352c77209f004e6c638ff079ea025921781" score = 75 quality = 70 tags = "RANSOMWARE, FILE" rule_version = "v1" malware_type = "ransomware" malware_family = "Ransom:W32/WastedLocker" actor_type = "Cybercrime" actor_group = "Unknown" strings: $pattern_0 = { 8d45fc 50 53 53 6a19 ff75f8 } $pattern_1 = { 66833b00 8bf3 0f8485000000 8b7d10 8b472c 85c0 7410 } $pattern_2 = { e8???????? 8b4d08 8b4518 8d0441 6683600200 83c40c 837d1400 } $pattern_3 = { 8701 e9???????? 8bc7 5f 5e 5b } $pattern_4 = { 8bf8 3bfb 742f 53 8d45fc 50 56 } $pattern_5 = { 6a10 8d45f0 6a00 50 e8???????? 83c40c 5e } $pattern_6 = { 5f 5d c20800 55 8bec } $pattern_7 = { 8d7e04 ff15???????? 85c0 8945e8 740e 2b4510 } $pattern_8 = { ff15???????? 8b45dc 8b4dbc 69c00d661900 055ff36e3c 8945dc } $pattern_9 = { 8b4d08 8b19 03d8 f7d0 c1c60f 03f2 0bc6 } condition: 7 of them and filesize < 1806288 } rule TRELLIX_ARC_Ransom_Mespinoza : FILE { meta: description = "rule to detect Mespinoza ransomware" author = "Christiaan Beek @ McAfee ATR" id = "70a76bc4-e0cb-5caa-bb64-1a732349d2ce" date = "2020-11-24" modified = "2020-11-24" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/Ransom_Mespinoza.yar#L3-L27" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead" hash = "48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3" hash = "e4287e9708a73ce6a9b7a3e7c72462b01f7cc3c595d972cf2984185ac1a3a4a8" logic_hash = "e245fb9a71d86209690a6f4c7aa38c10dbd32cda2ea3ecde08d0d94e896381cb" score = 75 quality = 70 tags = "FILE" malware_family = "ransom_Win_Mespinoza" strings: $s1 = "update.bat" fullword ascii $s2 = "protonmail.com" fullword ascii $s3 = "Every byte on any types of your devices was encrypted." fullword ascii $s4 = "To get all your data back contact us:" fullword ascii $s5 = "What to do to get all data back?" fullword ascii $s6 = "Don't try to use backups because it were encrypted too." fullword ascii $op0 = { 83 f8 4b 75 9e 0f be 46 ff 8d 4d e0 ff 34 85 50 } $op1 = { c6 05 34 9b 47 00 00 e8 1f 0c 03 00 59 c3 cc cc } $op2 = { e8 ef c5 fe ff b8 ff ff ff 7f eb 76 8b 4d 0c 85 } condition: ( uint16( 0 ) == 0x5a4d and filesize < 600KB and pe.imphash ( ) == "b5e8bd2552848bb7bf2f28228d014742" and ( 8 of them ) and 2 of ( $op* ) ) or ( all of them ) } rule TRELLIX_ARC_STEALER_Lokibot : STEALER FILE { meta: description = "Rule to detect Lokibot stealer" author = "Marc Rivero | McAfee ATR Team" id = "75f502a3-2d9f-5ccf-93f8-2d6a73e9e1b7" date = "2020-09-23" modified = "2020-09-25" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/stealer/STEALER_Lokibot.yar#L1-L39" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "0e40f4fdd77e1f90279c585cfc787942b8474e5216ff4d324d952ef6b74f25d2" hash = "3ad36afad12d8cf245904285c21a8db43f9ed9c82304fdc2f27c4dd1438e4a1d" hash = "26fbdd516b3c1bfa36784ef35d6bc216baeb0ef2d0c0ba036ff9296da2ce2c84" logic_hash = "999a69394a545f726cf15e4361e0dfc17eeac6544e6816a0ad140316e9642510" score = 75 quality = 70 tags = "STEALER, FILE" rule_version = "v1" malware_type = "stealer" malware_family = "Ransomware:W32/Lokibot" actor_type = "Cybercrime" actor_group = "Unknown" strings: $sq1 = { 55 8B EC 56 8B 75 08 57 56 E8 ?? ?? ?? ?? 8B F8 59 85 FF 75 04 33 C0 EB 20 56 6A 00 57 E8 ?? ?? ?? ?? 6A 0C E8 ?? ?? ?? ?? 83 C4 10 85 C0 74 E5 83 60 08 00 89 38 89 70 04 5F 5E 5D C3 } $sq2 = { 55 8B EC 83 EC 0C 53 56 57 33 DB BE ?? ?? ?? ?? 53 53 56 6A 09 E8 ?? ?? ?? ?? 6A 10 6A 01 53 53 8D 4D F8 51 FF D0 53 53 56 6A 09 E8 ?? ?? ?? ?? 6A 08 6A 01 53 53 8D 4D F8 51 FF D0 85 C0 0F 84 2B 01 00 00 6A 24 E8 ?? ?? ?? ?? 59 8B D8 33 C0 6A 09 59 8B FB F3 AB 66 8B 4D 24 B8 03 66 00 00 C7 03 08 02 00 00 66 85 C9 74 03 0F B7 C1 8B 4D 08 33 D2 0F B7 C0 89 43 04 89 53 08 85 C9 74 12 C7 43 08 08 00 00 00 8B 01 89 43 0C 8B 41 04 89 43 10 8B 4D 0C 85 C9 74 0F 83 43 08 08 8B 01 89 43 14 8B 41 04 89 43 18 8B 4D 10 85 C9 74 0F 83 43 08 08 8B 01 89 43 1C 8B 41 04 89 43 20 8B 7B 08 8B 75 F8 83 C7 0C 52 52 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 8D 4D FC 51 6A 00 6A 00 57 53 56 FF D0 85 C0 74 75 8B 75 FC 33 C0 40 83 7D 20 00 0F 45 45 20 33 FF 57 57 68 ?? ?? ?? ?? 6A 09 89 45 F4 E8 ?? ?? ?? ?? 57 8D 4D F4 51 6A 04 56 FF D0 85 C0 74 3B 39 7D 14 74 1A 8B 75 FC 57 57 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 57 FF 75 14 6A 01 56 FF D0 8B 55 18 8B 4D FC 53 89 0A 8B 55 1C 8B 4D F8 89 0A E8 ?? ?? ?? ?? 33 C0 59 40 EB 21 FF 75 FC E8 BF FB FF FF 59 EB 02 33 FF 53 E8 ?? ?? ?? ?? 57 FF 75 F8 E8 6B FB FF FF 83 C4 0C 33 C0 5F 5E 5B 8B E5 5D C3 } $sq3 = { 55 8B EC 83 EC 0C 53 8B 5D 0C 56 57 6A 10 33 F6 89 75 F8 89 75 FC 58 89 45 F4 85 DB 75 0E FF 75 08 E8 ?? ?? ?? ?? 8B D8 8B 45 F4 59 50 E8 ?? ?? ?? ?? 8B F8 59 85 FF 0F 84 B6 00 00 00 FF 75 F4 56 57 E8 C4 ?? ?? ?? 83 C4 0C 56 56 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 68 00 00 00 F0 6A 01 56 56 8D 4D F8 51 FF D0 85 C0 0F 84 84 00 00 00 8B 75 F8 6A 00 6A 00 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 8D 4D FC 51 6A 00 6A 00 68 03 80 00 00 56 FF D0 85 C0 74 51 6A 00 53 FF 75 08 FF 75 FC E8 7F FD FF FF 83 C4 10 85 C0 74 3C 8B 75 FC 6A 00 6A 00 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 6A 00 8D 4D F4 51 57 6A 02 56 FF D0 85 C0 74 19 FF 75 FC E8 16 FD FF FF 6A 00 FF 75 F8 E8 26 FD FF FF 83 C4 0C 8B C7 EB 0E 6A 00 FF 75 F8 E8 15 FD FF FF 59 59 33 C0 5F 5E 5B 8B E5 5D C3 } $sq4 = { 55 8B EC 83 7D 10 00 56 57 8B 7D 0C 57 74 0E E8 ?? ?? ?? ?? 8B F0 33 C0 03 F6 40 EB 09 E8 ?? ?? ?? ?? 8B F0 33 C0 83 7D 14 00 59 75 24 50 FF 75 08 E8 2C 00 00 00 59 59 83 F8 01 74 04 33 C0 EB 1D 56 FF 75 08 E8 C5 FE FF FF 59 59 83 F8 01 75 EC 56 57 FF 75 08 E8 CA FE FF FF 83 C4 0C 5F 5E 5D C3 } $sq5 = { 55 8B EC 53 56 8B 75 0C 57 85 F6 75 0B FF 75 08 E8 ?? ?? ?? ?? 59 8B F0 6B C6 03 89 45 0C 8D 58 01 53 E8 ?? ?? ?? ?? 8B F8 59 85 FF 74 42 53 6A 00 57 E8 ?? ?? ?? ?? 83 C4 0C 33 D2 85 F6 74 27 8B 45 08 0F B6 0C 02 8B C1 83 E1 0F C1 E8 04 8A 80 ?? ?? ?? ?? 88 04 57 8A 81 ?? ?? ?? ?? 88 44 57 01 42 3B D6 72 D9 8B 45 0C C6 04 07 00 8B C7 5F 5E 5B 5D C3 } $sq6 = { 55 8B EC 53 56 57 FF 75 08 E8 ?? ?? ?? ?? 33 C9 6A 02 5B 8D B8 A0 1F 00 00 8B C7 F7 E3 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B F0 59 59 85 F6 74 6F 8D 0C 3F 51 6A 00 56 E8 ?? ?? ?? ?? 8D 45 0C 50 FF 75 08 56 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B F8 83 C4 1C 85 FF 74 40 33 C9 8D 47 02 F7 E3 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B D8 59 85 DB 74 25 8D 0C 7D 02 00 00 00 51 6A 00 53 E8 ?? ?? ?? ?? 57 56 53 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 1C 8B C3 EB 09 56 E8 ?? ?? ?? ?? 59 33 C0 5F 5E 5B 5D C3 } $sq7 = { 55 8B EC 81 EC 80 00 00 00 56 57 E8 ?? ?? ?? ?? 6A 1F 59 BE ?? ?? ?? ?? 8D 7D 80 F3 A5 33 C9 6A 02 5A 66 A5 8B 7D 08 8D 47 01 F7 E2 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B F0 59 85 F6 74 4D 8D 04 7D 02 00 00 00 4F 89 45 08 53 50 6A 00 56 E8 ?? ?? ?? ?? 83 C4 0C 33 DB 85 FF 74 1C E8 ?? ?? ?? ?? 33 D2 6A 7E 59 F7 F1 D1 EA 66 8B 44 55 80 66 89 04 5E 43 3B DF 72 E4 56 E8 ?? ?? ?? ?? 3B F8 8B 45 08 59 77 C4 8B C6 5B EB 02 33 C0 5F 5E 8B E5 5D C3 } $sq8 = { 55 8B EC 81 EC 50 02 00 00 53 56 57 6A 0A E8 ?? ?? ?? ?? 59 33 DB 6A 2E 5E 39 5D 14 0F 84 13 01 00 00 FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 59 59 85 F6 0F 84 F7 00 00 00 53 53 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 56 FF D0 8B D8 83 FB FF 0F 84 CC 00 00 00 F6 85 B0 FD FF FF 10 0F 84 97 00 00 00 83 7D 1C 00 74 2E 8D 85 DC FD FF FF 68 ?? ?? ?? ?? 50 E8 0A ?? ?? ?? 59 59 85 C0 75 7A 8D 85 DC FD FF FF 68 ?? ?? ?? ?? 50 E8 F3 ?? ?? ?? 59 59 85 C0 75 63 8D 85 DC FD FF FF 50 E8 ?? ?? ?? ?? 59 83 F8 03 73 0C 6A 2E 58 66 39 85 DC FD FF FF 74 45 8D 85 DC FD FF FF 50 FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 0C 89 45 14 85 C0 74 27 6A 01 6A 00 6A 01 FF 75 10 FF 75 0C 50 E8 14 FF FF FF FF 75 14 8B F8 E8 ?? ?? ?? ?? 83 C4 1C 85 FF 0F 85 EE 00 00 00 33 C0 50 50 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 53 FF D0 85 C0 0F 85 3B FF FF FF 53 E8 ?? ?? ?? ?? 59 56 E8 ?? ?? ?? ?? 59 33 DB 6A 2E 5E FF 75 0C FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 83 C4 0C 85 FF 0F 84 CF 00 00 00 53 53 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 57 FF D0 8B D8 83 FB FF 0F 84 A6 00 00 00 8D 85 DC FD FF FF 50 E8 ?? ?? ?? ?? 59 83 F8 03 73 09 66 39 B5 DC FD FF FF 74 3E 83 BD B0 FD FF FF 10 75 06 83 7D 18 00 74 2F 8D 85 DC FD FF FF 50 FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 0C 85 F6 74 12 83 7D 10 00 74 40 56 FF 55 10 56 E8 ?? ?? ?? ?? 59 59 33 C0 50 50 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 53 FF D0 85 C0 74 29 6A 2E 5E EB 85 56 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59 8B C7 EB 22 57 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59 8B C6 EB 10 53 E8 ?? ?? ?? ?? 59 57 E8 ?? ?? ?? ?? 59 33 C0 5F 5E 5B 8B E5 5D C3 } $sq9 = { 83 3D 14 ?? ?? ?? ?? 56 74 0A 8B 35 20 ?? ?? ?? 85 F6 75 66 53 57 BB E0 01 00 00 33 FF 53 89 3D 14 ?? ?? ?? E8 F0 F8 FF FF 33 F6 A3 14 ?? ?? ?? 46 59 85 C0 74 12 6A 78 57 50 89 35 20 ?? ?? ?? E8 A6 F8 FF FF 83 C4 0C 53 89 3D 18 ?? ?? ?? E8 C5 F8 FF FF A3 18 ?? ?? ?? 59 85 C0 74 14 6A 78 57 50 89 35 20 ?? ?? ?? E8 7E F8 FF FF 83 C4 0C EB 06 8B 35 20 ?? ?? ?? 5F 5B 8B C6 5E C3 } $sq10 = { 55 8B EC 51 51 83 65 FC 00 53 56 57 64 A1 30 00 00 00 89 45 FC 8B 45 FC 8B 40 0C 8B 58 0C 8B F3 8B 46 18 FF 76 28 89 45 F8 E8 CE FA FF FF 8B F8 59 85 FF 74 1F 6A 00 57 E8 32 01 00 00 57 E8 ?? ?? ?? ?? 03 C0 50 57 E8 71 FA FF FF 83 C4 14 39 45 08 74 11 8B 36 3B DE 75 C6 33 C0 5F 5E 5B 8B E5 5D C2 04 00 8B 45 F8 EB F2 } $sq11 = { A1 ?? ?? ?? ?? 85 C0 74 07 50 E8 ?? ?? ?? ?? 59 A1 ?? ?? ?? ?? 85 C0 74 07 50 E8 ?? ?? ?? ?? 59 A1 ?? ?? ?? ?? 85 C0 74 07 50 E8 ?? ?? ?? ?? 59 33 C0 A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? C3 } $sq12 = { 55 8B EC 56 8B 75 0C 57 85 F6 74 48 56 E8 ?? ?? ?? ?? 59 85 C0 74 3D 56 E8 ?? ?? ?? ?? 59 85 C0 74 32 83 65 0C 00 8D 45 0C 6A 01 50 56 E8 ?? ?? ?? ?? 8B F8 83 C4 0C 85 FF 74 19 8B 45 0C 85 C0 74 12 83 7D 14 00 74 12 39 45 14 73 0D 57 E8 ?? ?? ?? ?? 59 33 C0 5F 5E 5D C3 83 7D 10 00 74 1A 6A 00 6A 01 56 E8 ?? ?? ?? ?? 59 50 FF 75 08 E8 1F 00 00 00 8B 45 0C 83 C4 10 50 57 FF 75 08 E8 FF FE FF FF 57 8B F0 E8 ?? ?? ?? ?? 83 C4 10 8B C6 EB C3 } $sq13 = { 55 8B EC 83 EC 18 56 FF 75 08 E8 ?? ?? ?? ?? 50 89 45 F0 E8 ?? ?? ?? ?? 8B F0 59 59 85 F6 0F 84 C0 00 00 00 53 8B 5D 0C 33 C9 57 6A 04 5A 8B C3 F7 E2 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 83 65 F4 00 8B F8 83 65 FC 00 59 85 DB 74 6D 8B 45 10 83 C0 FC FF 75 F0 83 C0 04 89 45 E8 6A 00 56 8B 00 89 45 EC E8 ?? ?? ?? ?? FF 75 F0 FF 75 08 56 E8 ?? ?? ?? ?? 83 65 F8 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 20 EB 1F FF 75 EC 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 32 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF 45 F8 59 59 85 C0 75 DD 8B 45 FC 40 89 45 FC 3B C3 8B 45 E8 72 99 56 E8 ?? ?? ?? ?? 59 39 5D F4 75 12 8B C7 EB 17 8B 45 FC 8B 4D F8 FF 45 F4 89 0C 87 EB D7 57 E8 ?? ?? ?? ?? 59 33 C0 5F 5B 5E 8B E5 5D C3 } $sq14 = { 55 8B EC 8B 45 0C 53 56 8B 75 08 57 8B 4E 04 03 C1 8D 3C 09 3B F8 77 06 8D B8 F4 01 00 00 33 C9 8B C7 6A 04 5A F7 E2 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B D8 59 85 DB 74 26 57 6A 00 53 E8 ?? ?? ?? ?? FF 76 08 FF 36 53 E8 ?? ?? ?? ?? FF 36 E8 ?? ?? ?? ?? 33 C0 89 1E 83 C4 1C 89 7E 04 40 5F 5E 5B 5D C3 } $sq15 = { 55 8B EC 83 7D 0C 00 57 74 39 8B 7D 10 85 FF 74 32 56 8B 75 08 8B 46 08 03 C7 3B 46 04 76 09 57 56 E8 3F FF FF FF 59 59 8B 46 08 03 06 57 FF 75 0C 50 E8 ?? ?? ?? ?? 01 7E 08 83 C4 0C 33 C0 40 5E EB 02 33 C0 5F 5D C3 } condition: uint16( 0 ) == 0x5a4d and any of them } rule TRELLIX_ARC_Milum_Trojan : TROJAN FILE { meta: description = "Rule to detect Milum trojan from the Wildpressure operation" author = "Marc Rivero | McAfee ATR Team" id = "acc56237-a93a-55c0-a90c-11ca1da683db" date = "2020-04-24" modified = "2020-08-14" reference = "https://securelist.com/wildpressure-targets-industrial-in-the-middle-east/96360/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_milum_wildpressure.yar#L3-L28" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "86456ebf6b807e8253faf1262e7a2b673131c80174f6133b253b2e5f0da442a9" logic_hash = "3ab1ff129517cb4a829edac289c00d7701d6f667ba2ef5a28024fd01a3a52e8e" score = 75 quality = 70 tags = "TROJAN, FILE" rule_version = "v1" malware_type = "trojan" malware_family = "Trojan:W32/Milum" actor_type = "Apt" actor_group = "Unknown" strings: $pattern = { 558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B????89??????????C7????????????8D????C7??????????33??6A??89??????????89????E8????????83????3B??0F84????????89????89??8B????89????8B????89????8B????C6??????8B????C6??????C6??????8B??????????BE????????89????89????88????C6??????6A??68????????8D??????????89??????????89??????????88??????????E8????????C6??????6A??538D????528D??????????89??????????89??????????88??????????E8????????C6??????8D??????????508B??E8????????508D??????????5157E8????????C6??????83????????????72??8B??????????52E8????????83????89??????????89??????????88??????????C6??????83????????????72??8B??????????50E8????????83????6A??68????????8D????89??????????89??????????88??????????89????89????88????E8????????C6??????6A??538D????518D????89????89????88????E8????????C6??????8D????528B??E8????????508D??????????5057E8????????C6??????83??????72??8B????51E8????????83????89????89????88????C6??????83??????72??8B????52E8????????83????6A??68????????8D????89????89????88????89????89????88????E8????????C6??????6A??538D????508D????89????89????88????E8????????C6??????83????8B??89??????????6A??89????89????68????????88??E8????????C6??????83????8B??89??????????6A??538D????89????89????5288??E8????????C6??????8D??????????50C6??????E8????????83????C6??????8B??????????2B??????????B8????????F7??03??C1????8B??C1????03??83????75??8B??????????6A??53528D????E8????????8B??????????6A??83????53508D????E8????????6A??538D????508D????89????89????88????E8????????C6??????6A??538D????518D????89????89????88????E8????????C6??????8D????528B??E8????????508D??????????5057E8????????C6??????BF????????39????72??8B????51E8????????83????89????89????88????C6??????39????72??8B????52E8????????83????89????89????88????C6??????8B??????????3B??74??8B??????????E8????????8B??????????50E8????????83????BF????????89??????????89??????????89??????????C6??????39????72??8B????51E8????????83????89????89????88????C6??????39????72??8B????52E8????????83????89????89????88????C6??????39????72??8B????50E8????????83????89????89????88????88????39????72??8B????51E8????????83????89????89????88????C7????????????39????72??8B????52E8????????83????8B??????????89????89????88????8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????8D??????????508D??????????89??????????E8????????C6??????C7??????????????????C6??????68????????8D??????????51E8????????CCCC558B??6A??68????????64??????????5051535657A1????????33??508D????64??????????8B????C7??????????C7????????????8D????33??83??????89????72??8B??EB??8B??8D????88??8B????8B????518B??E8????????8B????89????8B????89??8B????89????89????88????83??????72??8B??50E8????????83????89????C7????????????88??83????89????89????C7????????????8B????8B??50518D????E8????????89????8B????52E8????????83????8B????64????????????595F5E5B8B??5DC2????CCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????505156A1????????33??508D????64??????????83????C7????????????8B????5156E8????????C7????????????C7????????????8B??8B????64????????????595E8B??5DC2????CCCCCCCCCCCC558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B????33??8B??89??????????8B????8B??89??????????89??????????89??????????3B??0F84????????8D????39??????????0F85????????68????????8D????5750E8????????C7????????????83????8D????57518B??E8????????83????C6??????8B??????????6A??535083????E8????????C6??????BF????????39????72??8B????52E8????????83????C7????????????89????88????88????39????72??8B????50E8????????83????C7????????????89????88????E9????????578D????68????????51E8????????C7????????????508D??????????52BA????????E8????????C6??????83????8D????57518B??E8????????83????C6??????8B??????????6A??535083????E8????????C6??????BF????????39????72??8B????52E8????????83????C7????????????89????88????C6??????39??????????72??8B??????????50E8????????83????C7??????????????????89??????????88??????????88????39????72??8B????51E8????????83????C7????????????89????88????FF??????????38????75??8B????38????75??8B??8B??38????75??8D????8B??8B??38????74??EB??8B????38????75??3B????75??8B??8B????38????74??8B??8B??????????3B????0F85????????8B??????????8B??6A??5383????C7????????????89????508B??88??E8????????89????C7??????????????????8B??8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????CCCCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????50515356A1????????33??508D????64??????????8B??89????C7??????????33??89????83??????72??8B????50E8????????83????C7????????????89????88????C7????????????83??????72??8B????50E8????????83????C7????????????89????88????8B????64????????????595E5B8B??5DC3CCCCCCCCCC558B??6A??68????????64??????????5083????A1????????33??89????5356508D????64??????????33??89????538B??68????????8D????89????C7????????????89????88????E8????????C7????????????6A??8D????38????74??68????????EB??68????????E8????????8D????5083????8D????5651E8????????C6??????8D????52578B??E8????????83????C7????????????C6??????BE????????39????72??8B????50E8????????83????C7????????????89????88????88????39????72??8B????51E8????????83????C7????????????89????88????8B??8B????64????????????595E5B8B????33??E8????????8B??5DC3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????50515356A1????????33??508D????64??????????8B??89????C7??????????33??89????83??????72??8B????50E8????????83????C7????????????89????88????C7????????????83??????72??8B????50E8????????83????F6??????C7????????????89????88????74??56E8????????83????8B??8B????64????????????595E5B8B??5DC2????CCCC558B??6A??68????????64??????????50A1????????33??508D????64??????????C7????????????6A??6A??8D????5083????E8????????C7????????????83??????72??8B????51E8????????83????C7????????????C7????????????C6??????8B????64????????????598B??5DC2????CCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????5083????A1????????33??89????535657508D????64??????????33??89????8B????89????89????B8????????89????C7????????????89????88??89????8D????BF????????39????72??8B??8B????39????73??8D????8B????518D????518B??E8????????C6??????508B??E8????????C6??????39????72??8B????52E8????????83????C7????????????89????88????88????39????72??8B????50E8????????83????C7????????????89????88????8B??8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????CCCCCCCCCCCCCCCC558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B??33??89????8B????89??????????89?????????? } condition: uint16( 0 ) == 0x5a4d and filesize < 2000KB and pe.imphash ( ) == "548d9f5f1e74f34b85612667335d41f2" and all of them } rule TRELLIX_ARC_APT_Acidbox_Kernelmode_Module : KERNELDRIVER FILE { meta: description = "Rule to detect the kernel mode component of AcidBox" author = "Marc Rivero | McAfee ATR Team" id = "80b60307-5431-5f21-9e6f-06adaab0519d" date = "2020-07-24" modified = "2020-08-14" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_acidbox.yar#L1-L32" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "3ef071e0327e7014dd374d96bed023e6c434df6f98cce88a1e7335a667f6749d" logic_hash = "e39da89d0da22115ac7889bc73ff183973a6c5334e304df955362bde76694d42" score = 75 quality = 70 tags = "KERNELDRIVER, FILE" rule_version = "v1" malware_type = "kerneldriver" malware_family = "Rootkit:W32/Acidbox" actor_type = "APT" actor_group = "Turla" strings: $pattern_0 = { 897c2434 8978b8 8d5f28 448bc3 33d2 } $pattern_1 = { 4c8d842470010000 488d942418010000 498bcf e8???????? 8bd8 89442460 } $pattern_2 = { 4c8bf1 49d1eb 4585c9 0f88a2000000 440fb717 498bd0 } $pattern_3 = { ff15???????? 4c8d9c2480000000 498b5b10 498b7318 498b7b20 4d8b7328 498be3 } $pattern_4 = { 33d2 41b8???????? 895c2420 e8???????? } $pattern_5 = { 895c2420 4885ff 0f8424010000 440f20c0 84c0 0f8518010000 } $pattern_6 = { 85f6 0f8469fdffff 488d8424c8010000 41b9???????? } $pattern_7 = { 894c2404 750a ffc7 893c24 41ffc3 ebcb 85c9 } $pattern_8 = { 488b5c2450 488b742458 488b7c2460 4883c430 } $pattern_9 = { 33d2 488b4c2428 e8???????? 448b842450040000 4503c0 4c8d8c2450040000 488bd7 } condition: 7 of them and filesize < 78848 } rule TRELLIX_ARC_APT_Acidbox_Main_Module_Dll : BACKDOOR FILE { meta: description = "Rule to detect the Main mode component of AcidBox" author = "Marc Rivero | McAfee ATR Team" id = "8c9beb0f-62f7-5788-8340-0b1ecdf54253" date = "2020-07-24" modified = "2020-08-14" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_acidbox.yar#L34-L65" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "eb30a1822bd6f503f8151cb04bfd315a62fa67dbfe1f573e6fcfd74636ecedd5" logic_hash = "db98e204742b8629074d47df301ffcbb2dfb977a4da91557fb50838aae79e777" score = 75 quality = 70 tags = "BACKDOOR, FILE" rule_version = "v1" malware_type = "backdoor" malware_family = "Backdoor:W32/Acidbox" actor_type = "APT" actor_group = "Turla" strings: $pattern_0 = { 7707 b8022d03a0 eb05 e8???????? } $pattern_1 = { 4403c8 8bc3 41d1c6 33c6 81c6d6c162ca c1cb02 33c7 } $pattern_2 = { e9???????? 412b5c2418 8b45dc 412b442408 41015c241c 410144240c 015f1c } $pattern_3 = { 48895c2408 57 4883ec30 488bfa 33db 4885c9 7479 } $pattern_4 = { 48895c2408 57 4883ec30 498bd8 488bfa 488364245800 85c9 } $pattern_5 = { 488987e0010000 e9???????? 81cb001003a0 e9???????? 488b87a0010000 44847806 742e } $pattern_6 = { 4d8bcc 4c8d0596c50100 498bd4 488bce e8???????? 498b9de0010000 c74605aa993355 } $pattern_7 = { 4533c0 8d5608 e8???????? 488bf0 4889442460 4885c0 750b } $pattern_8 = { 488d5558 41c1ee08 41b802000000 44887559 e8???????? 4c8b4de0 894718 } $pattern_9 = { 4d03c2 4d3bc2 4d13cc 4d0303 4d3b03 4d8903 4c8b13 } condition: 7 of them and filesize < 550912 } rule TRELLIX_ARC_APT_Acidbox_Ssp_Dll_Module : BACKDOOR FILE { meta: description = "Rule to detect the SSP DLL component of AcidBox" author = "Marc Rivero | McAfee ATR Team" id = "ef1511c5-f650-5e65-937c-466f00932183" date = "2020-07-24" modified = "2020-08-14" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_acidbox.yar#L67-L98" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "003669761229d3e1db0f5a5b333ef62b3dffcc8e27c821ce9018362e0a2df7e9" logic_hash = "4c9b9de11d73587ca1ad1efa5455598e41edc5a9a59fc0339c429a212c1c7941" score = 75 quality = 70 tags = "BACKDOOR, FILE" rule_version = "v1" malware_type = "backdoor" malware_family = "Backdoor:W32/Acidbox" actor_type = "APT" actor_group = "Turla" strings: $pattern_0 = { 49897ba0 8bc7 49894398 49897ba8 33c9 49894bb0 } $pattern_1 = { 8b8424a8000000 c1e818 88443108 66895c310a 498b0e } $pattern_2 = { 8b5f48 413bdd 410f47dd 85db 0f84f1000000 488b4720 4885c0 } $pattern_3 = { e8???????? 85c0 78c7 488d9424a0020000 488d8c24e0030000 ff15???????? 4c8bf8 } $pattern_4 = { ff15???????? 488bc8 4c8bc6 33d2 ff15???????? 8bfb 895c2420 } $pattern_5 = { 415f c3 4c8bdc 49895b10 } $pattern_6 = { 488d842488010000 4889442420 41bf???????? 458bcf 4c8bc7 418bd7 488d8c2490000000 } $pattern_7 = { c1e908 0fb6c9 3bce 77b6 8bd0 b9???????? c1ea10 } $pattern_8 = { 4c8bc3 ba???????? 488d4c2438 e8???????? 89442430 85c0 7508 } $pattern_9 = { bb02160480 8bc3 488b5c2440 488b742448 488b7c2450 4883c430 } condition: 7 of them and filesize < 199680 } rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_1 : BACKDOOR FILE { meta: description = "Rule to detect the backdoor pwnlnx variant 1" author = "Marc Rivero | McAfee ATR Team" id = "5b76ca62-460c-5c36-a239-700cc509f2b0" date = "2020-04-17" modified = "2020-08-14" reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_decade_of_RATs.yar#L3-L33" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "0f6033d6f82ce758b576e2d8c483815e908e323d0b700040fbdab5593fb5282b" logic_hash = "1487890494dde891a6dbe7dff7ebd5660ee01fe10220215e680115f168c2ae4a" score = 75 quality = 70 tags = "BACKDOOR, FILE" rule_version = "v1" malware_type = "backdoor" malware_family = "Backdoor:W32/Pwnlnx" actor_type = "Cybercrime" actor_group = "Unknown" strings: $bp = { 7F??4C4602??01??000000000000000002??3E????0000????1A????0000000040000000000000??????0000000000000000000040??????????????1D????????0000????????????000000000000??????4000000000??????4000000000????01??00000000????01??00000000????000000000000????0000??????0000????000000000000????4000000000000002????000000001C??0000000000001C??00000000000001??00000000000001??000005????????0000000000000000??????0000000000004000000000????76??00000000????76??000000000000????00000000????0000????0000000080????00000000????????????0000????????????000038??00000000000080??????00000000000020??0000000002??0000060000????80????0000000028??????????000028??????????0000A0????????0000????????????0000????000000000000??????000004??00001C??0000000000001C??4000000000??????4000000000????000000000000????000000000000??????00000000000050E5??6404??00009C6D0000000000009C6D4000000000??????????????0000DC??000000000000DC??00000000000004??00000000000051E5??64??000000000000000000000000000000000000000000000000000000000000000000000000000000000000????000000000000????6C69????????????2D????????78??78??362D????????6F2E32??04??000010??000001??0000474E5500000000????0000????0000????000000000000????0000??????000001??000006000000000000????000020??0000??????00007D??5A580000000000000000000000000000000000000000000000000000000015????????00000000000000000000??????00000000000082????????00000000000000000000????????????0000????????????00000000000000000000????????????0000??????000012??0000000000000000000062??0000000000006A??000012??000000000000000000001B??0000000000007E??000012??000000000000000000008B??0000000000004902??????00000000000000000000????????????0000????????????00000000000000000000????????00000000??????000012??000000000000000000008E??000000000000F401??????00000000000000000000????????????0000????????????00000000000000000000????000000000000????01??????00000000000000000000????????????0000????0000????000000000000000000000000000000000000????0000????000000000000000000000000000000000000??????000012??0000000000000000000025????????0000????????????00000000000000000000????000000000000????0000????00000000000000000000????000000000000????01??????00000000000000000000????????????0000????0000????00000000000000000000????000000000000????02??????00000000000000000000????????????0000????01??????00000000000000000000??????0000000000006602??????00000000000000000000????????????0000??????000012??0000000000000000000025????????0000????01??????00000000000000000000????000000000000????????????00000000000000000000????000000000000????01??????00000000000000000000????000000000000????0000????00000000000000000000????01??00000000????????????00000000000000000000????????????0000????????????00000000000000000000??????000000000000EC01??????00000000000000000000??????0000000000004B01??????00000000000000000000????????????0000??????000012??0000000000000000000025????????0000????01??????00000000000000000000????????????0000??????000012??0000000000000000000008??0000000000004302??????00000000000000000000????????????0000??????????????000000000000000000000A??0000000000003F01??????00000000000000000000????????????0000??????000012??00000000000000000000F0????00000000????01??????00000000000000000000??????????????00002F02??????00000000000000000000????01??00000000????????????00000000000000000000????000000000000??????????????0000000000000000000080????00000000????02??????00000000000000000000????000000000000??????000012??0000000000000000000074??000000000000BF????????00000000000000000000????????????0000????02??????00000000000000000000??????000000000000FA0000????00000000000000000000????????????0000??????000012??0000000000000000000011??000000000000A8??000012??0000000000000000000044000000000000??????000012??000000000000000000005A000000000000??????000012??0000000000000000000029??000000000000C6????????00000000000000000000????000000000000????????????00000000000000000000????000000000000????0000????00000000000000000000????????00000000????????????00000000000000000000??????000000000000BC????????00000000000000000000????02??00000000????01??????00000000000000000000??????00000000000034??000012??00000000000000000000A1????????0000????????????00000000000000000000????????????0000??????????????000000000000000000004B000000000000????0000????00000000000000000000????000000000000??????000012??0000000000000000000005????????0000??????000012??0000000000000000000031??00000000000074??000012??00000000000000000000FF??0000000000005E02??????00000000000000000000????000000000000????????????00000000000000000000????????????0000??????000012??0000000000000000000025????????0000????02??????00000000000000000000??????000000000000DE??000012??000000000000000000007B??00000000000030??000012??0000000000000000000075??000000000000D9??000012??000000000000000000000E000000000000????????????00000000000000000000????000000000000????02??????00000000000000000000????????????0000????????????00000000000000000000????????????0000????????????00000000000000000000????000000000000????02??????00000000000000000000????000000000000????01??????00000000000000000000????????????0000????????????00000000000000000000????000000000000????????????00000000000000000000??????0000000000005201??????0000????174000000000????00000000000000005F5F676D6F6E5F73??6172??5F5F??????76??52656769????????????6173??6573??6C69????????????61642E????2E30??72??63????72??6D??????68????????5F63????6174????????6E6474????????75??65??????69??????????????6E6F5F6C6F63????69????????????6B????74??72??6164??73??676D6173????????6E6E6563??????74??72??6164??73??6C66??????63????74??70??68????????5F6465????63????6663????6C????????63??73??2E????????63????74??73??72??70????????69????????????????????616E64??????6574??6174??6E??????74??77??69??????????????6469????????????5F6E74??61??????74??72??69??????????????70??????????6D6F6E????????74??6E??????6C6563??????6B????????72??616C6C6F63??676574??69??????????????73??72??6F6B????63????77????????70??6173??72??3634??73??67656D70??79??6574??6D656D73??74??72??6469??????????????????6565??????68????????6173??74??6D65??????74??6F63????70????????616E74??74??6475??32??73??67616464????74??69????????????6472??6663??????65??????74??6F63????70????????6C6C6F63??73??72??6174??72??616C70??74????????6D6F76????????656E6469????????????6C??????74??6F73??62????616D65??????6563??????????72??74????????656164??????6C6F63????74??6C6F63????74??6D65??????616E6469????????????616464??????????????6565????73??74??69????????????????????6D6D6F76????????70??6E3634??5F5F6C69????????????72??5F6D6169????????????73??73??70??69????????????65????????78??74??74??34??474C4942435F32??32??35????????42435F32??33??000002??02??02??03??02??02??02??03??03??02??02??02??0000000002??02??02??02??02??03??02??02??02??02??02??02??02??02??03??02??02??02??04??02??02??03??02??03??02??02??02??03??02??02??02??02??02??03??02??02??02??02??02??02??03??02??02??03??02??02??02??03??02??03??02??03??02??02??02??02??02??02??03??03??03??02??02??02??02??02??000001??01??24??000010??000020??000075??69??????????9602??00000000????????????????????000000000000????69????????????A2????????0000??????69??????????9602??00000000????81????????????060000????????????000000000000????81????????????070000????00000000000000000000????81????????????070000????00000000000000000000????81????????????070000????00000000000000000000000082??????0000????0000??????0000000000000000000008??????????0000070000????????????000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000??????6000000000????0000??????000000000000000000004882??????0000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000?????? } condition: uint16( 0 ) == 0x457f and filesize < 100KB and all of them } rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_2 : BACKDOOR FILE { meta: description = "Rule to detect the backdoor pwnlnx variant 2" author = "Marc Rivero | McAfee ATR Team" id = "c4ee686b-49d9-5566-b749-1144a19c1fee" date = "2020-04-17" modified = "2020-08-14" reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_decade_of_RATs.yar#L35-L65" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "08cc67002782cbafd97a4bff549d25dd72d6976d2fdf79339aaf5a3ff7c3107e" logic_hash = "08ea40ba72677263a41f62097fc38040361ba595d67cb04979b66548c7f4d271" score = 75 quality = 70 tags = "BACKDOOR, FILE" rule_version = "v1" malware_type = "backdoor" malware_family = "Backdoor:W32/Pwnlnx" actor_type = "Cybercrime" actor_group = "Unknown" strings: $bp = { 7F??4C4602??01??000000000000000002??3E????0000000004??00000000??????00000000000088????????????00000000??????38??05????????????????0000????????????0000000000000000??????0000000000004000000000??????0D??????????????0D????????0000????00000000????0000????0000????????????0000????????????0000????????????0000????12??00000000????????????00000000????00000000??????000004??00005801??00000000??????4000000000??????4000000000????????00000000????????00000000??????000000000000070000??????000080??????0000000080??????0000000080??????0000000028??00000000000070??00000000000008??00000000000051E5??64??000000000000000000000000000000000000000000000000000000000000000000000000000000000000????000000000000??????000010??000001??0000474E5500000000????0000????0000????0000??????000014??000003??0000474E55????????????CC78??78??83????????????CB371F0000000080??????0000000025????????0000????7E??00000000????????????0000????????????0000??????4200000000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000??????4200000000????????????0000????????????0000??????4200000000????????????0000????????????0000????????????0000????76??00000000????????????0000????8B????00000000C8??????0000000025????????0000??????4200000000????76??00000000????????????0000????444200000000????76??00000000????????????0000??????4900000000????76??00000000????????????0000??????4600000000????76??00000000????????????0000????424200000000??????EC08??33??0000E8????????E8????????4883????C3FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????00000000000000000000000000000000000000000000000031??4989??5E4889??4883????505449C7??????????48C7??????????48C7??????????E8????????F490904883????488B??????????4885??74??FF??4883????C390909090909090909090909090554889??534883????80????????????75??BB????????488B??????????4881??????????48C1????4883????4839??73??660F1F??????4883????4889??????????FF????????????488B??????????4839??72??B8????????4885??74??BF????????E8????????C6????????????4883????5BC9C30F1F????????????55B8????????4885??4889??74??BE????????BF????????E8????????4883????????????74??B8????????4885??74??BF????????C9FF??0F1F??????????C9C39090554889??534881??????????89??????????48C7????????????8B????3D????????0F87????????8B????89??488D??????????8B??????????4889??89??E8????????85??0F84????????8B????89??488D??????????89??4889??E8????????BA????????488D??????????4889??4889??E8????????4889????4883??????0F84????????488D??????????488D??????????4889??4889??E8????????85??0F85????????488B??????????4889????C7????????????488B????89????488B????48C1????89????488B????4889????488B????4889??????488B????4889??????E8????????89????BE????????488D????E8????????488D????8B??????????BA????????4889??89??E8????????85??0F84????????488D????8B??????????BA????????4889??89??E8????????85??0F84????????BE????????488D????E8????????8B????488B????4889????488B????4889??????488B????4889??????E8????????39??0F85????????8B????89??4889??48C1????8B????89??488D????4889????488B????488B????BA????????4889??4889??E8????????488B????4889????EB??488B????488D??????????4889??BA????????BE????????4889??E8????????89????83??????7E??8B????488D??????????89??4889??E8????????8B????4863??488D??????????8B??????????4889??89??E8????????85??74??8B????48984801????488B????483B????7C??EB??90EB??90EB??90EB??90EB??90EB??90488B????4889??E8????????EB??90EB??90EB??90B8????????4881??????????5BC9C3554889??534881??????????4889??????????E8????????4889??E8????????C7????????????488B??????????8B????89????488B??????????8B??89????488B??????????8B????89????8B????8B????BA????????89??89??E8????????89????83??????0F84????????488D????BA????????BE????????4889??E8????????C7????????????C7????????????8B????89????488B????4889????488B????4889??????488B????4889??????E8????????89????488D????BE????????4889??E8????????488D????8B????BA????????4889??89??E8????????85??0F84????????488D??????????4889??E8????????488D??????????BE????????4889??E8????????488D??????????8B????BA????????4889??89??E8????????85??0F84????????488D????8B????BA????????4889??89??E8????????85??74??488D????BE????????4889??E8????????8B????488B????4889????488B????4889??????488B????4889??????E8????????39??75??8B????83????75??8B????488B????4889????488B????4889??????488B????4889??????89??E8????????EB??90EB??90EB??90EB??90EB??908B????89??E8????????B8????????4881??????????5BC9C390554889??4889????89????C7????????????488B????4889????C7????????????EB??488B????0FB6??8B????89??C1????F7????89??48980FB6??????????89??31??488B????88??83??????4883??????8B????3B????7C??488B????C9C3554889??4889????89????488B????4889????C7????????????EB??488B????0FB6??0FB6??????????31??488B????88??83??????4883??????8B????3B????7C??488B????C9C39090554889??534881??????????89??????????48C7????????????48C7????????????48C7????????????8B????89??488D??????????8B??????????4889??89??E8????????85??0F84????????8B????89??488D??????????89??4889??E8????????488D??????????488D??????????4889??4889??E8????????BA????????488D??????????488D??????????BE????????4889??B8????????E8????????488D??????????4889??E8????????4883????4889??E8????????4889????4883??????0F84????????488D??????????488B????4889??4889??E8????????488D??????????488D????B9????????BA????????4889??4889??E8????????89????83??????0F8E????????C7????????????E9????????488B????8B????4863??48C1????4801??488B??488D????BA????????488D??????????488D??????????4989??BE????????4889??B8????????E8????????488D??????????488D??????????4889??4889??E8????????85??0F85????????48C7????????????48C7????????????488D??????????4883????4889??E8????????4889??E8????????488B??????????8B??????????4189??4181??????????8B??????????89??81??????????488B????8B????4863??48C1????4801??488B??488D????BA????????488D??????????4889??????4889??????488B????4889??????488B????4889????4589??4189??4889??BE????????4889?? } condition: uint16( 0 ) == 0x457f and filesize < 1000KB and all of them } rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_3 : BACKDOOR FILE { meta: description = "Rule to detect the backdoor pwnlnx variant" author = "Marc Rivero | McAfee ATR Team" id = "02ea1eb2-7235-5ed5-86ba-19d52e8fb428" date = "2020-04-17" modified = "2020-08-14" reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_decade_of_RATs.yar#L67-L97" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "08f29e234f0ce3bded1771d702f8b5963b144141727e48b8a0594f58317aac75" logic_hash = "8a1405f430ce57810577f65ef43a1425601bf49b5adb4f6f935505427ad9dc94" score = 75 quality = 70 tags = "BACKDOOR, FILE" rule_version = "v1" malware_type = "backdoor" malware_family = "Backdoor:W32/Pwnlnx" actor_type = "Cybercrime" actor_group = "Unknown" strings: $bp = { 7F??4C4602??01??000000000000000002??3E????0000000004??00000000??????000000000000B0??3A??000000000000000040??????????????????????01??000005????????0000000000000000??????0000000000004000000000????????????0000????????????00000000????00000000????0000????0000????A40C??00000000C0??????????????C0??????????????5013??00000000????????????00000000????00000000??????000004??00005801??00000000??????4000000000??????4000000000????000000000000????000000000000??????000000000000070000??????0000C0??????????????C0??????????????C0??????????????28??00000000000078??00000000000008??00000000000051E5??64??000000000000000000000000000000000000000000000000000000000000000000000000000000000000????000000000000??????000010??000001??0000474E5500000000????0000??????000000000000C0????????????????????????0000????84????00000000C8??????0000000025????????0000????374200000000????A56C00000000????????????0000????????????0000????A56C00000000????????????0000??????4200000000????A56C00000000????????????0000????24??00000000????A56C00000000????????????0000????????????0000????A56C00000000????????????0000????83??????0000????A56C00000000????????????0000????5E42000000000000A66C00000000????????????0000??????4200000000????A66C00000000????????????0000????914200000000????A66C00000000????????????0000??????4200000000????A66C00000000????????????0000????????????0000????A66C00000000????????????0000????????????0000????A66C00000000????????????0000??????4200000000????A66C00000000????????????0000??????4200000000??????EC08??4301??????62??0000E8????????4883????C3FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????00000000000000000000000000000000000000000000000031??4989??5E4889??4883????505449C7??????????48C7??????????48C7??????????E8????????F490904883????488B??????????4885??74??FF??4883????C390909090909090909090909090B8????????55482D????????4883????4889??76??B8????????4885??74??5DBF????????FF??660F1F????????????5DC366666666????????????????????BE????????554881??????????48C1????4889??4889??48C1????4801??48D1??74??B8????????4885??74??5DBF????????FF??0F1F??5DC3660F1F??????80????????????75??554889??53BB????????4881??????????4883????488B??????????48C1????4883????4839??73??660F1F??????4883????4889??????????FF????????????488B??????????4839??72??E8????????B8????????4885??74??BF????????E8????????C6????????????4883????5B5DF3??669055B8????????4885??4889??74??BE????????BF????????E8????????BF????????4883????75??5DE9????????6690B8????????4885??74??FF??EB??9090554889??534881??????????89??????????48C7????????????8B????3D????????76??E9????????8B????89??488D??????????8B??????????4889??89??E8????????85??75??E9????????8B????89??488D??????????89??4889??E8????????488D??????????BE????????4889??E8????????4889????4883??????75??E9????????488D??????????488D??????????4889??4889??E8????????85??74??E9????????488B??????????4889????C7????????????488B????89????488B????48C1????89????4883????FF????FF????FF????E8????????4883????89????BE????????488D????E8????????8B??????????BA????????488D????89??E8????????85??75??E9????????8B??????????BA????????488D????89??E8????????85??75??E9????????BE????????488D????E8????????8B????4883????FF????FF????FF????E8????????4883????39??74??E9????????8B????89??48C1????4889??8B????89??4801??4889????488B????488B????BA????????4889??4889??E8????????488B????4889????EB??488B????488D??????????4889??BA????????BE????????4889??E8????????89????83??????7F??EB??8B????488D??????????89??4889??E8????????8B????4863??488D??????????8B??????????4889??89??E8????????85??75??EB??8B????48984801????488B????483B????7C??488B????4889??E8????????B8????????488B????C9C3554889??534881??????????4889??????????E8????????4889??E8????????C7????????????488B??????????8B????89????488B??????????8B??89????488B??????????8B????89????8B????8B????BA????????89??89??E8????????89????83??????75??E9????????488D????BA????????BE????????4889??E8????????C7????????????C7????????????8B????89????4883????FF????FF????FF????E8????????4883????89????488D????BE????????4889??E8????????488D????8B????BA????????4889??89??E8????????85??75??E9????????488D??????????4889??E8????????488D??????????BE????????4889??E8????????488D??????????8B????BA????????4889??89??E8????????85??75??EB??488D????8B????BA????????4889??89??E8????????85??75??EB??488D????BE????????4889??E8????????8B????4883????FF????FF????FF????E8????????4883????39??74??EB??8B????83????74??EB??8B????4883????FF????FF????FF????89??E8????????4883????908B????89??E8????????B8????????488B????C9C3554889??4889????89????C7????????????488B????4889????C7????????????EB??488B????0FB6??8B????99F7????89??48980FB6??????????31??89??488B????88??83??????4883??????8B????3B????7C??488B????5DC3554889??4889????89????488B????4889????C7????????????EB??488B????0FB6??0FB6??????????31??488B????88??83??????4883??????8B????3B????7C??488B????5DC39090554889??534881??????????89??????????48C7????????????48C7????????????48C7????????????8B????89??488D??????????8B??????????4889??89??E8????????85??75??E9????????8B????89??488D??????????89??4889??E8????????488D??????????488D??????????4889??4889??E8????????488D??????????488D??????????4889??BA????????BE????????4889??B8????????E8????????488D??????????4889??E8????????4883????4889??E8????????4889????4883??????75??E9????????488D??????????488B????4889??4889??E8????????488D????488D??????????B9????????BA????????4889??E8????????89????83??????0F8E????????C7????????????E9????????488B????8B????4863??48C1????4801??488B??488D????488D??????????488D??????????4989??4889??BA????????BE????????4889??B8????????E8????????488D??????????488D??????????4889??4889??E8????????85??0F85????????48C7????????????48C7????????????488D??????????4883????4889??E8????????4889??E8????????4989??488B??????????8B??????????25????????89??8B??????????25????????89??488B????8B????4863??48C1????4801??488B??488D????488D??????????415052FF????FF????4189??4189??BA????????BE????????4889??B8????????E8????????4883????488B????4889??E8????????4889??488D?????????? } condition: uint16( 0 ) == 0x457f and filesize < 4000KB and all of them } rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_4 : BACKDOOR FILE { meta: description = "Rule to detect the backdoor pwnlnx variant 4" author = "Marc Rivero | McAfee ATR Team" id = "199bb534-f0f6-5b67-aedd-3eada5e45cc6" date = "2020-04-17" modified = "2020-08-14" reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_decade_of_RATs.yar#L99-L129" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "2590ab56d46ff344f2aa4998efd1db216850bdddfc146d5d37e4b7d07c7336fc" logic_hash = "11203beee446aaf0783d3a8d3839a88ef16c27d52be8670d650ebf6a1de2c3aa" score = 75 quality = 70 tags = "BACKDOOR, FILE" rule_version = "v1" malware_type = "backdoor" malware_family = "Backdoor:W32/Pwnlnx" actor_type = "Cybercrime" actor_group = "Unknown" strings: $bp = { 7F??4C4602??01??000000000000000001??3E????000000000000000000000000000000000000????????????000000000000??????0000000040??????????????000014??000003??0000474E55????9FECFBE5??F973??EB??2A??????????71??BD????????0000000000000000554889??53E8????????FF????????????4889??4889??4881??????????FF????????????4889??5BC9C30F1F??????554889??E8????????FF????????????C9C366666666????????????????????554889??E8????????4885??74??4C8B????4D85??74??65??8B????????????8B??????????4889??????????48C7??????????89??C1????C1????01??25????????29??48984C89????????????FF??????????C9C3660F1F????????????31??C9C36666662E????????????????554889??E8????????4889??????????48C7??????????FF??????????C9C390554889??E8????????8B??????????488B??????????488D????0FB6????3C??400F94??3C??410F94??74??4084??75??B8????????C9C30F1F????????????8B??????????39????74??3B????74??4584??74??8B??????????4801??0FB7??????????66????74??66??????75??4889??41FF??B8????????C9C30F1F??4084??74??8B??????????4801??0FB7??????????66????75??EB??0F1F????554889??534883????E8????????31??4889??31??E8????????483D????????77??4885??74??488B????488B????488B????488B????4889??????????31??4889??E8????????31??4883????5BC9C383????EB??662E0F1F????????????554889??415453E8????????4989??4889??31??31??E8????????483D????????77??488B????31??4889??488B????488B????488B????488B??????????4989????4889??????????E8????????31??5B415CC9C383????EB??0F1F??????554889??534883????E8????????31??4889??31??E8????????483D????????77??4885??74??488B????488B????488B????488B????4889??????????31??4889??E8????????31??4883????5BC9C383????EB??662E0F1F????????????554889??415453E8????????4989??4889??31??31??E8????????483D????????77??488B????31??4889??488B????488B????488B????488B??????????4989????4889??????????E8????????31??5B415CC9C383????EB??0F1F??????554889??534883????E8????????31??4889??BE????????E8????????483D????????77??4885??74??488B????4889????31??4889??E8????????31??4883????5BC9C383????EB??660F1F??????554889??415453E8????????4989??4889??BE????????31??E8????????483D????????77??488B????31??4889??488B????4989????488B????4889????E8????????31??5B415CC9C383????EB??554889??4157415641554154534883????E8????????4889??488D????4989??4189??4889??BA????????4989??4489????4D89??E8????????488B??????????448B????4881??????????488D????75??EB??0F1F????488B????4881??????????488D????74??0FB7????4839??75??4883????31??5B415C415D415E415FC9C30F1F??????4D89??4C89??4489??4889??4C89??FF??????????4883????5B415C415D415E415FC9C30F1F????554889??4157415641554154534883????E8????????65??8B????????????4889????4889????4189??8B??????????4889??B9????????48C7??????????4889??4D89??4589??89??C1????C1????01??25????????29??F3A648984C8B????????????0F84????????B9????????48C7??????????4889??F3A60F84????????31??4585??4889??4889????4489????74??418D??????31??488D??????0FB6??4883????4889??48C1????48C1????4801??4801??4839??488D????488D????75??89????488D????4C89??E8????????4885??4889??0F84????????488B????4885??74??81????????????0F84????????488B??????????483D????????4C8D????75??EB??0F1F??????498B????483D????????4C8D????74??498B??4889??E8????????85??75??31??4883????5B415C415D415E415FC9C34589??4D89??488B????4489??4889??488B????FF??????????4883????5B415C415D415E415FC9C30F1F??????????81????????????0F85????????31??EB??488D????4C89??E8????????4885??4889??74??498B????488B??????????488B????4885??74??31??4889??4889????FF??4885??488B????0F84????????31??E9????????0F1F????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??41554154534883????E8????????4C8B??????????4989??4981??????????498D??????75??EB??0F1F????4C8B????4981??????????498D??????74??488B??4C89??E8????????85??75??4C89??E8????????488B??E8????????4889??E8????????4883????5B415C415DC9C36666662E????????????????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889?? } condition: uint16( 0 ) == 0x457f and filesize < 400KB and all of them } rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_6 : BACKDOOR FILE { meta: description = "Rule to detect the backdoor pwnlnx variant 6" author = "Marc Rivero | McAfee ATR Team" id = "56bfe9c7-4cd4-51f6-a469-da8af52d64c2" date = "2020-04-17" modified = "2020-08-14" reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_decade_of_RATs.yar#L131-L161" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "d29254ab907c9ef54349de3ec0dd8b22b4692c58ed7a7b340afbc6e44363f96a" logic_hash = "29423135a46ee7b9aa1bd8f1e6f7ffad09725787ad6e75312e1d34b18e3917d4" score = 75 quality = 70 tags = "BACKDOOR, FILE" rule_version = "v1" malware_type = "backdoor" malware_family = "Backdoor:W32/Pwnlnx" actor_type = "Cybercrime" actor_group = "Unknown" strings: $bp = { 7F??4C4602??01??000000000000000001??3E????000000000000000000000000000000000000??????09??00000000000000004000000000??????2B??28??04??000014??000003??0000474E55????4D9585????AB6522????52AD3B??EC9B4BE8????????0000000000000000????00000000554889??????????4889??41544989??534889??488B??????????E8????????4C89??4889??48C7??????????FF??????????488B??????????89??E8????????89??5B415C5DC30F1F??E8????????554889??????????4889??41544989??534889??488B??????????E8????????4C89??4889??48C7??????????FF??????????488B??????????89??E8????????89??5B415C5DC30F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??41574589??415641554189??4154534889??4883????488B??????????4889????4889????4C89????483D????????4C8D????74??4C63??EB??0F1F??????498B????483D????????4C8D????74??498B??4C89??4889??E8????????85??75??4883????5B415C415D415E415F5DC30F1F??????????4589??4C8B????488B????4489??4889??488B????FF??????????4883????5B415C415D415E415F5DC3660F1F??????E8????????554889??41574589??41564D89??41554989??41544189??BA????????534889??488D????4883????4889????4889??65??8B????????????4889????31??E8????????488B??????????4881??????????488D????74??0FB7????4839??75??EB??0F1F????????????410FB7????4839??74??4C8B????4981??????????498D????75??4589??4D89??4C89??4489??4889??488B????FF??????????488B????65??33????????????75??4883????5B415C415D415E415F5DC3660F1F??????31??EB??E8????????0F1F??????662E0F1F????????????E8????????55BF????????4889??4881??????????65??8B????????????4889????31??488D??????????FF????????????B9????????4889??488D??????????F3??A5488D??????????48C7??????????BE????????B1??E8????????4885??74??48BA???????? } condition: uint16( 0 ) == 0x457f and filesize < 700KB and all of them } rule TRELLIX_ARC_Mirai_Casper_Variant : BACKDOOR FILE { meta: description = "Rule to detect the Mirai Casper variant" author = "Marc Rivero | McAfee ATR Team" id = "0f3a028c-9514-51cd-ad82-415e8ac2dee7" date = "2020-04-17" modified = "2020-08-14" reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_decade_of_RATs.yar#L163-L193" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "57cc422a6a90c571198a2d1c3db13c31fbdb48ba2f0f4356846d6d636d0f9300" logic_hash = "5449d1ef0c4977c6151fc194ad5f526b6be414c1efb7fd4bacb77d4bcd89c703" score = 75 quality = 70 tags = "BACKDOOR, FILE" rule_version = "v1" malware_type = "backdoor" malware_family = "Backdoor:W32/Pwnlnx" actor_type = "Cybercrime" actor_group = "Unknown" strings: $bp = { 7F??4C4601??01??000000000000000002??03??01??0000E0??04??34??000088??????????000034??20??05????????????????000000000000000080??????80??????15????????0C??05????????10??????0000??????0C??40A510??40A510??80??????904A0000060000000010????????0000D4??0000D4??04??D4??04??440000??????????????000004??0000070000??????0C??40A510??40A510??14??000030??000004??000004??000051E5??64????000000000000000000000000000000000000060000??????000004??000010??000001??0000474E5500000000????0000????0000????0000??????000014??000003??0000474E55??????3A??87????529723????2C??08??????AB35????????2A??0000BC????????0000????A510??2A??0000C4??????????0000C8??????2A??0000CCA510??2A??00005589??5383????E8????????5B81??????????8B??????????85??74??E8????????E8????????E8????????585BC9C3FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????000000000000000031??5E89??83????50545268????????68????????515668????????E8????????F490909090909090909090909090905589??538D??????80????????????75??BB????????A1????????81??????????C1????83????39??73??908D??????83????A3????????FF????????????A1????????39??72??B8????????85??74??C7????????????E8????????C6????????????8D??????5B5DC3908D??????55B8????????89??8D??????E8????????5A81??????????85??74??89??????C7??????????????C7??????????????C7????????????E8????????A1????????85??74??B8????????85??74??C7????????????FF??C9C39090905589??83????8B????88????A1????????85??74??A1????????0FB6????88??83????A3????????EB??C7??????????????8D????89??????C7????????????E8????????C9C35589??83????EB??8B????0FB6??0FBE??83??????89????E8????????8B????0FB6??84??75??C9C35589??83????8B????0FB6??88????83??????80??????0F84????????80??????74??0FBE????89????E8????????E9????????C7????????????8B????0FB6??88????83??????80??????75??C7????????????8B????0FB6??88????83??????EB??80??????75??C7????????????8B????0FB6??88????83??????C7????????????EB??8B????89??C1????01??01??89??0FBE????8D????83????89????8B????0FB6??88????83??????80??????7E??80??????7E??80??????74??80??????75??83??????8B????0FB6??88????83??????80??????0F84????????0FB6????88????80??????7E??0FB6????83????88????0FBE????83????83????0F87????????8B????????????FF??8B????8D????89????8B??89????C7????????????EB??83??????8B????8B????8D????0FB6??84??75??EB??C7????????????E8????????8B????83????85??75??8B????3B????0F92??83??????84??75??8B????89????E8????????EB??C7????????????E8????????8B????3B????0F92??83??????84??75??E9????????8B????8D????89????8B??0FBE??89????E8????????E9????????C7????????????EB??C7????????????EB??C7????????????EB??C7????????????EB??0FBE????89????E8????????E9????????8B????83????85??74??8B????8D????89????8B??EB??80??????75??8B????8D????89????8B??EB??8B????8D????89????8B??89????80??????75??8B????85??79??F7????83??????C7????????????8B????BA????????F7????89??88????8B????BA????????F7????89????80??????7E??80??????75??B8????????EB??B8????????0FB6????01??88????8B????0FB6????83????88??????83??????83??????74??83??????76??8B????83????85??74??8B????C6????????83??????8B????89????8B????83????84??74??B8????????EB??B8????????88????EB??0FBE????89????E8????????8B????83????85??75??8B????3B????0F92??83??????84??75??83??????8B????0FB6??????0FBE??89????E8????????83??????75??EB??C7????????????E8????????8B????3B????0F92??83??????84??75??E9????????E9????????90EB??90C9C35589??83????8D????89????8B????89??????8B????89????E8????????C9C35589??83????8B????8B????88????88????C9C35589??57565381??????????8B????8B????88??????????88??????????C7??????????????????C7??????????????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????66????????????8D??????????BA????????89??????C7??????????????89????E8????????83????????????0F84????????83????????????0F84????????8B??????????89????E8????????3D????????0F8F????????8B??????????89????E8????????83????0F8F????????8B??????????89????E8????????83????0F8F????????C7??????????????????EB??8B??????????03??????????0FB6??3C??7E??8B??????????03??????????0FB6??3C??7F??8B??????????03??????????8B??????????03??????????0FB6??83????88??8B??????????83????89??????????8B??????????89????E8????????8B??????????39??7F??81??????????????????7E??C7??????????????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????8B??????????C7??????????????89????E8????????89??????????C7??????????????????E9????????8B??????????69??????????03??????????C6??????8B??????????69??????????03??????????C7??????????8B??????????69??????????89??03??????????0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????8B????89????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????8B??????????69??????????03??????????0FB6??????????3C??74??8B??????????69??????????03??????????05????????89????E8????????8B??????????69??????????03??????????8D??????????8B??????????69??????????03??????????81??????????83????89??????89??????89????E8????????8B??????????69??????????03??????????C6????????????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????0FB6????3C??0F87????????8B??????????69??????????89??03??????????0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????8B????89????E8????????89??E8????????89??0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????0FB6????0FB6??89??89??D3??89??8D????89????E8????????89????E8????????89??BA????????89??F7??89??C1????89??C1????01??89??29??83????0F87????????8B????????????FF??C7????????????E8????????C7??????????????C7????????????E8????????8B??????????69??????????03??????????83????89??????89????E8????????C7????????????E8????????E9????????C7????????????E8????????C7??????????????C7????????????E8????????8B??????????69??????????03??????????83????89??????89????E8????????C7????????????E8????????E9????????C7????????????E8????????C7??????????????C7????????????E8????????8B??????????69??????????03??????????83????89??????89????E8????????C7???????????? } condition: uint16( 0 ) == 0x457f and filesize < 3000KB and all of them } rule TRELLIX_ARC_APT_Stolen_Certificates : BACKDOOR FILE { meta: description = "Rule to detect samples digitally signed from these stolen certificates" author = "Marc Rivero | McAfee ATR Team" id = "57051977-780c-5c8e-bc66-0f1d8b3bbd93" date = "2020-04-17" modified = "2020-08-14" reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_decade_of_RATs.yar#L196-L221" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "ce3424524fd1f482a0339a3f92e440532cff97c104769837fa6ae52869013558" logic_hash = "9b700e4889349d0203bdd4e00035ee9c9aba5025ccc57eef915b2c78996f8160" score = 75 quality = 70 tags = "BACKDOOR, FILE" rule_version = "v1" malware_type = "backdoor" malware_family = "Backdoor:W32/Pwnlnx" actor_type = "Cybercrime" actor_group = "Unknown" condition: uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "/C=KR/ST=Seoul/L=Gangnam-gu/O=LivePlex Corp/CN=LivePlex Corp" and pe.signatures [ i ] . serial == "3f:55:42:e2:e7:1d:8d:b3:57:04:1c:9d:d4:5b:95:0a" or pe.signatures [ i ] . subject contains "/C=KR/ST=Seoul/L=Gangnam-gu/O=LivePlex Corp/CN=LivePlex Corp" and pe.signatures [ i ] . serial == "3f:55:42:e2:e7:1d:8d:b3:57:04:1c:9d:d4:5b:95:0a" or pe.signatures [ i ] . subject contains "/C=KR/ST=Seoul/L=Gangnam-gu/O=LivePlex Corp/CN=LivePlex Corp" or pe.signatures [ i ] . serial == "3f:55:42:e2:e7:1d:8d:b3:57:04:1c:9d:d4:5b:95:0a" ) } rule TRELLIX_ARC_APT_Winnti : BACKDOOR FILE { meta: description = "Detects Winnti variants" author = "McAfee ATR Team" id = "f12b039a-2508-580f-b777-428bbda2c666" date = "2020-06-04" modified = "2020-10-14" reference = "https://attack.mitre.org/software/S0141/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_winnti.yar#L1-L27" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "fd539d345821d9ac9b885811b1f642aa1817ba8501d47bc1de575f5bef2fbf9e" logic_hash = "f94b2c552fbb30e1005e5c75a2f449d60b9558a0916197bed41bf32c6477daef" score = 75 quality = 70 tags = "BACKDOOR, FILE" rule_version = "v1" malware_type = "backdoor" malware_family = "Backdoor:W32/Winnti" actor_type = "Apt" actor_group = "Unknown" strings: $pattern = { 9090909090909090909090909090C7????????????C2????90909090909081??????????E9????????CCCCCCCCCC8A??????8B??????538A??8A??568B??578B??????8B??C1????66????8B??C1????F3AB8B??83????F3AA8B??5F5E5BC390909090909090909090909090909083????5333??568D??????535089??????89??????E8????????8A??33??3A??8D??????0F94??83????5389??????528B??89??????C6????????E8????????8B??33??81??????????8D??????0F94??6A??89??????5223??89??????C6????????C6????????E8????????33??66????8D??????6A??0F94??89??????89??????5223??C6????????C6????????E8????????8B??83????33??3B??0F94??23??5E495BF7??1B??8B??83????C38B??????8B??????03??C390909090908B??????85??0F84????????8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??E9????????83????C39090909090909090909090909083????8B??????53558B??????33??568B??????83????5789??????76??81??????????8B??76??BF????????8B??????8D????03??C1????03??89??????3B??76??8B??????68????????6A??52E8????????8B??????8B??????8B??????505351565752E8????????8B??????8B??8B??????2B??8B??83????03??8B??????83????89??????77??03??0F84????????8B??????8B??????2B??03??3B??89??????75??81??????????77??8A??04??EB??83????77??08????EB??83????77??8A??80????88??EB??8D????C6????463D????????89??????76??8D????B8????????F7??C1????8B??33??8B??8B??C1????F3AB8B??83????03??F3AA8B??????81??????????4A89??????75??8B??????8B??88??468A??88??46424B75??8B??????C6????465FC6????46C6????2B??8B??????4633??89??5E5D5B83????C390909090909090909083????8B??????53558B??????568B??????8D????5789??????8B??????83????73??B8????????2B??EB??33??03??8B??2B??C1????8D??????89??????8B??????8B??????8D????3B??0F83????????8B??8B??69??????????8B??????8B??????C1????33??66??????03??8B??????2B??????89??????66??????8B??3B??0F85????????8B??????C7??????????????2B??8B??????8B??2B??0F84????????83????77??8A????0A??88????8B????89??03??E9????????83????77??8A??2C??88??468B????89??8B????89????8B????89????8B????89????03??E9????????83????77??8A??80????88??46EB??8D????C6????463D????????89??????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??8B??????81??????????4889??????75??8B??????8B??8B??????88??468B????89??8B????89????8B????89????8B????89????83????83????83????83????73??85??76??8A????88??46454B75??BB????????8B????8B????33??75??BB????????03??8B????8B??33??8B??????83????3B??73??8B??2B??????85??75??83????83????8B????8B??33??8B??????3B??72??EB??84??75??C1????4384??74??8B??????8B??03??2B??83????89??????77??3D????????77??4880????8A??80????C0????C0????0A??88??46C1????88??46E9????????3D????????77??4883????89??????77??80????80????EB??83????C6????4681??????????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??81??????????4875??8B??????88??8A??46C0????88??46C1????88??46E9????????2D????????83????89??????77??8B??80????C1????80????8A??0A??80????88??46C0????88??46C1????88??46E9????????8B??83????C1????80????80????88??4681??????????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??81??????????4875??8B??????88??8A??46C0????88??46C1????88??46E9????????8B??????E9????????8B??????8B??????8B??????2B??89??8B??5F2B??5E5D03??5B83????C390909090909090909090908B??????538B??????55568B??????C7??????????578A??8D????8B??????80????8B??76??81??????????8D????83????8B??83????0F82????????8A??88??40414F75??EB??33??8A??418B??83????0F83????????85??75??80????75??8A????81??????????4184??74??33??8A??418D??????8B??89??83????83????4E74??83????72??8B??89??83????83????83????83????73??85??76??8A??88??40414E75??EB??8A??88??40414E75??33??8A??418B??83????73??33??8B??8A??C1????2B??C1????2B??8A??????????81??????????4188??40478A??88??8A????4088??408A????83????8B??0F84????????8A??88??404183????76??8A??88??404183????76??8A??88??404133??8A??418B??83????72??8B??8B??C1????83????2B??33??8A??C1????2B??4F41C1????4E8A??88??8A????404788??40478A??88??40474E75??EB??83????72??83????75??80????75??8A????81??????????4184??74??33??8A??418D??????8D????66????81??????????C1????2B??83????EB??83????0F82????????8B??8B??83????C1????2B??83????75??80????75??8A????81??????????4184??74??33??8A??418D??????66????81??????????C1????2B??83????3B??74??81??????????83????0F82????????8B??2B??83????0F8C????????8B??89??83????83????83????8B??89??83????83????83????83????73??85??0F86????????8A??88??40474E75??E9????????33??8B??8A??C1????2B??C1????2B??4F41E9????????8B??????2B??3B??89??75??5F5E5D33??5BC31B??5F24??5E5D83????5BC39090909090909090909090909081??????????568B??68????????C7??????????FF??????????83????75??57B9????????33??8D??????66????????????F3AB66AB8D??????5068????????FF??????????83????5F75??6A??68????????FF??????????8B??5E81??????????C390909090909090909090909090568B??E8????????F6????????74??56E8????????83????8B??5EC2????909068????????C7??????????FF??????????85??75??FF??????????C39090909053558B??????5685??5774??8B??????85??74??33??33??33??85??76??8A??????????8A??????????32??80????32??8A????32??33??88????8D????BE????????F7??8D????BF????????8B??33??F7??413B??8B??72??5F5E5D5BC39083????538B??????55565768????????68????????5333??FF??????????8B??85??0F84????????68????????FF??????????8B??B0??88??????88??????8D??????B1??5056C6????????88??????C6????????C6????????C6????????C6????????88??????C6????????C6????????C6????????C6????????FF??????????5753FF??568B??FF??????????85??74??57FF??????????8B??8B??????B9????????8B??68????????50F3A5E8????????83????B8????????5F5E5D5B83????C35F8B??5E5D5B83????C39090538B??????????5657C7??????????8D????BF???????? } condition: uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them } rule TRELLIX_ARC_Hermeticwiper : TROJAN FILE { meta: description = "Detecting variants of Hermetic Wiper malware discovered in UA" author = " cb @ Trellix ATR" id = "fc6d9238-b732-541d-b083-11b43fe8770d" date = "2022-02-24" modified = "2022-02-24" reference = "https://github.com/advanced-threat-research/Yara-Rules/" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_Troj_HermWiper.yar#L1-L27" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" logic_hash = "b48e91afa19e09c7035ccda1b9293448e834d612b9a953b593f9412acb78faac" score = 75 quality = 70 tags = "TROJAN, FILE" rule_version = "v1" malware_type = "Trojan" strings: $0 = {E4B5518CD941310A015E4AF8E5968C8231492FE19246A293A569D5D7A36F56EB2FC5B68FFF6F3359C19AF6806920C3FE6628F90A75440E6616297A031BA6075100D72DFAA9829E772E45D77B89F862081EAFDB19B4B2DCEF3F273FF645ACCEAA4B991F98373973C0FB25829E860D9BC195EF1A0AD9219456AD077D42868EE03EE00E88D04C434BA97E88DF99273A35E2C668A1C69954B4762390ABDFBE4CD4AF} $1 = {90506F1C825F7AE0D8605F5C627CA325BFF199AB60A63DE8A90E923F4B18D7FB039E1DEC89D573AAB0A14C1D4BA70EB444753A41C03082A60CB4DB551393F2C50988A3181E7F31D01B5AAD94070432D98F18655AB8A555919FEFEA9DE1EDF1} $2 = {D5EEF61336015A85FF04ED298A6BDD6742FF153E33DAF9B383A5FFDCE7E64D47748DB5FF2609DF9BD5C66735FF6916797B2D365313FF1461EAEB9DAEA754FF6D4D55D1956CC8CBFF75C10CE74BF88C8DFF3B553B839D42609FFF2916227230} $3 = {6C750DDC932124500CE9B5AB91CE101BE9AD348220E9423124512282373675152281023428825C51770FE9841F853375125382F732750A5B83F60FEB6AEE2282647462228269745AEE22826F7452228275744AEE2282787442} $4 = {19A8A063FFAAAF6C1E7F78A896FFFA5C8F30BA98B69CFF1961E107BEB7636AFF9EA56A4FC4EDE3F1FF295235ACD0185726FFADA6B8CB54B342C9FF86F58524DC91617BFFB4388DBE01B6CF86} $5 = {50C449606B20184A6328556032197660AAF9507861609F6160640560B4546160C3A194056070C4A09EC4A01A0461A4C4A0831B16600561916069A291607061C09160AA1CB6204A} $6 = {FFEB19D2636B8B95273156BB63E8C78470D55970F47CF26574B46DE86EE084704590CA8053F15320258BBD1AACF18B04F2E965C6605CB10880B7E8FCF53DF5EB0621635EFF} $7 = {7E31126E14B8FF98554F6FCFB64207FFCF8D93B2573609C2FF99E4409F73BB9322FF1E5E380DC0BBABCAFF4B901EDF61BD6A68FFEE3253728C7769ABFF7BCDA939C959A282} $8 = {1970FFC6F8AA7C32EE693CFF369579E5355EF62CFF682CEAF20BA3EA1CFF1AAC638666431B20FF54293D1E709C231AFFCD11B55599F64CB9FF1E5A9015DC867F} $9 = {8DFF93B2573609C299E4FF409F73BB93221E5EFF380DC0BBABCA4B90FF1EDF61BD6A68EE32FF53728C7769AB7BCDFFA939C959A282D312FF5DD04F0370CE811F} $10 = {DF5519064E31101CF3DA96C15FF96728B708F358F51759E3A22FFA1CF1BB986A2038D6753E6BF037945B8469ADF20BAB71E10F3DE27735F640704C970DFE8672} condition: uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them } rule TRELLIX_ARC_Chimera_Recordedtv_Modified : TROJAN FILE { meta: description = "Rule to detect the modified version of RecordedTV.ms found in the Operation Skeleton" author = "Marc Rivero | McAfee ATR Team" id = "b0969713-41a4-550c-9545-f02783fa8d02" date = "2020-04-21" modified = "2020-08-14" reference = "https://medium.com/@cycraft_corp/taiwan-high-tech-ecosystem-targeted-by-foreign-apt-group-5473d2ad8730" source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_operation_skeleton.yar#L1-L33" license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE" hash = "66f13964c87fc6fe093a9d8cc0de0bf2b3bdaea9564210283fdb97a1dde9893b" logic_hash = "7165779b66999259a079fa68f898c5f9fb634adcb9d249366d321dff1014184b" score = 75 quality = 70 tags = "TROJAN, FILE" rule_version = "v1" malware_type = "trojan" malware_family = "Trojan:W32/RecordedTV" actor_type = "Apt" actor_group = "Unknown" strings: $byte = { C0 0E 5B C3 } $s1 = "Encrypted file: CRC failed in %s (password incorrect ?)" fullword wide $s2 = "EBorland C++ - Copyright 1999 Inprise Corporation" fullword ascii $s3 = " MacOS file type: %c%c%c%c ; " fullword wide $s4 = "rar.lng" fullword ascii condition: uint16( 0 ) == 0x5a4d and filesize < 900KB and all of them } /* * YARA Rule Set * Repository Name: Volexity * Repository: https://github.com/volexity/threat-intel * Retrieval Date: 2026-10-26 * Git Commit: 683296427d8c7f08938ce6c587f618c938cf4c54 * Number of Rules: 93 * Skipped: 1 (age), 8 (quality), 1 (score), 0 (importance) * * * LICENSE * * Copyright 2022 by Volexity, Inc. The 2-Clause BSD License Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ rule VOLEXITY_Webshell_Jsp_Godzilla : FILE MEMORY { meta: description = "Detects the JSP implementation of the Godzilla Webshell." author = "threatintel@volexity.com" id = "47c8eab8-84d7-5566-b757-5a6dcc7579b7" date = "2021-11-08" modified = "2024-07-30" reference = "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L1-L34" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "2786d2dc738529a34ecde10ffeda69b7f40762bf13e7771451f13a24ab7fc5fe" logic_hash = "52cba9545f662da18ca6e07340d7a9be637b89e7ed702dd58cac545c702a00e3" score = 75 quality = 80 tags = "FILE, MEMORY" os = "win,linux" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 6100 version = 6 strings: $s1 = ".getWriter().write(base64Encode(" wide ascii $s2 = ".getAttribute(" ascii wide $s3 = "java.security.MessageDigest" ascii wide $auth1 = /String xc=\"[a-f0-9]{16}\"/ ascii wide $auth2 = "String pass=\"" ascii wide $magic = "class X extends ClassLoader{public X(ClassLoader z){super(z);}public Class Q" $magic2 = "<%@page import=\"java.util.*,javax.crypto.*,javax.crypto.spec.*\"%><%!class" condition: all of ( $s* ) or all of ( $auth* ) or any of ( $magic* ) } rule VOLEXITY_Susp_Jsp_General_Runtime_Exec_Req : FILE MEMORY { meta: description = "Looks for a common design pattern in webshells where a request attribute is passed as an argument to exec()." author = "threatintel@volexity.com" id = "7f1539bd-a2f0-50dd-b500-ada4e0971d13" date = "2022-02-02" modified = "2024-07-30" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L35-L56" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "4935f0c50057e28efa7376c734a4c66018f8d20157b6584399146b6c79a6de15" logic_hash = "d3048aba80c1c39f1673931cd2d7c5ed83045603b0ad204073fd788d0103a6c8" score = 65 quality = 80 tags = "FILE, MEMORY" os = "win,linux" os_arch = "all" scan_context = "file,memory" severity = "high" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 6450 version = 3 strings: $s1 = "Runtime.getRuntime().exec(request." ascii condition: $s1 } rule VOLEXITY_Webshell_Jsp_Regeorg : FILE MEMORY { meta: description = "Detects the reGeorg webshells' JSP version." author = "threatintel@volexity.com" id = "205ee383-4298-5469-a509-4ce3eaf9dd0e" date = "2022-03-08" modified = "2024-09-20" reference = "https://github.com/SecWiki/WebShell-2/blob/master/reGeorg-master/tunnel.jsp" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L57-L86" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "f9b20324f4239a8c82042d8207e35776d6777b6305974964cd9ccc09d431b845" logic_hash = "cecb71605d9112d509823c26e40e1cf9cd6db581db448db5c9ffc63a2bfe529e" score = 75 quality = 80 tags = "FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 6575 version = 5 strings: $magic = "socketChannel.connect(new InetSocketAddress(target, port))" ascii $a1 = ".connect(new InetSocketAddress" ascii $a2 = ".configureBlocking(false)" ascii $a3 = ".setHeader(" ascii $a4 = ".getHeader(" ascii $a5 = ".flip();" ascii condition: $magic or all of ( $a* ) } rule VOLEXITY_Apt_Malware_Macos_Gimmick : STORMBAMBOO FILE MEMORY { meta: description = "Detects the macOS port of the GIMMICK malware." author = "threatintel@volexity.com" id = "3d485788-4aab-511b-a49e-5dc09d1950a9" date = "2021-10-18" modified = "2024-08-02" reference = "https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-03-22 GIMMICK/indicators/yara.yar#L1-L59" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f" logic_hash = "00fba9df2212874a45d44b3d098a7b76c97fcd53ff083c76b784d2b510a4a467" score = 75 quality = 78 tags = "STORMBAMBOO, FILE, MEMORY" os = "darwin" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 6022 version = 8 strings: $s1 = "http://cgi1.apnic.net/cgi-bin/my-ip.php --connect-timeout 10 -m 20" wide ascii $json1 = "base_json" ascii wide $json2 = "down_json" ascii wide $json3 = "upload_json" ascii wide $json4 = "termin_json" ascii wide $json5 = "request_json" ascii wide $json6 = "online_json" ascii wide $json7 = "work_json" ascii wide $msg1 = "bash_pid: %d, FDS_CHILD: %d, FDS_PARENT: %d" ascii wide $msg2 = "pid %d is dead" ascii wide $msg3 = "exit with code %d" ascii wide $msg4 = "recv signal %d" ascii wide $cmd1 = "ReadCmdQueue" ascii wide $cmd2 = "read_cmd_server_timer" ascii wide $cmd3 = "enableProxys" ascii wide $cmd4 = "result_block" ascii wide $cmd5 = "createDirLock" ascii wide $cmd6 = "proxyLock" ascii wide $cmd7 = "createDirTmpItem" ascii wide $cmd8 = "dowfileLock" ascii wide $cmd9 = "downFileTmpItem" ascii wide $cmd10 = "filePathTmpItem" ascii wide $cmd11 = "uploadItems" ascii wide $cmd12 = "downItems" ascii wide $cmd13 = "failUploadItems" ascii wide $cmd14 = "failDownItems" ascii wide $cmd15 = "downloadCmds" ascii wide $cmd16 = "uploadFiles" ascii wide $cmd17 = "bash callback...." ascii wide condition: $s1 or 5 of ( $json* ) or 3 of ( $msg* ) or 9 of ( $cmd* ) } rule VOLEXITY_Apt_Malware_Win_Gimmick_Dotnet_Base : STORMBAMBOO FILE MEMORY { meta: description = "Detects the base version of GIMMICK written in .NET." author = "threatintel@volexity.com" id = "be42d85f-3143-51d3-b148-95d0ae666771" date = "2020-03-16" modified = "2024-08-19" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-03-22 GIMMICK/indicators/yara.yar#L60-L86" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "b554bfe4c2da7d0ac42d1b4f28f4aae854331fd6d2b3af22af961f6919740234" logic_hash = "39a38ea189d5e840f9334cb7ec8f390444139b39c6f426906a8845f9a1ada9f7" score = 75 quality = 80 tags = "STORMBAMBOO, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 6628 version = 3 strings: $other1 = "srcStr is null" wide $other2 = "srcBs is null " wide $other3 = "Key cannot be null" wide $other4 = "Faild to get target constructor, targetType=" wide $other5 = "hexMoudule(public key) cannot be null or empty." wide $other6 = "https://oauth2.googleapis.com/token" wide condition: 5 of ( $other* ) } rule VOLEXITY_Apt_Malware_Js_Sharpext : SHARPPINE FILE MEMORY { meta: description = "A malicious Chrome browser extension used by the SharpPine threat actor to steal Gmail data from a victim." author = "threatintel@volexity.com" id = "61b5176a-ff73-5fce-bc70-c9e09bb5afed" date = "2021-09-14" modified = "2025-05-21" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-07-28 SharpTongue SharpTongue Deploys Clever Mail-Stealing Browser Extension SHARPEXT/yara.yar#L1-L52" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "1c9664513fe226beb53268b58b11dacc35b80a12c50c22b76382304badf4eb00" hash = "6025c66c2eaae30c0349731beb8a95f8a5ba1180c5481e9a49d474f4e1bb76a4" hash = "6594b75939bcdab4253172f0fa9066c8aee2fa4911bd5a03421aeb7edcd9c90c" logic_hash = "0ed58c8646582ee36aeac650fac02d1e4962d45c0f6a24783c021d9267bed192" score = 75 quality = 80 tags = "SHARPPINE, FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 5916 version = 5 strings: $s1 = "\"mode=attach&name=\"" ascii $s2 = "\"mode=new&mid=\"" ascii $s3 = "\"mode=attlist\"" ascii $s4 = "\"mode=list\"" ascii $s5 = "\"mode=domain\"" ascii $s6 = "\"mode=black\"" ascii $s7 = "\"mode=newD&d=\"" ascii $mark1 = "chrome.runtime.onMessage.addListener" ascii $mark2 = "chrome.webNavigation.onCompleted.addListener" ascii $enc1 = "function BSue(string){" ascii $enc2 = "function BSE(input){" ascii $enc3 = "function bin2hex(byteArray)" ascii $xhr1 = ".send(\"mode=cd1" ascii $xhr2 = ".send(\"mode=black" ascii $xhr3 = ".send(\"mode=domain" ascii $xhr4 = ".send(\"mode=list" ascii $manifest1 = "\"description\":\"advanced font\"," ascii $manifest2 = "\"scripts\":[\"bg.js\"]" ascii $manifest3 = "\"devtools_page\":\"dev.html\"" ascii condition: (5 of ( $s* ) and all of ( $mark* ) ) or all of ( $enc* ) or 3 of ( $xhr* ) or 2 of ( $manifest* ) } rule VOLEXITY_Webshell_Jsp_Converge : FILE MEMORY CVE_2022_26134 { meta: description = "Detects CONVERGE - a file upload webshell observed in incident involving compromise of Confluence server via CVE-2022-26134." author = "threatintel@volexity.com" id = "2a74678e-cb00-567c-a2e0-2e095f3e5ee8" date = "2022-06-01" modified = "2024-09-20" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L1-L21" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" logic_hash = "bb48516342eddd48c35e6db0eb74f95e116dc723503552b99ba721b5bdb391e5" score = 75 quality = 80 tags = "FILE, MEMORY, CVE-2022-26134" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 6788 version = 5 strings: $s1 = "if (request.getParameter(\"name\")!