741 lines
28 KiB
Text
741 lines
28 KiB
Text
// For feedback or questions contact us at: github@eset.com
|
|
// https://github.com/eset/malware-ioc/
|
|
//
|
|
// These yara rules are provided to the community under the two-clause BSD
|
|
// license as follows:
|
|
//
|
|
// Copyright (c) 2022, ESET
|
|
// All rights reserved.
|
|
//
|
|
// Redistribution and use in source and binary forms, with or without
|
|
// modification, are permitted provided that the following conditions are met:
|
|
//
|
|
// 1. Redistributions of source code must retain the above copyright notice, this
|
|
// list of conditions and the following disclaimer.
|
|
//
|
|
// 2. Redistributions in binary form must reproduce the above copyright notice,
|
|
// this list of conditions and the following disclaimer in the documentation
|
|
// and/or other materials provided with the distribution.
|
|
//
|
|
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
|
// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
|
// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
|
|
// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
|
// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
|
|
// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
//
|
|
|
|
import "pe"
|
|
|
|
rule apt_Windows_TA410_Tendyron_dropper
|
|
{
|
|
meta:
|
|
description = "TA410 Tendyron Dropper"
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2020-12-09"
|
|
strings:
|
|
$s1 = "Global\\{F473B3BE-08EE-4710-A727-9E248F804F4A}" wide
|
|
$s2 = "Global\\8D32CCB321B2" wide
|
|
$s3 = "Global\\E4FE94F75490" wide
|
|
$s4 = "Program Files (x86)\\Internet Explorer\\iexplore.exe" wide
|
|
$s5 = "\\RPC Control\\OLE" wide
|
|
$s6 = "ALPC Port" wide
|
|
condition:
|
|
int16(0) == 0x5A4D and 4 of them
|
|
}
|
|
|
|
rule apt_Windows_TA410_Tendyron_installer
|
|
{
|
|
meta:
|
|
description = "TA410 Tendyron Installer"
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2020-12-09"
|
|
strings:
|
|
$s1 = "Tendyron" wide
|
|
$s2 = "OnKeyToken_KEB.dll" wide
|
|
$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
|
|
$s4 = "Global\\8D32CCB321B2"
|
|
$s5 = "\\RTFExploit\\"
|
|
condition:
|
|
int16(0) == 0x5A4D and 3 of them
|
|
}
|
|
|
|
rule apt_Windows_TA410_Tendyron_Downloader
|
|
{
|
|
meta:
|
|
description = "TA410 Tendyron Downloader"
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2020-12-09"
|
|
strings:
|
|
/*
|
|
0x401250 8A10 mov dl, byte ptr [eax]
|
|
0x401252 80F25C xor dl, 0x5c
|
|
0x401255 80C25C add dl, 0x5c
|
|
0x401258 8810 mov byte ptr [eax], dl
|
|
0x40125a 40 inc eax
|
|
0x40125b 83E901 sub ecx, 1
|
|
0x40125e 75F0 jne 0x401250
|
|
*/
|
|
$chunk_1 = {
|
|
8A 10
|
|
80 F2 5C
|
|
80 C2 5C
|
|
88 10
|
|
40
|
|
83 E9 01
|
|
75 ??
