import "pe" import "hash" rule kapeka_backdoor { meta: author="WithSecure" description="Detects Kapeka backdoor based on common strings." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $a = "Azbi3l1xIgcRzTsOHopgrwUdJUMWpOFt" ascii $b = "PID : " wide $c = "ExitCode : " wide $d = "1: " wide $e = "2: " wide condition: pe.is_dll() and filesize > 50000 and filesize < 500000 and 4 of them } rule Kapeka_Backdoor { meta: author= "ThreatMon" description = "Kapeka_Backdoor Rule" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $opc1 = {8B 55 C8 8D 45 F8 8B 4D FC 50 C7 45 F8 00 00 00 00 E8 AB EB FF FF 84 C0 74 1A 8D 45 F4} $opc2 = {FF 15 9C D0 40 00 50 FF 15 A0 D0 40 00 8B F0 85 F6 74 19 53 8D 45 DC 50 56 FF 15 9C D1 40 00 8B 45 FC} $opc3 = {FF 15 80 D1 40 00 33 C9 BA 01 00 00 00 85 C0 0F 45 CA 83 7D FC 00 89 4D F8 74 05} condition: uint16(0) == 0x5A4D and (any of ($opc*)) } rule Kapeka_Backdoor_2 { meta: author= "ThreatMon" description = "Kapeka_Backdoor Rule" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $str1 = "jxs2HZ" $str2 = "BFF9F38C7760A28C" $str3 = "LsHsAO" $str4 = "jRcZrx" $str5 = "SIsKba" $str6 = "KKGCUr" $str7 = "GafpPS" $str8 = "LsHsAO" $opc1 = {E8 E4 AE FF FF 4C 8B C0 33 D2 33 C9 FF 15 37 D7 00 00 48 85 C0 48 89 87 08 04 00 00} $opc2 = {48 8D 0D 54 63 00 00 E8 43 10 FF FF 41 8D 54 24 05 48 8B D8 48 8D 4C 24 20} $opc3 = {FF 15 22 F4 00 00 48 8D 0D 83 1A 01 00 48 89 47 10 FF 15 F1 F5 00 00 48 8D 0D 92 1A 01 00 48 89 47 60 FF 15 E0 F5 00 00} condition: uint16(0) == 0x5A4D and (any of ($str*,$opc*)) } rule M_APT_Downloader_BACKORDER_1 { meta: author = "Mandiant" description = "This rule is designed to detect on events related to BACKORDER. BACKORDER is a downloader written in GoLang which download and executes a second stage payload from a remote server. BACKORDER is usually delivered within trojanized installer files and is hard coded to execute the original setup executable." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $go = "Go build ID:" ascii wide $a1 = "main.proc1esar" $a2 = "main.obt_zip" $a3 = "main.un1_zip" $a4 = "main.primer1_paso" condition: uint16(0) == 0x5a4d and filesize < 10MB and all of them } rule M_APT_Downloader_BACKORDER_2 { meta: author = "Mandiant" description = "Detects strings and sleep timer in the BACKORDER downloader" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $ = "data/setup.exe" $ = "http://" $ = {c7 04 ?? 00 CA 9A 3B C7 44 ?? 04 00 00 00 00 e8} // Sleep timer condition: uint16(0) == 0x5a4d and filesize < 10MB and all of them } rule M_APT_Disrupt_NIKOWIPER_1 { meta: author = "Mandiant" description = "Detects code in NIKOWIPER" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $ = "SDelete" $ = "-accepteula -r -s -q " wide $ = {68 ?? ?? 02 00 68 } condition: uint16(0) == 0x5a4d and filesize < 2MB and all of them } rule M_APT_Disrupt_NIKOWIPER_2 { meta: author = "Mandiant" description = "NikoWiper unique strings" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $sdelete = "SDelete is set for %d pass" ascii wide $dlihost = {77 00 73 00 [3] 5C 00 53 00 [3] 79 00 73 00 [3] 74 00 65 00 [3] 6D 00 33 00 [3] 32 00 5C 00 [3] 63 00 6D 00 [3] 64 00 2E 00 [3] 65 00 78 00 [3] 65 00 00 00 [3] 43 00 3A 00 [3] 5C 00 57 00 [3] 69 00 6E 00 [3] 64 00 6F 00 [3] 77 00 73 00 [3] 5C 00 64 00 [3] 6C 00 49 00 [3] 68 00 6F 00 [3] 73 00 74 00 [3] 2E 00 65 00 [3] 78 00 65 00} condition: uint16(0) == 0x5a4d and filesize < 2MB and all of them } rule M_APT_Disrupt_NIKOWIPER_MBR_1 { meta: author = "Mandiant" description = "Detects code in NIKOWIPER.MBR" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $ = {FF 37 FF 15 [4] 8B 4D F8} $ = {69 C0 60 EA 00 00 50 FF 15} $ = {8D 85 90 FB FF FF 68 00 02 00 00 50 E8} $ = {68 ?? ?? 02 00 68 [4] 56 FF 15} $ = {68 00 00 07 00 57 FF D0} $ = {8B B5 9C FB FF FF C1 E6 04} condition: uint16(0) == 0x5a4d and filesize < 2MB and all of them } rule M_Hunting_Windows_Powershell_CharSubstitutionFunction_1 { meta: author="Mandiant" description="Finds a function that does a character substitution" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $func_strTr = /public\sString.{1,100}\(string\s.{1,100},\sstring\s.{1,100},\sstring\s.{1,100}\)\s*\{\s*String\s[\w\d_]+\s?=\s?\"\";\s*for\(int\s[\w\d_]+=0;\s?[\w\d_]+\<\s?[\w\d_]+\.Length;\s?[\w\d_]+\+\+\)\s*\{\s*int\s[\w\d_]+\s?=\s?[\w\d_]+\.IndexOf\([\w\d_]+\[[\w\d_]+\]\);\s*if\([\w\d_]+\s?!=\s?-\d\)\s*[\w\d_]+\s?\+=\s?[\w\d_]+\[[\w\d_]+\];\s*else\s*[\w\d_]+\s?\+=\s?[\w\d_]+\[[\w\d_]+\];\s*\}\s*return\s[\w\d_]+;\s*\}/is condition: filesize < 2MB and all of them } rule M_Hunting_Windows_Powershell_HTTPHeaderParsing_1 { meta: author="Mandiant" description="Finds powershell 1-liners typically used in webshells to decode an HTTP header variable and use it as a command" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $httpParser1 = /getstring\(convert\.frombase64string\(([\w\d_]+)?