15 lines
715 B
Text
15 lines
715 B
Text
|
rule GhostWriter_MicroBackdoor_72632_00001 {
|
||
|
|
meta:
|
||
|
|
author = "Cluster25"
|
||
|
|
hash1 = "559d8e8f2c60478d1c057b46ec6be912fae7df38e89553804cc566cac46e8e91"
|
||
|
|
tlp = "white"
|
||
|
|
report = "https://blog.cluster25.duskrise.com/2022/03/08/ghostwriter-unc1151-adopts-microbackdoor-variants-in-cyber-operations-against-targets-in-ukraine"
|
||
|
|
strings:
|
||
|
|
$ = "cmd.exe /C \"%s%s\"" fullword wide
|
||
|
|
$ = "client.dll" fullword ascii
|
||
|
|
$ = "ERROR: Unknown command" fullword ascii
|
||
|
|
$ = " *** ERROR: Timeout occured" fullword ascii
|
||
|
|
$ = "%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword ascii
|
||
|
|
$ = "MIIDazCCAlOgAwIBAgIUWOftflCclQXpmWMnL1ewj2F5Y1AwDQYJKoZIhvcNAQEL" fullword ascii
|
||
|
|
condition: (uint16(0) == 0x5a4d and all of them)
|
||
|
|
}
|