=null && request.getParameter(\"name\").length()!=0){" ascii condition: $s1 } rule VOLEXITY_Webshell_Java_Realcmd : FILE MEMORY { meta: description = "Detects the RealCMD webshell, one of the payloads for BEHINDER." author = "threatintel@volexity.com" id = "60b30ccc-bcfa-51e6-a3f5-88037d19213e" date = "2022-06-01" modified = "2024-07-30" reference = "https://github.com/Freakboy/Behinder/blob/master/src/main/java/vip/youwe/sheller/payload/java/RealCMD.java" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L61-L84" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "a9a30455d6f3a0a8cd0274ae954aa41674b6fd52877fafc84a9cb833fd8858f6" logic_hash = "e09f2a23674fd73296dd4d1fabf1a2c812bfe69ff02abc96a4be35af6a18e512" score = 75 quality = 80 tags = "FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 6786 version = 4 strings: $fn1 = "runCmd" wide ascii fullword $fn2 = "RealCMD" ascii wide fullword $fn3 = "buildJson" ascii wide fullword condition: all of ( $fn* ) } rule VOLEXITY_Malware_Golang_Pantegana : FILE MEMORY { meta: description = "Detects PANTEGANA, a Golang backdoor used by a range of threat actors due to its public availability." author = "threatintel@volexity.com" id = "b6154165-68e0-5986-a0cf-5631d369c230" date = "2022-03-30" modified = "2025-03-21" reference = "https://github.com/elleven11/pantegana" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L90-L120" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "8297c99391aae918f154077c61ea94a99c7a339166e7981d9912b7fdc2e0d4f0" logic_hash = "791a664a6b4b98051cbfacb451099de085cbab74d73771709377ab68a5a23d2b" score = 75 quality = 80 tags = "FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "high" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 6631 version = 3 strings: $s1 = "RunFingerprinter" ascii $s2 = "SendSysInfo" ascii $s3 = "ExecAndGetOutput" ascii $s4 = "RequestCommand" ascii $s5 = "bindataRead" ascii $s6 = "RunClient" ascii $magic = "github.com/elleven11/pantegana" ascii condition: 5 of ( $s* ) or $magic } rule VOLEXITY_Malware_Any_Pupyrat_B : FILE MEMORY { meta: description = "Detects the PUPYRAT malware family, a cross-platform RAT written in Python." author = "threatintel@volexity.com" id = "ec8d0448-f47d-5c6e-bcf9-8f40ae83a96f" date = "2022-04-07" modified = "2025-03-21" reference = "https://github.com/n1nj4sec/pupy" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L121-L158" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "7474a6008b99e45686678f216af7d6357bb70a054c6d9b05e1817c8d80d536b4" logic_hash = "f5b5f35ee783ff1163072591c6d48a85894729156935650a0fd166ae22a2ea00" score = 75 quality = 80 tags = "FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 6689 version = 4 strings: $elf1 = "LD_PRELOAD=%s HOOK_EXIT=%d CLEANUP=%d exec %s 1>/dev/null 2>/dev/null" ascii $elf2 = "reflective_inject_dll" fullword ascii $elf3 = "ld_preload_inject_dll" fullword ascii $pupy1 = "_pupy.error" ascii $pupy2 = "pupy://" ascii $s1 = "Args not passed" ascii $s2 = "Too many args" ascii $s3 = "Can't execute" ascii $s4 = "mexec:stdin" ascii $s5 = "mexec:stdout" ascii $s6 = "mexec:stderr" ascii $s7 = "LZMA error" ascii condition: any of ( $elf* ) or all of ( $pupy* ) or all of ( $s* ) } rule VOLEXITY_Susp_Php_Fileinput_Eval : FILE { meta: description = "Rule designed to detect PHP files which use file_get_contents() and then shortly afterwards use an eval statement." author = "threatintel@volexity.com" id = "3e311677-22ea-5e5f-bdc6-dd67033d25a6" date = "2021-06-16" modified = "2024-12-12" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L159-L182" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "1a34c43611ee310c16acc383c10a7b8b41578c19ee85716b14ac5adbf0a13bd5" hash = "6e8874c756c009c63f715a44ca72d0cb31dc25d87d7df6ca2830fe8330580342" logic_hash = "de376bfdfa5b6244c414454cb5d43d29e3dd75e049389f0c430c160f9d198965" score = 65 quality = 80 tags = "FILE" os = "win,linux" os_arch = "all" scan_context = "file" severity = "high" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 5581 version = 5 strings: $s1 = "file_get_contents(\"php://input\")" $s2 = "eval(" condition: $s2 in ( @s1 [ 1 ] .. ( @s1 [ 1 ] + 512 ) ) } rule VOLEXITY_Susp_Php_Call_User_Func : FILE { meta: description = "Webshells using call_user_func() function against an object from a file input or POST variable." author = "threatintel@volexity.com" id = "48c7857e-7dda-5e3f-b82c-7d34c251f083" date = "2021-06-16" modified = "2024-07-30" reference = "https://zhuanlan.zhihu.com/p/354906657" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L183-L205" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "40b053a2f3c8f47d252b960a9807b030b463ef793228b1670eda89f07b55b252" logic_hash = "46c999da97682023861e58f9cd2c8651480db990a0361c1985c6d5c35b5bf0ea" score = 65 quality = 80 tags = "FILE" os = "win,linux" os_arch = "all" scan_context = "file" severity = "high" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 5582 version = 4 strings: $s1 = "@call_user_func(new C()" wide ascii condition: $s1 } rule VOLEXITY_Apt_Malware_Win_Applejeus_Oct22 : LAZYPINE FILE MEMORY { meta: description = "Detects AppleJeus DLL samples." author = "threatintel@volexity.com" id = "f88e2253-e296-57d8-a627-6cb4ccff7a92" date = "2022-11-03" modified = "2025-05-21" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L1-L22" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "82e67114d632795edf29ce1d50a4c1c444846d9e16cd121ce26e63c8dc4a1629" logic_hash = "46f3325a7e8e33896862b1971f561f4871670842aecd46bcc7a5a1af869ecdc4" score = 75 quality = 80 tags = "LAZYPINE, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 8495 version = 3 strings: $s1 = "HijackingLib.dll" ascii condition: $s1 } rule VOLEXITY_Apt_Malware_Win_Applejeus_B_Oct22 : LAZYPINE FILE MEMORY { meta: description = "Detects unpacked AppleJeus samples." author = "threatintel@volexity.com" id = "8586dc64-225b-5f28-a6d6-b9b6e8f1c815" date = "2022-11-03" modified = "2025-05-21" reference = "https://www.volexity.com/blog/2022/12/01/buyer-beware-fake-cryptocurrency-applications-serving-as-front-for-applejeus-malware/" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L24-L54" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "9352625b3e6a3c998e328e11ad43efb5602fe669aed9c9388af5f55fadfedc78" logic_hash = "76f3c9692ea96d3cadbbcad03477ab6c53445935352cb215152b9b5483666d43" score = 75 quality = 80 tags = "LAZYPINE, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 8497 version = 5 strings: $key1 = "AppX7y4nbzq37zn4ks9k7amqjywdat7d" $key2 = "Gd2n5frvG2eZ1KOe" $str1 = "Windows %d(%d)-%s" $str2 = "&act=check" condition: ( any of ( $key* ) and 1 of ( $str* ) ) or all of ( $str* ) } rule VOLEXITY_Apt_Malware_Win_Applejeus_C_Oct22 : LAZYPINE MEMORY { meta: description = "Detects unpacked AppleJeus samples." author = "threatintel@volexity.com" id = "c9cbddde-220c-5e26-8760-85c29b98bfeb" date = "2022-11-03" modified = "2023-09-28" reference = "https://www.volexity.com/blog/2022/12/01/buyer-beware-fake-cryptocurrency-applications-serving-as-front-for-applejeus-malware/" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L57-L84" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "a0db8f8f13a27df1eacbc01505f311f6b14cf9b84fbc7e84cb764a13f001dbbb" logic_hash = "a9e635d9353c8e5c4992beba79299fb889a7a3d5bc3eaf191f8bb7f51258a6c6" score = 75 quality = 80 tags = "LAZYPINE, MEMORY" os = "win" os_arch = "all" scan_context = "memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 8519 version = 3 strings: $str1 = "%sd.e%sc \"%s > %s 2>&1\"" wide $str2 = "tuid" $str4 = "payload" $str5 = "fconn" $str6 = "Mozilla_%lu" condition: 5 of ( $str* ) } rule VOLEXITY_Apt_Malware_Win_Applejeus_D_Oct22 : LAZYPINE FILE MEMORY { meta: description = "Detected AppleJeus unpacked samples." author = "threatintel@volexity.com" id = "80d2821b-a437-573e-9e9d-bf79f9422cc9" date = "2022-11-10" modified = "2025-05-21" reference = "https://www.volexity.com/blog/2022/12/01/buyer-beware-fake-cryptocurrency-applications-serving-as-front-for-applejeus-malware/" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L87-L112" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "a241b6611afba8bb1de69044115483adb74f66ab4a80f7423e13c652422cb379" logic_hash = "23c0642e5be15a75a39d089cd52f2f14d633f7af6889140b9ec6e53c5c023974" score = 75 quality = 80 tags = "LAZYPINE, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 8534 version = 3 strings: $reg = "Software\\Bitcoin\\Bitcoin-Qt" $pattern = "%s=%d&%s=%s&%s=%s&%s=%d" $exec = " \"%s\", RaitingSetupUI " $http = "Accept: */*" wide condition: all of them } rule VOLEXITY_Apt_Delivery_Macro_Lazypine_Jeus_B : LAZYPINE FILE { meta: description = "Detects macros used by the LazyPine threat actor to distribute AppleJeus." author = "threatintel@volexity.com" id = "ac4d4e82-e29f-5134-999d-b8dcef59d285" date = "2022-11-03" modified = "2025-05-21" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L114-L139" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b" logic_hash = "e55199e6ad26894f98e930cd4716127ee868872d08ada1c44675e4db1ec27894" score = 75 quality = 80 tags = "LAZYPINE, FILE" os = "win" os_arch = "all" scan_context = "file" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 8493 version = 3 strings: $a1 = ", vbDirectory) = \"\" Then" ascii $a2 = ".Caption & " ascii $a3 = ".nodeTypedValue" ascii $a4 = ".Application.Visible = False" ascii $a5 = " MkDir (" ascii condition: all of ( $a* ) } rule VOLEXITY_Apt_Delivery_Office_Macro_Lazypine_Jeus : LAZYPINE FILE { meta: description = "Detects malicious documents used by LazyPine in a campaign dropping the AppleJeus malware." author = "threatintel@volexity.com" id = "f9a92f47-aa1d-56ea-ac59-47cc559f379f" date = "2022-11-02" modified = "2025-05-21" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L141-L165" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b" logic_hash = "54d5396b889a45d81122301eadf77f73135937fbe9647ad60491ac7856faf5ad" score = 75 quality = 80 tags = "LAZYPINE, FILE" os = "all" os_arch = "all" scan_context = "file" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 8490 version = 7 strings: $s1 = "0M8R4K" ascii $s2 = "bin.base64" ascii $s3 = "dragon" ascii $s4 = "Workbook_Open" ascii condition: all of ( $s* ) } rule VOLEXITY_Apt_Malware_Js_Longtale : LONGTALE JUNGLEBAMBOO FILE MEMORY { meta: description = "Detection for LONGTALE, a chrome extension malware." author = "threatintel@volexity.com" id = "b97eaf48-8c4e-5fea-af7c-d1f559d334af" date = "2026-09-08" modified = "2026-09-08" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2026/2026-09-09 Chrome/rules.yar#L1-L37" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3" logic_hash = "194266bc6710943a421f1e3a65cf5345b061edd3777a9f555fa435fef41e7baa" score = 75 quality = 80 tags = "LONGTALE, JUNGLEBAMBOO, FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" report1 = "TIB-20260908B" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 13428 version = 2 strings: $f1 = "getPublicIP" ascii $f2 = "captureCookies" ascii $f3 = "recordFetch" ascii $f4 = "injectRecorder" ascii $f5 = "captureVisibleTab" ascii $f6 = "buildIngestPayload" ascii $case1 = "SET_KEYWORDS" $case2 = "GET_KEYWORDS" $case3 = "SCREENSHOT_NOW" $case4 = "FETCH_HISTORY" $case5 = "CAPTURE_STORAGE" $case6 = "CAPTURE_COOKIES" $case7 = "TOGGLE_RECORDING" condition: all of ( $f* ) or all of ( $case* ) } rule VOLEXITY_Apt_Malware_Win_Superstomp : JUNGLEBAMBOO SUPERSTOMP FILE MEMORY { meta: description = "Detection for the SUPERSTOMP malware used by JungleBamboo." author = "threatintel@volexity.com" id = "7719e855-70d7-56a9-9888-9d6f6a9afc2f" date = "2026-09-08" modified = "2026-09-08" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2026/2026-09-09 Chrome/rules.yar#L38-L73" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3" logic_hash = "b1e4c1f0bf614dae29ca534205792efe24605a2807e3a9c67f8c6e99aa153bfa" score = 75 quality = 80 tags = "JUNGLEBAMBOO, SUPERSTOMP, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" report1 = "TIB-20260908B" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 13427 version = 3 strings: $stomp_ua = "stomp/1.0" wide $stomp_pem = "stomp_ext_key.pem" wide $stomp_spki = "stomp_ext_key.spki" wide $stomp_bak = "stomp.bak" wide $xor_key = { 5a c3 17 8e f0 2b 96 41 7d 0a e8 33 b5 64 1f da } $browser_secpref = "Secure Preferences" wide $browser_extsettings = "extensions.settings." ascii $browser_devmode = "extensions.ui.developer_mode" ascii $browser_taskkill = "cmd.exe /c taskkill /F /IM " wide $browser_restore = "--restore-last-session" wide condition: 3 of ( $stomp* ) or $xor_key or all of ( $browser* ) } rule VOLEXITY_Exploit_Log_Ivanti_Rce : CVE_2026_104935 FILE MEMORY { meta: description = "Identifies files or memory regions containing request headers matching RCE vulnerability for Ivanti." author = "threatintel@volexity.com" id = "f1866c63-bb33-5747-b50c-c6111e44de2b" date = "2026-10-12" modified = "2026-10-12" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2026/2026-10-13 Ivanti/rules.yar#L1-L22" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" logic_hash = "4b17ac31a7e824bae5ef33a5fb16142764193e151348cbaa0cccda3fe2c09850" score = 75 quality = 80 tags = "CVE_2026_104935, FILE, MEMORY" os = "linux" os_arch = "all" scan_context = "file,memory" severity = "critical" report1 = "TIB-20261012" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 13503 version = 1 strings: $s1 = "X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi" ascii condition: $s1 } rule VOLEXITY_Exploit_Py_Ivanti_Oct26 : CVE_2026_104935 UTA0576 MEMORY { meta: description = "Detection for EoP vuln implementation in Python used by UTA0576." author = "threatintel@volexity.com" id = "de9fa239-09db-5851-af56-74a616c3a57a" date = "2026-10-10" modified = "2026-10-12" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2026/2026-10-13 Ivanti/rules.yar#L24-L51" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "25b95f47359c327e3a5ae5ac5cd147f8d9afd98092faf136822ee287e25e3dc8" logic_hash = "051f0d737a70836f27f4333f647d91572fc327be219c8dcbe5b62b0042b81312" score = 75 quality = 80 tags = "CVE_2026_104935, UTA0576, MEMORY" os = "linux" os_arch = "all" scan_context = "memory" severity = "critical" report1 = "TIB-20261012" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 13500 version = 3 strings: $magic1 = "target dsinvoked broker is busy; stop retries and clear its current child" ascii $magic2 = "PATCH_LOCATOR arch=%s offset=%s sha256=%s encoding=%s open=%s call=%s evidence=%s" $pycombo1 = "import os,socket,time,_frozen_importlib_external as ie" $pycombo2 = "def say(*x): print(*x,flush=True)" condition: any of ( $magic* ) or all of ( $pycombo* ) } rule VOLEXITY_Apt_Malware_Win_CLEANGULP_Memoryonly : CLEANGULP MEMORY { meta: description = "CLEANGULP: Detects decoded runtime strings associated with command-and-control, tasking, and persistence." author = "threatintel@volexity.com" id = "e1c0e877-2d11-567c-8e9f-c40ef9d8f784" date = "2026-09-16" modified = "2026-09-16" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2026/2026-09-21 Chrome-part-2/rules.yar#L1-L29" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" logic_hash = "dd65a0a286689427b296b4468147231e9ff17aa2ba1e6ce582f53db50b5b543f" score = 75 quality = 80 tags = "CLEANGULP, MEMORY" os = "win" os_arch = "all" scan_context = "memory" severity = "high" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 13450 version = 1 strings: $protocol_pre_register = "%s/beacon/pre-register" ascii $protocol_register = "%s/beacon/register" ascii $protocol_registration = "{\"uuid\":\"%s\",\"username\":\"%s\",\"computer\":\"%s\",\"internal_ip\":\"%s\",\"process\":\"%s\",\"pid\":%d,\"arch\":\"%s\",\"is_admin\":%s}" ascii $protocol_file_transfer = "{\"task_id\":\"%s\",\"filename\":\"%s\",\"data\":\"%s\",\"size\":%ld,\"chunk\":%d,\"total_chunks\":%d,\"file_transfer\":true}" ascii $capability_help = "Available: shell, ps, ls, upload, download, sleep, exit, help, bof" ascii $capability_upload = "[-] Usage: upload <server_filename>:<target_path>" ascii $capability_bof = "[-] Usage: bof <encoded_bof>:<encoded_args>" ascii condition: 2 of ( $protocol* ) or 2 of ( $capability* ) } rule VOLEXITY_Apt_Webshell_Java_Orangetail_B : UTA0533 ORANGETAIL FILE MEMORY { meta: description = "Detection for the accept logic of ORANGETAIL, a custom Java webshell used by UTA0533." author = "threatintel@volexity.com" id = "e9f19175-ea33-5eea-8663-91fc805306bb" date = "2026-07-06" modified = "2026-07-14" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2026/2026-07-17 SonicWall/rules.yar#L1-L25" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "1e1e68bbb899450a57274a8b12082ed4e2040a2aae77014f20431689d2b4edee" hash = "ea9154e374e4f77bc2cf54282e23543573980342a85bc888cb23f20b8bbba081" logic_hash = "e5ed25fb820dc4a18c374936c36d4321e2aba72d8b640cdb0d81abd764786918" score = 75 quality = 80 tags = "UTA0533, ORANGETAIL, FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" report1 = "TIB-20260714B" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 13240 version = 6 strings: $s1 = ".equals($1.getHeader(\"User-Agent\"))) { javax.servlet.jsp.JspFactory" ascii $s2 = " $2.setStatus(404); $2.setContentLength(0); $2.flushBuffer(); return;" ascii condition: all of them } rule VOLEXITY_Apt_Webshell_Java_Orangetail : UTA0533 ORANGETAIL FILE MEMORY { meta: description = "Detection for ORANGETAIL, a custom Java webshell used by UTA0533." author = "threatintel@volexity.com" id = "5bbffb5f-0917-57e4-a7d4-f5c770b5d253" date = "2026-07-06" modified = "2026-07-14" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2026/2026-07-17 SonicWall/rules.yar#L26-L53" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "ea9154e374e4f77bc2cf54282e23543573980342a85bc888cb23f20b8bbba081" logic_hash = "1a495df2bc13b1c2c61315d76d66b150452b923afa5847121429fa8ae9788a7b" score = 75 quality = 80 tags = "UTA0533, ORANGETAIL, FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" report1 = "TIB-20260714B" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 13239 version = 5 strings: $s1 = "agentmain called args=" $s2 = "tryInject=" $s3 = "agentmain ex:" $s4 = "javassist=" $s5 = "tryInject exception" $s6 = "found loaded class:" condition: 4 of ( $s* ) } rule VOLEXITY_Apt_Malware_Any_Uta0533_Ua : UTA0533 FILE MEMORY { meta: description = "Identify any blob containing a bogus user-agent used in different components of an attack attributed to UTA0533." author = "threatintel@volexity.com" id = "c13dafb2-b2c3-5988-91dd-0345ef60086c" date = "2026-07-06" modified = "2026-07-14" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2026/2026-07-17 SonicWall/rules.yar#L54-L76" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "8c470301dcb7278f73e622f1950073567b34011c64b60cdfbb0f89803923a5a3" logic_hash = "d4c0322080e853f5c5d495af05d43eaf3d375af6905e795cef718dec639a7092" score = 75 quality = 80 tags = "UTA0533, FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" report1 = "TIB-20260714B" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 13237 version = 3 strings: $s1 = "Mozilla/6.0 (Windows NT 11.0; Win64; x64) AppleWebKit/1537.136 (KHTML, like Gecko) Chrome/149.0.0.1 Safari/1537.136" ascii condition: $s1 } rule VOLEXITY_Apt_Malware_Python_Knuckleball : UTA0533 KNUCKLEBALL FILE MEMORY { meta: description = "Detects KNUCKLEBALL, a python based injector malware, using string patterns." author = "threatintel@volexity.com" id = "bceaee99-902b-5e0d-a8e6-f9909fcd3334" date = "2026-07-06" modified = "2026-07-14" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2026/2026-07-17 SonicWall/rules.yar#L77-L109" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "8c470301dcb7278f73e622f1950073567b34011c64b60cdfbb0f89803923a5a3" logic_hash = "306b5e0cc66af163c1dea29f8c55f0dbb396ddcefb63f22d62601d7cf1ea839d" score = 75 quality = 80 tags = "UTA0533, KNUCKLEBALL, FILE, MEMORY" os = "linux" os_arch = "all" scan_context = "file,memory" severity = "high" report1 = "TIB-20260714B" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 13233 version = 5 strings: $s1 = "/tmp/.java_pid{pid}" ascii $s2 = "/tmp/.attach_pid{pid}" ascii $s3 = "timeout waiting for JVMTI attach socket" ascii $s4 = "workplace.startup.CommandStartup" ascii $s5 = "/var/run/control.unit.sock" ascii $func1 = "unit_put(" ascii $func2 = "check_gate(" ascii $func3 = "inject_jar(" ascii $func4 = "find_wp_pid(" ascii condition: 2 of ( $s* ) or 3 of ( $func* ) } rule VOLEXITY_Apt_Malware_Any_Dotnet_Aot_Plenet : VERDANTBAMBOO PLENET FILE MEMORY { meta: description = "Detect PLENET, a multiplatform malware compile with native AOT." author = "threatintel@volexity.com" id = "615d7c43-0128-5cfa-a080-6ece5d2dc029" date = "2025-09-22" modified = "2025-10-30" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2026/2026-06-04 VerdantBamboo/rules.yar#L1-L31" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "eb141a43958802727a6c813452450c10b92704bea4474ee5fd87c0a1be326e2e" logic_hash = "67d8f7fbc2986b1068a9c557cf85ba83469e3fb7f2433bd10c7ad740a4b0e717" score = 75 quality = 80 tags = "VERDANTBAMBOO, PLENET, FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" report1 = "TIB-20251104" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 12367 version = 4 strings: $str1 = "[!] Bad dat" wide $str2 = "[!] Connection error. Kill Pty" wide $str3 = "[!] Error : Plexor is nul" wide $str4 = "[!] Unkown message type" wide $str5 = "[*] Disposing.." wide $str6 = "Lack port ':" wide $str7 = "IPv6 port error ':" wide $str8 = "this.existingPipeGiven." wide $str9 = "port must within 0~6553" wide condition: 4 of them } rule VOLEXITY_Apt_Malware_Elf_Verdantbamboo_Paths : VERDANTBAMBOO FILE MEMORY { meta: description = "Detection for VerdantBamboo related malware based on paths from local machines observed in binaries." author = "threatintel@volexity.com" id = "256f6bdc-1067-52e8-81b9-c7be1b802947" date = "2025-09-22" modified = "2026-01-27" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2026/2026-06-04 VerdantBamboo/rules.yar#L32-L54" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "eb141a43958802727a6c813452450c10b92704bea4474ee5fd87c0a1be326e2e" logic_hash = "aac17908a9d5e71d5db3fbdf9bb3307c74f5911bd253bb2060b05fbf238b2c3f" score = 75 quality = 80 tags = "VERDANTBAMBOO, FILE, MEMORY" os = "linux" os_arch = "all" scan_context = "file,memory" severity = "critical" report1 = "TIB-20251104" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 12361 version = 3 strings: $s1 = "bin/Release/net8.0/linux-x64/native/server" ascii condition: $s1 } rule VOLEXITY_Apt_Malware_Golang_Brickstorm_B : VERDANTBAMBOO BRICKSTORM FILE MEMORY { meta: description = "Detection for the BRICKSTORM malware family." author = "threatintel@volexity.com" id = "b3b9ff26-56ab-5801-8905-0a304887b998" date = "2025-09-05" modified = "2026-06-09" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2026/2026-06-04 VerdantBamboo/rules.yar#L56-L98" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878" logic_hash = "e91203a714a4bc9d1c70eae4670681e3f416257163cf44db20ad33380be5d39a" score = 75 quality = 80 tags = "VERDANTBAMBOO, BRICKSTORM, FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" report1 = "TIB-20251104" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 12299 version = 6 strings: $method1 = "UnPackHeaderData" $method2 = "handleRelay" $method3 = "NewWebSocketClient" $method4 = "createDnsMessage" $method5 = "GetFileOwnerInfo" $err1 = "dns rcode: %v" $err2 = "readFull error" $err3 = "tagAuth error" $err4 = "error: Auth: %s" $ws1 = "<a style='text-decoration: none;' href='javascript:history.go(-1);'><h5>Back</h5></a>" $ws2 = "Mon, 02 Jan 2006 15:04:05 GMT" $doh = "https://1.0.0.1/dns-queryhttps://1.1.1.1/dns-queryhttps://8.8.4.4/dns-queryhttps://8.8.8.8/dns-query" condition: 4 of ( $method* ) or 3 of ( $err* ) or all of ( $ws* ) or ( $doh and 3 of ( $method* , $err* , $ws* , $doh ) ) } rule VOLEXITY_Apt_Malware_Golang_Brickstorm : VERDANTBAMBOO BRICKSTORM FILE MEMORY { meta: description = "Detects the BRICKSTORM backdoor using common strings." author = "threatintel@volexity.com" id = "25775278-5115-5873-957f-9c5d0c8e4f5e" date = "2025-09-04" modified = "2025-10-30" reference = "https://blog.nviso.eu/wp-content/uploads/2025/04/NVISO-BRICKSTORM-Report.pdf" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2026/2026-06-04 VerdantBamboo/rules.yar#L100-L136" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "40d264cf9c73923932c3dfd52d20f46ff602be3fea8dc6ecc71aca46e6067bf5" hash = "e981fc4eaaa6417e6034e21438e55c0360773674a6fc0b63c1b95026449e5254" logic_hash = "39e3403d90ad67072ae631273e89fe059ec48906ce1d57fe1afbb91304dc84f3" score = 75 quality = 80 tags = "VERDANTBAMBOO, BRICKSTORM, FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" report1 = "TIB-20251104" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 12298 version = 7 strings: $dns1 = "https://1.1.1.1/dns-query" ascii $dns2 = "https://8.8.4.4/dns-query" ascii $dns3 = "https://8.8.8.8/dns-query" ascii $pack1 = "wsshell/core" ascii $pack2 = "wssoft/core" ascii $s1 = "github.com/hashicorp/yamux" ascii $s2 = "winbindd:" ascii $s3 = "WEE1=true" ascii $s4 = "WEE2=true" ascii condition: all of ( $dns* ) and all of ( $s* ) and any of ( $pack* ) } rule VOLEXITY_Apt_Malware_Py_Agentpsd : VERDANTBAMBOO AGENTPSD MEMORY { meta: description = "Detection for AgentPSD, a python-based malware typically delivered within PyInstaller-built binaries." author = "threatintel@volexity.com" id = "4a7d531f-926d-557e-b2a0-d4f103e9c63a" date = "2025-09-05" modified = "2025-10-30" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2026/2026-06-04 VerdantBamboo/rules.yar#L137-L171" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "ee41e06ed96182ce80cd4544a6abd5d7719c4a5c0e5ddb266a83842d39b99b0a" logic_hash = "dd0b957bc2a61ddebd392b86b35bae8c1052a285fa31ccd700e580c2ad9cce59" score = 75 quality = 80 tags = "VERDANTBAMBOO, AGENTPSD, MEMORY" os = "all" os_arch = "all" scan_context = "memory" severity = "critical" report1 = "TIB-20251104" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 12297 version = 5 strings: $s1 = "g_strPhpUrl" ascii $s2 = "g_nSleepMinits" ascii $s3 = "g_nDuringTime" ascii $func1 = "startwork" ascii $func2 = "ifrunning" ascii $func3 = "getsysinfo" ascii $func4 = "getcmdfromweb" ascii $func5 = "ParseCmdFromResponse" ascii $func6 = "PostDataToServer" ascii $func7 = "DealWithBuildinCommand" ascii $func8 = "PostBuildinResultToWeb" ascii condition: 2 of ( $s* ) or 4 of ( $func* ) } rule VOLEXITY_Apt_Malware_Any_Brickstorm_Rust : VERDANTBAMBOO BRICKSTORM FILE { meta: description = "Detects Rust variants of the BRICKSTORM malware." author = "threatintel@volexity.com" id = "b85ec85f-f590-5c1a-a5f9-107074b0e2a8" date = "2026-02-24" modified = "2026-02-24" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2026/2026-06-04 VerdantBamboo/rules.yar#L173-L202" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "45313a6745803a7f57ff35f5397fdf117eaec008a76417e6e2ac8a6280f7d830" logic_hash = "5f83f26188b7a8cab4bd548609c503371a18967342bd8dd6dede8e7a047e9508" score = 75 quality = 80 tags = "VERDANTBAMBOO, BRICKSTORM, FILE" os = "linux" os_arch = "all" scan_context = "file" severity = "high" report1 = "MAR-20260224" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 12816 version = 2 strings: $package1 = "Yamux" $package2 = "/lib.rs" $str1 = "/opt/vmware/bin/vmisupport" $str2 = "Socks5CmdNotSupported" $str3 = "/dev/ptmx" $str4 = "8tr9y8e4df1h6515fthderth" condition: all of ( $package* ) and 3 of ( $str* ) } rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Common_Certificate : EVILBAMBOO FILE { meta: description = "Detection of the common.cer file used for a large BADBAZAAR malware cluster for its certificate pinning for the C2 communication." author = "threatintel@volexity.com" id = "5a033770-7ad3-5c79-90ac-b1e3fff6b5f0" date = "2023-06-01" modified = "2023-06-13" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L230-L255" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "6aefc2b33e23f6e3c96de51d07f7123bd23ff951d67849a9bd32d446e76fb405" logic_hash = "861d4e1c40847c6ade04eddb047370d645afea6d5c16d55155fa58a16111c39e" score = 75 quality = 80 tags = "EVILBAMBOO, FILE" scan_context = "file" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" strings: $b1 = {30 82 03 61 30 82 02 49 a0 03 02 01 02 02 04 2b 6e df 67 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b} $s1 = "california1" $s2 = "los1" $s3 = "tech1" $s4 = "common1" $s5 = "common0" $s6 = "220401234506Z" $s7 = "470326234506Z0a1" condition: $b1 at 0 or all of ( $s* ) } rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Stage2_Implant_May23 : EVILBAMBOO FILE { meta: description = "Detection of the second stage capability of the BadBazaar android malware that has the main malicious capabilities. Will gather various info about the user/phone and routinely send this to the C2." author = "threatintel@volexity.com" id = "1f97c610-773f-5385-935a-445cb9192157" date = "2023-05-25" modified = "2023-08-30" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L257-L285" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "bf5f7fbf42236e89bcf663d2822d54bee89abaf3f247a54f371bf156e0e03629" logic_hash = "2186369298ebfa0b892ecb14ebacc93c6d14c9c35012e8e6cdff077634cf3773" score = 75 quality = 80 tags = "EVILBAMBOO, FILE" scan_context = "file" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" strings: $c1 = "%{\"command\":\"%s\",\"path\":\"%s\",\"files\":[" $c2 = "{\"name\":\"%s\",\"dirs\":\"%d\",\"files\":\"%d\",\"isfolder\":\"%d\",\"path\":\"%s\"}," $s1 = "Timezon id:" $s2 = "China Telecom" $s3 = "China Unicom" $s4 = "ConfigPipe" $s5 = "ForwordTo" $s6 = "can't get camera content" $s7 = "cat /sys/class/net/wlan0/address" $s8 = "_preferences_light" $s9 = "registration_jid" condition: 1 of ( $c* ) or 5 of ( $s* ) } rule VOLEXITY_Apt_Delivery_Web_Js_Jmask_Str_Array_Variant : EVILBAMBOO FILE { meta: description = "Detects the JMASK profiling script in an obfuscated format using a string array and an offset." author = "threatintel@volexity.com" id = "d5d32c8b-53fb-5103-ac73-05f320e71c97" date = "2023-06-27" modified = "2023-09-21" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L408-L444" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "7995c382263f8dbbfc37a9d62392aef8b4f89357d436b3dd94dea842f9574ecf" logic_hash = "0ae7c96e0f866f21d66d7a23bf937d6ce48c9dd1ea19142dbb13487208780146" score = 75 quality = 80 tags = "EVILBAMBOO, FILE" scan_context = "file" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" strings: $array_1 = "http://eular.github.io" $array_2 = "stun:stun.services.mozilla.com" $array_3 = "\xE6\x9C\xAA\xE5\xAE\x89\xE8\xA3\x85MetaMask" $array_4 = "/jquery/jquery.min.js" $array_5 = "onicecandidate" $ios_1 = "['a7', '640x1136', [_0x" $ios_2 = "['a7', _0x" $ios_3 = "['a8', _0x" $ios_4 = "['a8', '750x1334', ['iPhone\\x206']]" $ios_5 = "['a8', '1242x2208', ['iPhone\\x206\\x20Plus']]" $ios_6 = "['a8', _0x" $ios_7 = "['a9', _0x" $ios_8 = "['a9', '750x1334', [_0x" $ios_9 = "['a9', '1242x2208', ['iPhone\\x206s\\x20Plus']]" $ios_10 = "['a9x', '2048x2732', ['iPad\\x20Pro\\x20(1st\\x20gen\\x2012.9-inch)']]" $ios_11 = "['a10x', '1668x2224', [_0x" $header = "info = {}, finished = 0x0;" condition: 3 of ( $array_* ) or 5 of ( $ios_* ) or $header } rule VOLEXITY_Apt_Delivery_Web_Js_Jmask : EVILBAMBOO FILE { meta: description = "Detects the JMASK profiling script in its minified // obfuscated format." author = "threatintel@volexity.com" id = "a7b653e1-f7c6-56cc-ab99-3de91d29ef3b" date = "2023-06-15" modified = "2023-09-21" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L446-L472" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "efea95720853e0cd2d9d4e93a64a726cfe17efea7b17af7c4ae6d3a6acae5b30" logic_hash = "64315ac05049954d36297a616a25ffdd7ce81c6313c0878d5ba4082da24c21bb" score = 75 quality = 80 tags = "EVILBAMBOO, FILE" scan_context = "file" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" strings: $rev0 = "oi.buhtig.ralue//:ptth" ascii $rev1 = "lairA' xp41" ascii $rev2 = "dnuof ton ksaMateM" ascii $unicode1 = "document[\"\\u0063\\u0075\\u0072\\u0072\\u0065\\u006e\\u0074\\u0053\\u0063\\u0072\\u0069\\u0070\\u0074\"]" ascii $unicode2 = "\\u0061\\u0070\\u0070\\u006c\\u0069\\u0063\\u0061\\u0074\\u0069\\u006f\\u006e\\u002f\\u006a\\u0073\\u006f\\u006e" ascii $unicode3 = "\\u0063\\u006c\\u0069\\u0065\\u006e\\u0074\\u0057\\u0069\\u0064\\u0074\\u0068" ascii $unicode4 = "=window[\"\\u0073\\u0063\\u0072\\u0065\\u0065\\u006e\"]" ascii $header = "(function(){info={};finished=" ascii condition: all of ( $rev* ) or all of ( $unicode* ) or $header } rule VOLEXITY_Apt_Malware_Win_Avburner : DEVIOUSBAMBOO FILE MEMORY { meta: description = "Detects AVBurner based on a combination of API calls used, hard-coded strings and bytecode patterns." author = "threatintel@volexity.com" id = "1bde0861-4820-5bb1-98a3-516092c91be0" date = "2023-01-02" modified = "2024-08-16" reference = "https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-03-07 AVBurner/yara.yar#L1-L40" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "4b1b1a1293ccd2c0fd51075de9376ebb55ab64972da785153fcb0a4eb523a5eb" logic_hash = "56ff6c8a4b737959a1219699a0457de1f0c34fead4299033840fb23c56a0caad" score = 75 quality = 80 tags = "DEVIOUSBAMBOO, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 8780 version = 4 strings: $api1 = "PspCreateProcessNotifyRoutineAddress" wide $api2 = "PspCreateThreadNotifyRoutineAddress" wide $api3 = "PspLoadImageNotifyRoutineAddress" wide $str1 = "\\\\.\\RTCORE64" wide $str2 = "\\\\%ws/pipe/%ws" wide $str3 = "CreateServerW Failed %u" wide $str4 = "OpenSCManager Failed %u" wide $str5 = "Get patternAddress" wide $pattern1 = { 4C 8B F9 48 8D 0C C1 E8 } $pattern2 = { 48 8D 0C DD 00 00 00 00 45 33 C0 49 03 CD 48 8B } $pattern3 = { 48 8D 04 C1 48 89 45 70 48 8B C8 E8 } $pattern4 = { 49 8D 0C FC 45 33 C0 48 8B D6 E8 00 00 00 00 00} $pattern5 = { 45 33 C0 48 8D 0C D9 48 8B D7 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 } $pattern6 = { 41 0F BA 6D 00 0A BB 01 00 00 00 4C 8B F2 4C 8B F9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } condition: all of ( $api* ) or all of ( $str* ) or all of ( $pattern* ) } rule VOLEXITY_Apt_Win_Powerstar_Persistence_Batch : CHARMINGKITTEN { meta: description = "Detects the batch script used to persist PowerStar via Startup." author = "threatintel@volexity.com" id = "f3ed7b46-d80d-55b1-b6c7-6ea6569f199c" date = "2023-05-16" modified = "2023-09-20" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L1-L19" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "9777f106ac62829cd3cfdbc156100fe892cfc4038f4c29a076e623dc40a60872" logic_hash = "9c3a45b759516959eae1cdf8e73bf540b682c90359a6232aa4782a8d1fe15b7d" score = 75 quality = 80 tags = "CHARMINGKITTEN" memory_suitable = 1 license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" strings: $s_1 = "e^c^h^o o^f^f" $s_2 = "powershertxdll.ertxdxe" $s_3 = "Get-Conrtxdtent -Prtxdath" $s_4 = "%appdata%\\Microsrtxdoft\\Windortxdws\\" $s_5 = "&(gcm i*x)$" condition: 3 of them } rule VOLEXITY_Apt_Win_Powerstar_Memonly : CHARMINGKITTEN { meta: description = "Detects the initial stage of the memory only variant of PowerStar." author = "threatintel@volexity.com" id = "469fc433-da9e-55ed-99fb-9560ec86a179" date = "2023-05-16" modified = "2023-09-20" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L20-L65" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "977cf5cc1d0c61b7364edcf397e5c67d910fac628c6c9a41cf9c73b3720ce67f" logic_hash = "d790ff204e4e8adeb3e887d9ebce743e958b523c48317d017487b1b0c6aebc11" score = 75 quality = 78 tags = "CHARMINGKITTEN" memory_suitable = 1 license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" strings: $s_1 = "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($in.substring(3)))" $s_2 = "[Convert]::ToByte(([Convert]::ToString(-bnot ($text_bytes[$i])" $s_3 = "$Exec=[System.Text.Encoding]::UTF8.GetString($text_bytes)" $s_4 = "((65..90) + (97..122) | Get-Random -Count 16 | % {[char]$_})" $f_1 = "function Gorjol{" $f_2 = "Borjol \"$" $f_3 = "Gorjol -text" $f_4 = "function Borjoly{" $f_6 = "$filename = $env:APPDATA+\"\\Microsoft\\Windows\\DocumentPreview.pdf\";" $f_7 = "$env:APPDATA+\"\\Microsoft\\Windows\\npv.txt\"" $f_8 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\brt8ts74e.bat" $f_9 = "\\Microsoft\\Windows\\s7qe52.txt" $f_10 = "$yeolsoe2 = $yeolsoe" $f_11 = "setRequestHeader(\"Content-DPR\"" $f_12 = "getResponseHeader(\"Content-DPR\")" $f_13 = {24 43 6f 6d 6d 61 6e 64 50 61 72 74 73 20 3d 24 53 65 73 73 69 6f 6e 52 65 73 70 6f 6e 73 65 2e 53 70 6c 69 74 28 22 b6 22 29} $f_14 = "$language -like \"*shar*\"" $f_15 = "$language -like \"*owers*\"" $alias_1 = "(gcm *v????E?P?e*)" $alias_2 = "&(gcm *ke-e*) $Command" $key = "T2r0y1M1e1n1o0w1" $args_1 = "$sem.Close()" $args_2 = "$cem.Close()" $args_3 = "$mem.Close()" $command_1 = "_____numone_____" $command_2 = "_____mac2_____" $command_3 = "_____yeolsoe_____" condition: 2 of ( $s_* ) or any of ( $f_* ) or 2 of ( $alias_* ) or $key or all of ( $args_* ) or any of ( $command_* ) } rule VOLEXITY_Apt_Win_Powerstar_Logmessage : CHARMINGKITTEN { meta: description = "Detects interesting log message embedded in memory only version of PowerStar." author = "threatintel@volexity.com" id = "5979c776-5138-50e2-adab-0793ad86ba76" date = "2023-05-16" modified = "2023-09-20" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L66-L79" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" logic_hash = "539c9a8b3de24f2c8058d204900344756a8031822ebebc312612b8fb8422e341" score = 75 quality = 80 tags = "CHARMINGKITTEN" memory_suitable = 1 license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" strings: $s_1 = "wau, ije ulineun mueos-eul halkkayo?" condition: all of them } rule VOLEXITY_Apt_Win_Powerstar_Lnk : CHARMINGKITTEN { meta: description = "Detects LNK command line used to install PowerStar." author = "threatintel@volexity.com" id = "33f16283-69b9-5109-b723-3ddc8abb8c41" date = "2023-05-16" modified = "2023-09-20" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L80-L97" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" logic_hash = "da53aeaf69e80f697068779f4741b8c23cff82dd1bfb0640916a1bcc98c4892f" score = 75 quality = 80 tags = "CHARMINGKITTEN" memory_suitable = 1 license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" strings: $p_1 = "-UseBasicParsing).Content; &(gcm i*x)$" $c_1 = "powershecde43ell.ecde43exe" $c_2 = "wgcde43eet -Ucde43eri" $c_3 = "-UseBasicde43ecParsing).Contcde43eent; &(gcm i*x)$" condition: any of them } rule VOLEXITY_Apt_Win_Powerstar_Decrypt_Function : CHARMINGKITTEN { meta: description = "Detects PowerStar decrypt function, potentially downloaded standalone and then injected." author = "threatintel@volexity.com" id = "1fbc2689-8169-53b1-b581-c41ab2b3a16f" date = "2023-05-16" modified = "2023-09-20" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L98-L121" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "b79d28fe5e3c988bb5aadb12ce442d53291dbb9ede0c7d9d64eec078beba5585" logic_hash = "d022e363464488836a1c161f2b9c7463ac91ae6f60f14dfd574189233201c9aa" score = 75 quality = 80 tags = "CHARMINGKITTEN" memory_suitable = 1 license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" strings: $f_1 = "function Borjol{" $s_1 = "$global:Domain = \"" $s_2 = "$global:IP = \"" $s_3 = "$global:yeolsoe" $s_4 = "$semii.Close()" $s_5 = "$cemii.Close()" $s_6 = "$memii.Close()" condition: any of ( $f_* ) or 2 of ( $s_* ) } rule VOLEXITY_Apt_Win_Powerstar : CHARMINGKITTEN { meta: description = "Custom PowerShell backdoor used by Charming Kitten." author = "threatintel@volexity.com" id = "febcd23b-6545-571b-905d-18dffe8e913f" date = "2021-10-13" modified = "2023-09-20" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L122-L150" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "de99c4fa14d99af791826a170b57a70b8265fee61c6b6278d3fe0aad98e85460" logic_hash = "2cbf59eaee60a8f84b1ac35cec3b01592a2a0f56c92a2db218bb26a15be24bf3" score = 75 quality = 80 tags = "CHARMINGKITTEN" memory_suitable = 1 license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" strings: $appname = "[AppProject.Program]::Main()" ascii wide $langfilters1 = "*shar*" ascii wide $langfilters2 = "*owers*" ascii wide $definitions1 = "[string]$language" ascii wide $definitions2 = "[string]$Command" ascii wide $definitions3 = "[string]$ThreadName" ascii wide $definitions4 = "[string]$StartStop" ascii wide $sess = "$session = $v + \";;\" + $env:COMPUTERNAME + $mac;" ascii wide condition: $appname or all of ( $langfilters* ) or all of ( $definitions* ) or $sess } rule VOLEXITY_Apt_Ico_Uta0040_B64_C2 : UTA0040 FILE { meta: description = "Detection of malicious ICO files used in 3CX compromise." author = "threatintel@volexity.com" id = "1efb6376-a362-5f03-b4d3-08cd7d634de6" date = "2023-03-30" modified = "2023-03-30" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-03-30 3CX/indicators/rules.yar#L1-L31" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "a541e5fc421c358e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c" logic_hash = "2667a36ce151c6e964f9ce9a6f587eedbffdd6ec76e451a23c5cfdd08248d15e" score = 75 quality = 80 tags = "UTA0040, FILE" memory_suitable = 0 license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" strings: $IEND_dollar = {49 45 4e 44 ae 42 60 82 24} $IEND_nodollar = {49 45 4e 44 ae 42 60 82 } condition: uint16be( 0 ) == 0x0000 and filesize < 120KB and ( $IEND_dollar in ( filesize -500 .. filesize ) and not $IEND_nodollar in ( filesize -20 .. filesize ) and for any k in ( 1 .. #IEND_dollar ) : ( for all i in ( 1 .. 4 ) : ( uint8( @IEND_dollar [ k ] + !IEND_dollar [ k ] + i ) < 123 and uint8( @IEND_dollar [ k ] + !IEND_dollar [ k ] + i ) > 47 ) ) ) } rule VOLEXITY_Apt_Mac_Iconic : UTA0040 { meta: description = "Detects the MACOS version of the ICONIC loader." author = "threatintel@volexity.com" id = "6d702ed3-e5b9-5324-a06b-507c9231cc00" date = "2023-03-30" modified = "2023-03-30" reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-03-30 3CX/indicators/rules.yar#L32-L50" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67" logic_hash = "7b689c3931632b01869ac2f21a1edca0a5ca9007299fe7cd16962d6866c27558" score = 75 quality = 80 tags = "UTA0040" memory_suitable = 1 license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" strings: $str1 = "3CX Desktop App" xor(0x01-0xff) $str2 = "__tutma=" xor(0x01-0xff) $str3 = "Mozilla/5.0" xor(0x01-0xff) condition: all of them } rule VOLEXITY_Apt_Win_Iconicstealer : UTA0040 { meta: description = "Detect the ICONICSTEALER malware family." author = "threatintel@volexity.com" id = "d7896506-6ce5-59b1-b24a-87ffdb2a5174" date = "2023-03-30" modified = "2023-03-30" reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-03-30 3CX/indicators/rules.yar#L51-L69" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423" logic_hash = "ed7731d2361e7d96a6a35f8359b61a2af049b16bc457cf870db8831e142aebe2" score = 75 quality = 80 tags = "UTA0040" memory_suitable = 1 license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" strings: $str1 = "\\3CXDesktopApp\\config.json" wide $str2 = "url, title FROM urls" wide $str3 = "url, title FROM moz_places" wide condition: all of them } rule VOLEXITY_Apt_Win_3Cx_Backdoored_Lib : UTA0040 { meta: description = "Detects the malicious library delivered in the backdoored 3CX installer." author = "threatintel@volexity.com" id = "39270b93-830e-598f-a38e-fcc5050e4d30" date = "2023-03-30" modified = "2023-03-30" reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-03-30 3CX/indicators/rules.yar#L94-L133" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896" logic_hash = "40be2d46a318ff03724ea1f6628d78001c14c85a3ae6d032c0324ea849d707f2" score = 75 quality = 80 tags = "UTA0040" memory_suitable = 1 license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" strings: $shellcode = { 44 8D 4A ?? 44 8D 92 ?? ?? ?? ?? 45 85 C9 45 0F 49 D1 41 81 E2 00 FF FF FF 41 F7 DA 44 01 D2 FF C2 4C 63 CA 46 8A 94 0C ?? ?? ?? ?? 45 00 D0 45 0F B6 D8 42 8A AC 1C ?? ?? ?? ?? 46 88 94 1C ?? ?? ?? ?? 42 88 AC 0C ?? ?? ?? ?? 42 02 AC 1C ?? ?? ?? ?? 44 0F B6 CD 46 8A 8C 0C ?? ?? ?? ?? 45 30 0C 0E 48 FF C1 48 39 C8 75 ?? } condition: all of them } rule VOLEXITY_Informational_Win_3Cx_Msi : UTA0040 { meta: description = "Detects 3CX installers created in March 2023, 3CX was known to be compromised at this time." author = "threatintel@volexity.com" id = "ac26e7b1-61eb-5074-bcda-46d714bdba4c" date = "2023-03-30" modified = "2023-03-30" reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2023/2023-03-30 3CX/indicators/rules.yar#L134-L152" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868" logic_hash = "c04de2653ef587f27c7ebf058c6f6c345e16b67f36ccc4306bc49f8c4394728e" score = 75 quality = 80 tags = "UTA0040" memory_suitable = 0 license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" strings: $cert = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 } $app = "3CXDesktopApp.exe" $data = "202303" condition: all of them } rule VOLEXITY_Apt_Malware_Win_Deepdata_Module : BRAZENBAMBOO FILE MEMORY { meta: description = "Detects modules used by DEEPDATA based on the required export names used by those modules." author = "threatintel@volexity.com" id = "1287f5dd-9229-57ce-a91a-73d61041df80" date = "2024-07-30" modified = "2024-11-14" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-11-15 BrazenBamboo/rules.yar#L1-L25" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "c782346bf9e5c08a0c43a85d4991f26b0b3c99c054fa83beb4a9e406906f011e" logic_hash = "d36f34343826daf7f7368118c7127c7181a54c99a01803016c9a6965abb309cb" score = 75 quality = 80 tags = "BRAZENBAMBOO, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10868 version = 2 strings: $str1 = "ExecuteCommand" $str2 = "GetPluginCommandID" $str3 = "GetPluginName" $str4 = "GetPluginVersion" condition: all of them } rule VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_Core : BRAZENBAMBOO FILE MEMORY { meta: description = "Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc." author = "threatintel@volexity.com" id = "44f8d7a4-7f48-5960-91a7-baf475f7d291" date = "2024-02-15" modified = "2024-07-03" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-11-15 BrazenBamboo/rules.yar#L244-L287" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "80c0cdb1db961c76de7e4efb6aced8a52cd0e34178660ef34c128be5f0d587df" logic_hash = "f0189c0a84c53e365130e9683f2f2b2f73c14412d8e4d0251a4780d0e80162d8" score = 75 quality = 78 tags = "BRAZENBAMBOO, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10246 version = 2 strings: $s1 = "Enter RunWork......." $s2 = "it's running......." $s3 = "select ret = socket_error." $s4 = "%s\\\\account.bin" $s5 = "[CtrlLink]: get machine sn err:%d" $s6 = "wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /format:list | findstr /v \\\"^$\\\"" $s7 = "wmic csproduct get vendor,version /format:list | findstr /v \\\"^$\\\"" $s8 = "local ip get sockname error=%d" $s9 = "connect goole dns error=%d" $s10 = "%s/api/terminal/upsert/" $s11 = "/963852741/windows/plugin/manifest" $s12 = "Hello deepdata." $s13 = "Start Light." $s14 = "InitialPluginManager Error." $s15 = "InitialCommandExe Error." $s16 = "ws open, and send logon info." $s17 = "plugin_replay_handler" $s18 = "light_x86.dll" $pdb1 = "\\light\\bin\\light_x86.pdb" $pdb2 = "\\light\\bin\\plugin" $pdb3 = "D:\\tmpWork\\" condition: 1 of ( $pdb* ) or 5 of ( $s* ) } rule VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_C2_Strings : BRAZENBAMBOO FILE MEMORY { meta: description = "Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc." author = "threatintel@volexity.com" id = "a0af8fb7-13a3-54e8-8569-e8622fa80d89" date = "2024-02-15" modified = "2024-11-14" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-11-15 BrazenBamboo/rules.yar#L288-L337" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "80c0cdb1db961c76de7e4efb6aced8a52cd0e34178660ef34c128be5f0d587df" logic_hash = "eeaaf6e16d4854a2279bd62596f75cb8b8ec1b05f3b050f5dac97254704b9005" score = 75 quality = 78 tags = "BRAZENBAMBOO, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10245 version = 4 strings: $s1 = "[WsClient][Error]:" $s2 = "[WsClient][Info]:" $s3 = "[WsClient]:WsClient" $s4 = "[WsClient][Info]:Ws" $s5 = "WsClient Worker Thread ID=%d" $s6 = "[LightWebClient]:" $s7 = "LightHttpGet err:%s" $s8 = "User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.145 Safari/537.36" $s9 = "KvList Err:%s" $s10 = "dataMultiPart malloc err:%d" $ctrl1 = "CTRL_HEART_BEAT" $ctrl2 = "CTRL_NET_CONFIG" $ctrl3 = "CTRL_COMMAND_PLAN" $ctrl4 = "CTRL_MODIFY_NET_CONFIG" $ctrl5 = "CTRL_UPLOAD_PLUGIN_STATUS" $ctrl6 = "CTRL_PLUGIN_EXECUTE_COMMAND" $ctrl7 = "CTRL_PLUGIN_COMMAND_STATUS" $ctrl8 = "CTRL_PLUGIN_STOP_COMMAND" $ctrl9 = "CTRL_GET_SLEEP_CONFIG" $ctrl10 = "CTRL_MODIFY_SLEEP_CONFIG" $ctrl11 = "CTRL_SLEEP_STATUS" $ctrl12 = "CTRL_UPDATE_PLUGIN" $ctrl13 = "CTRL_DESTROY" $ctrl14 = "CTRL_RECONFIG_REBOUNT_ADDRESS" $ctrl15 = "CTRL_AUTO_UPLOUD_FILE_CONFIG" $ctrl16 = "CTRL_UPLOUD_DEVICE_INFO" $ctrl17 = "CTRL_TEST_VPDN_ACCOUNT" condition: 3 of ( $s* ) or 5 of ( $ctrl* ) } rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Modules : TRANSPARENTJASMINE FILE MEMORY { meta: description = "Detects DISGOMOJI modules using strings in the ELF." author = "threatintel@volexity.com" id = "b9e4ecdc-9b02-546f-9b79-947cb6b1f99a" date = "2024-02-22" modified = "2024-07-05" reference = "TIB-20240229" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L1-L24" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "2abaae4f6794131108adf5b42e09ee5ce24769431a0e154feabe6052cfe70bf3" logic_hash = "7880288e3230b688b780bdfbac2b0761fd7831b7df233672c2242c21a86e1297" score = 75 quality = 80 tags = "TRANSPARENTJASMINE, FILE, MEMORY" os = "linux" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10270 version = 6 strings: $s1 = "discord-c2/test/main/finalizing/Deliveries/ob_Delivery.go" wide ascii $s2 = "discord-c2/test/main/finalizing/WAN_Conf.go" wide ascii condition: any of them } rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Loader : TRANSPARENTJASMINE FILE MEMORY { meta: description = "Detects DISGOMOJI loader using strings in the ELF." author = "threatintel@volexity.com" id = "6d7848db-f1a5-5ccc-977a-7597b966a31c" date = "2024-02-22" modified = "2024-07-05" reference = "TIB-20240229" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L25-L47" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "51a372fee89f885741515fa6fdf0ebce860f98145c9883f2e3e35c0fe4432885" logic_hash = "d9be4846bab5fffcfd60eaec377443819404f30ec088905c2ee26bd3b7525832" score = 75 quality = 80 tags = "TRANSPARENTJASMINE, FILE, MEMORY" os = "linux" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10269 version = 7 strings: $s1 = "discord-c2/test/main/delievery.go" wide ascii condition: $s1 } rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Debug_String : TRANSPARENTJASMINE FILE MEMORY { meta: description = "Detects DISGOMOJI using strings in the ELF." author = "threatintel@volexity.com" id = "eed2468f-7e50-5f3e-946a-277c10984823" date = "2024-02-22" modified = "2024-11-27" reference = "TIB-20240229" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L48-L71" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529" logic_hash = "6bb130eead39bd8128983e0f2e76cfeff8865ce8ed3cb73b132ed32d68fc0db0" score = 75 quality = 80 tags = "TRANSPARENTJASMINE, FILE, MEMORY" os = "linux" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10268 version = 9 strings: $s1 = "discord-c2/test/main/payload.go" wide ascii $s2 = "Desktop/Golang_Dev/Discord" condition: any of them } rule VOLEXITY_Apt_Malware_Linux_Disgomoji_2 : TRANSPARENTJASMINE FILE MEMORY { meta: description = "Detects DISGOMOJI malware using strings in the ELF." author = "threatintel@volexity.com" id = "609beb47-5e93-5f69-b89d-2cf62f20851a" date = "2024-02-22" modified = "2024-07-05" reference = "TIB-20240229" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L72-L103" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529" logic_hash = "e03a774cca2946c1becdbd775ef465033dae089d578ea18a4f43fd7bdae9168e" score = 75 quality = 80 tags = "TRANSPARENTJASMINE, FILE, MEMORY" os = "linux" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10266 version = 9 strings: $s1 = "downloadFileFromURL" wide ascii $s2 = "createCronJob" wide ascii $s3 = "findAndSendFiles" wide ascii $s4 = "updateLogFile" wide ascii $s5 = "handleZipFile" wide ascii $s6 = "takeScreenshot" wide ascii $s7 = "zipFirefoxProfile" wide ascii $s8 = "zipDirectoryWithParts" wide ascii $s9 = "uploadAndSendToOshi" wide ascii $s10 = "uploadAndSendToLeft" wide ascii condition: 7 of them } rule VOLEXITY_Apt_Malware_Linux_Disgomoji_1 : TRANSPARENTJASMINE FILE MEMORY { meta: description = "Detects GOMOJI malware using strings in the ELF." author = "threatintel@volexity.com" id = "f6643e9a-ca41-57e0-9fce-571d340f1cfe" date = "2024-02-22" modified = "2024-07-05" reference = "TIB-20240229" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L104-L131" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529" logic_hash = "dd3535079881ae9cfe25c129803668cb595be89b7f62eb82af19cc3839f92b6d" score = 75 quality = 80 tags = "TRANSPARENTJASMINE, FILE, MEMORY" os = "linux" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10265 version = 7 strings: $s1 = "Session *%s* opened!" wide ascii $s2 = "uevent_seqnum.sh" wide ascii $s3 = "Error downloading shell script: %v" wide ascii $s4 = "Error setting execute permissions: %v" wide ascii $s5 = "Error executing shell script: %v" wide ascii $s6 = "Error creating Discord session" wide ascii condition: 4 of them } rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Bogus_Strings : TRANSPARENTJASMINE FILE { meta: description = "Detects the DISGOMOJI malware using bogus strings introduced in the newer version." author = "threatintel@volexity.com" id = "ecff8d3c-d4fe-5b6d-a227-6ff531cf8e2b" date = "2024-03-14" modified = "2024-07-05" reference = "TIB-20240318" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L132-L159" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "8c8ef2d850bd9c987604e82571706e11612946122c6ab089bd54440c0113968e" logic_hash = "0d8a2b371ffb182e60a8cc0cc500d1a9f906718a55f23f35f6c12f7faabbe971" score = 75 quality = 80 tags = "TRANSPARENTJASMINE, FILE" os = "linux" os_arch = "all" scan_context = "file" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10341 version = 5 strings: $s1 = "Graphics Display Rendering" wide ascii $s2 = "Error fetching Repository Key: %v" wide ascii $s3 = "Error reading Repository Key: %v" wide ascii $s4 = "Error fetching dpkg: %v" wide ascii $s5 = "GNU Drivers Latest version v1.4.2" wide ascii $s6 = "ps_output.txt" wide ascii condition: all of them } rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Uevent_Seqnum : TRANSPARENTJASMINE FILE { meta: description = "Detects a script deployed as part of DISGOMOJI malware chain." author = "threatintel@volexity.com" id = "9df61164-6a92-5042-ba4f-64dc7e998283" date = "2024-03-07" modified = "2024-07-05" reference = "TIB-20240318" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L160-L187" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "98b24fb7aaaece7556aea2269b4e908dd79ff332ddaa5111caec49123840f364" logic_hash = "e390e83d9fc15499c9f32ad47d1c526273105602bda7b3532720b0a3f6abc835" score = 75 quality = 80 tags = "TRANSPARENTJASMINE, FILE" os = "linux" os_arch = "all" scan_context = "file" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10314 version = 6 strings: $s1 = "USB_DIR=\"/media/$USER\"" wide ascii $s2 = "RECORD_FILE=\"record.txt\"" wide ascii $s3 = "copy_files()" wide ascii $s4 = "Check for connected USB drives" wide ascii $s5 = "Check if filename already exists in record.txt" wide ascii $s6 = "Function to copy files from USB drive to destination folder" wide ascii condition: 3 of them } rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Lan_Conf : TRANSPARENTJASMINE FILE { meta: description = "Detects a script deployed as part of DISGOMOJI malware chain." author = "threatintel@volexity.com" id = "b338b3cf-22ce-5767-bdea-503e883bc84b" date = "2024-03-07" modified = "2024-07-05" reference = "TIB-20240318" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L188-L215" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "0b5cf9bd917f0af03dd694ff4ce39b0b34a97c9f41b87feac1dc884a684f60ef" logic_hash = "2a19d5cff7adc9b1b92538a5df4e3cadea694f925f65080f5093fc5425e840f4" score = 75 quality = 80 tags = "TRANSPARENTJASMINE, FILE" os = "linux" os_arch = "all" scan_context = "file" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10312 version = 7 strings: $s1 = "add_lan_conf_cron_if_not_exists" wide ascii $s2 = "download_if_not_exists" wide ascii $s3 = "add_cron_if_not_exists" wide ascii $s4 = "uevent_seqnum.sh" wide ascii $s5 = "$HOME/.x86_64-linux-gnu" wide ascii $s6 = "lanConfScriptPath" wide ascii condition: 4 of them } rule VOLEXITY_Malware_Golang_Discordc2_Bmdyy_1 : FILE MEMORY { meta: description = "Detects a opensource malware available on github using strings in the binary. The DISGOMOJI malware family used by TransparentJasmine is based on this malware." author = "threatintel@volexity.com" id = "6816d264-4311-5e90-948b-2e27cdf0b720" date = "2024-03-28" modified = "2024-07-05" reference = "TIB-20240229" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L216-L243" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "de32e96d1f151cc787841c12fad88d0a2276a93d202fc19f93631462512fffaf" logic_hash = "22b3e5109d0738552fbc310344b2651ab3297e324bc883d5332c1e8a7a1df29b" score = 75 quality = 80 tags = "FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "high" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10390 version = 3 strings: $s1 = "File is bigger than 8MB" wide ascii $s2 = "Uploaded file to" wide ascii $s3 = "sess-%d" wide ascii $s4 = "Session *%s* opened" wide ascii $s5 = "%s%d_%dx%d.png" wide ascii condition: 4 of them } rule VOLEXITY_Malware_Golang_Discordc2_Bmdyy : FILE MEMORY { meta: description = "Detects a opensource malware available on github using strings in the binary. DISGOMOJI used by TransparentJasmine is based on this malware." author = "threatintel@volexity.com" id = "1ddbf476-ba2d-5cbb-ad95-38e0ae8db71b" date = "2024-02-22" modified = "2024-07-05" reference = "https://github.com/bmdyy/discord-c2" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L244-L267" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529" logic_hash = "38b860a43b9937351f74b01983888f18ad101cbe66560feb7455d46b713eba0f" score = 75 quality = 80 tags = "FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10264 version = 12 strings: $s1 = "**IP**: %s\n**User**: %s\n**Hostname**: %s\n**OS**: %s\n**CWD**" wide ascii condition: $s1 } rule VOLEXITY_Apt_Malware_Vbs_Basicstar_A : CHARMINGCYPRESS FILE MEMORY { meta: description = "VBS backdoor which bares architectural similarity to the POWERSTAR malware family." author = "threatintel@volexity.com" id = "e790defe-2bd5-5629-8420-ce8091483589" date = "2024-01-04" modified = "2025-05-21" reference = "TIB-20240111" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-02-13 CharmingCypress/rules.yar#L69-L99" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "c6f91e5585c2cbbb8d06b7f239e30b271f04393df4fb81815f6556fa4c793bb0" logic_hash = "977bb42553bb6585c8d0e1e89675644720ca9abf294eccd797e20d4bca516810" score = 75 quality = 80 tags = "CHARMINGCYPRESS, FILE, MEMORY" os = "win" os_arch = "all" report2 = "TIB-20240126" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10037 version = 8 strings: $s1 = "Base64Encode(EncSess)" ascii wide $s2 = "StrReverse(PlainSess)" ascii wide $s3 = "ComDecode, \"Module\"" ascii wide $s4 = "ComDecode, \"SetNewConfig\"" ascii wide $s5 = "ComDecode, \"kill\"" ascii wide $magic = "cmd /C start /MIN curl --ssl-no-revoke -s -d " ascii wide condition: 3 of ( $s* ) or $magic } rule VOLEXITY_Apt_Malware_Ps1_Powerless_B : CHARMINGCYPRESS FILE MEMORY { meta: description = "Detects POWERLESS malware." author = "threatintel@volexity.com" id = "e62703b5-32fb-5ceb-9f21-f52a4871f3d9" date = "2023-10-25" modified = "2024-01-29" reference = "TIB-20231027" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-02-13 CharmingCypress/rules.yar#L100-L157" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "62de7abb39cf4c47ff120c7d765749696a03f4fa4e3e84c08712bb0484306ae1" logic_hash = "eb9d199c1f7c2a42d711c1a44ab13526787169c18a77ce988568525baca043ef" score = 75 quality = 78 tags = "CHARMINGCYPRESS, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 9794 version = 5 strings: $fun_1 = "function verifyClickStorke" $fun_2 = "function ConvertTo-SHA256" $fun_3 = "function Convert-Tobase" fullword $fun_4 = "function Convert-Frombase" fullword $fun_5 = "function Send-Httppacket" $fun_6 = "function Generat-FetchCommand" $fun_7 = "function Create-Fetchkey" $fun_8 = "function Run-Uploader" $fun_9 = "function Run-Shot" fullword $fun_10 = "function ShotThis(" $fun_11 = "function File-Manager" $fun_12 = "function zip-files" $fun_13 = "function Run-Stealer" $fun_14 = "function Run-Downloader" $fun_15 = "function Run-Stro" fullword $fun_16 = "function Run-Tele" fullword $fun_17 = "function Run-Voice" $s_1 = "if($commandtype -eq \"klg\")" $s_2 = "$desrilizedrecievedcommand" $s_3 = "$getAsyncKeyProto = @" $s_4 = "$Global:BotId =" $s_5 = "$targetCLSID = (Get-ScheduledTask | Where-Object TaskName -eq" $s_6 = "$burl = \"$Global:HostAddress/" $s_7 = "$hashString = [System.BitConverter]::ToString($hash).Replace('-','').ToLower()" $s_8 = "$Global:UID = ((gwmi win32_computersystemproduct).uuid -replace '[^0-9a-z]').substring(" $s_9 = "$rawpacket = \"{`\"MId`\":`\"$Global:MachineID`\",`\"BotId`\":`\"$basebotid`\"}\"" $s_12 = "Runned Without any Error" $s_13 = "$commandresponse = (Invoke-Expression $instruction -ErrorAction Stop) | Out-String" $s_14 = "Operation started successfuly" $s_15 = "$t_path = (Get-WmiObject Win32_Process -Filter \"name = '$process'\" | Select-Object CommandLine).CommandLine" $s_16 = "?{ $_.DisplayName -match \"Telegram Desktop\" } | %{$app_path += $_.InstallLocation }" $s_17 = "$chlids = get-ChildItem $t -Recurse -Exclude \"$t\\tdata\\user_data\"" $s_18 = "if($FirsttimeFlag -eq $True)" $s_19 = "Update-Conf -interval $inter -url $url -next_url $next -conf_path $conf_path -key $config_key" condition: 3 of ( $fun_* ) or any of ( $s_* ) } rule VOLEXITY_Apt_Malware_Macos_Vpnclient_Cc_Oct23 : CHARMINGCYPRESS FILE MEMORY { meta: description = "Detection for fake macOS VPN client used by CharmingCypress." author = "threatintel@volexity.com" id = "e0957936-dc6e-5de6-bb23-d0ef61655029" date = "2023-10-17" modified = "2023-10-27" reference = "TIB-20231027" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-02-13 CharmingCypress/rules.yar#L246-L272" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "11f0e38d9cf6e78f32fb2d3376badd47189b5c4456937cf382b8a574dc0d262d" hash = "31ca565dcbf77fec474b6dea07101f4dd6e70c1f58398eff65e2decab53a6f33" logic_hash = "da5e9be752648b072a9aaeed884b8e1729a14841e33ed6633a0aaae1f11bd139" score = 75 quality = 80 tags = "CHARMINGCYPRESS, FILE, MEMORY" os = "darwin,linux" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 9770 version = 3 strings: $s1 = "networksetup -setsocksfirewallproxystate wi-fi off" ascii $s2 = "networksetup -setsocksfirewallproxy wi-fi ___serverAdd___ ___portNum___; networksetup -setsocksfirewallproxystate wi-fi on" ascii $s3 = "New file imported successfully." ascii $s4 = "Error in importing the File." ascii condition: 2 of ( $s* ) } rule VOLEXITY_Apt_Malware_Charmingcypress_Openvpn_Configuration : CHARMINGCYPRESS FILE { meta: description = "Detection for a .ovpn file used in a malicious VPN client on victim machines by CharmingCypress." author = "threatintel@volexity.com" id = "f39b2d7c-f0c5-5623-a114-02ba32469e59" date = "2023-10-17" modified = "2023-10-27" reference = "TIB-20231027" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-02-13 CharmingCypress/rules.yar#L273-L298" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "d6d043973d8843a82033368c785c362f51395b1a1d475fa4705aff3526e15268" hash = "31ca565dcbf77fec474b6dea07101f4dd6e70c1f58398eff65e2decab53a6f33" logic_hash = "f4c5f13ac75504b14def9c37d3a41c6eea4c45845d4b54c50030b1f00691e4bf" score = 75 quality = 80 tags = "CHARMINGCYPRESS, FILE" os = "all" os_arch = "all" scan_context = "file" severity = "high" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 9769 version = 3 strings: $remote = "remote-cert-tls server" ascii $ip = "Ip: " $tls = "<tls_auth>" condition: all of them } rule VOLEXITY_Apt_Delivery_Win_Charming_Openvpn_Client : CHARMINGCYPRESS FILE { meta: description = "Detects a fake OpenVPN client developed by CharmingCypress." author = "threatintel@volexity.com" id = "b69fdd72-4a55-5e83-b754-401fe9339007" date = "2023-10-17" modified = "2023-10-27" reference = "TIB-20231027" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-02-13 CharmingCypress/rules.yar#L299-L323" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "2d99755d5cd25f857d6d3aa15631b69f570d20f95c6743574f3d3e3e8765f33c" logic_hash = "02596a62cb1ba17ecabef0ae93f434e4774b00422a6da2106a2bc4c59d2f8077" score = 75 quality = 80 tags = "CHARMINGCYPRESS, FILE" os = "win" os_arch = "all" scan_context = "file" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 9768 version = 2 strings: $s1 = "DONE!" $s2 = "AppCore.dll" $s3 = "ultralight@@" condition: all of ( $s* ) } rule VOLEXITY_Apt_Malware_Ps1_Powerstar_Generic : CHARMINGCYPRESS FILE MEMORY { meta: description = "Detects POWERSTAR modules based on common HTTP functions used across modules." author = "threatintel@volexity.com" id = "71a3e99d-e1c8-5ac1-abbc-2ba5cba80799" date = "2023-06-02" modified = "2024-01-26" reference = "TIB-20240126" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-02-13 CharmingCypress/rules.yar#L324-L352" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" logic_hash = "4da02190ffd16304eccbc0d12dfcc5637a6b785af0e3dc3dfcafcfe114597eb2" score = 75 quality = 80 tags = "CHARMINGCYPRESS, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 9356 version = 3 strings: $http1 = "Send_Upload" ascii wide $http2 = "Send_Post_Data" ascii wide $json1 = "{\"OS\":\"" ascii wide $json2 = "{\"ComputerName\":\"' + $env:COMPUTERNAME + '\"}" ascii wide $json3 = "{\"Token\"" ascii wide $json4 = "{\"num\":\"" ascii wide condition: all of ( $http* ) or all of ( $json* ) } rule VOLEXITY_Apt_Malware_Any_Reloadext_Plugin : STORMBAMBOO FILE MEMORY { meta: description = "Detection for RELOADEXT, a Google Chrome extension malware." author = "threatintel@volexity.com" id = "6c6c8bee-2a13-5645-89ef-779f00264fd9" date = "2024-02-23" modified = "2024-08-02" reference = "TIB-20240227" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-08-02 StormBamboo/rules.yar#L4-L36" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "9d0928b3cc21ee5e1f2868f692421165f46b5014a901636c2a2b32a4c500f761" logic_hash = "2b11f8fc5b6260ebf00bde83585cd7469709a4979ca579cdf065724bc15052fc" score = 75 quality = 80 tags = "STORMBAMBOO, FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10282 version = 4 strings: $man1 = "Reload page with Internet Explorer compatible mode." $man2 = "\"http://*/*\"" $code1 = ";chrome[" $code2 = "XMLHttpRequest(),_" $code3 = "0x400*0x400" condition: all of ( $man* ) or ( #code1 > 8 and #code2 >= 2 and #code3 >= 2 ) } rule VOLEXITY_Apt_Malware_Macos_Reloadext_Installer : STORMBAMBOO FILE MEMORY { meta: description = "Detect the RELOADEXT installer." author = "threatintel@volexity.com" id = "c65ea2b5-ab98-5693-92ea-05c0f1ea1e5b" date = "2024-02-23" modified = "2024-08-02" reference = "TIB-20240227" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-08-02 StormBamboo/rules.yar#L37-L62" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "07e3b067dc5e5de377ce4a5eff3ccd4e6a2f1d7a47c23fe06b1ededa7aed1ab3" logic_hash = "8688796839202d95ded15e10262a7a7c7cbbae4a332b60305402e5984005d452" score = 75 quality = 80 tags = "STORMBAMBOO, FILE, MEMORY" os = "darwin" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10281 version = 2 strings: $str1 = "/CustomPlug1n/" $str2 = "Chrome NOT installed." $str3 = "-f force kill Chrome" $str4 = "/*} &&cp -rf ${" condition: 3 of them } rule VOLEXITY_Apt_Malware_Win_Dustpan_Apihashes : STORMBAMBOO FILE { meta: description = "Detects DUSTPAN malware using API hashes used to resolve functions at runtime." author = "threatintel@volexity.com" id = "ed275da4-cd95-5fa3-a568-e610fb405bb3" date = "2023-08-17" modified = "2024-08-02" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-08-02 StormBamboo/rules.yar#L171-L205" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "b77bcfb036f5a6a3973fdd68f40c0bd0b19af1246688ca4b1f9db02f2055ef9d" logic_hash = "3edb66ade428c451c18aa152244f869f9f8c10e62ed942bf722b4d1cf1893e93" score = 75 quality = 80 tags = "STORMBAMBOO, FILE" os = "win" os_arch = "all" report1 = "MAR-20230818" report2 = "TIB-20231221" scan_context = "file" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 9591 version = 3 strings: $h1 = {9c 5b 9f 0b} $h2 = {4c 8f 3e 08} $h3 = {b4 aa f2 06} $h4 = {dc cb ca 09} $h5 = {d4 33 07 0e} $h6 = {27 89 d6 0a} $h7 = {b5 7d ae 09} $h8 = {4e 64 eb 0b} $h9 = {be 17 d9 08} $magic = "SMHM" condition: 6 of ( $h* ) and $magic } rule VOLEXITY_Apt_Malware_Win_Pocostick_Jul23 : STORMBAMBOO FILE MEMORY { meta: description = "Detects the July 2023 POCOSTICK variant. These strings are only visible in memory after several rounds of shellcode decryption." author = "threatintel@volexity.com" id = "9632a7fc-06da-58b4-b95c-b46aeb9dd41d" date = "2023-07-24" modified = "2024-08-02" reference = "TIB-20231221" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-08-02 StormBamboo/rules.yar#L206-L235" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "ec3e787c369ac4b28447e7cacc44d70a595e39d47f842bacb07d19b12cab6aad" logic_hash = "19487db733c7f793be2a1287df32a165e46f6af0e940b13b389f4d675b5100c4" score = 75 quality = 80 tags = "STORMBAMBOO, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 9542 version = 3 strings: $str1 = "Folder PATH listing form volume" wide $str2 = "Volume serial number is 0000-1111" wide $str3 = "Type:Error" wide $str4 = "Type:Desktop" wide $str5 = "Type:Laptop" wide $str6 = "Type:Vitual" wide $str7 = ".unicode.tmp" wide $str8 = "EveryOne" wide condition: 6 of them } rule VOLEXITY_Apt_Malware_Py_Dustpan_Pyloader : STORMBAMBOO FILE MEMORY { meta: description = "Detects Python script used by KPlayer to update, modified by attackers to download a malicious payload." author = "threatintel@volexity.com" id = "446d2eef-c60a-50ed-9ff1-df86b6210dff" date = "2023-07-21" modified = "2024-08-02" reference = "TIB-20231221" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-08-02 StormBamboo/rules.yar#L236-L270" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" logic_hash = "bb3a70dad28181534e27abbbd618165652c137264bfd3726ae4480c642493a3b" score = 75 quality = 80 tags = "STORMBAMBOO, FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 9530 version = 4 strings: $s_1 = "def count_md5(src)" $s_2 = "urllib.request.urlretrieve(image_url,main)" $s_3 = "m1 != '4c8a326899272d2fe30e818181f6f67f'" $s_4 = "os.path.split(os.path.realpath(__file__))[0]" $s_5 = "r_v = os.system('curl '+ini_url+cc)" $s_6 = "b41ef5f591226a0d5adce99cb2e629d8" $s_7 = "1df495e7c85e59ad0de1b9e50912f8d0" $s_8 = "tasklist | findstr mediainfo.exe" $url_1 = "http://dl1.5kplayer.com/youtube/youtube_dl.png" $url_2 = "http://dl1.5kplayer.com/youtube/youtube.ini?fire=" $path_1 = "C:\\\\ProgramData\\\\Digiarty\\\\mediainfo.exe" condition: 3 of ( $s_* ) or any of ( $url_* ) or $path_1 } rule VOLEXITY_Apt_Webshell_Pl_Complyshell : UTA0178 FILE MEMORY { meta: description = "Detection for the COMPLYSHELL webshell." author = "threatintel@volexity.com" id = "6b44b5bc-a75f-573c-b9c3-562b7874e408" date = "2023-12-13" modified = "2024-01-12" reference = "TIB-20231215" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L3-L25" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "8bc8f4da98ee05c9d403d2cb76097818de0b524d90bea8ed846615e42cb031d2" logic_hash = "ff46691f1add20cff30fe996e2fb199ce42408e86d5642a8a43c430f2245b1f5" score = 75 quality = 80 tags = "UTA0178, FILE, MEMORY" os = "linux" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 9995 version = 4 strings: $s = "eval{my $c=Crypt::RC4->new(" condition: $s } rule VOLEXITY_Hacktool_Py_Pysoxy : FILE MEMORY { meta: description = "SOCKS5 proxy tool used to relay connections." author = "threatintel@volexity.com" id = "88094b55-784d-5245-9c40-b1eebf0e6e72" date = "2024-01-09" modified = "2024-01-09" reference = "TIB-20240109" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L87-L114" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "e192932d834292478c9b1032543c53edfc2b252fdf7e27e4c438f4b249544eeb" logic_hash = "f73e9d3c2f64c013218469209f3b69fc868efafc151a7de979dde089bfdb24b2" score = 75 quality = 80 tags = "FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10065 version = 3 strings: $s1 = "proxy_loop" ascii $s2 = "connect_to_dst" ascii $s3 = "request_client" ascii $s4 = "subnegotiation_client" ascii $s5 = "bind_port" ascii condition: all of them } rule VOLEXITY_Apt_Malware_Py_Upstyle : UTA0218 FILE MEMORY { meta: description = "Detect the UPSTYLE webshell." author = "threatintel@volexity.com" id = "45726f35-8b3e-5095-b145-9e7f6da6838b" date = "2024-04-11" modified = "2024-04-12" reference = "TIB-20240412" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L1-L34" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac" hash = "0d59d7bddac6c22230187ef6cf7fa22bca93759edc6f9127c41dc28a2cea19d8" hash = "4dd4bd027f060f325bf6a90d01bfcf4e7751a3775ad0246beacc6eb2bad5ec6f" logic_hash = "51923600b23d23f4ce29eac7f5ab9f7e1ddb45bed5f6727ddec4dcb75872e473" score = 75 quality = 80 tags = "UTA0218, FILE, MEMORY" os = "linux" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10429 version = 2 strings: $stage1_str1 = "/opt/pancfg/mgmt/licenses/PA_VM" $stage1_str2 = "exec(base64." $stage2_str1 = "signal.signal(signal.SIGTERM,stop)" $stage2_str2 = "exec(base64." $stage3_str1 = "write(\"/*\"+output+\"*/\")" $stage3_str2 = "SHELL_PATTERN" condition: all of ( $stage1* ) or all of ( $stage2* ) or all of ( $stage3* ) } rule VOLEXITY_Hacktool_Golang_Reversessh_Fahrj : FILE MEMORY { meta: description = "Detects a reverse SSH utility available on GitHub. Attackers may use this tool or similar tools in post-exploitation activity." author = "threatintel@volexity.com" id = "332e323f-cb16-5aa2-8b66-f3d6d50d94f2" date = "2024-04-10" modified = "2024-04-12" reference = "TIB-20240412" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L82-L116" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "161fd76c83e557269bee39a57baa2ccbbac679f59d9adff1e1b73b0f4bb277a6" logic_hash = "38b40cc7fc1e601da2c7a825f1c2eff209093875a5829ddd2f4c5ad438d660f8" score = 75 quality = 80 tags = "FILE, MEMORY" os = "all" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 10423 version = 5 strings: $fun_1 = "createLocalPortForwardingCallback" $fun_2 = "createReversePortForwardingCallback" $fun_3 = "createPasswordHandler" $fun_4 = "createPublicKeyHandler" $fun_5 = "createSFTPHandler" $fun_6 = "dialHomeAndListen" $fun_7 = "createExtraInfoHandler" $fun_8 = "createSSHSessionHandler" $fun_9 = "createReversePortForwardingCallback" $proj_1 = "github.com/Fahrj/reverse-ssh" condition: any of ( $proj_* ) or 4 of ( $fun_* ) } rule VOLEXITY_Apt_Malware_Golang_Govershell_Strings_UTA0388 : UTA0388 FILE MEMORY { meta: description = "This rule detects multiple variants of the GOVERSHELL malware family employed by UTA0388 via unique strings. The implant is side-loaded by a legitimate executable and uses various network protocol to communicate with the C2 server." author = "threatintel@volexity.com" id = "1fe9b2b8-5c74-5d3c-954b-37f625911f75" date = "2025-06-30" modified = "2025-10-08" reference = "TIB-20250708B" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2025/2025-10-08 UTA0388/rules.yar#L74-L134" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "a5ee55a78d420dbba6dec0b87ffd7ad6252628fd4130ed4b1531ede960706d2d" hash = "fbade9d8a040ed643b68e25e19cba9562d2bd3c51d38693fe4be72e01da39861" logic_hash = "74fa940002e0af9095790b1cf7260778661c97db4e3d316183eecde0e2b580a8" score = 75 quality = 78 tags = "UTA0388, FILE, MEMORY" os = "win" os_arch = "all" report2 = "MAR-20250930" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 11993 version = 10 strings: $a1 = "/lib/te64/" $a2 = "te64/payload." $a3 = "payload.sendAuthRequest.Println.func1" $a4 = "sendAuthRequest.deferwrap" $a5 = ".ensureSingleInstance.Printf." $a6 = "httpslike.NewHttpsLikeConn" $a7 = "main.Execute.Println." $a8 = "C:/Users/Dev/Desktop/20250608" $a9 = "/lib/te64/httpslike/httpslike.go" $a10 = "/lib/te64/payload/payload.go" $a11 = "/lib/te64/main.go" $a12 = "'rootFolderObj" $a13 = "'triggersObj" $a14 = "'repetitionObj" $a15 = "httpslike" $a16 = "main.CopySelf.copyDir." $s1 = "C:/Users/Make/Downloads/te250608/lib/te64/payload" $s2 = "te64/payload." $s3 = "C:/Users/Make/Desktop/lib/" $s4 = "CreateUserTask.deferwrap" $s5 = "main.generateRandomDir" $s6 = "te64.dll" $s7 = "payload.NewHttpClient.ProxyURL." $s8 = "payload.normalizeProxyURL" $b1 = {27 70 72 6f 67 72 61 6d 44 61 74 61 00} $b2 = {27 72 61 6e 64 6f 6d 44 69 72 00} $b3 = {27 74 61 72 67 65 74 44 69 72 00} $b4 = {27 65 78 65 50 61 74 68 00} $b5 = {27 63 75 72 72 65 6e 74 44 69 72 00} $b6 = {27 65 78 65 4e 61 6d 65 00} $b7 = {27 74 61 72 67 65 74 45 78 65 00} $b8 = {27 72 65 6c 50 61 74 68 00} condition: 4 of ( $a* ) or 5 of ( $s* ) or 3 of ( $b* ) } rule VOLEXITY_Webshell_Aspx_Regeorgtunnel : FILE MEMORY { meta: description = "A variation of the reGeorgtunnel open-source webshell." author = "threatintel@volexity.com" id = "b8aa27c9-a28a-5051-8f81-1184f28842ed" date = "2021-03-02" modified = "2024-10-18" reference = "https://github.com/sensepost/reGeorg/blob/master/tunnel.aspx" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L26-L56" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928" logic_hash = "ea3d0532cb609682922469e8272dc8061efca3b3ae27df738ef2646e30404c6f" score = 75 quality = 80 tags = "FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "high" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 4979 version = 4 strings: $s1 = "System.Net.Sockets" $s2 = "System.Text.Encoding.Default.GetString(Convert.FromBase64String(StrTr(Request.Headers.Get" $t1 = ".Split('|')" $t2 = "Request.Headers.Get" $t3 = ".Substring(" $t4 = "new Socket(" $t5 = "IPAddress ip;" condition: all of ( $s* ) or all of ( $t* ) } rule VOLEXITY_Apt_Webshell_Aspx_Sportsball : FILE MEMORY { meta: description = "The SPORTSBALL webshell, observed in targeted Microsoft Exchange attacks in 2021. SPORTSBALL was later discovered to be a variant of HYPERSHELL, a publicly available webshell." author = "threatintel@volexity.com" id = "25b23a4c-8fc7-5d6f-b4b5-46fe2c1546d8" date = "2021-03-01" modified = "2025-07-24" reference = "https://github.com/misterch0c/APT34/blob/e62f3d14ec78bea5c98d3c895162ca1e47676c18/Webshells_and_Panel/HyperShell/HyperShell/Shell/simple.aspx" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L57-L89" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a" logic_hash = "5ec5e52922e97a3080d397b69b2f42f09daa995271e218ea085fa2ec4e3abad2" score = 75 quality = 80 tags = "FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 4968 version = 6 strings: $uniq1 = "HttpCookie newcook = new HttpCookie(\"fqrspt\", HttpContext.Current.Request.Form" $uniq2 = "ZN2aDAB4rXsszEvCLrzgcvQ4oi5J1TuiRULlQbYwldE=" $s1 = "Result.InnerText = string.Empty;" $s2 = "newcook.Expires = DateTime.Now.AddDays(" $s3 = "System.Diagnostics.Process process = new System.Diagnostics.Process();" $s4 = "process.StandardInput.WriteLine(HttpContext.Current.Request.Form[\"" $s5 = "else if (!string.IsNullOrEmpty(HttpContext.Current.Request.Form[\"" $s6 = "<input type=\"submit\" value=\"Upload\" />" condition: any of ( $uniq* ) or all of ( $s* ) } rule VOLEXITY_Apt_Malware_Win_Bluelight : INKYPINE FILE MEMORY { meta: description = "The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications." author = "threatintel@volexity.com" id = "5bfdc74b-592e-5f3d-9fb8-bbbbd0f6f0f6" date = "2021-04-23" modified = "2025-02-18" reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2021/2021-08-17 - InkySquid Part 1/indicators/yara.yar#L78-L120" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "7c40019c1d4cef2ffdd1dd8f388aaba537440b1bffee41789c900122d075a86d" hash = "94b71ee0861cc7cfbbae53ad2e411a76f296fd5684edf6b25ebe79bf6a2a600a" hash = "485246b411ef5ea9e903397a5490d106946a8323aaf79e6041bdf94763a0c028" logic_hash = "45490dfc793bb95f153c0194989b25e0b2641fa9b9f6763d5733eab6483ffead" score = 75 quality = 80 tags = "INKYPINE, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 5284 version = 12 strings: $pdb1 = "\\Development\\BACKDOOR\\ncov\\" $pdb2 = "Release\\bluelight.pdb" nocase ascii $pdb3 = "D:\\Development\\GOLD-BACKDOOR\\Release\\FirstBackdoor.pdb" $pdb4 = "GOLD-BACKDOOR\\Release\\" $msg0 = "https://ipinfo.io" fullword $msg1 = "country" fullword $msg5 = "\"UserName\":\"" fullword $msg7 = "\"ComName\":\"" fullword $msg8 = "\"OS\":\"" fullword $msg9 = "\"OnlineIP\":\"" fullword $msg10 = "\"LocalIP\":\"" fullword $msg11 = "\"Time\":\"" fullword $msg12 = "\"Compiled\":\"" fullword $msg13 = "\"Process Level\":\"" fullword $msg14 = "\"AntiVirus\":\"" fullword $msg15 = "\"VM\":\"" fullword condition: any of ( $pdb* ) or all of ( $msg* ) } rule VOLEXITY_Apt_Malware_Rb_Rokrat_Loader : INKYPINE FILE MEMORY { meta: description = "Ruby loader seen loading the ROKRAT malware family." author = "threatintel@volexity.com" id = "69d09560-a769-55d3-a442-e37f10453cde" date = "2021-06-22" modified = "2024-08-22" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L1-L32" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "5bc52f6c1c0d0131cee30b4f192ce738ad70bcb56e84180f464a5125d1a784b2" logic_hash = "30ae14fd55a3ab60e791064f69377f3b9de9b871adfd055f435df657f89f8007" score = 75 quality = 80 tags = "INKYPINE, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 5598 version = 7 strings: $magic1 = "'https://update.microsoft.com/driverupdate?id=" ascii wide $magic2 = "sVHZv1mCNYDO0AzI';" ascii wide $magic3 = "firoffset..scupd.size" ascii wide $magic4 = /alias UrlFilter[0-9]{2,5} eval;"/ $s1 = "clRnbp9GU6oTZsRGZpZ" $s2 = "RmlkZGxlOjpQb2ludGVy" $s3 = "yVGdul2bQpjOlxGZklmR" $s4 = "XZ05WavBlO6UGbkRWaG" condition: any of ( $magic* ) or any of ( $s* ) } rule VOLEXITY_Apt_Malware_Py_Bluelight_Ldr : INKYPINE FILE { meta: description = "Python Loader used to execute the BLUELIGHT malware family." author = "threatintel@volexity.com" id = "db32b752-eba4-52a6-80b6-d1d394660453" date = "2021-06-22" modified = "2025-02-18" reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L33-L61" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "80269413be6ad51b8b19631b2f5559c9572842e789bbce031babe6e879d2e120" logic_hash = "6987f5903561da8d4fa32c8d824593f601a49e13edfa2d617952d57ba3444f76" score = 75 quality = 80 tags = "INKYPINE, FILE" os = "win" os_arch = "all" scan_context = "file" severity = "high" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 5600 version = 6 strings: $s1 = "\"\".join(chr(ord(" ascii $s2 = "import ctypes" ascii $s3 = "ctypes.CFUNCTYPE(ctypes.c_int)" ascii $s4 = "ctypes.memmove" ascii $magic = "writelines(\"python ended\")" ascii condition: all of ( $s* ) or $magic } rule VOLEXITY_Apt_Malware_Win_Decrok : INKYPINE FILE MEMORY { meta: description = "The DECROK malware family, which uses the victim's hostname to decrypt and execute an embedded payload." author = "threatintel@volexity.com" id = "46be1793-6419-54fe-a78b-5d087e02626e" date = "2021-06-23" modified = "2023-09-28" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L62-L90" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "6a452d088d60113f623b852f33f8f9acf0d4197af29781f889613fed38f57855" logic_hash = "a551700943d5abc95af00fc4fefd416ace8d59037852c6bc5caf1d6bd09afd63" score = 75 quality = 80 tags = "INKYPINE, FILE, MEMORY" os = "win" os_arch = "x86" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 5606 version = 4 strings: $v1 = {C7 ?? ?? ?? 