|
|
}
|
|
$s1 = "startModule" fullword
|
|
condition:
|
|
int16(0) == 0x5A4D and all of them
|
|
}
|
|
|
|
rule apt_Windows_TA410_X4_strings
|
|
{
|
|
meta:
|
|
description = "Matches various strings found in TA410 X4"
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2020-10-09"
|
|
strings:
|
|
$s1 = "[X]InLoadSC" ascii wide nocase
|
|
$s3 = "MachineKeys\\Log\\rsa.txt" ascii wide nocase
|
|
$s4 = "MachineKeys\\Log\\output.log" ascii wide nocase
|
|
condition:
|
|
any of them
|
|
}
|
|
|
|
rule apt_Windows_TA410_X4_hash_values
|
|
{
|
|
meta:
|
|
description = "Matches X4 hash function found in TA410 X4"
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2020-10-09"
|
|
strings:
|
|
$s1 = {D1 10 76 C2 B6 03}
|
|
$s2 = {71 3E A8 0D}
|
|
$s3 = {DC 78 94 0E}
|
|
$s4 = {40 0D E7 D6 06}
|
|
$s5 = {83 BB FD E8 06}
|
|
$s6 = {92 9D 9B FF EC 03}
|
|
$s7 = {DD 0E FC FA F5 03}
|
|
$s8 = {15 60 1E FB F5 03}
|
|
condition:
|
|
uint16(0) == 0x5a4d and 4 of them
|
|
|
|
}
|
|
|
|
rule apt_Windows_TA410_X4_hash_fct
|
|
{
|
|
meta:
|
|
description = "Matches X4 hash function found in TA410 X4"
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2020-10-09"
|
|
|
|
/*
|
|
0x6056cc2150 0FB601 movzx eax, byte ptr [rcx]
|
|
0x6056cc2153 84C0 test al, al
|
|
0x6056cc2155 7416 je 0x6056cc216d
|
|
0x6056cc2157 4869D283000000 imul rdx, rdx, 0x83
|
|
0x6056cc215e 480FBEC0 movsx rax, al
|
|
0x6056cc2162 4803D0 add rdx, rax
|
|
0x6056cc2165 48FFC1 inc rcx
|
|
0x6056cc2168 E9E3FFFFFF jmp 0x6056cc2150
|
|
*/
|
|
strings:
|
|
$chunk_1 = {
|
|
0F B6 01
|
|
84 C0
|
|
74 ??
|
|
48 69 D2 83 00 00 00
|
|
48 0F BE C0
|
|
48 03 D0
|
|
48 FF C1
|
|
E9 ?? ?? ?? ??
|
|
}
|
|
|
|
condition:
|
|
uint16(0) == 0x5a4d and any of them
|
|
|
|
}
|
|
|
|
rule apt_Windows_TA410_LookBack_decryption
|
|
{
|
|
meta:
|
|
description = "Matches encryption/decryption function used by LookBack."
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2021-10-12"
|
|
strings:
|
|
$initialize = {
|
|
8B C6 //mov eax, esi
|
|
99 //cdq
|
|
83 E2 03 //and edx, 3
|
|
03 C2 //add eax, edx
|
|
C1 F8 02 //sar eax, 2
|
|
8A C8 //mov cl, al
|
|
02 C0 //add al, al
|
|
02 C8 //add cl, al
|
|
88 4C 34 10 //mov byte ptr [esp + esi + 0x10], cl
|
|
46 //inc esi
|
|
81 FE 00 01 00 00 //cmp esi, 0x100
|
|
72 ??