\(request\.headers\.get\(['"][\w\d_]+['"]/ ascii wide nocase condition: filesize < 2MB and all of them } rule M_Hunting_REGEORG_Tunneller_Generic_1 { meta: author = "Mandiant" description = "Detects REGEORG" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $s1 = "System.Net.IPEndPoint" $s2 = "Response.AddHeader" $s3 = "Request.InputStream.Read" $s4 = "Request.Headers.Get" $s5 = "Response.Write" $s6 = "System.Buffer.BlockCopy" $s7 = "Response.BinaryWrite" $s8 = "SocketException soex" condition: filesize < 1MB and 7 of them } rule M_APT_Webshell_BRUSHPASS_1 { meta: author = "Mandiant" description = "Detects the string in the BRUSHPASS webshell" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $ = ".DataSource = " $ = "<%@ Page Language=" $ = "RedirectStandardOutput = true;" $ = "UseShellExecute = false;" $ = ".WindowStyle = ProcessWindowStyle.Hidden;" $ = " -Direction inbound -Profile Any -Action Allow -LocalPort" condition: filesize < 5MB and all of them } rule M_APT_Dropper_NEWRETURN_2 { meta: author = "Mandiant" description = "Detects strings in the NEWRETURN payloads" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $a1 = "GetLists" $a2 = "GetBuffer" $a3 = "Delays" $a4 = "InvokeMember" $a5 = "Array" $o1 = {1f 8b 08 00 00 00 00 00 04 00} $o2 = "http://" $a6 = "Form1" $a7 = "mscoree.dll" condition: all of ($a*) and ($o1 or $o2) } rule M_APT_Dropper_ILLICITORDER_1 { meta: author = "Mandiant" description = "Detects code segments in the ILLICITORDER dropper" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $push_8nn = {41 B8 3? 03 00 00 48 8B} $mov_8nn = {49 8B 9D 3B 03 00 00} $string_autorun = {C7 [3] 4f 66 66 69 C7 [3] 63 65 5c 41 c7 [3] 55 54 4f 52 c7 [3] 55 4e 2e 65 c7 [3] 78 65} $xor_13 = {B8 4F EC C4 4E F7 E9 C1 FA 02 8B C2 C1 E8 1F 03 D0 6B D2 0D 8B C1 2B C2} $xor_13_2 = {B9 0D 00 00 00 F7 F9 8B C2} $import_CryptStringToBinaryA = "CryptStringToBinaryA\x00" condition: uint16(0) == 0x5a4d and filesize < 10MB and ($push_8nn or $string_autorun or $mov_8nn) and ($xor_13 or $xor_13_2) and $import_CryptStringToBinaryA } rule M_APT_Backdoor_SPAREPART_Strings { meta: author = "Mandiant" description = "Detects the PDB and a struct used in SPAREPART" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $pdb = "c:\\Users\\user\\Desktop\\ImageAgent\\ImageAgent\\PreAgent\\src\\builder\\agent.pdb" ascii nocase $struct = { 44 89 ac ?? ?? ?? ?? ?? 4? 8b ac ?? ?? ?? ?? ?? 4? 83 c5 28 89 84 ?? ?? ?? ?? ?? 89 8c ?? ?? ?? ?? ?? 89 54 ?? ?? 44 89 44 ?? ?? 44 89 4c ?? ?? 44 89 54 ?? ?? 44 89 5c ?? ?? 89 5c ?? ?? 89 7c ?? ?? 89 74 ?? ?? 89 6c ?? ?? 44 89 74 ?? ?? 44 89 7c ?? ?? 44 89 64 ?? ?? 8b 84 ?? ?? ?? ?? ?? 44 8b c8 8b 84 ?? ?? ?? ?? ?? 44 8b c0 4? 8d 15 ?? ?? ?? ?? 4? 8b cd ff 15 ?? ?? ?? ?? } condition: (uint16(0) == 0x5A4D) and uint32(uint32(0x3C)) == 0x00004550 and $pdb and $struct and filesize < 20KB } rule M_APT_Backdoor_SPAREPART_SleepGenerator { meta: author = "Mandiant" description = "Detects the algorithm used to determine the next sleep timer" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $ = {C1 E8 06 89 [5] C1 E8 02 8B} $ = {c1 e9 03 33 c1 [3] c1 e9 05 33 c1 83 e0 01} $ = {8B 80 FC 00 00 00} $ = {D1 E8 [4] c1 E1 0f 0b c1} condition: all of them } rule M_APT_Backdoor_QUICKTOW_1 { meta: author = "Mandiant" description = "Hunting rule looking for QUICKTOW by strings." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $useragent = {4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 4f 57 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 30 31 2e 30 2e 34 39 35 31 2e 35 34 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36} $s1 = "NewErgoClientSessions" ascii nocase $s2 = "SetDisconnected" ascii nocase $s3 = "IsDisconnected" ascii nocase $s4 = "getDelay" ascii nocase $s5 = "setDelay" ascii nocase $s6 = "getMessagesFromServer" ascii nocase $s7 = "getOneMessageFromServer" ascii nocase $s8 = "getMessagesFromServer" ascii nocase condition: ((uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) or uint16(0) == 0x457f) and filesize < 20MB and $useragent and (6 of ($s*)) } rule M_APT_Backdoor_QUICKTOW_2 { meta: author = "Mandiant" description = "Function names matching QUICKTOW" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $go = "Go build" ascii wide $str1 = "main.(*Client).Auth" ascii wide $str2 = "main.(*Client).Disconnect" ascii wide $str3 = "main.(*Client).Disconnect.func1" ascii wide $str4 = "main.(*Client).IsDisconnected" ascii wide $str5 = "main.(*Client).MakeMessage" ascii wide $str6 = "main.(*Client).NewErgoClientSessions" ascii wide $str7 = "main.(*Client).NewHTTPHandler" ascii wide $str8 = "main.(*Client).NewSession" ascii wide $str9 = "main.(*Client).ProcessingMessages" ascii wide $str10 = "main.(*Client).RandomSleep" ascii wide $str11 = "main.(*Client).SetDisconnected" ascii wide $str12 = "main.(*Client).getDelay" ascii wide $str13 = "main.(*Client).getMessagesFromServer" ascii wide $str14 = "main.(*Client).getOneMessageFromServer" ascii wide $str15 = "main.(*Client).setDelay" ascii wide $str16 = "main.(*ErgoHTTPHandler).Lock" ascii wide $str17 = "main.