01 23 45 67 [2-20] C7 ?? ?? ?? 89 AB CD EF C7 ?? ?? ?? FE DC BA 98} $av1 = "Select * From AntiVirusProduct" wide $av2 = "root\\SecurityCenter2" wide $func1 = "CreateThread" $format = "%02x" condition: all of them and $func1 in ( @format .. @format + 10 ) } rule VOLEXITY_Apt_Malware_Win_Rokload : INKYPINE FILE { meta: description = "A shellcode loader used to decrypt and run an embedded executable." author = "threatintel@volexity.com" id = "229dbf3c-1538-5ecd-b5f8-8c9a9c81c515" date = "2021-06-23" modified = "2025-05-21" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L91-L112" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "85cd5c3bb028fe6931130ccd5d0b0c535c01ce2bcda660a3b72581a1a5382904" logic_hash = "8d65d32fd5bc055ca0e3831d3db88299e7c99f8547a170d3c53ec2c4001496a3" score = 75 quality = 80 tags = "INKYPINE, FILE" os = "win" os_arch = "x64" scan_context = "file" severity = "high" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 5603 version = 4 strings: $bytes00 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 57 41 54 41 55 41 56 41 57 48 ?? ?? ?? b9 ?? ?? ?? ?? 33 ff e8 ?? ?? ?? ?? b9 ?? ?? ?? ?? 4c 8b e8 e8 ?? ?? ?? ?? 4c 8b f0 41 ff d6 b9 ?? ?? ?? ?? 44 8b f8 e8 ?? ?? ?? ?? 4c 8b e0 e8 ?? ?? ?? ?? 48 } condition: $bytes00 at 0 } rule VOLEXITY_Apt_Malware_Win_Flipflop_Ldr : COZYLARCH FILE MEMORY { meta: description = "A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload." author = "threatintel@volexity.com" id = "58696a6f-55a9-5212-9372-a539cc327e6b" date = "2021-05-25" modified = "2025-05-21" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L3-L26" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330" logic_hash = "a79d2b0700ae14f7a2af23c8f7df3df3564402b1137478008ccabefea0f543ad" score = 75 quality = 80 tags = "COZYLARCH, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 5443 version = 6 strings: $s1 = "irnjadle" $s2 = "BADCFEHGJILKNMPORQTSVUXWZY" $s3 = "iMrcsofo taBesC yrtpgoarhpciP orived r1v0." condition: all of ( $s* ) } rule VOLEXITY_Malware_Win_Cobaltstrike_D : FILE MEMORY { meta: description = "The CobaltStrike malware family, variant D." author = "threatintel@volexity.com" id = "89a2459b-314b-513e-bd1a-8c4239a30338" date = "2021-05-25" modified = "2024-11-22" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L27-L54" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "b041efb8ba2a88a3d172f480efa098d72eef13e42af6aa5fb838e6ccab500a7c" logic_hash = "751b6832f2952d369cb616b28ac009d7bfcc4d92bf2db36d87d69bc1e9fa6c75" score = 75 quality = 80 tags = "FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 5445 version = 5 strings: $s1 = "%s (admin)" fullword $s2 = {48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65 74 2D 73 74 72 65 61 6D 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 0D 0A 0D 0A 00} $s3 = "%02d/%02d/%02d %02d:%02d:%02d" fullword $s4 = "%s as %s\\%s: %d" fullword $s5 = "%s&%s=%s" fullword $s6 = "rijndael" fullword $s7 = "(null)" condition: 6 of ( $s* ) } rule VOLEXITY_Apt_Malware_Win_Freshfire : COZYLARCH FILE { meta: description = "The FRESHFIRE malware family. The malware acts as a downloader, pulling down an encrypted snippet of code from a remote source, executing it, and deleting it from the remote server." author = "threatintel@volexity.com" id = "050b8e61-139a-5ff5-998a-7de67c9975bf" date = "2021-05-27" modified = "2025-05-21" reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L55-L87" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "ad67aaa50fd60d02f1378b4155f69cffa9591eaeb80523489a2355512cc30e8c" logic_hash = "69cd73f5812ba955c1352fb1552774d5cf49019d6b65a304fd1e33f852e678ba" score = 75 quality = 80 tags = "COZYLARCH, FILE" os = "win" os_arch = "all" scan_context = "file" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 5459 version = 9 strings: $uniq1 = "UlswcXJJWhtHIHrVqWJJ" $uniq2 = "gyibvmt\x00" $path1 = "root/time/%d/%s.json" $path2 = "C:\\dell.sdr" $path3 = "root/data/%d/%s.json" condition: (pe.number_of_exports == 1 and pe.exports ( "WaitPrompt" ) ) or any of ( $uniq* ) or 2 of ( $path* ) } rule VOLEXITY_Malware_Win_Backwash_Cpp : WHEELEDASH FILE MEMORY { meta: description = "CPP loader for the Backwash malware." author = "threatintel@volexity.com" id = "8a1c4ff1-1827-5e6f-b838-664d8c3be840" date = "2021-11-17" modified = "2023-11-13" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2021/2021-12-06 - XEGroup/indicators/yara.yar#L3-L26" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "0cf93de64aa4dba6cec99aa5989fc9c5049bc46ca5f3cb327b49d62f3646a852" logic_hash = "c8ed2d3103aa85363acd7f5573aeb936a5ab5a3bacbcf1f04e6b298299f24dae" score = 75 quality = 80 tags = "WHEELEDASH, FILE, MEMORY" os = "win" os_arch = "all" scan_context = "file,memory" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 6147 version = 2 strings: $s1 = "cor1dbg.dll" wide $s2 = "XEReverseShell.exe" wide $s3 = "XOJUMAN=" wide condition: 2 of them } rule VOLEXITY_Malware_Win_Iis_Shellsave : WHEELEDASH FILE MEMORY { meta: description = "Detects an AutoIT backdoor designed to run on IIS servers and to install a webshell." author = "threatintel@volexity.com" id = "a89defa5-4b22-5650-a0c0-f4b3cf3377a7" date = "2021-11-17" modified = "2023-08-17" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2021/2021-12-06 - XEGroup/indicators/yara.yar#L27-L49" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "21683e02e11c166d0cf616ff9a1a4405598db7f4adfc87b205082ae94f83c742" logic_hash = "f34d6f4ecaa4cde5965f6b0deac55c7133a2be96f5c466f34775be6e7f730493" score = 75 quality = 80 tags = "WHEELEDASH, FILE, MEMORY" scan_context = "file,memory" severity = "high" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 6146 version = 4 strings: $s1 = "getdownloadshell" ascii $s2 = "deleteisme" ascii $s3 = "sitepapplication" ascii $s4 = "getapplicationpool" ascii condition: all of them } rule VOLEXITY_Malware_Win_Backwash_Iis_Scout : WHEELEDASH FILE MEMORY { meta: description = "Simple backdoor which collects information about the IIS server it is installed on. It appears to the attacker refers to this components as 'XValidate' - i.e. to validate infected machines." author = "threatintel@volexity.com" id = "1f768b39-21a0-574d-9043-5104540003f7" date = "2021-11-17" modified = "2023-08-17" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2021/2021-12-06 - XEGroup/indicators/yara.yar#L50-L78" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "6f44a9c13459533a1f3e0b0e698820611a18113c851f763797090b8be64fd9d5" logic_hash = "18c4e338905ff299d75534006037e63a8f9b191f062cc97b0592245518015f88" score = 75 quality = 80 tags = "WHEELEDASH, FILE, MEMORY" scan_context = "file,memory" severity = "high" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 6145 version = 3 strings: $s1 = "SOAPRequest" ascii $s2 = "requestServer" ascii $s3 = "getFiles" ascii $s4 = "APP_POOL_CONFIG" wide $s5 = "<virtualDirectory" wide $s6 = "stringinstr" ascii $s7 = "504f5354" wide $s8 = "XValidate" ascii $s9 = "XEReverseShell" ascii $s10 = "XERsvData" ascii condition: 6 of them } rule VOLEXITY_Malware_Js_Xeskimmer : WHEELEDASH FILE { meta: description = "Detects JScript code using in skimming credit card details." author = "threatintel@volexity.com" id = "2c0911cf-a679-5d4e-baad-777745a28e27" date = "2021-11-17" modified = "2023-11-14" reference = "https://github.com/MBThreatIntel/skimmers/blob/master/null_gif_skimmer.js" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2021/2021-12-06 - XEGroup/indicators/yara.yar#L79-L114" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "92f9593cfa0a28951cae36755d54de63631377f1b954a4cb0474fa0b6193c537" logic_hash = "cc46e9fab5f408fde13c3897d378a1a2e4acb448f40ca4935c19024ebdc252d7" score = 75 quality = 80 tags = "WHEELEDASH, FILE" os = "win" os_arch = "all" scan_context = "file" severity = "critical" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 6144 version = 4 strings: $s1 = ".match(/^([3456]\\d{14,15})$/g" ascii $s2 = "^(p(wd|ass(code|wd|word)))" ascii $b1 = "c('686569676874')" ascii $b2 = "c('7769647468')" ascii $c1 = "('696D67')" ascii $c2 = "('737263')" ascii $magic = "d=c.charCodeAt(b),a+=d.toString(16);" condition: all of ( $s* ) or all of ( $b* ) or all of ( $c* ) or $magic } rule VOLEXITY_Malware_Win_Backwash_Iis : WHEELEDASH FILE MEMORY { meta: description = "Variant of the BACKWASH malware family with IIS worm functionality." author = "threatintel@volexity.com" id = "08a86a58-32af-5c82-90d2-d6603dae8d63" date = "2020-09-04" modified = "2023-08-17" reference = "https://github.com/volexity/threat-intel" source_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/2021/2021-12-06 - XEGroup/indicators/yara.yar#L181-L208" license_url = "https://github.com/volexity/threat-intel/blob/683296427d8c7f08938ce6c587f618c938cf4c54/LICENSE.txt" hash = "98e39573a3d355d7fdf3439d9418fdbf4e42c2e03051b5313d5c84f3df485627" logic_hash = "95a7f9e0afb031b49cd0da66b5a887d26ad2e06cce625bc45739b4a80e96ce9c" score = 75 quality = 80 tags = "WHEELEDASH, FILE, MEMORY" scan_context = "file,memory" severity = "high" license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt" rule_id = 231 version = 6 strings: $a1 = "GetShell" ascii $a2 = "smallShell" ascii $a3 = "createSmallShell" ascii $a4 = "getSites" ascii $a5 = "getFiles " ascii $b1 = "action=saveshell&domain=" ascii wide $b2 = "&shell=backsession.aspx" ascii wide condition: all of ( $a* ) or any of ( $b* ) } /* * YARA Rule Set * Repository Name: Elceef * Repository: https://github.com/elceef/yara-rulz * Retrieval Date: 2026-10-26 * Git Commit: 5683b294a12cf0c875b624933586029ae43a852f * Number of Rules: 16 * Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance) * * * LICENSE * * MIT License Copyright (c) 2022 Marcin Ulikowski Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */ rule ELCEEF_Suspicious_SFX : FILE { meta: description = "Detects self-extracting archives (SFX) executing cmd.exe or powershell.exe" author = "marcin@ulikowski.pl" id = "78f4ae8b-ba17-5c02-a6f0-66bec873aba8" date = "2023-04-04" modified = "2023-04-04" reference = "https://www.crowdstrike.com/blog/self-extracting-archives-decoy-files-and-their-hidden-payloads/" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/Suspicious_SFX.yara#L1-L22" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" logic_hash = "688ed356e2fa936a0e07a8479591c28fb457053ed94351bad4bf367b02f04b0a" score = 65 quality = 73 tags = "FILE" strings: $rar = { 52 61 72 21 } $zip = { 50 4b 03 04 } $setup_cmd = "\nSetup=cmd" $setup_powershell = "\nSetup=powershell" $silent = "\nSilent=1" condition: filesize < 1MB and uint16be( 0 ) == 0x4d5a and any of ( $zip , $rar ) and any of ( $setup_* ) and $silent } rule ELCEEF_HTA_Wscriptshell_Onenote : FILE { meta: description = "Detects suspicious OneNote documents with embedded HTA + WScript.Shell" author = "marcin@ulikowski.pl" id = "8cebd862-8dfb-5f5d-befb-5c41cde945ff" date = "2023-02-01" modified = "2023-02-02" reference = "https://github.com/elceef/yara-rulz" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/HTA_OneNote.yara#L1-L17" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" hash = "002fe00bc429877ee2a786a1d40b80250fd66e341729c5718fc66f759387c88c" logic_hash = "0287ac5d618c9a8332d167f1a05157aa829c7e8a052c35100fcaeb644d452e5c" score = 65 quality = 75 tags = "FILE" strings: $magic = { ae b1 53 78 d0 29 96 d3 } $hta = { 00 04 00 00 00 2e 00 68 00 74 00 61 } $wsh = "CreateObject(\"WScript.Shell\")" condition: filesize < 5MB and $magic at 8 and $wsh and $hta } rule ELCEEF_Base64_SVG_Javascript { meta: description = "Detects base64 encoded SVG objects containing Javascript" author = "marcin@ulikowski.pl" id = "99275772-1f4f-5616-9a9c-f76b613fe143" date = "2022-10-25" modified = "2022-12-12" reference = "https://github.com/elceef/yara-rulz" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/Base64_SVG_Javascript.yara#L1-L16" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" hash = "fe394a59e961c3fbcc326e7d0ee5909596de55249e669bc4da0aed172c11fda8" hash = "f0c94f2705b1aea17f4a6c6d71c6ed725fe71bf66b03b0117060010859ca8a19" logic_hash = "e4cb08ccc75dc00b518c4ee1495409ae6bb99e7d493be55312b8d39aa9099cfc" score = 75 quality = 75 tags = "" strings: $svg = "\"data:image/svg+xml;base64" wide ascii $js = "<script type=\"text/javascript\">" base64 condition: all of them } rule ELCEEF_BAT_Obfuscated_Setenv { meta: description = "Detects batch script with obfuscated SET command located directly after @echo off" author = "marcin@ulikowski.pl" id = "999d192e-a792-5953-b9e2-de4b298444d3" date = "2023-05-01" modified = "2023-05-05" reference = "https://twitter.com/wdormann/status/1651631372438585344" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/Suspicious_BAT.yara#L1-L20" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" hash = "a0f43c5748ada07a12af81dda2460045030f936a8d5081f3a403f85c2a9668f8" hash = "1a0ca873412474a6437d33e48071aa0169f8317b5c996e1b10a41791707b2cf5" hash = "83e47d4f3dd43ed01dc573f0b83e9e71f0ec75b6ea5712f640585d01d8aedf3c" hash = "cf351a2b1f0a157a92be2e01e460140e2c1d0ee1685474144f2203a97d2de489" logic_hash = "da3a2245207d79cb720079cc2bc88d5f9db22fc16601d21e7c8dcea381ed11e9" score = 75 quality = 75 tags = "" strings: $s1 = { 40 65 63 68 6f 20 6f 66 66 0d 0a ( 73 65 25 | 73 25 | 25 ) [2-26] 3a 7e [0-6] 3? 25 ( 25 | 20 | 65 25 | 74 20 | 65 74 20 ) } $s2 = { 40 65 63 68 6f 20 6f 66 66 0d 0a 73 65 74 20 22 [4] 3d 73 65 74 20 22 0d 0a 25 } condition: $s1 in ( 0 .. 4 ) or $s2 in ( 0 .. 4 ) } rule ELCEEF_BAT_Chunked_Payload_Setenv { meta: description = "Detects batch script storing chunks of payload in random environment variables" author = "marcin@ulikowski.pl" id = "18f3ddac-bc19-5b54-891e-93271d59490a" date = "2023-05-05" modified = "2024-04-10" reference = "https://github.com/elceef/yara-rulz" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/Suspicious_BAT.yara#L22-L37" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" hash = "f73521adbf89be99c4d7ea74ebf7fed815af49ce4dc060656d7c9c631e4d0538" logic_hash = "6b202d1a5723db664c7ca689c73fc1f84365801fd56fc9a035c8d3a0b6b2b9da" score = 75 quality = 75 tags = "" strings: $echo = "@echo off" $set = { ( 0d 0a | 26 20 ) 73 65 74 20 22 [10] 3d [2-6] 22 } condition: $echo in ( 0 .. 4 ) and #set > 10 } rule ELCEEF_BAT_Begin_Substring_Env { meta: description = "Detects suspicious substring syntax at the begining of batch script" author = "marcin@ulikowski.pl" id = "3fca187b-d2e7-595c-9330-25141a54285b" date = "2023-06-02" modified = "2024-04-10" reference = "https://cybersecurity.att.com/blogs/labs-research/seroxen-rat-for-sale" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/Suspicious_BAT.yara#L39-L55" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" hash = "8ace121fae472cc7ce896c91a3f1743d5ccc8a389bc3152578c4782171c69e87" logic_hash = "cc5e6e511bbc0a5cbb277ed0cbac1f2b21db8e21c4cdc802b6a1c3313d3b55cc" score = 65 quality = 75 tags = "" strings: $echo = "@echo off" $substr = { 3a 7e ( 3? 2c 3? | 2d 3? 2c 3? | 3? 2c 2d 3? | 3? 3? 2c 3? | 2d 3? 3? 2c 3? | 3? 3? 2c 2d 3? ) 25 } condition: $echo in ( 0 .. 4 ) and $substr in ( 10 .. 100 ) } rule ELCEEF_Polymorph_BAT_CAB : FILE { meta: description = "Detects polymorphic BAT/CAB files self-extracting payload with extrac32.exe/extract.exe" author = "marcin@ulikowski.pl" id = "10a46120-beaf-5443-bc35-c6d9ef065bb4" date = "2024-04-10" modified = "2024-04-10" reference = "https://github.com/elceef/yara-rulz" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/Suspicious_BAT.yara#L57-L72" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" hash = "f1296b12925108a5d675a8b9c2033c0b749b121ae3b5a6a912ce4418daa06d99" logic_hash = "d29d488b0ebcfb485818c181ac674e3586aa1a41ab68185a1f1d3e49295ffbce" score = 75 quality = 75 tags = "FILE" strings: $extract = { 65 78 74 72 61 63 ( 33 32 | 74 ) 20 2f 79 20 22 25 7e 66 30 22 } condition: uint32be( 0 ) == 0x4d534346 and uint32( 16 ) > 80 and $extract in ( 48 .. 80 ) } rule ELCEEF_Suspicious_Onenote { meta: description = "Detects OneNote documents with FileDataStoreObject structure containing: PE32, shortcut files (*.lnk), encoded JS, Windows Help File (*.chm), or batch script" author = "marcin@ulikowski.pl" id = "57f6fc7f-666f-5887-ac97-513588415757" date = "2023-01-22" modified = "2023-02-21" reference = "https://github.com/elceef/yara-rulz" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/Suspicious_OneNote.yara#L1-L23" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" hash = "f408ef3fa89546483ba63f58be3f27a98795655eb4b9b6217cbe302a5ba9d5f7" hash = "5306fa7940b4d67dfb031fd315b661cecb2ce81e2f34c9393e1826df0f0bbdc5" hash = "e1d34ad42938a777d80f3ee4c206de14021f13ab79600168b85894fdb0867b3e" hash = "9e89231578d8b9b190de3288fd10f43cf11a24963a8b0a76f0c46170deda59fd" hash = "6778c59a29e25d722230163bea272ece58d2d3696fbce4347c20104e8fb735dc" logic_hash = "b65f0976b71c1e827ecce09f0c435d9ffa6a5d3b3a41401efc6a14b6259af4ad" score = 65 quality = 75 tags = "" strings: $magic = { ae b1 53 78 d0 29 96 d3 } $fdso_pe32 = { a4 c4 8d 4d 0b 7a 9e ac [20] 4d 5a } $fdso_bat = { a4 c4 8d 4d 0b 7a 9e ac [20] 40 65 63 68 6f 20 6f 66 66 } $fdso_lnk = { a4 c4 8d 4d 0b 7a 9e ac [20] 4c 00 00 00 01 14 02 00 } $fdso_jse = { a4 c4 8d 4d 0b 7a 9e ac [20] 23 40 7e 5e } $fdso_chm = { a4 c4 8d 4d 0b 7a 9e ac [20] 49 54 53 46 03 } condition: $magic at 8 and 1 of ( $fdso_* ) } rule ELCEEF_EICAR_Encrypted_ZIP { meta: description = "Detects EICAR file in any encrypted ZIP archive" author = "marcin@ulikowski.pl" id = "c12d42de-356a-584b-9c48-71e65940f1cf" date = "2022-12-13" modified = "2022-12-16" reference = "https://github.com/elceef/yara-rulz" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/EICAR_Encrypted_ZIP.yara#L14-L44" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" logic_hash = "56851056671bde38338bd200d9fde59c042f35a2cd84ac9401e716f376c9502c" score = 75 quality = 75 tags = "" strings: $local = { 50 4b 03 04 // local file header signature (PK) ?? 00 // minimum version ?? 00 // flags (bit 0 and 6 indicate encryption) ?? 00 // compression method ?? ?? // last modification time ?? ?? // last modification date ?? ?? ?? ?? // CRC-32 of uncompressed and unencrypted data ?? ?? ?? ?? // compressed size ?? ?? ?? ?? // uncompressed size } condition: for any i in ( 1 .. #local ) : ( ( uint8( @local [ i ] + 6 ) & 0x01 or uint8( @local [ i ] + 6 ) & 0x40 ) and uint32( @local [ i ] + 14 ) == 0x6851cf3c and uint32( @local [ i ] + 22 ) == 68 ) } rule ELCEEF_Winrar_CVE_2025_8088_Exploit : CVE_2025_8088 FILE { meta: description = "Detects RAR archives exploiting CVE-2025-8088 in WinRAR" author = "marcin@ulikowski.pl" id = "546e2858-c04a-5f3c-94b9-54d5b7f364b5" date = "2025-08-18" modified = "2025-08-18" reference = "https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/WinRAR_CVE_2025_8088.yara#L1-L17" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" hash = "2a8fafa01f6d3863c87f20905736ebab28d6a5753ab708760c0b6cf3970828c3" logic_hash = "f3181b92294ad68467b6ce121170a91b423604fd152f27899a2f34879266e9d8" score = 75 quality = 75 tags = "CVE-2025-8088, FILE" strings: $ = { 00 03 53 54 4d [2-3] 3a ( 5c | 2e ) ( 5c | 2e ) ( 5c | 2e ) ( 5c | 2e ) } condition: uint32be( 0 ) == 0x52617221 and all of them } rule ELCEEF_HTML_Smuggling_A : T1027 FILE { meta: description = "Generic detection for HTML smuggling (T1027.006)" author = "marcin@ulikowski.pl" id = "b711318f-81d2-5d0b-968f-04ae18fdea5b" date = "2021-05-13" modified = "2023-04-16" reference = "https://github.com/elceef/yara-rulz" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/HTML_Smuggling.yara#L1-L31" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" hash = "279d5ef8f80aba530aaac8afd049fa171704fc703d9cfe337b56639732e8ce11" logic_hash = "bc076e9f3d4c6d2aa5a3602436408e5b2ac3140ca9f7cc776c44835cba211951" score = 75 quality = 75 tags = "T1027, FILE" strings: $mssave = { ( 2e | 22 | 27 ) 6d 73 53 61 76 65 } $element = { ( 2e | 22 | 27 ) 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 ( 28 | 22 | 27 ) } $objecturl = { ( 2e | 22 | 27 ) 63 72 65 61 74 65 4f 62 6a 65 63 74 55 52 4c ( 28 | 22 | 27 ) } $download = { ( 2e | 22 | 27 ) 64 6f 77 6e 6c 6f 61 64 ( 3d | 22 | 27 ) } $click = { ( 2e | 22 | 27 ) 63 6c 69 63 6b ( 3d | 22 | 27 ) } $atob = { 61 74 6f 62 ( 28 | 22 | 27 ) } $blob = "new Blob(" $array = "new Uint8Array(" $ole2 = "0M8R4KGxGuEA" $pe32 = "TVqQAAMAAAAE" $iso = "AAAABQ0QwMDE" $udf = "AAAAQkVBMDEB" $zip = { 55 45 73 44 42 ( 41 | 42 | 43 | 44 ) ( 6f | 30 | 4d | 51 ) ( 41 | 44 ) ( 41 | 43 ) } $jsxor = { 2e 63 68 61 72 43 6f 64 65 41 74 28 [1-10] 29 ( 5e | 20 5e ) } condition: filesize < 5MB and ( $mssave or ( #element == 1 and #objecturl == 1 and #download == 1 and #click == 1 ) ) and $blob and $array and $atob and ( #ole2 + #pe32 + #iso + #udf + #zip + #jsxor ) == 1 } rule ELCEEF_HTML_Smuggling_B : T1027 FILE { meta: description = "Generic detection for HTML smuggling (T1027.006)" author = "marcin@ulikowski.pl" id = "640d70c2-f1fc-5e32-a720-ebc92839ec40" date = "2022-12-02" modified = "2023-04-16" reference = "https://github.com/elceef/yara-rulz" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/HTML_Smuggling.yara#L33-L60" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" hash = "63955db0ccd6c0613912afb862635bde0fa925847f27adc8a0d65c994a7e05ea" logic_hash = "3c42e6f715bd5476aea4d47e9f6431747ddf7c7c8098840560201e2c21723eeb" score = 75 quality = 75 tags = "T1027, FILE" strings: $objecturl = { ( 2e | 22 | 27 ) 63 72 65 61 74 65 4f 62 6a 65 63 74 55 52 4c ( 28 | 22 | 27 ) } $atob = "atob(" $blob = "new Blob(" $file = "new File([" $array = "new Uint8Array(" $ole2 = "0M8R4KGxGuEA" $pe32 = "TVqQAAMAAAAE" $iso = "AAAABQ0QwMDE" $udf = "AAAAQkVBMDEB" $zip = { 55 45 73 44 42 ( 41 | 42 | 43 | 44 ) ( 6f | 30 | 4d | 51 ) ( 41 | 44 ) ( 41 | 43 ) } $jsxor = { 2e 63 68 61 72 43 6f 64 65 41 74 28 [1-10] 29 ( 5e | 20 5e ) } condition: filesize < 5MB and $atob and #objecturl == 1 and #file == 1 and #blob == 1 and #array == 1 and ( #ole2 + #pe32 + #iso + #udf + #zip + #jsxor ) == 1 } rule ELCEEF_HTML_Smuggling_C : T1027 FILE { meta: description = "Generic detection for HTML smuggling (T1027.006)" author = "marcin@ulikowski.pl" id = "ea1eafad-905b-571e-a016-8774e65bd976" date = "2023-04-17" modified = "2023-04-17" reference = "https://github.com/elceef/yara-rulz" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/HTML_Smuggling.yara#L62-L82" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" hash = "0b4cdfc8ae8ae17d7b6786050f1962c19858b91febb18f61f553083f57d96fea" hash = "2b99bf97f3d02ba3b44406cedd1ab31824723b56a8aae8057256cc87870c199e" hash = "904ea1ada62cfd4b964a6a3eb9bab5b98022ab000f77b75eb265a2ac44b45b37" logic_hash = "83409b0b173980975f6349e448e72fe1b2115fc7dbdec8ee7ad1826a65db17d3" score = 75 quality = 75 tags = "T1027, FILE" strings: $blob = "new Blob(" $array = "new Uint8Array(" $mssave = { ( 2e | 22 | 27 ) 6d 73 53 61 76 65 } $loop = { ?? 5b 69 5d ( 3d | 20 3d | 3d 20 | 20 3d 20 ) ?? 5b 69 5d ( 2d | 20 2d | 2d 20 | 20 2d 20 ) 3? 3b } condition: filesize < 5MB and $mssave and #blob == 1 and #array == 1 and #loop == 1 } rule ELCEEF_HTML_Windows_Search_Abuse { meta: description = "Detects HTML files abusing Windows system functionalities to redirect and download malicious payloads" author = "marcin@ulikowski.pl" id = "537cb46e-4cfc-517c-8d6d-0019f2c3e5ef" date = "2024-06-15" modified = "2024-06-16" reference = "https://github.com/elceef/yara-rulz" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/HTML_Windows_Search.yara#L1-L22" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" hash = "d136dcfc355885c502ff2c3be229791538541b748b6c07df3ced95f9a7eb2f30" logic_hash = "6a0d490cf08ab0aad3c535645abe9ebc26d12768cf2a2e932cdb7ec93cf3e2bd" score = 75 quality = 73 tags = "" strings: $location1 = "location.href" wide ascii $location2 = "location.replace(" wide ascii $location3 = "location.assign(" wide ascii $metarefresh = "<meta http-equiv=\"refresh\"" nocase wide ascii $search1 = "\"search-ms:query=" wide ascii $search2 = "\"search:query=" wide ascii $search3 = "URL=search:query=" wide ascii $crumb1 = "&crumb=location:" wide ascii $crumb2 = "&crumb=location:" wide ascii condition: ( any of ( $location* ) or $metarefresh ) and any of ( $search* ) and any of ( $crumb* ) } rule ELCEEF_Winrar_CVE_2023_38831_Exploit : CVE_2023_38831 FILE { meta: description = "Detects ZIP archives exploiting CVE-2023-38831 in WinRAR" author = "marcin@ulikowski.pl" id = "7d592eb7-b344-59ed-adf8-fe69ebb1e43f" date = "2023-09-23" modified = "2023-09-28" reference = "https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/WinRAR_CVE_2023_38831.yara#L1-L17" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" hash = "00175d538cba0c493e397a0b7f4b28f9a90dd0ee40f69795ae28d23ce0d826c0" hash = "ca8ca67df7853b86b6a107c8fd7f73b757de9143ea8844d0e6209249e8377885" logic_hash = "06f1d807429fb175831cf333b05b44b6ce33b4ae981e16c03e36ec7564a4fdd1" score = 75 quality = 75 tags = "CVE-2023-38831, FILE" strings: $ = { 50 4b 03 04 [24] 00 00 [3-64] 2e ?? ?? ?? 20 2f [3-64] 2e ?? ?? ?? 20 2e ( 626174 | 636d64 | 707331 ) } condition: uint16be( 0 ) == 0x504b and all of them } rule ELCEEF_ZIP_High_Ratio_Single_Doc : FILE { meta: description = "Detects ZIP archives containing single MS Word document with unusually high compression ratio" author = "marcin@ulikowski.pl" id = "0fbe89d9-1bf5-50a9-b6c1-1d739162a2ba" date = "2023-03-08" modified = "2023-03-08" reference = "https://github.com/elceef/yara-rulz" source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/ZIP_High_Ratio_Single_Doc.yara#L8-L27" license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE" hash = "4d9a6dfca804989d40eeca9bb2d90ef33f3980eb07ca89bbba06d0ef4b37634b" hash = "4bc2d14585c197ad3aa5836b3f7d9d784d7afe79856e0ddf850fc3c676b6ecb1" logic_hash = "470300b8d6356cff43a1e2be3a23a97be5d1e2ce5a76f2fb2eccdbbb47a4d327" score = 75 quality = 75 tags = "FILE" strings: $magic = { 50 4b 03 04 } $ext = ".doc" condition: filesize < 1MB and $magic at 0 and #magic == 1 and uint32( 22 ) > 1024 * 1024 * 100 and $ext at ( uint16( 26 ) + 26 ) } /* * YARA Rule Set * Repository Name: DitekSHen * Repository: https://github.com/ditekshen/detection * Retrieval Date: 2026-10-26 * Git Commit: e76c93dcdedff04076380ffc60ea54e45b313635 * Number of Rules: 609 * Skipped: 0 (age), 140 (quality), 5 (score), 799 (importance) * * * LICENSE * * Copyright 2021 by ditekSHen (https://github.com/ditekshen/detection). The 2-Clause BSD License Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ rule DITEKSHEN_INDICATOR_TOOL_PWS_Credstealer : FILE { meta: description = "Detects Python executable for stealing credentials including domain environments. Observed in MuddyWater." author = "ditekSHen" id = "ab587b12-f3e1-5f08-b27c-03ee9752e513" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L22-L41" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e729c8b0b1db642acabbc4590833c05ce81447bb89e5f40aea5f0b8ebdee4438" score = 75 quality = 75 tags = "FILE" strings: $s1 = "PYTHON27.DLL" fullword wide $s2 = "C:\\Python27\\lib\\site-packages\\py2exe\\boot_common.pyR" fullword ascii $s3 = "C:\\Python27\\lib\\site-packages\\py2exe\\boot_common.pyt" fullword ascii $s4 = "subprocess.pyc" fullword ascii $s5 = "MyGetProcAddress(%p, %p(%s)) -> %p" fullword ascii $p1 = "Dump SAM hashes from target systemss" fullword ascii $p2 = "Dump LSA secrets from target systemss" fullword ascii $p3 = "Dump the NTDS.dit from target DCs using the specifed method" fullword ascii $p4 = "Dump NTDS.dit password historys" fullword ascii $p5 = "Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameterss" fullword ascii $p6 = "Retrieve plaintext passwords and other information for accounts pushed through Group Policy Preferencess" fullword ascii $p7 = "Combo file containing a list of domain\\username:password or username:password entriess" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) and 1 of ( $p* ) ) } rule DITEKSHEN_INDICATOR_TOOL_PWS_Fgdump : FILE { meta: description = "detects all versions of the password dumping tool, fgdump. Observed to be used by DustSquad group." author = "ditekSHen" id = "2759fce2-db2a-5a48-bb37-931fd847a32d" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L64-L81" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "fdccd91a84374f7c94843bd9c2191720959416acf2e33d7b28b42d63d7ea4ce3" score = 75 quality = 75 tags = "FILE" strings: $s1 = "dumping server %s" ascii $s2 = "dump on server %s" ascii $s3 = "dump passwords: %s" ascii $s4 = "Dumping cache" nocase ascii $s5 = "SECURITY\\Cache" ascii $s6 = "LSASS.EXE process" ascii $s7 = " AntiVirus " nocase ascii $s8 = " IPC$ " ascii $s9 = "Exec failed, GetLastError returned %d" fullword ascii $10 = "writable connection to %s" ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_INDICATOR_TOOL_PWS_Blackbone : FILE { meta: description = "detects Blackbone password dumping tool on Windows 7-10 operating system." author = "ditekSHen" id = "a6d9f9d1-75fb-51af-87ad-80b4e135e759" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L112-L129" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e9dacd28accaef8a93ff8d3b5cf9437b3848791711a4a7118ab46d2bb6ca42d3" score = 75 quality = 75 tags = "FILE" strings: $s1 = "BlackBone: %s: " ascii $s2 = "\\BlackBoneDrv\\" ascii $s3 = "\\DosDevices\\BlackBone" fullword wide $s4 = "\\Temp\\BBImage.manifest" wide $s5 = "\\Device\\BlackBone" fullword wide $s6 = "BBExecuteInNewThread" fullword ascii $s7 = "BBHideVAD" fullword ascii $s8 = "BBInjectDll" fullword ascii $s9 = "ntoskrnl.exe" fullword ascii $s10 = "WDKTestCert Ton," ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_INDICATOR_TOOL_PWS_Mimikatz : FILE { meta: description = "Detects Mimikatz" author = "ditekSHen" id = "feb236c0-6e0d-5c2c-a050-cf1d000aaf38" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L131-L164" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "42c9c78c88bb7c427d5f0bf1d3b0113205780142b499eb17858037ded0f2971e" score = 75 quality = 73 tags = "FILE" strings: $s1 = "mimilib.dll" ascii $s2 = "mimidrv.sys" ascii $s3 = "mimikatz.exe" ascii $s4 = "\\mimidrv.pdb" ascii $s5 = "mimikatz" ascii $s6 = { 6d 00 69 00 6d 00 69 00 6b 00 61 00 74 00 7a } $s7 = { 5c 00 6d 00 69 00 6d 00 69 00 64 00 72 00 76 } $s8 = { 6d 00 69 00 6d 00 69 00 64 00 72 00 76 } $s9 = "Lecture KIWI_MSV1_0_" ascii $s10 = "Search for LSASS process" ascii $f1 = "SspCredentialList" ascii $f2 = "KerbGlobalLogonSessionTable" ascii $f3 = "LiveGlobalLogonSessionList" ascii $f4 = "TSGlobalCredTable" ascii $f5 = "g_MasterKeyCacheList" ascii $f6 = "l_LogSessList" ascii $f7 = "lsasrv!" ascii $f8 = "SekurLSA" ascii $f9 = /Cached(Unlock|Interative|RemoteInteractive)/ ascii $dll_1 = { c7 0? 00 00 01 00 [4-14] c7 0? 01 00 00 00 } $dll_2 = { c7 0? 10 02 00 00 ?? 89 4? } $sys_x86 = { a0 00 00 00 24 02 00 00 40 00 00 00 [0-4] b8 00 00 00 6c 02 00 00 40 00 00 00 } $sys_x64 = { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 } condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $* ) or 3 of ( $f* ) or all of ( $dll_* ) or any of ( $sys_* ) ) } rule DITEKSHEN_INDICATOR_TOOL_SCN_Portscan : FILE { meta: description = "Detects a port scanner tool observed as second or third stage post-compromise or dropped by malware." author = "ditekSHen" id = "f270e098-17a0-5d66-acd0-c946a29919f4" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L166-L180" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ebe5eb045a250ca38a55ac43018548074e9db160d76737c36f8ae5ea268b7b10" score = 75 quality = 75 tags = "FILE" strings: $s1 = "HEAD / HTTP/1.0" fullword ascii $s2 = "Result.txt" fullword ascii $s3 = "Example: %s SYN " ascii $s4 = "Performing Time: %d/%d/%d %d:%d:%d -->" fullword ascii $s5 = "Bind On IP: %d.%d.%d.%d" fullword ascii $s6 = "SYN Scan: About To Scan %" ascii $s7 = "Normal Scan: About To Scan %" ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_INDICATOR_TOOL_PWS_Sniffpass : FILE { meta: description = "Detects SniffPass, a password monitoring software that listens on the network and captures passwords over POP3, IMAP4, SMTP, FTP, and HTTP." author = "ditekSHen" id = "b96498d4-bbe3-5cb8-9c24-91ebb51e078a" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L197-L212" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "9b56ee4bac39b4220b24e92d00076650ffe84b71a60c0213a84fcf21c6cfe4cf" score = 75 quality = 75 tags = "FILE" strings: $s1 = "\\Release\\SniffPass.pdb" ascii $s2 = "Password Sniffer" fullword wide $s3 = "Software\\NirSoft\\SniffPass" fullword ascii $s4 = "Sniffed PasswordsCFailed to start" wide $s5 = "Pwpcap.dll" fullword ascii $s6 = "nmwifi.exe" fullword ascii $s7 = "NmApi.dll" fullword ascii $s8 = "npptools.dll" fullword ascii condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_INDICATOR_TOOL_Avbypass_Aviator : FILE { meta: description = "Detects AVIator, which is a backdoor generator utility, which uses cryptographic and injection techniques in order to bypass AV detection. This was observed to bypass Win.Trojan.AZorult. This rule works for binaries and memory." author = "ditekSHen" id = "2bddd64e-baca-58cb-ba52-27487cc4ded5" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L214-L240" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "1fb497eec2b0cd4051b5ddd53463f1da511c0a7b72d54a0bc68736a99fdc6143" score = 75 quality = 75 tags = "FILE" strings: $s1 = "msfvenom -p windows/meterpreter" ascii wide $s2 = "payloadBox.Text" ascii wide $s3 = "APCInjectionCheckBox" ascii wide $s4 = "Thread Hijacking (Shellcode Arch: x86, OS Arch: x86)" ascii wide $s5 = "injectExistingApp.Text" ascii wide $s6 = "Stable execution but can be traced by most AVs" ascii wide $s7 = "AV/\\tor" ascii wide $s8 = "AvIator.Properties.Resources" ascii wide $s9 = "Select injection technique" ascii wide $s10 = "threadHijacking_option" ascii wide $pwsh1 = "Convert.ToByte(Payload_Encrypted_Without_delimiterChar[" ascii wide $pwsh2 = "[DllImport(\"kernel32.dll\", SetLastError = true)]" ascii wide $pwsh3 = "IntPtr RtlAdjustPrivilege(" ascii wide $pwsh4 = /InjectShellcode\.(THREADENTRY32|CONTEXT64|WriteProcessMemory\(|CloseHandle\(|CONTEXT_FLAGS|CONTEXT\(\);|Thread32Next\()/ ascii wide $pwsh5 = "= Payload_Encrypted.Split(',');" ascii wide $pwsh6 = "namespace NativePayload_Reverse_tcp" ascii wide $pwsh7 = "byte[] Finall_Payload = Decrypt(KEY, _X_to_Bytes);" ascii wide $pwsh8 = /ConstantsAndExtCalls\.(WriteProcessMemory\(|CreateRemoteThread\()/ ascii wide condition: ( uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or 2 of ( $pwsh* ) ) ) or ( 3 of ( $s* ) or 2 of ( $pwsh* ) ) } rule DITEKSHEN_INDICATOR_TOOL_PWS_Pwdump7 : FILE { meta: description = "Detects Pwdump7 password Dumper" author = "ditekSHen" id = "dc6ff544-b9de-547b-9fa8-7d0b32e9592d" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L242-L254" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f84ab69ecc6837a826dc8726785165b8135edf51a47fb5bbaf19dc589b3032bd" score = 75 quality = 75 tags = "FILE" strings: $s1 = "savedump.dat" fullword ascii $s2 = "Asd -_- _RegEnumKey fail!" fullword ascii $s3 = "\\SAM\\" ascii $s4 = "Unable to dump file %S" fullword ascii $s5 = "NO PASSWORD" ascii condition: ( uint16( 0 ) == 0x5a4d and 4 of them ) or ( all of them ) } rule DITEKSHEN_INDICATOR_TOOL_LTM_Sharpexec : FILE { meta: description = "Detects SharpExec lateral movement tool" author = "ditekSHen" id = "4373a052-9525-5b24-81a4-65cd68afcb6c" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L256-L275" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "17ae5c9f0b22e8ecbbbcbe052e466d00cb7b62cff423688b5138209c52f0698d" score = 75 quality = 73 tags = "FILE" strings: $s1 = "fileUploaded" fullword ascii $s2 = "$7fbad126-e21c-4c4e-a9f0-613fcf585a71" fullword ascii $s3 = "DESKTOP_HOOKCONTROL" fullword ascii $s4 = /WINSTA_(ACCESSCLIPBOARD|WINSTA_ALL_ACCESS)/ fullword ascii $s5 = /NETBIND(ADD|DISABLE|ENABLE|REMOVE)/ fullword ascii $s6 = /SERVICE_(ALL_ACCESS|WIN32_OWN_PROCESS|INTERROGATE)/ fullword ascii $s7 = /(Sharp|PS|smb)Exec/ fullword ascii $s8 = "lpszPassword" fullword ascii $s9 = "lpszDomain" fullword ascii $s10 = "wmiexec" fullword ascii $s11 = "\\C$\\__LegitFile" wide $s12 = "LOGON32_LOGON_NEW_CREDENTIALS" fullword ascii condition: ( uint16( 0 ) == 0x5a4d and 9 of them ) or ( all of them ) } rule DITEKSHEN_INDICATOR_TOOL_PRV_Advancedrun : FILE { meta: description = "Detects NirSoft AdvancedRun privialge escalation tool" author = "ditekSHen" id = "c886951a-7ee9-5d38-a724-3dbba8c6ec31" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L277-L289" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "3f39e8f0629647f44a2f473d7b49a8b6adb1acd62de36420b80e7820e63854bb" score = 75 quality = 75 tags = "FILE" strings: $s1 = "RunAsProcessName" fullword wide $s2 = "Process ID/Name:" fullword wide $s3 = "swinsta.dll" fullword wide $s4 = "User of the selected process0Child of selected process (Using code injection) Specified user name and password" fullword wide $s5 = "\"Current User - Allow UAC Elevation$Current User - Without UAC Elevation#Administrator (Force UAC Elevation)" fullword wide condition: uint16( 0 ) == 0x5a4d and 3 of them } rule DITEKSHEN_INDICATOR_TOOL_PWS_Amady : FILE { meta: description = "Detects password stealer DLL. Dropped by Amadey" author = "ditekSHen" id = "6ee4e25b-bf38-5664-a08f-94e3fa92aa29" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L291-L306" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "409374bec5f58abeb7741b41f0fc7ea1c3fdc7bbc3f0c0628db0e3aac82836d1" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\AppData" fullword ascii $s2 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" ascii $s3 = "\\Mikrotik\\Winbox\\Addresses.cdb" fullword ascii $s4 = "\\HostName" fullword ascii $s5 = "\\Password" fullword ascii $s6 = "SOFTWARE\\RealVNC\\" ascii $s7 = "SOFTWARE\\TightVNC\\" ascii $s8 = "cred.dll" fullword ascii condition: uint16( 0 ) == 0x5a4d and filesize < 400KB and 7 of them } rule DITEKSHEN_INDICATOR_TOOL_SCR_Amady : FILE { meta: description = "Detects screenshot stealer DLL. Dropped by Amadey" author = "ditekSHen" id = "f7660899-ed12-5765-a856-6a1c7bbd8978" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L308-L320" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "9e7ab39976e3219f0c6c3ce5341442343cc4baf30757cd1c9d0c2d3845fdda2f" score = 75 quality = 75 tags = "FILE" strings: $s1 = "User-Agent: Uploador" fullword ascii $s2 = "Content-Disposition: form-data; name=\"data\"; filename=\"" fullword ascii $s3 = "WebUpload" fullword ascii $s4 = "Cannot assign a %s to a %s%List does not allow duplicates ($0%x)%String" wide $s5 = "scr.dll" fullword ascii condition: uint16( 0 ) == 0x5a4d and filesize < 700KB and 4 of them } rule DITEKSHEN_INDICATOR_TOOL_EXP_Eternalblue : FILE { meta: description = "Detects Windows executables containing EternalBlue explitation artifacts" author = "ditekSHen" id = "08173a1e-2e32-5add-864a-d92ffa0a3e44" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L322-L342" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "63e56637118accb8c32c20e52465c027df2dbf83b3b663d316b453ce879572c8" score = 75 quality = 75 tags = "FILE" strings: $ci1 = "CNEFileIO_" ascii wide $ci2 = "coli_" ascii wide $ci3 = "mainWrapper" ascii wide $dp1 = "EXPLOIT_SHELLCODE" ascii wide $dp2 = "ETERNALBLUE_VALIDATE_BACKDOOR" ascii wide $dp3 = "ETERNALBLUE_DOUBLEPULSAR_PRESENT" ascii wide $dp4 = "//service[name='smb']/port" ascii wide $dp5 = /DOUBLEPULSAR_(PROTOCOL_|ARCHITECTURE_|FUNCTION_|DLL_|PROCESS_|COMMAND_|IS_64_BIT)/ $cm1 = "--DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll" ascii wide $cm2 = "--DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll" ascii wide $cm3 = "--DaveProxyPort=0 --NetworkTimeout 30 --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig" ascii wide condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $ci* ) ) or ( 2 of ( $dp* ) ) or ( 1 of ( $dp* ) and 1 of ( $ci* ) ) or ( 1 of ( $cm* ) ) } rule DITEKSHEN_INDICATOR_TOOL_EXP_Weblogic : FILE { meta: description = "Detects Windows executables containing Weblogic exploits commands" author = "ditekSHen" id = "e761a968-35cb-5284-99f2-6d516ad348e3" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L344-L353" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "01855f1125b0ba87dd40f7d460440dbda2d75c8b484e842a2b2e20c089b4ab5e" score = 75 quality = 75 tags = "FILE" strings: $s1 = "certutil.exe -urlcache -split -f AAAAA BBBBB & cmd.exe /c BBBBB" ascii $s2 = "powershell (new-object System.Net.WebClient).DownloadFile('AAAAA','BBBBB')" ascii condition: uint16( 0 ) == 0x5a4d and 1 of them } rule DITEKSHEN_INDICATOR_TOOL_SCN_Smbtouch : FILE { meta: description = "Detects SMBTouch scanner EternalBlue, EternalChampion, EternalRomance, EternalSynergy" author = "ditekSHen" id = "4e8176dd-4113-5fa8-a695-77e7169f6975" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L376-L400" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "78c2a435762d3febe927eb15910d5a18c1ffe74604673463543d3c859f5ef8e9" score = 75 quality = 75 tags = "FILE" strings: $s1 = "[+] SMB Touch started" fullword ascii $s2 = "[-] Could not connect to share (0x%08X - %s)" fullword ascii $s3 = "[!] Target could be either SP%d or SP%d," fullword ascii $s4 = "[!] for these SMB exploits they are equivalent" fullword ascii $s5 = "[+] Target is vulnerable to %d exploit%s" fullword ascii $s6 = "[+] Touch completed successfully" fullword ascii $s7 = "Network error while determining exploitability" fullword ascii $s8 = "Named pipe or share required for exploit" fullword ascii $w1 = "UsingNbt" fullword ascii $w2 = "TargetPort" fullword ascii $w3 = "TargetIp" fullword ascii $w4 = "RedirectedTargetPort" fullword ascii $w5 = "RedirectedTargetIp" fullword ascii $w6 = "NtlmHash" fullword ascii $w7 = "\\PIPE\\LANMAN" fullword ascii $w8 = "UserRejected: " fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $s* ) or all of ( $w* ) ) } rule DITEKSHEN_INDICATOR_TOOL_SCN_Nbtscan : FILE { meta: description = "Detects NBTScan scanner for open NETBIOS nameservers on a local or remote TCP/IP network" author = "ditekSHen" id = "663c324e-4784-5efe-bbdf-60fa42e13944" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L402-L420" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "a81b95ad60aac4d66586ae7dc61f6bcbe2b7185b66b2bb895f45abff3ad3f430" score = 75 quality = 75 tags = "FILE" strings: $s1 = "[%s] is an invalid target (bad IP/hostname)" fullword ascii $s2 = "ERROR: no parse for %s -- %s" fullword ascii $s3 = "add_target failed" fullword ascii $s4 = " -p <n> bind to UDP Port <n> (default=%d)" fullword ascii $s5 = "process_response.c" fullword ascii $s6 = "currTarget != 0" fullword ascii $s7 = "parse_target.c" fullword ascii $s8 = "dump_packet.c" fullword ascii $s9 = "parse_target_cb.c" fullword ascii $s10 = "DUMP OF PACKET" fullword ascii $s11 = "lookup_hostname.c" fullword ascii condition: uint16( 0 ) == 0x5a4d and 10 of ( $s* ) } rule DITEKSHEN_INDICATOR_TOOL_PWS_Keychaindumper : FILE { meta: description = "Detects macOS certificate/password keychain dumping tool" author = "ditekSHen" id = "cec094fa-c651-58a6-a306-f16d8603e536" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L473-L484" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f606bdd5dba2180ffc552c46373b52801a0bd65a538b381fb9f4240efc5bd458" score = 75 quality = 71 tags = "FILE" clamav_sig = "INDICATOR_Osx.Tool.PWS.KeychainDumper" strings: $s1 = "_getEmptyKeychainItemString" fullword ascii $s2 = "NdumpKeychainEntitlements" fullword ascii $s3 = "_dumpKeychainEntitlements" fullword ascii condition: ( uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf ) and all of them } rule DITEKSHEN_INDICATOR_TOOL_PET_P0Wnedshell : FILE { meta: description = "Detects compiled executables of p0wnedShell post-exploitation toolkit" author = "ditekSHen" id = "7df8f9b4-48d3-5271-9d60-5dd4bfaed316" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L486-L512" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "9745b69573bf695fdada122143fb1889a7b2025250b5fb1e8f1a86b3be6f27d3" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Use WinRM, PsExec, SMB/WMI to execute commands on remote systems" wide $s2 = "-CreateProcess \"cmd.exe\" -Username \"nt authority\\system\"" wide $s3 = "-Command '\"lsadump::dcsync /user:" wide $s4 = "-Payload windows/meterpreter/reverse_https -Lhost" wide $s5 = "Get-Content ./EncodedPayload.bat" fullword wide $e1 = "OnYNAB+LCAAAAAAABAC8vOeS60iSLvh75yly+rZZVxuqC4KQs3uvLQhFEJIACALoHVuD1oKQBMbuuy+Y4pw8dUTf3R+bZlWVZHh87uHh4vPItv63ZGrCMW+bF7GZ2zL+" wide $e2 = "kuIeAB+LCAAAAAAABADsvWt327iuMPw9v0Jv27Wa7DqJc2ma5nl71vZFTpzx/ZJL+3TlyLZiq7EtjyTHcffZ//0BSEqiKEqWbKczs8941qS2LgAIAiAIguDjfNp3DHOq" wide $e3 = "mZYIAB+LCAAAAAAABADsvflj2zyOMPx7/gptmnftbBIfuZp0t/OOfMZp7PjO0adfX9lSbCWy5Vp2HGfm+d8/ACQl6vCRNp2Z3bVmnioWSRAEQQAESfC/Pmwp8FTtmTFu" wide $e4 = "u9YGAB+LCAAAAAAABADsvW1D40ayKPw9v0Lr4V7ZE8vY5mUY9rKJBzMTnmWAgyGTvYTlCluAdmzJK9nDsEn++1NV/S61ZJmXZJIN52wG7O7q6urq6qrqquoXSfDveZgE" wide $e5 = "T3gDAB+LCAAAAAAABADtvX1f2zq2KPz3yafQzuZcwi5JEydQ2nM7v4cCnc0zQLmE7j3z6+7NmMQBnwY7YzsFTqff/WpJsi3Jki07DlA2mT008ctaS0tL601L0nThjSPX" wide $e6 = "zRgDAB+LCAAAAAAABADtfW1327jR6OdHv4Kr9TmWdiVZkl+SdZs913Gcrm9tx7WcbvekuS4t0TYbiVRJKYmfbf77xeCNeCVBinKcbNStI5HAYDAYDAaDwczNMhovwjjy" wide $e7 = "pxICAB+LCAAAAAAABADtvf17GkeyKPyz+Cvmlfw+ggRhfcXr1X1znsUIx5yVhC7IUbI+fnUHGKRZwww7M1jWyeZ/v1XV3z09wABysnviZ1cBpqe6urqquqq6uno8j4ZZ" wide $e8 = "H4sIAAAAAAAEANy9e3wTVfo4PG1SmkLbCdpgFdSgUeuCbLTAthYk005gQhNahUIVkCqIqKi1TaAuIGBaJRzG27Kuul5wV3fV1fUuUFxNKbTl3oJAuaiouE4paAGBFpB5" wide $k1 = "EasySystemPPID" fullword ascii $k2 = "EasySystemShell" fullword ascii $k3 = "LatMovement" fullword ascii $k4 = "ListenerURL" fullword ascii $k5 = "MeterStager" fullword ascii $k6 = "PatchEventLog" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or 7 of ( $e* ) or all of ( $k* ) or ( 2 of ( $s* ) and 2 of ( $e* ) and 2 of ( $k* ) ) ) } rule DITEKSHEN_INDICATOR_TOOL_PWS_Rubeus : FILE { meta: description = "Detects Rubeus kerberos defensive/offensive toolset" author = "ditekSHen" id = "5af8cee0-e664-5dfe-9932-0e74ed41b6b4" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L514-L531" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ee817d23427970d7e77f9ce2a7cbc25c77177d81354fed83e7551cdcbc2d7cd2" score = 75 quality = 75 tags = "FILE" strings: $s1 = "(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" fullword wide $s2 = "(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))" fullword wide $s3 = "rc4opsec" fullword wide $s4 = "pwdlastset" fullword wide $s5 = "LsaEnumerateLogonSessions" fullword ascii $s6 = "extractKerberoastHash" fullword ascii $s7 = "ComputeAllKerberosPasswordHashes" fullword ascii $s8 = "kerberoastDomain" fullword ascii $s9 = "GetUsernamePasswordTGT" fullword ascii $s10 = "WriteUserPasswordToFile" fullword ascii condition: uint16( 0 ) == 0x5a4d and 8 of them } rule DITEKSHEN_INDICATOR_TOOL_UAC_NSISUAC : FILE { meta: description = "Detects NSIS UAC plugin" author = "ditekSHen" id = "4a7c20f6-bf0e-55fb-a0b9-7b51e4af7cd3" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L575-L587" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "48c0247c789328a0ff62816f5d6ecac7a0f2a3fe2cb95d99c0e7d988147f7137" score = 75 quality = 75 tags = "FILE" strings: $s1 = "HideCurrUserOpt" fullword wide $s2 = "/UAC:%X /NCRC%s" fullword wide $s3 = "2MyRunAsStrings" fullword wide $s4 = "CheckElevationEnabled" fullword ascii $s5 = "UAC.dll" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_INDICATOR_TOOL_REM_Intelliadmin : FILE { meta: description = "Detects commerical IntelliAdmin remote tool" author = "ditekSHen" id = "15385e0b-ead4-5614-a04e-55878eb70b34" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L589-L602" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "8b601d68eff65bc6cc2fb46630a7021e229764f9a80f6d3278ba3b9f55e5b114" score = 75 quality = 75 tags = "FILE" strings: $pdb1 = "\\Network Administrator" ascii $pdb2 = "\\Binaries\\Plugins\\Tools\\RPCService.pdb" ascii $s1 = "CIntelliAdminRPC" fullword wide $s2 = "IntelliAdmin RPC Service" fullword wide $s3 = "IntelliAdmin Remote Execute v" ascii $s4 = "IntelliAdminRPC" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $pdb* ) or 2 of ( $s* ) ) } rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpwmi : FILE { meta: description = "Detects SharpWMI" author = "ditekSHen" id = "9c58d9fa-04b8-5a9c-8ae9-ff2e7530772f" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L604-L619" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e6c5764d0883e2882e06f07e4729362011a4d65614259b85978e1c6ef5cfadb7" score = 75 quality = 73 tags = "FILE" strings: $s1 = "scriptKillTimeout" fullword ascii $s2 = "RemoteWMIExecuteWithOutput" fullword ascii $s3 = "RemoteWMIFirewall" fullword ascii $s4 = "iex([char[]](@({0})|%{{$_-bxor{1}}}) -join '')" fullword wide $s5 = "\\\\{0}\\root\\subscription" fullword wide $s6 = "_Context##RANDOM##" fullword wide $s7 = "executevbs" fullword wide $s8 = "scriptb64" fullword wide condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_INDICATOR_TOOL_PET_Defendercontrol : FILE { meta: description = "Detects Defender Control" author = "ditekSHen" id = "7bc1f26e-2432-5642-b1e7-c87683f7d932" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L621-L631" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "826ed0643a07580750eb11c4cf2c2759f53b6c2bda51705476edc4808abccbf8" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Windows Defender Control" wide $s2 = "www.sordum.org" wide ascii $s3 = "dControl" wide condition: uint16( 0 ) == 0x5a4d and 2 of them } rule DITEKSHEN_INDICATOR_TOOL_PET_Mulit_Venomagent : FILE { meta: description = "Detects Venom Proxy Agent" author = "ditekSHen" id = "598bc773-cbe9-503b-ba3e-27c2cde8910d" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L633-L645" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "5eda23a237404a44dc9eb057adbf6106166374168eb08e55c182da5c05ecb4f1" score = 75 quality = 75 tags = "FILE" strings: $s1 = "github.com/Dliv3/Venom/" ascii $s2 = "3HpKQVB3nT3qaNQPT-ZU/SKJ55ofz5TEmg5O3ROWA/CUs_-gfa04tGVO633Z4G/OSeEpRRb0Sq_5R6ArIi-" ascii $s3 = "venom_agent -" ascii $s4 = "bufferssh-userauthtransmitfileunknown portwirep: p->m= != sweepgen" ascii $s5 = "golang.org/x/crypto/ssh.(*handshakeTransport).readPacket" condition: ( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf ) and 3 of them } rule DITEKSHEN_INDICATOR_TOOL_HFS_Webserver : FILE { meta: description = "Detects HFS Web Server" author = "ditekSHen" id = "2c9d9a38-8a6c-5c53-84bc-4eef77933172" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L647-L658" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f5b8947e3858466dae5f476790842500f8184c4676d8c0c4870adb7fd3206652" score = 75 quality = 75 tags = "FILE" strings: $s1 = "SOFTWARE\\Borland\\Delphi\\" ascii $s2 = "C:\\code\\mine\\hfs\\scriptLib.pas" fullword ascii $s3 = "hfs.*;*.htm*;descript.ion;*.comment;*.md5;*.corrupted;*.lnk" ascii $s4 = "Server: HFS" ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_INDICATOR_TOOL_PROX_Lanproxy : FILE { meta: description = "Detects lanproxy-go-client" author = "ditekSHen" id = "71fc23d9-9aae-5666-832b-90cf5a86c474" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L660-L675" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "13a5aaea0fb522e3badb4a60d2db8d7dd46e5721bd6dc2e2b2e29d49e197c375" score = 75 quality = 75 tags = "FILE" strings: $s1 = "serverShare" fullword ascii $s2 = "parkingOnChan" fullword ascii $s3 = "{{join .Names \", \"}}{{\"\\t\"}}{{.Usage}}{{end}}{{end}}{{end}}{{end}}{{" ascii $s4 = "</table></thead></tbody>" fullword ascii $s5 = "value=aacute;abreve;addressagrave;alt -> andand;angmsd;angsph;any -> apacir;approx;articleatilde;barvee;barwed;bdoUxXvbecaus;ber" ascii $s6 = "/dev/urandom127.0.0.1:" ascii $s7 = "non-IPv4 addressnon-IPv6 addressntrianglelefteq;object is remotepacer: H_m_prev=reflect mismatchregexp: Compile(remote I/O error" ascii $s8 = ".WithDeadline(.in-addr.arpa." ascii condition: ( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and 6 of them } rule DITEKSHEN_INDICATOR_TOOL_PET_Peirates : FILE { meta: description = "Detects Kubernetes penetration tool Peirates" author = "ditekSHen" id = "74ce83ed-0d93-5cb0-97e8-6885ae83b336" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L677-L694" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "321f06af098283638f99d027dc3c95a25a72192a25c7afa5081a7dbff8c3acb7" score = 75 quality = 75 tags = "FILE" strings: $s1 = "DeprecatedServiceAccount" fullword ascii $s2 = "LivenessProbe" fullword ascii $s3 = "\\t\\tkubectl expose rs nginx --port=80 --target-port=8000" ascii $s4 = "\\t\\tkubectl run hazelcast --image=hazelcast --port=5701" ascii $s5 = "COMPREPLY[$i]=${COMPREPLY[$i]#\"$colon_word\"}" ascii $s6 = "%*polymorphichelpers.HistoryViewerFunc" ascii $s7 = "ListenAndServeTLS" ascii $s8 = "DownwardAPI" ascii $s9 = "; plural=(n%10==1 && n%100!=11 ? 0 : n != 0 ? 1 : 2);proto:" ascii $s10 = "name: attack-" ascii condition: uint16( 0 ) == 0x457f and 9 of them } rule DITEKSHEN_INDICATOR_TOOL_PET_Botb : FILE { meta: description = "Detects Break out the Box (BOtB)" author = "ditekSHen" id = "acafa6dd-51b9-5945-b1df-7763a97a424f" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L696-L710" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "a01f796b27852f9217d9bfea32f8d9ffb3c88521d4413f6612f7a0544cf44fb3" score = 75 quality = 75 tags = "FILE" strings: $s1 = "to unallocated span%%!%c(*big.Float=%s), RecursionDesired: /usr/share/zoneinfo//{Bucket}/{Key+}?acl/{Bucket}?accelerate/{Bucket}?encryption/{Bucket}?" ascii $s2 = "exploit CVE-2019-5736 with command: [ERROR] In Enabling CGROUP Notifications -> 'echo 1 > [INFO] CGROUP may exist, attempting exploit regardless" ascii $s3 = "main.execShellCmd" ascii $s4 = "[*] Data uploaded to:[+]" ascii $s5 = "whitespace or line breakfailed to find credentials in the environment.failed to get %s EC2 instance role credentialsfirst" ascii $s6 = "This process will exit IF an EXECVE is called in the Container or if the Container is manually stoppedPerform reverse DNS lookups" ascii $s7 = "http: request too largehttp://100.100.100.200/http://169.254.169.254/index out of range" ascii condition: uint16( 0 ) == 0x457f and 6 of them } rule DITEKSHEN_INDICATOR_TOOL_PWS_LSASS_Createminidump : FILE { meta: description = "Detects CreateMiniDump tool" author = "ditekSHen" id = "0d8642d1-2ed9-5270-a54a-6ba788026f5f" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L712-L724" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "577ccc783554363c0bed80d9642e8a0f107fc2ec66d84f76b9556aa3506c86c0" score = 75 quality = 75 tags = "FILE" strings: $s1 = "lsass.dmp" fullword wide $s2 = "lsass dumped successfully!" ascii $s3 = "Got lsass.exe PID:" ascii $s4 = "\\experiments\\CreateMiniDump\\CreateMiniDump\\" ascii $s5 = "MiniDumpWriteDump" fullword ascii condition: uint16( 0 ) == 0x5a4d and 2 of them } rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Browserpassworddumper : FILE { meta: description = "Detects SecurityXploded Browser Password Dumper tool" author = "ditekSHen" id = "ce90ef96-43c0-5d68-ba7d-21aafb3f754b" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L726-L737" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b3c6e9b393c244c7bf6489f54ebd622a09da050a65d6dbde325d5bcd7d85f39a" score = 75 quality = 75 tags = "FILE" strings: $s1 = "\\projects\\windows\\BrowserPasswordDump\\Release\\FireMaster.pdb" ascii $s2 = "%s: Dumping passwords" fullword ascii $s3 = "%s - Found login data file...dumping the passwords from file %s" fullword ascii $s4 = "%s Dumping secrets from login json file %s" fullword ascii condition: uint16( 0 ) == 0x5a4d and 3 of them } rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Ftppassworddumper : FILE { meta: description = "Detects SecurityXploded FTP Password Dumper tool" author = "ditekSHen" id = "d876c201-b527-531c-9563-0b1a1c6334cb" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L739-L750" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "941bfb9b1ce71252c5aa05bd654bdcf1af6cc1d5f720bc2c239e17454f15beda" score = 75 quality = 75 tags = "FILE" strings: $s1 = "\\projects\\windows\\FTPPasswordDump\\Release\\FireMaster.pdb" ascii $s2 = "//Dump all the FTP passwords to a file \"c:\\passlist.txt\"" ascii $s3 = "//Dump all the FTP passwords to console" ascii $s4 = "FTP Password Dump" fullword wide condition: uint16( 0 ) == 0x5a4d and 3 of them } rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Emailpassworddumper : FILE { meta: description = "Detects SecurityXploded Email Password Dumper tool" author = "ditekSHen" id = "25e140de-4a0a-5d4f-a93f-a414b9879f2b" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L752-L764" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "7f07611385d45bf45bfb8ee95e56febfb992fb7b416321c5b590878636a5c1b7" score = 75 quality = 75 tags = "FILE" strings: $s1 = "\\projects\\windows\\EmailPasswordDump\\Release\\FireMaster.pdb" ascii $s2 = "//Dump all the Email passwords to a file \"c:\\passlist.txt\"" ascii $s3 = "EmailPasswordDump" fullword wide $s4 = "//Dump all the Email passwords to console" ascii $s5 = "Email Password Dump" fullword wide condition: uint16( 0 ) == 0x5a4d and 3 of them } rule DITEKSHEN_INDICATOR_TOOL_Goclr : FILE { meta: description = "Detects binaries utilizing Go-CLR for hosting the CLR in a Go process and using it to execute a DLL from disk or an assembly from memory" author = "ditekSHen" id = "21766cad-17dd-525a-9ebe-cd90e892cff1" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L800-L814" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "a2a79793b1f530bcf9f79983f29a655f270cf0147606690b19eaeb82d4bd1f0d" score = 75 quality = 75 tags = "FILE" strings: $s1 = "github.com/ropnop/go-clr.(*IC" ascii $s2 = "EnumKeyExWRegEnumValueWRegOpenKeyExWRtlCopyMemoryRtlGetVersionShellExecuteWStartServiceW" ascii $c1 = "ICorRuntimeHost" ascii wide $c2 = "CLRCreateInstance" ascii wide $c3 = "ICLRRuntimeInfo" ascii wide $c4 = "ICLRMetaHost" ascii wide $go = "Go build ID:" ascii wide condition: uint16( 0 ) == 0x5a4d and all of ( $s* ) or ( 2 of ( $c* ) and $go ) } rule DITEKSHEN_INDICATOR_TOOL_Edgecookiesview : FILE { meta: description = "Detects EdgeCookiesView" author = "ditekSHen" id = "42c6eb2e-bf5c-5956-9009-c29551ce715d" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L833-L847" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "9ba6d416e02c1958806356c67636609dcca758da9f7e3d1fc15244cc5ff038fc" score = 75 quality = 75 tags = "FILE" strings: $s1 = "AddRemarkCookiesTXT" fullword wide $s2 = "# Netscape HTTP Cookie File" fullword wide $s3 = "/scookiestxt" fullword wide $s4 = "/deleteregkey" fullword wide $s5 = "Load cookies from:" wide $s6 = "Old cookies folder of Edge/IE" wide $pdb = "\\EdgeCookiesView\\Release\\EdgeCookiesView.pdb" ascii condition: uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or ( ( $pdb ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_INDICATOR_TOOL_Sharpnopsexec : FILE { meta: description = "Detects SharpNoPSExec" author = "ditekSHen" id = "10898364-6d77-5127-a16b-5fd3b1c652d5" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L849-L864" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c1d76639e7b6464d302729b48bbcd810216132868035904bb9866e7b31ccfac2" score = 75 quality = 75 tags = "FILE" strings: $s1 = "|-> Service" wide $s2 = "authenticated as" wide $s3 = "ImpersonateLoggedOnUser failed. Error:{0}" wide $s4 = "uPayload" fullword ascii $s5 = "pcbBytesNeeded" fullword ascii $s6 = "SharpNoPSExec" ascii wide $pdb1 = "SharpNoPSExec\\obj\\Debug\\SharpNoPSExec.pdb" ascii $pdb2 = "SharpNoPSExec\\obj\\Release\\SharpNoPSExec.pdb" ascii condition: uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( 1 of ( $pdb* ) and 1 of ( $s* ) ) ) } rule DITEKSHEN_INDICATOR_TOOL_Chromecookiesview : FILE { meta: description = "Detects ChromeCookiesView" author = "ditekSHen" id = "c1b89468-edf2-59d1-89b3-5822fa19d6ab" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L866-L880" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "81acd0978fc03525e7092ab51c681b61f9de0252066ce871298e2cd96b1d3024" score = 75 quality = 75 tags = "FILE" strings: $s1 = "AddRemarkCookiesTXT" fullword wide $s2 = "Decrypt cookies" wide $s3 = "/scookiestxt" fullword wide $s4 = "/deleteregkey" fullword wide $s5 = "Cookies.txt Format" wide $s6 = "# Netscape HTTP Cookie File" wide $pdb = "\\ChromeCookiesView\\Release\\ChromeCookiesView.pdb" ascii condition: uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or ( ( $pdb ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_INDICATOR_TOOL_Sliver : FILE { meta: description = "Detects Sliver implant cross-platform adversary emulation/red team" author = "ditekSHen" id = "e0c5404b-8e6b-5c3a-9e37-56012c3802dd" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L882-L900" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "4f9442b74c84c7b4a8fcf93de2919d12efe2f41d0b4e8514b43822fba0962af2" score = 75 quality = 75 tags = "FILE" strings: $x1 = "github.com/bishopfox/sliver/protobuf/sliverpbb." ascii $s1 = ".commonpb.ResponseR" ascii $s2 = ".PortfwdProtocol" ascii $s3 = ".WGTCPForwarder" ascii $s4 = ".WGSocksServerR" ascii $s5 = ".PivotEntryR" ascii $s6 = ".BackdoorReq" ascii $s7 = ".ProcessDumpReq" ascii $s8 = ".InvokeSpawnDllReq" ascii $s9 = ".SpawnDll" ascii $s10 = ".TCPPivotReq" ascii condition: ( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf ) and ( 1 of ( $x* ) or 5 of ( $s* ) ) } rule DITEKSHEN_INDICATOR_TOOL_Backstab : FILE { meta: description = "Detect Backstab tool capable of killing antimalware protected processes by leveraging sysinternals Process Explorer (ProcExp) driver" author = "ditekSHen" id = "1e514d03-9b78-5e75-9a31-02c0413e23a7" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L923-L939" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "d25c3ff4d7c120fdf7c275d11da7a321bcbdb275dcfaa699b5bb4bd66167ec92" score = 75 quality = 75 tags = "FILE" strings: $s1 = "NtLoadDriver: %x" fullword ascii $s2 = "POSIXLY_CORRECT" fullword ascii $s3 = "\\\\.\\PROCEXP" ascii $s4 = "ProcExpOpenProtectedProcess.DeviceIoControl: %" ascii $s5 = "ProcExpKillHandle.DeviceIoControl" ascii $s6 = "[%#llu] [%ws]: %ws" fullword ascii $s7 = "D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GR" wide $s8 = "-k -d c:\\\\driver.sys" ascii $s9 = "backstab.exe -" ascii condition: uint16( 0 ) == 0x5a4d and 6 of them } rule DITEKSHEN_INDICATOR_TOOL_EXP_Sharpprintnightmare : FILE { meta: description = "Detect SharpPrintNightmare" author = "ditekSHen" id = "15f52fce-27cc-52e7-91d5-7e2f6db5b596" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L941-L961" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "22c890a22ce6b7c1a06068018364f7c5a2afe1bee5b5bc6a8bae3703a11fac26" score = 75 quality = 75 tags = "FILE" strings: $s1 = "RevertToSelf() Error:" wide $s2 = "NeverGonnaGiveYou" wide $s3 = "\\Amd64\\UNIDRV.DLL" wide $s4 = ":\\Windows\\System32\\DriverStore\\FileRepository\\" wide $s5 = "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\old\\{0}\\{1}" wide $s6 = "\\SharpPrintNightmare\\" ascii $s7 = { 4e 61 6d 65 09 46 75 6c 6c 54 72 75 73 74 01 } $s8 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\PackageInstallation\\Windows x64\\DriverPackages" wide $s9 = "ntprint.inf_amd64" wide $s10 = "AddPrinterDriverEx" wide $s11 = "addPrinter" ascii $s12 = "DRIVER_INFO_2" ascii $s13 = "APD_COPY_" ascii condition: uint16( 0 ) == 0x5a4d and 7 of them } rule DITEKSHEN_INDICATOR_TOOL_REC_Adfind : FILE { meta: description = "Detect ADFind" author = "ditekSHen" id = "2f0d02a1-7488-5645-aa08-1eadee2862e8" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L963-L974" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "41fb9f72032f76adc6f1fccd25a1364f153eb2430063e9d582f3dcd9fc9ac84a" score = 75 quality = 75 tags = "FILE" strings: $s1 = "\\AdFind\\AdFind\\AdFind.h" ascii $s2 = "\\AdFind\\AdFind\\AdFind.cpp" ascii $s3 = "\\AdFind\\Release\\AdFind.pdb" ascii $s4 = "joeware_default_adfind.cf" ascii condition: uint16( 0 ) == 0x5a4d and 2 of them } rule DITEKSHEN_INDICATOR_TOOL_CNC_Chisel : FILE { meta: description = "Detect binaries using Chisel" author = "ditekSHen" id = "d126f2c8-655f-564f-ae46-f6bd6385dcac" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L976-L990" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "08c7b2c4725431c1bf85ae8068f4250c98e58890e3b4c97aa9e419e4f487cada" score = 75 quality = 75 tags = "FILE" strings: $s1 = "chisel-v" ascii $s2 = "sendchisel-v" ascii $s3 = "<-chiselclosedcookiedomainefenceempty" ascii $ws1 = "Sec-WebSocket-Key" ascii $ws2 = "Sec-WebSocket-Protocol" ascii $ws3 = "Sec-Websocket-Version" ascii $ws4 = "Sec-Websocket-Extensions" ascii condition: uint16( 0 ) == 0x5a4d and ( 1 of ( $s* ) and 3 of ( $ws* ) ) } rule DITEKSHEN_INDICATOR_TOOL_ANT_Invizzzible : FILE { meta: description = "Detect InviZzzible" author = "ditekSHen" id = "23533d1c-e0d8-51c8-ac18-60c845bff197" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1025-L1059" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "bd84015f9fdc160a6ed9010c5a5905fcf13987b1fdec6fdd9535e315dc3617e8" score = 75 quality = 73 tags = "FILE" strings: $s1 = "\\\\.\\pipe\\task_sched_se" fullword wide $s2 = "\\\\\\.