|
|
}
|
|
$generate = {
|
|
8A 94 1C 10 01 ?? ?? //mov dl, byte ptr [esp + ebx + 0x110]
|
|
8D 8C 24 10 01 ?? ?? //lea ecx, [esp + 0x110]
|
|
0F B6 C3 //movzx eax, bl
|
|
0F B6 44 04 10 //movzx eax, byte ptr [esp + eax + 0x10]
|
|
32 C2 //xor al, dl
|
|
02 F0 //add dh, al
|
|
0F B6 C6 //movzx eax, dh
|
|
03 C8 //add ecx, eax
|
|
0F B6 01 //movzx eax, byte ptr [ecx]
|
|
88 84 1C 10 01 ?? ?? //mov byte ptr [esp + ebx + 0x110], al
|
|
43 //inc ebx
|
|
88 11 //mov byte ptr [ecx], dl
|
|
81 FB 00 06 00 00 //cmp ebx, 0x600
|
|
72 ?? //jb 0x10025930
|
|
}
|
|
$decrypt = {
|
|
0F B6 C6 //movzx eax, dh
|
|
8D 8C 24 10 01 ?? ?? //lea ecx, [esp + 0x110]
|
|
03 C8 //add ecx, eax
|
|
8A 19 //mov bl, byte ptr [ecx]
|
|
8A C3 //mov al, bl
|
|
02 C6 //add al, dh
|
|
FE C6 //inc dh
|
|
02 F8 //add bh, al
|
|
0F B6 C7 //movzx eax, bh
|
|
8A 94 04 10 01 ?? ?? //mov dl, byte ptr [esp + eax + 0x110]
|
|
88 9C 04 10 01 ?? ?? //mov byte ptr [esp + eax + 0x110], bl
|
|
88 11 //mov byte ptr [ecx], dl
|
|
0F B6 C2 //movzx eax, dl
|
|
0F B6 CB //movzx ecx, bl
|
|
33 C8 //xor ecx, eax
|
|
8A 84 0C 10 01 ?? ?? //mov al, byte ptr [esp + ecx + 0x110]
|
|
30 04 2E //xor byte ptr [esi + ebp], al
|
|
46 //inc esi
|
|
3B F7 //cmp esi, edi
|
|
7C ?? //jl 0x10025980
|
|
}
|
|
condition:
|
|
uint16(0) == 0x5a4d and all of them
|
|
}
|
|
|
|
rule apt_Windows_TA410_LookBack_loader
|
|
{
|
|
meta:
|
|
description = "Matches the modified function in LookBack libcurl loader."
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2021-10-12"
|
|
strings:
|
|
$chunk_1 = {
|
|
FF 15 ?? ?? ?? ?? //call dword ptr [0x100530e0]
|
|
6A 40 //push 0x40
|
|
68 00 10 00 00 //push 0x1000
|
|
68 F0 04 00 00 //push 0x4f0
|
|
6A 00 //push 0
|
|
FF 15 ?? ?? ?? ?? //call dword ptr [0x100530d4]
|
|
8B E8 //mov ebp, eax
|
|
B9 3C 01 00 00 //mov ecx, 0x13c
|
|
BE 60 30 06 10 //mov esi, 0x10063060
|
|
8B FD //mov edi, ebp
|
|
68 F0 04 00 00 //push 0x4f0
|
|
F3 A5 //rep movsd dword ptr es:[edi], dword ptr [esi]
|
|
55 //push ebp
|
|
E8 ?? ?? ?? ?? //call 0x100258d0
|
|
8B 0D ?? ?? ?? ?? //mov ecx, dword ptr [0x100530e4]
|
|
A1 ?? ?? ?? ?? //mov eax, dword ptr [0x100530c8]
|
|
68 6C 02 00 00 //push 0x26c
|
|
89 4C 24 ?? //mov dword ptr [esp + 0x1c], ecx
|
|
89 44 24 ?? //mov dword ptr [esp + 0x20], eax
|
|
FF 15 ?? ?? ?? ?? //call dword ptr [0x10063038]
|
|
8B D8 //mov ebx, eax
|
|
B9 9B 00 00 00 //mov ecx, 0x9b
|
|
BE 50 35 06 10 //mov esi, 0x10063550
|
|
8B FB //mov edi, ebx
|
|
68 6C 02 00 00 //push 0x26c
|
|
F3 A5 //rep movsd dword ptr es:[edi], dword ptr [esi]
|
|
53 //push ebx
|
|
E8 ?? ?? ?? ?? //call 0x100258d0
|
|
83 C4 14 //add esp, 0x14
|
|
8D 44 24 ?? //lea eax, [esp + 0x10]
|
|
50 //push eax
|
|
53 //push ebx
|
|
8D 44 24 ?? //lea eax, [esp + 0x3c]
|
|
50 //push eax
|
|
A1 ?? ?? ?? ?? //mov eax, dword ptr [0x10063058]
|
|
FF 74 24 ?? //push dword ptr [esp + 0x28]
|
|
03 C5 //add eax, ebp
|
|
FF D0 //call eax
|
|
}
|
|
condition:
|
|
uint16(0) == 0x5a4d and all of them
|
|
}
|
|
|
|
rule apt_Windows_TA410_LookBack_strings
|
|
{
|
|
meta:
|
|
description = "Matches multiple strings and export names in TA410 LookBack."
