38 lines
1.4 KiB
Text
38 lines
1.4 KiB
Text
|
|
||
|
|
rule APT_MAL_MalDoc_CloudAtlas_Oct20_1 {
|
||
|
|
meta:
|
||
|
|
description = "Detects unknown maldoc dropper noticed in October 2020"
|
||
|
|
author = "Florian Roth (Nextron Systems)"
|
||
|
|
reference = "https://twitter.com/jfslowik/status/1316050637092651009"
|
||
|
|
date = "2020-10-13"
|
||
|
|
hash1 = "7ba76b2311736dbcd4f2817c40dae78f223366f2404571cd16d6676c7a640d70"
|
||
|
|
id = "e7caf2b2-caf2-5984-a792-8224f2641bda"
|
||
|
|
strings:
|
||
|
|
$x1 = "https://msofficeupdate.org" wide
|
||
|
|
condition:
|
||
|
|
uint16(0) == 0xcfd0 and
|
||
|
|
filesize < 300KB and
|
||
|
|
1 of ($x*)
|
||
|
|
}
|
||
|
|
|
||
|
|
rule APT_MAL_URL_CloudAtlas_Oct20_2 {
|
||
|
|
meta:
|
||
|
|
description = "Detects unknown maldoc dropper noticed in October 2020 - file morgue6visible5bunny6culvert7ambo5nun1illuminate4.url"
|
||
|
|
author = "Florian Roth (Nextron Systems)"
|
||
|
|
reference = "https://twitter.com/jfslowik/status/1316050637092651009"
|
||
|
|
date = "2020-10-13"
|
||
|
|
hash1 = "a6a58b614a9f5ffa1d90b5d42e15521f52e2295f02c1c0e5cd9cbfe933303bee"
|
||
|
|
id = "91f6362f-1793-58a3-a750-04ec9812b9df"
|
||
|
|
strings:
|
||
|
|
/* [InternetShortcut]
|
||
|
|
URL=https://msofficeupdate.org/ */
|
||
|
|
$hc1 = { 5B 49 6E 74 65 72 6E 65 74 53 68 6F 72 74 63 75
|
||
|
|
74 5D 0D 0A 55 52 4C 3D 68 74 74 70 73 3A 2F 2F
|
||
|
|
6D 73 6F 66 66 69 63 65 75 70 64 61 74 65 2E 6F
|
||
|
|
72 67 }
|
||
|
|
condition:
|
||
|
|
uint16(0) == 0x495b and
|
||
|
|
filesize < 200 and
|
||
|
|
$hc1 at 0
|
||
|
|
}
|