(*ErgoHTTPHandler).Unlock" ascii wide $str18 = "main.(*ErgoHTTPHandler).doRequest" ascii wide $str19 = "main.(*Session).IsAlive" ascii wide $str20 = "main.(*Session).Lock" ascii wide $str21 = "main.(*Session).MakeMessage" ascii wide $str22 = "main.(*Session).ResetAlive" ascii wide $str23 = "main.(*Session).SetAlive" ascii wide $str24 = "main.(*Session).Unlock" ascii wide $str25 = "main.(*Session).getDelay" ascii wide $str26 = "main.(*Session).getMessagesForSession" ascii wide $str27 = "main.(*Session).getOneMessageForSession" ascii wide $str28 = "main.(*Session).handle" ascii wide $str29 = "main.(*Session).handle.func1" ascii wide $str30 = "main.(*Session).processingMessage" ascii wide $str31 = "main.(*Session).setDelay" ascii wide $str32 = "main.(*Sessions).Add" ascii wide $str33 = "main.(*Sessions).Range" ascii wide $str34 = "main.GetHash" ascii wide $str35 = "main.NewAddress" ascii wide $str36 = "main.NewClient" ascii wide condition: (uint16(0) == 0x5a4d or uint16(0) == 0x457f) and filesize < 20MB and $go and 30 of ($str*) } rule M_APT_Backdoor_EARLYBLOOM_1 { meta: author = "Mandiant" description = "Code blocks indicative of EARLYBLOOM." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $code1 = { 8B 4D ?? 3B 4D ?? 73 24 8B 55 ?? 8B 45 ?? 8B 0A 33 48 ?? 8B 55 ?? 89 0A 8B 45 ?? 83 C0 ?? 89 45 ?? 8B 4D ?? 83 C1 ?? 89 4D ?? EB CB } $code2 = { 83 7D ?? 00 7C 20 8B 45 ?? 83 E0 ?? 83 E8 ?? F7 D0 89 45 ?? 8B 4D ?? D1 E9 8B 55 ?? 23 55 ?? 33 CA 89 4D ?? EB D1 } condition: uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and all of them } rule M_APT_Backdoor_EARLYBLOOM_2 { meta: author = "Mandiant" description = "Hunting rule looking for EARLYBLOOM, a backdoor written in C++ that communicates over HTTPS." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $a1 = "bsd.bst" xor $a2 = "bat.bdt" xor $a3 = "chkdsk.exe" xor $a4 = "Windows check disk" xor $a5 = "https://" xor condition: uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550 and filesize <300KB and 3 of ($a*) } rule M_Hunting_TANKTRAP_XML_1 { meta: author = "Mandiant" description = "Strings associated TANKTRAP XML GPO policy" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $r1 = /ImmediateTask clsid=\"\{9F030D12-DDA3-4C26-8548-B7CE9151166A\}\" name=\"[a-zA-Z]{5}\"/ condition: filesize < 5MB and all of them } rule M_Hunting_TANKTRAP_PS1_1 { meta: author = "Mandiant" description = "Strings associated TANKTRAP PowerShell" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $s1 = "ImmediateTaskV2 clsid = \"{9756B581-76EC-4169-9AFC-0CA8D43ADB5F}\"" $s2 = "SharpGPOAbuse" $s3 = "GuidExtension \"AADCED64-746C-4633-A97C-D61349046527\"" $s4 = "ImmediateTaskV2 clsid = \"\"{9756B581-76EC-4169-9AFC-0CA8D43ADB5F}\"" condition: filesize < 5MB and 3 of them } rule M_APT_Launcher_ARGUEPATCH_1 { meta: author = "Mandiant" description = "Identifies the code used by the sleep functionality in ARGUEPATCH" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $ = {2b ?? 81 f? 00 2E 93 02} $ = {83 C0 18 6B C0 3C [5-12] 69 C0 60 EA 00 00} $ = {68 00 DD 6D 00} condition: filesize < 5MB and all of them } rule M_APT_Launcher_ARGUEPATCH_2 { meta: author = "Mandiant" description = "To detect executable with patched function used to load encrypted shellcode" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: /* XOR loop: .text:004719C6 xor_loop: ; CODE XREF: PATCHED+468 .text:004719C6 8A 01 mov al, [ecx] ; 8A 01 .text:004719C8 33 D2 xor edx, edx ; 33 D2 .text:004719C8 .text:004719CA .text:004719CA xor_loop_inner: ; CODE XREF: PATCHED+45F .text:004719CA 8B 7D F8 mov edi, [ebp+String] ; 8B 7D ?? .text:004719CD 32 04 57 xor al, [edi+edx*2] ; 32 04 57 .text:004719D0 42 inc edx ; 42 .text:004719D1 88 01 mov [ecx], al ; 88 01 .text:004719D3 83 FA 10 cmp edx, 16 ; 83 FA 10 .text:004719D6 72 F2 jb short xor_loop_inner ; 72 F2 .text:004719D6 .text:004719D8 FF 4D FC dec [ebp+var_4] ; FF 4D ?? .text:004719DB 41 inc ecx ; 41 .text:004719DC 39 5D FC cmp [ebp+var_4], ebx ; 39 5D ?? .text:004719DF 75 E5 jnz short xor_loop ; 75 E5 */ $xor_loop = {8A 01 33 D2 8B 7D ?? 32 04 57 42 88 01 83 FA 10 72 F2 FF 4D ?? 41 39 5D ?? 75 E5} condition: (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $xor_loop } rule M_APT_Launcher_ARGUEPATCH_3 { meta: description = "arguepatch malware family" author= "Mandiant" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $p00_0 = {85ff74??83ff??75??33db8bfbeb??a1[4]6a} $p00_1 = {8a064684c075??2bf23bf35e73??51} $p01_0 = {2bc183e0??3d[4]72??8b51??83c0??2bca83c1??83f9} $p01_1 = {75??eb??803d[5]74??cc68[4]e8[4]803d[5]74} condition: uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and ( ($p00_0 in (92000..99000) and $p00_1 in (640..8300)) or ($p01_0 in (170000..190000) and $p01_1 in (140000..160000)) ) } rule M_APT_Dropper_FREETOW_1 { meta: author = "Mandiant" description = "Detects FREETOW" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $hex49_add_arg_check = { 83 C1 49 88 08 FF D0 } $shell32_stack_string = { C7 ( 41 | 42 | 43 | 45 | 46 | 47 ) ?? 