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2021-10-12"
|
|
strings:
|
|
$s1 = "SodomMainFree" ascii wide
|
|
$s2 = "SodomMainInit" ascii wide
|
|
$s3 = "SodomNormal.bin" ascii wide
|
|
$s4 = "SodomHttp.bin" ascii wide
|
|
$s5 = "sodom.ini" ascii wide
|
|
$s6 = "SodomMainProc" ascii wide
|
|
|
|
condition:
|
|
uint16(0) == 0x5a4d and (2 of them or pe.exports("SodomBodyLoad") or pe.exports("SodomBodyLoadTest"))
|
|
}
|
|
|
|
rule apt_Windows_TA410_LookBack_HTTP
|
|
{
|
|
meta:
|
|
description = "Matches LookBack's hardcoded HTTP request"
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2021-10-12"
|
|
strings:
|
|
$s1 = "POST http://%s/status.php?r=%d%d HTTP/1.1\x0d\nAccept: text/html, application/xhtml+xml, */*\x0d\nAccept-Language: en-us\x0d\nUser-Agent: %s\x0d\nContent-Type: application/x-www-form-urlencoded\x0d\nAccept-Encoding: gzip, deflate\x0d\nHost: %s\x0d\nContent-Length: %d\x0d\nConnection: Keep-Alive\x0d\nCache-Control: no-cache\x0d\n\x0d\n" ascii wide
|
|
$s2 = "id=1&op=report&status="
|
|
|
|
condition:
|
|
uint16(0) == 0x5a4d and all of them
|
|
}
|
|
|
|
rule apt_Windows_TA410_LookBack_magic
|
|
{
|
|
meta:
|
|
description = "Matches message header creation in LookBack."
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2021-10-12"
|
|
strings:
|
|
$s1 = {
|
|
C7 03 C2 2E AB 48 //mov dword ptr [ebx], 0x48ab2ec2
|
|
( A1 | 8B 15 ) ?? ?? ?? ?? //mov (eax | edx), x
|
|
[0-1] //push ebp
|
|
89 ?3 04 //mov dword ptr [ebc + 4], reg
|
|
8B 4? 24 ?? //mov reg, dword ptr [esp + X]
|
|
89 4? 08 //mov dword ptr [ebx + 8], ??
|
|
89 ?? 0C //mov dword ptr [ebx + 0xc], ??
|
|
8B 4? 24 ?? //mov reg, dword ptr [esp + X]
|
|
[1-2] //push 1 or 2 args
|
|
E8 ?? ?? ?? ?? //call
|
|
}
|
|
|
|
condition:
|
|
uint16(0) == 0x5a4d and all of them
|
|
}
|
|
|
|
rule apt_Windows_TA410_FlowCloud_loader_strings
|
|
{
|
|
meta:
|
|
description = "Matches various strings found in TA410 FlowCloud first stage."
