/* Yara Rule Set Author: Florian Roth Date: 2017-06-13 Identifier: Industroyer Reference: https://goo.gl/x81cSy */ /* Rule Set ----------------------------------------------------------------- */ rule Industroyer_Malware_1 { meta: description = "Detects Industroyer related malware" license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE" author = "Florian Roth (Nextron Systems)" reference = "https://goo.gl/x81cSy" date = "2017-06-13" hash1 = "ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910" hash2 = "018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81" id = "f5ab571c-03a7-538a-ada1-0930d15af5cf" strings: $s1 = "haslo.exe" fullword ascii $s2 = "SYSTEM\\CurrentControlSet\\Services\\%ls" fullword wide $s3 = "SYS_BASCON.COM" fullword wide $s4 = "*.pcmt" fullword wide $s5 = "*.pcmi" fullword wide $x1 = { 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5C 00 25 00 6C 00 73 00 00 00 49 00 6D 00 61 00 67 00 65 00 50 00 61 00 74 00 68 00 00 00 43 00 3A 00 5C 00 00 00 44 00 3A 00 5C 00 00 00 45 00 3A 00 5C 00 00 00 } $x2 = "haslo.dat\x00Crash" condition: ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) or 2 of them ) } rule Industroyer_Malware_2 { meta: description = "Detects Industroyer related malware" license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE" author = "Florian Roth (Nextron Systems)" reference = "https://goo.gl/x81cSy" date = "2017-06-13" hash1 = "3e3ab9674142dec46ce389e9e759b6484e847f5c1e1fc682fc638fc837c13571" hash2 = "37d54e3d5e8b838f366b9c202f75fa264611a12444e62ae759c31a0d041aa6e4" hash3 = "ecaf150e087ddff0ec6463c92f7f6cca23cc4fd30fe34c10b3cb7c2a6d135c77" hash1 = "6d707e647427f1ff4a7a9420188a8831f433ad8c5325dc8b8cc6fc5e7f1f6f47" id = "0561a7bb-3b6c-5caf-9131-04924cee1e0f" strings: $x1 = "sc create %ls type= own start= auto error= ignore binpath= \"%ls\" displayname= \"%ls\"" fullword wide $x2 = "10.15.1.69:3128" fullword wide $s1 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)" fullword wide $s2 = "/c sc stop %s" fullword wide $s3 = "sc start %ls" fullword wide $s4 = "93.115.27.57" fullword wide $s5 = "5.39.218.152" fullword wide $s6 = "tierexe" fullword wide $s7 = "comsys" fullword wide $s8 = "195.16.88.6" fullword wide $s9 = "TieringService" fullword wide $a1 = "TEMP\x00\x00DEF" fullword wide $a2 = "TEMP\x00\x00DEF-C" fullword wide $a3 = "TEMP\x00\x00DEF-WS" fullword wide $a4 = "TEMP\x00\x00DEF-EP" fullword wide $a5 = "TEMP\x00\x00DC-2-TEMP" fullword wide $a6 = "TEMP\x00\x00DC-2" fullword wide $a7 = "TEMP\x00\x00CES-McA-TEMP" fullword wide $a8 = "TEMP\x00\x00SRV_WSUS" fullword wide $a9 = "TEMP\x00\x00SRV_DC-2" fullword wide $a10 = "TEMP\x00\x00SCE-WSUS01" fullword wide condition: ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) or 3 of them or 1 of ($a*) ) or ( 5 of them ) } rule Industroyer_Portscan_3 { meta: description = "Detects Industroyer related custom port scaner" license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE" author = "Florian Roth (Nextron Systems)" reference = "https://goo.gl/x81cSy" date = "2017-06-13" hash1 = "893e4cca7fe58191d2f6722b383b5e8009d3885b5913dcd2e3577e5a763cdb3f" id = "f6675466-d469-562b-9fb6-7b72bce8a726" strings: $s1 = "!ZBfamily" fullword ascii $s2 = ":g/outddomo;" fullword ascii $s3 = "GHIJKLMNOTST" fullword ascii /* Decompressed File */ $d1 = "Error params Arguments!!!" fullword wide $d2 = "^(.+?.exe).*\\s+-ip\\s*=\\s*(.+)\\s+-ports\\s*=\\s*(.+)$" fullword wide $d3 = "Exhample:App.exe -ip= 127.0.0.1-100," fullword wide $d4 = "Error IP Range %ls - %ls" fullword wide $d5 = "Can't closesocket." fullword wide condition: ( uint16(0) == 0x5a4d and filesize < 500KB and all of ($s*) or 2 of ($d*) ) } rule Industroyer_Portscan_3_Output { meta: description = "Detects Industroyer related custom port scaner output file" license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE" author = "Florian Roth (Nextron Systems)" reference = "https://goo.gl/x81cSy" date = "2017-06-13" id = "4469f056-674c-5a44-84a5-12a65b8586d5" strings: $s1 = "WSA library load complite." fullword ascii $s2 = "Connection refused" fullword ascii condition: all of them } rule Industroyer_Malware_4 { meta: description = "Detects Industroyer related malware" license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE" author = "Florian Roth (Nextron Systems)" reference = "https://goo.gl/x81cSy" date = "2017-06-13" hash1 = "21c1fdd6cfd8ec3ffe3e922f944424b543643dbdab99fa731556f8805b0d5561" id = "f197d2a5-eecb-51ed-b991-7643efb3f749" strings: $s1 = "haslo.dat" fullword wide $s2 = "defragsvc" fullword ascii /* .dat\x00\x00Crash */ $a1 = { 00 2E 00 64 00 61 00 74 00 00 00 43 72 61 73 68 00 00 00 } condition: ( uint16(0) == 0x5a4d and filesize < 200KB and all of ($s*) or $a1 ) } rule Industroyer_Malware_5 { meta: description = "Detects Industroyer related malware" license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE" author = "Florian Roth (Nextron Systems)" reference = "https://goo.gl/x81cSy" date = "2017-06-13" hash1 = "7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad" id = "52ce21a0-0c72-585c-a805-c5077a7445af" strings: $x1 = "D2MultiCommService.exe" fullword ascii $x2 = "Crash104.dll" fullword ascii $x3 = "iec104.log" fullword ascii $x4 = "IEC-104 client: ip=%s; port=%s; ASDU=%u " fullword ascii $s1 = "Error while getaddrinfo executing: %d" fullword ascii $s2 = "return info-Remote command" fullword ascii $s3 = "Error killing process ..." fullword ascii $s4 = "stop_comm_service_name" fullword ascii $s5 = "*1* Data exchange: Send: %d (%s)" fullword ascii condition: ( uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or 4 of them ) ) or ( all of them ) }