63 lines
2.6 KiB
Text
63 lines
2.6 KiB
Text
|
include "../../MachO.yara"
|
||
|
|
|
||
|
|
rule malware_macos_apt_sofacy_xagent
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "sofacy xagent for macOS"
|
||
|
|
reference_1 = "http://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"
|
||
|
|
reference_2 = "https://blog.malwarebytes.com/cybercrime/2017/03/two-new-mac-backdoors-discovered/"
|
||
|
|
author = "@mimeframe"
|
||
|
|
md5 = "4fe4b9560e99e33dabca553e2eeee510"
|
||
|
|
strings:
|
||
|
|
// malware commands
|
||
|
|
$a1 = "remoteShell" ascii wide
|
||
|
|
$a2 = "getInfoOSX" ascii wide
|
||
|
|
$a3 = "ftpUpload" ascii wide
|
||
|
|
$a4 = "startUploading" ascii wide
|
||
|
|
$a5 = "deleteFile:" ascii wide
|
||
|
|
$a6 = "executeShellCommand" ascii wide
|
||
|
|
$a7 = "getFirefoxPassword" ascii wide
|
||
|
|
$a8 = "generateRandomPathAndName" ascii wide
|
||
|
|
$a9 = "createCryptPacket" ascii wide
|
||
|
|
$a10 = "CameraShot" ascii wide
|
||
|
|
$a11 = "7Cryptor" ascii wide
|
||
|
|
$a12 = "8ICryptor" ascii wide
|
||
|
|
$a13 = "Keylogger" ascii wide
|
||
|
|
$a14 = "BootXLoader" ascii wide
|
||
|
|
$a15 = "InjectApp" ascii wide
|
||
|
|
// unique malware strings
|
||
|
|
$b1 = "/Project/XAgentOSX/" ascii wide
|
||
|
|
$b2 = "XLoader_OSX" fullword ascii wide
|
||
|
|
$b3 = "<span class='keylog_user_keys'>" ascii wide
|
||
|
|
$b4 = "<span class='keylog_process'>" ascii wide
|
||
|
|
$b5 = "<span class='keylog_spec_key'>" ascii wide
|
||
|
|
$b6 = "<font size=4 color=red><pre>Stop take screenshot</pre></font>" ascii wide
|
||
|
|
// c2 domains
|
||
|
|
$c1 = "http://23.227.196.215/" ascii wide
|
||
|
|
$c2 = "http://apple-iclods.org/" ascii wide
|
||
|
|
$c3 = "http://apple-checker.org/" ascii wide
|
||
|
|
$c4 = "http://apple-uptoday.org/" ascii wide
|
||
|
|
$c5 = "http://apple-search.info" ascii wide
|
||
|
|
// c2 URL paths
|
||
|
|
$d1 = "watch/?" fullword ascii wide
|
||
|
|
$d2 = "search/?" fullword ascii wide
|
||
|
|
$d3 = "find/?" fullword ascii wide
|
||
|
|
$d4 = "results/?" fullword ascii wide
|
||
|
|
$d5 = "open/?" fullword ascii wide
|
||
|
|
$d6 = "search/?" fullword ascii wide
|
||
|
|
$d7 = "close/?" fullword ascii wide
|
||
|
|
// c2 URL parameters
|
||
|
|
$e1 = "itwm=" fullword ascii wide
|
||
|
|
$e2 = "text=" fullword ascii wide
|
||
|
|
$e3 = "from=" fullword ascii wide
|
||
|
|
$e4 = "itwm=" fullword ascii wide
|
||
|
|
$e5 = "ags=" fullword ascii wide
|
||
|
|
$e6 = "btnG=" fullword ascii wide
|
||
|
|
$e7 = "oprnd=" fullword ascii wide
|
||
|
|
$e8 = "itwm=" fullword ascii wide
|
||
|
|
$e9 = "utm=" fullword ascii wide
|
||
|
|
$e10 = "channel=" fullword ascii wide
|
||
|
|
condition:
|
||
|
|
MachO and (5 of ($a*) or any of ($b*) or any of ($c*) or 4 of ($d*) or 5 of ($e*))
|
||
|
|
}
|