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2021-10-12"
|
|
strings:
|
|
$key = "y983nfdicu3j2dcn09wur9*^&initialize(y4r3inf;'fdskaf'SKF"
|
|
$s2 = "startModule" fullword
|
|
$s4 = "auto_start_module" wide
|
|
$s5 = "load_main_module_after_install" wide
|
|
$s6 = "terminate_if_fail" wide
|
|
$s7 = "clear_run_mru" wide
|
|
$s8 = "install_to_vista" wide
|
|
$s9 = "load_ext_module" wide
|
|
$s10= "sll_only" wide
|
|
$s11= "fail_if_already_installed" wide
|
|
$s12= "clear_hardware_info" wide
|
|
$s13= "av_check" wide fullword
|
|
$s14= "check_rs" wide
|
|
$s15= "check_360" wide
|
|
$s16= "responsor.dat" wide ascii
|
|
$s17= "auto_start_after_install_check_anti" wide fullword
|
|
$s18= "auto_start_after_install" wide fullword
|
|
$s19= "extern_config.dat" wide fullword
|
|
$s20= "is_hhw" wide fullword
|
|
$s21= "SYSTEM\\Setup\\PrintResponsor" wide
|
|
$event= "Global\\Event_{201a283f-e52b-450e-bf44-7dc436037e56}" wide ascii
|
|
$s23= "invalid encrypto hdr while decrypting"
|
|
|
|
condition:
|
|
uint16(0) == 0x5a4d and ($key or $event or 5 of ($s*))
|
|
}
|
|
|
|
rule apt_Windows_TA410_FlowCloud_header_decryption
|
|
{
|
|
meta:
|
|
description = "Matches the function used to decrypt resources headers in TA410 FlowCloud"
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
/*
|
|
0x416a70 8B1E mov ebx, dword ptr [esi]
|
|
0x416a72 8BCF mov ecx, edi
|
|
0x416a74 D3CB ror ebx, cl
|
|
0x416a76 8D0C28 lea ecx, [eax + ebp]
|
|
0x416a79 83C706 add edi, 6
|
|
0x416a7c 3018 xor byte ptr [eax], bl
|
|
0x416a7e 8B1E mov ebx, dword ptr [esi]
|
|
0x416a80 D3CB ror ebx, cl
|
|
0x416a82 8D0C02 lea ecx, [edx + eax]
|
|
0x416a85 305801 xor byte ptr [eax + 1], bl
|
|
0x416a88 8B1E mov ebx, dword ptr [esi]
|
|
0x416a8a D3CB ror ebx, cl
|
|
0x416a8c 8B4C240C mov ecx, dword ptr [esp + 0xc]
|
|
0x416a90 03C8 add ecx, eax
|
|
0x416a92 305802 xor byte ptr [eax + 2], bl
|
|
0x416a95 8B1E mov ebx, dword ptr [esi]
|
|
0x416a97 D3CB ror ebx, cl
|
|
0x416a99 8B4C2410 mov ecx, dword ptr [esp + 0x10]
|
|
0x416a9d 03C8 add ecx, eax
|
|
0x416a9f 305803 xor byte ptr [eax + 3], bl
|
|
0x416aa2 8B1E mov ebx, dword ptr [esi]
|
|
0x416aa4 D3CB ror ebx, cl
|
|
0x416aa6 8B4C2414 mov ecx, dword ptr [esp + 0x14]
|
|
0x416aaa 03C8 add ecx, eax
|
|
0x416aac 83C006 add eax, 6
|
|
0x416aaf 3058FE xor byte ptr [eax - 2], bl
|
|
0x416ab2 8B1E mov ebx, dword ptr [esi]
|
|
0x416ab4 D3CB ror ebx, cl
|
|
0x416ab6 3058FF xor byte ptr [eax - 1], bl
|
|
0x416ab9 83FF10 cmp edi, 0x10
|
|
0x416abc 72B2 jb 0x416a70
|
|
*/
|
|
strings:
|
|
$chunk_1 = {
|
|
8B 1E
|
|
8B CF
|
|
D3 CB
|
|
8D 0C 28
|
|
83 C7 06
|
|
30 18
|
|
8B 1E
|
|
D3 CB
|
|
8D 0C 02
|
|
30 58 ??
|
|
8B 1E
|
|
D3 CB
|
|
8B 4C 24 ??
|
|
03 C8
|
|
30 58 ??
|
|
8B 1E
|
|
D3 CB
|
|
8B 4C 24 ??
|
|
03 C8
|
|
30 58 ??
|
|
8B 1E
|
|
D3 CB
|
|
8B 4C 24 ??
|
|
03 C8
|
|
83 C0 06
|
|
30 58 ??
|
|
8B 1E
|
|
D3 CB
|
|
30 58 ??
|
|
83 FF 10
|
|
72 ??
|
|
}
|
|
|
|
condition:
|
|
uint16(0) == 0x5a4d and all of them
|
|
}
|
|
|
|
rule apt_Windows_TA410_FlowCloud_dll_hijacking_strings
|
|
{
|
|
meta:
|
|
description = "Matches filenames inside TA410 FlowCloud malicious DLL."