73 68 65 6C C7 ( 41 | 42 | 43 | 45 | 46 | 47 ) ?? 6C 33 32 2E C7 ( 41 | 42 | 43 | 45 | 46 | 47 ) ?? 64 6C 6C 00 } condition: filesize < 5MB and all of them } rule M_APT_Dropper_FREETOW_2 { meta: author = "Mandiant" description = "Detects FREETOW" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $push_ror13_api_hash_getcommandlinew = { 68 55 CE E0 2E } $push_ror13_api_hash_loadlibrary = { 68 4C 77 26 07 } $push_ror13_api_hash_virtualalloc = { 68 58 A4 53 E5 } $ror13_api_hash_commandlinetoargw = { 11 4B AF 1C } condition: filesize < 5MB and all of them } rule M_APT_Dropper_FREETOW_3 { meta: author = "Mandiant" description = "Detects FREETOW" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $func_args1 = { 6A 40 68 00 10 00 00 6A 10 6A 00 } $func_args2 = { 6A 40 68 00 10 00 00 68 00 00 40 00 6A 00 } condition: all of them } rule M_APT_Dropper_FREETOW_4 { meta: author = "Mandiant" description = "Patched ftp with shellcode, run with z option to launch." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $h1 = {0FB70983 C1498808 FFD0} // 0F B7 09 movzx ecx, word ptr [ecx] // 83 C1 49 add ecx, 49h ; 'I' // 88 08 mov [eax], cl // FF D0 call eax $h2 = {80CAFF2A 11881141 3BC876F4} // 80 CA FF or dl, 0FFh ; // 2A 11 sub dl, [ecx] // 88 11 mov [ecx], dl // 41 inc ecx // 3B C8 cmp ecx, eax // 76 F4 jbe short loc_1001757 $s1 = "local-file:" $s2 = "xpsp2res.dll" $s3 = "anonymous" condition: uint16(0) == 0x5A4D and filesize < 50KB and all of them } rule M_APT_Worm_Win32_ITCHYSPARK_1 { meta: author = "Mandiant" description = "Looking for ITCHYSPARK samples based on opcode patterns observed on relevant functions." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $b1 = {5? 5? 8B ?? 8B [2] 2B ?? C1 ?? 02 8D [2] 8D [2] 8D [2] 85 ?? 7? ?? 8B ?? 8D [2] 8B ?? 33 ?? 8B ?? 4? 89 ?? 8D ?? 85 ?? 7? ?? 8B ?? 81 ?? A3 B1 29 4A 5? 5? 5? C3} $b2 = {6A 01 5? 6A 00 FF ?? 83 F8 ?? 0F 8? [4] 8B [2] E8 [4] 8B ?? 85 ?? 0F 8? [4] 6A 01 8D [2] 5? 5? FF ?? 85 C0 0F 8? [4] 33 ?? 89 [2] 39 ?? 0F 8? [4] 8D [2] 89 [2] 83 [2] 02 0F 8? [4] 83 [2] 04 0F 8?} $b3 = {5? 5? 5? 68 AE 00 00 00 6A 02 89 [2] 89 [2] FF ?? 83 ?? 6F 0F 8? [4] 8B [2] E8 [4] 8B ?? 89 [2] 85 ?? 0F 8? [4] 8D [2] 5? 5? 6A 00 68 AE 00 00 00 6A 02 FF ?? 85 ?? 0F 8?} $b4 = {5? 6A 65 5? 89 [2] FF 15 [4] 85 C0 0F 8? [4] 8B [2] 85 C0 0F 8? [4] [4-12] 85 ?? 0F 8? [4] 81 ?? F4 01 00 00 7?} condition: (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them } rule M_APT_Worm_Win32_ITCHYSPARK_2 { meta: author = "Mandiant" description = "Looking for WMI spreader component of ITCHYSPARK (ITCHYSPARK.WMI) samples based on opcodes observed at relevant functions." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $b1 = {5? 6A 03 6A 09 5? 68 [4] 68 [4] FF 15 [4] 85 C0 7? ?? FF 74 24 ?? FF 15 [4] FF 74 24 ?? FF 15} $b2 = {8B [5] 68 FF 01 0F 00 FF [2] 5? FF ?? 85 C0 7? ?? 32 ?? EB ?? 8B ?? E8 [4] 88 [2] 84 ?? 7? ?? 68 88 13 00 00 FF 15 [4] 68 FF 01 0F 00 FF [2] 5? FF ?? 85 C0 7?} $b3 = {5? [0-2] 5? 5? 5? FF 15 [4] 85 C0 7? ?? FF 15 [4] 3D 1D 04 00 00 7? ?? B0 01 EB ?? 83 ?? 1E 7? ?? 68 E8 03 00 00 FF 15 [4] 4? 8B ?? E8 [4] 83 F8 04 7? ?? EB ?? 32 C0 5? 5? C3} $b4 = {6A 00 FF 76 ?? FF 76 ?? FF 15 [4] 85 C0 0F 95 ?? 85 C0 7? ?? 6A 41 [0-12] 6A 44 [0-12] 6A 4D [0-12] 6A 49 [0-12] 6A 4E [0-12] 6A 24 [0-12] FF 76 [0-12] FF 76 [0-12] FF 76 ?? E8 [4] 83 C4 0C 88 [2] 6A 00 FF 76 ?? FF 76 ?? FF 15 [4] 85 C0 0F 95} condition: (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them } rule M_APT_Worm_Win32_ITCHYSPARK_3 { meta: author = "Mandiant" description = "Looking for SMB spreader component of ITCHYSPARK (ITCHYSPARK.SMB) samples based on op code patterns observed on relevant functions." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $b1 = { E8 [4] 5? 84 C0 7? ?? 8D ?? 24 ?? 5? 68 02 02 00 00 FF 15 [4] 85 C0 7? ?? 8D ?? 24 ?? 8D ?? 24 ?? 4? FF 15 [4] 5? FF 15 } $b2 = { 80 ?? 01 7? ?? 80 ?? 02 7? ?? 33 ?? B? [4] 80 ?? 01 6A 04 5? 0F 45 ?? 0F B7 ?? 33 C0 80 F? 01 0F 45 ?? 80 F? 02 7? ?? 6A 02 5? B? [4] 33 ?? 33 ?? 66 3B ?? 7? ?? 8B [2] 0F B7 ?? 8B [2] 89 [2] E8 [4] 8B ?? 83 F? 12 7? ?? 4? 66 3B ?? 7? } $b3 = { ( 68 | FF ) [2-4] FF 7? ?? 68 [4] 5? E8 [4] A1 60 F0 04 10 8B ?? 89 45 ?? 66 A1 [4] 66 89 45 ?? [4-12] E8 [4] 6A 12 5? } $b4 = { 33 ?? 89 [2] 8B ?? 85 [4] 89 46 ?? 33 C0 89 [2] 66 39 45 ?? 7? ?? 8B [2] EB ?? 0F B7 ?? 4? 89 [2] 8B ?? 85 [4] 8B [2] [8-16] 85 ?? 7? ?? 6A 00 33 C0 4? 5? 6A 02 5? 5? FF } $b5 = { E8 [4] 3B ?? 7? ?? 8B [2] B? 06 02 FC 23 3B ?? 7? ?? 7? ?? 3? 05 01 28 0A 7? ?? 3? 05 02 CE 0E 7? ?? 3? 06 00 72 17 7? ?? 3? 06 01 B0 1D 7? ?? 3? 06 01 B1 1D 7? ?? 3? 06 02 F0 23 7? ?? [0-32] 3? 06 03 80 25 7? ?? 3? 0A 00 00 28 7? ?? 3? 0A 00 5A 29 7? ?? 3? 0A 00 39 38 7? ?? 3? 0A 00 D7 3A 7? ?? B? 9A 08 00 00 EB ?? } condition: (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and 3 of them } rule M_APT_Tunneler_GOGETTER_1 { meta: author = "Mandiant" description = "Hunting for GOGETTER ELF files." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $g1 = "go.buildid" $g2 = "Go build ID:" $g3 = "Go buildinf:" $proxy1 = "proxy/pkg/client.