\\NPF_NdisWanIp" fullword wide $s3 = /--action --(dtt|mra|user-input|cfg|dan|evt|pid|exc|wmi|tsh)/ fullword wide $s4 = "cuckoo_%lu.ini" fullword wide $s5 = "sandbox evasion" wide nocase $s6 = "UnbalancedStack" fullword ascii $s7 = "process_with_long_name" fullword ascii $s8 = "DelaysAccumulation" fullword ascii $s9 = "PidReuse" fullword ascii $s10 = "DeadAnalyzer" fullword ascii $s11 = "SleepDummyPatch" fullword ascii $s12 = "AudioDeviceAbsence" fullword ascii $s14 = "\\\\.\\PhysicalDrive%u" fullword ascii $s15 = "\"countermeasures\":" ascii $s16 = "_%.02u%.02u%.02u_%.02u%.02u%.02u.html" ascii $f1 = ".?AVHyperV@SandboxEvasion@@" ascii $f2 = ".?AVJoebox@SandboxEvasion@@" ascii $f3 = ".?AVKVM@SandboxEvasion@@" ascii $f4 = ".?AVMisc@SandboxEvasion@@" ascii $f5 = ".?AVParallels@SandboxEvasion@@" ascii $f6 = ".?AVQEMU@SandboxEvasion@@" ascii $f7 = ".?AVSandboxie@SandboxEvasion@@" ascii $f8 = ".?AVVBOX@SandboxEvasion@@" ascii $f9 = ".?AVVirtualPC@SandboxEvasion@@" ascii $f10 = ".?AVVMWare@SandboxEvasion@@" ascii $f11 = ".?AVWine@SandboxEvasion@@" ascii $f12 = ".?AVXen@SandboxEvasion@@" ascii condition: uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or 4 of ( $f* ) or ( 2 of ( $f* ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_INDICATOR_TOOL_EXFIL_Sharpbox : FILE { meta: description = "Detect SharpBox, C# tool for compressing, encrypting, and exfiltrating data to Dropbox using the Dropbox API" author = "ditekSHen" id = "cd834fe2-dc77-509d-a8f9-d631f395bcd8" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1061-L1080" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b03ab3786b2a2e6774d94be4edf700a7154d8d400c7b2b31c73c68ce9fe0c08a" score = 75 quality = 75 tags = "FILE" strings: $s1 = "UploadData" fullword ascii $s2 = "isAttached" fullword ascii $s3 = "DecryptFile" fullword ascii $s4 = "set_dbxPath" fullword ascii $s5 = "set_dbxToken" fullword ascii $s6 = "set_decrypt" fullword ascii $s7 = "GeneratePass" fullword ascii $s8 = "FileUploadToDropbox" fullword ascii $s9 = "\\SharpBox.pdb" ascii $s10 = "https://content.dropboxapi.com/2/files/upload" fullword wide $s12 = "Dropbox-API-Arg: {\"path\":" wide $s13 = "X509Certificate [{0}] Policy Error: '{1}'" fullword wide condition: uint16( 0 ) == 0x5a4d and 7 of them } rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpstrike : FILE { meta: description = "Detect SharpStrike post-exploitation tool written in C# that uses either CIM or WMI to query remote systems" author = "ditekSHen" id = "00b36fce-3d84-51cf-a800-042d7484d78c" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1145-L1160" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c479d85878d9f9659fc157f0c6706703af3748a8740df6a5090cddc720dd7661" score = 75 quality = 75 tags = "FILE" strings: $x1 = "SharpStrike v" wide $x2 = "[*] Agent is busy" wide $x3 = "SharpStrike_Fody" fullword ascii $s1 = "ServiceLayer.CIM" fullword ascii $s2 = "Models.CIM" fullword ascii $s3 = "<HandleCommand>b__" ascii $s4 = "MemoryStream" fullword ascii $s5 = "GetCommands" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or all of ( $s* ) ) } rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladon : FILE { meta: description = "Detect Ladon tool that assists in lateral movement across a network" author = "ditekSHen" id = "227e63ce-8383-5bb1-870e-6c4e767b402f" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1162-L1178" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f31276bcbcae672966cfddc9af4f5b507d7244360b421de7fe1e811fb954fb7d" score = 75 quality = 75 tags = "FILE" strings: $d1 = "Ladon.VncSharp.dll" fullword ascii $d2 = "Ladon.Renci.SshNet.dll" fullword ascii $s1 = "Ladon." ascii $s2 = "nowPos" fullword ascii $s3 = "Scan" fullword ascii $s4 = "QLZ_STREAMING_BUFFER" fullword ascii $s5 = "sizeDecompressed" fullword ascii $s6 = "UpdateByte" fullword ascii $s7 = "kNumBitPriceShiftBits" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $d* ) or all of ( $s* ) or ( 1 of ( $d* ) and 5 of ( $s* ) ) ) } rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladonexp : FILE { meta: description = "Detect Ladon tool that assists in lateral movement across a network" author = "ditekSHen" id = "bd1e7ef5-ae68-5e0d-8261-0eb765453bae" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1180-L1191" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "22f6a717b8464bddd850bb5ea8b416e99bceb91fe917f188be178f2fff620730" score = 75 quality = 75 tags = "FILE" strings: $s1 = "txt_cscandll.Text" fullword wide $s2 = "CscanWebExpBuild.frmMain.resources" fullword ascii $s3 = "= \"$HttpXforwardedFor$\";" ascii $s4 = "namespace netscan" fullword ascii condition: uint16( 0 ) == 0x5a4d and 3 of them } rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladongo : FILE { meta: description = "Detect LadonGo tool that assists in lateral movement across a network" author = "ditekSHen" id = "4dbf7f24-b9ab-5629-8e78-667d9623dea9" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1193-L1207" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "606172b8fb251cb4ad75de40b55d74779aef6409832f6edf09068083143ec749" score = 75 quality = 75 tags = "FILE" strings: $f1 = "main.VulDetection" fullword ascii $f2 = "main.BruteFor" fullword ascii $f3 = "main.RemoteExec" fullword ascii $f4 = "main.Exploit" fullword ascii $f5 = "main.Noping" fullword ascii $f6 = "main.LadonScan" fullword ascii $f7 = "main.LadonUrlScan" fullword ascii condition: ( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xface ) and 5 of ( $f* ) } rule DITEKSHEN_INDICATOR_TOOL_ENC_Diskcryptor : FILE { meta: description = "Detect DiskCryptor open encryption solution that offers encryption of all disk partitions" author = "ditekSHen" id = "22b25d5c-d67f-53ac-9ae8-2de077afdda9" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1209-L1232" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "7ef0bf3b11f7e4055908518ce5b6a49e04d7002ebc3396fd2da32b4e13cf68e0" score = 75 quality = 75 tags = "FILE" strings: $x1 = "\\DiskCryptor\\DCrypt\\" ascii $s1 = "Error getting %sbootloader configuration" fullword wide $s2 = "loader.iso" fullword wide $s3 = "Bootloader config for [%s]" fullword wide $s4 = "dc_get_mbr_config" fullword ascii $s5 = "dc_encrypt_iso_image" fullword ascii $s6 = "dc_start_re_encrypt" fullword ascii $s7 = "dc_start_encrypt" fullword ascii $s8 = "_w10_reflect_" ascii $d1 = "\\DosDevices\\dcrypt" fullword wide $d2 = "$dcsys$_fail_%x" fullword wide $d3 = "%s\\$DC_TRIM_%x$" fullword wide $d4 = "\\Device\\dcrypt" fullword wide $d5 = "%s\\$dcsys$" fullword wide condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or 4 of ( $s* ) or 3 of ( $d* ) ) } rule DITEKSHEN_INDICATOR_TOOL_PRI_Juicypotato : FILE { meta: description = "Detect JuicyPotato" author = "ditekSHen" id = "2fb52598-9771-507b-a06d-7b9bc693ffee" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1255-L1270" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "43a7ac16b9633fd2e6c43ca142cd0d0e2166287bb51e1b6344119959fe054c19" score = 75 quality = 75 tags = "FILE" strings: $x1 = "\\JuicyPotato.pdb" ascii $x2 = "JuicyPotato v%s" fullword ascii $s1 = "hello.stg" fullword wide $s2 = "ppVirtualProcessorRoots" fullword ascii $s3 = "Lock already taken" fullword ascii $s4 = "[+] authresult %d" fullword ascii $s5 = "RPC -> send failed with error: %d" fullword ascii $s6 = "Priv Adjust FALSE" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) or ( 5 of ( $s* ) ) ) } rule DITEKSHEN_INDICATOR_TOOL_ENUM_Sharpshares : FILE { meta: description = "Detects SharpShares multithreaded C# .NET Assembly to enumerate accessible network shares in a domain" author = "ditekSHen" id = "1da53e34-21a3-5b3c-885e-dcc8814ac3c8" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1290-L1305" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "8b35d6a692814e1b27ffc1db4ab124bf621c156aaf57f24796c422ec95a85715" score = 75 quality = 75 tags = "FILE" strings: $s1 = "SharpShares." ascii wide $s2 = "GetComputerShares" fullword ascii $s3 = "userAccountControl:1.2.840.113556.1.4.803:=2))(operatingSystem=*server*)(!(userAccountControl:1.2" wide $s4 = "GetAllShares" fullword ascii $s5 = "stealth:" wide $s6 = "(&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(operatingSystem=*server*))" fullword wide $s7 = /\/targets|ldap|threads/ wide $s8 = "entriesread" fullword ascii condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_INDICATOR_TOOL_PROX_Revsocks : FILE { meta: description = "Detects revsocks Reverse socks5 tunneler with SSL/TLS and proxy support" author = "ditekSHen" id = "f85bc557-40ab-5533-8a89-a2de9bbc9ad9" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1307-L1321" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "4a8e68f25b7ba10b0eb9772ed4ba2b9c6566768f2b5a2859df8bac644d196bf3" score = 75 quality = 75 tags = "FILE" strings: $s1 = "main.agentpassword" fullword ascii $s2 = "main.connectForSocks" fullword ascii $s3 = "main.connectviaproxy" fullword ascii $s4 = "main.DnsConnectSocks" fullword ascii $s5 = "main.listenForAgents" fullword ascii $s6 = "main.listenForClients" fullword ascii $s7 = "main.getPEMs" fullword ascii condition: ( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and 4 of them } rule DITEKSHEN_INDICATOR_TOOL_PWS_Azbelt : FILE { meta: description = "Detects azbelt for enumerating Azure related credentials primarily on AAD joined machines" author = "ditekSHen" id = "cf9268d2-1928-51e8-9643-ee0a5bada9fa" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1323-L1338" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "71cc2b3418ea5e285adafe03fa80bade67dc3e4073fe58d42bc6190860b48b43" score = 75 quality = 75 tags = "FILE" strings: $s1 = "@http://169.254.169.254/metadata/identity/oauth2/token?api-version=" ascii $s2 = "@Partner Customer Delegated Admin Offline Processor" fullword ascii $s3 = "@TargetName: " fullword ascii $s4 = "httpclient.nim" fullword ascii $s5 = "@DSREG_DEVICE_JOIN" fullword ascii $s6 = "@.azure/msal_token_cache.bin" fullword ascii $s7 = "CredEnumerateW" fullword ascii $s8 = "@http://169.254.169.254/metadata/instance?api-version=" ascii condition: uint16( 0 ) == 0x5a4d and 6 of them } rule DITEKSHEN_INDICATOR_TOOL_Dontsleep : FILE { meta: description = "Detects Keep Host Unlocked (Don't Sleep)" author = "ditekShen" id = "f71bd0d5-a526-5f1e-8bd3-9e653db610a7" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1340-L1354" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b8e2132d3b36c3e2d2662a586916c7e4fc029f81af08b5c18006833c4e6f772f" score = 75 quality = 75 tags = "FILE" strings: $s1 = ":Repeat###DEL \"%s\"###if exist \"%s\" goto Repeat###DEL \"%s\"###" wide $s2 = "powrprof.dll,SetSuspendState" wide $s3 = "_selfdestruct.bat" wide $s4 = "please_sleep_block_" ascii $s5 = "Browser-Type: MiniBowserOK" wide $s6 = "m_use_all_rule_no_sleep" ascii $s7 = "BlockbyExecutionState: %d on:%d by_enable:%d" fullword wide condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_INDICATOR_TOOL_Nsudo : FILE { meta: description = "Detects NSudo allowing to run processes as TrustedInstaller or System" author = "ditekShen" id = "9a21b923-b02e-553b-8f53-026d7034c319" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1356-L1369" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "6bcffa79ca06b0b4178d6ea256f98d917c2b19cec0b059889b8d015d226a53f9" score = 75 quality = 75 tags = "FILE" strings: $x1 = "cmd /c start \"NSudo." wide $x2 = "*\\shell\\NSudo" fullword wide $x3 = "Projects\\NSudo\\Output\\Release\\x64\\NSudo.pdb" ascii $s1 = "-ShowWindowMode=Hide" wide $s2 = "?what@exception@@UEBAPEBDXZ" fullword ascii $s3 = "NSudo.RunAs." ascii condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and 2 of ( $s* ) ) or all of ( $s* ) or 4 of them ) } rule DITEKSHEN_INDICATOR_TOOL_Ligolo : FILE { meta: description = "Detects Ligolo tool for establishing SOCKS5 or TCP tunnels from a reverse connection" author = "ditekSHen" id = "cc461fd1-9a2f-59ce-af74-a0f55b8850b1" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1371-L1385" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b515dc184013c2f67d37e42d7172e2471b3a93c94024be12c7f587296287282d" score = 75 quality = 73 tags = "FILE" strings: $p1 = "/ligolo/main.go" ascii $p2 = "/armon/go-socks5" ascii $s1 = "main.StartLigolo" fullword ascii $s2 = "main.handleRelay" fullword ascii $s3 = "main.startSocksProxy" fullword ascii $s4 = "_main.tlsFingerprint" fullword ascii $s5 = "main.verifyTlsCertificate" fullword ascii condition: ( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf ) and ( ( all of ( $p* ) and 1 of ( $s* ) ) or all of ( $s* ) or ( 1 of ( $p* ) and 4 of ( $s* ) ) ) } rule DITEKSHEN_INDICATOR_TOOL_Ngrok : FILE { meta: description = "Detects Ngrok" author = "ditekSHen" id = "fc0a0de8-b68b-5b6b-a222-bbc031ebabd3" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1405-L1418" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f4bba142652aaf77e5b7c123b743cf165ae17210c39cf65b7311f7e7bd91f7e1" score = 75 quality = 75 tags = "FILE" strings: $s1 = "dashboard.ngrok.com" ascii $s2 = "go.ngrok.com/cmd/ngrok/main.go" ascii $s3 = "ngrok agent" ascii $s4 = "*ngrok.clientInfo" ascii $s5 = "'%s' socket: '%s' port: %d/edges/https/{{ .EdgeID }}/routes/{{ .ID }}/webhook_" ascii $s6 = "/{{ .ID }}/tunnel_sessions/{{ .ID }}/restart" ascii condition: ( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf ) and ( 3 of them ) } rule DITEKSHEN_INDICATOR_TOOL_Sqlrecon : FILE { meta: description = "Detects SQLRecon C# MS-SQL toolkit designed for offensive reconnaissance and post-exploitation" author = "ditekSHen" id = "ec91285b-690d-5fd3-b0fc-f8d72cbb7e15" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1420-L1436" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "784dbc518cf9492557c9b3536256c4a9b03e4536cf7cee7e764b8009dd4686bb" score = 75 quality = 75 tags = "FILE" strings: $s1 = "ConvertDLLToSQLBytes" ascii $s2 = "\\SQLRecon.pdb" ascii $s3 = "GetAllSQLServerInfo" ascii $s4 = "<GetMSSQLSPNs>b__" ascii $s5 = "select 1; exec master..xp_cmdshell" wide $s6 = "-> Command Execution" wide $s7 = ";EXEC dbo.sp_add_jobstep @job_name =" wide $s8 = "EXEC sp_drop_trusted_assembly 0x" wide $s9 = "(&(sAMAccountType=805306368)(servicePrincipalName=MSSQL*))" wide condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_INDICATOR_TOOL_Ngrokgo : FILE { meta: description = "Detects Go implementation variant for Ngrok" author = "ditekSHen" id = "b11f67c5-846d-57b2-8edc-521b2dc77503" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1473-L1488" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "4ec151661e3af922aba202c68392a2af17e2c4ed25a71a0b5aacc13fbfcc5c53" score = 75 quality = 75 tags = "FILE" strings: $s1 = "/codegangsta/inject" fullword wide $s2 = "go.ngrok.com/" ascii $s3 = "GetIsNgrokDomain" ascii $s4 = "GetNgrokMetering" ascii $s5 = "*cli.ngrokService" ascii $s6 = "GetAllowNgrokLink" ascii $s7 = "ngrok {{.Name}}{{if .Flags}}" ascii $s8 = "github.com/nikolay-ngrok/" ascii condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_INDICATOR_Tool_Forensia : FILE { meta: description = "Detects Forensia anti-forensics tool used for erasing footprints" author = "ditekSHen" id = "bcd05c2e-7ddd-5ce7-a6a7-0659bed38744" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1490-L1523" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "7147eee62df10cd8a6c00ec80c4d1bdb8234a181dd6af81d0580d847f05bd0b6" score = 75 quality = 73 tags = "FILE" strings: $c1 = "for /F \"tokens=*\" %1 in ('wevtutil.exe el') DO wevtutil.exe cl \"%1\"" ascii $c2 = "del /F /Q C:\\Windows\\Prefetch\\*" ascii $c3 = "del C:\\Windows\\AppCompat\\Programs\\RecentFileCache.bcf" ascii $c4 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\*" ascii $c5 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\*" ascii $c6 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*" ascii $c7 = "fsutil.exe usn deletejournal /D C:" ascii $r1 = "\\Memory Management\\PrefetchParameters" wide $r2 = "\\Explorer\\Advanced" wide $r3 = "\\Services\\EventLog" wide $r4 = "\\Shell\\BagMRU" wide $r5 = "\\Control\\FileSystem" wide $r6 = "\\Setup\\VC" wide $s1 = "[LOG] - %s" wide $s2 = "\\forensia\\regedit.hpp" wide $s3 = "NtfsDisableLastAccessUpdate" wide $s4 = "Melting The Executable" wide $s5 = "Sysmon Unloader" wide $s6 = "Rundll32.exe apphelp.dll,ShimFlushCache" ascii $s7 = "\\Debug\\forensia.pdb" ascii $s8 = { 55 00 00 00 aa 00 00 00 92 49 24 00 49 24 92 00 24 92 49 00 00 00 00 00 11 00 00 00 22 00 00 00 33 00 00 00 44 00 00 00 66 00 00 00 88 00 00 00 99 00 00 00 bb 00 00 00 cc 00 00 00 dd 00 00 00 ee 00 00 00 ff 00 00 00 6d b6 db 00 b6 db 6d 00 db 6d b6 } condition: uint16( 0 ) == 0x5a4d and ( ( 4 of ( $c* ) and 2 of ( $r* ) ) or ( 4 of ( $r* ) and 2 of ( $c* ) ) or 6 of ( $s* ) or ( 3 of ( $s* ) and 2 of ( $r* ) and 1 of ( $c* ) ) ) } rule DITEKSHEN_INDICATOR_TOOL_Dogzproxy : FILE { meta: description = "Detects Dogz proxy tool" author = "ditekSHen" id = "de2a8d26-0e8e-5999-baca-1e43933af866" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1525-L1537" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "575cfed9cb7979216fd8fd2a05efe5dfece3a9120b4f185c015918337829ed63" score = 75 quality = 75 tags = "FILE" strings: $s1 = "LOGONSERVER=" fullword wide $s2 = "DOGZ_E_" ascii $s3 = "got handshake_id=%d" ascii $s4 = "responser send connect ack" ascii $s5 = "dogz " ascii condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_INDICATOR_TOOL_Fastreverseproxy : FILE { meta: description = "Detects Fast Reverse Proxy (FRP) tool" author = "ditekSHen" id = "d643cc38-a96c-5353-bb46-ca46ea740e3b" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1539-L1555" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c26d9e8833c7055a03a446eb983c7f70f1f18669d009ebc204dda3f0bb6048f7" score = 75 quality = 75 tags = "FILE" strings: $x1 = "<title>frp client admin UI" ascii $x2 = "https://github.com/fatedier/frp" ascii $s1 = ").SetLogin" ascii $s2 = ").SetPing" ascii $s3 = ").SetNewWorkConn" ascii $s4 = ").ServeHTTP" ascii $s5 = ").Middleware" ascii $s6 = "frpc proxy config error:" ascii $s7 = "frpc sudp visitor proxy is close" ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and 4 of ( $s* ) ) or ( all of ( $s* ) ) ) } rule DITEKSHEN_INDICATOR_TOOL_Gogoscan : FILE { meta: description = "Detects GoGo scan tool" author = "ditekSHen" id = "c24ede04-2971-55f8-8b60-ec3bdca844d7" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1557-L1571" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c9fbc98a28c74bf920f5f7d62713834d18b33b5c65483a1bd42e4555764c8346" score = 75 quality = 75 tags = "FILE" strings: $s1 = "(conn) (scan (scan) MB in Value>" ascii $s2 = "sweep sysmontargettelnet" ascii $s3 = "%d bytes(?i) (.*SESS.*?ID)([a-z0-9])([A-Z]+)" ascii $s4 = "prepareForSweep" ascii $s5 = "Scanned %s with %d ports, found %d" ascii $s6 = "/chainreactors/gogo/" ascii $s7 = "Starting task %s ,total ports: %d , mod: %s" ascii condition: uint16( 0 ) == 0x5a4d and 6 of them } rule DITEKSHEN_INDICATOR_TOOL_Gogoprocdump : FILE { meta: description = "Detects GoGo (lsass) process dump tool" author = "ditekSHen" id = "f92845c6-f8ae-50d0-97ea-cfa72051c2de" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1573-L1586" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f410882e4c6c8b65e7d3c192cf94bf99d61cf54dc21d80cdf17193b34752c576" score = 75 quality = 75 tags = "FILE" strings: $s1 = "C:\\temp" ascii $s2 = "gogo" fullword ascii $s3 = "/DumpLsass-master/SilentProcessExit/" ascii $s4 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zone" ascii $s5 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass.exe" ascii $s6 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\lsass.exe" ascii condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_INDICATOR_TOOL_Fscan : FILE { meta: description = "Detects GoGo scan tool" author = "ditekSHen" id = "3bf73853-15c1-54f7-866a-6a7632e39f19" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1588-L1602" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b107eb767454c4c084a7237c107c8414bdb03c324902769ac544c5903e346e17" score = 75 quality = 75 tags = "FILE" strings: $s1 = "fscan version:" ascii $s2 = "Citrix-ConfProxyCitrix-MetaframeCitrix-NetScalerCitrix-XenServerCitrix_Netscaler" ascii $s3 = "(AkamaiGHost)(DESCRIPTION=(Typecho)(^.+)([0-9]+)(confluence.)(dotDefender)" ascii $s4 = "/fscan/" ascii $s5 = "WebScan.CheckDatas" ascii $s6 = "'Exploit.Test" ascii $s7 = "rules:" ascii condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_INDICATOR_TOOL_BURTNCIGAR : FILE { meta: description = "Detects BURNTCIGAR a utility which terminates processes associated with endpoint security software" author = "ditekSHen" id = "b5260d7e-07ac-5633-b450-e2124cbba65b" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1604-L1616" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "4977332a0b20b300a5fc34f0f8d56221f55b66783853306d803e91701cb7e6ec" score = 75 quality = 75 tags = "FILE" clamav1 = "INDICATOR.Win.TOOL.BURNTCIGAR" strings: $s1 = "Kill PID =" ascii $s2 = "CreateFile Error =" ascii $s3 = "\\KillAV" ascii $s4 = "DeviceIoControl" ascii condition: uint16( 0 ) == 0x5a4d and 3 of them } rule DITEKSHEN_INDICATOR_TOOL_Pplblade : FILE { meta: description = "Detects PPLBlade Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk" author = "ditekSHen" id = "60c9b036-51a0-5e08-83de-1f69f62245c3" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1634-L1658" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "da21402b07fcd0358ba630e48ab35956cb7ed8c12836a339c85b2ee5e414543e" score = 75 quality = 75 tags = "FILE" strings: $x1 = "PPLBlade" ascii $x2 = "/PPLBlade/" ascii $x3 = "PPLBlade.exe --mode" ascii $x4 = "PPLBLADE.SYSPPLBlade.dmp" ascii $s1 = "Dump bytes sent at %s:%d. Protocol: %s" ascii $s2 = "Deobfuscated dump saved in file %s" ascii $m1 = "main.WriteDriverOnDisk" ascii $m2 = "main.ProcExpOpenProc" ascii $m3 = "main.miniDumpCallback" ascii $m4 = "main.copyDumpBytes" ascii $m5 = "main.MiniDumpGetBytes" ascii $m6 = "main.SendBytesRaw" ascii $m7 = "main.SendBytesSMB" ascii $m8 = "main.DeobfuscateDump" ascii $m9 = "main.dumpMutex" ascii $m10 = "main.dbghelpDLL" ascii $m11 = "main.miniDumpWriteDump" ascii condition: uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or ( 1 of ( $x* ) and ( 1 of ( $s* ) or 3 of ( $m* ) ) ) or ( all of ( $s* ) and 3 of ( $m* ) ) or ( 7 of ( $m* ) ) ) } rule DITEKSHEN_INDICATOR_TOOL_Sharpldap : FILE { meta: description = "Detects SharpLDAP tool written in C# that aims to do enumeration via LDAP queries" author = "ditekSHen" id = "597e578d-41f0-595e-b92c-0c3676d8b47a" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1660-L1675" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "da5db3f2907229dc68e3c6f3351361a4b1fb9fe8afc597c9dfe611f9725c6181" score = 75 quality = 75 tags = "FILE" strings: $x1 = "SharpLDAP" ascii wide $x2 = "SharpLDAP.pdb" ascii $s1 = "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" wide $s2 = "(&(servicePrincipalName=*))" wide $s3 = "/Enumerating (Domain|Enterprise|Organizational|Service|Members|Users|Computers)/" wide $s4 = "ListMembers" fullword ascii $s5 = "GroupMembers" fullword ascii $s6 = "get_SamAccountName" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 4 of ( $s* ) ) or ( 5 of ( $s* ) ) ) } rule DITEKSHEN_INDICATOR_TOOL_Pandora : FILE { meta: description = "Detects Pandora tool to extract credentials from password managers" author = "ditekSHen" id = "3f71f24b-755f-5967-afbf-04a512bd0a19" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1677-L1691" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "dd5be3b99b62ec40c242225d9420b9ce299c4f348882b0380289309dfedbc1e8" score = 75 quality = 75 tags = "FILE" strings: $s1 = "process PID:" fullword wide $s2 = "Dump file created:" fullword wide $s3 = "System.Security.AccessControl.FileSystemAccessRule('Everyone', 'FullControl', 'Allow')" ascii $s4 = "{[math]::Round($_.PrivateMemorySize64" ascii $s5 = "rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump $" ascii $s6 = "\"payload\":{\"logins\":" ascii $s7 = "\\pandora.pdb" ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_INDICATOR_TOOL_Havoc : FILE { meta: description = "Detects Havoc Demon" author = "ditekSHen" id = "71ad145c-4017-597a-837e-5d11ba64d7c0" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1693-L1710" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c5806deaa57590ebe1923608b9b085460e0edd024721e6e9d7073765a79bf22b" score = 75 quality = 75 tags = "FILE" strings: $x1 = "X-Havoc:" wide $x2 = "X-Havoc-Agent:" wide $s1 = "\\Werfault.exe" wide $s2 = "/funny_cat.gif" wide condition: uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or 3 of them or ( pe.number_of_imports == 0 and pe.number_of_exports == 0 and 2 of them ) ) } rule DITEKSHEN_INDICATOR_TOOLS_Localpotato : FILE { meta: description = "Detects LocalPotato" author = "ditekShen" id = "65f8305b-b830-58e7-970b-da1df9a06e9b" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1712-L1743" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "88fba16a6eec6d2c23331642041c6adfddddeb21ba8e74b6959bd48c90f73cbb" score = 75 quality = 73 tags = "FILE" strings: $x1 = "LocalPotato.stg" fullword wide $x2 = "we always love potatoes" fullword ascii $s1 = "{00000306-0000-0000-c000-000000000046}" wide $s2 = "{854A20FB-2D44-457D-992F-EF13785D2B51}" wide $s3 = "cifs/127.0.0.1" wide $s4 = "\\\\127.0.0.1\\c$" wide $s5 = "complete failed: 0x%08x" ascii $s6 = "Authorization: NTLM %s" ascii $s7 = "Objref Moniker Display Name = %S" ascii $s8 = "SMB Connect Tree: %S" ascii $s9 = "b64type=%s" fullword ascii $s10 = "decodes=%s" fullword ascii $s11 = { 53 4d 42 72 00 00 00 00 18 01 48 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ac 7b 00 00 00 00 00 22 00 02 4e 54 20 4c 4d 20 30 2e 31 32 00 02 53 4d 42 20 32 2e 30 30 32 00 02 53 4d 42 20 32 2e 3f 3f 3f 00 00 00 00 00 00 00 00 00 00 00 68 fe 53 4d 42 40 } $o1 = { 44 8b 4c 24 34 48 8d 44 24 38 48 89 44 24 28 4c } $o2 = { e8 c4 ff ff ff 33 d2 48 8d 4d f0 41 b8 d0 04 00 } $o3 = { 83 7b 0c 00 75 42 8b 03 25 ff ff ff 1f 3d 21 05 } $o4 = { 3c 68 74 6c 3c 6a 74 5c 3c 6c 74 34 3c 74 74 24 } $o5 = { e9 39 ff ff ff cc 48 89 5c 24 08 4c 89 4c 24 20 } $o6 = { 48 b9 ff ff ff ff ff ff 0f 00 48 8b c2 41 b8 0c } condition: uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and 5 of ( $s* ) ) or 8 of ( $s* ) or ( 4 of ( $o* ) and ( 1 of ( $x* ) or 5 of ( $s* ) ) ) ) } rule DITEKSHEN_INDICATOR_TOOLS_Edrsandblast : FILE { meta: description = "Detects EDRSandBlast" author = "ditekShen" id = "85d6d82b-a30e-5c79-93e7-8a3bbbf4a403" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1745-L1767" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "9b801f053e42fbd646cf62fecf6cbf5f2cceeec82bed93ecd8625984eccb08c6" score = 75 quality = 75 tags = "FILE" strings: $s1 = "credguard" fullword wide $s2 = "\\cmd.exe" fullword wide $s3 = "ci_%s.dll" fullword wide $s4 = "cmd /c sc" wide $s5 = "fltmgr_%s.sys" fullword wide $s6 = "ntoskrnl_%s.exe" fullword wide $s7 = "ProductDir" fullword wide $s8 = "lsass.exe" fullword wide $s9 = "0x%p;%ws;%ws;;;" ascii $s10 = "MiniDumpWriteDump" ascii $s11 = "EDRSB_Init: %u" ascii $s12 = "ntoskrnloffsets.csv" fullword wide nocase $s13 = "wdigestoffsets.csv" fullword wide nocase $o1 = { eb 0e 8b 85 34 15 00 00 ff c0 89 85 34 15 00 00 } $o2 = { 74 48 8b 85 34 15 00 00 41 b9 04 01 00 00 4c 8d } condition: uint16( 0 ) == 0x5a4d and 7 of them } rule DITEKSHEN_INDICATOR_TOOLS_Rsockstun : FILE { meta: description = "Detects rsockstun" author = "ditekShen" id = "a284a607-abea-5914-ad3a-84eaff733ee0" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1769-L1781" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "4ad0ac389bf8961b0dd987a72d5dd534e5e3cc673f0e07aa49d39d1fd3f5f53e" score = 75 quality = 75 tags = "FILE" strings: $s1 = "main.connectviaproxy" ascii $s2 = "main.connectForSocks" ascii $s3 = "main.listenForClients" ascii $s4 = "main.listenForSocks" ascii $s5 = "Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=" ascii condition: ( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and all of them } rule DITEKSHEN_INDICATOR_TOOL_Scmaldevinj_Go : FILE { meta: description = "Detects Go shell/malware dev injector" author = "ditekShen" id = "56ec114f-8e16-5ab6-ae3b-a182cb381b4a" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1783-L1793" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "48c3c759283c63a0c439cfba0194da89f402189e4c3cd831c22b5078ccae47b1" score = 75 quality = 75 tags = "FILE" strings: $s1 = "hooka/shellcode.go" ascii $s2 = "/maldev\x09v" ascii $s3 = "Binject/debug/pe." ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_INDICATOR_TOOL_Reversessh_Go : FILE { meta: description = "Detects golang reverse ssh tool" author = "ditekShen" id = "4fb671aa-ad42-5f7e-bd5a-c19f018088c9" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1795-L1804" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "4f9899aacc09c7da05fb5d412cfe8e91ee0d8e922189a6f921410d73ae8b3a9c" score = 75 quality = 75 tags = "FILE" strings: $s1 = "/reverse_ssh/" ascii $s2 = "main.rsshService" ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_INDICATOR_TOOL_Sharpghosttask : FILE { meta: description = "Detects SharpGhostTask" author = "ditekSHen" id = "84d71179-0cfd-5389-b6bd-92c292361b3c" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1806-L1817" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "3de8d9fe7804e208ff556b6bedbd80eebfda1a730626403418a555ad9fbbb820" score = 75 quality = 75 tags = "FILE" strings: $x1 = "Ghosted" wide $x2 = /--target(binary|task)/ fullword wide $x3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\T" wide nocase $s4 = "__GhostTask|" ascii condition: uint16( 0 ) == 0x5a4d and 3 of them } rule DITEKSHEN_INDICATOR_TOOL_Krbrelay : FILE { meta: description = "Detects KrbRelay" author = "ditekshen" id = "c8baac8a-54f3-5f53-93f8-daabeaaaff44" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1819-L1836" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f76b585cd2d741eab9d91ffd5a34c38696ac573cba1a3752d21c4b8b6681ad7b" score = 75 quality = 75 tags = "FILE" strings: $s1 = "System.Collections.Generic.IEnumerable.GetEnumerator" fullword ascii $s2 = "System.Collections.Generic.IEnumerator.get_Current" fullword ascii $s3 = "GetProcessIdFromIPid" fullword ascii $g1 = "hello.stg" fullword wide $g2 = "DSInternals.Common" fullword ascii $g3 = "C:\\Windows\\System32\\DriverStore\\FileRepository\\ntprint.inf_amd64_7b3eed059f4c3e41\\Amd64\\UNIDRV.DLL" fullword wide $g4 = "C:\\Windows\\System32\\kernelbase.dll" fullword wide $g5 = "get_UnsupportedSecretEncryptionType" fullword ascii $g6 = "CoInitializeSecurity Error: 0x{0:X8}. Exploit will fail." fullword wide $g7 = "AuthnSvc: {0} - PrincName: {1}" fullword wide condition: uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 4 of ( $g* ) ) or ( 7 of them ) ) } rule DITEKSHEN_INDICATOR_TOOL_Edrsilencer : FILE { meta: description = "Detects EDRSilencer" author = "ditekshen" id = "29b6da1e-9138-5ee6-b9fd-d7b3c7f48626" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1838-L1857" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "da00aced2608fd5e192397ef2346ac247f29f993995fb90189e05da60be15d13" score = 75 quality = 75 tags = "FILE" strings: $s1 = "block \"C:\\Windows\\System32\\curl.exe\"" ascii $s2 = "blockedr" fullword ascii $s3 = "edrProcess" fullword ascii $s4 = "BlockEdrProcessTraffic" fullword ascii $s5 = "isInEdrProcessList" fullword ascii $s6 = "EDRSilencer.c" fullword ascii $v1 = "elastic-agent.exe" fullword ascii nocase $v2 = "CybereasonAV.exe" fullword ascii nocase $v3 = "SentinelAgent.exe" fullword ascii nocase $v4 = "fortiedr.exe" fullword ascii nocase $v5 = "MsMpEng.exe" fullword ascii nocase $v6 = "CylanceSvc.exe" fullword ascii nocase condition: uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $v* ) ) ) } rule DITEKSHEN_INDICATOR_TOOL_Edrprison : FILE { meta: description = "Detects EDRPrison" author = "ditekshen" id = "85831265-fd9e-5e0e-b5d9-22bf1c89b3f2" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1859-L1872" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e1ef9e9c6bd0d2efa7b0b617fb52100075658221559f92a61c672807ab5a4d77" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Block:" wide $s2 = "PacketLen:" wide $s3 = "DoWorkPacket_Step" ascii $s4 = "DoWorkAsyncNETWORK" ascii $s5 = "BlockMessage" ascii $s6 = "GetRmAddrPortNetwork" ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_INDICATOR_TOOL_Sharpsqlpwn : FILE { meta: description = "Detects SharpSQLPwn" author = "ditekshen" id = "f99c0ddb-a073-5c15-9a7c-60f6766cd0a2" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1874-L1891" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c811d4926c433c6521f4bbe03a1abf4a5b27b56931a18a8bb672f37fe4fccfb8" score = 75 quality = 75 tags = "FILE" strings: $s1 = "smb_ip" fullword ascii $s2 = "Recon" fullword ascii $s3 = "UNCPathInjection" fullword ascii $s4 = "from sys.server_principals" wide $s5 = "EXEC sp_configure '" wide $s6 = "EXEC ('sp_configure" wide $s7 = "CREATE ASSEMBLY" wide $s8 = "DROP ASSEMBLY" wide $s9 = "FROM 0x" wide $s10 = "EXEC master..xp_dirtree \"\\\\" wide condition: uint16( 0 ) == 0x5a4d and 7 of them } rule DITEKSHEN_INDICATOR_TOOL_Chromekatz : FILE { meta: description = "Detects ChromeKatz: CookieKatz and CredentialKatz" author = "ditekshen" id = "9dd706c8-552c-5c96-9b81-cfd50157ac34" date = "2020-11-06" modified = "2024-09-25" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1893-L1908" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "4f1bdbb7f8c4893444baac287c8fcefaca80a4301845706b56e9f9628c9f116f" score = 75 quality = 75 tags = "FILE" strings: $s1 = "\\include\\xmemory" ascii wide $s2 = "targetBrowser" ascii $s3 = "thirdPattern" ascii $s4 = "isBrowserWow64" ascii $s5 = "wcscpy_s(memory, size_in_elements, string)" fullword wide $s6 = "hChrome" fullword ascii $t1 = "szCookieMonster" fullword ascii $t2 = "szPasswordReuseDetectorInstances" fullword ascii condition: uint16( 0 ) == 0x5a4d and 6 of them } rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_0199_1 : CVE_2017_0199 FILE { meta: description = "Detects RTF documents potentially exploiting CVE-2017-0199" author = "ditekSHen" id = "74b3702a-7b4d-58be-ad2c-c2b1cf0ebc50" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L1-L69" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "06b75267f00b775a6c1cd7a2022a9cfa0ea2c976f969c2c066be51449f197f58" score = 75 quality = 75 tags = "CVE-2017-0199, FILE" strings: $urlmoniker3 = { 45 0a 30 0a 43 0a 39 0a 45 0a 41 0a 37 0a 39 0a 46 0a 39 0a 42 0a 41 0a 43 0a 45 0a 31 0a 31 0a 38 0a 43 0a 38 0a 32 0a 30 0a 30 0a 41 0a 41 0a 30 0a 30 0a 34 0a 42 0a 41 0a 39 0a 30 0a 42 } $urlmoniker4 = { 45 0d 0a 30 0d 0a 43 0d 0a 39 0d 0a 45 0d 0a 41 0d 0a 37 0d 0a 39 0d 0a 46 0d 0a 39 0d 0a 42 0d 0a 41 0d 0a 43 0d 0a 45 0d 0a 31 0d 0a 31 0d 0a 38 0d 0a 43 0d 0a 38 0d 0a 32 0d 0a 30 0d 0a 30 0d 0a 41 0d 0a 41 0d 0a 30 0d 0a 30 0d 0a 34 0d 0a 42 0d 0a 41 0d 0a 39 0d 0a 30 0d 0a 42 } $urlmoniker6 = { 65 0a 30 0a 63 0a 39 0a 65 0a 61 0a 37 0a 39 0a 66 0a 39 0a 62 0a 61 0a 63 0a 65 0a 31 0a 31 0a 38 0a 63 0a 38 0a 32 0a 30 0a 30 0a 61 0a 61 0a 30 0a 30 0a 34 0a 62 0a 61 0a 39 0a 30 0a 62 } $urlmoniker7 = { 65 0d 0a 30 0d 0a 63 0d 0a 39 0d 0a 65 0d 0a 61 0d 0a 37 0d 0a 39 0d 0a 66 0d 0a 39 0d 0a 62 0d 0a 61 0d 0a 63 0d 0a 65 0d 0a 31 0d 0a 31 0d 0a 38 0d 0a 63 0d 0a 38 0d 0a 32 0d 0a 30 0d 0a 30 0d 0a 61 0d 0a 61 0d 0a 30 0d 0a 30 0d 0a 34 0d 0a 62 0d 0a 61 0d 0a 39 0d 0a 30 0d 0a 62 } $ole1 = { d0 cf 11 e0 a1 b1 1a e1 } $ole2 = "d0cf11e0a1b11ae1" ascii nocase $ole3 = "64306366313165306131623131616531" ascii $ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31" ascii nocase $ole5 = { 64 0a 30 0a 63 0a 66 0a 31 0a 31 0a 65 0a 30 } $ole6 = { 64 0d 0a 30 0d 0a 63 0d 0a 66 0d 0a 31 0d 0a 31 0d 0a 65 0d 0a 30 } $obj1 = "\\objhtml" ascii $obj2 = "\\objdata" ascii $obj3 = "\\objupdate" ascii $obj4 = "\\objemb" ascii $obj5 = "\\objautlink" ascii $obj6 = "\\objlink" ascii condition: uint32( 0 ) == 0x74725c7b and 1 of ( $urlmoniker* ) and 1 of ( $ole* ) and 1 of ( $obj* ) } rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_8759_1 : CVE_2017_8759 FILE { meta: description = "detects CVE-2017-8759 weaponized RTF documents." author = "ditekSHen" id = "8f873145-b909-5185-9f85-07c820d1f38e" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L215-L238" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "595dc0153a2349fbd4f92dd544a3dfd05715059dd639653e7c7e6ac80624360e" score = 75 quality = 75 tags = "CVE-2017-8759, FILE" strings: $clsid1 = { 00 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 } $clsid2 = { 00 03 00 00 00 00 00 00 C0 00 00 00 00 00 00 46 } $clsid3 = "0003000000000000c000000000000046" ascii nocase $clsid4 = "4f4c45324c696e6b" ascii nocase $clsid5 = "OLE2Link" ascii nocase $ole1 = { d0 cf 11 e0 a1 b1 1a e1 } $ole2 = "d0cf11e0a1b11ae1" ascii nocase $ole3 = "64306366313165306131623131616531" ascii $ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31" $s1 = "wsdl=http" wide $s2 = "METAFILEPICT" ascii $s3 = "INCLUDEPICTURE \"http" ascii $s4 = "!This program cannot be run in DOS mode" ascii condition: uint32( 0 ) == 0x74725c7b and 1 of ( $clsid* ) and 1 of ( $ole* ) and 2 of ( $s* ) } rule DITEKSHEN_INDICATOR_RTF_Exploit_Scripting : CVE_2017_8759 CVE_2017_8570 FILE { meta: description = "detects CVE-2017-8759 or CVE-2017-8570 weaponized RTF documents." author = "ditekSHen" id = "e8fd1231-3ef5-5b0b-987c-f55337804da3" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L270-L302" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "a1f4c833f0132dcbe2b3677d6ac0f3597c152702515375d60d4332c21183bd76" score = 75 quality = 75 tags = "CVE-2017-8759, CVE-2017-8570, FILE" strings: $clsid1 = { 00 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 } $clsid2 = "0003000000000000c000000000000046" ascii nocase $clsid3 = "4f4c45324c696e6b" ascii nocase $clsid4 = "OLE2Link" ascii nocase $ole1 = { d0 cf 11 e0 a1 b1 1a e1 } $ole2 = "d0cf11e0a1b11ae1" ascii nocase $ole3 = "64306366313165306131623131616531" ascii $ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31" $ole5 = { 64 30 63 66 [0-2] 31 31 65 30 61 31 62 31 31 61 65 31 } $ole6 = "D0cf11E" ascii nocase $obj1 = "\\objhtml" ascii $obj2 = "\\objdata" ascii $obj3 = "\\objupdate" ascii $obj4 = "\\objemb" ascii $obj5 = "\\objautlink" ascii $obj6 = "\\objlink" ascii $obj7 = "\\mmath" ascii $obj8 = "\\objclass htmlfile" ascii $sct1 = { 33 (43|63) (3533|3733) (3433|3633) (3532|3732) (3439|3639)( 3530|3730) (3534|3734) (3443|3643) (3435|3635) (3534|3734) } $sct2 = { (3737|3537) (3733|3533) (3633|3433) (3732|3532) (3639|3439) (3730|3530) (3734|3534) (3245|3265) (3733|3533) (3638|3438) (3635|3435) (3643|3443) (3643|3443) } condition: uint32( 0 ) == 0x74725c7b and 1 of ( $clsid* ) and 1 of ( $ole* ) and 1 of ( $obj* ) and 1 of ( $sct* ) } rule DITEKSHEN_INDICATOR_RTF_Embedded_Excel_Sheetmacroenabled : FILE { meta: description = "Detects RTF documents embedding an Excel sheet with macros enabled. Observed in exploit followed by dropper behavior" author = "ditekSHen" id = "342d10b3-61d2-5fcb-8f4f-1fe45049257b" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L304-L328" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "cc3b52e549c2697c6e0a2fea365d193311d90d26854bd2fe321aa26c118975a0" score = 75 quality = 75 tags = "FILE" strings: $ex1 = "457863656c2e53686565744d6163726f456e61626c65642e" ascii nocase $ex2 = "0002083200000000c000000000000046" ascii nocase $ex3 = "Excel.SheetMacroEnabled." ascii $ole1 = { d0 cf 11 e0 a1 b1 1a e1 } $ole2 = "d0cf11e0a1b11ae1" ascii nocase $ole3 = "64306366313165306131623131616531" ascii $ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31" $obj1 = "\\objhtml" ascii $obj2 = "\\objdata" ascii $obj3 = "\\objupdate" ascii $obj4 = "\\objemb" ascii $obj5 = "\\objautlink" ascii $obj6 = "\\objlink" ascii $obj7 = "\\mmath" ascii condition: uint32( 0 ) == 0x74725c7b and ( 1 of ( $ex* ) and 1 of ( $ole* ) and 2 of ( $obj* ) ) } rule DITEKSHEN_INDICATOR_OLE_Metadatacmd : FILE { meta: description = "Detects OLE documents with Windows command-line utilities commands (certutil, powershell, etc.) stored in the metadata (author, last modified by, etc.)." author = "ditekSHen" id = "63b23630-b344-5fba-95f4-950d072beaff" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L330-L349" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0562d026a1ad4510310ebff5da154064f92afc7bf714973f7de362435476772c" score = 75 quality = 75 tags = "FILE" strings: $cmd1 = { 00 1E 00 00 00 [1-4] 00 00 (63|43) (6D|4D) (64|44) (00|20) } $cmd2 = { 00 1E 00 00 00 [1-4] 00 00 (6D|4D) (73|53) (68|48) (74|54) (61|41) (00|20) } $cmd3 = { 00 1E 00 00 00 [1-4] 00 00 (77|57) (73|53) (63|43) (72|52) (69|49) (70|50) (74|54) (00|20) } $cmd4 = { 00 1E 00 00 00 [1-4] 00 00 (63|42) (65|45) (72|52) (74|54) (75|55) (74|54) (69|49) (6C|4C) (00|20) } $cmd5 = { 00 1E 00 00 00 [1-4] 00 00 (70|50) (6F|4F) (77|57) (65|45) (72|52) (73|43) (68|48) (65|45) (6C|4C) (6C|4C) (00|20) } $cmd6 = { 00 1E 00 00 00 [1-4] 00 00 (6E|4E) (65|45) (74|54) 2E (77|57) (65|45) (62|42) (63|43) (6C|4C) (69|49) (65|45) (6E|4E) (74|54) (00|20) } condition: uint16( 0 ) == 0xcfd0 and any of them } rule DITEKSHEN_INDICATOR_RTF_Equation_Bitsadmin_Downloader : FILE { meta: description = "Detects RTF documents that references both Microsoft Equation Editor and BITSAdmin. Common exploit + dropper behavior." author = "ditekSHen" id = "e96a6f18-9a5e-58ca-829e-c82b444ad403" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L428-L451" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "39a07a0af243e929a6b3df48b6cf8a9d30bc8ef9e7deac494348945427b015e7" score = 75 quality = 75 tags = "FILE" snort2_sid = "910002-910003" snort3_sid = "910001" clamav_sig = "INDICATOR.RTF.EquationBITSAdminDownloader" strings: $eq = "0200000002CE020000000000C000000000000046" ascii nocase $ba = "6269747361646d696e" ascii nocase $obj1 = "\\objhtml" ascii $obj2 = "\\objdata" ascii $obj3 = "\\objupdate" ascii $obj4 = "\\objemb" ascii $obj5 = "\\objautlink" ascii $obj6 = "\\objlink" ascii $obj7 = "\\mmath" ascii condition: uint32( 0 ) == 0x74725c7b and ( ( $eq and $ba ) and 1 of ( $obj* ) ) } rule DITEKSHEN_INDICATOR_RTF_Equation_Certutil_Downloader : FILE { meta: description = "Detects RTF documents that references both Microsoft Equation Editor and CertUtil. Common exploit + dropper behavior." author = "ditekSHen" id = "a47f31f9-91fc-5009-8aff-2b9e334c3139" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L453-L476" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "d6c62957ce40ed755a84bd9aa8900e4990c466097d6df55c539b289bf50fe94e" score = 75 quality = 75 tags = "FILE" snort2_sid = "910006-910007" snort3_sid = "910003" clamav_sig = "INDICATOR.RTF.EquationCertUtilDownloader" strings: $eq = "0200000002CE020000000000C000000000000046" ascii nocase $cu = "636572747574696c" ascii nocase $obj1 = "\\objhtml" ascii $obj2 = "\\objdata" ascii $obj3 = "\\objupdate" ascii $obj4 = "\\objemb" ascii $obj5 = "\\objautlink" ascii $obj6 = "\\objlink" ascii $obj7 = "\\mmath" ascii condition: uint32( 0 ) == 0x74725c7b and ( ( $eq and $cu ) and 1 of ( $obj* ) ) } rule DITEKSHEN_INDICATOR_RTF_Equation_Powershell_Downloader : FILE { meta: description = "Detects RTF documents that references both Microsoft Equation Editor and PowerShell. Common exploit + dropper behavior." author = "ditekSHen" id = "5d1d65ef-e183-5a0d-a0fa-d0d5f09f21a1" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L478-L501" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0b8b9b7b40f8b4d659de9e025a65d5c6b64c6066bb618a3e7ed3c318f70befe5" score = 75 quality = 75 tags = "FILE" snort2_sid = "910004-910005" snort3_sid = "910002" clamav_sig = "INDICATOR.RTF.EquationPowerShellDownloader" strings: $eq = "0200000002CE020000000000C000000000000046" ascii nocase $ps = "706f7765727368656c6c" ascii nocase $obj1 = "\\objhtml" ascii $obj2 = "\\objdata" ascii $obj3 = "\\objupdate" ascii $obj4 = "\\objemb" ascii $obj5 = "\\objautlink" ascii $obj6 = "\\objlink" ascii $obj7 = "\\mmath" ascii condition: uint32( 0 ) == 0x74725c7b and ( ( $ps and $eq ) and 1 of ( $obj* ) ) } rule DITEKSHEN_INDICATOR_RTF_LNK_Shell_Explorer_Execution : FILE { meta: description = "detects RTF files with Shell.Explorer.1 OLE objects with embedded LNK files referencing an executable." author = "ditekSHen" id = "2cac4dd8-086a-5220-a658-94cedd9cf7c3" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L503-L517" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "4c11a37425e260692e11dc8fca317611106245d1590081a7038036ad568702f8" score = 75 quality = 75 tags = "FILE" strings: $clsid = "c32ab2eac130cf11a7eb0000c05bae0b" ascii nocase $lnk_header = "4c00000001140200" ascii nocase $http_url = "6800740074007000" ascii nocase $file_url = "660069006c0065003a" ascii nocase condition: uint32( 0 ) == 0x74725c7b and filesize < 1500KB and $clsid and $lnk_header and ( $http_url or $file_url ) } rule DITEKSHEN_INDICATOR_RTF_Forms_HTML_Execution : FILE { meta: description = "detects RTF files with Forms.HTML:Image.1 or Forms.HTML:Submitbutton.1 OLE objects referencing file or HTTP URLs." author = "ditekSHen" id = "26b21c94-9192-53be-808b-b553f87769e1" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L519-L533" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "5e8a2072971c40d6fbc0e0265a9adfbe4faa04d0f3c6962fda443da33aa06906" score = 75 quality = 75 tags = "FILE" strings: $img_clsid = "12d11255c65ccf118d6700aa00bdce1d" ascii nocase $sub_clsid = "10d11255c65ccf118d6700aa00bdce1d" ascii nocase $http_url = "6800740074007000" ascii nocase $file_url = "660069006c0065003a" ascii nocase condition: uint32( 0 ) == 0x74725c7b and filesize < 1500KB and ( $img_clsid or $sub_clsid ) and ( $http_url or $file_url ) } rule DITEKSHEN_INDICATOR_PUB_MSIEXEC_Remote : FILE { meta: description = "detects VB-enable Microsoft Publisher files utilizing Microsoft Installer to retrieve remote files and execute them" author = "ditekSHen" id = "518db2bb-174b-54c4-b330-1e8a8e36265d" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L535-L549" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "be5407e6e6e21e77f6de1d3a378996bfc6ce4326986aa03eb152e772bb495184" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Microsoft Publisher" ascii $s2 = "msiexec.exe" ascii $s3 = "Document_Open" ascii $s4 = "/norestart" ascii $s5 = "/i http" ascii $s6 = "Wscript.Shell" fullword ascii $s7 = "\\VBE6.DLL#" wide condition: uint16( 0 ) == 0xcfd0 and 6 of them } rule DITEKSHEN_INDICATOR_RTF_Ancalog_Exploit_Builder_Document : FILE { meta: description = "Detects documents generated by Phantom Crypter/Ancalog" author = "ditekSHen" id = "01e7f949-8ced-5355-978c-34d6e639e61a" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L551-L563" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e458be78ca8975d067110dc38119437b3ffe55afdbfdab47468c9ed74bba9f9d" score = 75 quality = 75 tags = "FILE" snort2_sid = "910000-910001" snort3_sid = "910000" clamav_sig = "INDICATOR.RTF.AncalogExploitBuilderDocument" strings: $builder1 = "{\\*\\ancalog" ascii $builder2 = "\\ancalog" ascii condition: uint32( 0 ) == 0x74725c7b and 1 of ( $builder* ) } rule DITEKSHEN_INDICATOR_RTF_Threadkit_Exploit_Builder_Document : FILE { meta: description = "Detects vaiations of RTF documents generated by ThreadKit builder." author = "ditekSHen" id = "f4a4e7f0-ea2f-523f-9634-a939dc90706e" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L565-L582" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f2308ac6ae5345e0c783871dd6b471397ec83ba7194db5cc74c8984d84c2c0c2" score = 75 quality = 75 tags = "FILE" strings: $obj1 = "\\objhtml" ascii $obj2 = "\\objdata" ascii $obj3 = "\\objupdate" ascii $obj4 = "\\objemb" ascii $obj5 = "\\objautlink" ascii $obj6 = "\\objlink" ascii $obj7 = "\\mmath" ascii $pat1 = /\\objupdate\\v[\\\s\n\r]/ ascii condition: uint32( 0 ) == 0x74725c7b and 2 of ( $obj* ) and 1 of ( $pat* ) } rule DITEKSHEN_INDICATOR_XML_Legacydrawing_Autoload_Document : FILE { meta: description = "detects AutoLoad documents using LegacyDrawing" author = "ditekSHen" id = "ce116601-7048-5a3f-9b73-5127ca3b359e" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L584-L594" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "a038636f5e8e7837c2209072f1659b921c8a9a48d4ed153e735915cf1f7f3fcc" score = 75 quality = 75 tags = "FILE" strings: $s1 = " 3 } rule DITEKSHEN_INDICATOR_DOC_Phishingpatterns : FILE { meta: description = "Detects OLE, RTF, PDF and OOXML (decompressed) documents with common phishing strings" author = "ditekSHen" id = "67372eb5-ed07-5062-a12e-9ad8c7070f0f" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L862-L883" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "50b6566cb18512f887c07576391eb492101f7534da3460d5f7740ee6f4cf707d" score = 75 quality = 75 tags = "FILE" strings: $s1 = "PERFORM THE FOLLOWING STEPS TO PERFORM DECRYPTION" ascii nocase $s2 = "Enable Editing" ascii nocase $s3 = "Enable Content" ascii nocase $s4 = "WHY I CANNOT OPEN THIS DOCUMENT?" ascii nocase $s5 = "You are using iOS or Android, please use Desktop PC" ascii nocase $s6 = "You are trying to view this document using Online Viewer" ascii nocase $s7 = "This document was edited in a different version of" ascii nocase $s8 = "document are locked and will not" ascii nocase $s9 = "until the \"Enable\" button is pressed" ascii nocase $s10 = "This document created in online version of Microsoft Office" ascii nocase $s11 = "This document created in previous version of Microsoft Office" ascii nocase $s12 = "This document protected by Microsoft Office" ascii nocase $s13 = "This document encrypted by" ascii nocase $s14 = "document created in earlier version of microsoft office" ascii nocase condition: ( uint16( 0 ) == 0xcfd0 or uint32( 0 ) == 0x74725c7b or uint32( 0 ) == 0x46445025 or uint32( 0 ) == 0x6d783f3c ) and 2 of them } rule DITEKSHEN_INDICATOR_OOXML_Excel4Macros_EXEC : FILE { meta: description = "Detects OOXML (decompressed) documents with Excel 4 Macros XLM macrosheet" author = "ditekSHen" id = "674ef310-d3bc-5e15-862f-29aa111becb3" date = "2020-11-06" modified = "2024-09-06" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L885-L898" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ab3994e4082390f65d030db0b898a20df1d7e4b0ca2fdedc7a9d0f1480fd0334" score = 75 quality = 75 tags = "FILE" clamav_sig = "INDICATOR.OOXML.Excel4MacrosEXEC" strings: $ms = " %s.tmp" condition: uint16( 0 ) == 0x457f and ( 4 of ( $x* ) or all of ( $s* ) or ( 3 of ( $x* ) and 5 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Multi_Wellmess : FILE { meta: description = "WellMess Windows/Linux backdoor payload" author = "ditekSHen" id = "cfa0f077-9d45-5796-b888-66fb397e74f8" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L488-L510" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "9cbbca609fd289d7406d9073237688d250dc68c450676b9b755509540d8f76a5" score = 75 quality = 75 tags = "FILE" clamav_sig1 = "MALWARE_Win.Trojan.WellMess_DotNet" clamav_sig2 = "MALWARE_Win.Trojan.WellMess_Golang" clamav_sig3 = "MALWARE_Linux.Trojan.WellMess_Golang" strings: $s1 = "-----BEGIN PUBLIC KEY-----" ascii $s2 = "-----END PUBLIC KEY-----" ascii $s3 = "net/http.(*persistConn).readResponse" ascii $s4 = "net/http/cookiejar.(*Jar).SetCookies" ascii $s5 = "_/home/ubuntu/GoProject/src/bot/botlib" ascii $s6 = "<;head;><;title;>" ascii $s7 = "<;title;><;service;>" ascii $s8 = "http://invalidlookup" ascii $s9 = "" ascii wide condition: ( uint16( 0 ) == 0x457f or uint16( 0 ) == 0x5a4d ) and all of them } rule DITEKSHEN_MALWARE_Win_Konni : FILE { meta: description = "Konni payload" author = "ditekSHen" id = "86eae9f6-60b0-5720-8528-ddbe32b6d4a6" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L512-L530" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "d57c51f7ede28b74395e5e0fbcc5fd9247b3353330f3e549d5abf99bbd7a1b93" score = 75 quality = 75 tags = "FILE" strings: $s1 = "uplog.tmp" fullword wide $s2 = "upfile.tmp" fullword wide $s3 = "%s-log-%s" fullword ascii wide $s4 = "%s-down" ascii wide $s5 = "%s-file-%s" fullword ascii wide $s6 = "\"rundll32.exe\" \"%s\" install" fullword wide $s7 = "subject=%s&data=" fullword ascii $s8 = "dll-x64.dll" fullword ascii $s9 = "dll-x32.dll" fullword ascii $pdb1 = "\\virus-dropper\\Release\\virus-dropper.pdb" ascii $pdb2 = "\\virus-init\\Release\\virus-init.pdb" ascii condition: uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $pdb* ) ) ) } rule DITEKSHEN_MALWARE_Win_Tjkeylogger : FILE { meta: description = "TJKeylogger payload" author = "ditekSHen" id = "6aaa11b2-3734-5538-b593-f5276f3acc72" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L553-L567" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "52d98a6f5a2cfc6717b7097b4e70c1e813851222f9f06ae74be4e5703b0b0dde" score = 75 quality = 75 tags = "FILE" strings: $s1 = "TJKeyLogger" fullword ascii $s2 = "software\\microsoft\\windows\\currentversion\\run" fullword ascii $s3 = "\\Passwords.txt" ascii $s4 = "TJKeyLogItem" fullword ascii $s5 = "TJKeyAsyncLog" fullword ascii $s6 = "FM_GETDSKLST" fullword ascii $s7 = "KL_GETMODE" fullword ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_W1RAT : FILE { meta: description = "W1 RAT payload" author = "ditekSHen" id = "d5841bc0-97e7-575e-91f6-d264f507a8b5" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L569-L585" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "84b9a2e309ed9ab0fb8343d941585356d23348683073d0a37fc7194f58a43a0e" score = 75 quality = 75 tags = "FILE" strings: $s1 = "/c /Ox /Fa\"%s/%s.asm\" /Fo\"%s/%s.obj\" \"%s/%s.%s\"" ascii $s2 = "this->piProcInfo.hProcess" fullword ascii $s3 = "index >= 0 && index < this->reg_tab->GetLen()" fullword ascii $s4 = "strcpy(log_font.lfFaceName,\"%s\");" fullword ascii $s5 = "WorkShop -- [%s]" fullword ascii $s6 = "HeaderFile.cpp" fullword ascii $s7 = "WndLog.cpp" fullword ascii $s8 = "assertion fail \"%s\" at file=%s line=%d" fullword ascii $s9 = "Stdin pipe creation failed" fullword ascii condition: ( uint16( 0 ) == 0x5a4d and 6 of ( $s* ) ) or ( all of them ) } rule DITEKSHEN_MALWARE_Win_Tefosteal : FILE { meta: description = "Tefosteal payload" author = "ditekSHen" id = "56646933-3ed3-5b77-9135-993b57603490" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L653-L674" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "a350863270cbe3349f271e55d66a2ebdd6406e8d122c11071de74a774eb77ebf" score = 75 quality = 71 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.Tefosteal" strings: $s1 = "netsh wlan show networks mode=bssid" nocase fullword wide $s2 = "LoginCredentialService.GetLoginCredentials$" ascii $s3 = "DefaultLoginCredentials.LoginEventUsrPw$" ascii $s4 = "SEC_E_NO_KERB_KEY" wide $s5 = "TList." ascii $s6 = "_Password.txt" fullword wide nocase $s7 = "_Cookies.txt" fullword wide nocase $f1 = "\\InfoPC\\BSSID.txt" wide $f2 = "\\Files\\Telegram\\" wide $f3 = "\\InfoPC\\Screenshot.png" wide $f4 = "\\InfoPC\\Systeminfo.txt" wide $f5 = "\\Steam\\config" wide $f6 = "\\delete.vbs" wide condition: uint16( 0 ) == 0x5a4d and 4 of ( $s* ) and 2 of ( $f* ) } rule DITEKSHEN_MALWARE_Win_Cryptostealergo : FILE { meta: description = "CryptoStealerGo payload" author = "ditekSHen" id = "83886aeb-af7e-564c-989a-fb7d955814e2" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L676-L692" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0050be7522e7d89cb9688e63fdca11d24baa74aa858e8c19ee7b4658518536b6" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Go build ID: \"" ascii $s2 = "file_upload.go" ascii $s3 = "grequests.FileUpload" ascii $s4 = "runtime.newproc" ascii $s5 = "credit_cards" ascii $s6 = "zip.(*fileWriter).Write" ascii $s7 = "autofill_" ascii $s8 = "XFxVc2VyIERhdGFcXA==" ascii $s9 = "XFxBcHBEYXRhXFxMb2NhbFxc" ascii condition: uint16( 0 ) == 0x5a4d and 8 of them } rule DITEKSHEN_MALWARE_Win_M00Nd3V : FILE { meta: description = "M00nD3v keylogger payload" author = "ditekSHen" id = "4000f55d-e072-50b6-b6ee-72cefc0ec53f" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L694-L715" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "68a0888da3b114dc895fe18a3d03b2b88d140fbf82b888f7a031b9364d01aabf" score = 75 quality = 75 tags = "FILE" strings: $s1 = "M00nD3v Stub" ascii wide $s2 = "M00nD3v{0}{1} Logs{0}{2} \\ {3}{0}{0}{4}" fullword wide $s3 = "Anti-Keylogger Elite" wide $s4 = "/C TASKKILL /F /IM" wide $s5 = "echo.>{0}:Zone.Identifier" fullword wide $s6 = "> Nul & Del \"{0}\" & start \"\" \"{1}.exe\"" wide $s7 = "> Nul & start \"\" \"{1}.exe\"" wide $s8 = "Stealer" fullword wide $s9 = "{0}{0}++++++++++++{1} {2}++++++++++++{0}{0}" wide $s10 = "{4}Application: {3}{4}URL: {0}{4}Username: {1}{4}Password: {2}{4}" wide $s11 = "encrypted_key\":\"(?.+?)\"" wide $s12 = "Botkiller" fullword ascii $s13 = "AVKiller" fullword ascii $s14 = "get_pnlPawns" fullword ascii condition: ( uint16( 0 ) == 0x5a4d and 6 of them ) or ( 9 of them ) } rule DITEKSHEN_MALWARE_Win_Vssdestroy : FILE { meta: description = "VSSDestroy/Matrix ransomware payload" author = "ditekSHen" id = "734ece56-b993-5b44-ae15-f673fabfe8ad" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L717-L740" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "24bfd32580f784440252d629a7ab86b84a570ded34409940616be2a89bf73088" score = 75 quality = 75 tags = "FILE" snort_sid = "920008-920009" clamav_sig = "MALWARE.Win.Ransomware.VSSDestroy" strings: $o1 = "[SHARESSCAN]" wide $o2 = "[LDRIVESSCAN]" wide $o3 = "[LOGSAVED]" wide $o4 = "[LPROGRESS]" wide $o5 = "[FINISHSAVED]" wide $o6 = "[ALL_LOCAL_KID]" wide $o7 = "[DIRSCAN" wide $o8 = "[GENKEY]" wide $s1 = "\\cmd.exe" nocase wide $s2 = "/C powershell \"" nocase wide $s3 = "%COMPUTERNAME%" wide $s4 = "%USERNAME%" wide $s5 = "Error loading Socket interface (ws2_32.dll)!" wide $s6 = "Old file list dump found. Want to load it? (y/n):" fullword wide condition: ( uint16( 0 ) == 0x5a4d and 4 of ( $o* ) and 3 of ( $s* ) ) or ( 5 of ( $o* ) and 4 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Goldenaxe : FILE { meta: description = "GoldenAxe ransomware payload" author = "ditekSHen" id = "23874106-dbbb-5cb2-b61a-1661d8e2d868" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L742-L763" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "6dfd88ce65acdfed4749e3b817b317c3c514ea42f892a7f5f95853c148507918" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Ransomware.GoldenAxe" strings: $s1 = "Go build ID: " ascii $s2 = "taskkill.exe" ascii $s3 = "cmd.exe" ascii $s4 = "Speak.Speak" ascii $s5 = "CLNTSRVRnull" ascii $s6 = "-----END" ascii $s7 = "-----BEGIN" ascii $s8 = ".EncryptFile" ascii $g1 = "GoldenAxe/Utils." ascii $g2 = "GoldenAxe/Cryptography." ascii $g3 = "GoldenAxe/Walker." ascii $g4 = "C:/Users/alpha/go/src/GoldenAxe/" ascii $g5 = "'Golden Axe ransomware'" ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $g* ) and 1 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Robbinhood : FILE { meta: description = "Robbinhood ransomware payload" author = "ditekSHen" id = "a5066a22-3c87-5e9f-a94f-5a44af2f96fd" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L765-L787" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f1c4226ed5cb1583418d5ef0efc2c2b5bc3cfe7f148f359c5d432fd660331a46" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Ransomware.Robbinhood" strings: $go = "Go build ID:" ascii $cmd1 = "cmd.exe /c" ascii $cmd2 = "net use * /DELETE" nocase ascii $cmd3 = "sc.exe stop" ascii $cmd4 = "vssadmin resize shadowstorage" nocase ascii $s1 = /Skipping\s(file|dir)/ ascii $s2 = "Encrypt[ERR] GET Size:" ascii $s3 = ".taskkilltasklistunknown(" ascii $s4 = ".sysvssadmin.exewevtutil.exe MB released" ascii $s5 = ".sysvssadmin.exewevtutil.exewinlogin.exewinlogon.exe MB released" ascii $s6 = ".enc_robbinhood" ascii $s7 = "c:\\windows\\temp\\pub.key" nocase ascii $s8 = "main.CoolMaker" ascii $s9 = "/valery/go/src/oldboy/" ascii condition: uint16( 0 ) == 0x5a4d and ( $go and 1 of ( $cmd* ) and 3 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Getcrypt : FILE { meta: description = "GetCrypt ransomware payload" author = "ditekSHen" id = "fb6db807-372f-59e6-96c6-54dd4ece336d" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L789-L825" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "fd7ee98757c3ac1f2b2a4dd9041c78d33273d7a7d596c3d99c6b8d79988f29f1" score = 75 quality = 73 tags = "FILE" clamav_sig1 = "MALWARE_Win.Ransomware.GetCrypt-1" clamav_sig2 = "MALWARE_Win.Ransomware.GetCrypt-2" strings: $x1 = "delete shadows /all /quiet" wide $x2 = "C:\\Windows\\System32\\svchost.exe" fullword wide $x3 = "desk.bmp" fullword wide $x4 = ":\\Boot" fullword wide $x5 = "\\encrypted_key.bin" fullword wide $x6 = "vssadmin.exe" fullword wide $x7 = ":\\Recovery" fullword wide $s1 = "CryptEncrypt" fullword ascii $s2 = "NtWow64ReadVirtualMemory64" fullword ascii $s3 = "MPR.dll" fullword ascii $s4 = "%key%" fullword ascii $s5 = "CryptDestroyKey" fullword ascii $s6 = "ntdll.dll" fullword ascii $s7 = "WNetCancelConnection2W" fullword ascii $s8 = ".%c%c%c%c" fullword wide $s10 = { 43 72 79 70 74 49 6d 70 6f 72 74 4b 65 79 00 00 cb 00 43 72 79 70 74 45 6e 63 72 79 70 74 00 00 c1 00 43 72 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78 74 41 00 00 c8 00 43 72 79 70 74 44 65 73 74 72 6f 79 4b 65 79 00 d2 00 43 72 79 70 74 47 65 6e 52 61 6e 64 6f 6d 00 00 c2 00 43 72 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78 74 57 00 00 41 44 56 41 50 49 33 32 2e 64 6c 6c 00 00 b5 01 53 68 65 6c 6c 45 78 65 63 75 74 65 45 78 57 00 53 48 45 4c 4c 33 32 2e 64 6c 6c 00 } condition: uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or 8 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Joego : FILE { meta: description = "JoeGo ransomware payload" author = "ditekSHen" id = "23d38bcd-e66d-5ff1-ad6a-3e6432d83562" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L827-L847" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "3ddf3506aefb3cd1845f9daa689848a02a2422ca98c5c984bc918cc7ea2b2677" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Ransomware.JoeGo" strings: $go = "Go build ID:" ascii $s1 = "%SystemRoot%\\system32\\%v." ascii $s2 = "REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /V" ascii $s3 = "/t REG_SZ /F /D %userprofile%\\" ascii $s4 = "(sensitive) [recovered]" ascii $s5 = "/dev/stderr/dev/stdout/index.html" ascii $s6 = "%userprofile%\\SystemApps" ascii $s7 = "p=
ACDTACSTAEDTAESTAKDTAKSTAWSTA" ascii $cnc1 = "/detail.php" ascii $cnc2 = "/checkin.php" ascii $cnc3 = "/platebni_brana.php" ascii $cnc4 = "://nebezpecnyweb.eu/" ascii condition: uint16( 0 ) == 0x5a4d and $go and ( all of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $cnc* ) ) ) } rule DITEKSHEN_MALWARE_Win_Aurora : FILE { meta: description = "Aurora ransomware payload" author = "ditekSHen" id = "d3eafe9c-c8d9-5744-ba5d-4eb0249cceea" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L849-L869" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "056bb11e8b947ef90462503db82b2001e4a5d4847fad9c0d5d771384a80d779a" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" fullword ascii wide $s2 = "#DECRYPT_MY_FILES#.txt" fullword ascii $s3 = "/gen.php?generate=" fullword ascii $s4 = "geoplugin.net/php.gp" ascii $s5 = "/end.php?id=" fullword ascii $s6 = "wotreplay" fullword ascii $s7 = "moneywell" fullword ascii $s8 = "{btc}" fullword ascii $s9 = ".?AV_Locimp@locale@std@@" ascii $s10 = ".?AV?$codecvt@DDU_Mbstatet@@@std@@" ascii $s11 = ".?AU_Crt_new_delete@std@@" ascii $pdb1 = "\\z0ddak\\Desktop\\source\\Release\\Ransom.pdb" ascii $pdb2 = "\\Desktop\\source\\Release\\Ransom.pdb" ascii condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $pdb* ) and 5 of ( $s* ) ) or ( 8 of them ) ) } rule DITEKSHEN_MALWARE_Win_Buran : FILE { meta: description = "Buran ransomware payload" author = "ditekSHen" id = "1433bac5-2ece-54bb-8e57-b5834fffc719" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L871-L903" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "eaf50d824dbade0ca63fafc5b4a376553039de9b51a0f6387cb28c8f91a7e0b9" score = 75 quality = 73 tags = "FILE" clamav_sig = "MALWARE.Win.Ransomware.Buran" strings: $v1_1 = "U?$error_info_injector@V" ascii $v1_2 = "Browse for Folder (FTP)" fullword ascii $v1_3 = "Find/Replace in Files" fullword ascii $v1_4 = "PAHKLM" fullword ascii $v1_5 = "PAHKCR" fullword ascii $v1_6 = "chkOpt_" ascii $h1 = "Search in this folder" ascii $h2 = "
to find where the text below" ascii $h3 = " files with these extensions (separate with semi-colons)" ascii $h4 = "Need help with [" wide condition: ( uint16( 0 ) == 0x5a4d and 5 of ( $s* ) ) or ( 6 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Aspire : FILE { meta: description = "Aspire Keylogger payload" author = "ditekSHen" id = "25724975-f373-553e-b27e-43168e956c16" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1007-L1022" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "3ea0136dbacb79e4c7556f562d17b26b84ac3e4c967b117021e2399ded0a0fdf" score = 75 quality = 75 tags = "FILE" strings: $s1 = "AspireLogger -" wide $s2 = "Application: @" wide $s3 = "encryptedUsername" wide $s4 = "encryptedPassword" wide $s5 = "Fetch users fron logins" wide $s6 = "URI=file:" wide $s7 = "signons.sqlite" wide $s8 = "logins.json" wide condition: ( uint16( 0 ) == 0x5a4d and 6 of ( $s* ) ) or ( 7 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_S05Kitty : FILE { meta: description = "Sector05 Kitty RAT payload" author = "ditekSHen" id = "3261f6b6-21e7-5195-98db-9607ba530572" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1024-L1045" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "df2930694671c9ca16f2afeb799704647c9acf32be118706c342347ffe8ceb36" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Execute Comand" ascii $s2 = "InjectExplorer" ascii $s3 = "targetProcess = %s" fullword ascii $s4 = "Process attach (%s)" fullword ascii $s5 = "process name: %s" fullword ascii $s6 = "cmd /c %s >%s" fullword ascii $s7 = "CmdDown: %s, failed" fullword ascii $s8 = "http://%s%s/%s" fullword ascii $s9 = "tmp.LOG" fullword ascii $x1 = "zerodll.dll" fullword ascii $x2 = "OneDll.dll" fullword ascii $x3 = "kkd.bat" fullword ascii $x4 = "%s\\regsvr32.exe /s \"%s\"" fullword ascii $x5 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\fontchk.jse" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 8 of ( $s* ) or all of ( $x* ) ) } rule DITEKSHEN_MALWARE_Win_Fakewmi : FILE { meta: description = "FakeWMI payload" author = "ditekSHen" id = "689bc207-2bc6-50de-80d6-d1ba0a26b264" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1047-L1064" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "627886cdd01f5f02e454ef284c77c87eb027ee33f6a51536758fb7f095271a40" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.Fakewmi" strings: $s1 = "-BEGIN RSA PUBLIC KEY-" ascii $s2 = ".exe|" ascii $s3 = "cmd /c wmic " ascii $s4 = "cmd /c sc " ascii $s5 = "schtasks" ascii $s6 = "taskkill" ascii $s7 = "findstr" ascii $s8 = "netsh interface" ascii $s9 = "CreateService" ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) and #s2 > 10 ) } rule DITEKSHEN_MALWARE_Win_Baldr : FILE { meta: description = "Baldr payload" author = "ditekSHen" id = "cdc35a11-a97b-5e21-929e-01fed5172b55" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1066-L1083" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f8e97fd618209bc6ce609b60b1e1f1e359be7678474fad3b18a529487c64cd99" score = 75 quality = 73 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.Baldr" strings: $x1 = "BALDR VERSION : {0}" fullword wide $x2 = "Baldr" fullword ascii wide $x3 = "{0}\\{1:n}.exe" fullword wide $x4 = ".doc;.docx;.log;.txt;" fullword wide $s1 = "b__" ascii $s2 = "b__" ascii $s3 = "UploadData" fullword ascii $s6 = "get_NetworkInterfaceType" fullword ascii $s5 = "get_Passwordcheck" fullword ascii condition: ( uint16( 0 ) == 0x5a4d and all of ( $x* ) ) or ( 2 of ( $x* ) and 4 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Rietspoof : FILE { meta: description = "Rietspoof payload" author = "ditekSHen" id = "b2d94705-ca59-56ae-8471-2c6895d355dc" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1110-L1140" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "d1d9baab83c904d1e8dcd7aeacdabfc79c1acee67006793c2240a42ebf9c62b2" score = 75 quality = 73 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.Rietspoof" strings: $c1 = "%s%s%s USER: user" fullword ascii $c2 = "cmd /c %s" fullword ascii $c3 = "CreateObject(\"Scripting.FileSystemObject\").DeleteFile(" ascii $c4 = "WScript.Quit" fullword ascii $c5 = "CPU: %s(%d)" fullword ascii $c6 = "RAM: %lld Mb" fullword ascii $c7 = "data.dat" fullword ascii $c8 = "%s%s%s USER:" ascii $v1_1 = ".vbs" ascii $v1_2 = "HELLO" ascii $v1_3 = "Wscript.Sleep" ascii $v1_4 = "User-agent:Mozilla/5.0 (Windows; U;" ascii $v2_1 = "Xjoepxt!" ascii $v2_2 = "Content-MD5:%s" fullword ascii $v2_3 = "M9h5an8f8zTjnyTwQVh6hYBdYsMqHiAz" fullword ascii $v2_4 = "GET /%s?%s HTTP/1.1" fullword ascii $v2_5 = "GET /?%s HTTP/1.1" fullword ascii $pdb1 = "\\techloader\\loader\\loader.odb" ascii wide $pdb2 = "\\loader\\Release\\loader_v1.0.pdb" ascii wide condition: uint16( 0 ) == 0x5a4d and ( 7 of ( $c* ) and ( 3 of ( $v* ) or 1 of ( $pdb* ) ) ) } rule DITEKSHEN_MALWARE_Win_Modirat : FILE { meta: description = "MoDiRAT payload" author = "ditekSHen" id = "8b641c7a-5ebd-50e7-83cb-e408683c456b" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1142-L1158" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "d0760e9dab7e9c0affb2193ea249feea8bb58e519522ca2a562f015059ad5590" score = 75 quality = 75 tags = "FILE" strings: $s1 = "add_Connected" fullword ascii $s2 = "Statconnected" fullword ascii $s3 = "StartConnect" fullword ascii $s4 = "TelegramTitleDetect" fullword ascii $s5 = "StartTitleTelegram" fullword ascii $s6 = "Check_titles" fullword ascii $s7 = "\\MoDi RAT V" ascii $s8 = "IsBuzy" fullword ascii $s9 = "Recording_Time" fullword wide condition: ( uint16( 0 ) == 0x5a4d and 7 of them ) or all of them } rule DITEKSHEN_MALWARE_JS_Koadicjs { meta: description = "Koadic post-exploitation framework JS payload" author = "ditekSHen" id = "8598d5cb-0486-52b0-a686-6bd014f35c44" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1188-L1208" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "689116f74996fecf4c16c224e8cd842ad5b5e989de2dfdf0debeb9a26d8a12fa" score = 75 quality = 75 tags = "" strings: $s1 = "window.moveTo(-" ascii $s2 = "window.onerror = function(sMsg, sUrl, sLine) { return false; }" fullword ascii $s3 = "window.onfocus = function() { window.blur(); }" fullword ascii $s4 = "window.resizeTo(" ascii $s5 = "window.blur();" fullword ascii $hf1 = ".+?)