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2021-10-12"
|
|
strings:
|
|
$dat1 = "emedres.dat" wide
|
|
$dat2 = "vviewres.dat" wide
|
|
$dat3 = "setlangloc.dat" wide
|
|
$dll1 = "emedres.dll" wide
|
|
$dll2 = "vviewres.dll" wide
|
|
$dll3 = "setlangloc.dll" wide
|
|
condition:
|
|
uint16(0) == 0x5a4d and (all of ($dat*) or all of ($dll*))
|
|
}
|
|
|
|
rule apt_Windows_TA410_FlowCloud_malicious_dll_antianalysis
|
|
{
|
|
meta:
|
|
description = "Matches anti-analysis techniques used in TA410 FlowCloud hijacking DLL."
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2021-10-12"
|
|
strings:
|
|
/*
|
|
33C0 xor eax, eax
|
|
E8320C0000 call 0x10001d30
|
|
83C010 add eax, 0x10
|
|
3D00000080 cmp eax, 0x80000000
|
|
7D01 jge +3
|
|
EBFF jmp +1 / jmp eax
|
|
E050 loopne 0x1000115c / push eax
|
|
C3 ret
|
|
*/
|
|
$chunk_1 = {
|
|
33 C0
|
|
E8 ?? ?? ?? ??
|
|
83 C0 10
|
|
3D 00 00 00 80
|
|
7D 01
|
|
EB FF
|
|
E0 50
|
|
C3
|
|
}
|
|
condition:
|
|
uint16(0) == 0x5a4d and all of them
|
|
}
|
|
|
|
rule apt_Windows_TA410_FlowCloud_pdb
|
|
{
|
|
meta:
|
|
description = "Matches PDB paths found in TA410 FlowCloud."
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2021-10-12"
|
|
|
|
condition:
|
|
uint16(0) == 0x5a4d and (pe.pdb_path contains "\\FlowCloud\\trunk\\" or pe.pdb_path contains "\\flowcloud\\trunk\\")
|
|
}
|
|
|
|
rule apt_Windows_TA410_FlowCloud_shellcode_decryption
|
|
{
|
|
meta:
|
|
description = "Matches the decryption function used in TA410 FlowCloud self-decrypting DLL"
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2021-10-12"
|
|
/*
|
|
0x211 33D2 xor edx, edx
|
|
0x213 8B4510 mov eax, dword ptr [ebp + 0x10]
|
|
0x216 BB6B040000 mov ebx, 0x46b
|
|
0x21b F7F3 div ebx
|
|
0x21d 81C2A8010000 add edx, 0x1a8
|
|
0x223 81E2FF000000 and edx, 0xff
|
|
0x229 8B7D08 mov edi, dword ptr [ebp + 8]
|
|
0x22c 33C9 xor ecx, ecx
|
|
0x22e EB07 jmp 0x237
|
|
0x230 301439 xor byte ptr [ecx + edi], dl
|
|
0x233 001439 add byte ptr [ecx + edi], dl
|
|
0x236 41 inc ecx
|
|
0x237 3B4D0C cmp ecx, dword ptr [ebp + 0xc]
|
|
0x23a 72F4 jb 0x230
|
|
*/
|
|
strings:
|
|
$chunk_1 = {
|
|
33 D2
|
|
8B 45 ??
|
|
BB 6B 04 00 00
|
|
F7 F3
|
|
81 C2 A8 01 00 00
|
|
81 E2 FF 00 00 00
|
|
8B 7D ??
|
|
33 C9
|
|
EB ??
|
|
30 14 39
|
|
00 14 39
|
|
41
|
|
3B 4D ??
|
|
72 ??
|
|
}
|
|
|
|
condition:
|
|
uint16(0) == 0x5a4d and all of them
|
|
}
|
|
|
|
rule apt_Windows_TA410_FlowCloud_fcClient_strings
|
|
{
|
|
meta:
|
|
description = "Strings found in fcClient/rescure.dat module."
