24 lines
799 B
Text
24 lines
799 B
Text
|
rule bad_ComputraceAgent
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "Absolute Computrace Agent Lacking Hardcoded Domain"
|
||
|
|
thread_level = 3
|
||
|
|
in_the_wild = true
|
||
|
|
reference = "https://pastebin.com/nsv0tqUg"
|
||
|
|
reference2 = "https://asert.arbornetworks.com/lojack-becomes-a-double-agent/"
|
||
|
|
reference3 = "https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$a = { D1 E0 F5 8B 4D 0C 83 D1 00 8B EC FF 33 83 C3 04 }
|
||
|
|
$b1 = { 72 70 63 6E 65 74 70 2E 65 78 65 00 72 70 63 6E 65 74 70 00 }
|
||
|
|
$b2 = { 54 61 67 49 64 00 }
|
||
|
|
|
||
|
|
$domain = { c6 d0 d4 c7 d6 dd 9b db d4 d8 d0 c4 c0 d0 c7 cc 9b d6 da d8 } // search.namequery.com XOR 0xb5
|
||
|
|
|
||
|
|
condition:
|
||
|
|
uint16(0) == 0x5a4d and
|
||
|
|
filesize < 20KB and
|
||
|
|
($a or ($b1 and $b2))
|
||
|
|
and not $domain
|
||
|
|
}
|