\\1[^>]*>" fullword wide $g1 = "get_Clipboard" fullword ascii $g2 = "get_Keyboard" fullword ascii $g3 = "get_Password" fullword ascii $g4 = "get_CtrlKeyDown" fullword ascii $g5 = "get_ShiftKeyDown" fullword ascii $g6 = "get_AltKeyDown" fullword ascii $m1 = "yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.htmlLogtext/html[]Time" ascii $m2 = "%image/jpg:Zone.Identifier\\tmpG.tmp%urlkey%-f \\Data\\Tor\\torrcp=%PostURL%127.0.0.1POST+%2B" ascii $m3 = ">{CTRL}Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\\WScript.ShellRegReadg401" ascii $m4 = "%startupfolder%\\%insfolder%\\%insname%/\\%insfolder%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%insregname%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunTruehttp" ascii $m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii condition: ( uint16( 0 ) == 0x5a4d and ( 8 of ( $s* ) or ( 6 of ( $* ) and all of ( $g* ) ) ) ) or ( 2 of ( $m* ) ) } rule DITEKSHEN_MALWARE_Win_Taurus : FILE { meta: description = "Taurus infostealer payload" author = "ditekSHen" id = "c02114c1-9c97-5d0c-b7ce-1bd6a00a9e9a" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1483-L1519" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "6039c27e69b47dfcc1327c34306627d2d9bd57f6bd365bb80b47ad21f892ae8a" score = 75 quality = 73 tags = "FILE" strings: $s1 = "t.me/taurus_se" ascii $s2 = "rus_seller@explo" ascii $s3 = "/c timeout /t 3 & del /f /q" ascii $s4 = "MyAwesomePrefix" ascii $txt1 = "LogInfo.txt" fullword ascii $txt2 = "Information.txt" fullword ascii $txt3 = "General\\passwords.txt" fullword ascii $txt4 = "General\\forms.txt" fullword ascii $txt5 = "General\\cards.txt" fullword ascii $txt6 = "Installed Software.txt" fullword ascii $txt7 = "Crypto Wallets\\WalletInfo.txt" fullword ascii $txt8 = "cookies.txt" fullword ascii $url1 = "/cfg/" wide $url2 = "/loader/complete/" wide $url3 = "/log/" wide $url4 = "/dlls/" wide $upat = /\.exe;;;\d;\d;\d\]\|\[http/ $x1 = "Vaultcli.dll" fullword ascii $x2 = "Bcrypt.dll" fullword ascii $x3 = "*.localstor" ascii $x4 = "operator<=>" fullword ascii $x5 = ".data$rs" fullword ascii $x6 = "https_discordap" ascii $o1 = { 53 56 8b 75 08 8d 85 64 ff ff ff 57 6a ff 6a 01 } $o2 = { 6a 00 68 00 04 00 00 ff b5 a8 fe ff ff ff b5 ac } $o3 = { ff 75 0c 8d 85 44 ff ff ff 50 e8 aa f7 ff ff 8b } $o4 = { 8b 47 04 c6 40 19 01 8d 85 6c ff ff ff 8b 0f 50 } $o5 = { 8d 8d ?? ff ff ff e8 5b } condition: (( 3 of ( $s* ) or ( 6 of ( $txt* ) and 2 of ( $s* ) ) or ( $upat and 1 of ( $s* ) and 2 of ( $txt* ) ) or ( all of ( $url* ) and ( 2 of ( $txt* ) or 1 of ( $s* ) ) ) ) or ( uint16( 0 ) == 0x5a4d and all of ( $x* ) or ( all of ( $o* ) and 3 of ( $x* ) ) ) ) } rule DITEKSHEN_MALWARE_Win_Remoteutilitiesrat : FILE { meta: description = "RemoteUtilitiesRAT RAT payload" author = "ditekSHen" id = "1cf3ece1-e723-5302-9673-273381ba7a8b" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1521-L1537" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "179a559f6a6ffbce31595bd613d338bb6ac40b8a083ed0169cde754b6ed756c7" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.RemoteUtilitiesRAT" strings: $s1 = "rman_message" wide $s2 = "rms_invitation" wide $s3 = "rms_host_" wide $s4 = "rman_av_capture_settings" wide $s5 = "rman_registry_key" wide $s6 = "rms_system_information" wide $s7 = "_rms_log.txt" wide $s8 = "rms_internet_id_settings" wide condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_MALWARE_Win_Slothfulmedia : FILE { meta: description = "SlothfulMedia backdoor payload" author = "ditekSHen" id = "e94b6d67-137c-5cfb-9c59-fbeb6cd85f0a" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1539-L1565" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "6f742e8d9d555b44daaa09835f599c99e16cd39bb106c8f43fbbca7093de462e" score = 75 quality = 73 tags = "FILE" strings: $x1 = /ExtKeylogger(Start|Stop)/ fullword ascii $x2 = /ExtService(Add|Delete|Start|Stop)/ fullword ascii $x3 = /ExtRegKey(Add|Del)/ fullword ascii $x4 = /ExtRegItem(Add|Del)/ fullword ascii $x5 = "ExtUnload" fullword ascii $s1 = "Local Security Process" fullword wide $s2 = "Global%s%d" fullword wide $s3 = "%s%s_%d.dat" fullword wide $s4 = "\\AppIni" fullword wide $s5 = "%s.tmp" fullword wide $s6 = "\\SetupUi" fullword wide $s7 = "%s|%s|%s|%s" fullword wide $s8 = "\\ExtInfo" fullword wide $cnc1 = "/v?m=" fullword ascii $cnc2 = "%s&i=%d" fullword ascii $cnc3 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75" fullword ascii $cnc4 = "Content-Length: %d" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or 7 of ( $s* ) or all of ( $cnc* ) or ( 1 of ( $x* ) and 4 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Apocalypse : FILE { meta: description = "Apocalypse infostealer payload" author = "ditekSHen" id = "f1fa6642-fe42-57e7-a1bc-0f59815049f8" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1598-L1615" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "d18ac492ad57cf390f20693cb47ae2c6e3dbdd921fa846130a4bc20047e1aa27" score = 75 quality = 75 tags = "FILE" strings: $s1 = "OpenClipboard" fullword ascii $s2 = "SendARP" fullword ascii $s3 = "GetWebRequest" fullword ascii $s4 = "DotNetGuard" fullword ascii $s5 = "set_CreateNoWindow" fullword ascii $s6 = "UploadFile" fullword ascii $s7 = "GetHINSTANCE" fullword ascii $s8 = "Kill" fullword ascii $s9 = "GetProcesses" fullword ascii $s10 = "get_PrimaryScreen" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Osno : FILE { meta: description = "Osno ransomware and infostealer payload" author = "ditekSHen" id = "25ed5ad4-804a-5608-b6fe-a811ca6744d8" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1617-L1652" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "3df59c306017001467a5f237db2ab37d97c34116558e18420a6a1f01f08f520f" score = 75 quality = 73 tags = "FILE" strings: $s1 = ".HolyGate+<>c+<" ascii $s2 = /Osno(Keylogger|Stealer|Ransom)/ wide $s3 = "password,executeWebhook('Account credentials" wide $s4 = "-Name Osno -PropertyType" wide $s5 = "process.env.hook" ascii $s6 = "Stealer.JSON.JsonValue" ascii $s7 = "b_" ascii $s8 = "b_" ascii $s9 = "antiVM" fullword ascii $s10 = "downloadurl" fullword ascii $s11 = "set_sPassword" fullword ascii $txt0 = "{0} {1} .txt" fullword wide $txt1 = "\\ScanningNetworks.txt" fullword wide $txt2 = "\\SteamApps.txt" fullword wide $txt3 = "-ErrorsLogs.txt" fullword wide $txt4 = "-keylogs.txt" fullword wide $txt5 = "Hardware & Soft.txt" fullword wide $cnc0 = "/csharp/" ascii wide $cnc1 = "token=" ascii wide $cnc2 = "×tamp=" ascii wide $cnc3 = "&session_id=" ascii wide $cnc4 = "&aid=" ascii wide $cnc5 = "&secret=" ascii wide $cnc6 = "&api_key" ascii wide $cnc7 = "&session_key=" ascii wide $cnc8 = "&type=" ascii wide condition: ( uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or 4 of ( $txt* ) or ( 4 of ( $s* ) and 2 of ( $txt* ) ) ) ) or ( 7 of ( $cnc* ) ) } rule DITEKSHEN_MALWARE_Win_Betabot : FILE { meta: description = "BetaBot payload" author = "ditekSHen" id = "377c500c-5727-5bea-ac46-cb69c868a607" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1654-L1666" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e594d01874ee622169d6708ddc6cfde7f1d26d2bea1604961dc860700e8a1d5d" score = 75 quality = 73 tags = "FILE" strings: $s1 = "__restart" fullword ascii $s2 = "%SystemRoot%\\SysWOW64\\tapi3.dll" fullword wide $s3 = "%SystemRoot%\\system32\\tapi3.dll" fullword wide $s4 = "publicKeyToken=\"6595b64144ccf1df\"" ascii $s5 = "VirtualProtectEx" fullword ascii condition: uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them } rule DITEKSHEN_MALWARE_Win_Wshratplugin : FILE { meta: description = "WSHRAT keylogger plugin payload" author = "ditekSHen" id = "45c4fc87-6c45-5cd7-9fc4-7d3ea664a740" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1668-L1685" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "3feeab43b58b533b7d2d41a71f2107e6f05b9c54ff805607843d253cadbe9384" score = 75 quality = 75 tags = "FILE" snort_sid = "920010-920012" clamav_sig = "MALWARE.Win.Trojan.WSHRAT-KLG" strings: $s1 = "GET /open-keylogger HTTP/1.1" fullword wide $s2 = "KeyboardChange: nCode={0}, wParam={1}, vkCode={2}, scanCode={3}, flags={4}, dwExtraInfo={6}" wide $s3 = "MouseChange: nCode={0}, wParam={1}, x={2}, y={3}, mouseData={4}, flags={5}, dwExtraInfo={7}" wide $s4 = "sendKeyLog" fullword ascii $s5 = "saveKeyLog" fullword ascii $s6 = "get_TotalKeyboardClick" fullword ascii $s7 = "get_SessionMouseClick" fullword ascii $pdb = "\\Android\\documents\\visual studio 2010\\Projects\\Keylogger\\Keylogger\\obj\\x86\\Debug\\Keylogger.pdb" ascii condition: uint16( 0 ) == 0x5a4d and filesize < 100KB and 4 of them } rule DITEKSHEN_MALWARE_Win_Revengerat : FILE { meta: description = "RevengeRAT and variants payload" author = "ditekSHen" id = "7d725050-108c-54b5-978e-2dd2124f5b0f" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1687-L1713" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "be9e50052f45b94d5995db723dd64d16a91c5ba0d3f589c018155c0cce45124f" score = 75 quality = 75 tags = "FILE" snort_sid = "920000-920002" strings: $l1 = "Lime.Connection" fullword ascii $l2 = "Lime.Packets" fullword ascii $l3 = "Lime.Settings" fullword ascii $l4 = "Lime.NativeMethods" fullword ascii $s1 = "GetAV" fullword ascii $s2 = "keepAlivePing!" fullword ascii wide $s3 = "Revenge-RAT" fullword ascii wide $s4 = "*-]NK[-*" fullword ascii wide $s5 = "RV_MUTEX" fullword ascii wide $s6 = "set_SendBufferSize" fullword ascii $s7 = "03C7F4E8FB359AEC0EEF0814B66A704FC43FB3A8" fullword ascii $s8 = "5B1EE7CAD3DFF220A95D1D6B91435D9E1520AC41" fullword ascii $s9 = "\\RevengeRAT\\" ascii $q1 = "Select * from AntiVirusProduct" fullword ascii wide $q2 = "SELECT * FROM FirewallProduct" fullword ascii wide $q3 = "select * from Win32_Processor" fullword ascii wide condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $l* ) and 3 of ( $s* ) ) or ( all of ( $q* ) and 3 of ( $s* ) ) or 3 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_TRAT : FILE { meta: description = "TRAT payload" author = "ditekSHen" id = "15f80970-6bc7-5e29-86d6-f7529a10d227" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1715-L1730" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b8474c74cd9f21fcb3a8ae1c7a7a0a801f0f117782e9803cdae39daf7f0f8b2f" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.TRAT" strings: $s1 = "^STEAM_0:[0-1]:([0-9]{1,10})$" fullword wide $s2 = "^7656119([0-9]{10})$" fullword wide $s3 = "Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)" ascii $s4 = "\"schtasks\", \"/delete /tn UpdateWindows /f\");" ascii $s5 = "ProcessWindowStyle.Hidden" ascii $s6 = "+<>c+<" ascii $s7 = "//B //Nologo *Y" fullword ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_Matiex : FILE { meta: description = "Matiex/XetimaLogger keylogger payload" author = "ditekSHen" id = "61803e0c-8f6a-5ded-855a-ff26eed1384f" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1768-L1788" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "62b45c43d99bef93a6c0e72200b869fdce331f8fa325640df7d8b72af56a3ef2" score = 75 quality = 73 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.MatiexKeylogger" strings: $id = "--M-A-T-I-E-X--K-E-Y-L-O-G-E-R--" ascii wide $s1 = "StartKeylogger" fullword ascii $s2 = "_KeyboardLoggerTimer" ascii $s3 = "_ScreenshotLoggerTimer" ascii $s4 = "_VoiceRecordLogger" ascii $s5 = "_ClipboardLoggerTimer" ascii $s6 = "get_logins" fullword ascii $s7 = "get_processhackerFucked" fullword ascii $s8 = "_ThePSWDSenders" fullword ascii $pdb = "\\Before FprmT\\Document VB project\\FireFox Stub\\FireFox Stub\\obj\\Debug\\VNXT.pdb" ascii condition: uint16( 0 ) == 0x5a4d and ( $id or 4 of ( $s* ) or ( $pdb and 2 of them ) ) } rule DITEKSHEN_MALWARE_Win_Iamthekingkeylogger : FILE { meta: description = "IAmTheKing Keylogger payload" author = "ditekSHen" id = "f9c84241-6db2-5243-9bea-2165104cb0c3" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1790-L1805" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "80d8cabfd02cd73e19e6cf1c2a8a5f06c5b3b502fe4f07289e92b448425aaa6d" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.IAmTheKingKeylogger" strings: $s1 = "[TIME:]%d/%d/%d %02d:%02d:%02d" fullword ascii $s2 = "[TITLE:]" fullword ascii $s3 = "%s-%02d-%02d-%02d-%02d" fullword ascii $s4 = "[DATA]:" fullword ascii $s5 = "[BK]" fullword ascii $s6 = "Log.txt" fullword ascii $s7 = "sonme hting is wrong x" fullword ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_Iamthekingscrcap : FILE { meta: description = "IAmTheKing screen capture payload" author = "ditekSHen" id = "ba385194-9578-568c-b908-bc4fc742e52e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1807-L1821" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "594ddad4e08bad51f90de1c4299e28b4800b4fa686bd4176e406ba401a1242ba" score = 75 quality = 75 tags = "FILE" strings: $s1 = "@MyScreen.jpg" fullword wide $s2 = "DISPLAY" fullword wide $s3 = ".?AVCImage@ATL@@" fullword ascii $s4 = ".?AVGdiplusBase@Gdiplus@@" fullword ascii $s5 = ".?AVImage@Gdiplus@@" fullword ascii $s6 = ".?AVBitmap@Gdiplus@@" fullword ascii $s7 = ".?AVCAtlException@ATL@@" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Iamthekingkingofhearts : FILE { meta: description = "IAmTheKing King Of Hearts payload" author = "ditekSHen" id = "95c73ec0-75b0-5d46-87da-b30feb170716" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1823-L1843" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "75b6dd0ebb90fd04f9e4a0b1fc6a1bbf417fc66daad24c8b01f0390f6155ec55" score = 75 quality = 75 tags = "FILE" strings: $s1 = "write info fail!!! GetLastError-->%u" fullword ascii $s2 = "LookupAccountSid Error %u" fullword ascii $s3 = "CreateServiceErrorID:%d" fullword ascii $s4 = "In ControlServiceErrorID:%d" fullword ascii $s5 = "In QueryServiceStatus ErrorID:%d" fullword ascii $s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii $s7 = "hello%s" fullword ascii $s8 = "additional header failed..." fullword ascii $s9 = "Set Option failed errcode: %ld" fullword ascii $s10 = "add cookie failed..." fullword ascii $u1 = "Mozilla/4.0 (compatible; )" fullword ascii $u2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; SE)" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $u* ) and 4 of ( $s* ) ) or ( all of ( $u* ) and 3 of ( $s* ) ) or ( 5 of them ) ) } rule DITEKSHEN_MALWARE_Win_Redlinedropperahk : FILE { meta: description = "Detects AutoIt/AutoHotKey executables dropping RedLine infostealer" author = "ditekSHen" id = "16eee826-f1fd-5a6f-b6f3-e02ccd889614" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1866-L1878" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0950fe9daa02f3a8fd527f75275766111be7e8774578963b0bdb455800dfc4f9" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.RedLineDropper-AHK" strings: $s1 = ".SetRequestHeader(\"User-Agent\",\" ( \" OSName \" | \" bit \" | \" CPUNAme \"\"" ascii $s2 = ":= \" | Windows Defender\"" ascii $s3 = "WindowSpy.ahk" wide $s4 = ">AUTOHOTKEY SCRIPT<" fullword wide condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Dlagent01 : FILE { meta: description = "Detects known downloader agent" author = "ditekSHen" id = "85ead6fd-b56e-5e78-8fb4-7c9ecb4c0b58" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1880-L1894" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "7aec81655af9b779a314c3e2cff933aa6426fcfe21b5a87e60e159c7e7f5238a" score = 75 quality = 75 tags = "FILE" snort_sid = "920007" clamav_sig = "MALWARE.Win.Trojan.DLAgent01" strings: $s1 = "Mozilla/5.0 Gecko/41.0 Firefox/41.0" fullword wide $s2 = "/Node:localhost /Namespace:\\\\root\\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List" fullword wide $s3 = "GUID.log" fullword wide $s4 = "NO AV" fullword wide $s5 = "%d:%I64d:%I64d:%I64d" fullword wide condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_MALWARE_Linux_PLEAD : FILE { meta: description = "PLEAD Linux payload" author = "ditekSHen" id = "07aa0561-d6d9-53b6-97ac-670cdf04335d" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1896-L1920" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "539998248ded0eb8ea1702c527804f89cfd55412f17ec699bd0af801f4fba673" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Linux.Trojan.PLEAD" strings: $x1 = "CFileTransfer" ascii $x2 = "CFileManager" ascii $x3 = "CPortForward" ascii $x4 = "CPortForwardManager" ascii $x5 = "CRemoteShell" ascii $x6 = "CSockClient" ascii $s1 = "/proc/self/exe" fullword ascii $s2 = "/bin/sh" fullword ascii $s3 = "echo -e '" ascii $s4 = "%s %s" ascii $s5 = "%s %lld %s" ascii $s6 = "Files: %d Size: %lld" ascii $s7 = "Dirs: %d" ascii $s8 = "%s(%s)/" ascii $s9 = "%s %s %s %s" ascii condition: uint16( 0 ) == 0x457f and ( all of ( $x* ) or all of ( $s* ) or 12 of them ) } rule DITEKSHEN_MALWARE_Win_CRAT : FILE { meta: description = "Detects CRAT main DLL" author = "ditekSHen" id = "9757a8de-61ea-55c0-b64c-055798450985" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1922-L1944" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "5a9fef68e110a1564dd5956408abcc3736cfa6853e1ac5510a089cc68f6bdc35" score = 75 quality = 75 tags = "FILE" strings: $s1 = "cmd /c \"dir %s /s >> %s\"" wide $s2 = "Set-Cookie:\\b*{.+?}\\n" wide $s3 = "Location: {[0-9]+}" wide $s4 = "Content-Disposition: form-data; name=\"%s\"; filename=\"" ascii $s6 = "%serror.log" wide $v2x_1 = "?timestamp=%u" wide $v2x_2 = "config.txt" wide $v2x_3 = "entdll.dll" wide $v2x_4 = "\\cmd.exe" wide $v2x_5 = "[MyDocuments]" wide $v2x_6 = "@SetWindowTextW FindFileExA" wide $v2x_7 = "Microsoft\\Windows\\WinX\\Group1\\*.exe" wide $v2s_1 = "Installed Anti Virus Programs" ascii $v2s_2 = "Running Processes" ascii $v2s_3 = "id=%u&content=" ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 6 of ( $v2x* ) or all of ( $v2s* ) or ( 2 of ( $v2s* ) and 4 of ( $v2x* ) ) ) } rule DITEKSHEN_MALWARE_Win_Cratpluginkeylogger : FILE { meta: description = "Detects CRAT keylogger plugin DLL" author = "ditekSHen" id = "a8682786-7704-56f0-a6df-b4e2ab4d7536" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1946-L1962" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "58ef1f7466fcc871be2e74aa447c76970fd90c9d9d345a896fb8e6335114d189" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.CRAT" strings: $ai1 = "VM detected!" fullword wide $ai2 = "Sandbox detected!" fullword wide $ai3 = "Debug detected!" fullword wide $ai4 = "Analysis process detected!" fullword wide $s1 = "Create KeyLogMutex %s failure %d" wide $s2 = "Key Log Mutex already created! %s" wide $s3 = /KeyLogThread\s(started|finished|terminated)!/ wide $s4 = /KeyLog_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( all of ( $ai* ) and 1 of ( $s* ) ) or ( 3 of ( $s* ) and 1 of ( $ai* ) ) or 5 of them ) } rule DITEKSHEN_MALWARE_Win_Cratpluginclipboardmonitor : FILE { meta: description = "Detects CRAT Clipboad Monitor plugin DLL" author = "ditekSHen" id = "587487c7-f00b-5d4a-8b18-e46d6c6560e2" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1964-L1979" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c3e692a06388e143a8e1053e75a6eb6a82da5bdf26d38e3a0e339bc20d8312a1" score = 75 quality = 75 tags = "FILE" strings: $ai1 = "VM detected!" fullword wide $ai2 = "Sandbox detected!" fullword wide $ai3 = "Debug detected!" fullword wide $ai4 = "Analysis process detected!" fullword wide $s1 = "Clipboard Monitor Mutex [%s] already created!" wide $s2 = "ClipboardMonitorThread started!" fullword wide $s3 = /MonitorClipboardThread\s(finished|terminated)!/ wide $s4 = /ClipboardMonitor_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( all of ( $ai* ) and 1 of ( $s* ) ) or ( 3 of ( $s* ) and 1 of ( $ai* ) ) or 5 of them ) } rule DITEKSHEN_MALWARE_Win_Cratpluginscreencapture : FILE { meta: description = "Detects CRAT Screen Capture plugin DLL" author = "ditekSHen" id = "ef0b6b88-8b1b-5ab5-ad81-276eaff0411f" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1981-L2000" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "7b4378ae883d01338fabe2eb50a5509b722c661e63afc287afa07b263a0ebc42" score = 75 quality = 75 tags = "FILE" strings: $ai1 = "VM detected!" fullword wide $ai2 = "Sandbox detected!" fullword wide $ai3 = "Debug detected!" fullword wide $ai4 = "Analysis process detected!" fullword wide $s1 = "User is inactive!, give up capture" wide $s2 = "Capturing screen..." wide $s3 = "%s\\P%02d%lu.tmp" fullword wide $s4 = "CloseHandle ScreenCaptureMutex failure! %d" fullword wide $s5 = "ScreenCaptureMutex already created! %s" fullword wide $s6 = "Create ScreenCaptureMutex %s failure %d" fullword wide $s7 = /ScreenCaptureThread\s(finished|terminated)!/ wide $s8 = /ScreenCapture_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( all of ( $ai* ) and 1 of ( $s* ) ) or ( 3 of ( $s* ) and 1 of ( $ai* ) ) or 6 of them ) } rule DITEKSHEN_MALWARE_Win_Cratpluginransomhansom : FILE { meta: description = "Detects CRAT Hansom Ransomware plugin DLL" author = "ditekSHen" id = "0bfc97df-545f-5453-afe0-5777dc1c95b4" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2002-L2020" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b22f6d22630f311241634513eb051df2b36af84a938c1ae1f5284e5a5d7d3077" score = 75 quality = 73 tags = "FILE" strings: $cmd1 = "/f /im \"%s\"" wide $cmd2 = "add HKLM\\%s /v %s /t REG_DWORD /d %d /F" wide $cmd3 = "add HKCU\\%s /v %s /t REG_DWORD /d %d /F" wide $cmd4 = "\"%s\" a -y -ep -k -r -s -ibck -df -m0 -hp%s -ri1:%d \"%s\" \"%s\"" wide $s1 = "\\hansom.jpg" wide $s2 = "HansomMain" fullword ascii wide $s3 = "ExtractHansom" fullword ascii wide $s4 = "Hansom2008" fullword ascii $s5 = ".hansomkey" fullword wide $s6 = ".hansom" fullword wide $s7 = /Ransom_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( 2 of ( $cmd* ) and 2 of ( $s* ) ) or ( 4 of ( $s* ) and 1 of ( $cmd* ) ) or 6 of them ) } rule DITEKSHEN_MALWARE_Win_Aliencrypter : FILE { meta: description = "Detects AlienCrypter injector/downloader/obfuscator" author = "ditekSHen" id = "af9e785a-bdec-5d3e-9a50-56f7f1a0507e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2022-L2036" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "28a2a6e6d58fd6efbb5753a7be5b621a3eac546d45f9481b9dd2641cbe70b547" score = 75 quality = 75 tags = "FILE" strings: $s1 = ".AlienRunPE." ascii wide $s2 = "RunAsNewUser_RunDLL" fullword wide $s3 = { 00 50 52 4f 43 45 53 53 5f 53 55 53 50 45 4e 44 5f 52 45 53 55 4d 45 00 64 6e 6c 69 62 2e 50 45 00 } $s4 = { 2e 41 6c 69 65 6e 52 75 6e 50 45 00 50 52 4f 43 45 53 53 5f 54 45 52 4d 49 4e 41 54 45 00 } $s5 = "@@@http" wide $resp1 = "

@@@77,90," ascii wide $resp2 = "

@@@HH,JA," ascii wide condition: ( uint16( 0 ) == 0x5a4d and 3 of them ) or ( 1 of ( $resp* ) and 2 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Ficker : FILE { meta: description = "Detects Ficker infostealer" author = "ditekSHen" id = "1cfeea86-e8bf-50fb-ba08-435d7a14a913" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2038-L2055" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "adcc0ffc0e1ded36dc41c22d10d2ea293d5740484203892bcecf89a5f4001452" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.Ficker" strings: $s1 = "JNOde\\" ascii $s2 = "\"SomeNone" fullword ascii $s3 = "kindmessage" fullword ascii $s4 = "..\\\\?\\.\\UNC\\Windows stdio in console mode does not support writting non-UTF-8 byte sequences" ascii $s5 = "..\\\\?\\.\\UNC\\Windows stdio in console mode does not support writing non-UTF-8 byte sequences" ascii $s6 = "(os error other os erroroperation interrruptedwrite zerotimed" ascii $s7 = "(os error other os erroroperation interruptedwrite zerotimed" ascii $s8 = "nPipeAlreadyExistsWouldBlockInvalidInputInvalidDataTimedOutWriteZeroInterruptedOtherN" fullword ascii $s9 = "_matherr(): %s in %s(%g, %g) (retval=%g)" ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_Xorist : FILE { meta: description = "Detects Xorist ransomware" author = "ditekSHen" id = "76119441-343d-51c3-90eb-9d54c80a983d" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2057-L2078" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b34e3fa065cabcd8d26908866e53ff599631128e1da884e42a2e63d890879eaa" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Ransomware.Xorist" strings: $x1 = { 00 4d 00 41 00 47 00 45 00 0b 00 50 00 55 00 53 00 53 00 59 00 4c 00 49 00 43 00 4b 00 45 00 52 00 } $x2 = { 30 70 33 6e 53 4f 75 72 63 33 20 58 30 72 31 35 37 2c 20 6d 6f 74 68 65 72 66 75 63 6b 65 72 21 00 70 75 73 73 79 6c 69 63 6b 65 72 00 2e 62 6d 70 00 2e 00 2e 2e 00 6f 70 65 6e 00 2e 65 78 65 } $s1 = "\\shell\\open\\command" fullword ascii $s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword ascii $s3 = "CRYPTED!" fullword ascii $s4 = "Attention!" fullword ascii $s5 = "Password:" fullword ascii $s6 = { 43 6f 6d 53 70 65 63 00 2f 63 20 64 65 6c 20 22 00 22 20 3e 3e 20 4e 55 4c } condition: uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or 5 of ( $s* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_PYSA : FILE { meta: description = "Detects PYSA/Mespinoza ransomware" author = "ditekSHen" id = "3a3fad6a-46bc-51dc-9723-4412034ca442" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2080-L2100" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e614b827bd8d065e94852fed01497c785bf90c52c3624aff9939b3f40ecf96a4" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Ransomware.PYSA" strings: $s1 = "%s\\Readme.README" fullword wide $s2 = "Every byte on any types of your devices was encrypted" ascii $s3 = { 6c 65 67 61 6c 6e 6f 74 69 63 65 74 65 78 74 00 (50|70) (59|79) (53|73) (41|61) } $s4 = { 6c 65 67 61 6c 6e 6f 74 69 63 65 63 61 70 74 69 6f 6e 00 00 (50|70) (59|79) (53|73) (41|61) } $s5 = { 2e 62 61 74 00 00 6f 70 65 6e 00 00 00 00 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 50 6f 6c 69 63 69 65 73 5c 53 79 73 74 65 6d 00 00 00 } $f1 = ".?AVPK_EncryptorFilter@CryptoPP@@" ascii $f2 = ".?AV?$TF_EncryptorImpl@" ascii $f3 = "@VTF_EncryptorBase@CryptoPP@@" ascii condition: uint16( 0 ) == 0x5a4d and all of ( $f* ) and 3 of ( $s* ) } rule DITEKSHEN_MALWARE_Win_Polar : FILE { meta: description = "Detects Polar ransomware" author = "ditekSHen" id = "ab4e4478-5417-5918-b5df-5b6ffe7438a9" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2102-L2123" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "4f05a8ace9a03d02f54f0ebdd5349d1d1b23db8e34aa71edd44eebf02b88745c" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Ransomware.Polar" strings: $s1 = "Encrypt Failed ! ErrorMessage :" wide $s2 = ".locked" fullword wide $s3 = ".cryptd" fullword wide $s4 = "$SysReset" fullword wide $s5 = "Polar.Properties.Resources" ascii wide $s6 = "AES_EnDecryptor.Basement" fullword ascii $s7 = "RunCMDCommand" fullword ascii $s8 = "killerps_list" fullword ascii $s9 = "clearlog" fullword ascii $s10 = "encryptFile" fullword ascii $s11 = "changeBackPictrue" fullword ascii $pdb1 = "\\Ransomware_ALL_encode\\dir_file\\obj\\x86\\Release\\Encode.pdb" ascii $pdb2 = "\\Ransomware_ALL_encode\\dir_file\\obj\\x64\\Release\\Encode.pdb" ascii condition: uint16( 0 ) == 0x5a4d and ( 8 of ( $s* ) or ( 1 of ( $pdb* ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Poullight : FILE { meta: description = "Detects Poullight infostealer" author = "ditekSHen" id = "c80143f8-9c44-5e96-b1ff-2adb4bf031e4" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2155-L2176" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e60ffb10892d35664a088d69c965e130f87bb1a59c257d484bdfe5085074bccd" score = 75 quality = 75 tags = "FILE" snort2_sid = "920074-920075" snort3_sid = "920074-920075" clamav_sig = "MALWARE.Win.Trojan.Poullight" strings: $s1 = "zipx" fullword wide $s2 = "{0}Windows Defender.exe" fullword wide $s3 = "pll_test" fullword wide $s4 = "loginusers.vdf" wide $s5 = "Stealer by Nixscare" wide $s6 = "path_lad" fullword ascii $s7 = "" ascii $s8 = "Poullight.Properties" ascii $s9 = "" fullword wide $s10 = "{0}processlist.txt" fullword wide $s11 = "{0}Browsers\\Passwords.txt" fullword wide condition: uint16( 0 ) == 0x5a4d and 7 of them } rule DITEKSHEN_MALWARE_Linux_Xorddos : FILE { meta: description = "Detects XORDDoS" author = "ditekSHen" id = "0ca581c3-bce2-5b4f-8146-9aeb49b88813" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2209-L2220" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "192378d903316c1d80b064e78feb6ed9d2ffc9e6c7dc0c8df223d83d17e4e8d9" score = 75 quality = 75 tags = "FILE" strings: $s1 = "for i in `cat /proc/net/dev|grep :|awk -F: {'print $1'}`; do ifconfig $i up& done" fullword ascii $s2 = "cp /lib/libudev.so /lib/libudev.so.6" fullword ascii $s3 = "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab" fullword ascii $s4 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)" fullword ascii condition: uint32( 0 ) == 0x464c457f and 3 of them } rule DITEKSHEN_MALWARE_Win_Blacknet : FILE { meta: description = "Detects BlackNET RAT" author = "ditekSHen" id = "c1ece46a-3cd9-54aa-a105-1c5b19357a7e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2222-L2250" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "64e00325a5a6a595067c6133800e73d943f45e2783475c24ed4a9bd9937fe0d6" score = 75 quality = 75 tags = "FILE" snort2_sid = "920079-920082" snort3_sid = "920079-920082" clamav_sig = "MALWARE.Win.Trojan.BlackNET" strings: $s1 = "SbieCtrl" fullword wide $s2 = "SpyTheSpy" fullword wide $s3 = "\\BlackNET.dat" fullword wide $s4 = "StartDDOS" fullword wide $s5 = "UDPAttack" fullword wide $s6 = "ARMEAttack" fullword wide $s7 = "TCPAttack" fullword wide $s8 = "HTTPGetAttack" fullword wide $s9 = "RetriveLogs" fullword wide $s10 = "StealPassword" fullword wide $s11 = "/create /f /sc ONSTART /RL HIGHEST /tn \"'" fullword wide $b1 = "DeleteScript|BN|" fullword wide $b2 = "|BN|Online" fullword wide $b3 = "NewLog|BN|" fullword wide $cnc1 = "/getCommand.php?id=" fullword wide $cnc2 = "/upload.php?id=" fullword wide $cnc3 = "connection.php?data=" fullword wide $cnc4 = "/receive.php?command=" fullword wide condition: uint16( 0 ) == 0x5a4d and ( 9 of ( $s* ) or all of ( $cnc* ) or all of ( $b* ) or 12 of them ) } rule DITEKSHEN_MALWARE_Win_Stormkitty : FILE { meta: description = "Detects StormKitty infostealer" author = "ditekSHen" id = "a061a1c0-9ed5-5048-85df-4d7ed6995e92" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2252-L2269" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "5d139aad6932f177cd14e0356f822ad68ddc659ea4fabd2fd2fbcbc8bad58888" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.StormKitty" strings: $x1 = "\\ARTIKA\\Videos\\Chrome-Password-Recovery" ascii $x2 = "https://github.com/LimerBoy/StormKitty" fullword ascii $x3 = "StormKitty" fullword ascii $s1 = "GetBSSID" fullword ascii $s2 = "GetAntivirus" fullword ascii $s3 = "C:\\Users\\Public\\credentials.txt" fullword wide $s4 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" fullword wide $s5 = "BCrypt.BCryptGetProperty() (get size) failed with status code:{0}" fullword wide $s6 = "\"encrypted_key\":\"(.*?)\"" fullword wide condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 5 of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $x* ) ) ) } rule DITEKSHEN_MALWARE_Win_Bulz01 : FILE { meta: description = "Detects trojan loader" author = "ditekSHen" id = "4ac4125b-70f5-5cda-ae45-fd5713e25a6e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2271-L2281" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "29884dda4936016660f5d1e33ffcf97a20c7d3116483a5895a5e2a1dd4ac9e9f" score = 75 quality = 75 tags = "FILE" strings: $s1 = "DisableTrivet.dll" fullword ascii condition: uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and all of ( $s* ) and ( pe.exports ( "Ordinal" ) or pe.exports ( "Chechako" ) or pe.exports ( "Originator" ) or pe.exports ( "Repressions" ) ) } rule DITEKSHEN_MALWARE_Win_Powerpool_STG1 : FILE { meta: description = "Detects first stage PowerPool backdoor" author = "ditekSHen" id = "8531c22d-8d71-5794-b9c8-0a4cd81bb2b0" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2334-L2361" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "9ab00d6e3007743a8bb30fbcdb435ac49101b52face55549ae454c64345caff9" score = 75 quality = 75 tags = "FILE" snort2_sid = "920088" snort3_sid = "920086" clamav_sig = "MALWARE.Win.Trojan.PowerPool-STG-1" strings: $s1 = "cmd /c powershell.exe $PSVersionTable.PSVersion > \"%s\"" fullword wide $s2 = "cmd /c powershell.exe \"%s\" > \"%s\"" fullword wide $s3 = "rar.exe a -r %s.rar -ta%04d%02d%02d%02d%02d%02d -tb%04d%02d%02d%02d%02d%02d" fullword wide $s4 = "MyDemonMutex%d" fullword wide $s5 = "MyScreen.jpg" fullword wide $s6 = "proxy.log" fullword wide $s7 = "myjt.exe" fullword wide $s8 = "/?id=%s&info=%s" fullword wide $s9 = "auto.cfg" fullword ascii $s10 = "Mozilla/5.0 (Windows NT 6.1; WOW64)" fullword wide $s11 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)" fullword wide $s12 = "CMD COMMAND EXCUTE ERROR!" fullword ascii $c1 = "run.afishaonline.eu" fullword wide $c2 = "home.Sports-Collectors.com" fullword wide $c3 = "about.Sports-Collectors.com" fullword $c4 = "179.43.158.15" fullword wide $c5 = "185.227.82.35" fullword wide condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $c* ) and 5 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Powerpool_STG2 : FILE { meta: description = "Detects second stage PowerPool backdoor" author = "ditekSHen" id = "1a059900-3292-5419-a143-caea3e710191" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2363-L2395" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b80712bab281dbde816e2eda6ab1b4a9e21be26578fb755a1e1e1635675aa911" score = 75 quality = 73 tags = "FILE" snort2_sid = "920089-920091" snort3_sid = "920087-920089" clamav_sig = "MALWARE.Win.Trojan.PowerPool-STG-2" strings: $s1 = "write info fail!!! GetLastError-->%u" fullword ascii $s2 = "LookupAccountSid Error %u" fullword ascii $s3 = "Mozilla/4.0 (compatible; )" fullword ascii $s4 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; SE)" fullword ascii $s5 = "Content-Disposition: form-data; name=\"%s\"" fullword ascii $s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii $s7 = "Content-Type: multipart/form-data; boundary=--MULTI-PARTS-FORM-DATA-BOUNDARY" fullword ascii $s8 = "in Json::Value::find" fullword ascii $s9 = "in Json::Value::resolveReference" fullword ascii $s10 = "in Json::Value::duplicateAndPrefixStringValue" fullword ascii $s11 = ".?AVLogicError@Json@@" fullword ascii $s12 = ".?AVRuntimeError@Json@@" fullword ascii $s13 = "http:\\\\82.221.101.157:80" ascii $s14 = "http://172.223.112.130:80" ascii $s15 = "http://172.223.112.130:443" ascii $s16 = "http://info.newsrental.net:80" ascii $s17 = "%s|%I64d" ascii $s18 = "open internet failed..." ascii $s19 = "connect failed..." ascii $s20 = "handle not opened..." ascii $s21 = "corrupted regex pattern" fullword ascii $s22 = "add cookie failed..." ascii condition: uint16( 0 ) == 0x5a4d and 14 of them } rule DITEKSHEN_MALWARE_Win_Egregor : FILE { meta: description = "Detects Egregor ransomware variants" author = "ditekSHen" id = "2e24d4ec-39c2-5148-80a1-04f96bc8b477" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2397-L2434" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "d39a7bf89a7574f7dfe56db78c8cdbbee97782f829805d4ee87fd9f1635154cd" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Ransomware.Egregor" strings: $s1 = "C:\\Logmein\\{888-8888-9999}\\Logmein.log" fullword wide $p1 = "--deinstall" fullword wide $p2 = "--del" fullword wide $p3 = "--exit" fullword wide $p4 = "--kill" fullword wide $p5 = "--loud" fullword wide $p6 = "--nooperation" fullword wide $p7 = "--nop" fullword wide $p8 = "--skip" fullword wide $p9 = "--useless" fullword wide $p10 = "--yourmommy" fullword wide $p11 = "-passegregor" ascii wide $p12 = "-peguard" ascii wide $p13 = "--nomimikatz" ascii wide $p14 = "--multiproc" ascii wide $p15 = "--killrdp" ascii wide $p16 = "--nonet" ascii wide $p17 = "--norename" ascii wide $p18 = "--greetings" ascii wide condition: ( uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and ( ( all of ( $s* ) and 1 of ( $p* ) ) or ( 2 of them and filesize < 1000KB and for any i in ( 0 .. pe.number_of_sections ) : ( ( pe.sections [ i ] . name == ".00cfg" ) ) ) ) ) or 8 of ( $p* ) } rule DITEKSHEN_MALWARE_Win_Redlinedropperexe : FILE { meta: description = "Detects executables dropping RedLine infostealer" author = "ditekSHen" id = "364ba540-60a5-5e1b-bb21-505a442eabb6" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2461-L2484" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "cd1fb4a1d0883221dbdcc519db7f54b0f7285e8a19201dbc586c2520e8086bc2" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.RedLineDropper-EXE" strings: $s1 = "Wizutezinod togeto0Rowadufevomuki futenujilazem jic lefogatenezinor" fullword wide $s2 = "6Tatafamobevofaj bizafoju peyovavacoco lizine kezakajuj" fullword wide $s3 = "Lawuherusozeru kucu zam0Zorizeyuk lepaposupu gala kinarusot ruvasaxehuwo" fullword wide $s4 = "ClearEventLogW" fullword ascii $s5 = "ProductionVersion" fullword wide $s6 = "Vasuko)Yugenizugilobo toxocivoriye yexozoyohuzeb" wide $s7 = "Yikezevavuzus gucajanesan#Rolapucededoxu xewulep fuwehofiwifi" wide condition: uint16( 0 ) == 0x5a4d and ( pe.exports ( "_fgeek@8" ) and 2 of them ) or ( 2 of them and for any i in ( 0 .. pe.number_of_sections ) : ( ( pe.sections [ i ] . name == ".rig" ) ) ) } rule DITEKSHEN_MALWARE_Win_Nibiru : FILE { meta: description = "Detects Nibiru ransomware" author = "ditekSHen" id = "78c3bf75-1ab3-5f88-ba4b-d5a0a906d57c" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2486-L2504" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f3718e9091b09e0f47ecd6715a3a2c160ede6ab9fb144e7ed115dd5a25c8e379" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Ransomware.Nibiru" strings: $s1 = ".encrypt" fullword wide $s2 = "crypted" fullword wide $s3 = ".Nibiru" fullword wide $s4 = "Encryption Complete" fullword wide $s5 = "All your files,documents,important datas,mp4,mp3 and anything valuable" ascii $s6 = "EncryptOrDecryptFile" fullword ascii $s7 = "get_hacker" ascii $s8 = "/C choice /C Y /N /D Y /T 3 & Del \"" fullword wide $s9 = "Once You pay,you get the KEY to decrypt files" ascii $pdb = "\\Projects\\Nibiru\\Nibiru\\obj\\x86\\Release\\Nibiru.pdb" ascii condition: uint16( 0 ) == 0x5a4d and ( 7 of them or ( $pdb and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Medusalocker : FILE { meta: description = "Detects MedusaLocker ransomware" author = "ditekshen" id = "06b7645f-228d-5ec1-9b82-88caee447a5c" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2506-L2537" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0e2a0a9f12f550a5c6a11731710e0dc2c2e26d17f43d2385bf6e298518631771" score = 75 quality = 73 tags = "FILE" clamav_sig = "MALWARE.Win.Ransomware.MedusaLocker" strings: $x1 = "\\MedusaLockerInfo\\MedusaLockerProject\\MedusaLocker\\Release\\MedusaLocker.pdb" ascii $x2 = "SOFTWARE\\Medusa" wide $x3 = "=?utf-8?B?0RFQctTF0YDQcNC60IXQvdC+IEludGVybmV0IED4cGxvseVyIDEz?=" ascii $s1 = "Recovery_Instructions.mht" fullword wide $s2 = "README_LOCK.TXT" fullword wide $s3 = "C:\\Users\\Public\\Desktop" wide $s4 = "[LOCKER] " wide $s5 = "TmV3LUl0ZW0gJ2" ascii $s6 = "=20" ascii $s7 = "LIST OF ENCRYPTED FILES" ascii $s8 = "KEY.FILE" ascii $cmd1 = { 2f 00 63 00 20 00 64 00 65 00 6c 00 20 00 00 00 20 00 3e 00 3e 00 20 00 4e 00 55 00 4c 00 } $cmd2 = "vssadmin.exe delete" wide nocase $cmd3 = "bcdedit.exe /set {default}" wide $cmd4 = "wbadmin delete systemstatebackup" wide nocase $mut1 = "{8761ABBD-7F85-42EE-B272-A76179687C63}" fullword wide $mut2 = "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" fullword wide $mut3 = "{6EDD6D74-C007-4E75-B76A-E5740995E24C}" fullword wide $ext1 = { 2e 00 52 00 65 00 61 00 64 00 49 00 6e 00 73 00 74 00 72 00 75 00 63 00 74 00 69 00 6f 00 6e 00 73 00 00 00 00 00 00 00 2e 00 6b 00 65 00 76 00 65 00 72 00 73 00 65 00 6e } $ext2 = ".exe,.dll,.sys,.ini,.lnk,.rdp,.encrypted" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and ( 4 of ( $s* ) or 1 of ( $mut* ) ) ) or 6 of ( $s* ) or ( 1 of ( $mut* ) and 2 of ( $cmd* ) ) or ( 1 of ( $ext* ) and 5 of them ) ) } rule DITEKSHEN_MALWARE_Win_Ransomexx : FILE { meta: description = "Detects RansomEXX ransomware" author = "ditekshen" id = "4d1294de-d73c-5f9c-adb7-18ce5b5aca9f" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2539-L2555" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "351398d89b847b3439fa58b7aab50f3c6e48be27877d3f8b85cc78e994413ecc" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Ransomware.RansomEXX" strings: $id = "ransom.exx" ascii $s1 = "!TXDOT_READ_ME!.txt" fullword wide $s2 = "debug.txt" fullword wide $s3 = ".txd0t" fullword wide $s4 = "crypt_detect" fullword wide $s5 = "powershell.exe" fullword wide $s6 = "cipher.exe" fullword ascii wide $s7 = "?ReflectiveLoader@@" ascii condition: uint16( 0 ) == 0x5a4d and ( ( $id and 3 of ( $s* ) ) or all of ( $* ) ) } rule DITEKSHEN_MALWARE_Win_Quasarstealer : FILE { meta: description = "Detects Quasar infostealer" author = "ditekshen" id = "d0d532fe-bd0a-560a-8570-f6038d694338" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2557-L2572" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "4b6ab49992db4d7bf4404d51b0ef1773249de89545ec31176ad45d00803ba703" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.QuasarStealer" strings: $s1 = "PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null" fullword ascii $s2 = "DQuasar.Common, Version=1.4.0.0, Culture=neutral, PublicKeyToken=null" fullword ascii $s3 = "Process already elevated." fullword wide $s4 = "get_PotentiallyVulnerablePasswords" fullword ascii $s5 = "GetKeyloggerLogsDirectory" ascii $s6 = "set_PotentiallyVulnerablePasswords" fullword ascii $s7 = "BQuasar.Client.Extensions.RegistryKeyExtensions+" ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_Bandook : FILE { meta: description = "Detects Bandook backdoor" author = "ditekshen" id = "c74bd688-c79e-5939-93a8-c2cd9f2cd60e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2676-L2705" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "bff09f769aae890d81efe9926cc8ce85c1caa4eeeb6bc7d2321d2d906ac8d6cf" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.Bandook" strings: $s1 = "\"%sLib\\dpx.pyc\" \"%ws\" \"%ws\" \"%ws\" \"%ws\" \"%ws\"" fullword wide $s2 = "%s\\usd\\dv-%s.dat" fullword ascii $s3 = "%sprd.dat" fullword ascii $s4 = "%sfile\\shell\\open\\command" fullword ascii $s5 = "explorer.exe , %s" fullword ascii $f1 = "CaptureScreen" fullword ascii $f2 = "StartShell" fullword ascii $f3 = "ClearCred" fullword ascii $f4 = "GrabFileFromDevice" fullword ascii $f5 = "PutFileOnDevice" fullword ascii $f6 = "ChromeInject" fullword ascii $f7 = "StartFileMonitor" fullword ascii $f8 = "DisableMouseCapture" fullword ascii $f9 = "StealUSB" fullword ascii $f10 = "DDOSON" fullword ascii $f11 = "InstallMac" fullword ascii $f12 = "SendCam" fullword ascii $x1 = "RTC-TGUBP" fullword ascii $x2 = "AVE_MARIA" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 6 of ( $f* ) or ( 2 of ( $s* ) and 3 of ( $f* ) ) or ( all of ( $x* ) and ( 2 of ( $f* ) or 3 of ( $s* ) ) ) ) } rule DITEKSHEN_MALWARE_Win_Kimsuky : FILE { meta: description = "Detects Kimsuky backdoor" author = "ditekshen" id = "6216b874-13f1-5283-9d17-90b7ca6996f8" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2707-L2730" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "9f9e64a9cfb3f61bc6b355035c5f0644e4750b740e05cb557c6183c7acfc5a19" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.Kimsuky" strings: $s1 = "Win%d.%d.%dx64" fullword ascii $s2 = ".zip" fullword ascii $s3 = ".enc" fullword ascii $s4 = "&p2=a" fullword ascii $s5 = "Content-Disposition: form-data; name=\"binary\"; filename=\"" fullword ascii $s6 = "%s/?m=a&p1=%s&p2=%s-%s-v%d" fullword ascii $s7 = "/?m=b&p1=" fullword ascii $s8 = "/?m=c&p1=" fullword ascii $s9 = "/?m=d&p1=" fullword ascii $s10 = "http://%s/%s/?m=e&p1=%s&p2=%s&p3=%s" fullword ascii $s11 = "taskkill.exe /im iexplore.exe /f" fullword ascii $s12 = "GetParent" fullword ascii $s13 = "DllRegisterServer" fullword ascii $dll1 = "AutoUpdate.dll" fullword ascii $dll2 = "dropper-ie64.dll" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $dll* ) and 7 of ( $s* ) ) or ( 11 of ( $* ) ) ) } rule DITEKSHEN_MALWARE_Win_Salfram : FILE { meta: description = "Detects Salfram executables" author = "ditekSHen" id = "323e1c8e-2184-5831-9af5-a460c55fbf7c" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2755-L2766" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "19d7934727baa870dcd3ec77ba596cd64e49763477ba3feb7baec5ab6d3866d3" score = 75 quality = 75 tags = "FILE" snort2_sid = "920085-920087" snort3_sid = "920085" clamav_sig = "MALWARE.Win.Trojan.Salfram" strings: $s1 = "!This Salfram cannot be run in DOS mode." fullword ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Hawkeyev9 { meta: description = "Detects HawkEyeV9 payload" author = "ditekshen" id = "ca59aa45-fb55-5f9a-a224-8bd2b72ce5ac" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2768-L2793" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "d24111930dd0230c01963a90c9fbbc0a0a71df170c2ca116bb329e6158cb681c" score = 75 quality = 75 tags = "" clamav_sig = "MALWARE.Win.Trojan.HawkEyeV9" strings: $id1 = "HawkEye Keylogger - Reborn v9 - {0} Logs - {1} \\ {2}" wide $id2 = "HawkEye Keylogger - Reborn v9{0}{1} Logs{0}{2} \\ {3}{0}{0}{4}" wide $str1 = "_PasswordStealer" ascii $str2 = "_KeyStrokeLogger" ascii $str3 = "_ScreenshotLogger" ascii $str4 = "_ClipboardLogger" ascii $str5 = "_WebCamLogger" ascii $str6 = "_AntiVirusKiller" ascii $str7 = "_ProcessElevation" ascii $str8 = "_DisableCommandPrompt" ascii $str9 = "_WebsiteBlocker" ascii $str10 = "_DisableTaskManager" ascii $str11 = "_AntiDebugger" ascii $str12 = "_WebsiteVisitorSites" ascii $str13 = "_DisableRegEdit" ascii $str14 = "_ExecutionDelay" ascii $str15 = "_InstallStartupPersistance" ascii condition: int16 ( 0 ) == 0x5a4d and ( 1 of ( $id* ) or 5 of ( $str* ) ) } rule DITEKSHEN_MALWARE_Win_Hyperbro : FILE { meta: description = "Detects HyperBro (class names) payload" author = "ditekSHen" id = "539b796d-297b-5e2f-84df-282ceaa57bd4" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2795-L2813" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f6e86ef963de885e0bf92ead075e265618c0745104d223302edd824d409c45cd" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.HyperBro" strings: $s1 = "VTClipboardInfo" ascii wide $s2 = "VTClipboardMgr" ascii wide $s3 = "VTFileRename" ascii wide $s4 = "VTFileRetime" ascii wide $s5 = "VTKeyboardInfo" ascii wide $s6 = "VTKeyboardMgr" ascii wide $s7 = "VTRegeditKeyInfo" ascii wide $s8 = "VTRegeditMgr" ascii wide $s9 = "VTRegeditValueInfo" ascii wide $s10 = "VTFileDataRes" ascii wide condition: uint16( 0 ) == 0x5a4d and 9 of them } rule DITEKSHEN_MALWARE_Linux_UNK01 : FILE { meta: description = "Detects unknown/unidentified Linux malware" author = "ditekSHen" id = "24c6ff35-9378-5a6b-90d1-9740917b1b72" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2815-L2836" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "8bb4822c1c7e0f52726ecafafa696d83c741257587f351360c5295163c245450" score = 75 quality = 75 tags = "FILE" strings: $f1 = "%sresponse.php?status" ascii $f2 = "%supstream.php?mid=%s&os=%s" ascii fullword $f3 = "%supstream.php?tid=%" ascii $f4 = "%sindex.php?token=%.32s&flag=%d&name=%s" ascii fullword $f5 = "%sactive_off.php?id=%d&uniqu=%d" ascii fullword $s1 = "lock:%i usable num:%i n:%i" fullword ascii $s2 = "tid:%.*s tNumber:%i" fullword ascii $s3 = "init.php" fullword ascii $s4 = "mod_drone" fullword ascii $s5 = "new_mid" fullword ascii $s6 = "&exists[]=" fullword ascii $s7 = "&mod[]=" fullword ascii $s8 = "shutdown" fullword ascii $s9 = "&mac[]=%02X%02X%02X%02X%02X%02X" fullword ascii condition: uint16( 0 ) == 0x457f and ( 3 of ( $f* ) or 6 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Linux_UNK02 : FILE { meta: description = "Detects unknown/unidentified Linux malware" author = "ditekSHen" id = "6e62df0d-d329-5e52-af74-2a1f19dc4cca" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2838-L2852" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "4cde21932c27fe3c08495f557b5e086b1fb668d8b5508249891828b9ed48edd4" score = 75 quality = 75 tags = "FILE" strings: $rf1 = "[]A\\A]A^A_" ascii $rf2 = "[A\\A]A^A_]" ascii $f1 = "/bin/basH" ascii fullword $f2 = "/proc/seH" ascii fullword $f3 = "/dev/ptsH" ascii fullword $f4 = "pqrstuvwxyzabcde" ascii fullword $f5 = "libnss_%s.so.%d.%d" ascii fullword condition: uint16( 0 ) == 0x457f and ( all of ( $f* ) and #rf1 > 3 and #rf2 > 3 ) } rule DITEKSHEN_MALWARE_Win_Itranslatordll : FILE { meta: description = "Detects iTranslator DLL payload" author = "ditekSHen" id = "df05da78-3626-5eb5-81a2-a93fba844484" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2876-L2892" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ca0479efd241058f358553b6382a1987a5b4c069965f4adb88cd2f3fc4bef21a" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.iTranslator_DLL" strings: $d1 = "system32\\drivers\\%S.sys" fullword wide $d2 = "\\windows\\system32\\winlogon.exe" fullword ascii $d3 = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\%s" fullword wide $d4 = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\webssx" fullword wide $d5 = "\\Device\\CtrlSM" fullword wide $d6 = "\\DosDevices\\CtrlSM" fullword wide $d7 = "\\driver_wfp\\CbFlt\\Bin\\CbFlt.pdb" ascii $d8 = ".php" ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Caspertroy : FILE { meta: description = "Detects CasperTroy payload" author = "ditekSHen" id = "822c3231-60ba-5e60-8df8-06dea80b318a" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2919-L2931" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ce070b1e6279ef9fa47f84da7c5166cd93b3e7a0f95541ae14c048b2af9bc431" score = 75 quality = 75 tags = "FILE" strings: $s1 = "DllTroy.dll" fullword ascii $s2 = "Content-Disposition: form-data; name=\"image\"; filename=\"title.gif\"" fullword ascii $s3 = "Content-Disposition: form-data; name=\"COOKIE_ID\"" fullword ascii $s4 = "Content-Disposition: form-data; name=\"PHP_SESS_ID\"" fullword ascii $s5 = "Content-Disposition: form-data; name=\"SESS_ID\"" fullword ascii condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_MALWARE_Win_Rasftuby : FILE { meta: description = "Detects Rasftuby/DarkCrystal" author = "ditekSHen" id = "908624a8-0068-5512-a5d0-77ce1f4efd80" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2933-L2950" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b769c1986d23173cf8a8a3c8a14d388a7c0327e46d936fc97c449dc55f2a5575" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.DarkCrystal.RAT-Rasftuby" strings: $s1 = "/DCRS/main.php?data=active" fullword ascii wide $s2 = "/socket.php?type=__ds_" ascii wide $s3 = "/uploader.php" fullword ascii wide $s4 = "del \\\"%USERPROFILE%\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\System.lnk\\\"" fullword ascii wide $s5 = "Host:{0},Port:{1},User:{2},Pass:{3}" fullword ascii wide $s6 = "keyloggerstart_status" fullword ascii wide $s7 = "keyloggerstop_status" fullword ascii wide $s8 = "[PRINT SCREEN]" fullword ascii wide $s9 = "DCS.Internal" ascii condition: uint16( 0 ) == 0x5a4d and 5 of ( $s* ) } rule DITEKSHEN_MALWARE_Win_Protonbot : FILE { meta: description = "Detects ProtonBot loader" author = "ditekSHen" id = "b0d08378-0297-5e70-99f1-1dc0fec6fa01" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2952-L2969" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b511dfd47109d36ffc7fcb23b49779e1164d50a28061ab724d7a2c744ac23ac8" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.ProtonBot" strings: $x1 = "\\PROTON\\Release\\build.pdb" ascii $x2 = "\\proton\\proton bot\\json.hpp" wide $x3 = "proton bot" ascii wide $s1 = "endptr == token_buffer.data() + token_buffer.size()" fullword wide $s2 = "ranges.size() == 2 or ranges.size() == 4 or ranges.size() == 6" fullword wide $s3 = "ref_stack.back()->is_array() or ref_stack.back()->is_object()" fullword wide $s4 = "ktmw32.dll" fullword ascii $s5 = "@detail@nlohmann@@" ascii $s6 = "urlmon.dll" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( all of ( $s* ) and 1 of ( $x* ) ) ) } rule DITEKSHEN_MALWARE_Win_Imminentrat : FILE { meta: description = "Detects ImminentRAT" author = "ditekSHen" id = "99831b32-d8a0-5814-bf41-491f607ee825" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2971-L2994" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f959fd28e818b17c962fcd5bb99fa5ac0058f22494950e0200f139703f3e756a" score = 75 quality = 75 tags = "FILE" strings: $x1 = "abuse@imminentmethods.net" ascii $x2 = "Imminent-Monitor-" ascii $x3 = "AddressChangeListener" fullword ascii $x4 = "SevenZipHelper" fullword ascii $x5 = "WrapNonExceptionThrows" fullword ascii $s1 = "_ENABLE_PROFILING" wide $s2 = "Anti-Virus: {0}" wide $s3 = "File downloaded & executed" wide $s4 = "Chat - You are speaking with" wide $s5 = "\\Imminent\\Plugins" wide $s6 = "\\Imminent\\Path.dat" wide $s7 = "\\Imminent\\Geo.dat" wide $s8 = "DisableTaskManager = {0}" wide $s9 = "This client is already mining" wide $s10 = "Couldn't get AV!" wide $s11 = "Couldn't get FW!" wide condition: uint16( 0 ) == 0x5a4d and ( 4 of ( $x* ) or 5 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Warzonerat : FILE { meta: description = "Detects AveMaria/WarzoneRAT" author = "ditekSHen" id = "4f3df696-280c-5f2b-9511-8cc7c9dff1d6" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2996-L3011" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "1af8b0f90b0de3287499082a6d6d9da6ed62a3110018e0c0f7149353693060b2" score = 75 quality = 75 tags = "FILE" strings: $s1 = "RDPClip" fullword wide $s2 = "Grabber" fullword wide $s3 = "Ave_Maria Stealer OpenSource" wide $s4 = "\\MidgetPorn\\workspace\\MsgBox.exe" wide $s5 = "@\\cmd.exe" wide $s6 = "/n:%temp%\\ellocnak.xml" wide $s7 = "Hey I'm Admin" wide $s8 = "warzone160" fullword ascii condition: uint16( 0 ) == 0x5a4d and 5 of ( $s* ) } rule DITEKSHEN_MALWARE_Win_Karaganycore : FILE { meta: description = "Detects Karagany/xFrost core plugin" author = "ditekSHen" id = "c066805b-9373-5524-aff9-d16cd59f5a24" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3013-L3027" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "cde96ac6477fda1312ce4f7532018c9f11df7d39c40155d10bdde0e3d84c6d57" score = 75 quality = 75 tags = "FILE" strings: $s1 = "127.0.0.1" fullword ascii $s2 = "port" fullword ascii $s3 = "C:\\Windows\\System32\\Kernel32.dll" fullword ascii $s4 = "kernel32.dll" fullword ascii $s5 = "http" ascii $s6 = "Move" fullword ascii $s7 = " 1 and 4 of ( $s* ) } rule DITEKSHEN_MALWARE_Win_STOP : FILE { meta: description = "Detects STOP ransomware" author = "ditekSHen" id = "e928d917-a9d9-5830-938a-59b62608e84c" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3286-L3309" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "61f7e7c1139c56088b2f58b78ae132ffcfef0f931c15b67ea775b0d5e51d189d" score = 75 quality = 73 tags = "FILE" snort2_sid = "920113" snort3_sid = "920111" clamav_sig = "MALWARE.Win.Ransomware.STOP" strings: $x1 = "C:\\SystemID\\PersonalID.txt" fullword wide $x2 = "/deny *S-1-1-0:(OI)(CI)(DE,DC)" wide $x3 = "e:\\doc\\my work (c++)\\_git\\encryption\\" ascii wide nocase $s1 = "\" --AutoStart" fullword ascii wide $s2 = "--ForNetRes" fullword wide $s3 = "--Admin" fullword wide $s4 = "%username%" fullword wide $s5 = "?pid=" fullword wide $s6 = /&first=(true|false)/ fullword wide $s7 = "delself.bat" ascii $mutex1 = "{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}" fullword ascii $mutex2 = "{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}" fullword ascii $mutex3 = "{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( 2 of ( $x* ) and 1 of ( $mutex* ) ) or ( all of ( $x* ) ) or ( 6 of ( $s* ) and ( 1 of ( $x* ) or 1 of ( $mutex* ) ) ) or ( 9 of them ) ) } rule DITEKSHEN_MALWARE_Win_Parallaxrat : FILE { meta: description = "Detects ParallaxRAT" author = "ditekSHen" id = "e602b28f-ae5d-52af-b1c5-5c41776dd4c5" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3311-L3328" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "7fd94dee44079b595b906f1687f44b51b8cebabbeb0900563b8d4fcc0e46bdd0" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.ParallaxRAT" strings: $s1 = "[Clipboard End]" fullword wide $s2 = "[Ctrl +" fullword wide $s3 = "[Alt +" fullword wide $s4 = "Clipboard Start" wide $s5 = "(Wscript.ScriptFullName)" wide $s6 = "CSDVersion" fullword ascii $s7 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" fullword ascii $x1 = { 2e 65 78 65 00 00 84 00 00 4d 5a 90 00 } $x2 = "This program cannot be run in DOS mode" ascii condition: (( uint16( 0 ) == 0x5a4d and all of ( $s* ) ) or all of them ) } rule DITEKSHEN_MALWARE_Win_Meterpreter : FILE { meta: description = "Detects Meterpreter payload" author = "ditekSHen" id = "d72fef80-d624-5e39-963a-8d7c12eb2d9c" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3330-L3343" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "5226cd7bb2344b822ee94d75f81a523ff701778de97a32ae52c604a4855e960c" score = 75 quality = 75 tags = "FILE" strings: $s1 = "PACKET TRANSMIT" fullword ascii $s2 = "PACKET RECEIVE" fullword ascii $s3 = "\\\\%s\\pipe\\%s" fullword ascii wide $s4 = "%04x-%04x:%s" fullword wide $s5 = "server.dll" fullword ascii condition: ( uint16( 0 ) == 0x5a4d and all of them ) or ( filesize < 300KB and all of them ) } rule DITEKSHEN_MALWARE_Win_Trojan_Expresscms : FILE { meta: description = "Detects ExpressCMS" author = "ditekSHen" id = "d096db0c-05f6-5b69-9d84-0105f2182ff3" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3366-L3382" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "64d551e0c11b6394f9ae2b8fa749c36cb1b5c3f498592f95dc19fdea23c53160" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.ExpressCMS" strings: $s1 = "/click.php?cnv_id=" fullword wide $s2 = "/click.php?key=" wide $s3 = "jdlnb" fullword wide $s4 = "Gkjfdshfkjjd: dsdjdsjdhv" fullword wide $s5 = "--elevated" fullword wide $s6 = "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\%d" wide $s7 = "\\Microsoft\\Manager.exe" fullword wide $s8 = "\\Microsoft\\svchost.exe" fullword wide condition: uint16( 0 ) == 0x5a4d and 6 of them } rule DITEKSHEN_MALWARE_Win_Meterpreterstager : FILE { meta: description = "Detects Meterpreter stager payload" author = "ditekSHen" id = "dfbc37e9-13e0-55e2-a501-1005eea52b63" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3384-L3395" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0ac53a10abb1e4dd7da57872cd1779851d953127a912c31a5e411d8eb9bd07f4" score = 75 quality = 75 tags = "FILE" strings: $s1 = "PAYLOAD:" fullword ascii $s2 = "AQAPRQVH1" fullword ascii $s3 = "ws2_32" fullword ascii $s4 = "KERNEL32.dll" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of them and filesize < 100KB } rule DITEKSHEN_MALWARE_Win_Ziggy : FILE { meta: description = "Detects Ziggy ransomware" author = "ditekSHen" id = "6d2d316a-cf19-5001-bf94-842346229d76" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3397-L3421" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "103a50511971161ca673e0c8378aeca2fa7d0f6309966bbb2b70e0d039e0f196" score = 75 quality = 75 tags = "FILE" snort2_sid = "920098" snort3_sid = "920096" clamav_sig = "MALWARE.Win.Ransomware.Ziggy" strings: $id1 = "/Ziggy Info;component/mainwindow.xaml" fullword wide $id2 = "AZiggy Info, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" fullword ascii $id3 = "Ziggy Ransomware" fullword wide $id4 = "clr-namespace:Zeggy" fullword ascii $s1 = "GetCooldown" fullword ascii $s2 = "checkCommandMappings" fullword ascii $s3 = "add_OnExecuteCommand" fullword ascii $s4 = "MindLated.jpg" fullword wide $s5 = "http://fixfiles.xyz/ziggy/api/info.php?id=" fullword wide $s6 = "Reamaining time:" fullword wide $msg1 = "<:In case of no answer in 12 hours write us to this e-mail" ascii $msg2 = "Free decryption as guarantee" fullword ascii $msg3 = "# Do not try to decrypt your data using third party software, it may cause permanent data loss" ascii $msg4 = "# Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can becom" ascii condition: uint16( 0 ) == 0x5a4d and ( 3 of ( $id* ) or 4 of ( $s* ) or 3 of ( $msg* ) ) } rule DITEKSHEN_MALWARE_Win_Nworm : FILE { meta: description = "Detects NWorm/N-W0rm payload" author = "ditekSHen" id = "06546ccf-8914-5b1c-942f-99664b9ecf44" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3423-L3443" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "a1397a057422be260b5bdf1eb58571e95c259c132cc2518b39e1524a0eda9c66" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.NWorm" strings: $id1 = "N-W0rm" ascii $id2 = "N_W0rm" ascii $x1 = "pongPing" fullword wide $x2 = "|NW|" fullword wide $s1 = "runFile" fullword wide $s2 = "runUrl" fullword wide $s3 = "killer" fullword wide $s4 = "powershell" fullword wide $s5 = "wscript.exe" fullword wide $s6 = "ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File \"" fullword wide $s7 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36" fullword wide $s8 = "Start-Sleep -Seconds 1.5; Remove-Item -Path '" fullword wide condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $id* ) and ( 1 of ( $x* ) or 3 of ( $s* ) ) ) or ( all of ( $x* ) and 2 of ( $s* ) ) or 7 of ( $s* ) or 10 of them ) } rule DITEKSHEN_MALWARE_Win_Qakbot : FILE { meta: description = "Detects variants of QakBot payload" author = "ditekSHen" id = "3a3b3b6c-0969-584e-a184-7acfca3cdd42" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3445-L3457" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b64c05eb7ac03b2b4709f9979d117e4cacc617f21d0b3bf1c1be42aa18cc44cc" score = 75 quality = 73 tags = "FILE" strings: $s1 = "stager_1.dll" fullword ascii $s2 = "_vsnwprintf" fullword ascii $s3 = "DllRegisterServer" fullword ascii $s4 = "Win32_PnPEntity" fullword wide $s5 = "0>user32.dll" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Fonix : FILE { meta: description = "Detects Fonix ransomware" author = "ditekSHen" id = "d67cce49-5f4f-59f6-b2a9-9c4dd1c6c0f6" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3459-L3481" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "159b8946f7772c76271de821eb12897689bf73d96fc6a1d7c4a65cdc50b877c7" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Ransomware.Fonix" strings: $s1 = "dontcryptanyway" fullword wide $s2 = "Cpriv.key" ascii wide $s3 = "Cpub.key" ascii wide $s4 = "NetShareEnum() failed!Error: % ld" fullword wide $s5 = "

Attention!
  • DO NOT pay" wide $s6 = "Encryption Completed !!!" fullword wide $s7 = "kill process" fullword ascii $s8 = "Copy SystemID C:\\ProgramData\\SystemID" ascii $id1 = "].FONIX" fullword wide $id2 = "xinofconfig.txt" fullword ascii wide $id3 = "XINOF4MUTEX" wide $id4 = ":\\Fonix\\cryptoPP\\" ascii $id5 = "schtasks /CREATE /SC ONLOGON /TN fonix" ascii $id6 = "Ransomware\\Fonix" ascii condition: uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or 3 of ( $id* ) or ( 1 of ( $id* ) and 3 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Bobik : FILE { meta: description = "Detects Bobik infostealer" author = "ditekSHen" id = "12f14151-0c89-519d-85d3-4b4b82a950a3" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3483-L3498" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "735dcb9e04956863305ca89a43686b8e48e3b20784ae9292cfc40d1c2c09d467" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.Bobik" strings: $s1 = "@Default\\Login Data" fullword ascii $s2 = "@Default\\Cookies" fullword ascii $s3 = "@logins.json" fullword ascii $s4 = "@[EXECUTE]" fullword ascii $s5 = "@C:\\Windows\\System32\\cmd.exe" fullword ascii $s6 = /(CHROME|OPERA|FIREFOX)_BASED/ fullword ascii $s7 = "threads.nim" fullword ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_Dlagent05 : FILE { meta: description = "Detects an unknown dropper. Typically exisys as a DLL in base64-encoded gzip-compressed file embedded within another executable" author = "ditekSHen" id = "a8a72484-42be-5c5c-962b-75bed8acdf39" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3538-L3551" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e8c7c03451bbfcba7a1ab02f8c1320ad50d17d2e990f0e2f89942faea2a1e531" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Win.Trojan.DLAgent05" strings: $s1 = "MARCUS.dll" fullword ascii wide $s2 = "GZipStream" fullword ascii $s3 = "MemoryStream" fullword ascii $s4 = "proj_name" fullword ascii $s5 = "res_name" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Nemty : FILE { meta: description = "Detects Nemty/Nefilim ransomware" author = "ditekSHen" id = "361269c6-5215-5ecf-869c-3c55ff8387e1" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3553-L3577" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "dcebcddc472f4fb3bb34c35fc5a5424e54bfc3a262fdae10b189d210217b9b37" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Go build ID:" ascii $s2 = "GOMAXPROCSGetIfEntryGetVersionGlagoliticKharoshthiManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPOSTALCODEPhoenicianSaurasht" ascii $s3 = "crypto/x509.ExtKeyUsage" ascii $s4 = "crypto/x509.KeyUsageContentCommitment" ascii $s5 = "DEK-Info header" ascii $s6 = "GetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard TimePacific SA Standard TimeQueryPerformanceCounter" fullword ascii $s7 = "*( - < = > k= m=%: +00+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12..." ascii $s8 = "Go cmd/compile go1.10" fullword ascii $s9 = ".dllprogramdatarecycle.bin" ascii $s10 = ".dll.exe.lnk.sys.url" ascii $vx1_1 = "Fa1led to os.OpenFile()" ascii $vx1_2 = "-HELP.txt" ascii $vf1_1 = "main.CTREncrypt" fullword ascii $vf1_2 = "main.FileSearch" fullword ascii $vf1_3 = "main.getdrives" fullword ascii $vf1_4 = "main.RSAEncrypt" fullword ascii $vf1_5 = "main.SaveNote" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 9 of ( $s* ) or ( all of ( $vx* ) and 2 of ( $s* ) ) or all of ( $vf* ) ) } rule DITEKSHEN_MALWARE_Win_Qnapcrypt : FILE { meta: description = "Detects QnapCrypt/Lockedv1/Cryptfile2 ransomware" author = "ditekSHen" id = "3ef5643a-f2af-5d62-8927-e46679e069c2" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3579-L3607" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "68fc3f0503d82295ffa5bfb49bda8b790142913217775a2812e3965a6c9a1fe1" score = 75 quality = 73 tags = "FILE" strings: $go = "Go build ID:" ascii $s1 = "Encrypting %s..." ascii $s2 = "\\Start Menu\\Programs\\StartUp\\READMEV" ascii $s3 = "main.deleteRecycleBin" ascii $s4 = "main.encryptFiles" ascii $s5 = "main.antiVirtualBox" ascii $s6 = "main.antiVmware" ascii $s7 = "main.deleteShadows" ascii $s8 = "main.delUAC" ascii $s9 = "main.KillProcess" ascii $s10 = "main.delExploit" ascii $s11 = "main.encrypt" ascii $s12 = "main.ClearLogDownload" ascii $s13 = "main.ClearLog" ascii $s14 = "main.EndEncrypt" ascii $s15 = "main.RunFuckLogAndSoft" ascii $s16 = "main.ClearUsercache" ascii $s17 = "main.FirstDuty" ascii $s18 = ".lockedv1" ascii $s19 = "WSAStartup\\clear.bat\\ngrok.exe\\video.mp4" ascii $s20 = "net stop " ascii condition: uint16( 0 ) == 0x5a4d and $go and 6 of ( $s* ) } rule DITEKSHEN_MALWARE_Win_Vidar : FILE { meta: description = "Detects Vidar / ArkeiStealer" author = "ditekSHen" id = "d858c463-26d7-5f96-ad9a-cb261a8c61c6" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3640-L3650" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c95c8694c05ff0e8d28f098e668a8ae8fa70130e31af6c0e540c4e5596007e41" score = 75 quality = 75 tags = "FILE" strings: $s1 = "\"os_crypt\":{\"encrypted_key\":\"" fullword ascii $s2 = "screenshot.jpg" fullword wide $s3 = "Content-Disposition: form-data; name=\"" ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Babuk : FILE { meta: description = "Detects Babuk ransomware" author = "ditekSHen" id = "6bb7093f-bbef-5b43-b4f9-be72ae4ef319" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3652-L3674" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "5ca5c5106747cf8f4ccd5df4ddbc78321fea3c8f533cb807a704d270eb956007" score = 75 quality = 75 tags = "FILE" strings: $s1 = "ecdh_pub_k.bin" wide $s2 = "How To Restore Your Files.txt" wide $s3 = /(babuk|babyk)\s(ransomware|locker)/ ascii nocase $s4 = "/login.php?id=" ascii $s5 = "http://babuk" ascii $s6 = "bootsect.bak" fullword wide $s7 = "Can't open file after killHolder" ascii $s8 = "Can't OpenProcess" ascii $s9 = "DoYouWantToHaveSexWithCuongDong" ascii $arg1 = "-lanfirst" fullword ascii $arg2 = "-lansecond" fullword ascii $arg3 = "-nolan" fullword ascii $arg4 = "shares" fullword wide $arg5 = "paths" fullword wide $arg6 = "gdebug" fullword wide condition: uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or ( 3 of ( $arg* ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Nitol : FILE { meta: description = "Detects Nitol backdoor" author = "ditekSHen" id = "d545f826-11ff-5d0f-9a95-8232b19d35b6" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3676-L3704" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c0ddcd6179bea2f3af77ae198e07f55f62884e07a975623ae41bcec163060f89" score = 75 quality = 73 tags = "FILE" strings: $s1 = "%$#@!.aspGET ^&*().htmlGET" ascii $s2 = "Applications\\iexplore.exe\\shell\\open\\command" fullword ascii $s3 = "taskkill /f /im rundll32.exe" fullword ascii $s4 = "\\Tencent\\Users\\*.*" fullword ascii $s5 = "[Pause Break]" fullword ascii $s6 = ":]%d-%d-%d %d:%d:%d" fullword ascii $s7 = "GET %s HTTP/1.1" fullword ascii $s8 = "GET %s%s HTTP/1.1" fullword ascii $s9 = "Accept-Language: zh-cn" fullword ascii $s10 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 5.1)" fullword ascii $s11 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii $s12 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii $w1 = ".aspGET" ascii $w2 = ".htmGET" ascii $w3 = ".htmlGET" ascii $domain = "www.xy999.com" fullword ascii $v2_1 = "loglass" fullword ascii $v2_2 = "rlehgs" fullword ascii $v2_3 = "eherrali" fullword ascii $v2_4 = "agesrlu" fullword ascii $v2_5 = "lepejagas" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or ( all of ( $v2* ) ) or ( $domain and 3 of them ) or ( #w1 > 2 and #w2 > 2 and #w3 > 2 and 3 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Strongpity : FILE { meta: description = "Detects StrongPity" author = "ditekSHen" id = "9dcc5edb-5c86-5412-af63-f88d488d5829" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3706-L3720" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e92147966cd68152eb536b805c4918462f72f64280d1b3df800bb41266aa232f" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Boundary%08X" ascii wide $s2 = "Content-Disposition: form-data; name=\"file\";" fullword ascii $s3 = "%sfilename=\"%ls\"" fullword ascii $s4 = "name=%ls&delete=" fullword ascii $s5 = "Content-Type: application/octet-stream" fullword ascii $s6 = "cmd.exe /C ping" wide $s7 = "& rmdir /Q /S \"" wide condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_Jssloader : FILE { meta: description = "Detects JSSLoader RAT/backdoor" author = "ditekSHen" id = "ef710c21-5c64-513e-b882-b5768478976e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3722-L3752" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "91764dabfb40cb51914110de229ddb00cd565078fef83c825f7a86fa502fda37" score = 75 quality = 73 tags = "FILE" strings: $cmd1 = "Cmd_UPDATE" fullword ascii $cmd2 = "Cmd_IDLE" fullword ascii $cmd3 = "Cmd_EXE" fullword ascii $cmd4 = "Cmd_VBS" fullword ascii $cmd5 = "Cmd_JS" fullword ascii $cmd6 = "Cmd_PWS" fullword ascii $cmd7 = "Cmd_RAT" fullword ascii $cmd8 = "Cmd_UNINST" fullword ascii $cmd9 = "Cmd_RunDll" fullword ascii $s1 = "ANSWER_OK" fullword ascii $s2 = "GatherDFiles" ascii $s3 = "CommandCd" fullword ascii $s4 = "URL_GetCmd" fullword ascii $s5 = "\"host\": \"{0}\", \"domain\": \"{1}\", \"user\": \"{2}\"" wide $s6 = "pc_dns_host_name" wide $s7 = "\"adinfo\": { \"adinformation\":" wide $e1 = "//e:vbscript" wide $e2 = "//e:jscript" wide $e3 = "/c rundll32.exe" wide $e4 = "/C powershell" wide $e5 = "C:\\Windows\\System32\\cmd.exe" wide $e6 = "echo del /f" wide $e7 = "AT.U() {0}. format" wide condition: uint16( 0 ) == 0x5a4d and ( 5 of ( $cmd* ) or 5 of ( $s* ) or all of ( $e* ) or 7 of them ) } rule DITEKSHEN_MALWARE_Win_CHUWI_Seth : FILE { meta: description = "First sighting on 2020-01-05 didn't include ransomware artificats. Second sighting on 2020-01-24 with several correlations between the two samples now include ransomware artifacts." author = "ditekSHen" id = "62af3cd3-59c3-580b-9d66-71fd4acfaf17" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3754-L3801" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e6e3f5e9af093268667f67fec2176a943b35721e9f220804e176c6b5a3bb24e1" score = 75 quality = 73 tags = "FILE" snort2_sid = "920103-920105" snort3_sid = "920101-920103" strings: $cmd1 = "shell_command" fullword ascii $cmd2 = "check_command" fullword ascii $cmd3 = "down_exec" fullword ascii $cmd4 = "open_link" fullword ascii $cmd5 = "down_exec" fullword ascii $cmd6 = "exe_link" fullword ascii $cmd7 = "shellCommand" fullword ascii $cmd8 = "R_CMMAND" fullword ascii $cnc1 = "/check_command.php?HWID=" ascii $cnc2 = "&act=get_command" ascii $cnc3 = "/get_command.php?hwid=" ascii $cnc4 = "&command=down_exec" ascii $cnc5 = "&command=message" ascii $cnc6 = "&command=open_link" ascii $cnc7 = "&command=down_exec" ascii $cnc8 = "&command=shell" ascii $pdb = "\\Users\\CHUWI\\Documents\\CPROJ\\Downloader\\svchost" ascii $rcnc1 = "inc/check_command.php" ascii $rcnc2 = "inc/get_command.php" ascii $rcnc3 = "php?btc" ascii $rcnc4 = "php?hwid" ascii $x1 = "> %USERPROFILE%\\Desktop\\HOW_DECRYPT_FILES.seth.txt" ascii $x2 = "/C dir /b %USERPROFILE%\\Documents > %temp%\\doc.txt" ascii $x3 = "/C dir /b %USERPROFILE%\\Desktop > %temp%\\desk.txt" ascii $x4 = "/C dir /b %USERPROFILE%\\Downloads > %temp%\\downs.txt" ascii $x5 = "/C dir /b %USERPROFILE%\\Pictures > %temp%\\pics.txt" ascii $x6 = "for /F \"delims=\" %%a in ('mshta.exe \"%~F0\"') do set \"HTA=%%a\"" ascii $x7 = "\\svchost.exe" fullword ascii $x8 = ".seth" fullword ascii $x9 = "MyAgent" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( $pdb or 5 of ( $cmd* ) or 4 of ( $cnc* ) or all of ( $rcnc* ) or 5 of ( $x* ) or 8 of them ) } rule DITEKSHEN_MALWARE_Linux_Ransomexx : FILE { meta: description = "Detects RansomEXX ransomware" author = "ditekshen" id = "b449afc7-9055-55ed-a876-316d1aea8fee" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3834-L3858" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c233ccc3e741cb2c53f182c48093e41595a82a3f4e5bdb1dc0204f1f57b96c2a" score = 75 quality = 75 tags = "FILE" clamav_sig = "MALWARE.Linux.Ransomware.RansomEXX" strings: $c1 = "crtstuff.c" fullword ascii $c2 = "cryptor.c" fullword ascii $c3 = "ransomware.c" fullword ascii $c4 = "logic.c" fullword ascii $c5 = "enum_files.c" fullword ascii $c6 = "readme.c" fullword ascii $c7 = "ctr_drbg.c" fullword ascii $s1 = "regenerate_pre_data" fullword ascii $s2 = "g_RansomHeader" fullword ascii $s3 = "CryptOneBlock" fullword ascii $s4 = "RansomLogic" fullword ascii $s5 = "CryptOneFile" fullword ascii $s6 = "encrypt_worker" fullword ascii $s7 = "list_dir" fullword ascii $s8 = "ctr_drbg_update_internal" fullword ascii condition: uint16( 0 ) == 0x457f and ( 5 of ( $c* ) or 6 of ( $s* ) or ( 3 of ( $c* ) and 3 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Trickbotmodule : FILE { meta: description = "Detects Trickbot modules" author = "ditekshen" id = "c56c664f-5928-5e2e-ab06-0b9d504981be" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3860-L3881" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "4d06653dad5f8a18598855212548364b3c3d2b68b99784846b494fcb1d1c8df9" score = 75 quality = 75 tags = "FILE" strings: $mc = "" ascii $s1 = "" ascii $s2 = "" ascii $s3 = "\d+<\/limit>/ ascii $w8 = " 3 and 2 of them ) ) } rule DITEKSHEN_MALWARE_Win_Miniduke : FILE { meta: description = "Detects MiniDuke" author = "ditekSHen" id = "947cd414-d19d-5543-8961-94aef69cc94e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3948-L3969" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c3ab139b4fda2ff9678ceecbdf5ac0c57536bd658f62aa9d19610028b0a5f92c" score = 75 quality = 75 tags = "FILE" strings: $s1 = "DefPipe" fullword ascii $s2 = "term %5d" fullword ascii $s3 = "pid %5d" fullword ascii $s4 = "uptime %5d.%02dh" fullword ascii $s5 = "login: %s\\%s" fullword ascii $s6 = "Software\\Microsoft\\ApplicationManager" ascii $s7 = { 69 64 6c 65 ?? 00 73 74 6f 70 ?? 00 61 63 63 65 70 74 ?? 00 63 6f 6e 6e 65 63 74 ?? 00 6c 69 73 74 65 6e ?? 00 } $net1 = "salesappliances.com" ascii $net2 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36" fullword ascii $net3 = "http://10." ascii $net4 = "JiM9t8g7j8KoJkLJlKqka8dbo7q5z4v5u3o4z" ascii $net5 = "application/octet-stream" ascii $net6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" ascii condition: uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or 4 of ( $net* ) or 7 of them ) } rule DITEKSHEN_MALWARE_Win_Polyglotduke : FILE { meta: description = "Detects PolyGlotDuke" author = "ditekSHen" id = "01ac90db-35f6-5192-8630-81000573b4f9" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3971-L3986" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c1fb8ea1d21768cbd65bd7b91e3f817fa97a0a933b511dff2ae4d5db49bdb2ec" score = 75 quality = 75 tags = "FILE" strings: $s1 = { 48 b9 ff ff ff ff ff ff ff ff 51 48 23 8c 24 ?? 00 00 00 48 89 8C 24 00 00 00 00 } $s2 = { 56 be ff ff ff ff 56 81 e6 7f } $s3 = { 48 8b 05 19 ?4 4b 00 48 05 48 83 00 00 4c 8b 44 24 50 8b 54 24 48 48 8b } condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) ) or ( 2 of them and pe.exports ( "InitSvc" ) ) } rule DITEKSHEN_MALWARE_Win_WSHRATJS : FILE { meta: description = "Detects WSHRAT JS variants" author = "ditekSHen" id = "7dbaea67-48dc-5fb8-ba58-b0d6eeca207b" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4028-L4045" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "9956ed4613ac403360ab0222a7ed62350fcd998710843bd6700717f8bbb5052e" score = 75 quality = 75 tags = "FILE" strings: $charset_full = "us-ascii" nocase ascii $charset_begin = "\"us-\"" nocase ascii $charset_end = "Array(97,115,99,105,105)" nocase ascii $wsc_object1 = "WScript.CreateObject(\"System.Text.UTF8Encoding" nocase ascii $wsc_object2 = "WScript.CreateObject(\"Adodb.Stream" nocase ascii $wsc_object3 = "WScript.CreateObject(\"Microsoft.XmlDom" nocase ascii $s1 = "function(){return" ascii $s2 = "}catch(err){" ascii $s3 = "{item: \"bin.base64\"}" nocase ascii $s4 = "* 1].item =" ascii condition: filesize < 400KB and ( $charset_full or ( $charset_begin and $charset_end ) ) and 2 of ( $wsc_object* ) and 3 of ( $s* ) } rule DITEKSHEN_MALWARE_Win_Quilclipper { meta: description = "Detects QuilClipper variants mostly in memory or extracted AutoIt script" author = "ditekSHen" id = "bd23ec5a-f21a-5133-a77a-de2615933b82" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4076-L4094" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "dcac93806a438b188ae70a679301cb6630b9eb6849bf8fbbb1cea5fed5e7cf75" score = 75 quality = 75 tags = "" strings: $cnc1 = "QUILCLIPPER by" ascii $cnc2 = "/ UserName:" ascii $cnc3 = "/ System:" ascii $s1 = "DLLCALL ( \"kernel32.dll\" , \"handle\" , \"CreateMutexW\" , \"struct*\"" ascii $s2 = "SHELLEXECUTE ( @SCRIPTFULLPATH , \"\" , \"\" , FUNC_" ascii $s3 = "CASE BITROTATE" ascii $s4 = "CASE BITXOR" ascii $s5 = "CLIP( FUNC_" ascii $s6 = "CLIPPUT (" ascii $s7 = "FUNC _CLIPPUTFILE(" ascii $s8 = "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Schedule" ascii condition: all of ( $cnc* ) or all of ( $s* ) } rule DITEKSHEN_MALWARE_Win_Spyeye : FILE { meta: description = "Detects SpyEye" author = "ditekSHen" id = "aa15220a-6fd4-5c5e-8287-957fc3c3fe52" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4096-L4111" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "352853d600d1f4fbc09e58b783eb4e13b335fefbfe89842873710f0a9085d107" score = 75 quality = 75 tags = "FILE" strings: $x1 = "_CLEANSWEEP_" ascii wide $x2 = "config.datUT" fullword ascii $x3 = "webinjects.txtUT" fullword ascii $s1 = "confirm:processCommand" fullword ascii $s2 = "Smth wrong with navigate to REF-PAGE (err code: %d). 0_o" fullword ascii $s3 = "(UTC%s%2.2f) %s" fullword wide $s4 = "M\\F;u`r" fullword ascii $s5 = "]YH0%Yn" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and 1 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Renamer : FILE { meta: description = "Detects Renamer/Tainp variants" author = "ditekSHen" id = "9e701bbe-d698-510a-b63d-3c1575dac7b0" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4114-L4135" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "df80657631f072bc1627e1cf503881a2c065396f8798d7f347259672f600198d" score = 75 quality = 75 tags = "FILE" strings: $s1 = "shell\\open\\command=" fullword wide $s2 = "icon=%SystemRoot%\\system32\\SHELL32.dll,4" fullword wide $s3 = "DropTarget" ascii $s4 = "C:\\Windows\\Paint" fullword wide $s5 = "hold.inf" fullword wide $s6 = "Dropped" ascii condition: uint16( 0 ) == 0x5a4d and all of ( $s* ) or ( 4 of ( $s* ) and for any directory in pe.data_directories : ( directory.virtual_address != 0 and directory.size == 0 ) ) } rule DITEKSHEN_MALWARE_Win_Epsilon : FILE { meta: description = "Detects Epsilon ransomware" author = "ditekSHen" id = "c5561a0d-85ac-5137-a97e-310aa03eb787" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4137-L4169" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "cc4481ddb6f5fd52a0bc901dde4c34ccf79024cd68605245df0dcbea22d0adee" score = 75 quality = 75 tags = "FILE" strings: $s1 = ".Speak \"" wide $s2 = "chkUpdateRegistry" fullword wide $s3 = "/C choice /C Y /N /D Y /T 1 & Del \"" fullword wide $s4 = "CreateObject(\"sapi.spvoice\")" fullword wide $s5 = "READ_ME.hta" wide $s6 = "WScript.Sleep(" wide $s7 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide $s8 = "
    Files are encrypted* but not deleted.