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2021-10-12"
|
|
strings:
|
|
$s1 = "df257bdd-847c-490e-9ef9-1d7dc883d3c0"
|
|
$s2 = "\\{2AFF264E-B722-4359-8E0F-947B85594A9A}"
|
|
$s3 = "Global\\{26C96B51-2B5D-4D7B-BED1-3DCA4848EDD1}" wide
|
|
$s4 = "{804423C2-F490-4ac3-BFA5-13DEDE63A71A}" wide
|
|
$s5 = "{A5124AF5-DF23-49bf-B0ED-A18ED3DEA027}" wide
|
|
$s6 = "XXXModule_func.dll"
|
|
$driver1 = "\\drivers\\hidmouse.sys" wide fullword
|
|
$driver2 = "\\drivers\\hidusb.sys" wide fullword
|
|
|
|
condition:
|
|
uint16(0) == 0x5a4d and (any of ($s*) or all of ($driver*))
|
|
}
|
|
|
|
rule apt_Windows_TA410_FlowCloud_fcClientDll_strings
|
|
{
|
|
meta:
|
|
description = "Strings found in fcClientDll/responsor.dat module."
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2021-10-12"
|
|
strings:
|
|
$s1 = "http://%s/html/portlet/ext/draco/resources/draco_manager.swf/[[DYNAMIC]]/1"
|
|
$s2 = "Cookie: COOKIE_SUPPORT=true; JSESSIONID=5C7E7A60D01D2891F40648DAB6CB3DF4.jvm1; COMPANY_ID=10301; ID=666e7375545678695645673d; PASSWORD=7a4b48574d746470447a303d; LOGIN=6863303130; SCREEN_NAME=4a2b455377766b657451493d; GUEST_LANGUAGE_ID=en-US"
|
|
$fc_msg = ".fc_net.msg"
|
|
$s4 = "\\pipe\\namedpipe_keymousespy_english" wide
|
|
$s5 = "8932910381748^&*^$58876$%^ghjfgsa413901280dfjslajflsdka&*(^7867=89^&*F(^&*5678f5ds765f76%&*%&*5"
|
|
$s6 = "cls_{CACB140B-0B82-4340-9B05-7983017BA3A4}" wide
|
|
$s7 = "HTTP/1.1 200 OK\x0d\nServer: Apache-Coyote/1.1\x0d\nPragma: No-cache\x0d\nCache-Control: no-cache\x0d\nExpires: Thu, 01 Jan 1970 08:00:00 CST\x0d\nLast-Modified: Fri, 27 Apr 2012 08:11:04 GMT\x0d\nContent-Type: application/xml\x0d\nContent-Length: %d\x0d\nDate: %s GMT"
|
|
$sql1 = "create table if not exists table_filed_space"
|
|
$sql2 = "create table if not exists clipboard"
|
|
$sql3 = "create trigger if not exists file_after_delete after delete on file"
|
|
$sql4 = "create trigger if not exists file_data_after_insert after insert on file_data"
|
|
$sql5 = "create trigger if not exists file_data_after_delete after delete on file_data"
|
|
$sql6 = "create trigger if not exists file_data_after_update after update on file_data"
|
|
$sql7 = "insert into file_data(file_id, ofs, data, status)"
|
|
|
|
condition:
|
|
uint16(0) == 0x5a4d and (any of ($s*) or #fc_msg >= 8 or 4 of ($sql*))
|
|
}
|
|
|
|
rule apt_Windows_TA410_Rootkit_strings
|
|
{
|
|
meta:
|
|
description = "Strings found in TA410's Rootkit"
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2021-10-12"
|
|
strings:
|
|
$driver1 = "\\Driver\\kbdclass" wide
|
|
$driver2 = "\\Driver\\mouclass" wide
|
|
$device1 = "\\Device\\KeyboardClass0" wide
|
|
$device2 = "\\Device\\PointerClass0" wide
|
|
$driver3 = "\\Driver\\tcpip" wide
|
|
$device3 = "\\Device\\tcp" wide