(*Client)" $proxy2 = "proxy/pkg/" $yamux = "hashicorp/yamux" condition: filesize < 25MB and uint32(0) == 0x464c457f and any of ($g*) and all of ($proxy*) and $yamux } rule M_APT_Tunneler_GOGETTER_2 { meta: author = "Mandiant" description = "Detects GOGETTER" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $s1 = "\x00github.com/hashicorp/yamux.Client\x00" $s2 = "\x00github.com/hashicorp/yamux.(*Session).AcceptStream\x00" $sb1 = { 8D ?? 24 [1-5] 89 04 24 E8 [4-5] 8B 44 24 [1-2] 8B 4C 24 [4-32] 83 ?? 03 75 0D 66 81 3? 65 6E 75 06 80 7? 02 64 7? [1-2] C7 04 24 00 00 00 00 E8 } condition: (uint32(0) == 0x464c457f) and all of them } rule M_APT_Tunneler_GOGETTER_3 { meta: author = "Mandiant" description = "Detects GOGETTER" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $sb1 = { 48 C7 ?? 24 [4] 00 10 00 00 48 C7 ?? 24 [4] 00 10 00 00 48 8D 15 [4] 48 89 ?? 24 [4] 48 8B ?? 24 ?? 48 89 ?? 24 [4] 48 C7 ?? 24 [4] FF FF FF FF 48 C7 ?? 24 [4] FF FF FF FF [32-150] 48 8D ?? 24 [4] 0F 1F 40 00 E8 [4] 48 8? ?? 0F 85 [4] 48 89 ?? 24 ?? 48 89 ?? 24 ?? 48 89 D9 48 89 C3 48 8D 44 24 ?? E8 [4] 48 89 ?? 24 ?? 48 89 ?? 24 ?? E8 [4] 48 8B 4C 24 ?? 0F 1F 40 00 48 3? ?? 7? ?? 48 8? ?? 48 8B 44 24 ?? E8 [4] 84 C0 } condition: (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them } rule M_APT_Wiper_CADDYWIPER_1 { meta: author = "Mandiant" description = "Searches code segments in CADDYWIPER" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: // C7 45 FC 44 3A 5C 00 mov [ebp+var_4], '\:D' $ = {c7 ?? ?? 44 3A 5C 00} // B8 00 00 A0 00 mov eax, 0A00000h $ = {B8 00 00 A0 00} /* 51 push ecx 68 54 C0 07 00 push 7C054h */ $ = {51 68 54 C0 07 00} condition: filesize < 3MB and all of them } rule M_APT_Wiper_CADDYWIPER_2 { meta: author = "Mandiant" description = "Searches for the Physical Device call within CADDYWIPER" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: // LocalAlloc, push 0xa00000 and 0x40 $ = {00 00 A0 00} $ = {43 3A 5C 55 C7 ?? ?? 73 65 72 73} $ = {C7 45 FC 44 3A 5C 00} // d:\\ //$ = {68 54 C0 07 00} condition: all of them } rule M_APT_Disrupt_NEARTWIST_1 { meta: author = "Mandiant" description = "Detects NEARTWIST" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $mersenne_alg = { D1 EA 83 E1 01 69 C9 DF B0 08 99 33 CA } $s1 = "PhysicalDrive" wide fullword $wipe_drive = { 6A 00 6A 00 6A 03 6A 00 6A 03 68 00 00 00 C0 [0-32] FF 15 [4-64] 5? 6A 00 6A 00 6A 00 6A 00 68 18 00 09 00 5? FF 15 [4-256] 68 00 00 01 00 [0-32] FF 15 } $wipe_file = { 6A 00 6A 00 6A 03 6A 00 6A 03 68 00 00 00 C0 [0-32] FF 15 [4-64] 5? 5? FF 15 [4-32] 6A 00 68 00 00 01 00 5? 5? E8 } condition: (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them } rule M_APT_Wiper_Win32_NEARTWIST_1 { meta: author = "Mandiant" description = "Looking for NEARTWIST samples based on opcode patterns observed on relevant functions." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $b1 = {68 05 01 00 00 8D [4-6] 5? FF 15 [4] 85 C0 0F 8? [4] 3? 05 01 00 00 0F 8? [4] 8B 85 [4-5] 85 C0 0F 8?} $b2 = {FF 15 [4] 89 8? [4-6] B? 01 00 00 00 [4-32] C1 ?? 1E 33 ?? 69 ?? 65 89 07 6C 03 ?? 89 [6] 4? (3D|81 FA) 70 02 00 00 7? ?? B? 70 02 00 00 } $b3 = {6A 00 5? 68 00 00 01 00 8D ?? 24 [4] 5? 5? FF 15 [4] 85 C0 7? ?? 8B 44 24 ?? 3D 00 00 01 00 7? ?? 2B ?? 83 ?? 00 E9} condition: (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them } rule M_APT_Wiper_Win_NEARTWIST_1 { meta: author = "Mandiant" description = "Looking for NEARTWIST samples based on strings, imports, and constants for Mersenne Twister / ISAAC PRNG." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $b1 = { 65 89 07 6C } $b2 = { AD 58 3A FF } $b3 = { 8C DF FF FF } $i1 = "GetTickCount" $i2 = "DeviceIoControl" $i3 = "GetLogicalDrives" $i4 = "FindFirstFile" $i5 = "FindNextFile" $i6 = "WriteFile" $i7 = "GetDiskFreeSpaceEx" $i8 = "CreateThread" $i9 = "GetWindowsDirectory" $i10 = "GetTempFileName" $n1 = "Cleaner.exe" ascii fullword wide $n2 = "Cleaner.dll" ascii fullword wide $s1 = "PhysicalDrive" ascii fullword wide $s2 = "\\\\.\\" ascii fullword wide $s3 = "*.*" ascii fullword wide $s4 = "Tmf" ascii fullword wide $s5 = "Tmd" ascii fullword wide condition: (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of ($n*) and all of ($s*) and all of ($i*) and all of ($b*) } rule M_APT_Disrupt_PARTYTICKET_1 { meta: author = "Mandiant" description = "Looking for PARTYTICKET samples via strings." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $s1 = "/403forBiden/" ascii wide $s2 = "/wHiteHousE/" ascii wide $s3 = "partyTicket." ascii wide $s4 = "vote_result." ascii wide $s5 = ".encryptedJB" ascii wide $f1 = "/wHiteHousE.baggageGatherings" ascii wide $f2 = "/wHiteHousE.primaryElectionProcess" ascii wide $f3 = "/wHiteHousE.GoodOffice1" ascii wide $f4 = "/wHiteHousE.lookUp" ascii wide $f5 = "/wHiteHousE.init" ascii wide $m1 = "

Thank you for your vote! All your files, documents, photoes, videos, databases etc. have been successfully encrypted!