    " ascii $e1 = { 72 00 75 00 6e 00 64 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 09 2e 00 74 00 78 00 74 00 00 09 2e 00 64 00 6f 00 63 00 00 0b 2e 00 64 00 6f 00 63 00 78 00 00 09 2e 00 78 00 6c 00 73 00 00 0d 2e 00 69 00 6e 00 64 00 65 00 78 00 00 09 2e 00 70 00 64 00 66 00 00 09 2e 00 7a 00 69 00 70 00 00 09 2e 00 72 00 61 00 72 00 00 09 2e 00 63 00 73 00 73 00 00 09 2e 00 6c 00 6e 00 6b 00 00 0b 2e 00 78 00 6c 00 73 00 78 00 00 09 2e 00 70 00 70 00 74 00 00 0b 2e 00 70 00 70 00 74 00 78 00 00 09 2e 00 6f 00 64 00 } $e2 = { 68 00 74 00 6d 00 00 07 2e 00 6d 00 6c 00 00 07 43 00 3a 00 5c 00 00 07 44 00 3a 00 5c 00 00 07 45 00 3a 00 5c 00 00 07 46 00 3a 00 5c 00 00 07 47 00 3a 00 5c 00 00 07 5a 00 3a 00 5c 00 00 07 41 00 3a 00 5c 00 00 0f 63 00 6d 00 64 00 2e 00 65 00 78 00 65 } condition: uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or ( all of ( $e* ) and 4 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Dllloader : FILE { meta: description = "Detects unknown DLL Loader" author = "ditekSHen" id = "164967b8-d0f5-543d-82ac-bb2465b85c2a" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4228-L4239" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "aaf1ff0f93d1fe6cf189c9f30403c226e64146178150dff8dfd3a9e3ed84bcc2" score = 75 quality = 75 tags = "FILE" strings: $s1 = "LondLibruryA" fullword ascii $s2 = "LdrLoadDll" fullword ascii $s3 = "snxhk.dll" fullword ascii $s4 = "DisableThreadLibraryCalls" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Warezov : FILE { meta: description = "Detects Warezov worm/downloader" author = "ditekSHen" id = "8cb1dcb1-981d-5ff2-b0d9-aa18dfbfc795" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4255-L4269" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e65922902fd18175a3ce7b600d46535e92b92240fa3ca83dced6f9ce14f3e815" score = 75 quality = 75 tags = "FILE" strings: $s1 = "ft\\Windows\\CurrentVersion\\Run" wide $s2 = "DIR%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide $s3 = "%WINDIR%\\sqhos32.wmf" wide $s4 = "Accept: */*" fullword ascii $s5 = "Range: bytes=" fullword ascii $s6 = "module.exe" fullword ascii $s7 = { 25 73 25 73 2e 25 73 ?? ?? 22 22 26 6c 79 79 56 00 00 00 00 25 73 25 30 34 64 25 30 32 64 25 30 32 64 00 } condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_MALWARE_Win_Arechclient2 : FILE { meta: description = "Detects Arechclient2 RAT" author = "ditekSHen" id = "c12858ea-5e06-5303-9df0-0f59ba83b5e5" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4271-L4303" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0d841f4d4664fb09801c51f7b65e897e4e698753ad67fc20e2b81d98c0b3d07d" score = 75 quality = 73 tags = "FILE" strings: $s1 = "\\Google\\Chrome\\User Data\\copiedProf\"" wide $s2 = "\",\"BotName\":\"" wide $s3 = "\",\"BotOS\":\"" wide $s4 = "\",\"URLData\":\"" wide $s5 = "{\"Type\":\"ConnectionType\",\"ConnectionType\":\"Client\",\"SessionID\":\"" wide $s6 = "{\"Type\":\"TestURLDump\",\"SessionID\":\"" wide $s7 = "" ascii $s8 = "" ascii $s9 = "fuck_sd" fullword ascii $s10 = "HandleBotKiller" fullword ascii $s11 = "RunBotKiller" fullword ascii $s12 = "ConnectToServer" fullword ascii $s13 = "KillBrowsers" fullword ascii $s14 = "keybd_event" fullword ascii $s15 = "FuckCodeImg" fullword ascii $v1_1 = "grabber@" fullword ascii $v1_2 = "k__" ascii $v1_3 = "k__" ascii $v1_4 = "k__" ascii $v1_5 = "k__" ascii $v1_6 = "k__" ascii $v1_7 = "k__" ascii $v1_8 = /k__BackingField/ fullword ascii $v1_9 = "displayName[AString-ZaString-z\\d]{2String4}\\.[String\\w-]{String6}\\.[\\wString-]{2String7}Local Extension Settingshost" wide $v1_10 = "\\sitemanager.xml MB or SELECT * FROM Cookiesconfig" wide condition: uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or 7 of ( $v1* ) or ( 6 of ( $v1* ) and 1 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Killmbr : FILE { meta: description = "Detects KillMBR" author = "ditekSHen" id = "b109865f-e268-5633-bb8e-f390dd050d99" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4305-L4316" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "1ed9206f90052df7e533be4612afa373e5e69fba8f5b5ae4df1c09a9d98958cf" score = 75 quality = 75 tags = "FILE" strings: $s1 = "\\\\.\\PhysicalDrive" ascii $s2 = "/logger.php" ascii $s3 = "Ooops! Your MBR was been rewritten" ascii $s4 = "No, this ransomware dont encrypt your files, erases it" ascii condition: uint16( 0 ) == 0x5a4d and ( 2 of them and #s1 > 10 ) } rule DITEKSHEN_MALWARE_Win_Lcpdot : FILE { meta: description = "Detects LCPDot" author = "ditekSHen" id = "e4db3784-7fb0-58bd-997e-788f409445cd" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4318-L4337" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b0f77f17976c38a69c2ff0d84002f2db29a4d25873309259519115b5f2b210ff" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword wide $s2 = "Cookie: SESSID=%s" fullword ascii $s3 = "Cookie=Enable" fullword ascii $s4 = "Cookie=Enable&CookieV=%d&Cookie_Time=32" fullword ascii $s5 = ".?AVTShellCodeRuner@@" fullword ascii $s6 = ".?AVTHashEncDecoder@@" fullword ascii $s7 = ".?AVTWebAddressList@@" fullword ascii $s8 = "WinMain.dll" fullword ascii $s9 = "HotPlugin" wide $o0 = { 4c 89 6c 24 08 4c 89 34 24 44 8d 77 01 44 8d 6f } $o1 = { 8b f0 e8 58 34 00 00 48 8b f8 48 85 c0 74 0c 48 } $o2 = { c7 44 24 30 47 49 46 38 c7 44 24 34 39 61 27 00 } condition: uint16( 0 ) == 0x5a4d and 6 of ( $s* ) or ( all of ( $o* ) and 3 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Torisma : FILE { meta: description = "Detects Torisma" author = "ditekSHen" id = "e62a0f1c-4404-5da1-9c43-4cb58e735827" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4339-L4355" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "bd3823f8a91fdfc443e20bcb299a5103b7176a694f0d5328e7986de83f677a31" score = 75 quality = 75 tags = "FILE" strings: $s1 = "ACTION=PREVPAGE&CODE=C%s&RES=%d" fullword ascii $s2 = "ACTION=VIEW&PAGE=%s&CODE=%s&CACHE=%s&REQUEST=%d" fullword ascii $s3 = "ACTION=NEXTPAGE&CODE=S%s&CACHE=%s&RES=%d" fullword ascii $s4 = "Your request has been accepted. ClientID: {" ascii $s5 = "Proxy-Connection: Keep-Alive" fullword wide $s6 = "Content-Length: %d" fullword wide $o0 = { f7 f9 8b c2 89 44 24 34 48 63 44 24 34 48 8b 4c } $o1 = { 48 c7 00 ff ff ff ff 48 8b 84 24 90 } $o2 = { f3 aa 83 7c 24 30 01 75 34 c7 44 24 20 01 } condition: uint16( 0 ) == 0x5a4d and 4 of ( $s* ) or ( all of ( $o* ) and 3 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Thanos : FILE { meta: description = "Detects Thanos / Prometheus / Spook ransomware" author = "ditekSHen" id = "f523906e-ef5e-57be-82ed-06e75c393f42" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4357-L4389" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "8ce7cdfe4bca31e21d6fa31a75c46737a41fae3b5b0fda818e3a4709ceaf9bf5" score = 75 quality = 73 tags = "FILE" strings: $f1 = "b__" ascii $f2 = "b__" ascii $f3 = "b__" ascii $f4 = "b__" ascii $f5 = "k__" ascii $f6 = "k__" ascii $f7 = "b__" ascii $s1 = "Aditional KeyId:" wide $s2 = "process call create cmd.exe /c \\\\" wide $s3 = "/c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin" wide $s4 = "\\HOW_TO_DECYPHER_FILES." wide $s5 = "Client Unique Identifier Key:" wide $s6 = "/s /f /q c:\\*.VHD c:\\*.bac c:\\*.bak c:\\*.wbcat c:\\*.bkf c:\\Backup*.* c:\\backup*.* c:\\*.set c:\\*.win c:\\*.dsk" fullword wide $s7 = "NtOpenProcess" fullword wide $s8 = "Builder_Log" fullword wide $s9 = "> Nul & fsutil file setZeroData offset=0 length=" wide $s10 = "3747bdbf-0ef0-42d8-9234-70d68801f407" wide $s11 = "4b195894-0f06-4fdd-afb4-b17fb9246a59" wide $s12 = "cec564ff-2433-4771-b918-15f58ef6e26c" wide $s13 = "56258a19-7489-468b-86ee-e7899203d67c" wide $s14 = "WalkDirectoryTree" fullword ascii $s15 = "hashtableLock" fullword ascii $s16 = "get_ParentFrn" fullword ascii $m1 = "SW5mb3JtYXRpb24uLi" wide $m2 = "QWxsIHlvdXIgZmlsZXMgd2VyZSBlbmNyeXB0" wide condition: uint16( 0 ) == 0x5a4d and ( 5 of ( $f* ) or 5 of ( $s* ) or ( 4 of ( $f* ) and 2 of ( $s* ) or ( all of ( $m* ) and 3 of them ) ) or 8 of them ) } rule DITEKSHEN_MALWARE_Win_Tmanager : FILE { meta: description = "Detects TManager RAT. Associated with TA428" author = "ditekSHen" id = "391b72bd-ddf5-5251-b566-c75c1cc16b74" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4391-L4410" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "cdbcc00ae67c9161f6db89cfa658c8bc8fb7fab3915ac5ae99bdd34c42ee2abb" score = 75 quality = 75 tags = "FILE" strings: $s1 = "WSAStartup Error!" fullword wide $s2 = "KB3112342.LOG" fullword wide $s3 = "\\cmd.exe -c" fullword wide $s4 = "sock_hmutex" fullword wide $s5 = "cmd_hmutex" fullword wide $s6 = "powershell" fullword wide $s7 = "%s_%d.bmp" fullword wide $s8 = "!Error!" fullword wide $s9 = "[Execute]" fullword ascii $s10 = "[Snapshot]" fullword ascii $s11 = "GetLanIP error!" fullword ascii $s12 = "chcp & exit" fullword ascii condition: uint16( 0 ) == 0x5a4d and 6 of them } rule DITEKSHEN_MALWARE_Win_Sn0Wlogger : FILE { meta: description = "Detects Sn0w Logger" author = "ditekSHen" id = "cdb70164-3f72-553f-a6c5-190f699e0743" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4412-L4428" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ea4b2281f906271dc249b5036b22eadfc5add94def4f8e4f8a40c384618465d8" score = 75 quality = 75 tags = "FILE" strings: $s1 = "\\SnowP\\Example\\Secured\\" ascii $s2 = "{0}{3}Content-Type: {4}{3}Content-Disposition: form-data; name=\"{1}\"{3}{3}{2}{3}" wide $s3 = "\"encrypted_key\":\"(.*?)\"" fullword wide $s4 = "d__" ascii $s5 = "_urlWebhook" ascii $r1 = "[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27}" fullword wide $r2 = "^\\w+([-+.']\\w+)*@\\w+([-.]\\w+)*\\.\\w+([-.]\\w+)*$" fullword wide $r3 = "mfa\\.[\\w-]{84}" fullword wide $r4 = "(\\w+)=(\\d+)-(\\d+)$" fullword wide condition: uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( all of ( $r* ) and 2 of ( $s* ) ) or 7 of them ) } rule DITEKSHEN_MALWARE_Win_Klackring : FILE { meta: description = "Detects Klackring variants. Associated with ZINC / Lazarus" author = "ditekSHen" id = "7bd9a68f-d58b-5437-a28b-5a7f1a11038e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4461-L4475" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b894e89de720affadd80966d726a44ffce75d71095b0530edb6bfddb76660c54" score = 75 quality = 75 tags = "FILE" strings: $s1 = "%s\\%s.dll" fullword wide $s2 = "cmd.exe /c move /Y %s %s" fullword wide $s3 = "%s\\win32k.sys" fullword wide $s4 = "NetSvcInst_Rundll32.dll" fullword ascii $s5 = "Spectrum.dll" fullword ascii wide $s6 = "%s\\cmd.exe" fullword wide $s7 = ".?AVA5Stream@@" fullword ascii condition: uint16( 0 ) == 0x5a4d and 6 of them } rule DITEKSHEN_MALWARE_Win_Suncrypt : FILE { meta: description = "Detects SunCrypt ransomware" author = "ditekSHen" id = "1a28fcbf-1fc0-5f18-ae71-2e813ed0f958" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4494-L4532" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "abde9bbf2577304ff059972a38e803ba17de7a1f0346efe880a710f2ad79db37" score = 75 quality = 73 tags = "FILE" strings: $s1 = "-noshares" fullword wide $s2 = "-nomutex" fullword wide $s3 = "-noreport" fullword wide $s4 = "-noservices" fullword wide $s5 = "$Recycle.bin" fullword wide $s6 = "YOUR_FILES_ARE_ENCRYPTED.HTML" fullword wide $s7 = "\\\\?\\%c:" fullword wide $s8 = "locker.exe" fullword ascii $s9 = "DllRegisterServer" fullword ascii $g1 = "main.EncFile" fullword ascii nocase $g2 = "main.detectName" fullword ascii nocase $g3 = "main.detectIP" fullword ascii nocase $g4 = "main.detectDebugProc" fullword ascii nocase $g5 = "main.Bypass" ascii nocase $g6 = "main.allocateMemory" fullword ascii nocase $g7 = "main.killAV" fullword ascii nocase $g8 = "main.disableShadowCopy" fullword ascii nocase $g9 = "main.(*windowsDrivesModel).LoadDrives" fullword ascii nocase $g10 = "main.IsFriends" fullword ascii nocase $g11 = "main.walkMsg" fullword ascii nocase $g12 = "main.makeSecretMessage" fullword ascii nocase $g13 = "main.stealFiles" fullword ascii nocase $g14 = "main.newKey" fullword ascii nocase $g15 = "main.openBrowser" fullword ascii nocase $g16 = "main.killProc" fullword ascii nocase $g17 = "main.selfRemove" fullword ascii nocase $m1 = "

    \\x20Offline\\x20HowTo\\x20

    \\x0a\\x09\\x09\\x09\\x09

    Copy\\x20&\\x20Paste\\x20this\\x20message\\x20to" ascii $m2 = "\\x20restore\\x20your\\x20files." ascii $m3 = "\\x20your\\x20documents\\x20and\\x20files\\x20encrypted" ascii $m4 = "\\x20lose\\x20all\\x20of\\x20your\\x20data\\x20and\\x20files." ascii $m5 = ",'/#/client/','

    \\x20Whats\\x20Happen" ascii condition: uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or 6 of ( $g* ) or 3 of ( $m* ) ) } rule DITEKSHEN_MALWARE_Win_Zegost : FILE { meta: description = "Detects Zegost" author = "ditekSHen" id = "cce29602-c096-53df-a99b-16f18ed43b80" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4534-L4560" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "96727a0f5c113e5cdfe871f104553fd1c04a8f63ecbb8db7223afb71fcdd4087" score = 75 quality = 75 tags = "FILE" strings: $s1 = "rtvscan.exe" fullword ascii $s2 = "ashDisp.exe" fullword ascii $s3 = "KvMonXP.exe" fullword ascii $s4 = "egui.exe" fullword ascii $s5 = "avcenter.exe" fullword ascii $s6 = "K7TSecurity.exe" fullword ascii $s7 = "TMBMSRV.exe" fullword ascii $s8 = "RavMonD.exe" fullword ascii $s9 = "kxetray.exe" fullword ascii $s10 = "mssecess.exe" fullword ascii $s11 = "QUHLPSVC.EXE" fullword ascii $s12 = "360tray.exe" fullword ascii $s13 = "QQPCRTP.exe" fullword ascii $s14 = "knsdtray.exe" fullword ascii $s15 = "V3Svc.exe" fullword ascii $s16 = "??1_Winit@std@@QAE@XZ" fullword ascii $s17 = "ClearEventLogA" fullword ascii $s18 = "SeShutdownPrivilege" fullword ascii $s19 = "%s\\shell\\open\\command" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_GENERIC01 : FILE { meta: description = "Detects known unamed malicious executables, mostly DLLs" author = "ditekSHen" id = "3c16df71-f2e2-591c-b377-7e5ed697d43f" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4562-L4575" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ddae979db5ddda772ca66a3d50e4b5479b16052ea002fd04fdbf295ce784e291" score = 75 quality = 75 tags = "FILE" strings: $s1 = "\\wmkawe_%d.data" ascii $s2 = "\\resmon.resmoncfg" ascii $s3 = "ByPassUAC" fullword ascii $s4 = "rundll32.exe C:\\ProgramData\\Sandboxie\\SbieMsg.dll,installsvc" fullword ascii nocase $s5 = "%s\\SbieMsg." ascii $s6 = "Stupid Japanese" fullword ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_Dlagent06 : FILE { meta: description = "Detects known downloader agent downloading encoded binaries in patches" author = "ditekSHen" id = "00cb5184-b12d-5014-bee8-116cc72dfa47" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4593-L4610" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "9188804ad0e08f3e0cd09eb8815abea14da5aa28aef9084d19108a24f49f65c7" score = 75 quality = 75 tags = "FILE" snort2_sid = "920122" snort3_sid = "920119" strings: $s1 = "totallist" fullword ascii wide $s2 = "LINKS_HERE" fullword wide $s3 = "[SPLITTER]" fullword wide $var2_1 = "DownloadWeb" fullword ascii $var2_2 = "WriteByte" fullword ascii $var2_3 = "MemoryStream" fullword ascii $var2_4 = "DownloadString" fullword ascii $var2_5 = "WebClient" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 2 of ( $var2* ) ) or ( 4 of ( $var2* ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_PWSH_Poshkeylogger { meta: description = "Detects PowerShell PoshKeylogger" author = "ditekSHen" id = "a816d716-caeb-5f08-9043-29db531f9e7c" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4612-L4627" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "20bde87ded7e3b68bc554c4b9a6c2ef08514f0d47b6b144763927bede81ea540" score = 75 quality = 75 tags = "" strings: $s1 = "::GetKeyboardState" ascii $s2 = "GetAsyncKeyState(" ascii $s3 = "::MapVirtualKey(" ascii $s4 = "::GetAsyncKeyState" ascii $s5 = "Start-Sleep" ascii $s6 = "send-mailmessage" ascii $s7 = "[System.IO.File]::AppendAllText($" ascii $s8 = "new-object Management.Automation.PSCredential $" ascii condition: 6 of them } rule DITEKSHEN_MALWARE_Win_Fujinamarat : FILE { meta: description = "Detects FujinamaRAT" author = "ditekSHen" id = "f6b08713-1c03-5914-b0a2-ea9164a3f2cb" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4629-L4645" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "42557094afe67196442f46d76f156c09852d694bcc5f03eac51e79ad247c2fdd" score = 75 quality = 75 tags = "FILE" snort2_sid = "920124" snort3_sid = "920121" strings: $s1 = "GetAsyncKeyState" fullword ascii $s2 = "HTTP/1.0" fullword wide $s3 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" fullword wide $s4 = "frmMain" fullword ascii $s5 = "G<=>?@ABGGGGGGGGGGGGGGGGGGGGGGGGGGCDEF" fullword ascii $s6 = "VBA6.DLL" fullword ascii $s7 = "t_save" fullword ascii condition: uint16( 0 ) == 0x5a4d and 6 of them } rule DITEKSHEN_MALWARE_Win_Phorpiex : FILE { meta: description = "Detects Phorpiex variants" author = "ditekSHen" id = "e2d26c5f-939e-53e3-8730-622341d26273" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4647-L4666" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "4c48a20aaf37d65471710181238d2c39c1cb0fc5a37b9c411e8d4dcfd7a9e26e" score = 75 quality = 75 tags = "FILE" strings: $s1 = "ShEllExECutE=__\\DriveMgr.exe" fullword wide nocase $s2 = "/c start __ & __\\DriveMgr.exe & exit" fullword wide nocase $s3 = "%s\\autorun.inf" fullword wide $s4 = "svchost." wide $s5 = "%ls\\%d%d" wide $s6 = "bitcoincash:" ascii $s7 = "%ls:*:Enabled:%ls" fullword wide $s8 = "%s\\%s\\DriveMgr.exe" fullword wide $s9 = "api.wipmania.com" ascii $v1_1 = "%appdata%" fullword wide $v1_2 = "(iPhone;" ascii $v1_3 = "/tst.php" ascii condition: uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or all of ( $v1* ) ) } rule DITEKSHEN_MALWARE_Win_Vovalex : FILE { meta: description = "Detects Vovalex ransomware" author = "ditekSHen" id = "967af585-8a91-5ed0-8400-a8a24d95fd12" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4705-L4718" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ea695521981f4b007eee50e95f7989dda1f07cc411c59450489bb17391ff29dc" score = 75 quality = 75 tags = "FILE" strings: $s1 = "README.VOVALEX.txt" fullword ascii $s2 = "\\src\\phobos\\std\\" ascii $s3 = "LoadLibraryA(\"Advapi32.dll\")" fullword ascii $s4 = "Failed to spawn process \"" fullword ascii $s5 = "=== Bypassed ===" fullword ascii $s6 = "If you don't know where to buy" ascii condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_MALWARE_Win_Dharma : FILE { meta: description = "Detects Dharma ransomware" author = "ditekSHen" id = "070be95e-8d9c-5c4d-9d46-cddea6dbb682" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4720-L4728" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "2727b2c0295e32699e08c3c79d7ac6fd52f1520358ac23290d40df428c969f4b" score = 75 quality = 75 tags = "FILE" strings: $s1 = "C:\\crysis\\Release\\PDB\\payload.pdb" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Cryptolocker : FILE { meta: description = "Detects Cryptolocker ransomware variants (Betarasite)" author = "ditekSHen" id = "4c6d714d-1fb1-55ce-8022-40f6f634e2cd" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4730-L4752" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e1700e8ace338c25119305878e8bc52210506bd42183007985ba9601abdab87b" score = 75 quality = 73 tags = "FILE" strings: $x1 = "CryptoLocker" fullword wide $x2 = ".betarasite" fullword wide $x3 = "CMSTPBypass" fullword ascii $s1 = "CommandToExecute" fullword ascii $s2 = "SetInfFile" fullword ascii $s3 = "SchoolPrject1" ascii $s4 = "$730d5f64-bd57-47c1-9af4-d20aec714d02" fullword ascii $s5 = "Encrypt" fullword ascii $s6 = "Invalide Key! Please Try Again." fullword wide $s7 = "RegAsm" fullword wide $s8 = "Your key will be destroyed" wide $s9 = "encrypted using RC4 and RSA-2048" wide $c1 = "https://coinbase.com" fullword wide $c2 = "https://localbictoins.com" fullword wide $c3 = "https://bitpanda.com" fullword wide condition: uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or all of ( $s* ) or ( 2 of ( $x* ) and 5 of ( $s* ) ) or ( all of ( $c* ) and 1 of ( $x* ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_PWSH_Poshwifistealer { meta: description = "Detects PowerShell PoshWiFiStealer" author = "ditekSHen" id = "69ac123d-b746-57f1-a488-547f9a9cdd86" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4754-L4765" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "769349360b5d22226a5339a9e8471d06731dc522475c9385c1c145a0488e0ad1" score = 75 quality = 75 tags = "" strings: $s1 = "netsh wlan export profile" ascii $s2 = "Send-MailMessage" ascii $u1 = "https://github.com/axel05869/Wifi-Grab" ascii $u2 = "/exploitechx/wifi-password-extractor" ascii condition: all of ( $s* ) or all of ( $u* ) } rule DITEKSHEN_MALWARE_Win_Steamhook : FILE { meta: description = "Detects potential Steam stealer" author = "ditekSHen" id = "7533fb83-d721-54e6-8ae1-1c840dd5a13d" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4767-L4781" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "da743ca99fd19828e3938875acaf6544f17d884587a59623c8361f5905af4a57" score = 75 quality = 73 tags = "FILE" strings: $s1 = "Mozilla/4.0 (compatible; )" fullword ascii $s2 = "/steam/upload.php" ascii $s3 = ".*?(ssfn\\d+)" fullword ascii $s4 = "add cookie failed..." fullword ascii $s5 = "Content-Type: multipart/form-data; boundary=--MULTI-PARTS-FORM-DATA-BOUNDARY" fullword ascii $pdb1 = "\\SteamHook\\Install\\" ascii $pdb2 = "\\SteamHook\\dll\\" ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $pdb* ) or ( 1 of ( $pdb* ) and 3 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Netwire : FILE { meta: description = "Detects NetWire RAT" author = "ditekSHen" id = "c215f449-c725-51da-8f5b-2619bc282b22" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4783-L4805" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "bae4f0cd7a431336bd784ba95f6ba3396e6f0f12c081e62482ad37ff859c1f1c" score = 75 quality = 75 tags = "FILE" strings: $x1 = "SOFTWARE\\NetWire" fullword ascii $x2 = { 4e 65 74 57 69 72 65 00 53 4f 46 54 57 41 52 45 5c 00 } $s1 = "User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword ascii $s2 = "filenames.txt" fullword ascii $s3 = "GET %s HTTP/1.1" fullword ascii $s4 = "[%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword ascii $s5 = "Host.exe" fullword ascii $s6 = "-m \"%s\"" fullword ascii $g1 = "HostId" fullword ascii $g2 = "History" fullword ascii $g3 = "encrypted_key" fullword ascii $g4 = "Install Date" fullword ascii $g5 = "hostname" fullword ascii $g6 = "encryptedUsername" fullword ascii $g7 = "encryptedPassword" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $x* ) or ( 1 of ( $x* ) and 2 of ( $s* ) ) or ( all of ( $g* ) and ( 2 of ( $s* ) or 1 of ( $x* ) ) ) ) } rule DITEKSHEN_MALWARE_Win_Breakstaf : FILE { meta: description = "Detects BreakStaf ransomware" author = "ditekSHen" id = "3c8ca485-2cb4-56fd-a1f5-16b43515cec9" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4807-L4827" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "56078b797c64ce77398f9b92e5677f7159d8357eafb03cf62bb30f06d4f3b2e3" score = 75 quality = 73 tags = "FILE" strings: $s1 = "C:\\Program files" wide $s2 = "C:\\Program files (x86)" wide $s3 = "C:\\System Volume Information" wide $s4 = "C:\\$Recycle.Bin" wide $s5 = "C:\\Windows" wide $s6 = ".?AVRandomNumberGenerator@Crypto" ascii $s7 = ".?AV?$SymmetricCipherFinal@" ascii $s8 = ".breakstaf" fullword wide nocase $s9 = "readme.txt" fullword wide nocase $s10 = ".VHD" fullword wide nocase $s11 = ".vhdx" fullword wide nocase $s12 = ".BAK" fullword wide nocase $s13 = ".BAC" fullword wide nocase condition: uint16( 0 ) == 0x5a4d and 12 of them } rule DITEKSHEN_MALWARE_Win_Kitty : FILE { meta: description = "Detects HelloKitty ransomware, triggers on FIVEHANDS" author = "ditekSHen" id = "4147294a-7eff-595a-ad4f-8a84ffff960f" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4829-L4847" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "3a36755c81ec70c127bb73448fc29325444b85b5f0704327fc81975c2af2e99e" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Kitty" wide $s2 = "-path" fullword wide $s3 = "select * from Win32_ShadowCopy" fullword wide $s4 = "Win32_ShadowCopy.ID='%s'" fullword wide $s5 = "programdata" fullword wide $s6 = "$recycle.bin" fullword wide $s7 = ".crypt" fullword wide $s8 = "%s/secret/%S" wide $s9 = "decrypts3nln3tic.onion" wide $n1 = "read_me_lkd.txt" wide $n2 = "DECRYPT_NOTE.txt" wide condition: uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or 1 of ( $n* ) and 4 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Dlagent07 : FILE { meta: description = "Detects delf downloader agent" author = "ditekSHen" id = "a45afe84-15ae-528a-ad7e-ab9f03045789" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4849-L4867" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "1e0001d18524d0d34ad876e67e2c4dc0495ee18a73c34f53f97367876e27b406" score = 75 quality = 75 tags = "FILE" strings: $s1 = "C:\\Users\\Public\\Libraries\\temp" fullword ascii $s2 = "SOFTWARE\\Borland\\Delphi" ascii $s3 = "Mozilla/5.0(compatible; WinInet)" fullword ascii $o1 = { f3 a5 e9 6b ff ff ff 5a 5d 5f 5e 5b c3 a3 00 40 } $o2 = { e8 83 d5 ff ff 8b 15 34 40 41 00 89 10 89 58 04 } $o3 = { c3 8b c0 53 51 e8 f1 ff ff ff 8b d8 85 db 74 3e } $o4 = { e8 5c e2 ff ff 8b c3 e8 b9 ff ff ff 89 04 24 83 } $o5 = { 85 c0 74 1f e8 62 ff ff ff a3 98 40 41 00 e8 98 } $o6 = { 85 c0 74 19 e8 be ff ff ff 83 3d 98 40 41 00 ff } $x1 = "22:40:08 \"> " ascii condition: uint16( 0 ) == 0x5a4d and ( ( 2 of ( $s* ) and 5 of ( $o* ) ) or ( all of ( $s* ) and 2 of ( $o* ) ) or ( all of ( $x* ) and 2 of them ) ) } rule DITEKSHEN_MALWARE_Win_Clop : FILE { meta: description = "Detects Clop ransomware variants" author = "ditekSHen" id = "d3c9e950-8b03-5d19-8448-9cf208813df2" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4869-L4889" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "a1a21100c468c4db147f97b0724b7a3aefbb92b157071bfe6f61d02768573b44" score = 75 quality = 75 tags = "FILE" strings: $x1 = "Cllp^_-" ascii $s2 = "temp.dat" fullword wide $s3 = "README_README.txt" wide $s4 = "BEGIN PUBLIC KEY" ascii $s5 = "runrun" wide $s6 = "wevtutil.exe" ascii $s7 = "%s%s.Cllp" fullword wide $s8 = "WinCheckDRVs" fullword wide $o1 = { 6a ff 56 89 9d 28 dd ff ff ff d0 a1 64 32 41 00 } $o2 = { 56 89 9d 28 dd ff ff ff 15 78 32 41 00 eb 07 43 } $o3 = { 68 ?? 34 41 00 8d 85 58 dd ff ff 50 ff d7 85 c0 } $o4 = { 68 d0 34 41 00 50 ff d6 8b bd 28 d5 ff ff 83 c4 } $o5 = { a1 64 32 41 00 43 56 89 9d 08 d5 ff ff ff d0 8b } condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $x* ) and ( 3 of ( $s* ) or 4 of ( $o* ) ) ) or ( all of ( $o* ) and 2 of ( $s* ) ) or ( 4 of ( $s* ) and 4 of ( $o* ) ) ) } rule DITEKSHEN_MALWARE_Win_Maktub : FILE { meta: description = "Detects Maktub ransomware" author = "ditekSHen" id = "be47d858-8497-593f-865b-c3d3a5db6c2e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4891-L4905" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "5c11d04fc3088eb8a0132b9ed83748ddb7e1bbe9d03b9e884d4003181cbb6d69" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Content-Disposition: attachment; filename=" ascii $s2 = "Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0" fullword ascii $s3 = "/tor/status-vote/current/consensus" ascii $s4 = "/tor/server/fp/" ascii $s5 = "/tor/rendezvous2/" ascii $s6 = "404 Not found" fullword ascii $s7 = /_request@\d+/ fullword ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_Pwshloader_Runpe01 { meta: description = "Detects PowerShell PE loader / executer. Observed Gorgon TTPs" author = "ditekSHen" id = "fd44f48c-7a24-512b-8375-c9f978a8b5bd" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4907-L4920" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "7dd377f6a1cc48ef8ab9d53989755fb967c89d3798b721781bc09043ba3d86f4" score = 75 quality = 75 tags = "" strings: $rp1 = "GetType('RunPe.RunPe'" ascii $rp2 = "GetType(\"RunPe.RunPe\"" ascii $rm1 = "GetMethod('Run'" ascii $rm2 = "GetMethod(\"Run\"" ascii $s1 = ".Invoke(" ascii $s2 = "[Reflection.Assembly]::Load(" ascii condition: all of ( $s* ) and 1 of ( $rp* ) and 1 of ( $rm* ) } rule DITEKSHEN_MALWARE_Win_Pwshloader_Runpe02 { meta: description = "Detects PowerShell PE loader / executer. Observed Gorgon TTPs" author = "ditekSHen" id = "08261054-bebc-58fe-949a-27f6e817003a" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4922-L4934" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "d7677689938d3e3eb6b59b99b7e347c60214f6edf8e5f83bf85da5a5f1ad33bb" score = 75 quality = 75 tags = "" strings: $s1 = "'.Replace('" ascii nocase $s2 = "'aspnet_compiler.exe'" ascii $s3 = "[Byte[]]$" ascii $pe1 = "(77,90," ascii $pe2 = "='4D5A" ascii condition: all of ( $s* ) and ( #pe1 > 1 or #pe2 > 1 ) and #s1 > 4 } rule DITEKSHEN_MALWARE_Win_Peloader_Runpe : FILE { meta: description = "Detects PE loader / injector. Observed Gorgon TTPs" author = "ditekSHen" id = "262dedee-05d2-5783-b0ff-24470d310ab8" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4936-L4950" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0369c3e2f83a0265c81e5dcd10b4d88753bd6ce3da4bb893a364486712a2b80d" score = 75 quality = 75 tags = "FILE" strings: $s1 = "commandLine'" fullword ascii $s2 = "RunPe.dll" fullword ascii $s3 = "HandleRun" fullword ascii $s4 = "inheritHandles" fullword ascii $s5 = "BlockCopy" fullword ascii $s6 = "WriteProcessMemory" fullword ascii $s7 = "startupInfo" fullword ascii condition: uint16( 0 ) == 0x5a4d and 6 of them } rule DITEKSHEN_MALWARE_Win_Peloader_INF : FILE { meta: description = "Detects PE loader / injector. Potentical HCrypt. Observed Gorgon TTPs" author = "ditekSHen" id = "09823302-34e0-5283-9740-1475ab8077be" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4952-L4963" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "758f7b465b8f9dab5c1194bee266392efe143ac219a5307e6886845b3c862700" score = 75 quality = 75 tags = "FILE" strings: $x1 = "Managament.inf" fullword ascii $x2 = "rOnAlDo" fullword ascii $x3 = "untimeResourceSet" fullword ascii $x4 = "3System.Resources.Tools.StronglyTypedResourceBuilder" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Dlagent08 : FILE { meta: description = "Detects known downloader agent downloading encoded binaries in patches" author = "ditekSHen" id = "e3450f93-7c57-5386-a901-bc5e710657a4" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4965-L4975" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0238c13b00e5778ef216b4e8576c321803da6e269c96c3051b9cc45a3ac6e567" score = 75 quality = 75 tags = "FILE" snort2_sid = "920122" snort3_sid = "920119" strings: $pat = /\/base\/[A-F0-9]{32}\.html/ ascii wide condition: uint16( 0 ) == 0x5a4d and $pat and #pat > 1 } rule DITEKSHEN_MALWARE_Win_Doejocrypt : FILE { meta: description = "Detects DoejoCrypt / DearCry ransomware" author = "ditekSHen" id = "2c90f8e7-ced4-56da-ab8d-61b5ba63dacd" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4977-L4993" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f8a3897de9522340799a59e3e755c323b0defaab73a9030b6b69a1a82c05dcd0" score = 75 quality = 75 tags = "FILE" strings: $s1 = "DEARCRY!" fullword ascii $s2 = ".CRYPT" fullword ascii $s3 = "\\EncryptFile -svcV2\\" ascii $s4 = "please send me the following hash!" ascii $s5 = "dear!!!" fullword ascii $s6 = "/readme.txt" fullword ascii $o1 = { c3 8b 65 e8 c7 45 fc fe ff ff ff 8b b5 f4 e9 ff } $o2 = { 0f 8c 27 ff ff ff 33 db 57 e8 7b 36 00 00 eb 0a } $o3 = { 0f 8c 2a ff ff ff 53 57 e8 b7 42 00 00 8b 4c 24 } condition: uint16( 0 ) == 0x5a4d and 4 of ( $s* ) or ( all of ( $o* ) and ( 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Sunshuttle : FILE { meta: description = "Detects SunShuttle / GoldMax" author = "ditekSHen" id = "1618d0bc-6e72-5f1e-81e7-56611bfd7f8b" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4995-L5017" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "fa8feb069e73aa0a7fcb4daecc1fdf8edeff65e5aeefef161626647fe989e5c0" score = 75 quality = 75 tags = "FILE" strings: $s1 = "main.beaconing" fullword ascii $s2 = "main.clean_file" fullword ascii $s3 = "main.decrypt" fullword ascii $s4 = "main.define_internal_settings" fullword ascii $s5 = "main.delete_empty" fullword ascii $s6 = "main.encrypt" fullword ascii $s7 = "main.false_requesting" fullword ascii $s8 = "main.removeBase64Padding" fullword ascii $s9 = "main.resolve_command" fullword ascii $s10 = "main.retrieve_session_key" fullword ascii $s11 = "main.save_internal_settings" fullword ascii $s12 = "main.send_command_result" fullword ascii $s13 = "main.send_file_part" fullword ascii $s14 = "main.wget_file" fullword ascii $s15 = "main.write_file" fullword ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_Ranzylocker : FILE { meta: description = "Detects RanzyLocker / REntS ransomware" author = "ditekSHen" id = "0d74f6fd-e1d2-5939-991e-7fdd2ca3310b" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5019-L5042" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "15897144843acf49b81c5428fd1bb56d7a2acf16047a6e5d3ca4f2aaa8891577" score = 75 quality = 75 tags = "FILE" strings: $hr1 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550" ascii $hr2 = "776D69632E65786520534841444F57434F5059202F6E6F696E746572616374697665" ascii $hr3 = "626364656469742E657865202F736574207B64656661756C747D207265636F76657279656E61626C6564204E6F" ascii $hr4 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550202D64656C6574654F6C64657374" ascii $hr5 = "626364656469742E657865202F736574207B64656661756C747D20626F6F74737461747573706F6C6963792069676E6F7265616C6C6661696C75726573" ascii $hr6 = "76737361646D696E2E6578652044656C65746520536861646F7773202F416C6C202F5175696574" ascii $hx1 = "476C6F62616C5C33353335354641352D303745392D343238422D423541352D314338384341423242343838" ascii $hx2 = "534F4654574152455C4D6963726F736F66745C45524944" ascii $hx3 = "227375626964223A22" ascii $hx4 = "226E6574776F726B223A22" ascii $hx5 = "726561646D652E747874" ascii $hx6 = "-nolan" fullword wide $o1 = { 8d 45 e9 89 9d 54 ff ff ff 88 9d 44 ff ff ff 3b } $o2 = { 8b 44 24 2? 8b ?c 24 34 40 8b 54 24 38 89 44 24 } $o3 = { 8b 44 24 2? 8b ?c 24 1c 89 44 24 34 8b 44 24 28 } $o4 = { 8b 44 24 2? 8b ?c 24 34 05 00 00 a0 00 89 44 24 } condition: uint16( 0 ) == 0x5a4d and ( all of ( $hx* ) or ( 2 of ( $hr* ) and 2 of ( $hx* ) ) or ( all of ( $o* ) and 2 of ( $h* ) ) ) } rule DITEKSHEN_MALWARE_Win_Wobbychipmbr : FILE { meta: description = "Detects WobbyChipMBR / Covid-21 ransomware" author = "ditekSHen" id = "581fbce1-128d-5323-a259-14d9bfdf09b1" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5044-L5060" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "168c7f610625131c9552252d2b824a90918d2961996ee0f783497dff5cf17351" score = 75 quality = 75 tags = "FILE" strings: $x1 = "You became a Victim of the Covid-21 Ransomware" ascii wide $x2 = "Reinstalling Windows has been blocked" ascii wide $x3 = "Enter Decryption Key:" ascii wide $x4 = "encrypted with military grade encryption" ascii wide $s1 = "schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR" ascii $s2 = "\\EFI\\Boot\\bootx64.efi" ascii wide $s3 = "DumpHex" fullword ascii $s4 = "TFTP Error" fullword wide $s5 = "HD(Part%d,MBRType=%02x,SigType=%02x)" fullword wide condition: uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or all of ( $s* ) or ( 1 of ( $x* ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Snatch : FILE { meta: description = "Detects Snatch / GoRansome / MauriGo ransomware" author = "ditekSHen" id = "00dce673-b909-571f-8117-c5d4ce73fb31" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5062-L5091" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "bf8c33a7203458c80a43944c3117bb897b1702f0024271904d9be682cbd695fc" score = 75 quality = 73 tags = "FILE" strings: $s1 = "main.encryptFile" ascii $s2 = "main.encryptFileExt" ascii $s3 = "main.deleteShadowCopy" ascii $s4 = "main.Shadow" fullword ascii $s5 = "main.RecoverMe" fullword ascii $s6 = "main.EncryptWithPublicKey" ascii $s7 = "main.EncoderLookupDir" fullword ascii $s8 = "main.ALIGNUP" fullword ascii $s9 = "main.encrypt" fullword ascii $s10 = "github.com/mauri870/ransomware" ascii $m1 = "Dear You, ALl Your files On YOUR network computers are encrypted" ascii $m2 = "You have to pay the ransom of %s USD in bitcoins to the address" ascii $m3 = "REMEMBER YOU FILES ARE IN SAVE HANDS AND WILL BE RESTORED OR RECOVERED ONCE PAYMENT IS DONE" ascii $m4 = ":HELP FEEED A CHILD:" ascii $m5 = ">SYSTEM NETWORK ENCRYPTED<" ascii $m6 = "YOUR IDENTIFICATION : %s" ascii $m7 = "convince you of our honesty" ascii $m8 = "use TOR browser to talk with support" ascii $m9 = "encrypted and attackers are taking" ascii $p1 = "/Go/src/kitty/kidrives/" ascii $p2 = "/LGoGo/encoder.go" ascii nocase $p3 = "/Go/src/kitty/kidata/" ascii condition: uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or 2 of ( $m* ) or ( 1 of ( $m* ) and 1 of ( $s* ) ) or ( all of ( $p* ) and ( 1 of ( $s* ) or 1 of ( $m* ) ) ) ) } rule DITEKSHEN_MALWARE_Win_Meteorite : FILE { meta: description = "Detects Meteorite downloader" author = "ditekSHen" id = "ce7a72ce-56a8-5def-a952-f0b08efe8a4a" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5093-L5109" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0ae8183d949046be4257b48571a266f2501d60dd302f511ca1a2d518884e6a7f" score = 75 quality = 75 tags = "FILE" strings: $x1 = "MeteoriteDownloader" fullword ascii wide $x2 = "Meteorite Downloader" fullword ascii wide $x3 = "Meteorite Downloader v" wide $s1 = "regwrite" fullword wide $s2 = "urlmon" fullword ascii $s3 = "wscript.shell" fullword wide $s4 = "modMain" fullword ascii $s5 = "VBA6.DLL" fullword ascii $s6 = "^_http" ascii condition: uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or ( 5 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Legionlocker : FILE { meta: description = "Detects LegionLocker ransomware" author = "ditekSHen" id = "4e5c50d0-808e-5adb-bce9-804ddf66ca61" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5111-L5129" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "2da897b5603415f14fff134b3a94d77e6963da79e117d26ba16e6b04e45f4045" score = 75 quality = 75 tags = "FILE" strings: $m1 = "+Do not run task manager, powershell, cmd etc." ascii wide $m2 = "3 hours your files will be deleted." ascii wide $m3 = "files have been encrypted by Legion Locker" ascii wide $s1 = "passwordBytes" fullword ascii $s2 = "_start_enc_" ascii $s3 = "_del_desktop_" ascii $s4 = "Processhacker" wide $s5 = "/k color 47 && del /f /s /q %userprofile%\\" wide $s6 = "Submit code" fullword wide $pdb1 = "\\obj\\Debug\\LegionLocker.pdb" ascii $pdb2 = "\\obj\\Release\\LegionLocker.pdb" ascii condition: uint16( 0 ) == 0x5a4d and ( 1 of ( $m* ) or 1 of ( $pdb* ) or 4 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Dlagentgo : FILE { meta: description = "Detects Go-based downloader" author = "ditekSHen" id = "e16ccb89-2eb6-5457-a88e-f802f3c35764" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5131-L5144" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b9dd2446eddff18be00feb34d8911600feb395a9ce2566786d42b48b444230d0" score = 75 quality = 75 tags = "FILE" strings: $s1 = "main.downloadFile" fullword ascii $s2 = "main.fetchFiles" fullword ascii $s3 = "main.createDefenderAllowanceException" fullword ascii $s4 = "main.unzip" fullword ascii $s5 = "HideWindow" fullword ascii $s6 = "/go/src/installwrap/main.go" ascii condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_MALWARE_Win_Blackmoon : FILE { meta: description = "Detects executables using BlackMoon RunTime" author = "ditekSHen" id = "76071d36-3d2d-589c-8c3f-0ae60e69996e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5146-L5155" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "05bfde8ec3a469df5707c195e25995ac6af730e8a1595b1a598276c024420be2" score = 75 quality = 75 tags = "FILE" strings: $s1 = "blackmoon" fullword ascii $s2 = "BlackMoon RunTime Error:" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Iceid : FILE { meta: description = "Detects IceID / Bokbot variants" author = "ditekSHen" id = "0da94737-0f82-5892-a0eb-f9f3c0a114cc" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5157-L5176" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "204b4c297806a36ca14bb3e659824f4eb49b18308af7090f0db1194705f1e2c9" score = 75 quality = 75 tags = "FILE" strings: $n1 = "POST" fullword wide $n2 = "; _gat=" fullword wide $n3 = "; _ga=" fullword wide $n4 = "; _u=" fullword wide $n5 = "; __io=" fullword wide $n6 = "; _gid=" fullword wide $n7 = "Cookie: __gads=" fullword wide $s1 = "c:\\ProgramData" ascii $s2 = "loader_dll_64.dll" fullword ascii $s3 = "loader_dll_32.dll" fullword ascii $s4 = "/?id=%0.2X%0.8X%0.8X%s" ascii $s5 = "%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.8X" ascii condition: uint16( 0 ) == 0x5a4d and ( ( all of ( $n* ) and 1 of ( $s* ) ) or ( 3 of ( $s* ) and 1 of ( $n* ) ) ) } rule DITEKSHEN_MALWARE_Win_Purge : FILE { meta: description = "Detects Purge ransomware" author = "ditekSHen" id = "b3fb9f38-ce12-5e0e-8908-3379b5da3497" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5178-L5201" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "83d13eca69bc99539e47d6d29689edf2a4fcd2260c6e909582126a490eef8115" score = 75 quality = 75 tags = "FILE" strings: $n1 = "imagesave/imagesize.php" ascii $n2 = "imageinfo.html" ascii $n3 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)" ascii $n4 = "Content-Type: application/x-www-form-urlencoded" ascii $m1 = "YOUR_ID: %x%x" wide $m2 = "Specially for your PC was generated personal" wide $m3 = "which is on our Secret Server" wide $m4 = "wait for a miracle and get your price" wide $s1 = "%s\\SpyHunter Remove Ransomware" wide $s2 = "$recycle.bin" fullword wide $s3 = "TheEnd" fullword wide $s4 = "%s\\HELP_DECRYPT_YOUR_FILES.TXT" fullword wide $s5 = "%s.id_%x%x_email_" wide $s6 = "scmd" fullword wide $s7 = "process call create \"%s\"" wide $s8 = "FinishEnds" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $n* ) or 2 of ( $m* ) or ( 3 of ( $s* ) and ( 1 of ( $n* ) or 1 of ( $m* ) ) ) ) } rule DITEKSHEN_MALWARE_Win_Njrat : FILE { meta: description = "Detects NjRAT / Bladabindi / NjRAT Golden" author = "ditekSHen" id = "078dea64-8f95-5939-a1fb-c0a888adcf0d" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5203-L5220" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "92d535a7c7f361b7a0901d0b99427ebc82a69577bfea73c04a7f9d51d2054b36" score = 75 quality = 75 tags = "FILE" strings: $x1 = /Njrat\s\d+\.\d+\sGolden\s/ wide $s1 = /\sfirewall\s(add|delete)\sallowedprogram/ wide $s2 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 (63|6b) 00 20 00 70 00 69 00 6e 00 67 } $s3 = "Execute ERROR" wide $s4 = "Download ERROR" wide $s5 = "[kl]" fullword wide $s6 = "UploadValues" fullword wide $s7 = "winmgmts:\\\\.\\root\\SecurityCenter2" fullword wide $s8 = "HideM" fullword wide $s9 = "No Antivirus" fullword wide condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_MALWARE_Win_Darktrackrat : FILE { meta: description = "Detects OzoneRAT / DarkTrack / DarkSky" author = "ditekSHen" id = "ef8675f8-f643-5948-a967-e4a9ce5ab89e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5222-L5245" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "2a831c0f7707864d8c9e9fa338085a52933869d8cfbdbe0d12715da301c12646" score = 75 quality = 75 tags = "FILE" strings: $x1 = "Klog.dat" ascii $x2 = "I_AM_DT" ascii $x3 = " Alien" ascii $x4 = "Local Victim" ascii $x5 = "Dtback\\AlienEdition\\Server\\SuperObject.pas" ascii $x6 = "].encryptedUsername" ascii $x7 = "].encryptedPassword" ascii $x8 = { 49 41 4d [6] 44 41 52 [0-2] 4b [6] 44 54 41 43 4b } $s1 = "AntiVirusProduct" ascii $s2 = "AntiSpywareProduct" ascii $s3 = "ConnectServer" ascii $s4 = "ExecQuery" ascii $s5 = "\\Drivers\\Etc\\Hosts" fullword ascii $s6 = "BTMemoryLoadLibary: Get DLLEntyPoint" ascii $s7 = "\\\\.\\SyserDbgMsg" fullword ascii $s8 = "\\\\.\\SyserBoot" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 4 of ( $x* ) or 6 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Godzilla : FILE { meta: description = "Detects Godzilla loader" author = "ditekSHen" id = "3384b844-6abf-5f94-a62b-7ebbdfe321bd" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5247-L5265" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ff87fbaaf488ac69e06a03a7f8e5305ec114caa6271c25fa130033f50f0d9095" score = 75 quality = 75 tags = "FILE" strings: $x1 = "MSVBVM60.DLL" fullword ascii $x2 = "Loginserver8" fullword ascii $x3 = "Proflogger7" fullword ascii $s1 = "Badgeless5" fullword ascii $s2 = "Montebrasite3" fullword ascii $s3 = "Atelomyelia4" fullword ascii $s4 = "Xxencoded5" fullword ascii $s5 = "Garneau2" fullword ascii $s6 = "Hypostasis0" fullword ascii $s7 = "Piarhemia4" fullword ascii $s8 = "Foredestine8" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of ( $x* ) and 2 of ( $s* ) } rule DITEKSHEN_MALWARE_Win_UNK03 : FILE { meta: description = "Detects unknown malware" author = "ditekSHen" id = "b0711427-b6bf-5e4b-af36-9c752ead4d6c" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5267-L5280" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f1a4be68206628c3addbce8b6bbc1f801e67632d4e6a6af1d45cdad833e9a991" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Software\\Microsoft\\Windows\\CurrentVersion" ascii $s2 = "rundll32.exe C:\\Windows\\System32\\shimgvw.dll,ImageView_Fullscreen %s" ascii $s3 = "%s.jpg" ascii $s4 = "%s\\sz.txt" ascii $s5 = "ChromeSecsv9867%d7.exe" ascii $s6 = "%s\\appl%c.jpg" ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_UNK04 : FILE { meta: description = "Detects unknown malware (proxy tool)" author = "ditekSHen" id = "6a178f37-a9fd-5a83-a550-c6333342ac9b" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5282-L5296" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ba6e5bbc1d094b23e3870af963503d1ccbcd56adc24126b4a38b77d4b88b4b67" score = 75 quality = 75 tags = "FILE" strings: $x1 = "127.0.0.1/%d" fullword ascii $x2 = "SYSTEM\\CurrentControlSet\\SERVICES\\PORTPROXY\\V4TOV4\\TCP" fullword ascii $x3 = "%s rundll32.exe" fullword ascii $s1 = "kxetray.exe" fullword ascii $s2 = "ksafe.exe" fullword ascii $s3 = "Mcshield.exe" fullword ascii $s4 = "Miner.exe" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of ( $x* ) and 2 of ( $s* ) } rule DITEKSHEN_MALWARE_Win_Karkoff : FILE { meta: description = "Detects Karkoff" author = "ditekSHen" id = "7d2fe783-18b3-5d84-a9b5-e8e0b5a0db98" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5298-L5313" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e9b6ba5be2b3cd0faa898347e57cee5a57b80b19842c3a1ddb42d620307c8b39" score = 75 quality = 75 tags = "FILE" strings: $x1 = "C:\\Windows\\Temp\\MSEx_log.txt" fullword wide $x2 = "CMD.exe" fullword wide $x3 = "Karkoff.ProjectInstaller.resources" fullword ascii $s1 = /try\shttp(s)?\s(ip|domain)/ fullword wide $s2 = "Reg cleaned!" fullword wide nocase $s3 = "Content-Disposition: form-data; name=\"{1}\"" fullword wide $s4 = "^[A-Fa-f0-9]{8}-([A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}$" fullword wide $s5 = "new backdoor" fullword wide condition: uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or 4 of ( $s* ) or ( 2 of ( $x* ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Dlagent09 : FILE { meta: description = "Detects known downloader agent" author = "ditekSHen" id = "90f71ac7-19d9-5a8e-9830-df2f16e12c9b" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5315-L5328" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "9336507fa4bb9d3a6325d5e9caafc8c4e816a0166fded7d4e53e09a87628bc89" score = 75 quality = 71 tags = "FILE" strings: $h1 = "//:ptth" ascii wide nocase $h2 = "//:sptth" ascii wide nocase $s1 = "DownloadString" fullword ascii wide $s2 = "StrReverse" fullword ascii wide $s3 = "FromBase64String" fullword ascii wide $s4 = "WebClient" fullword ascii wide condition: uint16( 0 ) == 0x5a4d and ( 1 of ( $h* ) and all of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Coinminingbot : FILE { meta: description = "Detects coinmining bot" author = "ditekSHen" id = "df15bfbd-f531-5eaa-b160-ad8a1fbe992f" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5330-L5343" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "a307a6c9184e8f4068cfa89a8432ae017c8aab10b706ba065051f8749860c15c" score = 75 quality = 75 tags = "FILE" strings: $s1 = "FullScreenDetect" fullword ascii $s2 = "GetChildProcesses" fullword ascii $s3 = "HideBotPath" fullword ascii $s4 = "Inject" fullword ascii $s5 = "DownloadFile" fullword ascii $s6 = "/Data/GetUpdateInfo" wide condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_Fyanti : FILE { meta: description = "Hunt for FYAnti third-stage loader DLLs" author = "ditekSHen" id = "7a1f913c-d83f-50e9-943c-246c4c71c654" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5345-L5351" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "baaeef0b1452d7ea41ffaaff592cac2c5e16f921dbbfb3a300a63e69f134e9d0" score = 75 quality = 75 tags = "FILE" condition: uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and pe.exports ( "FuckYouAnti" ) } rule DITEKSHEN_MALWARE_Win_Pureloader : FILE { meta: description = "Detects Pure loader / injector" author = "ditekSHen" id = "ad44a12a-4ac7-5cc7-92ab-13c23514de69" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5366-L5382" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "1f0bd20e769ea79d28d6e60ca06aa8aa2b3436426cfe0cd4f2023a08236875cd" score = 75 quality = 75 tags = "FILE" strings: $s1 = "InvokeMember" fullword wide $s2 = "ConcatProducer" fullword wide $s3 = ".Classes.Resolver" wide $s4 = "get_DLL" fullword ascii $s5 = "BufferedStream" fullword ascii $s6 = "GZipStream" fullword ascii $s7 = "MemoryStream" fullword ascii $s8 = "Decompress" fullword ascii $s9 = "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ascii condition: uint16( 0 ) == 0x5a4d and 8 of them } rule DITEKSHEN_MALWARE_Win_VBS_Dlagent01 { meta: description = "Detects VBS MSHTA downloader" author = "ditekSHen" id = "447ea323-ecab-5f6b-b13e-0690254c754e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5384-L5395" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0e47839a55773764aca0aebcf1078c06c729b86d1e2f18d7d64e3bb11e87f3eb" score = 75 quality = 75 tags = "" strings: $s1 = "llehS.tpircsW" ascii $s2 = ".Run" ascii $s3 = "mshta http" ascii nocase $s4 = "StrReverse" ascii condition: all of them } rule DITEKSHEN_MALWARE_Win_Ranumbot : FILE { meta: description = "Detects RanumBot / Windigo / GoStealer" author = "ditekSHen" id = "26a0832e-8a39-5a0e-bd39-710744212c16" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5397-L5430" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "a9c32445e62d072e4184d25497696ef6225edb176dc7a9743a54194d4ddb4b0c" score = 75 quality = 73 tags = "FILE" strings: $f1 = "main.addSchedulerTaskSSH" fullword ascii $f2 = "main.attackRouter" fullword ascii $f3 = "main.decryptPassword" fullword ascii $f4 = "main.handleScanRequest" fullword ascii $f5 = "main.scanNetwork" fullword ascii $f6 = "main.extractCredentials" fullword ascii $s1 = "H_T= H_a= H_g= MB, W_a= and h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s/16%s:%d%s:22+0330+0430+0530+0545+0630+0845+10" ascii $s2 = "<== as at fp= is lr: of on pc= sp: sp=) = ) m=+Inf, n -Inf00%x112212343125: p=ABRTACDTACSTAEDTAESTAKDTAKSTALRMAWSTAhomAtoiCESTChamDashEESTGOGCJulyJuneKILLLEAFLisuMiaoModiNZDTNZSTNewaPIPEQUITSASTSEGVTERMThai" ascii $s3 = "W*struct { P *big.Int; Q *big.Int; G *big.Int; Y *big.Int; Rest []uint8 \"ssh:\\\"rest\\\"\" }" ascii $s4 = "policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write" ascii $s5 = "/Users/alexander/go/src/mikrotik/winbox.go" ascii $xf1 = "main.readConfig" fullword ascii $xf2 = "main.ensureRunningAsUser" fullword ascii $xf3 = "main.configRegPath" fullword ascii $xf4 = "main.oldConfigRegPath" fullword ascii $uf1 = "main.locateChrome" fullword ascii $uf2 = "main.decryptAndUploadProfile" fullword ascii $uf3 = "main.decryptCookies" fullword ascii $uf4 = "main.extractPasswords" fullword ascii $uf5 = "main.getFirefoxProfile" fullword ascii $uf6 = "main.postBrowsersData" fullword ascii $uf7 = "main.uploadFirefoxProfile" fullword ascii $uf8 = "main.zipFirefoxProfile" fullword ascii $uf9 = /main\.detect(Browsers|Chrome|Coccoc|Edge|Firefox|InternetExplorer|Opera|Yandex)/ fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 5 of ( $f* ) or 4 of ( $s* ) or ( 2 of ( $f* ) and 2 of ( $s* ) ) or ( all of ( $xf* ) and 1 of ( $uf* ) ) or 6 of ( $uf* ) ) } rule DITEKSHEN_MALWARE_Win_Dllhijacker01 : FILE { meta: description = "Hunt for VSNTAR21 / DllHijacker01 IronTiger / LuckyMouse / APT27 malware" author = "ditekSHen" id = "0a858058-310a-5b1c-a6fe-abdec7b25abe" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5432-L5448" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "48535c0bb5342e2f91ac9d015c761d8d543b122dd3cc08b7029631fcf3037bfb" score = 75 quality = 75 tags = "FILE" strings: $s1 = "libvlc_add_intf" fullword ascii $s2 = "libvlc_dllonexit" fullword ascii $s3 = "libvlc_getmainargs" fullword ascii $s4 = "libvlc_initenv" fullword ascii $s5 = "libvlc_set_app_id" fullword ascii $s6 = "libvlc_set_app_type" fullword ascii $s7 = "libvlc_set_user_agent" fullword ascii $s8 = "libvlc_wait" fullword ascii $s9 = "dll.dll" fullword ascii condition: uint16( 0 ) == 0x5a4d and 6 of them } rule DITEKSHEN_MALWARE_Win_Hyperbro02 : FILE { meta: description = "Detects HyperBro IronTiger / LuckyMouse / APT27 malware" author = "ditekSHen" id = "1880afd7-ca06-5b43-af8f-e791ded0d7d8" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5450-L5474" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ca4ee116516549fc42f7e32b3c24d631b7f2c638efbde5c07227358e78fd6f35" score = 75 quality = 75 tags = "FILE" strings: $s1 = "\\cmd.exe /A" fullword wide $s2 = "C:\\windows\\explorer.exe" fullword wide $s3 = "\\\\.\\pipe\\testpipe" fullword wide $s4 = "Elevation:Administrator!new:{" wide $s5 = "log.log" fullword wide $s6 = "%s\\%d.exe" fullword wide $s7 = ".?AVTPipeProtocol@@" fullword ascii $s8 = ".?AVTCaptureMgr@@" fullword ascii $s9 = "system-%d" fullword wide $s10 = "[test] %02d:%02d:%02d:%03d %s" fullword wide $s11 = "\\..\\data.dat" fullword wide $s12 = "\\..\\config.ini" fullword wide $s13 = { 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 20 00 2d 00 77 00 6f 00 72 00 6b 00 65 00 72 00 } $s14 = { 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 20 00 2d 00 64 00 61 00 65 00 6d 00 6f 00 6e 00 } $cnc1 = "https://%s:%d/ajax" fullword wide $cnc2 = "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36" fullword wide $cnc3 = "139.180.208.225" fullword wide condition: uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or ( 2 of ( $cnc* ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Dllhijacker02 : FILE { meta: description = "Detects ServiceCrt / DllHijacker03 IronTiger / LuckyMouse / APT27 malware" author = "ditekSHen" id = "de5eee06-570a-5ec3-9e1b-13de4c4f260f" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5512-L5527" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "d4eb236256c413d4d3223cc897783f5631c7798c0f3280e72d8c8504438fcaf9" score = 75 quality = 75 tags = "FILE" strings: $s1 = "ServiceCrtMain" fullword ascii $s2 = "mpsvc.dll" fullword ascii $o1 = { 84 db 0f 85 4c ff ff ff e8 14 06 00 00 8b f0 83 } $o2 = { f7 c1 00 ff ff ff 75 c5 eb 13 0f ba 25 10 20 01 } $o3 = { 8d 04 b1 8b d9 89 45 fc 8d 34 b9 a1 18 20 01 10 } $o4 = { b0 01 c3 68 b8 2c 01 10 e8 83 ff ff ff c7 04 24 } $o5 = { eb 34 66 0f 12 0d 00 fe 00 10 f2 0f 59 c1 ba cc } $o6 = { 73 c7 dc 0d 4c ff 00 10 eb bf dd 05 34 ff 00 10 } condition: uint16( 0 ) == 0x5a4d and all of ( $s* ) and 5 of ( $o* ) } rule DITEKSHEN_MALWARE_Win_Zeoticus : FILE { meta: description = "Detects Zeoticus ransomware" author = "ditekSHen" id = "6d1096dd-d075-54eb-ade9-48e2f945145d" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5529-L5549" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "588c140c141e82dae56758550549dfb96410db50521ac546477e1adc5575b4a0" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Dear %s" fullword wide $s2 = "\\??\\UNC\\%s\\%s\\" wide $s3 = "\\\\%ws\\admin$\\%ws" wide $s4 = "%s /node:\"%ws\" /user:\"%ws\" /password:" wide $s5 = "process call create" wide $s6 = ">----===Zeoticus" ascii $s7 = "ZEOTICUSV2" ascii $s8 = "GetExtendedTcpTable" fullword ascii $s9 = "SHAMROckSWTF" ascii $s10 = "NTDLL.RtlAllocateHeap" fullword ascii $s11 = ".pandora" fullword wide $s12 = { 70 00 20 00 72 00 20 00 69 00 20 00 76 00 20 00 65 00 20 00 74 } $pdb = "_cryptor\\shell_gen\\Release\\" ascii condition: uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or ( $pdb ) ) } rule DITEKSHEN_MALWARE_Win_Dlagent11 : FILE { meta: description = "Detects downloader agent" author = "ditekSHen" id = "c8bf9b1a-4ec1-5291-a334-82c79980ef53" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5551-L5564" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "61df4855766050237c0b67bf70684020beb5d88f5928fa2814077e505be938a6" score = 75 quality = 75 tags = "FILE" strings: $pdb = "\\loader2\\obj\\Debug\\loader2.pdb" ascii $s1 = "DownloadFile" fullword ascii $s2 = "ZipFile" fullword ascii $s3 = "WebClient" fullword ascii $s4 = "ExtractToDirectory" fullword ascii $s5 = "System Clear" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( ( $pdb ) and 4 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Softcnapp : FILE { meta: description = "Detects SoftCNApp" author = "ditekSHen" id = "473442e2-d411-5e2b-948e-c7ce034a5810" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5566-L5583" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "2d7f4320282218842fa2e82906bcaf691610ad1a6ea257a2a9fc9e062229a2e8" score = 75 quality = 75 tags = "FILE" strings: $s1 = "\\\\.\\PIPE\\SOC%d" fullword ascii $s2 = "Mozilla/5.0 (Windows NT 6.1)" fullword ascii $s3 = "Param: sl=%d; sl=%d; sl=%d; sl=%d; sl=%d;" fullword ascii $s4 = ".?AVCHPPlugin@@" fullword ascii $s5 = ".?AVCHPCmd@@" fullword ascii $s6 = ".?AVCHPExplorer@@" fullword ascii $s7 = "%s\\svchost.exe -O" fullword wide $s8 = "\"%s\\%s\" -P" fullword ascii $n1 = "45.63.58.34" fullword ascii $n2 = "127.0.0.1" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( all of ( $n* ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Covenantgruntstager : FILE { meta: description = "Detects Covenant Grunt Stager" author = "ditekSHen" id = "61495541-ed9c-5227-aa50-cbaeacfb20a2" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5585-L5606" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "638f63f605b21154f062b0f4d0659cd6cd87aee319debb2c1a991a679fec087a" score = 75 quality = 75 tags = "FILE" strings: $x1 = "VXNlci1BZ2VudA" ascii wide $x2 = "cGFnZT17R1VJRH0mdj0x" ascii wide $x3 = "0eXBlPXtHVUlEfSZ2PTE" ascii wide $x4 = "tZXNzYWdlPXtHVUlEfSZ2PTE" ascii wide $x5 = "L2VuLXVzL" ascii wide $x6 = "L2VuLXVzL2luZGV4Lmh0bWw" ascii wide $x7 = "L2VuLXVzL2RvY3MuaHRtbD" ascii wide $s1 = "ExecuteStager" ascii $s2 = "UseCertPinning" fullword ascii $s3 = "FromBase64String" fullword ascii $s4 = "ToBase64String" fullword ascii $s5 = "DownloadString" fullword ascii $s6 = "UploadString" fullword ascii $s7 = "GetWebRequest" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or all of ( $s* ) or ( 1 of ( $x* ) and 5 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Fabookie : FILE { meta: description = "Detects Fabookie / ElysiumStealer" author = "ditekSHen" id = "dfa653c4-37d9-5e31-9c47-23adf751e4aa" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5608-L5624" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "bbe10323817d501a361a33abf61a49ad59fcac69d78d9d9ec1744ee99a4b4629" score = 75 quality = 73 tags = "FILE" strings: $s1 = "rwinssyslog" fullword wide $s2 = "_kasssperskdy" fullword wide $s3 = "[Title:%s]" fullword wide $s4 = "[Execute]" fullword wide $s5 = "[Snapshot]" fullword wide $s6 = "Mozilla/4.0 (compatible)" fullword wide $s7 = "d-k netsvcs" fullword wide $s8 = "facebook.websmails.com" fullword wide $s9 = "CUdpClient::Start" fullword ascii condition: ( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x0805 ) and 6 of them } rule DITEKSHEN_MALWARE_Win_Cobianrat : FILE { meta: description = "Detects CobianRAT, a fork of Njrat" author = "ditekSHen" id = "5a9b6f04-fc52-52a9-b72f-d24dd093e886" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5626-L5640" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "5c8f55e5328b61c3591c876797b4521f8e98af7a6c53bab918f10d5c3c2b5013" score = 75 quality = 75 tags = "FILE" strings: $s1 = "1.0.40.7" fullword wide $s2 = "DownloadData" fullword wide $s3 = "Executed As" fullword wide $s4 = "\\Plugins" fullword wide $s5 = "LOGIN" fullword wide $s6 = "software\\microsoft\\windows\\currentversion\\run" wide $s7 = "Hidden" fullword wide condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_Leivion : FILE { meta: description = "Detects Leivion" author = "ditekSHen" id = "77800add-8fff-5657-9ed6-a23517bce0b1" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5660-L5673" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "a0cda23df4301b66feedad7c04b4d051c07474ccaa07c05598dd0b47bb6fc7e6" score = 75 quality = 75 tags = "FILE" strings: $s1 = "/var/lib/veil/go/src/runtime/mem_windows.go" fullword ascii $s2 = "/var/lib/veil/go/src/internal/singleflight/singleflight.go" fullword ascii $s3 = "/var/lib/veil/go/src/net/http/sniff.go" fullword ascii $s4 = "/var/lib/veil/go/src/net/sendfile_windows.go" fullword ascii $s5 = "/var/lib/veil/go/src/os/exec_" ascii $s6 = "/var/lib/veil/go/src/runtime/mgcsweep.go" fullword ascii condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_MALWARE_Win_Banload : FILE { meta: description = "Detects Banload" author = "ditekSHen" id = "4672bce1-1280-576d-b7df-f0181a854058" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5675-L5688" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "5cbc69d11b73f60d6eee3f23ed6cc217ba37a3408cb69e396e0394b5a1e20b75" score = 75 quality = 75 tags = "FILE" strings: $s1 = "main.die" fullword ascii $s2 = "main.postResults" fullword ascii $s3 = "main.checkin" fullword ascii $s4 = "RegQueryValueExWRemoveDirectoryWSETTINGS_TIMEOUTTerminateProcessUpgrade RequiredUser-Agent: %s" ascii $s5 = "pcuser-agentws2_32.dll (targetpc= DigestType ErrCode=%v" ascii $s6 = "invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrie" fullword ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_Infinitylock : FILE { meta: description = "Detects InfinityLock ransomware" author = "ditekSHen" id = "7a66cc19-c635-580b-abc2-b58bd48673bd" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5705-L5723" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "634759f1c2d48becebc9c87e146e898524071738f74b7001b112dc793bcb581c" score = 75 quality = 73 tags = "FILE" strings: $s1 = "_Encrypted$" fullword ascii $s2 = "PublicKeyToken=" fullword ascii nocase $s3 = "GenerateHWID" fullword ascii $s4 = "CreateKey" fullword ascii $d1 = "ProgrammFiles" fullword ascii $d2 = "OneDrive" fullword ascii $d3 = "ProgrammsX86" fullword ascii $d4 = "UserDirs" fullword ascii $d5 = "B_Drive" fullword ascii $pdb1 = "F:\\DESKTOP!\\ChkDsk\\ChkDsk\\obj\\" ascii $pdb2 = "\\ChkDsk\\obj\\Debug\\PremiereCrack.pdb" ascii condition: uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 1 of ( $d* ) ) or ( 4 of ( $d* ) and 2 of ( $s* ) ) or ( any of ( $pdb* ) and 1 of ( $s* ) and 1 of ( $d* ) ) ) } rule DITEKSHEN_MALWARE_Win_Mountlocker : FILE { meta: description = "Detects MountLocker ransomware" author = "ditekSHen" id = "0590d08d-1ee8-5dfe-af12-15b149acd2d6" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5725-L5740" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "30bc601fef60cc1c9d8bff5dd3f8a53214f088b74eb24fe2369f5664613e0eaf" score = 75 quality = 75 tags = "FILE" strings: $s1 = "] locker.dir.check > " ascii wide $s2 = "] locekr.kill." ascii wide $s3 = "] locker.worm" ascii wide $s4 = "%CLIENT_ID%" fullword ascii $s5 = "RecoveryManual.html" ascii wide $s6 = "RECOVERY MANUAL" ascii $s7 = ".ReadManual.%0.8X" ascii wide $s8 = "/?cid=%CLIENT_ID%" ascii condition: uint16( 0 ) == 0x5a4d and 3 of them } rule DITEKSHEN_MALWARE_Win_Pingback : FILE { meta: description = "Detects PingBack ICMP backdoor" author = "ditekSHen" id = "ecb313b6-f923-5b6d-a4d7-a4650817ed84" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5742-L5761" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c5fa9ecefca1188ba5e81c0518f74023884ad0f66718fc030601cb458bdf2f12" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Sniffer ok!" fullword ascii $s2 = "recv icmp packet!" fullword ascii $s3 = "WSASocket() failed: %d" fullword ascii $s4 = "file on remote computers success" ascii $s5 = "listen port error!" fullword ascii $s6 = "\\PingBackService" ascii $c1 = "exec" fullword ascii $c2 = "rexec" fullword ascii $c3 = "exep" fullword ascii $c4 = "download" fullword ascii $c5 = "upload" fullword ascii $c6 = "shell" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or all of ( $c* ) or ( 4 of ( $c* ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Bazarloader : FILE { meta: description = "Detects BazarLoader variants" author = "ditekSHen" id = "6282df59-7244-501f-bb60-09a2a519bd47" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5763-L5776" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "8febd1355bc03f71794ffb8d51cbb112e8acd2d26fec5bb736a388d5384e7747" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Startdelay for %d ms to avoid some dynamic AV detects!" ascii $s2 = "Use Debug for moving faster!" ascii $s3 = "Logging Mutex %s to %s" ascii $s4 = "FIRST AND ONLY COPY RUNNING! Mutex %s" ascii $s5 = "the most secret 3d GetWinApiPointers line in the world!" ascii $s6 = "[+] makeMD5hash. " ascii condition: uint16( 0 ) == 0x5a4d and 3 of ( $s* ) } rule DITEKSHEN_MALWARE_Win_Coinminer01 : FILE { meta: description = "Detects coinmining malware" author = "ditekSHen" id = "739e7cea-c6b6-5add-86d4-382b00e2b645" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5778-L5790" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "31a7531ecc7b8a35ba882c17d15bd3581e65b4b99dd3a7cb8bca8f6edf204114" score = 75 quality = 75 tags = "FILE" strings: $s1 = "-o pool." ascii wide $s2 = "--cpu-max-threads-hint" ascii wide $s3 = "-P stratum" ascii wide $s4 = "--farm-retries" ascii wide $dl = "github.com/ethereum-mining/ethminer/releases/download" ascii wide condition: uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or ( $dl ) ) } rule DITEKSHEN_PUA_Win_Ultrasurf : FILE { meta: description = "Detects UltraSurf / Ultrareach PUA" author = "ditekSHen" id = "ba0f6867-bddc-5e72-978c-8e29b1b6b709" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5792-L5807" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "d8d17b1bf20c12f864697d3dd66f345a8b93e2a75f0489b58b23b7f5264b6be3" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Ultrareach Internet Corp." ascii $s2 = "UltrasurfUnionRectUrlFixupWUse Proxy" ascii $s3 = "Ultrasurf UnlockFileUrlEscapeWUser-Agent" ascii wide $s4 = "Ultrasurf0#" ascii $m1 = "main.bindata_read" fullword ascii $m2 = "main.icon64_png" fullword ascii $m3 = "main.setProxy" fullword ascii $m4 = "main.openbrowser" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $s* ) or ( all of ( $m* ) and 1 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Hello : FILE { meta: description = "Hunt for Hello / WickrMe ransomware" author = "ditekSHen" id = "99c11aab-8a3a-5e10-9af0-542e55129d51" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5809-L5820" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f52f12eb38613f5afd5258b5263c6e6e2d9db6c9659a769f896a2bb66564fa69" score = 75 quality = 75 tags = "FILE" strings: $s1 = "DeleteBackupFiles" ascii wide $s2 = "GetEncryptFiles" ascii wide $s3 = "DeleteVirtualDisks" ascii wide $s4 = "DismountVirtualDisks" ascii wide condition: uint16( 0 ) == 0x5a4d and 3 of them } rule DITEKSHEN_MALWARE_Win_Buterat : FILE { meta: description = "Detects ButeRAT" author = "ditekSHen" id = "74f63d61-6589-5fb1-864a-3a02ddd57ebc" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5822-L5839" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c3d93e8dc1bde8e77c11586c8d8b67d137ef2c4791e12269f1af310fbe14832b" score = 75 quality = 73 tags = "FILE" strings: $x1 = "TVqQAAMAA" ascii $s1 = "ipinfo.io/geo" wide $s2 = "/index.php" wide $s3 = "Copy-Item -Path" wide $s4 = ";Start-Process" wide $s5 = "Microsoft\\Windows\\Start Menu\\Programs\\Startup" wide $s6 = "LOCALAPPDATA" fullword wide $s7 = "passwords.json" wide $s8 = "Scripting.FileSystemObject" fullword wide $z1 = /(edge|chrome|opera|exodus|jaxx|atomic|coinomi)\.zip/ ascii wide nocase condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) or 1 of ( $z* ) ) and ( 4 of ( $s* ) ) or ( 6 of ( $s* ) ) or ( #z1 > 4 and 2 of them ) ) } rule DITEKSHEN_MALWARE_Win_Cookiestealer : FILE { meta: description = "Detects generic cookie stealer" author = "ditekSHen" id = "64c6c59d-4046-5949-bf71-22a5f6bfa209" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5841-L5857" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "9cc406ae078e37430b3cf10954c02014b9760bc887344842e724df735d1d9808" score = 75 quality = 75 tags = "FILE" strings: $s1 = "([\\S]+?)=([^;|^\\r|^\\n]+)" fullword ascii $s2 = "(.+?): ([^;|^\\r|^\\n]+)" fullword ascii $s3 = "Set-Cookie: ([^\\r|^\\n]+)" fullword ascii $s4 = "cmd.exe /c taskkill /f /im chrome.exe" fullword ascii $s5 = "FIREFOX.EXE|Google Chrome|IEXPLORE.EXE" ascii $pdb1 = "F:\\facebook_svn\\trunk\\database\\Release\\DiskScan.pdb" fullword ascii $pdb2 = "D:\\Projects\\crxinstall\\trunk\\Release\\spoofpref.pdb" fullword ascii $ua1 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36" fullword ascii $ua2 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 1 of ( $pdb* ) and 1 of ( $ua* ) ) or ( all of ( $ua* ) and 1 of ( $pdb* ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Bitcoingrabber : FILE { meta: description = "Detects generic bitcoin stealer" author = "ditekSHen" id = "f73b58da-1db5-5767-ae0a-074648e30966" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5859-L5875" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "2dc762525c1fbf25517df52f0561d96d7469bf1367eada31c236fc313001c6cb" score = 75 quality = 75 tags = "FILE" strings: $s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide $s2 = "Bitcoin-Grabber" ascii $s3 = "Bitcoin_Grabber" ascii $s4 = "encrypt resources [compress]T" fullword ascii $s5 = "code control flow obfuscationT" fullword ascii $s6 = "\\Users\\lakol\\Desktop\\a\\Crypto Currency Wallet Changer\\" ascii $pat1 = "\\b(bc1|[13])[a-zA-HJ-NP-Z0-9]{26,35}\\b" fullword wide $pat2 = "\\b0x[a-fA-F0-9]{40}\\b" fullword wide $pat3 = "\\b4([0-9]|[A-B])(.){93}\\b" fullword wide condition: uint16( 0 ) == 0x5a4d and 4 of ( $s* ) or ( all of ( $pat* ) and 2 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_FOXGRABBER : FILE { meta: description = "Detects FOXGRABBER utility" author = "ditekSHen" id = "b98e501c-e9c6-5fcc-bfa0-9475ce32864c" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5877-L5890" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "5ecba516f1155bdcccf83b0a034b11d8eac8619d4c3326fdbc76082fbe4daf02" score = 75 quality = 75 tags = "FILE" strings: $s1 = "start grabbing" wide $s2 = "end grabbing in" wide $s3 = "error of copying files from comp:" wide $s4 = "\\Firefox\\" wide nocase $pdb1 = "\\obj\\Debug\\grabff.pdb" ascii $pdb2 = "\\obj\\Release\\grabff.pdb" ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $pdb* ) and 1 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Browsergrabber : FILE { meta: description = "Hunt for FOXGRABBER-like samples but for various browsers" author = "ditekSHen" id = "a50a60cf-5ab8-5e4e-be00-aa0306f4d84f" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5892-L5906" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c96a63566280758d8c32542bfab3c6faa7d21329430345f51ea4c2f0a6809dc2" score = 75 quality = 75 tags = "FILE" strings: $s1 = "start grabbing" wide $s2 = "end grabbing in" wide $s3 = "error of copying files from comp:" wide $s4 = /(Chrome|Edge)/ wide $ff = "\\Firefox\\" wide nocase $pdb1 = "\\obj\\Debug\\grab" ascii $pdb2 = "\\obj\\Release\\grab" ascii condition: uint16( 0 ) == 0x5a4d and not ( $ff ) and ( all of ( $s* ) or ( 1 of ( $pdb* ) and 1 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Deathransom : FILE { meta: description = "Detects known DeathRansom ransomware" author = "ditekSHen" id = "a6eeb607-8b5c-5982-8b5a-aa2b3c6a65e6" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5908-L5925" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "3c87364a7ecc403262056eeccaa16bf230fbbe684e21d35099d0d572abba9eda" score = 75 quality = 75 tags = "FILE" strings: $s1 = "%s %f %c" fullword ascii $pdb1 = ":\\wud.pdb" ascii $spdb2 = "\\crypt_server\\runtime\\crypt" ascii $spdb3 = "\\bin\\nuvin.pdb" ascii $h1 = "#Dunubeyokunov" wide $h2 = "^Neyot dehipijakeyelih" wide $h3 = "talin%Sanovurenofibiw" wide $h4 = "WriteFile" fullword ascii $h5 = "ClearEventLogA" fullword ascii $h6 = "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" ascii wide condition: uint16( 0 ) == 0x5a4d and ( all of ( $pdb* ) or ( all of ( $s* ) and 1 of ( $pdb* ) ) or 5 of ( $h* ) ) } rule DITEKSHEN_MALWARE_Win_Unlockyourfiles : FILE { meta: description = "Detects UnlockYourFiles ransomware" author = "ditekSHen" id = "265f2a48-143a-56c9-9cd4-b5137799a9e8" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5927-L5946" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "05f549467fac03d4aa2248a9c6c87e4c4273ed6ad727ebb77a4dd115032e454b" score = 75 quality = 75 tags = "FILE" strings: $s1 = "filesx0" wide $s2 = "_auto_file" wide $s3 = "" fullword wide $s4 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\" wide $s5 = "DecryptAllFile" fullword ascii $s6 = "AES_Only_Decrypt_File" fullword ascii $m1 = "Free files decrypted" wide $m2 = "Restore my files" wide $m3 = "Type tour password..." wide $m4 = "files encrypted by strong password" ascii $m5 = "buy bitcoin" ascii $m6 = "Unlock File" fullword wide condition: uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or 5 of ( $m* ) or ( 2 of ( $s* ) and 2 of ( $m* ) ) ) } rule DITEKSHEN_MALWARE_Win_Decryptmyfiles : FILE { meta: description = "Detects DecryptMyFiles ransomware" author = "ditekSHen" id = "dab518f2-3fac-5492-88fb-35cd0000ec47" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5948-L5964" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "5b7f74569700e2ad3f31388571dad5ffda45f5ab3dd36806f7514aff0367d5ba" score = 75 quality = 73 tags = "FILE" strings: $s1 = "FILES ENCRYPTED" wide $s2 = "pexplorer.exe" fullword wide $s3 = "uniquesession" fullword ascii $s4 = ".[decryptmyfiles.top]." fullword ascii $s5 = "decrypt 1 file" ascii $s6 = "(databases,backups, large excel" ascii $c1 = "api/connect.php" ascii $c2 = "decryptmyfiles.top" ascii $c3 = "/contact/" ascii condition: uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or all of ( $c* ) or ( 2 of ( $c* ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Motocos : FILE { meta: description = "Detects Motocos ransomware" author = "ditekSHen" id = "be7284be-b57d-5a2c-9a84-37d76445cd0d" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5966-L5981" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "99ac365c277058503874313e3a74ab016d6d279b47c754c3df950e3ce60e29f1" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Block Investigation Tools" wide $s2 = "powershell.exe,taskmgr.exe,procexp.exe,procmon.exe" wide $s3 = "google.com,youtube.com,baidu.com,facebook.com,amazon.com,360.cn,yahoo.com,wikipedia.org,zoom.us,live.com,reddit.com,netflix.com,microsoft.com,instagram.com,vk.com," wide $s4 = "START ----" wide $s5 = "TEngine.Clear_EventLog_Result" wide $s6 = "TEngine.EncryptLockFiles" wide $s7 = "TEngine.CleanShadowFiles" wide $s8 = "TDNSUtils.SendCommand" wide condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_MALWARE_Win_Dlagent12 : FILE { meta: description = "Detects downloader agent" author = "ditekSHen" id = "841b998b-99d1-50d8-bc7b-75b2a8e690bf" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5983-L5993" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b9845414f4ce4cc25b75a8de7569c4135bbb7ba9098fd4c50d7ac80302e99b8f" score = 75 quality = 75 tags = "FILE" strings: $s1 = "WebClient" fullword ascii $s2 = "DownloadData" fullword ascii $s3 = "packet_server" fullword wide condition: uint16( 0 ) == 0x5a4d and all of them and filesize < 50KB } rule DITEKSHEN_MALWARE_Win_Dlinjector01 : FILE { meta: description = "Detects specific downloader injector shellcode" author = "ditekSHen" id = "c5e0946c-3e15-5ebc-b1b5-3f00566dc5cd" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5995-L6015" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "5c13af5fdbb2e8a27103d9502126a82d0bff15d9a269b22e4279b5b459d50e2d" score = 75 quality = 75 tags = "FILE" strings: $s1 = "process call create \"%s\"" ascii wide $s2 = "\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\" ascii wide $s3 = "%systemroot%\\system32\\ntdll.dll" ascii wide $s4 = "qemu-ga.exe" ascii wide $s5 = "prl_tools.exe" ascii wide $s6 = "vboxservice.exe" ascii wide $o1 = { 75 04 74 02 38 6e 8b 34 24 83 c4 04 eb 0a 08 81 } $o2 = { 16 f8 f7 ba f0 3d 87 c7 95 13 b7 64 22 be e1 59 } $o3 = { 8b 0c 24 83 c4 04 eb 05 ea f2 eb ef 05 e8 ad fe } $o4 = { eb 05 1d 51 eb f5 ce e8 80 fd ff ff 77 a1 f4 cd } $o5 = { eb 05 6e 33 eb f5 73 e8 64 f6 ff ff 77 a1 f4 77 } $o6 = { 59 eb 05 fd 98 eb f4 50 e8 d5 f5 ff ff 3b b9 00 } $o7 = "bYkoDA7G" fullword ascii condition: ( uint16( 0 ) == 0x5a4d and all of ( $o* ) ) or ( all of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Dlinjector02 : FILE { meta: description = "Detects downloader injector" author = "ditekSHen" id = "ce2c418d-18e4-579c-9828-94e294385846" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6017-L6034" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "76d185cfcbc7f4996c2fb5c7c1ba4eb20b32d322d8ff47594283a4ca3e573a0b" score = 75 quality = 75 tags = "FILE" strings: $x1 = "In$J$ct0r" fullword wide $x2 = "%InJ%ector%" fullword wide $a1 = "WriteProcessMemory" fullword wide $a2 = "URLDownloadToFileA" fullword ascii $a3 = "Wow64SetThreadContext" fullword wide $a4 = "VirtualAllocEx" fullword wide $s1 = "RunPE" fullword wide $s2 = "SETTINGS" fullword wide $s3 = "net.pipe" fullword wide $s4 = "vsmacros" fullword wide condition: uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or ( all of ( $a* ) and 3 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Nermer : FILE { meta: description = "Detects Nermer ransomware" author = "ditekSHen" id = "fce4f178-8e98-53b0-ae09-2ce876ad524e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6036-L6062" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e885b1b908b256ee07f5cb144d63f5ad65e5bf746b70efe168b0ac742a246ab3" score = 75 quality = 75 tags = "FILE" strings: $x1 = "gPROTECT_INFO.TXT" fullword wide $x2 = ".nermer" fullword wide $s1 = "db_journal" fullword wide $s2 = "quicken2015backup" fullword wide $s3 = "mysql" fullword wide $s4 = "sas7bdat" fullword wide $s5 = "httpd.exe" fullword wide $s6 = "Intuit.QuickBooks.FCS" fullword wide $s7 = "convimage" fullword wide $s8 = ".?AV?$_Binder@U_Unforced@std@@P8shares_t@" ascii $s9 = "BgIAAACkAABSU0ExAAgAAAEAAQCt" ascii $m1 = "YOUR FILES WERE ENCRYPTED" ascii $m2 = "MARKED BY EXTENSION .nermer" ascii $m3 = "send us your id: >> {id} <<" ascii $m4 = "email us: >> {email} <<" ascii $c1 = "/repeater.php" ascii $c2 = "HTTPClient/0.1" fullword ascii $c3 = "94.156.35.227" ascii $c4 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $m* ) or all of ( $c* ) or all of ( $s* ) or ( 4 of ( $s* ) and ( 1 of ( $x* ) or 1 of ( $m* ) or 2 of ( $c* ) ) ) or 14 of them ) } rule DITEKSHEN_MALWARE_Win_Beastdoor : FILE { meta: description = "Detects Beastdoor backdoor" author = "ditekSHen" id = "b271d53e-2693-5a93-825a-ef32f72a4b01" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6064-L6084" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "d9a72717d124bcf1e3b95850cd524e577abe96a094586a5555faadba78fcb9ad" score = 75 quality = 75 tags = "FILE" strings: $s1 = "shellx.pif" fullword ascii nocase $s2 = "Beasty" fullword ascii $s3 = "* Boot:[" ascii $s4 = "^ Shut Down:[" ascii $s5 = "set cdaudio door" ascii $s6 = "This \"Portable Network Graphics\" image is not valid" wide $n1 = ".aol.com" ascii $n2 = "web.icq.com" ascii $n3 = "&fromemail=" fullword ascii $n4 = "&subject=" fullword ascii $n5 = "&Send=" fullword ascii $n6 = "POST /scripts/WWPMsg.dll HTTP/1.0" fullword ascii $n7 = "mirabilis.com" ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 5 of ( $n* ) or ( 3 of ( $s* ) and 3 of ( $n* ) ) ) } rule DITEKSHEN_MALWARE_Win_Gravityrat : FILE { meta: description = "Detects GravityRAT" author = "ditekSHen" id = "cb581dd6-15b2-54ae-9f27-30ec21554fb9" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6086-L6108" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "a6b049dbf21f22f751c15da98536e9ef2a4ced7755ade0cc9904afddef1d3ae6" score = 75 quality = 75 tags = "FILE" strings: $s1 = "/GX/GX-Server.php?VALUE=2&Type=" wide $s2 = "&SIGNATUREHASH=" wide $s3 = "Error => CommonFunctionClass => Upload()" wide $s4 = "/GetActiveDomains.php" wide $s5 = "DetectVM" ascii wide $s6 = "/c {0} > {1}" wide $s7 = "DRIVEUPLOADCOMPLETED => TOTALFILES={0}, FILESUPLOADED={1}" wide $s8 = "Program => RunAFile()" wide $s9 = "DoViaCmd" ascii $s10 = ".msoftupdates.com:" wide $f1 = "b__" ascii $f2 = "b__" ascii $f3 = "b__" ascii $f4 = "b__" ascii $f5 = "b__" ascii condition: uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or ( all of ( $f* ) and 1 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Fatalrat : FILE { meta: description = "Detects FatalRAT" author = "ditekSHen" id = "f9d0c5dd-ae69-512d-a260-01b9765e10eb" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6110-L6128" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "fb7f6822aa4ef98e77670d276d06c9a37718bce38d32ce5b53fe67513b107fbe" score = 75 quality = 75 tags = "FILE" strings: $x1 = "XXAcQbcXXfRSScR" fullword ascii $s1 = "CHROME_NO_DATA" fullword ascii $s2 = "CHROME_UNKNOW" fullword ascii $s3 = "-Thread running..." ascii $s4 = "InetCpl.cpl,ClearMyTracksByProcess" ascii nocase $s5 = "MSAcpi_ThermalZoneTemperature" ascii nocase $s6 = "taskkill /f /im rundll32.exe" fullword ascii nocase $s7 = "del /s /f %appdata%\\Mozilla\\Firefox" ascii nocase $s8 = "\\\\%s\\C$\\" ascii $s9 = "fnGetChromeUserInfo" fullword ascii $s10 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or 5 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Wingo : FILE { meta: description = "Detects malicious Golang executables" author = "ditekSHen" id = "bc0c84d6-7ea1-5234-89f6-98337900e044" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6130-L6141" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "423b1631ad625fd46a9d10f0ecdf24931cf62a2c1694da3ebdd38daad0a4f724" score = 75 quality = 73 tags = "FILE" strings: $s1 = "Go build ID:" ascii $s2 = /main\.[a-z]{9}Delete/ fullword ascii $s3 = /main\.[a-z]{9}Update/ fullword ascii $s4 = /main\.[a-z]{9}rundll/ fullword ascii condition: uint16( 0 ) == 0x5a4d and ( all of them and #s2 > 2 and #s3 > 2 and #s4 > 2 ) } rule DITEKSHEN_MALWARE_Win_Gelsemine : FILE { meta: description = "Detects Gelsemine" author = "ditekSHen" id = "f7e9ca53-fc52-5da0-a760-cb09c2544f4f" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6174-L6194" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "8c20efa6f34ee9165fac9f1f2e5eb20830a02016309dfaa5681977e1a8ac6068" score = 75 quality = 75 tags = "FILE" strings: $s1 = "If any of these steps fails.only pick one of the targets for configuration\"If you want to just get on with it*which also use [ " wide $s2 = "A make implementation+with core modules (please read NOTES.PER_L)2The per_l Text::Template (please read NOTES.PER_L)" wide $s3 = "NOTES.VMS (OpenVMS)!NOTES.WIN (any supported Windows)%NOTES.DJGPP (DOS platform with DJGPP)'NOTES.ANDROID (obviously Android [ND" wide $s4 = "A simple example would be this)which is to be understood as one of these" fullword wide $s5 = "bala bala bala" fullword wide $s6 = "echo FOO" fullword wide $s7 = "?_Tidy@?$basic_string@DU?$char_traits@D@std@@V" ascii $o1 = { eb 08 c7 44 24 34 fd ff ff ff 8b 44 24 54 8b 4c } $o2 = { eb 08 c7 44 24 34 fd ff ff ff 8b 44 24 54 8b 4c } $o3 = { 8b 76 08 2b f0 a1 34 ff 40 00 03 f0 89 35 38 ff } $o4 = { 83 c4 34 c3 8b 4e 20 6a 05 e8 73 10 00 00 8b 76 } $o5 = { 8b 44 24 44 2b d1 03 d0 8b f2 e9 14 ff ff ff 8d } $o6 = { 68 00 06 00 00 6a 00 e8 d3 ff ff ff a2 48 00 41 } condition: uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or ( all of ( $o* ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Gelsevirine : FILE { meta: description = "Detects Gelsevirine" author = "ditekSHen" id = "70f0ed08-4e07-5ab3-968e-95059d20a8e9" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6224-L6254" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "60d41d6d789f1cd2a7040d6535f13c69ea58a489035838f047b886e8f1f37f63" score = 75 quality = 73 tags = "FILE" strings: $s1 = /64loadpath(xp|sv|7)/ fullword wide $s2 = "{\"Actions\":[]}" fullword wide $s3 = "PlatformsChunk" fullword wide $s4 = "CurrentPluginCategory" fullword wide $s5 = "CurrentOperationPlatform" fullword wide $s6 = "PersistencePlugins" fullword wide $s7 = "memory_library_file" fullword wide $s8 = "LoadPluginBP" fullword ascii $s9 = "GetOperationBasicInformation" fullword ascii $s10 = "commonappdata/Intel/Runtime" wide $s11 = "cfsst x64" fullword wide $s12 = "ForkOperation" fullword ascii $c1 = "domain.dns04.com:8080;domain.dns04.com:443;acro.ns1.name:80;acro.ns1.name:1863;" wide $c2 = "(.*)" wide $v1_2 = "Grabber\\" wide $v1_3 = "/log.php" wide $v1_4 = /Browsers\\(Logins|Cards|Cookies)/ wide $v1_5 = "b__" ascii $v1_6 = "record_header_field" fullword ascii $v1_7 = "JavaScreenshotiptReader" fullword ascii $v1_8 = "HTTPDebuggerPro" wide $v1_9 = "IEInspector" wide $v1_10 = "Fiddler" wide $v2_1 = /get_(Cookie|Logins|Cards)Path/ fullword ascii $v2_2 = "get_AllScreens" fullword ascii $v2_3 = "{0}_{1}_{2}.zip" fullword wide $v2_4 = "\\Stealer" fullword wide $g1 = "$983a3552-4ec3-4936-bd4a-8e6fd67b4c67" fullword ascii $g2 = "$a5d9ca4d-400f-4e07-8c09-a916b548f2e3" fullword ascii $g3 = "$ebc25cf6-9120-4283-b972-0e5520d0000C" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and ( 3 of ( $s* ) or 3 of ( $v1* ) or 3 of ( $v2* ) ) ) or 7 of ( $v1* ) or 3 of ( $v2* ) or ( 2 of ( $g* ) and 3 of them ) ) } rule DITEKSHEN_MALWARE_Win_Allakore : FILE { meta: description = "Detects AllaKore" author = "ditekSHen" id = "371663c1-6faf-5ca3-a79e-e4340d44660b" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6462-L6493" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0e93682787e27246cdddbd67ca5360728c65049a2e97e71809b5902854aa4bef" score = 75 quality = 73 tags = "FILE" strings: $x1 = "AllaKore Remote - Chat" fullword wide $x2 = "AllaKore Remote - Share Files" fullword wide $x3 = "CYRUS - Chat" fullword wide $x4 = "CYRUS - Share Files" fullword wide $x5 = "<|REDIRECT|><|GETFOLDERS|>" fullword wide $x6 = "<|REDIRECT|><|DOWNLOADFILE|>" fullword wide $x7 = "<|REDIRECT|><|WHEELMOUSE|>" fullword wide $x8 = "<|REDIRECT|><|SETMOUSE" wide $x9 = "<|CHECKIDPASSWORD|>" fullword wide $x10 = "<|KEYBOARDSOCKET|>" fullword wide $x11 = "<|REDIRECT|><|CLIPBOARD|>" fullword wide $x12 = "<|IDEXISTS!REQUESTPASSWORD|>" fullword wide $x13 = "<|GETFULLSCREENSHOT|>" fullword wide $x14 = "<|MAINSOCKET|>" fullword ascii $s1 = "You can not connect with yourself!" wide $s2 = "Waiting for authentication..." wide $s3 = "Connected support!" wide $s4 = "ID does nor exists." wide $s5 = "Finding the ID..." wide $s6 = "PC is Busy!" wide $s7 = "Upload & Execute" fullword ascii $s8 = "Download file selected" fullword ascii $s9 = "CaptureKeys_TimerTimer" fullword ascii $s10 = "Remote File Manager" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 4 of ( $x* ) or 4 of ( $s* ) or ( 3 of ( $s* ) and 2 of ( $x* ) ) ) } rule DITEKSHEN_MALWARE_Win_Reverserat : FILE { meta: description = "Detects ReverseRAT" author = "ditekSHen" id = "df13fc6c-025a-54db-809d-4f3c27b8aa7a" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6495-L6514" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "87ab00a5588bfce04ec47a07b184fffe359e472ac8bf561b02a8b070edf2e014" score = 75 quality = 75 tags = "FILE" strings: $pdb1 = "\\ReverseRat.pdb" ascii nocase $pdb2 = "\\ReverseRat\\obj\\" ascii nocase $s1 = "processCmd" fullword ascii $s2 = "CmdOutputDataHandler" fullword ascii $s3 = "sendingProcess" fullword ascii $s4 = "SetStartup" fullword ascii $s5 = "RunServer" fullword ascii $s6 = "_OutputDataReceived" ascii $s7 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 03 0a 00 00 13 74 00 65 00 72 00 6d 00 69 00 6e 00 61 00 74 00 65 00 00 09 65 00 78 00 69 00 74 00 } condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $pdb* ) and 2 of ( $s* ) ) or 5 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Smokeloader : FILE { meta: description = "Detects SmokeLoader variants" author = "ditekSHen" id = "e8f28f89-3a79-5d78-8c0a-bad16a57df84" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6516-L6539" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "65c56ed11a3cb4e4bcf8fd2a6be097545cb96e84ba4c4202969d1d163a2a36ed" score = 75 quality = 75 tags = "FILE" strings: $x1 = "G2A/CLP/05/RYS" fullword wide $x2 = "0N1Y/53R10U5/BU51N355" fullword wide $x3 = "CH4PG3PB-6HT2VI9C-O2NL2NO5-QP1BW0EG" fullword wide $s1 = "Azure-Update-Task" fullword wide $s2 = "C:\\Windows\\System32\\schtasks.exe" fullword wide $s3 = "/C /create /F /sc minute /mo 1 /tn \"" fullword wide $s4 = "\\Microsoft\\Network" fullword wide $s5 = "\\Microsoft\\TelemetryServices" fullword wide $s6 = "\" /tr \"" fullword wide $e1 = "\\sqlcmd.exe" fullword wide $e2 = "\\sihost.exe" fullword wide $e3 = "\\fodhelper.exe" fullword wide condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 4 of ( $s* ) ) or ( 5 of ( $s* ) and 1 of ( $e* ) ) ) } rule DITEKSHEN_MALWARE_Win_Dlinjector03 : FILE { meta: description = "Detects unknown loader / injector" author = "ditekSHen" id = "2d0df2d8-5b1c-5408-b8c7-8ca14d57da0f" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6541-L6551" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "10092e7916775fe0a39baa5714fdda89f443ceabdcc610cc1fcd5a0fb0e68d0c" score = 75 quality = 73 tags = "FILE" strings: $x1 = "LOADER ERROR" fullword ascii $s1 = "_ZN6curlpp10OptionBaseC2E10CURLoption" fullword ascii $s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Coinminer02 : FILE { meta: description = "Detects coinmining malware" author = "ditekSHen" id = "1878a1b5-4e97-5575-802e-573caded2b3a" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6553-L6571" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "83760aef667819923a2ac67c006e03bb6d4260b7a4aedd691dd5b145fb50d5c1" score = 75 quality = 75 tags = "FILE" strings: $s1 = "%s/%s (Windows NT %lu.%lu" fullword ascii $s2 = "\\Microsoft\\Libs\\WR64.sys" wide $s3 = "\\\\.\\WinRing0_" wide $s4 = "pool_wallet" ascii $s5 = "cryptonight" ascii $s6 = "mining.submit" ascii $c1 = "stratum+ssl://" ascii $c2 = "daemon+http://" ascii $c3 = "stratum+tcp://" ascii $c4 = "socks5://" ascii $c5 = "losedaemon+https://" ascii condition: uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) and 1 of ( $c* ) ) } rule DITEKSHEN_MALWARE_Win_Mercurial : FILE { meta: description = "Detects Mercurial infostealer" author = "ditekSHen" id = "c262ada2-01ca-5fc1-adef-987908514019" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6573-L6593" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "400f8f717a4e07bf4de508c02bbcd9e82bf21f3df84c989fc622378f33e192f0" score = 75 quality = 75 tags = "FILE" strings: $x1 = "mercurial grabber" wide nocase $x2 = "\"text\":\"Mercurial Grabber |" wide $x3 = "/nightfallgt/mercurial-grabber" wide $s1 = "/LimerBoy/Adamantium-Thief/" ascii $s2 = "Mozilla/5.0 (Macintosh; Intel Mac OS X x.y; rv:42.0) Gecko/20100101 Firefox/42.0" fullword wide $s3 = "StealCookies" fullword ascii $s4 = "StealPasswords" fullword ascii $s5 = "DetectDebug" fullword ascii $s6 = "CaptureScreen" fullword ascii $s7 = "WebhookContent" fullword ascii $s8 = /Grab(Token|Product|IP|Hardware)/ fullword ascii $p1 = "[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27}" fullword ascii wide $p2 = "mfa\\.[\\w-]{84}" fullword ascii wide condition: uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or 5 of ( $s* ) or ( all of ( $p* ) and 3 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Phonzy : FILE { meta: description = "Detects specific downloader agent" author = "ditekSHen" id = "d35f41e4-4633-5482-9ae4-79354463f1b9" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6595-L6608" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "924e7674d76594314df1a32d38f19cee12a3ed49cdf5e153f98bb08a7634055c" score = 75 quality = 75 tags = "FILE" strings: $ua1 = "User-Agent: Mozilla/5.0 (X11; Linux" wide $s1 = "" fullword wide $s2 = "WebClient" fullword ascii $s3 = "WriteAllText" fullword ascii $s4 = "DownloadString" fullword ascii $s5 = "WriteByte" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $ua* ) and ( $s1 ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Hive : FILE { meta: description = "Detects Hive ransomware" author = "ditekSHen" id = "7b79dc54-01c7-5667-acf5-a32cd7a45b54" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6610-L6647" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "14c20ff2fa62d80eed0f4f364e24d93d493d4f3b47f664983714940afa74046f" score = 75 quality = 73 tags = "FILE" strings: $url1 = "http://hivecust" ascii $url2 = "http://hiveleakdb" ascii $s1 = "encrypt_files.go" ascii $s2 = "erase_key.go" ascii $s3 = "kill_processes.go" ascii $s4 = "remove_shadow_copies.go" ascii $s5 = "stop_services_windows.go" ascii $s6 = "remove_itself_windows.go" ascii $x1 = "/encryptor/" ascii $x2 = "HOW_TO_DECRYPT.txt" ascii $x3 = "FilesEncrypted" fullword ascii $x4 = "EncryptionStarted" fullword ascii $x5 = "encryptFilesGroup" fullword ascii $x6 = "Your data will be undecryptable" ascii $x7 = "- Do not fool yourself. Encryption has perfect secrecy" ascii $v1_1 = ".EncryptFiles." ascii $v1_2 = ".EncryptFilename." ascii $v1_3 = ")*struct { F uintptr; .autotmp_14 string }" ascii $v1_4 = "D*struct { F uintptr; data *[]uint8; seed *uint8; fnc *main.decFunc }" ascii $v1_5 = "golang.org/x/sys/windows.getSystemWindowsDirectory" ascii $v1_6 = "path/filepath.WalkDir" ascii $v2_1 = "taskkill /f /im" ascii $v2_2 = "schtasks /delete /tn" ascii $v2_3 = "encfile.txt" ascii $v2_4 = "README.html" ascii $v2_5 = "total encrypt %v/%v" ascii $v2_6 = "ITSSHOWKEY" ascii $v2_7 = "Recovery your files." ascii $v2_8 = "yaml:\"send_host\"" ascii $v2_9 = "yaml:\"ignore_dir\"" ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $url* ) or all of ( $s* ) or 4 of ( $x* ) or 5 of ( $v1* ) or 5 of ( $v2* ) or ( 4 of ( $v2* ) and #v2_1 > 10 ) ) } rule DITEKSHEN_MALWARE_Win_Spyro : FILE { meta: description = "Detects Spyro / VoidCrypt / Limbozar ransomware" author = "ditekSHen" id = "8b3273c4-827e-50ce-983e-a5843f6b5a78" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6649-L6675" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "2e3be361f6d4283fd312a4486eaa39d6594813937cc3f62dbb603babeff17929" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Decrypt-info.txt" ascii wide $s2 = "AbolHidden" ascii wide $s3 = "C:\\ProgramData\\prvkey" ascii wide $s4 = ".?AV?