|
|
$driver4 = "\\Driver\\nsiproxy" wide
|
|
$device4 = "\\Device\\Nsi" wide
|
|
$reg1 = "\\Registry\\Machine\\SYSTEM\\Setup\\AllowStart\\ceipCommon" wide
|
|
$reg2 = "RHH%d" wide
|
|
$reg3 = "RHP%d" wide
|
|
$s1 = "\\SystemRoot\\System32\\drivers\\hidmouse.sys" wide
|
|
|
|
condition:
|
|
uint16(0) == 0x5a4d and all of ($s1,$reg*) and (all of ($driver*) or all of ($device*))
|
|
}
|
|
|
|
rule apt_Windows_TA410_FlowCloud_v5_resources
|
|
{
|
|
meta:
|
|
description = "Matches sequence of PE resource IDs found in TA410 FlowCloud version 5.0.2"
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2021-10-12"
|
|
condition:
|
|
uint16(0) == 0x5a4d and pe.number_of_resources >= 13 and
|
|
for 12 resource in pe.resources:
|
|
( resource.type == 10 and resource.language == 1033 and
|
|
//resource name is one of 100, 1000, 10000, 1001, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 2000, 2001 as widestring
|
|
(resource.name_string == "1\x000\x000\x00" or resource.name_string == "1\x000\x000\x000\x00" or resource.name_string == "1\x000\x000\x000\x000\x00" or
|
|
resource.name_string == "1\x000\x000\x001\x00" or resource.name_string == "1\x000\x001\x00" or resource.name_string == "1\x000\x002\x00" or
|
|
resource.name_string == "1\x000\x003\x00" or resource.name_string == "1\x000\x004\x00" or resource.name_string == "1\x000\x005\x00" or
|
|
resource.name_string == "1\x000\x006\x00" or resource.name_string == "1\x000\x007\x00" or resource.name_string == "1\x000\x008\x00" or
|
|
resource.name_string == "1\x000\x009\x00" or resource.name_string == "1\x001\x000\x00" or resource.name_string == "2\x000\x000\x000\x00" or resource.name_string == "2\x000\x000\x001\x00")
|
|
)
|
|
}
|
|
|
|
rule apt_Windows_TA410_FlowCloud_v4_resources
|
|
{
|
|
meta:
|
|
description = "Matches sequence of PE resource IDs found in TA410 FlowCloud version 4.1.3"
|
|
reference = "https://www.welivesecurity.com/"
|
|
source = "https://github.com/eset/malware-ioc/"
|
|
license = "BSD 2-Clause"
|
|
version = "1"
|
|
author = "ESET Research"
|
|
date = "2021-10-12"
|
|
condition:
|
|
uint16(0) == 0x5a4d and pe.number_of_resources >= 6 and
|
|
for 5 resource in pe.resources:
|
|
( resource.type == 10 and resource.language == 1033 and
|
|
// resource name is one of 10000, 10001, 10002, 10003, 10004, 10005, 10100 as wide string
|
|
(resource.name_string == "1\x000\x000\x000\x000\x00" or resource.name_string == "1\x000\x000\x000\x001\x00" or
|
|
resource.name_string == "1\x000\x000\x000\x002\x00" or resource.name_string == "1\x000\x000\x000\x003\x00" or
|
|
resource.name_string == "1\x000\x000\x000\x004\x00" or resource.name_string == "1\x000\x000\x000\x005\x00" or resource.name_string == "1\x000\x001\x000\x000\x00")
|
|
)
|
|
}
|