" ascii wide fullword $m2 = "

Now your computer has a special ID:

" ascii wide fullword $m3 = "

NOTE: Do not send file with sensitive content. In the email write us your computer's special ID (mentioned above)." ascii wide fullword condition: uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and (3 of ($s*) or 3 of ($f*) or 2 of ($m*)) } rule M_APT_Disrupt_PARTYTICKET_2 { meta: author = "Mandiant" description = "Looking for PARTYTICKET samples via opcode patterns observed on relevant functions." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $b1 = {48 83 F8 1B 0F 8D [4] 48 89 [3] 48 89 [3] 48 89 [3] 48 8D 35 [4] 0F B6 3C 06 81 FF 80 00 00 00 0F 8? [4] 48 FF C0 [16-32] E8 [16-64] E8 [8-32] E8 [4] 48 8B 44 24 ?? 48 85 C0 7? ?? [8-24] E9} $b2 = {48 83 F8 37 0F 8D [24-32] E8 [16-32] E8 [16-32] 48 C1 E? 04 [8-16] 7? ?? 0F B6 44 24 ?? EB ?? [8-16] E8 [4] 0F B6 44 24 ?? 84 C0 7? ?? [4-8] B8 01 00 00 00 E9 } $b3 = {3D 77 69 6E 64 0F 85 [4-12] 66 3D 6F 77 0F 85 [4-12] 3C 73 0F 85 [4] E8 [4] [8-24] 31 ?? EB} condition: uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and all of them } rule M_APT_Distupt_NEARMISS_1 { meta: author = "Mandiant" description = "Detects NEARMISS" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $code_fat_corruption = { 8B ?? 56 8B ?? 52 [1-64] 0F B? ?? 16 [1-32] 8B ?? 24 [0-32] 0F B? ?? 0D [1-32] 0F B? ?? 10 [1-32] 0F B? ?? 0E } $code_ntfs_corruption = { 0F B? ?? 0B 0F B? ?? 0D [1-64] FF ?? 34 FF ?? 30 [1-64] 0F B? ?? 0B [1-64] FF ?? 3C FF ?? 38 } $s1 = "\\\\.\\PhysicalDrive%u" fullword wide $s2 = "\\\\.\\EPMNTDRV\\%u" fullword wide $s3 = "DRV_X64" fullword wide $s4 = "DRV_X86" fullword wide $s5 = "DRV_XP_X64" fullword wide $s6 = "DRV_XP_X86" fullword wide $s7 = "$ATTRIBUTE_LIST" fullword wide $s8 = "$EA_INFORMATION" fullword wide $s9 = "$SECURITY_DESCRIPTOR" fullword wide $s10 = "$INDEX_ROOT" fullword wide $s11 = "$INDEX_ALLOCATION" fullword wide $s12 = "$LOGGED_UTILITY_STREAM" fullword wide condition: (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (8 of ($s*) or all of ($code*)) } rule M_Hunting_Win32_NEARMISS_1 { meta: author = "Mandiant" description = "rule looks for code present in NEARMISS samples. Based on a rule generated by symhunt for symfunc/cef8160083d485a3676d55b3fc5e1c42." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $c = { 55 8B EC 81 EC AC 08 ?? ?? 53 56 57 33 DB 89 4D E0 68 ?? ?? ?? ?? 8D 85 78 FC FF FF C7 45 DC ?? ?? ?? ?? 53 50 C7 45 E4 ?? ?? ?? ?? 89 5D F8 89 5D A4 E8 ?? ?? ?? ?? 83 C4 0C 68 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B F8 8D 85 78 FC FF FF 68 ?? ?? ?? ?? 50 FF ?? ?? ?? ?? ?? 83 C4 0C 89 45 F0 85 FF 74 ?? 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 8B D8 FF D6 68 ?? ?? ?? ?? 57 FF D6 8B F0 85 F6 74 ?? 8D 45 F8 50 FF } condition: filesize < 15MB and uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550 and any of them } rule M_Hunting_Win32_NEARMISS_2 { meta: author = "Mandiant" description = "rule looks for a specific stackstring - mangled SeShutdownPrivilege - found in NEARMISS samples." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $s1 = { 53 00 65 00 [4] 53 00 68 00 [4] 75 00 74 00 [4] 64 00 6F 00 [4] 9A 02 00 00 [4] 00 00 00 00 } $s2 = { 77 00 6E 00 [7] 50 00 72 00 } condition: filesize < 15MB and uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550 and all of them } rule M_Hunting_Win_WiperPaths_1 { meta: author = "Mandiant" description = "Detects notable wiper strings" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $w1 = "\\\\.\\EPMNTDRV" wide fullword $w2 = "\\\\.\\PhysicalDrive" wide fullword $w3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" wide fullword $w4 = "\\\\?\\C:\\Windows\\System32\\winevt\\Logs" wide fullword $w5 = "\\\\?\\C:\\Documents and Settings" wide fullword $w6 = "<>" wide fullword condition: uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and (all of them) } rule M_Webshell_PHP_WEEVELY_1 { meta: author = "Mandiant" description = "Weevely3 open source webshell detection from https://artikrh.github.io/posts/weevely-backdoor-analysis -- Webshell source code: https://github.com/epinna/weevely3/tree/master/core" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $php = " 500 and filesize < 1000 } rule M_Backdoor_Win_DARKCRYSTALRAT_Config_1 { meta: author = "Mandiant" description = "This rule looks for PE files containing part of DARKCRYSTALRAT configuration string. Configuration JSON is stored as base64 encoded, reversed, gzip compressed and again bas64 encoded string." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $s = { 48 00 34 00 73 00 49 00 41 00 41 00 41 00 41 00 41 00 41 00 41 00 45 00 41 00 46 00 32 00 54 00 58 00 58 00 75 00 69 00 4D 00 42 00 43 00 46 00 66 00 39 00 } condition: filesize < 15MB and uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550 and $s } rule M_Downloader_SHARPCOFFEE_1 { meta: author = "Mandiant" description = "Detects SHARPCOFFEE" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $str1 = "ActiveXObject(\"WScript.Shell\").Run(\"powershell.exe" nocase $str2 = "new-object net.webclient;" nocase $str3 = ".downloaddata('http" nocase $str4 = ".uploaddata('http" nocase $str5 = "[System.Net.Dns]" nocase condition: all of them } rule M_APT_Downloader_SHARPCOFFEEVBS_2 { meta: author = "Mandiant" description = "Detects SHARPCOFFE.VBS variant, a VBS script used to download and run a secondary payload, and upload the output of the secondary payload during the same script execution." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $vbs = "dim" ascii wide nocase $a1 = /\$\w{1,20}\.uploaddata\('http:\/\/.{1,20}\/page\d{1,3}',\$\w{1,10}\);/ $a2 = /=\$\w{1,20}\.downloaddata\('http:\/\/.{1,50}\/page\d{1,3}\/upgrade\.txt'\);if\(/ condition: filesize < 1MB and $vbs at 0 and any of ($a*) } rule M_Dropper_COLDWELL_Permission_Arch_Check_1 { meta: author = "Mandiant" description = "Detects COLDWELL" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $ = {C7 45 F? 00 05 50 C7 45 F? } $ = {C7 45 F? 00 00 00 00 C7 45 F? } $ = {0F 95 C3 6A 04 83 C3 [7] F7 D8 6A 0A} condition: all of them } rule M_Disrupt_ROARBAT_1 { meta: author = "Mandiant" description = "Detects ROARBAT" TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $ = "takeown /a /f \"%%" $ = "in (C:\\Users," $ = "a -df %" $ = "\" & del %" condition: all of them } rule M_Hunting_Backdoor_PowerShell_WILDDIME_Strings_1 { meta: author = "Mandiant" description = "Searching for PowerShell scripts with strings associated with WILDDIME." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $s1 = "GetEnviron" nocase ascii wide $s2 = "R64Encoder" nocase ascii wide $s3 = "R64Decoder" nocase ascii wide $s4 = "Send-HttpRequest" nocase ascii wide $s5 = "JVBERi0xLjcNCiW1tb" nocase ascii wide condition: filesize < 200KB and all of them } rule M_Hunting_Downloader_SHARPENTRY_1 { meta: author= "Mandiant" description="Detects code fragments connected to the payload decoding and mining routines found within SHARPENTRY." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $decode_routine = { 0F B6 ?? ?? 0F B6 ?? ?? 33 C2 88 ?? ?? 0F B6 ?? ?? 83 ?? 4D } $payload_mine = { 8B ?? ?? 03 ?? ?? 81 ?? 89 C3 81 C3 } condition: uint16(0) == 0x5A4D and $decode_routine and $payload_mine } rule M_Hunting_Dropper_SHARPIVORY_Strings_1 { meta: author = "Mandiant" description = "Searching for executables containing strings references to the SHARPIVORY code family." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $s1 = "WriteAllBytes" $s2 = "FromBase64String" $w1 = "schtasks.exe" wide $w2 = "kernel32.dll" wide $w3 = "/create /tn" wide $w4 = "/sc minute /mo 20 /f" wide condition: filesize < 5MB and uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and all of them } rule MTI_Hunting_INDUSTROYERv2_Bytes { meta: author = "Mandiant" description = "Searching for executables containing bytecode associated with the INDUSTROYER.V2 malware family." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $bytes = {8B [2] 89 [2] 8B 0D [4] 89 [2] 8B 15 [4] 89 [2] A1 [4] 89 [2] 8B 0D [4] 89 [2] 8A 15 [4] 88 [2] 8D [2] 5? 8B [2] E8} condition: filesize < 3MB and uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and $bytes } rule MTI_Hunting_INDUSTROYERv2_Strings { meta: author = "Mandiant" description = "Searching for executables containing strings associated with the INDUSTROYER.V2 malware family." TLP_level= "CLEAR" PAP_level= "CLEAR" strings: $a1 = "M%X - %02d:%02d:%02d" nocase ascii wide $a2 = "%02hu:%02hu:%02hu:%04hu" nocase ascii wide $a3 = "%s M%X " nocase ascii wide $a4 = "%s: %d: %d" nocase ascii wide $a5 = "%s M%X %d (%s)" nocase ascii wide $a6 = "%s M%X SGCNT %d" nocase ascii wide $a7 = "%s ST%X %d" nocase ascii wide $a8 = "Current operation : %s" nocase ascii wide $a9 = "Sent=x%X | Received=x%X" nocase ascii wide $a10 = "ASDU:%u | OA:%u | IOA:%u | " nocase ascii wide $a11 = "Cause: %s (x%X) | Telegram type: %s (x%X" nocase ascii wide $b1 = "Length:%u bytes | " nocase ascii wide $b2 = "Unknown APDU format !!!" nocase ascii wide $b3 = "MSTR ->> SLV" nocase ascii wide $b4 = "MSTR <<- SLV" nocase ascii wide condition: filesize < 3MB and uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and (1 of ($a*) and 1 of ($b*)) } rule CISA_10375867_01 : wiper HERMETICWIPER { meta: Author = "CISA Code & Media Analysis" Incident = "10375867" Date = "2022-04-05" Last_Modified = "20220406_1500" Actor = "n/a" Category = "Wiper" Family = "n/a" Description = "Detects Hermetic Wiper samples" MD5_1 = "382fc1a3c5225fceb672eea13f572a38" SHA256_1 = "2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf" MD5_2 = "decc2726599edcae8d1d1d0ca99d83a6" SHA256_2 = "3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767" MD5_3 = "84ba0197920fd3e2b7dfa719fee09d2f" SHA256_3 = "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da" MD5_4 = "3f4a16b29f2f0532b7ce3e7656799125" SHA256_4 = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591" MD5_5 = "f1a33b2be4c6215a1c39b45e391a3e85" SHA256_5 = "06086c1da4590dcc7f1e10a6be3431e1166286a9e7761f2de9de79d7fda9c397" strings: $rsrc1 = { 53 5A 44 44 } $rsrc2 = { 52 00 43 00 44 00 41 00 54 00 41 00 } $rsrc3 = { 44 00 52 00 56 00 5F 00 58 00 36 00 34 } $rsrc4 = { 44 00 52 00 56 00 5F 00 58 00 38 00 36 } $rsrc5 = { 44 00 52 00 56 00 5F 00 58 00 50 00 5F 00 58 00 36 00 34 } $rsrc6 = { 44 00 52 00 56 00 5F 00 58 00 50 00 5F 00 58 00 38 00 36 00 } $s1 = { 45 00 50 00 4D 00 4E 00 54 00 44 00 52 00 56 00 5C 00 25 00 75 } $s2 = { 50 00 68 00 79 00 73 00 69 00 63 00 61 00 6C 00 44 00 72 00 69 00 76 00 65 00 25 00 75 } $s3 = { 53 00 59 00 53 00 54 00 45 00 4D 00 5C 00 43 00 75 00 72 00 72 00 65 00 6E 00 74 00 43 00 6F 00 6E 00 74 00 72 00 6F 00 6C 00 53 