$TF_CryptoSystemBase@VPK_Encryptor@CryptoPP" ascii $s5 = "C:\\Users\\LEGION\\" ascii $s6 = "C:\\ProgramData\\pkey.txt" fullword ascii $s7 = ".Spyro" fullword ascii $m1 = "Go to C:\\ProgramData\\ or in Your other Drives" wide $m2 = "saving prvkey.txt.key file will cause" wide $m3 = "in Case of no Answer:" wide $m4 = "send us prvkey*.txt.key" wide $m5 = "Somerhing went wrong while writing payload on disk" ascii $m6 = "this country is forbidden.\"}" ascii $c1 = "Voidcrypt/1.0" ascii $c2 = "h1dd3n.cc" ascii $c3 = "/voidcrypt/index.php" ascii $c4 = "&user=" ascii $c5 = "&disk-size=" ascii $c6 = "unique-id=" ascii condition: uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or 4 of ( $c* ) or 3 of ( $m* ) or 8 of them ) } rule DITEKSHEN_MALWARE_Win_Darkvnc : FILE { meta: description = "Detects DarkVNC" author = "ditekSHen" id = "3c7d215c-fcca-5a0f-b59c-d84fd894677a" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6677-L6696" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b0dbde04c0a05e476d505b92cf7dbf3b4ef0dd9e88eafcd21b7a7d0e3623abbd" score = 75 quality = 75 tags = "FILE" strings: $s1 = "USR-%s(%s)_%S-%S%u%u" fullword wide $s2 = "BOT-%s(%s)_%S-%S%u%u" fullword wide $s3 = "USR-UnicodeErr(Err)_%s-%s%u%u" fullword ascii $s4 = "BOT-UnicodeErr(Err)_%s-%s%u%u" fullword ascii $s5 = "PRM_STRG" fullword wide $s6 = "bot_shell >" ascii $s7 = "monitor_off / monitor_on" ascii $s8 = "kbd_off / kbd_on" ascii $s9 = "ActiveDll: Dll inject thread for process 0x%x terminated with status: %u" ascii $s10 = "PsSup: File %s successfully started with parameter \"%s\"" ascii $s11 = "PsSup: ShellExecute failed. File: %s, error %u" ascii $s12 = "#hvnc" fullword ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_Avoslocker : FILE { meta: description = "Hunt for AvosLocker ransomware" author = "ditekSHen" id = "390e57b2-207e-5013-899a-0b04aa63a56f" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6748-L6757" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "85601fdd13ddeb1fc0b8b98eb68e324046d60c1ae9467d083a75abebcb50e3a0" score = 75 quality = 75 tags = "FILE" strings: $s1 = "GET_YOUR_FILES_BACK.txt" ascii wide $s2 = ".avos" fullword ascii wide condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Margulasrat : FILE { meta: description = "Detects MargulasRAT" author = "ditekSHen" id = "6efabf80-9194-542d-afd2-9bf9c8e26e55" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6786-L6810" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "dd5b94c947d97cdc34032f2cb84b4975a1e8f510638857fb6dbe553bcff7d16e" score = 75 quality = 75 tags = "FILE" strings: $pdb1 = "G:\\VP-S-Fin\\memory\\" ascii $pdb2 = "G:\\VP-S-Fin\\Margulas\\" ascii $pdb3 = "G:\\VP-S-Fin\\remote" ascii $pdb4 = "G:\\VP-S-Fin\\" ascii $s1 = "/C choice /C Y /N /D Y /T 1 & Del " fullword wide $s2 = "strToHash" fullword ascii $s3 = "\\socking" fullword wide $s4 = "\\wininets" fullword wide $s5 = "ClientSocket" fullword ascii $s6 = "new Stream()" fullword wide $s7 = "CipherText" fullword ascii $s8 = "WriteAllBytes" fullword ascii $s9 = { 00 50 72 6f 63 65 73 73 00 45 78 69 73 74 73 00} $s10 = "pxR/THCwdLuruMmw8wB8xAUvbno1yPGBTOV9IoOkAp/n7+paQm74pkzlfSKDpAKfTOV9IoOkAp9M5X0ig6QCn0zlfSKDpAKfTOV9IoOkAp" wide $c1 = "149.248.52.61" wide $c2 = "://vpn.nic.in" wide $c3 = "://www.mod.gov.in/dod/sites/default/files/" wide condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $pdb* ) and ( 1 of ( $c* ) or 3 of ( $s* ) ) ) or ( 1 of ( $c* ) and 3 of ( $s* ) ) or ( 6 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Lilithrat : FILE { meta: description = "Detects LilithRAT" author = "ditekSHen" id = "87e56524-f557-5662-86bc-2b26e7c74aee" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6812-L6839" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" hash = "132870a1ae6a0bdecaa52c03cfe97a47df8786f148fa8ca113ac2a8d59e3624a" hash = "ab7b6e0b28995bdeea44f20c0aba47f95e1d6ba281af3541cd2c04dc6c2a3ad9" hash = "b2eeb487046ba1d341fb964069b7e83027b60003334e04e41b467e35c3d2460f" hash = "cebcda044c60b709ba4ee0fa9e1e7011a6ffc17285bcc0948d27f866ec8d8f20" logic_hash = "1e8ac8a329ff99318e12666ea1d90d21bb9b0dff656a5eb1ce741b940c99afd5" score = 75 quality = 75 tags = "FILE" strings: $pdb1 = "c:\\Users\\Groovi\\Documents\\Visual Studio 2008\\Projects\\TestDll\\" ascii $pdb2 = "C:\\Users\\iceberg\\Downloads\\RAT-Server-master\\RAT-Server-master\\RAT\\Debug\\RAT.pdb" ascii $pdb3 = "C:\\Users\\Samy\\Downloads\\Compressed\\Lilith-master\\Debug\\Lilith.pdb" ascii $s1 = "log.txt" fullword ascii $s2 = "keylog.txt" fullword ascii $s3 = "File Listing Completed Successfully." fullword ascii $s4 = "Download Execute" fullword ascii $s5 = "File Downloaded and Executed Successfully." fullword ascii $s6 = "C:\\WINDOWS\\system32\\cmd.exe" fullword ascii $s7 = "CMD session closed" ascii $s8 = "Restart requested: Restarting self" fullword ascii $s9 = "Termination requested: Killing self" fullword ascii $s10 = "Couldn't write to CMD: CMD not open" fullword ascii $s11 = "keydump" fullword ascii $s12 = "remoteControl" fullword ascii $s13 = "packettype" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 1 of ( $pdb* ) or 6 of ( $s* ) or ( 1 of ( $pdb* ) and 4 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Epicenterrat : FILE { meta: description = "Detects EpicenterRAT" author = "ditekSHen" id = "6abe6e94-d7f5-5f88-96a6-a8fad599ef6a" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6841-L6863" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e9086dff22e301f57c6a9bdb38fbed8e902d5b8ca20a5e5b3cda56db08d5582e" score = 75 quality = 75 tags = "FILE" strings: $pdb1 = "c:\\Users\\Zombie\\Desktop\\MutantNinja\\" ascii $pdb2 = "\\Epicenter Client\\" ascii $s1 = "PROCESS_LIST<%SEP%>" fullword wide $s2 = "GETREADY_RECV_FILE<%SEP%>" fullword wide $s3 = "DISPLAY<%SEP%>" wide $s4 = "GETSCREEN<%SEP%>" fullword wide $s5 = "dumpImageName" fullword ascii $s6 = "dumpLoc" fullword ascii $s7 = "EXPECT<%SEP%>filelist<%SEP%>" fullword wide $s8 = "<%FSEP%>FOLDER<%FSEP%>-<%SEP%>" fullword wide $s9 = "KILLPROC<%SEP%>" fullword wide $s10 = "LAUNCHPROC<%SEP%>" fullword wide $s11 = "cmd.exe /c start /b " fullword wide $s12 = "savservice" fullword wide $s13 = "getvrs" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 1 of ( $pdb* ) or 5 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Lastconn : FILE { meta: description = "Detects LastConn" author = "ditekSHen" id = "18727c30-d84d-5ffa-acd4-2cc54e553604" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6865-L6894" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "94f5874353d0fb475595373c06a0de91603cad9b435d35dc00febf90608d6b5a" score = 75 quality = 75 tags = "FILE" strings: $s1 = "System.Net.Http.SysSR" fullword wide $s2 = "System.Net.Http.WrSR" fullword wide $s3 = "yyyy'-'MM'-'dd'T'HH':'mm':'ss.FFFFFFFK" fullword wide $s4 = { 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 0c 6e 00 6f 00 74 00 69 00 66 00 79 00 04 06 12 80 e8 05 00 00 12 80 e8 08 75 00 73 00 65 00 72 00 08 74 00 65 00 61 00 6d 00 06 61 00 70 00 70 00 0c 6e 00 6f 00 61 00 75 00 74 00 68 00 } $s5 = { 68 00 69 00 64 00 64 00 65 00 6e 00 10 64 00 69 00 73 00 61 00 6c 00 6c 00 6f 00 77 00 0e 65 00 78 00 74 00 65 00 6e 00 64 00 73 00 04 69 00 64 00 16 75 00 6e 00 69 00 71 00 75 00 65 00 49 00 74 00 65 00 6d 00 73 } $s6 = "d__" ascii $s7 = "d__" ascii $s8 = "d__" ascii $s9 = "d__" ascii $s10 = "d__" ascii $s12 = "d__" ascii $s13 = "d__" ascii $s14 = "d__" ascii $s15 = "CDropbox.Api.DropboxRequestHandler+d__" ascii condition: uint16( 0 ) == 0x5a4d and 12 of them } rule DITEKSHEN_MALWARE_Win_Crimsonrat : FILE { meta: description = "Detects CrimsonRAT" author = "ditekSHen" id = "54c9bbb2-9fa6-5c1f-9272-13255357ddbf" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6896-L6920" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "a40cf09dbaafb2e7b9130af1b40e46b4c38fed6185b16435ad4c118f9e6d56c7" score = 75 quality = 75 tags = "FILE" strings: $s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|" fullword wide $s2 = "system volume information|" fullword wide $s3 = "program files (x86)|" fullword wide $s4 = "program files|" fullword wide $s5 = "(connect|command|drives|getfiles|upload|execute|download)/ fullword wide $x2 = "aHR0cDovLzE0NC45MS42NS4xMDAv" wide $x3 = "aHR0cDovL21mYWhvc3QuZGRucy5uZXQv" wide $f1 = "b__" ascii $f2 = "b__" ascii $f3 = "b__" ascii $f4 = "b__" ascii $f5 = "b__" ascii $f6 = "b__" ascii $f7 = "b__" ascii $s1 = "beaconURL" ascii $s2 = "PingReply" ascii $s3 = "updateUpload" ascii $s4 = "updateCommand" ascii $s5 = "runCommand" ascii $s6 = "uploadFile" ascii $s7 = "SELECT * FROM MSFT_NetAdapter WHERE ConnectorPresent = True AND DeviceID = '{0}'" fullword wide $s8 = "SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion" fullword wide $s9 = "Mozilla/3.0" fullword wide $s10 = "|directory|N/A|" fullword wide $s11 = "cmd.exe /c" fullword wide $c1 = /Content-Disposition: form-data; name=(hostname|hid|id|action|secondary)/ fullword wide $c2 = /(classification|updatecs|update|beacon)\.php/ wide $c3 = "Content-Disposition: form-data;name=\"{0}\";filename=\"{1}\"filepath=\"{2}\"" fullword wide $pdb1 = "D:\\Projects\\C#\\HTTP-Simple\\WindowsMediaPlayer - HTTP - " ascii $pdb2 = "\\WindowsMediaPlayer10\\obj\\x86\\Release\\winow4.pdb" ascii condition: uint16( 0 ) == 0x5a4d and ( #x1 > 5 or ( all of ( $f* ) and ( 1 of ( $s* ) or 2 of ( $c* ) ) ) or 7 of ( $s* ) or all of ( $c* ) or ( all of ( $pdb* ) and 4 of them ) or ( 2 of ( $x* ) and 5 of them ) ) } rule DITEKSHEN_MALWARE_Win_Nodachi : FILE { meta: description = "Detects Nodachi infostealer" author = "ditekSHen" id = "bce0c44d-7e75-5c51-ba93-75bd81896921" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6957-L6972" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c8a262b862a47d5c0c9bd76b722aa4ceb55dd365b5dca35a61318d8a1c53269d" score = 75 quality = 75 tags = "FILE" strings: $x1 = "//AppData//Roaming//kavachdb//kavach.db" ascii $s1 = "/upload/drive/v3/files/{fileId}" ascii $s2 = "main.getTokenFromWeb" ascii $s3 = "main.tokenFromFile" ascii $s4 = "/goLazagne/" ascii $s5 = "/extractor/withoutdrive/main.go" ascii $s6 = "struct { Hostname string \"json:\\\"hostname\\\"\"; EncryptedUsername string \"json:\\\"encryptedUsername\\\"\"; EncryptedPassword string \"json:\\\"encryptedPassword\\\"\" }" ascii $s7 = "C://Users//public//cred.json" ascii condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or ( 4 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Iamthekingqueenofhearts : FILE { meta: description = "IAmTheKing Queen Of Hearts payload" author = "ditekSHen" id = "b8d222f0-b3ce-5143-816b-4bbcde645672" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6974-L6991" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0aafeb1dce380ebe6cccc3c7f9564022e1a4cdcf20091943d2bfcc845129152d" score = 75 quality = 75 tags = "FILE" strings: $s1 = "{'session':[{'name':'" ascii $s2 = "begin mainthread ok" wide $s3 = "getcommand error" wide $s4 = "querycode error" wide $s5 = "Code = %d" wide $s6 = "cookie size :%d" wide $s7 = "send request error:%d" wide $s8 = "PmMytex%d" wide $s9 = "%s_%c%c%c%c_%d" wide $s10 = "?what@exception@std@@UBEPBDXZ" ascii condition: uint16( 0 ) == 0x5a4d and 6 of them } rule DITEKSHEN_MALWARE_Win_Iamthekingqueenofclubs : FILE { meta: description = "IAmTheKing Queen Of Clubs payload" author = "ditekSHen" id = "4d19a484-0483-5b3e-a9ad-1cd8ca263a04" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6993-L7007" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "28d7d3e9a3b7c104fc5b0fa38ce33b34596f16f6987c34a0e2e3fd93a8a908bd" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Not Support!" fullword wide $s2 = "%s|%s|%s|%s" fullword wide $s3 = "cmd.exe" fullword wide $s4 = "for(;;){$S=Get-Content \"%s\";IF($S){\"\" > \"%s\";$t=iex $S 2>\"%s\";$t=$t+' ';echo $t >>\"%s\";}sleep -m " wide $s5 = "PowerShell.exe -nop -c %s" fullword wide $s6 = "%s \"%s\" Df" fullword wide $s7 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)" fullword ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_Biopass_Dropper : FILE { meta: description = "Detects Go BioPass dropper" author = "ditekSHen" id = "56037c79-59f7-587c-8f54-c9618e871f34" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7088-L7111" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "06f3b3ee38349ddcf9be7cbb7627d60fa673962409dde6e4badd112841a3ed19" score = 75 quality = 75 tags = "FILE" strings: $go = "Go build ID:" ascii $s1 = "main.NetWorkStatus" ascii $s2 = "main.NoErrorRunFunction" ascii $s3 = "main.FileExist" ascii $s4 = "main.execute" ascii $s5 = "main.PsGenerator" ascii $s6 = "main.downFile" ascii $s7 = "main.Unzip" ascii $url1 = "https://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/" ascii $x1 = "SCHTASKS /Run /TN SYSTEM_CDAEMON" ascii $x2 = "SCHTASKS /Run /TN SYSTEM_SETTINGS" ascii $x3 = "SCHTASKS /Run /TN SYSTEM_TEST && SCHTASKS /DELETE /F /TN SYSTEM_TEST" ascii $x4 = ".exe /install /quiet /norestart" ascii $x5 = "exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\\''http" ascii $x6 = "powershell.exe -Command $" ascii $x7 = ".Path ='-----BEGIN RSA TESTING KEY-----" ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 5 of ( $x* ) or ( 1 of ( $url* ) and ( $go ) ) or 9 of them ) } rule DITEKSHEN_MALWARE_Win_A310Logger : FILE { meta: description = "Detects A310Logger" author = "ditekSHen" id = "d2cf2f7b-5710-56ab-b13d-97a70fe7f618" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7113-L7149" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "8205169c9c78eb784b9d07a5fd85ad3a54763452e1e315f7e7911b8ac49a6c01" score = 75 quality = 73 tags = "FILE" snort_sid = "920204-920207" strings: $s1 = "Temporary Directory * for" fullword wide $s2 = "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*RD_" wide $s3 = "@ENTIFIER=" wide $s4 = "ExecQuery" fullword wide $s5 = "MSXML2.ServerXMLHTTP.6.0" fullword wide $s6 = "Content-Disposition: form-data; name=\"document\"; filename=\"" wide $s7 = "CopyHere" fullword wide $s8 = "] Error in" fullword wide $s9 = "shell.application" fullword wide nocase $s10 = "SetRequestHeader" fullword wide $s11 = "\\Ethereum\\keystore" fullword wide $s12 = "@TITLE Removing" fullword wide $s13 = "@RD /S /Q \"" fullword wide $en1 = "Unsupported encryption" fullword wide $en2 = "BCryptOpenAlgorithmProvider(SHA1)" fullword wide $en3 = "BCryptGetProperty(ObjectLength)" fullword wide $en4 = "BCryptGetProperty(HashDigestLength)" fullword wide $v1_1 = "PW\\FILES\\SC::" wide $v1_2 = "AddAttachment" fullword wide $v1_3 = "Started:" fullword wide $v1_4 = "Ended:" fullword wide $v1_5 = "sharedSecret" fullword wide $v1_6 = "\":\"([^\"]+)\"" fullword wide $v1_7 = "\\credentials.txt" fullword wide $v1_8 = "WritePasswords" fullword ascii $v1_9 = "sGeckoBrowserPaths" fullword ascii $v1_10 = "get_sPassword" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or ( 3 of ( $en* ) and 4 of ( $s* ) ) or ( 5 of ( $s* ) and 1 of ( $en* ) ) or 5 of ( $v1* ) or ( 4 of ( $v1* ) and 2 of ( $s* ) and 2 of ( $en* ) ) ) } rule DITEKSHEN_MALWARE_Win_Crylock : FILE { meta: description = "Detects CryLock ransomware" author = "ditekSHen" id = "296288d8-2fdd-592a-aef9-7d4853885594" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7151-L7186" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "dde35dd2c7e89212c4562f2dcf6a78d06fbb3d31150d49e6c48f758b07f1834f" score = 75 quality = 73 tags = "FILE" strings: $s1 = "Encrypted by BlackRabbit. (BR-" ascii $s2 = "{ENCRYPTENDED}" ascii $s3 = "{ENCRYPTSTART}" ascii $s4 = "<%UNDECRYPT_DATETIME%>" ascii $s5 = "<%RESERVE_CONTACT%>" ascii $s6 = "how_to_decrypt.hta" ascii wide $s7 = "END ENCRYPT ONLY EXTENATIONS" ascii $s8 = "END UNENCRYPT EXTENATIONS" ascii $s9 = "END COMMANDS LIST" ascii $s10 = "END PROCESSES KILL LIST" ascii $s11 = "END SERVICES STOP LIST" ascii $s12 = "END PROCESSES WHITE LIST" ascii $s13 = "END UNENCRYPT FILES LIST" ascii $s14 = "END UNENCRYPT FOLDERS LIST" ascii $s15 = "Encrypted files:" ascii $s16 = { 65 78 74 65 6e 61 74 69 6f 6e 73 00 ff ff ff ff 06 00 00 00 63 6f 6e 66 69 67 00 00 ff ff ff ff (0a|0d 0a) 00 00 00 63 6f 6e 66 69 67 2e 74 78 74 00 00 ff ff ff ff 03 00 00 00 68 74 61 } $p1 = "-exclude" fullword $p2 = "-makeff" fullword $p3 = "-full" fullword $p4 = "-nolocal" fullword $p5 = "-nolan" fullword $p6 = "\" -id \"" fullword $p7 = "\" -wid \"" fullword $p8 = "\"runas\"" fullword $p9 = " -f -s -t 00" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or 6 of ( $p* ) ) } rule DITEKSHEN_MALWARE_Win_Deeprats : FILE { meta: description = "Detects DeepRats (" author = "ditekSHen" id = "5b774e24-3864-519f-9cfd-d729d7d567a0" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7188-L7218" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" hash = "1f8b7e1b14869d119c5de1f05330094899bd997fca4c322d852db85cbd9271e6" logic_hash = "511264c0b6932f90069a5206cd142ca7210b0bc40c51ef5aa9c41a161fb57aab" score = 75 quality = 73 tags = "FILE" strings: $s1 = "https://freegeoip.live/json/https://myexternalip.com/rawin" ascii $s2 = "github.com/cretz/bine" ascii $s3 = "github.com/kbinani/screenshot" ascii $s4 = "socks5://%s:%d" ascii $s5 = "socks5://%s:%s@%s:%d" ascii $s6 = "http://%s:%d" ascii $s7 = "http://%s@%s:%d" ascii $s8 = "%SystemRoot%\\system32\\--CookieAuthentication" ascii $s9 = "tor_addr_" ascii $f1 = ".GetVnc" ascii $f2 = ".GetCommand" ascii $f3 = ".GetPayload" ascii $f4 = ".ListenCommands" ascii $f5 = ".ReceiveFile" ascii $f6 = ".RegisterImplant" ascii $f7 = ".Screenshot" ascii $f8 = ".SendFile" ascii $f9 = ".StartShell" ascii $f10 = ".UnregisterImplant" ascii $f11 = ".VncInstalled" ascii $f12 = ".PingPong" ascii $f13 = ".ListenCMD" ascii condition: uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or 8 of ( $f* ) ) } rule DITEKSHEN_MALWARE_Win_Gasket : FILE { meta: description = "Detects Gasket" author = "ditekSHen" id = "3afa131d-9c88-50df-a3b4-552db4a84e69" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7220-L7250" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0279979915891fc8c813ba555120ee5705b53b234a808b5ca77bff35a082e376" score = 75 quality = 73 tags = "FILE" strings: $s1 = "main.checkGasket" ascii $s2 = "main.connectGasket" ascii $s3 = "/cert/trust/dev/stderr/dev/stdout/index.html" ascii $f1 = ".SetPingHandler." ascii $f2 = ".SetPongHandler." ascii $f3 = ".computeMergeInfo." ascii $f4 = ".computeDiscardInfo." ascii $f5 = ".readPlatformMachineID." ascii $f6 = ".(*Session).establishStream." ascii $f7 = ".(*Session).handleGoAway." ascii $f8 = ".(*Stream).processFlags." ascii $f9 = ".(*Session).handlePing." ascii $f10 = ".(*windowsService).Install." ascii $f11 = ".(*windowsService).Uninstall." ascii $f12 = ".(*windowsService).Status." ascii $f13 = ".getStopTimeout." ascii $f14 = ".DialContext." ascii $f15 = ".WriteControl." ascii $f16 = ".(*Server).authenticate." ascii $f17 = ".(*Server).ServeConn." ascii $f18 = ".(*TCPProxy).listen." ascii $f19 = ".UserPassAuthenticator.Authenticate." ascii $f20 = ".(*InfoPacket).XXX_" ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 16 of ( $f* ) ) } rule DITEKSHEN_MALWARE_Win_Lu0Bot : FILE { meta: description = "Detects Lu0Bot" author = "ditekSHen" id = "f8595553-b911-5e30-9ece-cad7d5913f19" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7274-L7285" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b4822248230a804b1dc75f8d517af28a621dab1746c9ef45eaa4754149ce0cba" score = 75 quality = 75 tags = "FILE" strings: $s1 = "WinExec" fullword ascii $s2 = "AlignRects" fullword ascii $o1 = { be 00 20 40 00 89 f7 89 f0 81 c7 a? 01 00 00 81 } $o2 = { 53 50 e8 b0 01 00 00 e9 99 01 00 00 e8 ae 01 00 } condition: uint16( 0 ) == 0x5a4d and filesize < 4KB and 1 of ( $s* ) and all of ( $o* ) } rule DITEKSHEN_MALWARE_Win_Shellcodedlei : FILE { meta: description = "Detects shellcode downloader, executer, injector" author = "ditekSHen" id = "62a4f141-87f8-596a-adf6-5bf9a50c9e91" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7287-L7304" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "064c17427ae6b33ffb09a14abcb924d20ead44250e8bd03070bf40869f1c812e" score = 75 quality = 75 tags = "FILE" strings: $s1 = "PPidSpoof" fullword ascii $s2 = "ProcHollowing" fullword ascii $s3 = "CreateProcess" fullword ascii $s4 = "DynamicCodeInject" fullword ascii $s5 = "PPIDDynCodeInject" fullword ascii $s6 = "MapAndStart" fullword ascii $s7 = "PPIDAPCInject" fullword ascii $s8 = "PPIDDLLInject" fullword ascii $s9 = "CopyShellcode" fullword ascii $s10 = "GetEntryFromBuffer" fullword ascii condition: uint16( 0 ) == 0x5a4d and filesize < 100KB and 5 of ( $s* ) } rule DITEKSHEN_MALWARE_Win_Bluebot : FILE { meta: description = "Detects BlueBot" author = "ditekSHen" id = "cddd40bb-c3c6-5c44-9cb1-480571375be8" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7306-L7333" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "04a19f649eb2fff7a5bc59ccead80cd0a04c4e5418cbc83e850045dba75b03e0" score = 75 quality = 75 tags = "FILE" strings: $x1 = "Blue_Botnet" wide $x2 = "5-START-http" ascii $x3 = "*300-END-" ascii $x4 = "botlogger.php" wide $s1 = "//TARGET//" wide $s2 = "//BLOG//" wide $s3 = "MCBOTALPHA" wide $s4 = "//IPLIST//" wide $s5 = "Host: //BLOG//" wide $s6 = "User-Agent: //USERAGENT//" wide $s7 = "//TARGET//" wide $s8 = "POST //URL// HTTP/1.1/r/n" wide $v1 = "b__" ascii $v2 = "PressData" fullword ascii $v3 = "POSTPiece" fullword ascii $v4 = /(load|tcp|udp)Stuff/ fullword ascii $v5 = "isAttacking" fullword ascii $v6 = "DoSAttack" fullword ascii $v7 = "prv_attack" fullword ascii $v8 = "blogList" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 5 of ( $s* ) or 5 of ( $v* ) or 9 of them ) } rule DITEKSHEN_MALWARE_Win_Unkcobaltstrike : FILE { meta: description = "Detects unknown malware, potentially CobaltStrike related" author = "ditekSHen" id = "24ddccc7-3700-57a1-999c-ddefae6911bb" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7335-L7354" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "2fb4e87eec3b56773b812ce6a5c28143183087e0f93d92d76c1103563f8e0891" score = 75 quality = 75 tags = "FILE" strings: $s1 = "https://%hu.%hu.%hu.%hu:%u" ascii wide $s2 = "https://microsoft.com/telemetry/update.exe" ascii wide $s3 = "\\System32\\rundll32.exe" ascii wide $s4 = "api.opennicproject.org" ascii wide $s5 = "%s %s,%s %u" ascii wide $s6 = "User32.d?" ascii wide $s7 = "StrDupA" fullword ascii wide $s8 = "{6d4feed8-18fd-43eb-b5c4-696ad06fac1e}" ascii wide $s9 = "{ac41592a-3d21-46b7-8f21-24de30531656}" ascii wide $s10 = "bd526:3b.4e32.57c8.9g32.35ef41642767~" ascii wide $s11 = { 4b d3 91 49 a1 80 91 42 83 b6 33 28 36 6b 90 97 } $s12 = { 0d 4c e3 5c c9 0d 1f 4c 89 7c da a1 b7 8c ee 7c } condition: uint16( 0 ) == 0x5a4d and 6 of them } rule DITEKSHEN_MALWARE_Win_MB150 : FILE { meta: description = "Detects MB150? Go ransomware" author = "ditekSHen" id = "9688974b-ccf9-59ea-bb31-e46c63f021bf" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7376-L7402" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "a07535fc53912ddde6a0bed187c21ecdb2701d317d7de0cbdd2db37071bc9a21" score = 75 quality = 75 tags = "FILE" strings: $x1 = /main\.evade_(clicks_count|cpu_count|disk_size|foreground_window|hostname|mac|printer|screen_size|system_memory|time_acceleration|tmp|utc)/ fullword ascii $x2 = /main\.sandbox_(hostname|mac_addresses)/ fullword ascii $x3 = "main.drop_ransom_note" fullword ascii $x4 = "main.ransom_amount" fullword ascii $x5 = "main.create_encryption_key" fullword ascii $x6 = "main.encrypt" fullword ascii $x7 = "main.encrypt_encryption_key" fullword ascii $x8 = "main.encrypt_file" fullword ascii $x9 = "main.ext_blacklist" fullword ascii $mac1 = "00:03:FF00:05:6900:0C:2900:16:3E00:1C:1400:1C:4200:50:56" ascii nocase $mac2 = "00-03-FF00-05-6900-0C-2900-16-3E00-1C-1400-1C-4200-50-56" ascii nocase $mac3 = "0003FF000569000C2900163E001C14001C42005056" ascii nocase $go = "Go build ID:" ascii $s1 = "main.MB150" ascii $s2 = "http://1.1.1.1" ascii $s3 = "your personnal ID" ascii $s4 = "ransom amount" ascii $s5 = "binance.com" ascii $s6 = "getmonero.org" ascii condition: uint16( 0 ) == 0x5a4d and ( 4 of ( $x* ) or ( $go and 4 of ( $s* ) ) or ( 1 of ( $mac* ) and ( 2 of ( $x* ) or 3 of ( $s* ) ) ) ) } rule DITEKSHEN_MALWARE_Win_Horuseyesrat : FILE { meta: description = "Detects HorusEyesRAT" author = "ditekSHen" id = "80b2fd11-f8b4-5aee-b55a-4f7ee9fad6cf" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7435-L7451" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c0f499e3a17923b391ed6b7fa723525a9d4aef0ce04a2c7abec60d5eda15888f" score = 75 quality = 73 tags = "FILE" strings: $x1 = "\\HorusEyesRat-" ascii $x2 = "\\HorusEyesRat.pdb" ascii $x3 = "get_horus_eye" ascii $s1 = "get_Type_Packet" fullword ascii $s2 = "PacketLib" fullword ascii nocase $s3 = "System.Net.Sockets" fullword ascii $s4 = "PROCESS_MODE_BACKGROUND_BEGIN" fullword ascii $s5 = "EXECUTION_STATE" fullword ascii $s6 = /Plugins\\[A-Z]{2}.dll/ fullword wide condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) or ( 4 of ( $s* ) and #s6 > 4 ) ) } rule DITEKSHEN_MALWARE_Win_Breakwin : FILE { meta: description = "Detects BreakWin Wiper" author = "ditekSHen" id = "4ffadbfa-c1cc-59e6-a9ba-7a34eca6c3fe" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7453-L7471" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "86fc89e28fc107c2d4fe98dc16048d9e076b1fef53a3df0814f80a88bbe09c48" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Started wiping file %s with %s." fullword wide $s2 = "C:\\Program Files\\Lock My PC" wide $s3 = "Stardust is still alive." fullword wide $s4 = "Failed to terminate the locker process." fullword wide $s5 = "C:\\Windows\\System32\\cmd.exe" fullword wide $s6 = "Process created successfully. Executed command: %s." fullword wide $s7 = "locker_background_image_path" fullword ascii $s8 = "takeown.exe /F \"C:\\Windows\\Web\\Screen\" /R /A /D Y" fullword ascii $s9 = "icacls.exe \"C:\\Windows\\Web\\Screen\" /reset /T" fullword ascii $s10 = "takeown.exe /F \"C:\\ProgramData\\Microsoft\\Windows\\SystemData\" /R /A /D Y" fullword ascii $s11 = ".?AVProcessSnapshotCreationFailedException@@" fullword ascii condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_MALWARE_Win_Coinminer03 : FILE { meta: description = "Detects coinmining malware" author = "ditekSHen" id = "e0e57557-7c46-5336-b904-c4c1f142bd81" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7506-L7528" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f22e1af955a0d132dda820fe5e5e1ae2f077b7264ce1f0125a2f37c0da6b6508" score = 75 quality = 75 tags = "FILE" strings: $s1 = "UnVzc2lhbiBTdGFuZGFyZCBUaW1l" wide $s2 = "/xmrig" wide $s3 = "/gminer" wide $s4 = "-o {0} -u {1} -p {2} -k --cpu-priority 0 --threads={3}" wide $s5 = "--algo ethash --server" wide $s6 = "--algo kawpow --server" wide $cnc1 = "/delonl.php?hwid=" fullword wide $cnc2 = "/gateonl.php?hwid=" fullword wide $cnc3 = "&cpuname=" fullword wide $cnc4 = "&gpuname=" fullword wide $cnc5 = "{0}/gate.php?hwid={1}&os={2}&cpu={3}&gpu={4}&dateinstall={5}&gpumem={6}" fullword wide $cnc6 = "/del.php?hwid=" fullword wide $f1 = "b__" ascii $f2 = "b__" ascii $f3 = "b__" ascii condition: uint16( 0 ) == 0x5a4d and ( 3 of ( $cnc* ) or ( 2 of ( $f* ) and ( 1 of ( $s* ) or 1 of ( $f* ) ) ) or all of ( $f* ) or 5 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Zeppelin : FILE { meta: description = "Detects Zeppelin (Delphi) ransomware" author = "ditekSHen" id = "368d0c31-745d-50ad-a265-50561fdc822a" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7530-L7545" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f6c8420756b562662985dd26eaad58500a24cae786a47b788c953e86276116a1" score = 75 quality = 75 tags = "FILE" strings: $s1 = "TUnlockAndEncrypt" ascii $s2 = "TExcludeFiles" ascii $s3 = "TExcludeFolders" ascii $s4 = "TDrivesAndShares" ascii $s5 = "TTaskKiller" ascii $x1 = "!!! D !!!" ascii $x2 = "!!! LOCALPUBKEY !!!" ascii $x3 = "!!! ENCLOCALPRIVKEY !!!" ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $x* ) or ( 2 of ( $x* ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Slackbot : FILE { meta: description = "Detects SlackBot" author = "ditekSHen" id = "cd540aa2-dc8f-5ccc-b66c-a8d72b73c896" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7547-L7588" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "919839883c437b69cf7f380830f2499be24415f96f1e42424e4859114f958581" score = 75 quality = 73 tags = "FILE" strings: $x1 = "lp0o4bot v" ascii $x2 = "slackbot " ascii $s1 = "cpu: %lumhz %s, uptime: %u+%.2u:%.2u, os: %s" fullword ascii $s2 = "%s, running for %u+%.2u:%.2u" fullword ascii $s3 = "PONG :%s" fullword ascii $s4 = "PRIVMSG %s :%s" fullword ascii $s5 = "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" fullword ascii $m1 = "saving %s to %s" ascii $m2 = "visit number %u failed" ascii $m3 = "sending %s packets of %s bytes to %s with a delay of %s" ascii $m4 = "file executed" ascii $m5 = "packets sent" ascii $m6 = "upgrading to %s" ascii $m7 = "rebooting..." ascii $c1 = "!@remove" fullword ascii $c2 = "!@restart" fullword ascii $c3 = "!@reboot" fullword ascii $c4 = "!@rndnick" fullword ascii $c5 = "!@exit" fullword ascii $c6 = "!@sysinfo" fullword ascii $c7 = "!@upgrade" fullword ascii $c8 = "!@login" fullword ascii $c9 = "!@run" fullword ascii $c10 = "!@webdl" fullword ascii $c11 = "!@cycle" fullword ascii $c12 = "!@clone" fullword ascii $c13 = "!@visit" fullword ascii $c14 = "!@udp" fullword ascii $c15 = "!@nick" fullword ascii $c16 = "!@say" fullword ascii $c17 = "!@quit" fullword ascii $c18 = "!@part" fullword ascii $c19 = "!@join" fullword ascii $c20 = "!@raw" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or all of ( $s* ) or all of ( $m* ) or ( 10 of ( $c* ) and ( 1 of ( $x* ) or 3 of ( $s* ) or 2 of ( $m* ) ) ) ) } rule DITEKSHEN_MALWARE_Win_Sweetystealer : FILE { meta: description = "Detects SweetyStealer" author = "ditekSHen" id = "21dd1706-2cb5-5b27-ad3a-c3de8e6fb333" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7590-L7608" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ecf22240b47af077055260faba0406721f1b4cc5ed04180285df0de86c4e1241" score = 75 quality = 75 tags = "FILE" strings: $s1 = "SWEETY STEALER" wide $s2 = "\\SWEETYLOG.zip" fullword wide $s3 = "\\SWEETY STEALER\\SWEETY\\" ascii $s4 = "\\Sweety" fullword wide $s5 = "SWEETYSTEALER." ascii $s6 = "in Virtual Environment, so we prevented stealing" wide $s7 = ":purple_square:" wide $f1 = "b__" ascii $f2 = "b__" ascii $f3 = "b__" ascii $f4 = "k__" ascii condition: uint16( 0 ) == 0x5a4d and 3 of ( $s* ) or ( 3 of ( $f* ) and 1 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Genircbot : FILE { meta: description = "Detects generic IRCBots" author = "ditekSHen" id = "e1faa1dd-bbf5-5208-97d6-a6e8597d39bc" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7610-L7626" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "cc7f4599148c45fdf755c07530ae4846b7e283b5c1001c121f9ea05279997dc1" score = 75 quality = 73 tags = "FILE" strings: $s1 = "@login" ascii nocase $s2 = "PRIVMSG" fullword ascii $s3 = "JOIN" fullword ascii $s4 = "PING :" fullword ascii $s5 = "NICK" fullword ascii $s6 = "USER" fullword ascii $x1 = "irc.danger.net" fullword ascii nocase $x2 = "evilBot" fullword ascii nocase $x3 = "#evilChannel" fullword ascii nocase condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 2 of ( $x* ) ) } rule DITEKSHEN_MALWARE_Win_Nanocore : FILE { meta: description = "Detects NanoCore" author = "ditekSHen" id = "931b98f6-df2b-538b-bc49-ecbbd24334da" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7654-L7681" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "6336260e0af2b4b51338ee066f41b7c58aa134a6c03ca110db7e088edf2b65a7" score = 75 quality = 75 tags = "FILE" strings: $x1 = "NanoCore Client" fullword ascii $x2 = "NanoCore.ClientPlugin" fullword ascii $x3 = "NanoCore.ClientPluginHost" fullword ascii $i1 = "IClientApp" fullword ascii $i2 = "IClientData" fullword ascii $i3 = "IClientNetwork" fullword ascii $i4 = "IClientAppHost" fullword ascii $i5 = "IClientDataHost" fullword ascii $i6 = "IClientLoggingHost" fullword ascii $i7 = "IClientNetworkHost" fullword ascii $i8 = "IClientUIHost" fullword ascii $i9 = "IClientNameObjectCollection" fullword ascii $i10 = "IClientReadOnlyNameObjectCollection" fullword ascii $s1 = "ClientPlugin" fullword ascii $s2 = "EndPoint" fullword ascii $s3 = "IPAddress" fullword ascii $s4 = "IPEndPoint" fullword ascii $s5 = "IPHostEntr" fullword ascii $s6 = "get_ClientSettings" fullword ascii $s7 = "get_Connected" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 8 of ( $i* ) or all of ( $s* ) or ( 1 of ( $x* ) and ( 3 of ( $i* ) or 2 of ( $s* ) ) ) ) } rule DITEKSHEN_MALWARE_Win_Neshta : FILE { meta: description = "Detects Neshta" author = "ditekSHen" id = "b96ee19e-b631-57fd-bf8a-67d790202c46" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7711-L7720" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "7967c1154f652e28e541058a7b7f61aa077cfaf6be58282e1de68d9a6088c1ac" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus." fullword ascii $s2 = "! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]" fullword ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Linux_Hellokitty : FILE { meta: description = "Detects Linux version of HelloKitty ransomware" author = "ditekSHen" id = "bb228937-8cd8-5fb8-aaed-3bd539ae96f2" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7722-L7746" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "bcb1188d616b29fa535e757a37476435a3061d27e143339413f6829876701868" score = 75 quality = 73 tags = "FILE" strings: $s1 = "exec_pipe:%s" ascii $s2 = "Error InitAPI !!!" fullword ascii $s3 = "No Files Found !!!" fullword ascii $s4 = "Error open log File:%s" fullword ascii $s5 = "%ld - Files Found " fullword ascii $s6 = "Total VM run on host:" fullword ascii $s7 = "error:%d open:%s" fullword ascii $s8 = "work.log" fullword ascii $s9 = "esxcli vm process kill" ascii $s10 = "readdir64" fullword ascii $s11 = "%s_%d.block" fullword ascii $s12 = "EVP_EncryptFinal_ex" fullword ascii $s13 = ".README_TO_RESTORE" fullword ascii $m1 = "COMPROMISED AND YOUR SENSITIVE PRIVATE INFORMATION WAS STOLEN" ascii nocase $m2 = "damage them without special software" ascii nocase $m3 = "leaking or being sold" ascii nocase $m4 = "Data will be Published and/or Sold" ascii nocase condition: uint16( 0 ) == 0x457f and ( 6 of ( $s* ) or ( 2 of ( $m* ) and 2 of ( $s* ) ) or 8 of them ) } rule DITEKSHEN_MALWARE_Win_Blackmatter : FILE { meta: description = "Detects BlackMatter ransomware" author = "ditekSHen" id = "8883e652-edab-5cbf-a4fa-963b437447d9" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7748-L7767" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "4558002b424f7102f67fc44dfc37ac20f6013e25ae827c6aee0fc37231e2fa72" score = 75 quality = 75 tags = "FILE" strings: $s1 = "C:\\Windows\\System32\\*.drv" fullword wide $s2 = "NYbr-Vk@" fullword ascii $s3 = ":7:=:H:Q:W:\\:b:&;O;^;v;" fullword ascii $o1 = { b0 34 aa fe c0 e2 fb b9 03 } $o2 = { fe 00 ff 75 08 ff 75 0c ff b5 d8 fe ff ff ff b5 } $o3 = { 6a 00 ff 75 0c ff b5 d8 fe ff ff ff b5 dc fe ff } $o4 = { ff 75 08 ff 75 0c ff b5 d8 fe ff ff ff b5 dc fe } $o5 = { 53 56 57 8d 85 70 ff ff ff 83 c0 0f 83 e0 f0 89 } $o6 = { c7 85 68 ff ff ff 00 04 00 00 8b 85 6c ff ff ff } condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) and all of ( $o* ) ) } rule DITEKSHEN_MALWARE_Win_Dlinjector04 : FILE { meta: description = "Detects downloader / injector" author = "ditekSHen" id = "fe423aee-6ff4-5fd0-9fa2-51dd0c27f54b" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7769-L7790" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ab9a047e53dec2cc5986522636783b5cb8aae7fc0297292d017ec22ee5750cce" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Runner" fullword ascii $s2 = "DownloadPayload" fullword ascii $s3 = "RunOnStartup" fullword ascii $a1 = "Antis" fullword ascii $a2 = "antiVM" fullword ascii $a3 = "antiSandbox" fullword ascii $a4 = "antiDebug" fullword ascii $a5 = "antiEmulator" fullword ascii $a6 = "enablePersistence" fullword ascii $a7 = "enableFakeError" fullword ascii $a8 = "DetectVirtualMachine" fullword ascii $a9 = "DetectSandboxie" fullword ascii $a10 = "DetectDebugger" fullword ascii $a11 = "CheckEmulator" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 5 of ( $a* ) ) or 10 of ( $a* ) ) } rule DITEKSHEN_MALWARE_Win_Macoute : FILE { meta: description = "Detects Macoute" author = "ditekSHen" id = "0ecfb923-2e51-544e-984d-efdeeb175727" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7814-L7836" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "1dffa48fe6c0ac053509b5f5994d323fd72d090da0f077b52c9bc33df6997964" score = 75 quality = 75 tags = "FILE" strings: $s1 = "scp%s%s%s%s" ascii $s2 = "putfile %s %s" ascii $s3 = "pscp|%s|%s:%s" ascii $s4 = "connect %host %port\\n" ascii $s5 = "/ecoute/spool/%s-%lu" ascii $s6 = "" ascii $s7 = "CMPT;%s;%s;%s;%s;%s" ascii $s8 = "%s\\apoScreen%lu.dll" ascii $s9 = "/cap/%s%lu.jpg" ascii $s10 = "INFO;%u;%u;%u;%d;%d;%d;%d;%d;%d;%d;%s" ascii $s11 = "SUBJECT: %s is comming!" ascii $s12 = "Content-type: multipart/mixed; boundary=\"#BOUNDARY#\"" ascii $s13 = "FROM: %s@yahoo.com" ascii $s14 = "" ascii $s15 = "" ascii condition: uint16( 0 ) == 0x5a4d and 10 of them } rule DITEKSHEN_MALWARE_Win_Coinminer04 : FILE { meta: description = "Detects coinmining malware" author = "ditekSHen" id = "d90d8ad3-20b7-5bb4-8c58-3488c60ed9a2" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7838-L7858" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "2ef60dbf0bac3d5910635bb011a45e5ebc1392094b10425604fa9dd290198f8b" score = 75 quality = 75 tags = "FILE" strings: $s1 = "createDll" fullword ascii $s2 = "getTasks" fullword ascii $s3 = "SetStartup" fullword ascii $s4 = "loadUrl" fullword ascii $s5 = "Processer" fullword ascii $s6 = "checkProcess" fullword ascii $s7 = "runProcess" fullword ascii $s8 = "createDir" fullword ascii $cnc1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0" fullword wide $cnc2 = "?hwid=" fullword wide $cnc3 = "?timeout=1" fullword wide $cnc4 = "&completed=" fullword wide $cnc5 = "/cmd.php" wide condition: uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) and 1 of ( $cnc* ) ) } rule DITEKSHEN_MALWARE_Win_Sidewalk : FILE { meta: description = "Detects SideWalk" author = "ditekSHen" id = "ab82b83a-a279-555a-83c2-6340431b10da" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7860-L7880" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "6885a1ad69d61fa5875ee0db949071e84390fc2db4307c412b32cd17c0806f6a" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Decommit" fullword ascii $s2 = "Shellc0deRunner" fullword ascii $s3 = "shellc0de" fullword ascii $s4 = "C:\\Windows\\System32\\msdt.exe" fullword wide $s5 = "StartProcessWOPid" fullword ascii $s6 = "StartProcessWithParent" fullword ascii $m1 = "alloctype" fullword ascii $m2 = "ThreadIoPriority" fullword ascii $m3 = "PebAddress" fullword ascii $m4 = "dotnet.4.x64.dll" fullword wide $m5 = "LogonNetCredentialsOnly" fullword ascii $m6 = "ThreadIdealProcessor" fullword ascii $m7 = "LogonWithProfile" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or all of ( $m* ) or ( 11 of them ) ) } rule DITEKSHEN_MALWARE_Win_Vanillarat : FILE { meta: description = "Detects VanillaRAT" author = "ditekSHen" id = "70c2cd1a-a6d4-562e-a6fc-c16a9e87c6b7" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7882-L7902" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "d7b90ac88a50693ec4bb0676c04f5d161f04f67970ea60d80e79d774da75bfdc" score = 75 quality = 75 tags = "FILE" strings: $stub = "VanillaStub." ascii wide $s1 = "Client.Send: " wide $s2 = "Connected to chat" fullword wide $s3 = "GetStoredPasswords" fullword wide $s4 = "Started screen locker." fullword wide $s5 = "[<\\MOUSE>]" fullword wide $s6 = "YOUR SCREEN HAS BEEN LOCKED!" fullword wide $s7 = "record recsound" fullword wide $f1 = "d__" ascii $f2 = "d__" ascii $f3 = "k__" ascii $f4 = "k__" ascii $f5 = "KillClient" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( $stub and ( 2 of ( $s* ) or 2 of ( $f* ) ) ) or 6 of ( $s* ) or all of ( $f* ) ) } rule DITEKSHEN_MALWARE_Win_Sectoprat : FILE { meta: description = "Detects SectopRAT" author = "ditekSHen" id = "d6594834-24d7-5e86-84b5-5a7920e7bc89" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7904-L7929" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "b4048f837c02560a8b650247173be25893b466e5cec8f2784eea58172f973822" score = 75 quality = 75 tags = "FILE" strings: $s1 = "\\\\.\\root\\cimv2:Win32_Process" wide $s2 = "\\\\.\\root\\cimv2:CIM_DataFile.Name=" wide $s3 = "^.*(?=Windows)" fullword wide $s4 = "C:\\Windows\\System32\\cmd.exe" wide $s5 = "C:\\Windows\\explorer.exe" wide $s6 = "Disabling IE protection" wide $s7 = "stream started succces" wide $b1 = "/C start Firefox" wide $b2 = "/C start chrome" wide $b3 = "/C start iexplore" wide $m1 = "DefWindowProc" fullword ascii $m2 = "AuthStream" fullword ascii $m3 = "KillBrowsers" fullword ascii $m4 = "GetAllNetworkInterfaces" fullword ascii $m5 = "EnumDisplayDevices" fullword ascii $m6 = "RemoteClient.Packets" fullword ascii $m7 = "IServerPacket" fullword ascii $m8 = "keybd_event" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( 5 of ( $s* ) and 2 of ( $b* ) ) or all of ( $s* ) or ( all of ( $b* ) and ( 4 of ( $s* ) or 5 of ( $m* ) ) ) ) } rule DITEKSHEN_MALWARE_Win_Neptune : FILE { meta: description = "Detects Neptune keylogger / infostealer" author = "ditekSHen" id = "0f619bea-f00b-5078-95a4-83306e3e87b4" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7931-L7953" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e3298bf55f89180ed7e9f7ad35b59d39284a5143fd69fa2a4fbc27d91fb2fbd3" score = 75 quality = 75 tags = "FILE" strings: $x1 = "your keylogger has been freshly installed on" wide $x2 = "Attached is a screenshot of the victim" wide $x3 = "color: rgb(2, 84, 138);'>Project Neptune
    " wide $x4 = ">{Monitor Everything}

    " wide $x5 = "[First Run] Neptune" wide $x6 = "Neptune - " wide $s1 = "Melt" fullword wide $s2 = "Hide" fullword wide $s3 = "SDDate+" fullword wide $s4 = "DelOff+" fullword wide $s5 = "MsgFalse+" fullword wide $s6 = "Clipboard:" fullword wide $s7 = "information is valid and working!" wide $s8 = ".exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f" wide $s9 = "http://www.exampleserver.com/directfile.exe" fullword wide condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 7 of ( $s* ) or ( 1 of ( $x* ) and 5 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Tomiris : FILE { meta: description = "Detects Tomiris" author = "ditekSHen" id = "86efd4fb-3c76-504e-b367-132aee59e09a" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7955-L7978" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "1d9baeb6db2e849dd053c3fc735984e23b9cead39cf166f8a544ee5a439185d1" score = 75 quality = 75 tags = "FILE" strings: $f1 = "main.workPath" ascii $f2 = "main.selfName" ascii $f3 = "main.infoServerAddr" ascii $f4 = "main.configFileName" ascii $s1 = "C:/Projects/go/src/Tomiris/main.go" ascii $s2 = "C:/GO/go1.16.2/src/os/user/lookup_windows.go" ascii $s3 = "C:\\GO\\go1.16.2" ascii $s4 = ".html.jpeg.json.wasm.webp/p/gf/p/kk1562515" ascii $s5 = "\" /ST 10:00alarm clockassistQueueavx512vbmi2avx512vnniwbad" ascii $s6 = "write /TR \" Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p=" ascii $t1 = "SCHTASKS /DELETE /F /TN \"%s\"" ascii $t2 = "SCHTASKS /CREATE /SC DAILY /TN" ascii $t3 = "SCHTASKS /CREATE /SC ONCE /TN \"%s\" /TR \"%s\" /ST %s" ascii $t4 = "SCHTASKS /CREATE /SC ONCE /TN \"%s\" /TR \"'%s' %s\" /ST %s" ascii $r1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones" ascii $r2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" ascii condition: uint16( 0 ) == 0x5a4d and ( ( all of ( $f* ) and 3 of ( $s* ) and 2 of ( $t* ) and 1 of ( $r* ) ) or ( 4 of ( $s* ) and 2 of ( $t* ) and 1 of ( $r* ) ) or 12 of them ) } rule DITEKSHEN_MALWARE_Win_Jennlog : FILE { meta: description = "Detects JennLog loader" author = "ditekSHen" id = "38f8cd13-f157-5cce-bf04-80c29d254144" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7980-L7996" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "085a4783c7c01ec95491d9999d1835ad9ab3dc70d77b944578e097b3ffe3a627" score = 75 quality = 75 tags = "FILE" strings: $x1 = "%windir%\\system32\\rundll32.exe advapi32.dll,ProcessIdleTasks" fullword wide $x2 = "https://fkpageintheworld342.com" fullword wide $s1 = "ExecuteInstalledNodeAndDelete" fullword ascii $s2 = "ProcessExsist" fullword ascii $s3 = "helloworld.Certificate.txt" fullword wide $s4 = "ASCII85 encoded data should begin with '" fullword wide $s5 = "] WinRE config file path: C:\\" ascii $s6 = "] Parameters: configWinDir: NULL" ascii $s7 = "] Update enhanced config info is enabled." ascii condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or 5 of ( $s* ) or ( all of ( $x* ) and 2 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Lockfile : FILE { meta: description = "Detects LockFile ransomware" author = "ditekSHen" id = "762ac376-43ff-56d2-b279-2879ce6d8542" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7998-L8014" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "28c8aa8931d599e5a1860fe2ed0b8172e709dad1a48a319858a907fa775af293" score = 75 quality = 71 tags = "FILE" strings: $x1 = "LOCKFILE" fullword ascii $x2 = "25a01bb859125507013a2fe9737d3c33" fullword ascii $s1 = "" fullword ascii $s2 = "%s" fullword ascii $s3 = "%d" fullword ascii $s4 = "%s\\%s-%s-%d%s" fullword ascii $s5 = ">RAC=OQD:S>P@:AO?R:EEOS:ARDD=N?EENSB" ascii wide $m1 = "LOCKFILE" ascii wide nocase $m2 = " 2 and 5 of them ) ) } rule DITEKSHEN_MALWARE_Win_Flagpro : FILE { meta: description = "Detects Flagpro" author = "ditekSHen" id = "da1bf899-feb5-5ed0-956e-c20bc3565a6e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9032-L9049" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c5e5944426b7be690ad62dd0d98a8fc6f8135cab0dbdd8a5aaf1670491eda59d" score = 75 quality = 75 tags = "FILE" strings: $s1 = "download...." fullword ascii $s2 = "~MYTEMP" fullword wide $s3 = ".?AVCV20_LoaderApp@@" fullword ascii $s4 = ".?AVCV20_LoaderDlg@@" fullword ascii $s5 = "ExecYes" fullword ascii $s6 = / 1 and 4 of them ) ) } rule DITEKSHEN_MALWARE_Win_Maze : FILE { meta: description = "Detects Maze ransomware" author = "ditekSHen" id = "f5d1d3e2-1ffe-5ec6-b1ee-bded81867fb8" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9116-L9145" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "d3ce3b43c65dfd9f59ba3c6b64e8d7687db175673cc62068caa1e1da023390c0" score = 75 quality = 75 tags = "FILE" strings: $x1 = "Uc32nbspacec97c98c99c100c101c102c103c104c105c106c107c108c109c110c" ascii $s1 = "\"%s\" shadowcopy delete" wide $s2 = "[%windir%\\system32\\wbem\\wmic" wide $s3 = "process call create \"cmd /c start %s\"" wide $s4 = "DECRYPT-FILES.html" fullword wide $s5 = "Dear %s, your files" wide $s6 = "%s! Alert! %s! Alert!" wide $s7 = "%BASE64_PLACEHOLDER%" fullword ascii $s8 = "-orDGorX0or" fullword ascii $s9 = { 47 45 54 20 2f 25 73 20 48 54 54 50 2f 31 2e 31 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 25 73 0d 0a 48 6f 73 74 3a 20 25 73 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 0d 0a 00 50 4f 53 54 20 2f 25 73 20 48 54 54 50 2f 31 2e 31 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 25 73 0d 0a 48 6f 73 74 3a 20 25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 25 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 0d 0a 00 0d 0a 0d 0a 00 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 00 } condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or 6 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Lokilocker : FILE { meta: description = "Detects LokiLocker ransomware" author = "ditekSHen" id = "4f4927c5-79e6-5c5a-b84d-c4728affe9e1" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9169-L9194" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "bf78f5e8f40c1a19f6b078a85854e95d5ef1f321393a831edda17b0d65515da7" score = 75 quality = 75 tags = "FILE" strings: $x1 = "SOFTWARE\\Loki" fullword wide $x2 = "Cpriv.Loki" fullword wide $x3 = "Loki/" wide $x4 = /loki(\s)?locker/ fullword wide nocase $s1 = "Restore-My-Files.txt" wide $s2 = "loading encryption keys" wide $s3 = "Kill switch -> enabled" wide $s4 = "ScanSMBShares" fullword ascii $s5 = "RewriteMBR" fullword ascii $s6 = /Encrypt(Drives|File|WinVolume|OsDrive)/ fullword ascii $n1 = "unique-id=" ascii wide $n2 = "&disk-size=" ascii wide $n3 = "&user=Darwin&cpu-name=" ascii wide $n4 = "&ram-size=" ascii wide $n5 = "&os-name=" ascii wide $n6 = "&chat-id=" ascii wide $n7 = "&msg-id=" ascii wide $n8 = "&elapsed-time=" ascii wide condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 4 of ( $s* ) or 6 of ( $n* ) or ( 3 of ( $s* ) and 3 of ( $n* ) ) or ( 1 of ( $x* ) and ( 2 of ( $s* ) or 2 of ( $n* ) ) ) ) } rule DITEKSHEN_MALWARE_Win_Bhunt : FILE { meta: description = "Detects BHunt infostealer" author = "ditekSHen" id = "4c699f10-64a0-5e3c-af00-e08ebe1c6830" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9212-L9233" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ca0a7e6898047fa3b369125a4402e2beffd328a5db47b1d5dd5914a86d6f0073" score = 75 quality = 75 tags = "FILE" strings: $x1 = "BHUNT.Resources.resources" fullword ascii $x2 = "//minecraftsquid.hopto.org/" wide $s1 = "chaos_crew" ascii wide $s2 = "golden7" ascii wide $s3 = "mrpropper" ascii wide $s4 = "/ifo.php?" ascii wide $s5 = "bonanza=:=" ascii wide $s6 = "blackjack=:=" ascii wide $s7 = "SendPostData" fullword ascii $c1 = "cmd /c REG ADD" wide $c2 = "taskkill /F /IM" wide $c3 = "cmd.exe /c wmic" wide $g1 = "$ca9a291d-266c-41dc-9f1c-93cfe0dcac16" fullword ascii $g2 = "$6d0feb35-213d-4b9f-afc7-06d168cfcb5e" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and ( 5 of ( $s* ) or 2 of ( $c* ) ) ) or ( 6 of ( $s* ) and 2 of ( $c* ) ) or ( all of ( $g* ) and 2 of them ) ) } rule DITEKSHEN_MALWARE_Win_Lorenz : FILE { meta: description = "Detects Lorenz ransomware" author = "ditekSHen" id = "9c11cfbc-aa77-5138-81e4-3a5f4f21a470" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9235-L9265" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e9fc9d405b955c379ae40b1804d43b19999f6ea264fc645c897080fb020e8ae8" score = 75 quality = 73 tags = "FILE" strings: $x1 = "143.198.117.43" fullword ascii $x2 = "157.90.147.28" fullword ascii $x3 = "//kpb3ss3vwvfejd4g3gvpvqo6ad7nnmvcqoik4mxt2376yu2adlg5fwyd.onion" ascii $x4 = "http://lorenz" ascii $x5 = "\\lora\\Release\\lora.pdb" ascii $x6 = "--MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ" ascii $x7 = "/USER:'HOMEOFFICE.COM\\" ascii $x8 = "/USER:'Sentinel.com\\" ascii $s1 = "to->_What == nullptr && to->_DoFree == false" fullword wide $s2 = "*it == '\\0'" fullword wide $s3 = "process call create 'cmd.exe /c" ascii $s4 = "\\Control Panel\\Desktop\" /V Wallpaper /T REG_SZ /F /D" ascii $s5 = "HELP_SECURITY_EVENT.html" ascii $s6 = "
    [+] Whats Happen?" ascii $s7 = /\.Lorenz\.sz\d+$/ fullword ascii $s8 = "TW9Vc29Db3JlV29ya2VyLmV4ZQ==" fullword ascii $s9 = ".Speak(\"You've been hack" ascii nocase $s10 = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAo" ascii $n1 = "ame_serv=" ascii $n2 = "&ip=" ascii $n3 = "&winver=Windows" ascii $n4 = "&list_drive=" ascii $n5 = "&file=" ascii condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 8 of ( $s* ) or ( 4 of ( $n* ) and 2 of them ) or ( 1 of ( $x* ) and 6 of them ) ) } rule DITEKSHEN_MALWARE_Win_Blackcat : FILE { meta: description = "Detects BlackCat ransomware" author = "ditekSHen" id = "b6831d84-40d7-52ae-8c4d-30b087b0007b" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9267-L9289" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "cd76e5b87f33d91c17fd032417583c3f68d0e310aaf6f08e26ec5d53844ed9d2" score = 75 quality = 75 tags = "FILE" strings: $x1 = "{\"config_id\":\"\",\"public_key\":\"MIIBIjANBgkqhkiG9w0BAQEFAAO" ascii $x2 = "C:\\Users\\Public\\All Usersdeploy_note_and_image_for_all_users=" fullword ascii $s1 = "encrypt_app::windows" ascii $s2 = /locker::core::os::windows::(desktop_note|self_propagation|privilege_escalation|psexec|shadow_copy)/ ascii $s3 = "uac_bypass::shell_exec=" ascii $s4 = "-u-p-s-d-f-cpropagate::attempt=" ascii $s5 = "masquerade_peb" ascii $s6 = "RECOVER-${EXTENSION}-FILES.txt" ascii $s7 = ".onion/?access-key=${ACCESS_KEY}" ascii $s8 = "-vm-killno-vm-snapshot-killno-vm-kill-" ascii $s9 = "esxi_vm_killenable_esxi_vm_snapshot_killstrict_" ascii $s10 = /enum_(shares|servers)_sync::ok/ fullword ascii $s11 = "hidden_partitions::mount_all::mounting=" ascii condition: ( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and ( all of ( $x* ) or 5 of ( $s* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Timetime : FILE { meta: description = "Detects TimeTime ransomware" author = "ditekSHen" id = "4d6a31b5-b5a5-58e2-bfce-c40c72cda391" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9311-L9327" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "c75ca595ff25f8c79bfe8e5c6af29349be8f07c2de79fd24f09b02afffb7168b" score = 75 quality = 75 tags = "FILE" strings: $s1 = "@_DECRYPTOR_@" ascii wide $s2 = "@__RECOVER_YOUR_FILES__@" wide $s3 = "\\TimeTime.pdb" ascii $s4 = "runCommand" fullword ascii $s5 = "decryptor_file_name" fullword ascii $s6 = "encryption_hiding_process" fullword ascii $s7 = "admin_hiding_process" fullword ascii $s8 = "security_vaccine" fullword ascii $s9 = "EncrFiles_Load" fullword ascii condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_MALWARE_Win_Strifewater : FILE { meta: description = "Detects StrifeWater RAT" author = "ditekSHen" id = "69f0bd07-3e4e-5245-9c42-c3f8199b566e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9329-L9354" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ddb189dfe58af08d2c0682239551a5b9d82db94eedcefc02895316bcbbaca3f2" score = 75 quality = 75 tags = "FILE" strings: $s1 = "example/1.0" fullword wide $s2 = "coname:" fullword ascii $s3 = "*elev:" fullword ascii $s4 = "*uname:" fullword ascii $s5 = "--BoundrySign" ascii $s6 = "000000c:\\users\\public\\libraries\\tmp.bi" ascii $s7 = "9c4arSBr32g6IOni" fullword ascii $pdb = "\\win8\\Desktop\\ishdar_win8\\" ascii $xn1 = "techzenspace.com" fullword wide $xn2 = "87.120.8.210" wide $xn3 = "192.168.40.27" wide $n1 = /RVP\/index\d+\.php/ fullword wide $n2 = "tid=%d&code=%s&fname=%s&apiData=%s" fullword ascii $n3 = "code=%s&tid=%d&fname=%s&apiData=%s" fullword ascii $n4 = "Content-Disposition: form-data; name=\"token\"" fullword ascii $n5 = "Content-Disposition: form-data; name=\"apiData\"" fullword ascii $n6 = "Content-Disposition: form-data; name=\"data\"; filename=\"" fullword ascii $n7 = "Content-Disposition: form-data; name=\"tid\"" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $xn* ) or 6 of ( $s* ) or 6 of ( $n* ) or ( 1 of ( $xn* ) and 4 of them ) or ( $pdb and 4 of them ) or ( 3 of ( $s* ) and 3 of ( $n* ) ) ) } rule DITEKSHEN_MALWARE_Win_Surtr : FILE { meta: description = "Detects Surtr ransomware. Ransom note is similar to LockFile" author = "ditekSHen" id = "7a31415d-5c03-5537-9adb-65e637f9fa0e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9356-L9378" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "a8db5588079d471d8904f0444973973a0c01dbec1ccbe3d43a34d41a0dde495d" score = 75 quality = 75 tags = "FILE" strings: $s1 = "SurtrRansomware" ascii $s2 = " 5 ) } rule DITEKSHEN_MALWARE_Win_Povertystealer : FILE { meta: description = "Detects PovertyStealer" author = "ditekSHen" id = "a431b82a-81cb-51a9-b3a8-61d71f36a60e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10904-L10917" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0d8a4dd1f3a9935935878840d19e16d91d240da776f99eb2dd3f12df96efa1d9" score = 75 quality = 75 tags = "FILE" clamav1 = "MALWARE.Win.Trojan.PovertyStealer" strings: $x1 = "Poverty is the parent of crime." ascii $s2 = "OperationSystem: %d:%d:%d" ascii $s3 = "ScreenSize: {lWidth=%d, lHeight=%d}" ascii $s4 = "VideoAdapter #%d: %s" ascii $s5 = "$d.log" fullword wide condition: (( uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or all of ( $s* ) ) ) or all of them ) } rule DITEKSHEN_MALWARE_Win_Janelarat : FILE { meta: description = "Detects JanelaRAT" author = "ditekSHen" id = "6a49eeda-307f-5429-aa24-658223360239" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10919-L10939" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "9f10112b6ffa382b03511e7b6c8757438d5910ee2c24d650d05bb53abfff3860" score = 75 quality = 75 tags = "FILE" strings: $x1 = "k__" ascii $x2 = "janela" fullword ascii $x3 = "\\CSHARP\\RAT\\" ascii $s1 = "k__" ascii $s2 = "b__" ascii $s3 = "hookStruct" fullword ascii $s4 = "[^a-zA-Z]" fullword wide $s5 = "GetRecycled" fullword ascii $s6 = "import \"bcl.proto\";" wide $s7 = "\\KL_FINAL\\" ascii $s8 = "\\KL_FASEAVAST" ascii $s9 = "\\kl c++" ascii $s10 = "VisaoAPP" ascii wide condition: uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 2 of ( $x* ) and 3 of ( $s* ) ) or ( 1 of ( $x* ) and 5 of ( $s* ) ) or ( 6 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Qwixxrat : FILE { meta: description = "Detects QwixxRAT. Uses ToxicEye / TelegramRAT as base (MALWARE_Win_TelegramRAT)" author = "ditekSHen" id = "0a8f2f6f-aa78-56c2-aca0-d575fbf0b91e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10941-L10953" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e6e44697e393da35215f7835f122cb74b05dbeebb558345d5110d6fbc809f4dd" score = 75 quality = 75 tags = "FILE" strings: $s1 = /Qwixx(\s)?Stealer/ ascii wide $s2 = "discord.gg/UXVFHzTjYe" wide $s3 = "t.me/QwixxTwixx" wide $s4 = "Secret Qwixx" wide $s5 = "\\Qwixx Rat\\" ascii condition: uint16( 0 ) == 0x5a4d and 2 of them } rule DITEKSHEN_MALWARE_Win_Toxiceye : FILE { meta: description = "Detects ToxicEye / TelegramRAT. Observed used as the basis for many infostealers" author = "ditekSHen" id = "99304f11-2444-5864-b174-514bb5bef0f7" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10955-L10973" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ee01c107dd295b923801c0d1a77b1534d3a5f2abf8d2cfa93c6786a1b0553504" score = 75 quality = 75 tags = "FILE" strings: $s1 = "[~] Handling command" wide $s2 = "[?] Sleeping {0}" wide $s3 = "GETPASSWORDS" wide $s4 = "FORKBOMB" wide $s5 = "SENDKEYPRESS" wide $s6 = "KEYLOGGER" wide $s7 = "/ToxicEye/master/TelegramRAT/" wide $s8 = "desktopScreenshot" ascii $s9 = "MeltFile" ascii $s10 = "AutoStealer" ascii $s11 = /\/LimerBoy\/(ToxicEye|Adamantium-Thief|hackpy)/ wide condition: uint16( 0 ) == 0x5a4d and 7 of them } rule DITEKSHEN_MALWARE_Win_Rdpcredsstealerinjector : FILE { meta: description = "Detects RDP Credentials Stealer injector" author = "ditekSHen" id = "221b7d64-6585-5f3a-bffa-bde05390db73" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10994-L11007" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0dfade8dde987f5134158b7c4abc3eaf8dcece86e1ff2ab1da4466da316939a2" score = 75 quality = 75 tags = "FILE" clamav1 = "MALWARE.Win.Trojan.RDPCredsStealer-Injector" strings: $s1 = "\\APIHookInjectorBin\\" ascii $s2 = "\\RDPCredsStealerDLL.dll" ascii $s3 = "DLL Injected" ascii $s4 = "Code Injected" ascii $s5 = /(OpenProcess|VirtualAllocEx|CreateRemoteThread)\(\) failed:/ fullword ascii condition: uint16( 0 ) == 0x5a4d and 3 of them } rule DITEKSHEN_MALWARE_Win_Krakenstealer : FILE { meta: description = "Detect Kraken infostealer" author = "ditekSHen" id = "460eb574-99c9-5f78-9efa-7a8808aaaae7" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11009-L11030" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "7f15823db706e6e51d8ea58fb026efb49f42234255d2f448614dc645d12648bb" score = 75 quality = 73 tags = "FILE" snort = "923828002" strings: $x1 = /Kraken(_)?(Stub|Keyboard|Clipboard|GeneratorMachine|PostLogs|Screenshot|Keylogs|Password)/ ascii wide $s1 = /(get|set)_(Clipboard|Keyboard|Screen)Recorder/ fullword ascii $s2 = /Dumping(FileZilla|360_China|Opera|Epic|CocCoc|Thunderbird|Brave)/ fullword ascii $s3 = "ScreenPostData" fullword ascii $s4 = "encrypt_data" fullword ascii $s5 = "KeyboardProc" fullword ascii $s6 = "UploadsKeyboard" fullword ascii $s7 = "ClpUploader" fullword ascii $s8 = "StartKeylogger" fullword ascii $s9 = "ClipoDetectedRemover" fullword ascii $s10 = "Disable_Regis" fullword ascii $s11 = "RecordedClips" fullword ascii $s12 = "HoneyPotStatus" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or 9 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Whiffyrecon : FILE { meta: description = "Detects Whiffy Recon" author = "ditekSHen" id = "19b0f327-06ee-5f78-abac-9c4fbcad98ac" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11032-L11052" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "58df9f47f5890c5e31d352be682c6164a940dad206ad29c54c43f70d3afb9543" score = 75 quality = 75 tags = "FILE" strings: $s1 = "WLANSVC" fullword wide $s2 = "f02fe1c0-137a-4802-8881-55dd300c5022" fullword wide $s3 = "\\wlan.lnk" fullword wide $s4 = "str-12.bin" wide $s5 = "/geolocation/v1/geolocate?key=" wide $s6 = "/wlan" fullword wide $s7 = "/scanned" fullword wide $s8 = "/bots/" fullword wide $s9 = "wlan.pdb" fullword ascii $s10 = "botId" fullword ascii $s11 = "wifiAccessPoints" fullword ascii $s12 = "considerIp" fullword ascii $s13 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" fullword wide condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_Quiterat : FILE { meta: description = "Detects QuiteRAT" author = "ditekSHen" id = "54f7b899-3418-5074-8138-38cf073cda8c" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11054-L11068" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "257f9151294254e3e86979f184963f0396587438393b11bad068ba0f386cfc4a" score = 75 quality = 75 tags = "FILE" strings: $x1 = "< No Pineapple! >" ascii $x2 = ".?AVPineapple" ascii $x3 = ".?AVApple@@" ascii $s1 = "XgsdCwsRFxZF" ascii $s2 = "XggZChkVRQ==" ascii $s3 = "RxUZERQRHEU=" ascii $s4 = "XhkbDBEXFkU" ascii condition: uint16( 0 ) == 0x5a4d and ( ( all of ( $x* ) and 1 of ( $s* ) ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_PWSH_CUMII { meta: description = "Detects multi-dropper PowerShell" author = "ditekSHen" id = "07b77251-1d79-5521-8c05-ecfc662f45cb" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11070-L11086" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ab9e59b0552718928d170a988d129b38352700076847f2f409976016858864eb" score = 75 quality = 75 tags = "" clamav = "ditekSHen.MALWARE.PWSH.CUMII" strings: $s1 = ".('{1}{$}'.replace('$','0')" ascii nocase $s2 = ",'I').replace('!','ex')" ascii nocase $s3 = "'.replace('*','0001')" ascii nocase $s4 = "Remove-Item $" ascii nocase $s5 = "the File will start cumiing" ascii nocase $b1 = "011001100111010101101110011*" ascii $b2 = "0101001000*1110110*010011111" ascii $b3 = "01001101010110101001*11*0000" ascii condition: (3 of ( $s* ) and 1 of ( $b* ) ) } rule DITEKSHEN_MALWARE_Win_Agnianestealer : FILE { meta: description = "Detects Agniane infostealer" author = "ditekSHen" id = "fcbbf748-dc01-579f-a6f8-37e0f3dea35e" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11088-L11114" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "0031fbe6d76868819cbcfc638433d60a50e8f5cfd14ff25af88ed3dffefd7d62" score = 75 quality = 75 tags = "FILE" snort = "923828001" clamav = "ditekSHen.MALWARE.Win.AgnianeStealer" strings: $x1 = "Agniane.pdb" ascii $x2 = "IEnumerable." ascii $x3 = "Agniane Stealer" wide $x4 = "cinoshibot" wide $x5 = "yqbiguuno2zp5jxsmqbev4rwckvy27bqws5cgm3hiid7xolt65j72kqd.onion" wide $s1 = "" wide $s2 = "Domain Detect: detected {0}" wide $s3 = "DOMAINDETECTCOOKIES" ascii $s4 = /(Opera|Edge|Chrome|Brave|Vivaldi|Blink|Universal|Gecko|OperaGx|Firefox)Grabber/ fullword ascii $u1 = "/antivm.php?id=" wide $u2 = "/ferr.php?id=" wide $u3 = ".php?ownerid=" wide $u4 = "&buildid=" wide $u5 = "&username=" wide $u6 = "&BSSID=" wide $u7 = "&rndtoken=" wide $u8 = "&domaindetects=" wide condition: uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and ( 2 of ( $s* ) or 3 of ( $u* ) ) ) or ( all of ( $s* ) and 3 of ( $u* ) ) or ( 7 of ( $u* ) ) ) } rule DITEKSHEN_MALWARE_Win_TOITOIN_Kritaloader : FILE { meta: description = "Detects TOITOIN KritaLoader" author = "ditekSHen" id = "5ff002fc-1108-554e-9de6-92d568826d1d" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11116-L11127" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "9629a4cfa606812d2579c0c0d486dec5971854e5133f0594a4638db5b89c3135" score = 75 quality = 75 tags = "FILE" clamav = "ditekSHen.MALWARE.Win.Trojan.TOITOIN" strings: $p1 = ":\\Trabalho_2023\\OFF_2023\\" ascii $p2 = "DLL_Start_OK.pdb" ascii $s1 = "krita_main" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( 1 of ( $p* ) and 1 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_TOITOIN_Downloader : FILE { meta: description = "Detects TOITOIN Downloader" author = "ditekSHen" id = "0282ea26-e381-5c9a-9dad-c90246d8add0" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11143-L11154" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "d7e5e99c9266ec144152c3d1066e0e1a862f48ded17fab8f504192ca48219826" score = 75 quality = 75 tags = "FILE" clamav = "ditekSHen.MALWARE.Win.Trojan.TOITOIN" strings: $p1 = ":\\Trabalho_2023\\OFF_2023\\" ascii $s1 = { 20 2f 63 20 22 [6-15] 63 00 6d 00 64 00 00 00 6f 00 70 00 65 00 6e } $o1 = { 48 83 fa 10 72 34 48 8b 8d 10 ?? 00 00 48 ff c2 } condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Venomrat : FILE { meta: description = "Detects VenomRAT" author = "ditekSHen" id = "93cd5ae3-c222-51a2-bbb9-bdd3254006e5" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11156-L11170" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "47d343def76a323c66db4ba6fb1c0d119f45323f9b7f36695e4aeb7b070819d7" score = 75 quality = 75 tags = "FILE" strings: $x1 = "Venom RAT + HVNC" fullword ascii $x2 = "Venom" fullword ascii $x3 = "VenomByVenom" fullword wide $s1 = "/c schtasks /create /f /sc onlogon /rl highest /tn \"" fullword wide $s2 = "UmVjZWl2ZWQ" wide $s3 = "Pac_ket" fullword wide $s4 = "Po_ng" fullword wide condition: uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) and 2 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Sapphirestealer : FILE { meta: description = "Detects SapphireStealer" author = "ditekSHen" id = "ed6cffe4-23f1-5791-b07d-75abb698c899" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11172-L11190" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "97088c0decf158d45a02571bd50b5f370c139339c19b8071f38c0f9816232d1f" score = 75 quality = 75 tags = "FILE" strings: $s1 = "Sapphire.Modules." ascii $s2 = "sapphire\\" wide $s3 = "by r3vengerx0" wide $s4 = "Sapphire\\obj\\" ascii $s5 = "[ERROR_GETSECRETKEY_METHOD]" fullword wide $s6 = "[ERROR_CANT_GET_PASSWORD]" fullword wide $s7 = "

    ------NEW LOGS------

    " wide $s8 = "[ERROR] can't create grab directory" wide $s9 = "d__" ascii $s10 = "UploadToTelegram" ascii $s11 = ".SendLog+d__" ascii condition: uint16( 0 ) == 0x5a4d and 5 of them } rule DITEKSHEN_MALWARE_Win_R77 : FILE { meta: description = "Detects r77 rootkit" author = "ditekSHen" id = "813d207e-c6d9-5fea-8387-19da33bc3317" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11192-L11217" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "e3ec6e88a3a77b7dc69eb51a528e6417f6b8695c7cb01d699cf248cebd9b84e2" score = 75 quality = 75 tags = "FILE" strings: $s1 = "startup" fullword wide $s2 = "process_names" fullword wide $s3 = "paths" fullword wide $s4 = "service_names" fullword wide $s5 = "tcp_local" fullword wide $s6 = "tcp_remote" fullword wide $s7 = "\\\\.\\pipe\\" wide $s8 = "SOFTWARE\\" wide condition: uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 5 of them and pe.exports ( "ReflectiveDllMain" ) ) or ( 5 of them and for any i in ( 0 .. pe.number_of_sections ) : ( ( pe.sections [ i ] . name == ".detourd" ) ) ) ) } rule DITEKSHEN_MALWARE_Win_Risepro : FILE { meta: description = "Detects RisePro infostealer" author = "ditekShen" id = "77bc8791-cbe8-53b5-86f4-bc918454a6a6" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11239-L11269" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "f6f1832f316df51ca108a3c75034bd53c3823cd3d9b16da120e12e252dbf90ff" score = 75 quality = 71 tags = "FILE" strings: $x1 = "t.me/riseprosupport" ascii wide nocase $s1 = "failed readpacket" fullword wide $s2 = "faield sendpacket" fullword wide $s3 = "PersistWal" fullword wide $s4 = /CRED_ENUMERATE_(ALL|SESSION)_CREDENTIALS/ fullword ascii $s5 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36" fullword wide $s6 = { 4c 00 6f 00 67 00 69 00 6e 00 20 00 44 00 61 00 74 00 61 [10] 57 00 65 00 62 00 20 00 44 00 61 00 74 00 61 [2] 48 00 69 00 73 00 74 00 6f 00 72 00 79 [21] 43 00 6f 00 6f 00 6b 00 69 00 65 00 73 } $s7 = { 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 2f 00 78 00 2d 00 77 00 77 00 77 00 2d 00 66 00 6f 00 72 00 6d 00 2d 00 75 00 72 00 6c 00 65 00 6e 00 63 00 6f 00 64 00 65 00 64 00 3b 00 20 00 63 00 68 00 61 00 72 00 73 00 65 00 74 00 3d 00 75 00 74 00 66 00 2d 00 38 00 42 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 2f 00 6a 00 73 00 6f 00 6e 00 2c 00 20 00 74 00 65 00 78 00 74 00 2f 00 70 00 6c 00 61 00 69 00 6e 00 2c 00 20 00 2a 00 2f 00 2a } $s8 = /_(SET|GET)_(GRABBER|LOADER)/ wide $s9 = /catch (save )?(windows cred|screen|pluginscrypto|historyCC|autofill|cookies|passwords|passwords sql|autofills sql|dwnlhistory sql|discordToken|quantum|isDropped)/ fullword wide condition: uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or 6 of ( $s* ) ) } rule DITEKSHEN_MALWARE_Win_Graphicalproton_Rsockstun : FILE { meta: description = "Detects GraphicalProton custom rsockstun" author = "ditekShen" id = "5efa85f6-7e73-53a1-92df-4cb975e62345" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11271-L11286" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "ca4d18160b89d82106310237cf81bba57a7f51be77a31d2f18ca8c2987972c2c" score = 75 quality = 75 tags = "FILE" strings: $m1 = "main.connectviaproxy" ascii $m2 = "main.connectForSocks" ascii $m3 = "main.listenForClients" ascii $m4 = "main.listenForSocks" ascii $s1 = "Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=" ascii $s2 = "Server: nginx/1.14.1" ascii $s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" ascii $s4 = "wine_get" ascii condition: uint16( 0 ) == 0x5a4d and ( ( all of ( $m* ) and 2 of ( $s* ) ) or ( all of ( $s* ) and 1 of ( $m* ) ) or 7 of them ) } rule DITEKSHEN_MALWARE_Win_PWSHDLLDL : FILE { meta: description = "Detects downloader" author = "ditekShen" id = "553ed216-c8c2-504f-b689-0e8d21a00eaa" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11288-L11303" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "7acef81f0e6e282650c161963599dcbe2b3975d482eb7c330581901b0fe85655" score = 75 quality = 75 tags = "FILE" strings: $s1 = "powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file " fullword wide nocase $s2 = "objShell.run \"powershell -WindowStyle hidden -command wscript.exe //b //nologo '" fullword wide nocase $s3 = "cmd.exe /c schtasks.exe /create /tn \"" fullword wide nocase $s4 = "-WindowStyle hidden -command wscript.exe //b //nologo '" fullword wide nocase $s6 = "\" /tr \"wscript.exe //b //nologo '" fullword wide nocase $s7 = "\" -Value \"Powershell.exe -WindowStyle hidden \"\"& '" fullword wide nocase $op0 = { 61 01 00 34 53 79 73 74 65 6d 2e 57 65 62 2e 53 } $op1 = { 4b 04 00 00 34 01 00 00 7f 05 00 00 1a } condition: uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and 5 of them } rule DITEKSHEN_MALWARE_Win_Nppspy : FILE { meta: description = "Detects NPPSpy / Ntospy" author = "ditekShen" id = "3867ba96-1162-5693-b58e-fc6fa04d880a" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11305-L11325" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "53e929b52dddd5e3d060d2dd9937411f1ff215be4d3c67f5935c2a3fbab006d6" score = 75 quality = 75 tags = "FILE" strings: $s1 = "ntskrnl.dll" fullword ascii $s2 = "PasswordStealing.dll" fullword ascii $s3 = "ntoskrnl.dll" fullword ascii $s4 = "\\programdata\\packag~" ascii $s5 = "NPPSPY.dll" fullword ascii $s6 = "MSControll.dll" fullword ascii $s7 = "\\Windows\\Temp\\" ascii $s8 = "\\NPPSpy\\" ascii $s9 = "NPGetCaps" fullword ascii $s10 = "NPLogonNotify" fullword ascii $path = "\\GrzegorzTworek\\" ascii condition: uint16( 0 ) == 0x5a4d and ( ( pe.is_dll ( ) and filesize < 110KB and pe.number_of_exports == 2 and ( ( pe.exports ( "NPGetCaps" ) and pe.exports ( "NPLogonNotify" ) ) or ( 1 of ( $s* ) and ( pe.exports ( "NPGetCaps" ) or pe.exports ( "NPLogonNotify" ) ) ) ) ) or ( ( $path ) and any of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Agentracoon : FILE { meta: description = "Detects AgentRacoon. Not Raccoon" author = "ditekShen" id = "cc31bd71-da96-5a3d-b2f1-40f9745d8d46" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11327-L11343" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "7ed17a1bc161855f2bdc432952086f3b86b58ae9ea6c0d541544f4b63a8e08e8" score = 75 quality = 75 tags = "FILE" strings: $s1 = "UdpClient" fullword ascii $s2 = "IPEndPoint" fullword ascii $s3 = "get_Client" fullword ascii $s4 = "set_ReceiveTimeout" fullword ascii $s5 = "Command failed:" wide $s6 = "uploaded" wide $s7 = "downloaded" wide $s8 = ".telemetry." wide $s9 = "xn--" wide condition: uint16( 0 ) == 0x5a4d and 7 of them } rule DITEKSHEN_MALWARE_Win_Simda : FILE { meta: description = "Detects Simda / Shifu infostealer" author = "ditekShen" id = "892a5ffe-ea1a-5df3-9c36-0198fa61b8b6" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11345-L11361" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "3f06e86033e8f9534f9904a2a63c4717a9532eb235f6f4405ef1db7d9b93f036" score = 75 quality = 75 tags = "FILE" strings: $s1 = "command=auth_loginByPassword&back_command=&back_custom1=&" fullword ascii $s2 = "iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clma" ascii $s3 = "debug_%s_%s.log" fullword ascii $s4 = "Content-Disposition: form-data; name=\"file\"; filename=\"report\"" ascii $s5 = "name=%s&port=%u" ascii $s6 = "id=%s&ver=4.0.1&up=%u&os=%03u&rights=%s<ime=%s%d&token=%d" ascii $s7 = "{BotVer:" fullword ascii $s8 = "software\\microsoft\\windows nt\\currentversion\\winlogon" ascii $s9 = /(!|&|data_)inject(=ok)?/ fullword ascii condition: uint16( 0 ) == 0x5a4d and 6 of them } rule DITEKSHEN_MALWARE_Win_Vbsdownloader : FILE { meta: description = "Detects second stage VBS downloader of third stage VBS" author = "ditekShen" id = "480e6872-3a8c-58c5-a455-02342ec7918c" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11363-L11375" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "fee9a78e60d02ff2f03035812af2bf36fe350c70d3e4e094713791833f8ba4d6" score = 75 quality = 75 tags = "FILE" strings: $s1 = "CreateObject(\"MSXML2.ServerXMLHTTP\")" wide $s2 = ".Open \"GET\"," wide $s3 = ".Send" wide $s4 = ".responseText" wide $s5 = "ExecuteGlobal" wide condition: filesize < 50KB and all of them } rule DITEKSHEN_MALWARE_Win_Umbralstealer : FILE { meta: description = "Detects Umbral infostealer" author = "ditekShen" id = "695a350b-3d8e-5244-a275-a60202a8e956" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11377-L11398" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "1686e4626e4d6335f028d6cb6471c32dac747a77fc95d97b4c9dfd043ba975e9" score = 75 quality = 75 tags = "FILE" strings: $x1 = "Umbral Stealer" wide $x2 = "Umbral.payload." ascii $s1 = "U2V0LU1wUHJlZmVyZW5jZ" wide $s2 = "{{ Key = {0}, Value = {1} }}" wide $s3 = "csproduct get uuid" wide $s4 = "0.0.0.0 www." $s5 = /(set|get)_Take(Screen|WebcamSnap)shot/ fullword ascii $s6 = "still_pin" fullword ascii $c1 = "kaspersky.com" wide $c2 = "bitdefender.com" wide $c3 = "virustotal.com" wide $c4 = "malwarebytes.com" wide $c5 = "clamav.net" wide $c6 = "trendmicro.com" wide condition: uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or 5 of ( $s* ) or ( 3 of ( $s* ) and 4 of ( $c* ) ) ) } rule DITEKSHEN_MALWARE_Win_Metastealer : FILE { meta: description = "Detects MetaStealer infostealer" author = "ditekSHen" id = "46aa30c1-12c2-56df-8c65-0b96147f9051" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11400-L11423" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "260c6d90a89ddb6219a5cbad18058e41611ae2dc68a8d4e589fa6ca81853752f" score = 75 quality = 75 tags = "FILE" strings: $s1 = "! #\"'&(&*)>=@?POQOROSOTOUOVOWOXOYOZO[O^]{z|z}z~z" fullword wide $s2 = "{0}{1}{2}" fullword wide $s3 = "localhost" fullword wide $s4 = "\\tdata" fullword wide $s5 = "DecryptBlob" fullword ascii $s6 = "GetMac" fullword ascii $s7 = "GetHdc" fullword ascii $s8 = "FindProc" fullword ascii $s9 = "targetPid" fullword ascii $s10 = "MessageSecurityOverTcp" fullword ascii $s11 = "ListOfProcesses" fullword ascii $s12 = "ListOfPrograms" fullword ascii $s13 = "browserPaths" fullword ascii $s14 = "configs" fullword ascii $s15 = "scanners" fullword ascii $s16 = "FileScannerRule" fullword ascii condition: uint16( 0 ) == 0x5a4d and 7 of ( $s* ) } rule DITEKSHEN_MALWARE_Win_Mediapi : FILE { meta: description = "Detects MediaPI" author = "ditekSHen" id = "95db8772-1bcd-5eea-956c-c9578b8e1329" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11425-L11439" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "2bce0a96b45e46c0cbd913dacb3dfe7ae1b519102d637e0fd9dabe2008037d94" score = 75 quality = 75 tags = "FILE" strings: $s1 = "SomeFunction" ascii $s2 = "\"stealth" ascii $s3 = "\"ServAddr" ascii $s4 = "\"ServPort" ascii $s5 = "\"ServIp" ascii $s6 = "\"wsaData" ascii $s7 = "\"-socket" ascii condition: uint16( 0 ) == 0x5a4d and pe.is_dll ( ) and ( ( 6 of them ) or ( 3 of them and pe.exports ( "SomeFunction" ) ) ) } rule DITEKSHEN_MALWARE_Win_Blackhunt : FILE { meta: description = "Detects BlackHunt ransomware" author = "ditekSHen" id = "4bdb26dd-a424-54a6-b313-e98bdf18cfce" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11441-L11456" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "62e9bc505eff3e19ff0cdaf180e45e6d7917f0bec7cd9b007bee9fe1d9d09b66" score = 75 quality = 75 tags = "FILE" strings: $s1 = /#BlackHunt_(Logs|BG|Icon|Public|Private|ID|ReadMe|Update)\.(txt|jpg|ico|key|hta)/ ascii wide $s2 = /-(biggame|noencrypt|netinfo|nospread)/ fullword wide $s3 = "/v \"*BlackHunt\" /t REG_SZ /d" wide $s4 = "/sc onstart /TN \"Windows Critical Update\" /TR \"'%s' %s\" /F" wide $s5 = "/v \"DisableChangePassword\" /t REG_DWORD /d" wide $s6 = " %s this ID ( %s )" wide $s7 = "}div.header h1 span#hunter" wide $s8 = "BLACK_HUNT_MUTEX" fullword ascii condition: uint16( 0 ) == 0x5a4d and 4 of them } rule DITEKSHEN_MALWARE_Win_Houdiniconfig : FILE { meta: description = "Detects Houdini Trojan configurations" author = "ditekshen" id = "e4f974fe-731e-55a8-aa5f-068a1e62f54d" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/back-in-2017" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11600-L11616" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "70a67c9a91d2f82184f1d7a5ea51de911a054dd4e38e2cc36f495ed59219afab" score = 75 quality = 75 tags = "FILE" strings: $s1 = "install_name=" $s2 = "nick_name=" $s3 = "install_folder=" $s4 = "reg_startup=" $s5 = "startup_folder_startup=" $s6 = "task_startup=" $s7 = "injection=" $s8 = "injection_process" condition: ( uint16( 0 ) == 0x5a4d and 5 of them ) or ( all of them ) } rule DITEKSHEN_MALWARE_Win_Lighthand : FILE { meta: description = "Detects LightHand" author = "ditekshen" id = "2b644dfb-f09a-50a5-8260-7b7022bce1f4" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11691-L11718" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "4f06467a522b786045839e6b22b888cecc554b0f63cc20dc43dc0f8ec80f5654" score = 75 quality = 75 tags = "FILE" strings: $x1 = "27.102." ascii $x2 = "109.248.150.179" fullword ascii $s1 = /Hello (Client|Server)/ fullword ascii $s2 = "%s|%s|%s|%s|%s|%s|" fullword wide $s3 = "%s\\cmd.exe" fullword wide $s4 = "Remote PC" fullword wide $s5 = { 2e 62 61 74 [3-4] 3a 4c 31 0d 0a 64 65 6c 20 2f 46 20 22 25 73 22 0d 0a 69 66 20 65 78 69 73 74 20 22 25 73 22 20 67 6f 74 6f 20 4c 31 0d 0a 64 65 6c 20 2f 46 20 22 25 73 22 0d 0a 00 00 6f 70 65 6e } $s6 = { 25 00 2e 00 32 00 66 00 47 00 42 00 00 00 00 00 25 00 73 00 7c 00 25 00 73 00 7c 00 25 00 73 00 0a 00 00 00 00 00 00 00 5c 00 2a 00 2e 00 2a 00 00 00 00 00 0a 00 00 00 2e 00 00 00 2e 00 2e 00 00 00 00 00 00 00 00 00 46 00 6f 00 6c 00 64 00 65 00 72 00 00 00 00 00 25 00 73 00 5c 00 25 00 73 00 00 00 00 00 00 00 25 00 64 00 42 00 00 00 25 00 2e 00 31 00 66 00 4b 00 42 00 00 00 00 00 25 00 2e 00 31 00 66 00 4d 00 42 } condition: uint16( 0 ) == 0x5a4d and ( ( 5 of ( $s* ) ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Validalpha : FILE { meta: description = "Detects ValidApha / BlackRAT" author = "ditekshen" id = "3162eb5f-6e2d-598a-b199-22b70ec8a773" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11720-L11736" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "54d170076d1b32cee6f6252d40548acc7e23b467d692c59d6146a8aadf431211" score = 75 quality = 75 tags = "FILE" strings: $x1 = "RAT/Black/" ascii $x2 = "RAT/Black/Client_Go/" ascii $s1 = "main.RunTask" fullword ascii $s2 = "main.CmdShell" fullword ascii $s3 = "main.SelfDelete" fullword ascii $s4 = "main.RecvPacket" fullword ascii $s5 = "main.FileDownload" fullword ascii $s6 = "main.CaptureScreen" fullword ascii $s7 = "main.PeekNamedPipe" fullword ascii condition: uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or ( 6 of ( $s* ) ) ) } rule DITEKSHEN_MALWARE_Win_Tigerrat : FILE { meta: description = "Detects TigerRAT" author = "ditekshen" id = "37192fc8-1932-5f33-994a-bb319b131c58" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11738-L11756" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "38a238339db7e7f573e0c7362af5a08654a9e134f902c0ecae441250a0364c64" score = 75 quality = 75 tags = "FILE" strings: $m0 = ".?AVCryptorRC4@@" fullword ascii $m1 = ".?AVModuleShell@@" fullword ascii $m2 = ".?AVModuleKeyLogger@@" fullword ascii $m3 = ".?AVModuleSocksTunnel@@" fullword ascii $m4 = ".?AVModuleScreenCapture@@" fullword ascii $m5 = ".?AVModulePortForwarder@@" fullword ascii $s1 = "\\x9891-009942-xnopcopie.dat" fullword wide $s2 = "(%02d : %02d-%02d %02d:%02d:%02d)--- %s[Clipboard]" fullword ascii $s3 = "[%02d : %02d-%02d %02d:%02d:%02d]--- %s[Title]" fullword ascii $s4 = "~KPTEMP" fullword wide $s5 = "del \"%s\"%s \"%s\" goto " ascii condition: uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) ) or ( 5 of ( $m* ) ) or ( 3 of ( $m* ) and 2 of ( $s* ) ) or ( 5 of them ) ) } rule DITEKSHEN_MALWARE_Win_Ktlvdoor : FILE { meta: description = "Detects KTLVdoor" author = "ditekshen" id = "f63ebd05-fb4b-50fb-887b-dacd379594a4" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11758-L11791" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "3ced9b558c7e17acd015cd2c9dd0c5d024bf9c31c7f2e7c9b7b937124109cf8b" score = 75 quality = 73 tags = "FILE" strings: $s1 = "/cmd/acc/agent_acc" ascii $s2 = "main.DLLWMain" ascii $s3 = "main.checkSilent" ascii $h1 = ".handleInteractiveShell" ascii $h2 = ".handleNetstat" ascii $h3 = ".handleProcess" ascii $h4 = ".handleRefreshHostInfo" ascii $h5 = ".handleTimestomp" ascii $h6 = ".handleSoInject" ascii $h7 = ".HandleRegInfo" ascii $h8 = ".handlePortscan" ascii $h9 = ".handleReflectDllInject" ascii $h10 = ".handleFileDownload" ascii $f1 = ".RdpWithNTLM." ascii $f2 = ".FingerPrintOs." ascii $f3 = ".ScanWMI." ascii $f4 = ".ScanWinRM." ascii $f5 = ".ScanWeb." ascii $f6 = ".ScanSmb2." ascii $f7 = ".ScanRDP." ascii $f8 = ".ScanPing." ascii $f9 = ".ScanOxid." ascii $f10 = ".ScanMssql." ascii $f11 = ".ScanBanner." ascii $fr1 = /\.proxy[CS]2[CS](TC|UD)P/ ascii $fr2 = /\.Scan(WMI|WinRM|Web|Smb2|RDP|Ping|Oxid|Mssql|Banner)\./ ascii condition: ( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and ( ( 6 of ( $h* ) ) or ( 12 of ( $f* ) ) or ( 2 of ( $h* ) and 4 of ( $f* ) ) or ( 1 of ( $s* ) and ( 4 of ( $h* ) or 4 of ( $f* ) ) ) or ( 13 of them ) ) } rule DITEKSHEN_MALWARE_Win_Fakecaptcha_Downloader : FILE { meta: description = "Detects downloader executables dropped by fake captcha" author = "ditekshen" id = "d577e8ef-11df-565c-9925-63b8768a7115" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11793-L11803" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "57c39ce93f74d03767e7fde53281983a8462e4f3705d1bb9084bc169a08a0f83" score = 75 quality = 75 tags = "FILE" strings: $s1 = "MZ" ascii $s2 = "window.close();" ascii $s3 = "eval(" ascii condition: uint16( 0 ) == 0x5a4d and all of them } rule DITEKSHEN_MALWARE_Win_Xenorat : FILE { meta: description = "Detects Blacksuit" author = "ditekshen" id = "7f27ebef-8a0e-591a-a926-ac950db86053" date = "2020-11-06" modified = "2024-11-01" reference = "https://github.com/ditekshen/detection" source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11805-L11820" license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt" logic_hash = "487046464f545fb9e4a1d6e277cdc010eac6886583f0b388555a483d9021191b" score = 75 quality = 75 tags = "FILE" strings: $x1 = "xeno rat client" wide $x2 = "xeno_rat_client." ascii $x3 = "xeno rat client" ascii $s1 = "+" ascii $s2 = "+" ascii $s3 = "+" ascii $s4 = "+ 50 or #opc_x86 > 50 ) } rule WITHSECURELABS_Ducktail_Artifacts : FILE { meta: description = "Detects artifacts found in files associated to DUCKTAIL malware" author = "WithSecure" id = "937c9688-b74f-5e02-838f-ab6757a8d2a1" date = "2022-07-18" modified = "2022-07-26" reference = "https://labs.withsecure.com/publications/ducktail" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/DUCKTAIL/ducktail_artifacts.yar#L1-L20" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" hash = "3dbd9e1c3d0fd6358d4adcba04fdfc0b6e8acc49" hash = "9370243589327b458486e3f7637779c2a96b4250" hash = "b98170b18b906aee771dbd4dbd31e5963a90a50e" logic_hash = "1daa5e654058c802826b6a306b5bfc9d0c05c4ee54607e94e618a8d409ce74d9" score = 75 quality = 75 tags = "FILE" version = "1.0" strings: $pdb_path_1 = /[a-z]\:\\projects\\(viruttest|virot)\\/i nocase ascii $pdb_path_2 = /[a-z]\:\\users\\ductai\\/i nocase ascii $pdb_path_3 = "\\dataextractor.pdb" nocase ascii $email = "ductai2308@gmail.com" wide ascii condition: uint16( 0 ) == 0x5A4D and any of them } rule WITHSECURELABS_Ducktail_Nativeaot : FILE { meta: description = "Detects NativeAOT variants of DUCKTAIL malware" author = "WithSecure" id = "1961d3e1-987b-588b-bfc2-8239797cd049" date = "2022-11-17" modified = "2022-11-22" reference = "https://labs.withsecure.com/publications/ducktail_returns" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/DUCKTAIL/ducktail_nativeaot.yara#L2-L22" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" hash = "b043e4639f89459cae85161e6fbf73b22470979e" hash = "073b092bf949c31628ee20f7458067bbb05fda3a" hash = "d1f6b5f9718a2fe9eaac0c1a627228d3f3b86f87" logic_hash = "976b28ac45e5a13d4ce900b857e6bd3afc82b65b0235791fd698b762287cd60e" score = 75 quality = 75 tags = "FILE" version = "1.0" condition: uint16( 0 ) == 0x5A4D and filesize > 15MB and ( pe.section_index ( ".managed" ) >= 0 or pe.exports ( "DotNetRuntimeDebugHeader" ) ) and pe.exports ( "SendFile" ) and pe.exports ( "Start" ) and pe.exports ( "Open" ) } rule WITHSECURELABS_Andariel_Undercrypt { meta: description = "Detects UnderCrypt samples based on shared code portions" author = "WithSecure" id = "840d250f-7ad5-53df-aad9-20d405bf81bf" date = "2026-01-22" modified = "2026-01-22" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/Andariel2025/andariel.yara#L40-L53" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "38ae107a8eeea3d54c34fa62fb8e8eb133489fc90337920c14319a2e7b51603a" score = 75 quality = 75 tags = "" strings: $1 = {C0746F4C8BDE498D1C024D2B5D304C3BD3735FBF00F0000041BE00A0000041833A00744E458B42044D8D4A084983E80849D1E84585C0742E90410FB71141FFC8} $2 = {00448B461C448B4E244C03C2448B56204C03CA4C03D2F7C50000FFFF752B8B4E100FB7D53BD17213034E143BD1730C0FB7C5418B1C804903DBEB6433C04881C4} $6 = {119C4000C04FA30A3E23672FCB3AABD2119C4000C04FA30A3E9EDB32D3B3B925418207A14884F532168D1880928E0E6748B30C7FA83884E8DED2D139BD2FBA6A4889B0B4B0CB466891DC96F605292B6336AD8BC4389CF2A7132205931904000000} $7 = {647265488D5424204863403C448BC366C744242C7373885C242E428B8C10880000004903CA448B49208B79244D03CA8B711C4903FA448B59144903F24585DB7441418B01B1474903C23A08750E0FB64A0148FFC248FFC084C975EE0FB608380A741341FFC0488D5424204983C104453BC3} $8 = {4C8BD0C745E04765745033D2C745E4726F63418BFA8855EE4863403C448BC2C745E864647265488D55E066C745EC7373428B8C10880000004903CA448B4920448B69244D03CA8B411C4D03EA448B59144903C2488945484585DB744C660F1F440000418B01B1474903C23A08750E0FB64A0148FFC248FF} condition: any of them } rule WITHSECURELABS_Andariel_Undercrypt_Versioninfo { meta: description = "Detects UnderCrypt samples based on version info" author = "WithSecure" id = "03ed3929-12e9-5a8f-bdef-394396679a19" date = "2026-01-22" modified = "2026-01-22" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/Andariel2025/andariel.yara#L54-L67" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "2d87246f89128a97136c021653211109d44dc9c75be747e58c7d09ebdac092ed" score = 75 quality = 75 tags = "" condition: (pe.version_info [ "ProductName" ] == "Microsoft@Windows@OperatingSystem" ) or ( pe.version_info [ "InternalName" ] contains "_crypted." and pe.version_info [ "FileVersion" ] contains "10.0.19041.1" ) } rule WITHSECURELABS_Andariel_Starshellrat { meta: description = "Detects StarshellRAT samples" author = "WithSecure" id = "ecc377fd-2754-5f6a-a26b-c6c12b9e18c8" date = "2026-01-22" modified = "2026-01-22" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/Andariel2025/andariel.yara#L68-L85" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "b210ab8790710a8d53a0775550d94e0604dd80c4681a90dcd093ec8ceccc6da5" score = 75 quality = 75 tags = "" strings: $str1 = "StarShell" ascii $str2 = "ReadRlt" ascii $str3 = "SendRlt" ascii $str4 = "ProcessShell" ascii $str5 = "Screan ok" wide $str6 = "<==>" wide $str7 = "\\r\\nStarted..." wide $str8 = "\\r\\nDownload End." wide $str9 = "\\r\\nupload end" wide condition: pe.is_pe and 3 of them } rule WITHSECURELABS_Andariel_Gopherrat { meta: description = "Detects GopherRAT samples" author = "WithSecure" id = "88627e61-43fa-5d5b-94f3-77d540131f90" date = "2026-01-22" modified = "2026-01-22" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/Andariel2025/andariel.yara#L86-L105" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "2a42590be19b4b9a258c63f683c724165d64cc7bf22e4b7e7dec3ff73ea9175c" score = 75 quality = 75 tags = "" strings: $cmdName1 = "GetMACHashID" $cmdName2 = "startHeartbeat" $cmdName3 = "encodeTo949" $cmdName4 = "xorDecrypt" $cmdName5 = "StartShell" $cmdName6 = "getLogicalDrives" $cmdName7 = "sendSocksCommand" $xorKey = {357095A221F033AC} condition: pe.is_pe and ( 3 of ( $cmdName* ) or $xorKey ) } rule WITHSECURELABS_Andariel_Portscanner_Versioninfo { meta: description = "Detects custom port scanner based on file version info" author = "WithSecure" id = "ffa12319-188e-5050-86b9-6c80575548df" date = "2026-01-22" modified = "2026-01-22" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/Andariel2025/andariel.yara#L106-L114" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "b7be7cbaeb686c55425695ee324b87c6e01c46c9850cf160025cb5dd8ce7ea1f" score = 75 quality = 75 tags = "" condition: pe.version_info[ "InternalName" ] == "PortScan.exe" and pe.version_info [ "ProductName" ] == "Chrome" } rule WITHSECURELABS_Andariel_EDR_KILLER_Script { meta: description = "Detects strings found in EDR killer batch script" author = "WithSecure" id = "72228388-7d17-5a61-97ad-eb7f0e701ce4" date = "2026-01-22" modified = "2026-01-22" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/Andariel2025/andariel.yara#L115-L124" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "c26618981d6fafd81cfbae6ad302e8e742fa6fb97589f26ea811c910904960a6" score = 75 quality = 75 tags = "" strings: $a1 = "PageSvc" ascii $a2 = "page.sys" ascii condition: all of them } rule WITHSECURELABS_Andariel_Jelusrat_PDB : FILE { meta: description = "Detects JelusRAT packer and payload samples via PDB path" author = "WithSecure" id = "1820e77e-818a-5de5-8483-84ec9448a58f" date = "2026-01-22" modified = "2026-01-22" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/Andariel2025/andariel.yara#L125-L141" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "a14d808ff783b7c42f3e4600386d578d63c88a0cd7c492cb1a026e0580b551f3" score = 75 quality = 75 tags = "FILE" strings: $str_pdb = /jelus *rat[\x20-\x7F]{0,100}\.pdb\x00/ nocase condition: filesize <= 16MB and uint16( 0 ) == 0x5A4D and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them } rule WITHSECURELABS_Andariel_Jelusrat_Plugin { meta: description = "Detects JelusRAT plugins" author = "WithSecure" id = "0ac026fa-ce23-5473-ac70-e08d70743b48" date = "2026-01-22" modified = "2026-01-22" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/Andariel2025/andariel.yara#L142-L152" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "4006238e639232a6f01db518fa666ae23600cbfb19746bddad991ac04011a87b" score = 75 quality = 75 tags = "" condition: pe.exports( "testPlugin" ) and pe.exports ( "beginPlugin" ) and pe.exports ( "endPlugin" ) and pe.exports ( "processCommand" ) } rule WITHSECURELABS_DAYLIGHT { meta: description = "Detects common strings found across samples obfuscated with DAYLIGHT" author = "WithSecure" id = "bbd4aad0-a156-5692-9b4a-ebdb5143a2bf" date = "2026-05-28" modified = "2026-05-28" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/GREYVIBE/greyvibe.yara#L1-L11" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "bc16cbe538d2d4bba7ec3332b525d79e74ab9dec8f545e5f12720e185b24d3dd" score = 75 quality = 73 tags = "" strings: $a = "$encryptedstream, $keystream" nocase ascii wide $b = "Daylight savings time is active" ascii wide condition: any of them } rule WITHSECURELABS_TEASOUP { meta: description = "Detects common strings found across samples obfuscated with TEASOUP" author = "WithSecure" id = "b983f58c-7d53-51d4-b574-1feb8719c2ac" date = "2026-05-28" modified = "2026-05-28" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/GREYVIBE/greyvibe.yara#L13-L24" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "357e3d23dac84db54b65ff1727e89eb1dab6e0d06461ebd8368d265c3d1f88bd" score = 75 quality = 75 tags = "" strings: $a = "s += String.fromCharCode(charCode)" ascii wide $b = "var ts = arr[i]" ascii wide $c = "System Maintenance Script" ascii wide condition: 2 of ( $* ) } rule WITHSECURELABS_LOOKVALPS { meta: description = "Detects common strings found across samples obfuscated with LOOKVALPS" author = "WithSecure" id = "9dec92aa-123c-5c32-beb6-308b8c936ca4" date = "2026-05-28" modified = "2026-05-28" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/GREYVIBE/greyvibe.yara#L26-L36" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "ef694f6fee59578d9ccd909ca506771ec5cda94a64232895558cc141a09cf6e3" score = 75 quality = 75 tags = "" strings: $a = "currentValue = $LookupTable" ascii wide $b = "foreach($b in $data){$d+=[char]($b -bxor $key)}" ascii wide condition: any of them } rule WITHSECURELABS_LOOKVALJS { meta: description = "Detects a common string found across samples obfuscated with LOOKVALJS" author = "WithSecure" id = "35168369-c940-51ed-b1e2-a29c68bf4fec" date = "2026-05-28" modified = "2026-05-28" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/GREYVIBE/greyvibe.yara#L38-L47" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "4714815c64a6ba989d4d7554d3ac39702d067fd7299460a6db80dbd3e4b3abff" score = 75 quality = 75 tags = "" strings: $a = "currentValue = lookupTable" ascii wide condition: all of them } rule WITHSECURELABS_GREYVIBE_JSLOADER_1 { meta: description = "Detects common strings found across one of GREYVIBE's loaders (observed across PrincessClub and PhantomMail campaigns)" author = "WithSecure" id = "f6cb348d-7d82-5514-9059-3679aa979aee" date = "2026-05-28" modified = "2026-05-28" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/GREYVIBE/greyvibe.yara#L49-L59" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "e00567601c35f15985e97cb37b272ecf6fbf928b78c192123f418810b0061a8e" score = 75 quality = 75 tags = "" strings: $a = "wmizzzz" $b = "runzzzz" condition: all of them } rule WITHSECURELABS_GREYVIBE_JSLOADER_2 { meta: description = "Detects common strings found across one of GREYVIBE's loaders (observed in PhantomMail campaign)" author = "WithSecure" id = "9901d2df-6539-51c6-a24d-c06a7e898a6a" date = "2026-05-28" modified = "2026-05-28" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/GREYVIBE/greyvibe.yara#L61-L73" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "c6fc0969bb62de731e9770447df565e427b03c69851708a0a30a4da20f176236" score = 75 quality = 75 tags = "" strings: $a = "// String Reconstruction" $b = "Math.cos" $c = "Math.sin" $d = ".join(\"\")" condition: all of them } rule WITHSECURELABS_Phantomrelay_Fingerprint { meta: description = "Detects PhantomRelay's fingerprinting script" author = "WithSecure" id = "b7191fdf-f270-5949-bb54-a5dea2a6e2a0" date = "2026-05-28" modified = "2026-05-28" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/GREYVIBE/greyvibe.yara#L75-L89" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "88e2cf9106731fe9e7e76ed00a09e81828029e68e0e40ca58c8efad93e9e16b5" score = 75 quality = 75 tags = "" target_entity = "file" strings: $a1 = "$env:COMPUTERNAME" $a2 = "$env:USERNAME" $a3 = "$PID" $a4 = "Win32_Computer" $user_agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/534.36 (KHTML, like Gecko) Chrome/95.4.4476.124 Safari/537.36" condition: all of them } rule WITHSECURELABS_GREYVIBE_Phantomrelay_Watchdog : FILE { meta: description = "Detects GREYVIBE's watchdog script for PhantomRelay" author = "WithSecure" id = "c59eef2e-22c8-5df2-aa81-111cce4d20c8" date = "2026-05-28" modified = "2026-05-28" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/GREYVIBE/greyvibe.yara#L91-L103" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "19d5fdaf2e2c98637971427761e316fd405a0f6d8e7f539dc9f72d20313ba43c" score = 75 quality = 75 tags = "FILE" strings: $a1 = "--headless" $a2 = "/watchdog" $a3 = "Register-ScheduledTask" $a4 = "DownloadFile" condition: filesize < 50KB and all of them } rule WITHSECURELABS_Legionrelay_Client { meta: description = "Detects LegionRelay client script" author = "WithSecure" id = "ec6b7aae-414d-5e54-9fc0-6826c7e9e1b8" date = "2026-05-28" modified = "2026-05-28" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/GREYVIBE/greyvibe.yara#L105-L119" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "ba3fff2de891e880884434150f7a6331356a234ad0b2bc572e158a9b7ac03c0c" score = 75 quality = 75 tags = "" strings: $a1 = "powershell_ise" $a2 = "pwsh" $a3 = "/status" $a4 = "/commands?client_id=" $a5 = "[^\\w\\-]" $a6 = "client_config.json" condition: all of them } rule WITHSECURELABS_Fallspy { meta: description = "Detects FallSpy Android malware" author = "WithSecure" id = "8d0823be-3a64-5e2d-995c-0b2fccf77a98" date = "2026-05-28" modified = "2026-05-28" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/GREYVIBE/greyvibe.yara#L121-L139" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "29575182e5399930764cdc33d1a62d020618ad630a01d4f503a38a241069fe4d" score = 75 quality = 75 tags = "" strings: $a = "DataCollectorWork" fullword $b = "UpdateChecker" fullword $c = "/check_update?version=" $e = "&call_logs=" fullword $f = "&sim_numbers=" fullword $g = "&wifi_ssid=" fullword $h = "Public IP: " fullword $i = "uploaded_hashes" fullword $n = "Android ID: " fullword $o = "Call Logs: " fullword condition: 4 of them } rule WITHSECURELABS_Phantomrelay_Client : FILE { meta: description = "Detects PhantomRelay client script" author = "WithSecure" id = "d65c65a3-beab-51cd-8700-1204ce40791e" date = "2026-05-28" modified = "2026-05-28" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/GREYVIBE/greyvibe.yara#L141-L153" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "3d5ad744d1689b71604d55ec75a971f1a1f89c3f030c069a5ea205e4a3e4fac4" score = 75 quality = 75 tags = "FILE" strings: $a = ".idc" $b = ".cmd" $c = ".psh" $d = "WebSockets.ClientWebSocket" condition: filesize < 100KB and all of them } rule WITHSECURELABS_Fake_Vpn_Client_Hta { meta: description = "Detects HTA files masqeurading as fake VPN clients" author = "WithSecure" id = "8c8da6db-edde-5a34-8fe8-7ad7887e7078" date = "2026-08-26" modified = "2026-08-26" reference = "https://github.com/WithSecureLabs/iocs" source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/Initial_Access_SEO_Poisoning/fake_vpn_client_hta.yara#L1-L12" license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE" logic_hash = "1dfcaabcd99b0ca271e27d4302f1287f0a59619ef9996f078c867e4f442be8c7" score = 75 quality = 75 tags = "" target_entity = "file" strings: $a = "yes-hta-2025" $b = "X-From-HTA" condition: any of them } /* * YARA Rule Set * Repository Name: LOLDrivers * Repository: https://github.com/magicsword-io/LOLDrivers/ * Retrieval Date: 2026-10-26 * Git Commit: 96a491d410f849fd392762c83cea8ccbe81a5bff * Number of Rules: 49 * Skipped: 0 (age), 0 (quality), 744 (score), 0 (importance) * * * LICENSE * * Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ rule LOLDRIVERS_MAL_Driver_501E { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kernel_utility_driver64.sys, kernel_utility_driver32.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "74880e73-3ec7-502d-adbc-3a64bf14a8cd" date = "2026-08-28" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1-L16" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "501ea082774f29adc752887402af6df0edf49bf7b3816b93f6e52c06a79685bc" hash = "962fb670510807fd5cab3a6e6f886aeb2b925c42054c29fa02f67011be935954" logic_hash = "24ba91a218e2dd4c2b02a88f522d7bc72864f1be574abd403e6a457c32e6cbc9" score = 70 quality = 80 tags = "" strings: $ = { 460069006c006500560065007200730069006f006e00[1-8]31002c0035003000320036002c0031003000300030002c00310032003700 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]31002c0035003000320036002c0031003000300030002c00310032003700 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]48724367406209672000280043002900200032003000310030002d003200300032003600 } condition: all of them } rule LOLDRIVERS_MAL_Driver_773B { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "6349b7fd-2ba4-5011-a2a3-cb5d13c3992e" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L18-L33" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "773b4a1efb9932dd5116c93d06681990759343dfe13c0858d09245bc610d5894" logic_hash = "5906a3c80fce46b8a546449ada8c70dfdfdfedcd516543c6584fb1c715be240a" score = 70 quality = 80 tags = "" strings: $ = { 460069006c006500560065007200730069006f006e00[1-8]32002e0031002e0031002e003000 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002e0031002e0031002e003000 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310037002000 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Basil_Windivertsys_Windivertdriver_2F43 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - windivert.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "41f45e37-6102-5758-ad31-15f67bf89e48" date = "2026-04-28" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L35-L56" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "2f43f4251be4d72dd56c91bf6cce475d379eb9ba6c4dda2be3022ea633d5e807" hash = "8248306bcc5fae20fd4f3d5c44f962c85cddbe020b34a1799350ce2034154b7d" hash = "8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2" logic_hash = "66efc4d061d40083963cbe1bf76b56a47ae888c33fba653e9bca0e0a9275b79d" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]5400680065002000570069006e00440069007600650072007400200032002e003200200064007200690076006500720020005b00550052004c003a002000680074007400700073003a002f002f0072006500710072007900700074002e006f00720067002f00770069006e006400690076006500720074002e00680074006d006c005d0020005b0042006900740063006f0069006e003a00200031004300350076005a0056005300620069007a00500065005a00380079006400540059006800550066006d0034004c004100320063004e007700420066006300590068005d00 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]42006100730069006c00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]32002e003200 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002e003200 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]570069006e004400690076006500720074002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]570069006e00440069007600650072007400200032002e0032002000640072006900760065007200 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]570069006e004400690076006500720074002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f0070007900720069006700680074002000a900200042006100730069006c00200032003000310031002d003200300032003200 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Basil_Windivertsys_Windivertdriver_8DA0 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - windivert.sys" author = "Florian Roth" id = "b2c5b02b-7fe2-5dcc-8c96-c67212780220" date = "2025-09-18" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L58-L79" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2" hash = "2f43f4251be4d72dd56c91bf6cce475d379eb9ba6c4dda2be3022ea633d5e807" hash = "8248306bcc5fae20fd4f3d5c44f962c85cddbe020b34a1799350ce2034154b7d" logic_hash = "ec4c9f576f33bdb22610fb9f4462b7a6c113ad704b1f6908e949dc65dde28bd5" score = 70 quality = 80 tags = "" strings: $ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400680065002000570069006e00440069007600650072007400200032002e003200200064007200690076006500720020005b00550052004c003a002000680074007400700073003a002f002f0072006500710072007900700074002e006f00720067002f00770069006e006400690076006500720074002e00680074006d006c005d0020005b0042006900740063006f0069006e003a00200031004300350076005a0056005300620069007a00500065005a00380079006400540059006800550066006d0034004c004100320063004e007700420066006300590068005d } $ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0042006100730069006c } $ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032 } $ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032 } $ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069006e004400690076006500720074002e007300790073 } $ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00440069007600650072007400200032002e00320020006400720069007600650072 } $ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069006e004400690076006500720074002e007300790073 } $ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200042006100730069006c00200032003000310031002d0032003000320032 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Chingachgukdengerk_Vusbbussys_Virtualusbbusdriver_B4F3 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - driver_b4f33ffe.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "927f87b3-468e-52c5-8f82-d2ece75832e7" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L81-L101" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "b4f33ffef069c18e8a8834eb448dd1f1dbdaae93b140cfff5a1db015eb3ada2f" logic_hash = "178a4e8398ab6c663a1b6d1c810948a5efe1f9d97c2c9e2177d6763e0de3bc7d" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]5600690072007400750061006c00200055005300420020006200750073002000640072006900760065007200 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]4300680069006e006700610063006800670075006b00200026002000440065006e0067006500720032006b00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]30002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b00 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]30002e003100 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]76007500730062006200750073002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]5600690072007400750061006c00200055005300420020006200750073002000640072006900760065007200 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]76007500730062006200750073002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f0070007900720069006700680074002000280043002900320030003000340020004200790020004300680069006e006700610063006800670075006b00200026002000440065006e0067006500720032006b00 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Crowdstrikeinc_Csagentsys_Crowdstrikefalconsensor_06EC { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - changsha. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "38c7c76c-3c1f-57ae-a667-5e3296258417" date = "2026-04-28" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L103-L127" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "06eccd102c9105957773b32538943531d9c39d0a504ceb3b9b155e97e3b0b134" hash = "1e42c8cb410a7ed653cfe62bbd8cf191f31a47337fe1ffcc35232d03f2da05ef" hash = "6a2a0f9c56ee9bf7b62e1d4e1929d13046cd78a93d8c607fe4728cc5b1e8d050" hash = "94b87b1cdaf1d86c2bc4eacef45608d0f16fdd3b981b88cdddc16b6bc64fe25d" hash = "b2ff9ef50ae037bb003d7157ea8da008a48f715a78c644b5f027b070bf5eb049" hash = "efb642ad3fab4a2e6cb4de829b60e04dd0d9ae7c2b4cf544de28c38f978b4136" logic_hash = "28b611b6df72d855592b7ed4e35343cf033f6dbcab76fb190a53314c415dd6df" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]430072006f007700640053007400720069006b0065002000460061006c0063006f006e002000530065006e0073006f0072002000440072006900760065007200 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]430072006f007700640053007400720069006b0065002c00200049006e0063002e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]36002e00330034002e00310034003800300036002e003000 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]36002e00330034002e00310034003800300036002e003000 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]430053004100670065006e0074002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]430072006f007700640053007400720069006b0065002000460061006c0063006f006e002000530065006e0073006f007200 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]430053004100670065006e0074002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]2800630029002000430072006f007700640053007400720069006b0065002c00200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e00 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Crowdstrikeinc_Csagentsys_Crowdstrikefalconsensor_94B8 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - idmtdi.sys" author = "Florian Roth" id = "b3173c53-ef34-5722-8f49-dd596733c7fe" date = "2025-09-18" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L129-L152" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "94b87b1cdaf1d86c2bc4eacef45608d0f16fdd3b981b88cdddc16b6bc64fe25d" hash = "1e42c8cb410a7ed653cfe62bbd8cf191f31a47337fe1ffcc35232d03f2da05ef" hash = "6a2a0f9c56ee9bf7b62e1d4e1929d13046cd78a93d8c607fe4728cc5b1e8d050" hash = "efb642ad3fab4a2e6cb4de829b60e04dd0d9ae7c2b4cf544de28c38f978b4136" hash = "b2ff9ef50ae037bb003d7157ea8da008a48f715a78c644b5f027b070bf5eb049" logic_hash = "9376ab5835e07d117ee3d157713339c0ffeda2479cb8183dc82cfffcbb29971d" score = 70 quality = 80 tags = "" strings: $ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00430072006f007700640053007400720069006b0065002000460061006c0063006f006e002000530065006e0073006f00720020004400720069007600650072 } $ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430072006f007700640053007400720069006b0065002c00200049006e0063002e } $ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00330034002e00310034003800300036002e0030 } $ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00330034002e00310034003800300036002e0030 } $ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00430053004100670065006e0074002e007300790073 } $ = { 00500072006f0064007500630074004e0061006d0065[1-8]00430072006f007700640053007400720069006b0065002000460061006c0063006f006e002000530065006e0073006f0072 } $ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00430053004100670065006e0074002e007300790073 } $ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800630029002000430072006f007700640053007400720069006b0065002c00200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } condition: all of them } rule LOLDRIVERS_MAL_Driver_Dwadsafeloadsys_E112 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - driver_e1123b59.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "5fb37a6c-fc26-536a-bc2a-9ac7b78be53f" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L154-L174" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "e1123b59a801e243a64270d0c6ab1277e5e3afba9c19023807409f53c1b0204b" logic_hash = "163d4ccfa2d9d46ef55e9d6fc28f832e390996757322f50c91afca95ce57db4a" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]a25b3762ef7aa0527d8f719aa852 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]566e1753fe76517f517fdc7ed1798062096750966c51f853 } $ = { 460069006c006500560065007200730069006f006e00[1-8]32003000320032002e0031002e00310036002e003100300030003000 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32003000320032002e0031002e00310036002e003100300030003000 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]640077006100640073006100660065006c006f00610064002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]fe76517f3b4ea8523296a15ffb7cdf7e } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]640077006100640073006100660065006c006f00610064002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f007000790072006900670068007400200028004300290020003200300032003200 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_008F { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "e3793182-9875-566e-8237-70029c4e9072" date = "2026-04-28" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L176-L217" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "008fa89822b7a1f91e5843169083202ea580f7b06eb6d5cae091ba844d035f25" hash = "02ebf848fa618eba27065db366b15ee6629d98f551d20612ac38b9f655f37715" hash = "21617210249d2a35016e8ca6bd7a1edda25a12702a2294d56010ee8148637f5a" hash = "2ce4f8089b02017cbe86a5f25d6bc69dd8b6f5060c918a64a4123a5f3be1e878" hash = "40556dd9b79b755cc0b48d3d024ceb15bd2c0e04960062ab2a85cd7d4d1b724a" hash = "443c0ba980d4db9213b654a45248fd855855c1cc81d18812cae9d16729ff9a85" hash = "60ee78a2b070c830fabb54c6bde0d095dff8fad7f72aa719758b3c41c72c2aa9" hash = "6964a5d85639baee288555797992861232e75817f93028b50b8c6d34aa38b05b" hash = "7662187c236003308a7951c2f49c0768636c492f8935292d02f69e59b01d236d" hash = "8206ce9c42582ac980ff5d64f8e3e310bc2baa42d1a206dd831c6ab397fbd8fe" hash = "82ac05fefaa8c7ee622d11d1a378f1d255b647ab2f3200fd323cc374818a83f2" hash = "8b30b2dc36d5e8f1ffc7281352923773fb821cdf66eb6516f82c697a524b599b" hash = "a85d3fd59bb492a290552e5124bfe3f9e26a3086d69d42ccc44737b5a66673ec" hash = "aafa642ca3d906138150059eeddb6f6b4fe9ad90c6174386cfe13a13e8be47d9" hash = "b2486f9359c94d7473ad8331b87a9c17ca9ba6e4109fd26ce92dff01969eaa09" hash = "beef40f1b4ce0ff2ee5c264955e6b2a0de6fe4089307510378adc83fad77228b" hash = "c7cd14c71bcac5420872c3d825ff6d4be6a86f3d6a8a584f1a756541efff858e" hash = "d41e39215c2c1286e4cd3b1dc0948adefb161f22bc3a78756a027d41614ee4ff" hash = "d7aa8abdda8a68b8418e86bef50c19ef2f34bc66e7b139e43c2a99ab48c933be" hash = "e858de280bd72d7538386a73e579580a6d5edba87b66b3671dc180229368be19" hash = "e8743094f002239a8a9d6d7852c7852e0bb63cd411b007bd8c194bcba159ef15" hash = "ec96b15ce218f97ec1d8f07f13b052d274c4c8438f31daf246ccfaaee5e1bebd" hash = "fefc070a5f6a9c0415e1c6f44512a33e8d163024174b30a61423d00d1e8f9bf2" logic_hash = "6104e8d8ad41b46aeae1a0f557c175ab0ac05a76bc66f0142c8fea5216f3a3c2" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]6d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a002900 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } $ = { 460069006c006500560065007200730069006f006e00[1-8]32002e0031002e0031002e003000 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002e0031002e0031002e003000 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]6d0069006d006900640072007600 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]6d0069006d006900640072007600200028006d0069006d0069006b00610074007a002900 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]6d0069006d0069006400720076002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310037002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_06DD { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "df9d437b-b65c-54ac-a4f1-515bc9cc1f5a" date = "2026-04-28" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L219-L251" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "06ddf49ac8e06e6b83fccba1141c90ea01b65b7db592c54ffe8aa6d30a75c0b8" hash = "07759750fbb93c77b5c3957c642a9498fcff3946a5c69317db8d6be24098a4a0" hash = "087270d57f1626f29ba9c25750ca19838a869b73a1f71af50bdf37d6ff776212" hash = "0d676baac43d9e2d05b577d5e0c516fba250391ab0cb11232a4b17fd97a51e35" hash = "0f58e09651d48d2b1bcec7b9f7bb85a2d1a7b65f7a51db281fe0c4f058a48597" hash = "4dc24fd07f8fb854e685bc540359c59f177de5b91231cc44d6231e33c9e932b1" hash = "627e13da6a45006fff4711b14754f9ccfac9a5854d275da798a22f3a68dd1eaa" hash = "94ba4bcbdb55d6faf9f33642d0072109510f5c57e8c963d1a3eb4f9111f30112" hash = "a74e8f94d2c140646a8bb12e3e322c49a97bd1b8a2e4327863d3623f43d65c66" hash = "b169a5f643524d59330fafe6e3e328e2179fc5116ee6fae5d39581467d53ac03" hash = "baf7fbc4743a81eb5e4511023692b2dfdc32ba670ba3e4ed8c09db7a19bd82d3" hash = "bcca03ce1dd040e67eb71a7be0b75576316f0b6587b2058786fda8b6f0a5adfd" hash = "dfc80e0d468a2c115a902aa332a97e3d279b1fc3d32083e8cf9a4aadf3f54ad1" hash = "eab9b5b7e5fab1c2d7d44cd28f13ae8bb083d9362d2b930d43354a3dfd38e05a" logic_hash = "db9c07dc4ae315897e8011a73b9e8b56222acfac61ef9bd0b6b38ef7b0c01482" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]6d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a002900 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } $ = { 460069006c006500560065007200730069006f006e00[1-8]32002e0030002e0030002e003000 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002e0030002e0030002e003000 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]6d0069006d006900640072007600 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]6d0069006d006900640072007600200028006d0069006d0069006b00610074007a002900 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]6d0069006d0069006400720076002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310034002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_0740 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "d112acd2-b22a-503a-b30f-a47f24cd88fc" date = "2026-04-28" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L253-L286" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "0740359baef32cbb0b14a9d1bd3499ea2e770ff9b1c85898cfac8fd9aca4fa39" hash = "0f7bfa10075bf5c193345866333d415509433dbfe5a7d45664b88d72216ff7c3" hash = "29348ebe12d872c5f40e316a0043f7e5babe583374487345a79bad0ba93fbdfe" hash = "2da2b883e48e929f5365480d487590957d9e6582cc6da2c0b42699ba85e54fe2" hash = "3b2cd65a4fbdd784a6466e5196bc614c17d1dbaed3fd991d242e3be3e9249da6" hash = "469713c76c7a887826611b8c7180209a8bb6250f91d0f1eb84ac4d450ef15870" hash = "4af8192870afe18c77381dfaf8478f8914fa32906812bb53073da284a49ae4c7" hash = "62764ddc2dce74f2620cd2efd97a2950f50c8ac5a1f2c1af00dc5912d52f6920" hash = "818787057fc60ac8b957aa37d750aa4bace8e6a07d3d28b070022ee6dcd603ab" hash = "897f2bbe81fc3b1ae488114b93f3eb0133a85678d061c7a6f718507971f33736" hash = "9dc7beb60a0a6e7238fc8589b6c2665331be1e807b4d2b3ddd1c258dbbd3e2f7" hash = "af4f42197f5ce2d11993434725c81ecb6f54025110dedf56be8ffc0e775d9895" hash = "bcb774b6f6ff504d2db58096601bc5cb419c169bfbeaa3af852417e87d9b2aa0" hash = "ddf427ce55b36db522f638ba38e34cd7b96a04cb3c47849b91e7554bfd09a69a" hash = "e4b2c0aa28aac5e197312a061b05363e2e0387338b28b23272b5b6659d29b1d8" logic_hash = "d982a7c23da64204a368e3931894568f1b37ed013ab440bc2051c13a0e2bb053" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]6d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a002900 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } $ = { 460069006c006500560065007200730069006f006e00[1-8]32002e0031002e0030002e003000 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002e0031002e0030002e003000 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]6d0069006d006900640072007600 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]6d0069006d006900640072007600200028006d0069006d0069006b00610074007a002900 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]6d0069006d0069006400720076002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310036002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_07BE { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "d0393b38-9f92-5a9a-ab48-2f73a9420f84" date = "2026-04-28" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L288-L322" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "07beac65e28ee124f1da354293a3d6ad7250ed1ce29b8342acfd22252548a5af" hash = "1d23ab46ad547e7eef409b40756aae9246fbdf545d13946f770643f19c715e80" hash = "200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a" hash = "26ef7b27d1afb685e0c136205a92d29b1091e3dcf6b7b39a4ec03fbbdb57cb55" hash = "31b66a57fae0cc28a6a236d72a35c8b6244f997e700f9464f9cbf800dbf8bee6" hash = "406b844f4b5c82caf26056c67f9815ad8ecf1e6e5b07d446b456e5ff4a1476f9" hash = "41ad660820c41fc8b1860b13dc1fea8bc8cb2faceb36ed3e29d40d28079d2b1f" hash = "4bd4715d2a7af627da11513e32fab925c872babebdb7ff5675a75815fbf95021" hash = "704c6ffe786bc83a73fbdcd2edd50f47c3b5053da7da6aa4c10324d389a31db4" hash = "8b32fc8b15363915605c127ccbf5cbe71778f8dfbf821a25455496e969a01434" hash = "9a42fa1870472c38a56c0a70f62e57a3cdc0f5bc142f3a400d897b85d65800ac" hash = "9e56e96df36237e65b3d7dbc490afdc826215158f6278cd579c576c4b455b392" hash = "a7a665a695ec3c0f862a0d762ad55aff6ce6014359647e7c7f7e3c4dc3be81b7" hash = "b0a27ac1a8173413de13860d2b2e34cb6bc4d1149f94b62d319042e11d8b004c" hash = "c4f041de66ec8cc5ab4a03bbc46f99e073157a4e915a9ab4069162de834ffc5c" hash = "f6157e033a12520c73dcedf8e49cd42d103e5874c34d6527bb9de25a5d26e5ad" logic_hash = "33f34a0f27cf70de70e1e2408658a1473a60276902c64be1dfa99f2bc367c361" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]6d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a002900 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } $ = { 460069006c006500560065007200730069006f006e00[1-8]32002e0032002e0030002e003000 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002e0032002e0030002e003000 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]6d0069006d006900640072007600 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]6d0069006d006900640072007600200028006d0069006d0069006b00610074007a002900 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]6d0069006d0069006400720076002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310039002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_082A { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "bfb3b8e6-a13d-5fcc-a8e9-d0e012577c82" date = "2026-04-28" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L324-L382" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "082a79311da64b6adc3655e79aa090a9262acaac3b917a363b9571f520a17f6a" hash = "083f821d90e607ed93221e71d4742673e74f573d0755a96ad17d1403f65a2254" hash = "0f98492c92e35042b09032e3d9aedc357e4df94fc840217fa1091046f9248a06" hash = "10ad50fcb360dcab8539ea322aaf2270565dc835b7535790937348523d723d6b" hash = "12b0000698b79ea3c8178b9e87801cc34bad096a151a8779559519deafd4e3f0" hash = "19dfacea1b9f19c0379f89b2424ceb028f2ce59b0db991ba83ae460027584987" hash = "1a5c08d40a5e73b9fe63ea5761eaec8f41d916ca3da2acbc4e6e799b06af5524" hash = "2456a7921fa8ab7b9779e5665e6b42fccc019feb9e49a9a28a33ec0a4bb323c4" hash = "3ca5d47d076e99c312578ef6499e1fa7b9db88551cfc0f138da11105aca7c5e1" hash = "4136f1eb11cc463a858393ea733d5f1c220a3187537626f7f5d63eccf7c5a03f" hash = "492113a223d6a3fc110059fe46a180d82bb8e002ef2cd76cbf0c1d1eb8243263" hash = "4b97d63ebdeda6941bb8cef5e94741c6cca75237ca830561f2262034805f0919" hash = "4c89c907b7525b39409af1ad11cc7d2400263601edafc41c935715ef5bd145de" hash = "4d42678df3917c37f44a1506307f1677b9a689efcf350b1acce7e6f64b514905" hash = "569fe70bedd0df8585689b0e88ad8bd0544fdf88b9dbfc2076f4bdbcf89c28aa" hash = "793b78e70b3ae3bb400c5a8bc4d2d89183f1d7fc70954aed43df7287248b6875" hash = "7b846b0a717665e4d9fb313f25d1f6a5b782e495387aea45cf87ad3c049ac0db" hash = "80e4c83cfa9d675a6746ab846fa5da76d79e87a9297e94e595a2d781e02673b3" hash = "85b9d7344bf847349b5d58ebe4d44fd63679a36164505271593ef1076aa163b2" hash = "93aa3066ae831cdf81505e1bc5035227dc0e8f06ebbbb777832a17920c6a02fe" hash = "94c71954ac0b1fd9fa2bd5c506a16302100ba75d9f84f39ee9b333546c714601" hash = "95e5b5500e63c31c6561161a82f7f9373f99b5b1f54b018c4866df4f2a879167" hash = "a0931e16cf7b18d15579e36e0a69edad1717b07527b5407f2c105a2f554224b2" hash = "a1e6b431534258954db07039117b3159e889c6b9e757329bbd4126383c60c778" hash = "aaf04d89fd15bc61265e545f8e1da80e20f59f90058ed343c62ee24358e3af9e" hash = "ac5fb90e88d8870cd5569e661bea98cf6b001d83ab7c65a5196ea3743146939a" hash = "b0b80a11802b4a8ca69c818a03e76e7ef57c2e293de456439401e8e6073f8719" hash = "bc49cb96f3136c3e552bf29f808883abb9e651040415484c1736261b52756908" hash = "c42c1e5c3c04163bf61c3b86b04a5ec7d302af7e254990cef359ac80474299da" hash = "cf9451c9ccc5509b9912965f79c2b95eb89d805b2a186d7521d3a262cf5a7a37" hash = "d032001eab6cad4fbef19aab418650ded00152143bd14507e17d62748297c23f" hash = "d37996abc8efb29f1ccbb4335ce9ba9158bec86cc4775f0177112e87e4e3be5c" hash = "d43520128871c83b904f3136542ea46644ac81a62d51ae9d3c3a3f32405aad96" hash = "e8ec06b1fa780f577ff0e8c713e0fd9688a48e0329c8188320f9eb62dfc0667f" hash = "e99580e25f419b5ad90669e0c274cf63d30efa08065d064a863e655bdf77fb59" hash = "ee525b90053bb30908b5d7bf4c5e9b8b9d6b7b5c9091a26fa25d30d3ad8ef5d0" hash = "ee7b8eb150df2788bb9d5fe468327899d9f60d6731c379fd75143730a83b1c55" hash = "efa56907b9d0ec4430a5d581f490b6b9052b1e979da4dab6a110ab92e17d4576" hash = "f03f0fb3a26bb83e8f8fa426744cf06f2e6e29f5220663b1d64265952b8de1a1" hash = "f9b01406864ab081aa77eef4ad15cb2dd2f830d1ef54f52622a59ff1aeb05ba5" logic_hash = "9cc08eead20733d15cc302f9c61b4a7b48682063b9a7ce48b2b210da648d8c81" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]6d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a002900 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } $ = { 460069006c006500560065007200730069006f006e00[1-8]32002e0032002e0030002e003000 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002e0032002e0030002e003000 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]6d0069006d006900640072007600 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]6d0069006d006900640072007600200028006d0069006d0069006b00610074007a002900 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]6d0069006d0069006400720076002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000320030002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_0AAB { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "656f610e-4358-5c37-a940-32b041767b90" date = "2026-04-28" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L384-L433" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "0aab2deae90717a8876d46d257401d265cf90a5db4c57706e4003c19eee33550" hash = "14b89298134696f2fd1b1df0961d36fa6354721ea92498a349dc421e79447925" hash = "15cf366f7b3ee526db7ce2b5253ffebcbfaa4f33a82b459237c049f854a97c0c" hash = "1ef7afea0cf2ef246ade6606ef8b7195de9cd7a3cd7570bff90ba1e2422276f6" hash = "26bea3b3ab2001d91202f289b7e41499d810474607db7a0893ceab74f5532f47" hash = "36c65aeb255c06898ffe32e301030e0b74c8bca6fe7be593584b8fdaacd4e475" hash = "4999541c47abd4a7f2a002c180ae8d31c19804ce538b85870b8db53d3652862b" hash = "4bca0a401b364a5cc1581a184116c5bafa224e13782df13272bc1b748173d1be" hash = "51805bb537befaac8ce28f2221624cb4d9cefdc0260bc1afd5e0bc97bf1f9f93" hash = "5295080de37d4838e15dec4e3682545033d479d3d9ac28d74747c086559fb968" hash = "52f3905bbd97dcd2dbd22890e5e8413b9487088f1ee2fa828030a6a45b3975fd" hash = "618b15970671700188f4102e5d0638184e2723e8f57f7e917fa49792daebdadb" hash = "62036cdf3663097534adf3252b921eed06b73c2562655eae36b126c7d3d83266" hash = "64d4370843a07e25d4ceb68816015efcaeca9429bb5bb692a88e615b48c7da96" hash = "673bbc7fa4154f7d99af333014e888599c27ead02710f7bc7199184b30b38653" hash = "69866557566c59772f203c11f5fba30271448e231b65806a66e48f41e3804d7f" hash = "6d68d8a71a11458ddf0cbb73c0f145bee46ef29ce03ad7ece6bd6aa9d31db9b7" hash = "822982c568b6f44b610f8dc4ab5d94795c33ae08a6a608050941264975c1ecdb" hash = "82b7fa34ad07dbf9afa63b2f6ed37973a1b4fe35dee90b3cf5c788c15c9f08f7" hash = "8684aec77b4c3cafc1a6594de7e95695fa698625d4206a6c4b201875f76a5b38" hash = "a32dc2218fb1f538fba33701dfd9ca34267fda3181e82eb58b971ae8b78f0852" hash = "a42f4ae69b8755a957256b57eb3d319678eab81705f0ffea0d649ace7321108f" hash = "a78c9871da09fab21aec9b88a4e880f81ecb1ed0fa941f31cc2f041067e8e972" hash = "b34e2d9f3d4ef59cf7af18e17133a6a06509373e69e33c8eecb2e30501d0d9e4" hash = "b8c71e1844e987cd6f9c2baf28d9520d4ccdd8593ce7051bb1b3c9bf1d97076a" hash = "c4c9c84b211899ceb0d18a839afa497537a7c7c01ab481965a09788a9e16590c" hash = "c4fb31e3f24e40742a1b9855a2d67048fe64b26d8d2dbcec77d2d5deeded2bcc" hash = "c7bccc6f38403def4690e00a0b31eda05973d82be8953a3379e331658c51b231" hash = "c8ae217860f793fce3ad0239d7b357dba562824dd7177c9d723ca4d4a7f99a12" hash = "d50cb5f4b28c6c26f17b9d44211e515c3c0cc2c0c4bf24cd8f9ed073238053ad" hash = "f3ec3f22639d45b3c865bb1ed7622db32e04e1dbc456298be02bf1f3875c3aac" logic_hash = "aee47e91f76b5d344e7f136d033095d2738257f3791474c37dbc6a336b778577" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]6d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a002900 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } $ = { 460069006c006500560065007200730069006f006e00[1-8]32002e0031002e0030002e003000 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002e0031002e0030002e003000 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]6d0069006d006900640072007600 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]6d0069006d006900640072007600200028006d0069006d0069006b00610074007a002900 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]6d0069006d0069006400720076002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310037002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_0F58 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys" author = "Florian Roth" id = "0531a88d-cb21-5055-b365-a80b6e99a6e9" date = "2025-09-18" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L435-L467" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "0f58e09651d48d2b1bcec7b9f7bb85a2d1a7b65f7a51db281fe0c4f058a48597" hash = "087270d57f1626f29ba9c25750ca19838a869b73a1f71af50bdf37d6ff776212" hash = "0d676baac43d9e2d05b577d5e0c516fba250391ab0cb11232a4b17fd97a51e35" hash = "06ddf49ac8e06e6b83fccba1141c90ea01b65b7db592c54ffe8aa6d30a75c0b8" hash = "eab9b5b7e5fab1c2d7d44cd28f13ae8bb083d9362d2b930d43354a3dfd38e05a" hash = "627e13da6a45006fff4711b14754f9ccfac9a5854d275da798a22f3a68dd1eaa" hash = "b169a5f643524d59330fafe6e3e328e2179fc5116ee6fae5d39581467d53ac03" hash = "dfc80e0d468a2c115a902aa332a97e3d279b1fc3d32083e8cf9a4aadf3f54ad1" hash = "a74e8f94d2c140646a8bb12e3e322c49a97bd1b8a2e4327863d3623f43d65c66" hash = "94ba4bcbdb55d6faf9f33642d0072109510f5c57e8c963d1a3eb4f9111f30112" hash = "07759750fbb93c77b5c3957c642a9498fcff3946a5c69317db8d6be24098a4a0" hash = "4dc24fd07f8fb854e685bc540359c59f177de5b91231cc44d6231e33c9e932b1" hash = "baf7fbc4743a81eb5e4511023692b2dfdc32ba670ba3e4ed8c09db7a19bd82d3" hash = "bcca03ce1dd040e67eb71a7be0b75576316f0b6587b2058786fda8b6f0a5adfd" logic_hash = "ffa3eaf9032aa673119558217d212ff819ce91e99ab6c046f8801990d5826689" score = 70 quality = 80 tags = "" strings: $ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 } $ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } $ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 } $ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 } $ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 } $ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 } $ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 } $ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310034002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_14B8 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys" author = "Florian Roth" id = "a9965f8f-4969-52ae-953f-a06d8fabe951" date = "2025-09-18" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L469-L518" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "14b89298134696f2fd1b1df0961d36fa6354721ea92498a349dc421e79447925" hash = "36c65aeb255c06898ffe32e301030e0b74c8bca6fe7be593584b8fdaacd4e475" hash = "673bbc7fa4154f7d99af333014e888599c27ead02710f7bc7199184b30b38653" hash = "5295080de37d4838e15dec4e3682545033d479d3d9ac28d74747c086559fb968" hash = "8684aec77b4c3cafc1a6594de7e95695fa698625d4206a6c4b201875f76a5b38" hash = "69866557566c59772f203c11f5fba30271448e231b65806a66e48f41e3804d7f" hash = "a42f4ae69b8755a957256b57eb3d319678eab81705f0ffea0d649ace7321108f" hash = "62036cdf3663097534adf3252b921eed06b73c2562655eae36b126c7d3d83266" hash = "1ef7afea0cf2ef246ade6606ef8b7195de9cd7a3cd7570bff90ba1e2422276f6" hash = "b34e2d9f3d4ef59cf7af18e17133a6a06509373e69e33c8eecb2e30501d0d9e4" hash = "0aab2deae90717a8876d46d257401d265cf90a5db4c57706e4003c19eee33550" hash = "15cf366f7b3ee526db7ce2b5253ffebcbfaa4f33a82b459237c049f854a97c0c" hash = "c4c9c84b211899ceb0d18a839afa497537a7c7c01ab481965a09788a9e16590c" hash = "618b15970671700188f4102e5d0638184e2723e8f57f7e917fa49792daebdadb" hash = "4bca0a401b364a5cc1581a184116c5bafa224e13782df13272bc1b748173d1be" hash = "c7bccc6f38403def4690e00a0b31eda05973d82be8953a3379e331658c51b231" hash = "822982c568b6f44b610f8dc4ab5d94795c33ae08a6a608050941264975c1ecdb" hash = "b8c71e1844e987cd6f9c2baf28d9520d4ccdd8593ce7051bb1b3c9bf1d97076a" hash = "26bea3b3ab2001d91202f289b7e41499d810474607db7a0893ceab74f5532f47" hash = "c8ae217860f793fce3ad0239d7b357dba562824dd7177c9d723ca4d4a7f99a12" hash = "a78c9871da09fab21aec9b88a4e880f81ecb1ed0fa941f31cc2f041067e8e972" hash = "82b7fa34ad07dbf9afa63b2f6ed37973a1b4fe35dee90b3cf5c788c15c9f08f7" hash = "6d68d8a71a11458ddf0cbb73c0f145bee46ef29ce03ad7ece6bd6aa9d31db9b7" hash = "52f3905bbd97dcd2dbd22890e5e8413b9487088f1ee2fa828030a6a45b3975fd" hash = "64d4370843a07e25d4ceb68816015efcaeca9429bb5bb692a88e615b48c7da96" hash = "f3ec3f22639d45b3c865bb1ed7622db32e04e1dbc456298be02bf1f3875c3aac" hash = "51805bb537befaac8ce28f2221624cb4d9cefdc0260bc1afd5e0bc97bf1f9f93" hash = "c4fb31e3f24e40742a1b9855a2d67048fe64b26d8d2dbcec77d2d5deeded2bcc" hash = "d50cb5f4b28c6c26f17b9d44211e515c3c0cc2c0c4bf24cd8f9ed073238053ad" hash = "4999541c47abd4a7f2a002c180ae8d31c19804ce538b85870b8db53d3652862b" hash = "a32dc2218fb1f538fba33701dfd9ca34267fda3181e82eb58b971ae8b78f0852" logic_hash = "e4d4b0da09beff889931b8d90365c3a04ff4b5b410004fb820cb2551365cf63c" score = 70 quality = 80 tags = "" strings: $ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 } $ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } $ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0031002e0030002e0030 } $ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0031002e0030002e0030 } $ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 } $ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 } $ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 } $ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310037002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_28F5 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "233f1c4a-de22-5e72-bec4-dbe76ba2cda9" date = "2026-04-28" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L520-L541" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "28f5aa194a384680a08c0467e94a8fc40f8b0f3f2ac5deb42e0f51a80d27b553" hash = "2fd43a749b5040ebfafd7cdbd088e27ef44341d121f313515ebde460bf3aaa21" hash = "7824931e55249a501074a258b4f65cd66157ee35672ba17d1c0209f5b0384a28" logic_hash = "04e636fcc51732ebe8a2756a5bf1b5506eb9e0670814c440f92dcfe118483c5b" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]6d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a002900 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } $ = { 460069006c006500560065007200730069006f006e00[1-8]32002e0030002e0030002e003000 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002e0030002e0030002e003000 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]6d0069006d006900640072007600 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]6d0069006d006900640072007600200028006d0069006d0069006b00610074007a002900 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]6d0069006d0069006400720076002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310035002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_2FD4 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys" author = "Florian Roth" id = "e77f1fc7-4700-5afe-908f-b0d206757365" date = "2025-09-18" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L543-L564" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "2fd43a749b5040ebfafd7cdbd088e27ef44341d121f313515ebde460bf3aaa21" hash = "7824931e55249a501074a258b4f65cd66157ee35672ba17d1c0209f5b0384a28" hash = "28f5aa194a384680a08c0467e94a8fc40f8b0f3f2ac5deb42e0f51a80d27b553" logic_hash = "e24fab351505faf86bd12d6dd97662542c8cf5fca09d916b716af1478f3c9ddf" score = 70 quality = 80 tags = "" strings: $ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 } $ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } $ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 } $ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 } $ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 } $ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 } $ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 } $ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310035002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_30E0 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "701572d2-8f9e-5542-926d-28b7de5e71d2" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L566-L587" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "30e083cd7616b1b969a92fd18cf03097735596cce7fcf3254b2ca344e526acc2" hash = "a906251667a103a484a6888dca3e9c8c81f513b8f037b98dfc11440802b0d640" logic_hash = "0c302fd9d99a5d2fc73b34910a51c9bc064b2ad3143b6da4b8524c50f541c569" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]6d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a002900 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } $ = { 460069006c006500560065007200730069006f006e00[1-8]32002e0030002e0030002e003000 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002e0030002e0030002e003000 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]6d0069006d006900640072007600 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]6d0069006d006900640072007600200028006d0069006d0069006b00610074007a002900 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]6d0069006d0069006400720076002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310033002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_41AD { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys" author = "Florian Roth" id = "8a8887dd-0f3d-5ab4-a945-b47966789b99" date = "2025-09-18" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L589-L623" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "41ad660820c41fc8b1860b13dc1fea8bc8cb2faceb36ed3e29d40d28079d2b1f" hash = "a7a665a695ec3c0f862a0d762ad55aff6ce6014359647e7c7f7e3c4dc3be81b7" hash = "9a42fa1870472c38a56c0a70f62e57a3cdc0f5bc142f3a400d897b85d65800ac" hash = "f6157e033a12520c73dcedf8e49cd42d103e5874c34d6527bb9de25a5d26e5ad" hash = "31b66a57fae0cc28a6a236d72a35c8b6244f997e700f9464f9cbf800dbf8bee6" hash = "1d23ab46ad547e7eef409b40756aae9246fbdf545d13946f770643f19c715e80" hash = "704c6ffe786bc83a73fbdcd2edd50f47c3b5053da7da6aa4c10324d389a31db4" hash = "200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a" hash = "4bd4715d2a7af627da11513e32fab925c872babebdb7ff5675a75815fbf95021" hash = "9e56e96df36237e65b3d7dbc490afdc826215158f6278cd579c576c4b455b392" hash = "8b32fc8b15363915605c127ccbf5cbe71778f8dfbf821a25455496e969a01434" hash = "b0a27ac1a8173413de13860d2b2e34cb6bc4d1149f94b62d319042e11d8b004c" hash = "07beac65e28ee124f1da354293a3d6ad7250ed1ce29b8342acfd22252548a5af" hash = "c4f041de66ec8cc5ab4a03bbc46f99e073157a4e915a9ab4069162de834ffc5c" hash = "26ef7b27d1afb685e0c136205a92d29b1091e3dcf6b7b39a4ec03fbbdb57cb55" hash = "406b844f4b5c82caf26056c67f9815ad8ecf1e6e5b07d446b456e5ff4a1476f9" logic_hash = "a51e3e4c17122bf15b70b47693c3d24792cc7c7cbead1b26e501cb2907113968" score = 70 quality = 80 tags = "" strings: $ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 } $ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } $ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 } $ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 } $ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 } $ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 } $ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 } $ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310039002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_7662 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys" author = "Florian Roth" id = "2bb58484-03d2-5ccc-b165-cfe405f60f03" date = "2025-09-18" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L625-L666" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "7662187c236003308a7951c2f49c0768636c492f8935292d02f69e59b01d236d" hash = "a85d3fd59bb492a290552e5124bfe3f9e26a3086d69d42ccc44737b5a66673ec" hash = "60ee78a2b070c830fabb54c6bde0d095dff8fad7f72aa719758b3c41c72c2aa9" hash = "b2486f9359c94d7473ad8331b87a9c17ca9ba6e4109fd26ce92dff01969eaa09" hash = "d41e39215c2c1286e4cd3b1dc0948adefb161f22bc3a78756a027d41614ee4ff" hash = "008fa89822b7a1f91e5843169083202ea580f7b06eb6d5cae091ba844d035f25" hash = "8206ce9c42582ac980ff5d64f8e3e310bc2baa42d1a206dd831c6ab397fbd8fe" hash = "aafa642ca3d906138150059eeddb6f6b4fe9ad90c6174386cfe13a13e8be47d9" hash = "fefc070a5f6a9c0415e1c6f44512a33e8d163024174b30a61423d00d1e8f9bf2" hash = "6964a5d85639baee288555797992861232e75817f93028b50b8c6d34aa38b05b" hash = "443c0ba980d4db9213b654a45248fd855855c1cc81d18812cae9d16729ff9a85" hash = "e8743094f002239a8a9d6d7852c7852e0bb63cd411b007bd8c194bcba159ef15" hash = "ec96b15ce218f97ec1d8f07f13b052d274c4c8438f31daf246ccfaaee5e1bebd" hash = "beef40f1b4ce0ff2ee5c264955e6b2a0de6fe4089307510378adc83fad77228b" hash = "e858de280bd72d7538386a73e579580a6d5edba87b66b3671dc180229368be19" hash = "21617210249d2a35016e8ca6bd7a1edda25a12702a2294d56010ee8148637f5a" hash = "02ebf848fa618eba27065db366b15ee6629d98f551d20612ac38b9f655f37715" hash = "40556dd9b79b755cc0b48d3d024ceb15bd2c0e04960062ab2a85cd7d4d1b724a" hash = "8b30b2dc36d5e8f1ffc7281352923773fb821cdf66eb6516f82c697a524b599b" hash = "2ce4f8089b02017cbe86a5f25d6bc69dd8b6f5060c918a64a4123a5f3be1e878" hash = "d7aa8abdda8a68b8418e86bef50c19ef2f34bc66e7b139e43c2a99ab48c933be" hash = "82ac05fefaa8c7ee622d11d1a378f1d255b647ab2f3200fd323cc374818a83f2" hash = "c7cd14c71bcac5420872c3d825ff6d4be6a86f3d6a8a584f1a756541efff858e" logic_hash = "089f046e94a9cb4f576896e90375d6dbcaef61aa302af07f80230a74bc33ed18" score = 70 quality = 80 tags = "" strings: $ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 } $ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } $ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0031002e0031002e0030 } $ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0031002e0031002e0030 } $ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 } $ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 } $ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 } $ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310037002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_AAF0 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys" author = "Florian Roth" id = "57e5655e-1313-585f-931c-d892e8952d0e" date = "2025-09-18" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L668-L726" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "aaf04d89fd15bc61265e545f8e1da80e20f59f90058ed343c62ee24358e3af9e" hash = "4b97d63ebdeda6941bb8cef5e94741c6cca75237ca830561f2262034805f0919" hash = "c42c1e5c3c04163bf61c3b86b04a5ec7d302af7e254990cef359ac80474299da" hash = "f03f0fb3a26bb83e8f8fa426744cf06f2e6e29f5220663b1d64265952b8de1a1" hash = "0f98492c92e35042b09032e3d9aedc357e4df94fc840217fa1091046f9248a06" hash = "d032001eab6cad4fbef19aab418650ded00152143bd14507e17d62748297c23f" hash = "2456a7921fa8ab7b9779e5665e6b42fccc019feb9e49a9a28a33ec0a4bb323c4" hash = "f9b01406864ab081aa77eef4ad15cb2dd2f830d1ef54f52622a59ff1aeb05ba5" hash = "19dfacea1b9f19c0379f89b2424ceb028f2ce59b0db991ba83ae460027584987" hash = "3ca5d47d076e99c312578ef6499e1fa7b9db88551cfc0f138da11105aca7c5e1" hash = "cf9451c9ccc5509b9912965f79c2b95eb89d805b2a186d7521d3a262cf5a7a37" hash = "a0931e16cf7b18d15579e36e0a69edad1717b07527b5407f2c105a2f554224b2" hash = "492113a223d6a3fc110059fe46a180d82bb8e002ef2cd76cbf0c1d1eb8243263" hash = "85b9d7344bf847349b5d58ebe4d44fd63679a36164505271593ef1076aa163b2" hash = "efa56907b9d0ec4430a5d581f490b6b9052b1e979da4dab6a110ab92e17d4576" hash = "12b0000698b79ea3c8178b9e87801cc34bad096a151a8779559519deafd4e3f0" hash = "4136f1eb11cc463a858393ea733d5f1c220a3187537626f7f5d63eccf7c5a03f" hash = "ee525b90053bb30908b5d7bf4c5e9b8b9d6b7b5c9091a26fa25d30d3ad8ef5d0" hash = "10ad50fcb360dcab8539ea322aaf2270565dc835b7535790937348523d723d6b" hash = "4d42678df3917c37f44a1506307f1677b9a689efcf350b1acce7e6f64b514905" hash = "d37996abc8efb29f1ccbb4335ce9ba9158bec86cc4775f0177112e87e4e3be5c" hash = "569fe70bedd0df8585689b0e88ad8bd0544fdf88b9dbfc2076f4bdbcf89c28aa" hash = "80e4c83cfa9d675a6746ab846fa5da76d79e87a9297e94e595a2d781e02673b3" hash = "1a5c08d40a5e73b9fe63ea5761eaec8f41d916ca3da2acbc4e6e799b06af5524" hash = "ee7b8eb150df2788bb9d5fe468327899d9f60d6731c379fd75143730a83b1c55" hash = "a1e6b431534258954db07039117b3159e889c6b9e757329bbd4126383c60c778" hash = "e99580e25f419b5ad90669e0c274cf63d30efa08065d064a863e655bdf77fb59" hash = "b0b80a11802b4a8ca69c818a03e76e7ef57c2e293de456439401e8e6073f8719" hash = "4c89c907b7525b39409af1ad11cc7d2400263601edafc41c935715ef5bd145de" hash = "083f821d90e607ed93221e71d4742673e74f573d0755a96ad17d1403f65a2254" hash = "e8ec06b1fa780f577ff0e8c713e0fd9688a48e0329c8188320f9eb62dfc0667f" hash = "ac5fb90e88d8870cd5569e661bea98cf6b001d83ab7c65a5196ea3743146939a" hash = "7b846b0a717665e4d9fb313f25d1f6a5b782e495387aea45cf87ad3c049ac0db" hash = "93aa3066ae831cdf81505e1bc5035227dc0e8f06ebbbb777832a17920c6a02fe" hash = "082a79311da64b6adc3655e79aa090a9262acaac3b917a363b9571f520a17f6a" hash = "bc49cb96f3136c3e552bf29f808883abb9e651040415484c1736261b52756908" hash = "95e5b5500e63c31c6561161a82f7f9373f99b5b1f54b018c4866df4f2a879167" hash = "d43520128871c83b904f3136542ea46644ac81a62d51ae9d3c3a3f32405aad96" hash = "94c71954ac0b1fd9fa2bd5c506a16302100ba75d9f84f39ee9b333546c714601" hash = "793b78e70b3ae3bb400c5a8bc4d2d89183f1d7fc70954aed43df7287248b6875" logic_hash = "9566444b1d3adb2a8a5f48b45bbbdb5c9be3ce399ec091e3ffd13780a90227f1" score = 70 quality = 80 tags = "" strings: $ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 } $ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } $ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 } $ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 } $ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 } $ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 } $ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 } $ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000320030002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_DDF4 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys" author = "Florian Roth" id = "0b38be06-60df-5b49-a748-eb175e1db33f" date = "2025-09-18" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L728-L761" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "ddf427ce55b36db522f638ba38e34cd7b96a04cb3c47849b91e7554bfd09a69a" hash = "bcb774b6f6ff504d2db58096601bc5cb419c169bfbeaa3af852417e87d9b2aa0" hash = "af4f42197f5ce2d11993434725c81ecb6f54025110dedf56be8ffc0e775d9895" hash = "9dc7beb60a0a6e7238fc8589b6c2665331be1e807b4d2b3ddd1c258dbbd3e2f7" hash = "2da2b883e48e929f5365480d487590957d9e6582cc6da2c0b42699ba85e54fe2" hash = "29348ebe12d872c5f40e316a0043f7e5babe583374487345a79bad0ba93fbdfe" hash = "e4b2c0aa28aac5e197312a061b05363e2e0387338b28b23272b5b6659d29b1d8" hash = "897f2bbe81fc3b1ae488114b93f3eb0133a85678d061c7a6f718507971f33736" hash = "0f7bfa10075bf5c193345866333d415509433dbfe5a7d45664b88d72216ff7c3" hash = "469713c76c7a887826611b8c7180209a8bb6250f91d0f1eb84ac4d450ef15870" hash = "818787057fc60ac8b957aa37d750aa4bace8e6a07d3d28b070022ee6dcd603ab" hash = "4af8192870afe18c77381dfaf8478f8914fa32906812bb53073da284a49ae4c7" hash = "0740359baef32cbb0b14a9d1bd3499ea2e770ff9b1c85898cfac8fd9aca4fa39" hash = "62764ddc2dce74f2620cd2efd97a2950f50c8ac5a1f2c1af00dc5912d52f6920" hash = "3b2cd65a4fbdd784a6466e5196bc614c17d1dbaed3fd991d242e3be3e9249da6" logic_hash = "d20bfd9f05a7cdb031f3ada2801ee3b978a9d27407b4425c7aa7eb41b4549b18" score = 70 quality = 80 tags = "" strings: $ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 } $ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } $ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0031002e0030002e0030 } $ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0031002e0030002e0030 } $ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 } $ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 } $ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 } $ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310036002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Gmer_Gmersys_Gmer_0052 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gmer64.sys, superman.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "a54097ee-007c-5c9e-b3f1-66b6dd702e27" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L763-L784" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "0052aa88e42055a2eed5ddd17c3499c692360155e5e031a211edfcef577acce3" hash = "18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7" logic_hash = "8b7692316b92194c57edb7cfa44a69441e9541414a59364cbeb87f070fa97e32" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]47004d00450052002000440072006900760065007200200068007400740070003a002f002f007700770077002e0067006d00650072002e006e0065007400 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]47004d0045005200 } $ = { 460069006c006500560065007200730069006f006e00[1-8]32002c00200030002c002000360039003800330020006200750069006c0074002000620079003a002000570069006e00440044004b00 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002c00200030002c0020003600390038003300 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]67006d0065007200360034002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]47004d0045005200 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]67006d0065007200360034002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f0070007900720069006700680074002000280043002900200047004d0045005200200032003000300033002d003200300031003300 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Legalcorp_Pciexpressvideocapture_FD22 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PcieCubed.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "1a627d8b-c2b4-5391-a7d6-b8add687f140" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L786-L805" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8" logic_hash = "46ff8b6469cbd4f4db4965f08a5df1a79d6c3f21d92d2b390df82e5807738798" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]5000430049006500200056006900640065006f0020004300610070007400750072006500 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]4c006500670061006c00200043006f00720070002e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]31002e0030002e0030002e0031003500 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]31002e0030002e0030002e0031003500 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]50004300490020004500780070007200650073007300200056006900640065006f0020004300610070007400750072006500 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]5000630069006500430075006200650064002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]320030003100360020004c006500670061006c00 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Ampgsys_Microsoftwindowsoperatingsystem_CACA { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ampg.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "9c8ca76c-117c-5f80-8179-abd1ffa84ba9" date = "2026-09-08" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L807-L826" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "cacaf0698c6371f8cc45fae85a13fb738f0b8ce0db716c5e4d0d12152de163e3" logic_hash = "bf38019a154863d70321b8aa1380551bd96a42a5f0141d163543d4f16b66ea22" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]53004400200043007200610073006800640075006d007000200050006f00720074002000440072006900760065007200 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]4d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]310030002e0030002e00320036003100300030002e00340032003000320020002800570069006e004200750069006c0064002e003100360030003100300031002e0030003800300030002900 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]310030002e0030002e00320036003100300030002e003400320030003200 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]61006d00700067002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]4d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d00 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]61006d00700067002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e00 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Ndislansys_Microsoftwindowsoperatingsystem_B0EB { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ndislan.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "889ecb2a-f4a5-518c-858b-7292b6469323" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L828-L848" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427" logic_hash = "4032161d51e52d628e614970992fbae4f2294a8b2779160812233ccaef94e7f7" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]4d00530020004c0041004e002000440072006900760065007200 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]4d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]36002e0031002e0037003600300030002e003100340032003100 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]36002e0031002e0037003600300030002e003100340032003100 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]6e006400690073006c0061006e002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]4d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d00 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]6e006400690073006c0061006e002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e00 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Ntbiosys_Microsoftrwindowsrntoperatingsystem_96BF { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ntbios.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "cbf1f033-3c26-5aac-841e-881d0061b647" date = "2026-04-28" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L850-L870" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc" hash = "c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c" logic_hash = "139d8b63b53e2c6db2ceb2f0509599c23b854c2b4c02e37cc226ed36589ed5e9" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]6e007400620069006f0073002000640072006900760065007200 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]4d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]35002c00200030002c00200032002c0020003100 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]35002c00200030002c00200032002c0020003100 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]6e007400620069006f002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]20004d006900630072006f0073006f00660074002800520029002000570069006e0064006f0077007300200028005200290020004e00540020004f007000650072006100740069006e0067002000530079007300740065006d00 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]6e007400620069006f0073002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]4872436740620967200028004300290020003200300030003300 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Ntbiosys_Microsoftrwindowsrntoperatingsystem_C0D8 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ntbios_2.sys" author = "Florian Roth" id = "f16b4b22-985a-5d39-ae51-709aa9a69d8d" date = "2025-09-18" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L872-L892" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c" hash = "96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc" logic_hash = "74ad0b57644d82a77bc902786250156f5e3700671bdf9765055b5908dc345a67" score = 70 quality = 80 tags = "" strings: $ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006e007400620069006f00730020006400720069007600650072 } $ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e } $ = { 00460069006c006500560065007200730069006f006e[1-8]0035002c00200030002c00200032002c00200031 } $ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002c00200030002c00200032002c00200031 } $ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e007400620069006f002e007300790073 } $ = { 00500072006f0064007500630074004e0061006d0065[1-8]0020004d006900630072006f0073006f00660074002800520029002000570069006e0064006f0077007300200028005200290020004e00540020004f007000650072006100740069006e0067002000530079007300740065006d } $ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e007400620069006f0073002e007300790073 } $ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000300033 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Srvnetsys_Microsoftwindowsoperatingsystem_F6C3 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinTapix.sys, SRVNET2.SYS. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "d4ad7898-a3e3-56ef-8e83-f76da3d3f576" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L894-L914" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d" logic_hash = "af5fe5f0852f2e654996aea7dccec8428dc8e9720797fc91d4243a0f480a0dc8" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]53006500720076006500720020004e006500740077006f0072006b002000640072006900760065007200 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]4d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]310030002e0030002e00310038003300360032002e0036003900330020002800570069006e004200750069006c0064002e003100360030003100300031002e0030003800300030002900 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]310030002e0030002e00310038003300360032002e00360039003300 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]5300520056004e004500540032002e00530059005300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]4d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d00 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]5300520056004e004500540032002e00530059005300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e00 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_06A0 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "34ade986-126e-5864-81ad-1e7588c95930" date = "2026-04-28" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L916-L938" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4" hash = "8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce" hash = "b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3" hash = "e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e" logic_hash = "2b7b3fd40dec6f5530b327ca022e9bad705e49bae0baf6e98938e5ab3510e8d1" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]570041004e0020005400720061006e00730070006f00720074002000440072006900760065007200 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]4d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]36002e0031002e0037003600300030002e003100310037003200 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]36002e0031002e0037003600300030002e003100310037003200 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]770061006e00740064002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]4d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d00 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]770061006e00740064002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]4d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e00 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_6908 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_2.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "f0537343-c4e8-55c9-a82e-45ec1b05e60d" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L940-L960" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f" logic_hash = "bc1f89fd51c08995cdcf3090db6d3de1f96abc7193e6a71ac7d758f9c68f0def" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]570041004e0020005400720061006e00730070006f00720074002000440072006900760065007200 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]4d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]36002e0031002e0037003600300030002e00390033003800 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]36002e0031002e0037003600300030002e00390033003800 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]770061006e00740064002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]4d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d00 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]770061006e00740064002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]4d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e00 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_81C7 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_3.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "c11f392b-b6c6-5158-90d1-715c87fa3591" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L962-L982" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1" logic_hash = "5f24b13eb3f9a5c863e43fe39ff1bc6e6bb67928aa62b7179d315836a0421952" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]570041004e0020005400720061006e00730070006f00720074002000440072006900760065007200 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]4d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]35002e0032002e0033003700390030002e00390033003800 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]35002e0032002e0033003700390030002e00390033003800 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]770061006e00740064002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]4d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d00 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]770061006e00740064002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]4d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e00 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_E7AF { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_6.sys" author = "Florian Roth" id = "5f883209-6887-5cb4-96bb-988898d47c09" date = "2025-09-18" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L984-L1006" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e" hash = "b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3" hash = "8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce" hash = "06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4" logic_hash = "b4d12069a9a3a8d8d9bde9a4ed3f80f21f2654b6f96943d201933198678d01d9" score = 70 quality = 80 tags = "" strings: $ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570041004e0020005400720061006e00730070006f007200740020004400720069007600650072 } $ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e } $ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003100370032 } $ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003100370032 } $ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770061006e00740064002e007300790073 } $ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d } $ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770061006e00740064002e007300790073 } $ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } condition: all of them } rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Windbgsys_Microsoftwindowsoperatingsystem_06C5 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - windbg.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "b73da459-5c4d-5331-84da-2eabb9e0b478" date = "2026-04-28" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1008-L1043" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f" hash = "139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988" hash = "32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d" hash = "4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4" hash = "50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76" hash = "5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d" hash = "6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724" hash = "6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77" hash = "770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a" hash = "86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62" hash = "bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df" hash = "e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d" hash = "e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12" hash = "ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620" hash = "f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280" hash = "f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a" hash = "fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5" logic_hash = "8e9d30a966ff2c1abb89d05dcd641129984332c60962656d159b19c3c8410617" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]570069006e0064006f007700730020004700550049002000730079006d0062006f006c0069006300200064006500620075006700670065007200 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]4d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]310030002e0030002e00310039003000340031002e0036003800350020002800570069006e004200750069006c0064002e003100360030003100300031002e0030003800300030002900 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]310030002e0030002e00310039003000340031002e00360038003500 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]770069006e006400620067002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]4d006900630072006f0073006f00660074003f002000570069006e0064006f00770073003f0020004f007000650072006100740069006e0067002000530079007300740065006d00 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]770069006e006400620067002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]3f0020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e00 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Windbgsys_Microsoftwindowsoperatingsystem_6994 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - windbg.sys" author = "Florian Roth" id = "05060e37-3c01-5b86-a3ee-6e141399164a" date = "2025-09-18" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1045-L1080" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77" hash = "5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d" hash = "ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620" hash = "f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280" hash = "32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d" hash = "6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724" hash = "86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62" hash = "06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f" hash = "4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4" hash = "770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a" hash = "50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76" hash = "f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a" hash = "fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5" hash = "139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988" hash = "e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d" hash = "e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12" hash = "bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df" logic_hash = "161f83c85ad516f3f06f3719a1d8ae0c841e818e50f985403133c2f77b7be894" score = 70 quality = 80 tags = "" strings: $ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e0064006f007700730020004700550049002000730079006d0062006f006c00690063002000640065006200750067006700650072 } $ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e } $ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310039003000340031002e0036003800350020002800570069006e004200750069006c0064002e003100360030003100300031002e00300038003000300029 } $ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310039003000340031002e003600380035 } $ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770069006e006400620067002e007300790073 } $ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074003f002000570069006e0064006f00770073003f0020004f007000650072006100740069006e0067002000530079007300740065006d } $ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770069006e006400620067002e007300790073 } $ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]003f0020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } condition: all of them } rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wintapixsys_Microsoftwindowsoperatingsystem_1485 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinTapix.sys, SRVNET2.SYS. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "de5ced23-fbe6-54cc-ba14-85d33a1738cf" date = "2026-04-28" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1082-L1102" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e" hash = "8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330" logic_hash = "e60ece0c0d46a41696efb8bd55931e8f6368237fcd782d891fa84384fff2c7ce" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]570069006e0064006f007700730020004b00650072006e0065006c00200045007800650063007500740069007600650020004d006f00640075006c006500 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]4d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]36002e0033002e0039003600300030002e003100360033003800340020002800770069006e0062006c00750065005f00720074006d002e003100330030003800320031002d0031003600320033002900 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]36002e0033002e0039003600300030002e0031003600330038003400 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]570069006e00540061007000690078002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]4d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d00 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]570069006e00540061007000690078002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e00 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wintapixsys_Microsoftwindowsoperatingsystem_8578 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinTapix.sys, SRVNET2.SYS" author = "Florian Roth" id = "0bb182e8-e64b-5b01-9ca5-105212ebeb51" date = "2025-09-18" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1104-L1124" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330" hash = "1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e" logic_hash = "dd85f0dc471425fe692e5a51580a97facdaea45505c48b5e01dd6dbc975f2ffe" score = 70 quality = 80 tags = "" strings: $ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e0064006f007700730020004b00650072006e0065006c00200045007800650063007500740069007600650020004d006f00640075006c0065 } $ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e } $ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0033002e0039003600300030002e003100360033003800340020002800770069006e0062006c00750065005f00720074006d002e003100330030003800320031002d00310036003200330029 } $ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0033002e0039003600300030002e00310036003300380034 } $ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069006e00540061007000690078002e007300790073 } $ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d } $ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069006e00540061007000690078002e007300790073 } $ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } condition: all of them } rule LOLDRIVERS_MAL_Driver_Mimidrv_Mimidrvmimikatz_2FAF { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "0a40c83f-175f-5b02-afd7-a975daa62ec9" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1126-L1143" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "2faf95a3405578d0e613c8d88d534aa7233da0a6217ce8475890140ab8fb33c8" logic_hash = "4495d60de69a9e2928c8c8512ebadbd8bd9671c4848c756b1b2be7095000161b" score = 70 quality = 80 tags = "" strings: $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002e0030002e0030002e003000 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]6d0069006d006900640072007600 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]6d0069006d006900640072007600200028006d0069006d0069006b00610074007a002900 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]6d0069006d0069006400720076002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310035002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Paloaltonetworksinc_Tdevfltsys_Cortexxdradvancedendpointprotection_8284 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - tdevflt.sys, ABYSSWORKER. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "32233331-2e87-52f3-874a-93fe8747efaa" date = "2026-07-10" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1145-L1164" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "8284c8676cc22c4b2e66826ac16986da7ddecba1f2776b16771be17bfdc45dc2" logic_hash = "46da747e7362e38544ec0e107a02614155b3c235d02add7846a3ffc7537418b5" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]43006f0072007400650078002000580044005200200050006e00500020004400650076006900630065002000460069006c007400650072002000440072006900760065007200 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]500061006c006f00200041006c0074006f0020004e006500740077006f0072006b0073002c00200049006e0063002e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]38002e0032002e0032002e0034003900370030003800 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]38002e0032002e0032002e0034003900370030003800 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]740064006500760066006c0074002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]43006f00720074006500780020005800440052002221200041006400760061006e00630065006400200045006e00640070006f0069006e0074002000500072006f00740065006300740069006f006e00 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]740064006500760066006c0074002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]a9002000500061006c006f00200041006c0074006f0020004e006500740077006f0072006b0073002c00200049006e0063002e00200041006c006c002000720069006700680074007300200072006500730065007200760065006400 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Pinchinstechnologycoltd_Rwtkrlsys_Ransomwareterminator_090D { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - driver_090d409f.sys" author = "Florian Roth" id = "5c1070f6-a282-5cee-b9bc-ea833b766e1f" date = "2025-09-18" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1166-L1186" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "090d409f86430e078694e621ad0bd5e458d32aa727f0eb99bda3961577df8d49" hash = "04e1f364c0fcebaa1f0833c0595a976d0625ed3390441b4f2d1aedb314bf2497" logic_hash = "079ccac2c3427b198a0873ee69ab4ce8631a4b35fa3829468883a0acf2852b94" score = 70 quality = 80 tags = "" strings: $ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200570054004b0072006c } $ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500069006e006300680069006e007300200054006500630068006e006f006c006f0067007900200043006f002e002c004c00740064002e } $ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e003800300037 } $ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030 } $ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]005200570054004b0072006c002e007300790073 } $ = { 00500072006f0064007500630074004e0061006d0065[1-8]00520061006e0073006f006d0077006100720065005400650072006d0069006e00610074006f0072 } $ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005200570054004b0072006c002e007300790073 } $ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310036002000500069006e006300680069006e007300200054006500630068006e006f006c006f0067007900200043006f002e002c004c00740064002e } condition: all of them } rule LOLDRIVERS_MAL_Driver_Pinchinstechnologycoltd_Rwtkrlsys_Ransomwareterminator_146B { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - driver_146b8f4f.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "fa3f4573-ab34-5cc7-a2b0-6ee60e58337c" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1188-L1208" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "146b8f4fc91a4915e8f6aa6e0d871f7161a809c46760ef602bab534836142436" logic_hash = "0e49dff13e48c047366391dd6e7114a093d3cfeb8b27ba0d66b0ce4983a1445e" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]5200570054004b0072006c00 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]500069006e006300680069006e007300200054006500630068006e006f006c006f0067007900200043006f002e002c004c00740064002e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]30002e0031002e0030002e00320035003100 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]30002e003800 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]5200570054004b0072006c002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]520061006e0073006f006d0077006100720065005400650072006d0069006e00610074006f007200 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]5200570054004b0072006c002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f0070007900720069006700680074002000280043002900200032003000310036002000500069006e006300680069006e007300200054006500630068006e006f006c006f0067007900200043006f002e002c004c00740064002e00 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Pinchinstechnologycoltd_Rwtkrlsys_Ransomwareterminator_1A74 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - driver_1a74c2bd.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "263d1e9e-f84d-5b71-a5b9-a13383a8c04b" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1210-L1230" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "1a74c2bde0c9a76486657ccb9c79ea87c9891a32cdd4aa15c7542f7c9487a539" logic_hash = "5e3e2880da2a9754d4b944617053b10e6c47b3115f544a82c2505ac6958ec193" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]5200570054004b0072006c00 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]500069006e006300680069006e007300200054006500630068006e006f006c006f0067007900200043006f002e002c004c00740064002e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]31002e0030002e0030002e003100300030003600 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]31002e003000 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]5200570054004b0072006c002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]520061006e0073006f006d0077006100720065005400650072006d0069006e00610074006f007200 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]5200570054004b0072006c002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f0070007900720069006700680074002000280043002900200032003000310036002000500069006e006300680069006e007300200054006500630068006e006f006c006f0067007900200043006f002e002c004c00740064002e00 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Pinchinstechnologycoltd_Rwtkrlsys_Ransomwareterminator_930D { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - driver_930da474.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "9fadef65-78da-5920-9bec-e4e96a3dbba8" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1232-L1252" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "930da474a6d1be97b54f2c81e883e14d62897aa58622e5b040e412bd36cee0a7" logic_hash = "b4d25b7e1a98b006af44acae4dff17c1a401687add8e1554271b06e42a924f74" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]5200570054004b0072006c00 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]500069006e006300680069006e007300200054006500630068006e006f006c006f0067007900200043006f002e002c004c00740064002e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]31002e0030002e0030002e00380030003800 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]31002e003000 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]5200570054004b0072006c002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]520061006e0073006f006d0077006100720065005400650072006d0069006e00610074006f007200 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]5200570054004b0072006c002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f0070007900720069006700680074002000280043002900200032003000310036002000500069006e006300680069006e007300200054006500630068006e006f006c006f0067007900200043006f002e002c004c00740064002e00 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Sensecorp_42B2 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "d2bef8c0-05ae-5951-88ab-8b914f38ce06" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1254-L1271" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25" logic_hash = "efa506290575bbc70909280080fd85a732c733339e7d984753010c0496aec348" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]530065006e007300650035002000440072006900760065007200 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]530065006e00730065003500200043004f0052005000 } $ = { 460069006c006500560065007200730069006f006e00[1-8]32002e0035002e0030002e003000 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002e0035002e0030002e003000 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f007000790072006900670068007400200028004300290020003200300032003200 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Sensecorp_7F45 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "8feb9ed7-feb1-5868-b3f0-0d7140f720ae" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1273-L1290" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6" logic_hash = "e7fb00da35e8923567e443830650672094b18d8b49d614d138ed36726fee9019" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]530065006e007300650035002000440072006900760065007200 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]530065006e00730065003500200043004f0052005000 } $ = { 460069006c006500560065007200730069006f006e00[1-8]32002e0036002e0030002e003000 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002e0036002e0030002e003000 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f007000790072006900670068007400200028004300290020003200300032003200 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Tonecinc_Idmtdisys_Internetdownloadmanager_2C1B { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - idmtdi.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "9272f502-fc9d-5ccd-ac6a-7be6652ae14b" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1292-L1314" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "2c1b65c2988b337182f1ba57b404793454e30a7fd328d34bc2e79857dc437a4a" hash = "44ebb0f534e7cdfec06d5234358d219798a313219b214d72aa23afc5a57d7ea9" hash = "77225a99b2e0e2b4007fb2f5a96d356e13deab45b9ef54c175d5452de8a211a7" logic_hash = "2836d1c6613df7efe33966cc2a5edd4b9bb30cb0346173221652278503ce13cf" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]49006e007400650072006e0065007400200044006f0077006e006c006f006100640020004d0061006e00610067006500720020005400440049002000440072006900760065007200 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]54006f006e0065006300200049006e0063002e00 } $ = { 460069006c006500560065007200730069006f006e00[1-8]36002e00330032002e0033002e0038003000 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]36002e00330032002e0033002e003100 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]690064006d007400640069002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]49006e007400650072006e0065007400200044006f0077006e006c006f006100640020004d0061006e006100670065007200 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]690064006d007400640069002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f0070007900720069006700680074002000a9002000310039003900390020002d0020003200300031003800200054006f006e0065006300200049006e0063002e00 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Windowsrwinddkprovider_Heysafedrvsys_Windowsrwinddkdriver_A188 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - heysafe_drv.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "521e5bf7-5e89-5937-bbec-5915f4e5d333" date = "2026-10-19" modified = "2026-10-19" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1316-L1335" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "a188993dd8cac6628f97dfd390cfab8a9e510d581c39e32da66cbc4b559db27d" logic_hash = "c7a13531158b905d3bc021242a19a600074985995a6151942b230824650fc0d5" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]48006500790053006100660065002d00580020007400680069006e002000700072006f00740065006300740069006f006e002000660069006c007400650072002000640072006900760065007200 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f0076006900640065007200 } $ = { 460069006c006500560065007200730069006f006e00[1-8]310030002e0030002e00310030003000310031002e0031003600330038003400 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]310030002e0030002e00310030003000310031002e0031003600330038003400 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]68006500790073006100660065005f006400720076002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000640072006900760065007200 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]68006500790073006100660065005f006400720076002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f00700079007200690067006800740020002800430029002000320030003200360020004800650079005300610066006500 } condition: all of them } rule LOLDRIVERS_MAL_Driver_Windowsrwinddkprovider_Netfiltersys_Windowsrwinddkdriver_2060 { meta: description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - driver_206006a1.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious." author = "Florian Roth" id = "bdbed311-eecb-5e27-8162-3d9e985ec7b0" date = "2025-09-18" modified = "2026-04-28" reference = "https://github.com/magicsword-io/LOLDrivers" source_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/detections/yara/yara-rules_mal_drivers.yar#L1337-L1357" license_url = "https://github.com/magicsword-io/LOLDrivers//blob/96a491d410f849fd392762c83cea8ccbe81a5bff/LICENSE" hash = "206006a11f233b9ae876952308f6d60d7a75c80b4d530a3e6146a0b4d8cd3e4f" logic_hash = "228cc65de47535e5b1514db5c9d98c638013c45b65de75c74e4a8f1e2016a167" score = 70 quality = 80 tags = "" strings: $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]4e0065007400460069006c007400650072002000530044004b0020005700460050002000440072006900760065007200200028005700500050002900 } $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f0076006900640065007200 } $ = { 460069006c006500560065007200730069006f006e00[1-8]31002e0036002e0035002e003700 } $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]36002e0032002e0039003200300030002e0032003000350035003700 } $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]6e0065007400660069006c0074006500720032002e00730079007300 } $ = { 500072006f0064007500630074004e0061006d006500[1-8]570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000640072006900760065007200 } $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]6e0065007400660069006c0074006500720032002e00730079007300 } $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f0070007900720069006700680074002000a90020004e0065007400460069006c00740065007200530044004b002e0063006f006d00 } condition: all of them } // Copyright 2026 Stanleon. MIT license (see notices.txt). rule DocBunker_Test_EICAR { meta: description = "Harmless EICAR antivirus test string; not a real infection" author = "DocBunker" strings: $test = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" condition: $test }