00 65 00 74 00 5C 00 43 00 6F 00 6E 00 74 00 72 00 6F 00 6C 00 5C 00 43 00 72 00 61 00 73 00 68 00 43 00 6F 00 6E 00 74 00 72 00 6F 00 6C } $s4 = { 43 00 72 00 61 00 73 00 68 00 44 00 75 00 6D 00 70 00 45 00 6E 00 61 00 62 00 6C 00 65 00 64 } $s5 = { 24 00 49 00 4E 00 44 00 45 00 58 00 5F 00 41 00 4C 00 4C 00 4F 00 43 00 41 00 54 00 49 00 4F 00 4E } $s6 = { 53 00 65 00 4C 00 6F 00 61 00 64 00 44 00 72 00 69 00 76 00 65 00 72 00 50 00 72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 } $s7 = { 53 00 65 00 42 00 61 00 63 00 6B 00 75 00 70 00 50 00 72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 } $s8 = { 43 00 3A 00 5C 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 5C 00 53 00 59 00 53 00 56 00 4F 00 4C } condition: uint16(0) == 0x5A4D and ((3 of ($rsrc*)) and (7 of ($s*))) } rule CISA_10376640_01 : trojan wiper ISAACWIPER { meta: Author = "CISA Code & Media Analysis" Incident = "10376640" Date = "2022-03-14" Last_Modified = "20220418_1900" Actor = "n/a" Category = "Trojan Wiper" Family = "ISAACWIPER" Description = "Detects ISACC Wiper samples" MD5_1 = "aa98b92e3320af7a1639de1bac6c17cc" SHA256_1 = "abf9adf2c2c21c1e8bd69975dfccb5ca53060d8e1e7271a5e9ef3b56a7e54d9f" MD5_2 = "8061889aaebd955ba6fb493abe7a4de1" SHA256_2 = "afe1f2768e57573757039a40ac40f3c7471bb084599613b3402b1e9958e0d27a" MD5_3 = "ecce8845921a91854ab34bff2623151e" SHA256_3 = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033" strings: $s0 = { 73 00 74 00 61 00 72 00 74 00 20 00 65 00 72 00 61 00 73 00 69 00 6E 00 67 } $s1 = { 6C 00 6F 00 67 00 69 00 63 00 61 00 6C } $s2 = { 46 00 41 00 49 00 4C 00 45 00 44 } $s3 = { 5C 00 6C 00 6F 00 67 00 2E 00 74 00 78 00 74 } $s4 = { 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F } $s5 = {53 74 61 72 74 40 34} $s6 = {3B 57 34 74 2D 6A} $s7 = {43 6C 65 61 6E 65 72 2E} condition: all of ($s0,$s1,$s2,$s3,$s4) or all of ($s5,$s6,$s7) } rule CISA_10376640_02 : trojan wiper worm HERMETICWIZARD { meta: Author = "CISA Code & Media Analysis" Incident = "10376640" Date = "2022-03-12" Last_Modified = "20220413_1300" Actor = "n/a" Category = "Trojan Wiper Worm" Family = "HERMETICWIZARD" Description = "Detects Hermetic Wizard samples" MD5_1 = "0959bf541d52b6e2915420442bf44ce8" SHA256_1 = "5a300f72e221a228e3a36a043bef878b570529a7abc15559513ea07ae280bb48" strings: $s0 = { 70 00 69 00 70 00 65 00 5C 00 25 00 73 } $s1 = { 6E 00 6D 00 61 00 6E 00 73 00 65 00 72 00 76 } $s2 = { 73 61 6D 72 } $s3 = { 62 72 6F 77 73 65 72 } $s4 = { 6E 65 74 6C 6F 67 6F 6E } $s5 = { 6C 73 61 72 70 63 } $s6 = { 6E 74 73 76 63 73 } $s7 = { 73 76 63 63 74 6C } $s8 = { 73 74 61 72 74 20 63 6D 64 20 2F 63 20 22 70 69 6E 67 20 6C 6F 63 61 6C 68 6F 73 74 } $s9 = { 67 00 75 00 65 00 73 00 74 } $s10 = { 74 00 65 00 73 00 74 } $s11 = { 75 00 73 00 65 00 72 } $s12 = { 61 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F } $s13 = { 51 00 61 00 7A 00 31 00 32 00 33 } $s14 = { 51 00 77 00 65 00 72 00 74 00 79 00 31 00 32 } $s15 = { 63 6D 64 20 2F 63 20 73 74 61 72 74 20 72 65 67 } condition: all of them } rule CISA_10376640_03 : trojan wiper worm HERMETICWIZARD { meta: Author = "CISA Code & Media Analysis" Incident = "10376640" Date = "2022-03-13" Last_Modified = "20220413_1300" Actor = "n/a" Category = "Trojan Wiper Worm" Family = "HERMETICWIZARD" Description = "Detects Hermetic Wizard samples" MD5_1 = "58d71fff346017cf8311120c69c9946a" SHA256_1 = "2d29f9ca1d9089ba0399661bb34ba2fd8aba117f04678cd71856d5894aa7150b" strings: $s0 = { 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F } $s1 = { 5C 00 5C 00 25 00 73 00 5C 00 70 00 69 00 70 00 65 00 5C 00 25 00 73 } $s2 = { 64 00 6C 00 6C 00 00 00 2D 00 69 } $s3 = { 2D 00 68 00 00 00 00 00 2D 00 73 } $s4 = { 2D 00 63 00 00 00 00 00 2D 00 61 } $s5 = { 43 6F 6D 6D 61 6E 64 4C 69 6E 65 54 6F 41 72 67 76 57 } condition: all of them } rule CISA_10376640_04 : trojan wiper CADDYWIPER { meta: Author = "CISA Code & Media Analysis" Incident = "10376640" Date = "2022-03-23" Last_Modified = "20220324_1700" Actor = "n/a" Category = "Trojan Wiper" Family = "CADDYWIPER" Description = "Detects Caddy wiper samples" MD5_1 = "42e52b8daf63e6e26c3aa91e7e971492" SHA256_1 = "a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea" strings: $s0 = { 44 73 52 6F 6C 65 47 65 74 50 72 69 6D 61 72 79 44 6F 6D 61 69 6E } $s1 = { 50 C6 45 A1 00 C6 45 A2 48 C6 45 A3 00 C6 45 A4 59 C6 } $s2 = { C6 45 A6 53 C6 45 A7 00 C6 45 A8 49 C6 } $s3 = { C6 45 B0 44 C6 45 B1 00 C6 45 B2 52 } $s4 = { C6 45 B8 45 C6 45 B9 00 C6 45 BA 39 } $s5 = { C6 45 AC 43 C6 45 AD 3A C6 45 AE 5C C6 45 AF } $s6 = { 55 C6 45 B0 73 C6 45 B1 65 C6 45 B2 72 C6 45 B3 } $s7 = { C6 45 E0 44 C6 45 E1 3A C6 45 E2 5C C6 45 E3 } $s8 = { 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F } condition: all of them } rule CISA_10376640_05 : trojan wiper worm HERMETICWIZARD { meta: Author = "CISA Code & Media Analysis" Incident = "10376640" Date = "2022-04-14" Last_Modified = "20220414_1037" Actor = "n/a" Category = "Trojan Wiper Worm" Family = "HERMETICWIZARD" Description = "Detects Hermetic Wizard samples" MD5_1 = "517d2b385b846d6ea13b75b8adceb061" SHA256 = "a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec" strings: $s0 = { 57 69 7A 61 72 64 2E 64 6C 6C } $s1 = { 69 6E 66 6C 61 74 65 } $s2 = { 4D 61 72 6B 20 41 64 6C 65 72 } condition: all of them and filesize < 2000KB }