50 lines
2 KiB
Text
50 lines
2 KiB
Text
|
|
/* modified by Florian Roth */
|
|
|
|
rule APT_SideWinder_NET_Loader_Aug_2020_1 {
|
|
meta:
|
|
description = "Detected the NET loader used by SideWinder group (August 2020)"
|
|
author = "Arkbird_SOLG"
|
|
reference = "https://twitter.com/ShadowChasing1/status/1297902086747598852"
|
|
date = "2020-08-24"
|
|
hash1 = "4a0947dd9148b3d5922651a6221afc510afcb0dfa69d08ee69429c4c75d4c8b4"
|
|
id = "61d96e2a-3a43-586f-85bc-a2c53b1318e6"
|
|
strings:
|
|
$a1 = "DUSER.dll" fullword wide
|
|
|
|
$s1 = "UHJvZ3JhbQ==" fullword wide // base64 encoded string -> 'Program' -> Invoke call decoded PE
|
|
$s2 = "U3RhcnQ=" fullword wide
|
|
$s3 = ".tmp " fullword wide
|
|
$s4 = "FileRipper" fullword ascii
|
|
$s5 = "copytight @" fullword wide
|
|
condition:
|
|
uint16(0) == 0x5a4d and filesize < 4KB and $a1 and 3 of ($s*)
|
|
}
|
|
|
|
rule APT_MAL_SideWinder_implant {
|
|
meta:
|
|
author = "AT&T Alien Labs"
|
|
description = "Detects SideWinder final payload"
|
|
hash1 = "c568238dcf1e30d55a398579a4704ddb8196b685"
|
|
reference = "https://cybersecurity.att.com/blogs/labs-research/a-global-perspective-of-the-sidewinder-apt"
|
|
id = "3a420c9c-7821-5405-8d4d-6931d0f311ba"
|
|
strings:
|
|
$code= { 1B 30 05 00 C7 00 00 00 00 00 00 00 02 28 03 00
|
|
00 06 7D 12 00 00 04 02 02 FE 06 23 00 00 06 73
|
|
5B 00 00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A
|
|
7D 13 00 00 04 02 02 FE 06 24 00 00 06 73 5B 00
|
|
00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A 7D 15
|
|
00 00 04 02 7B 12 00 00 04 6F 0E 00 00 06 2C 1D
|
|
02 28 1F 00 00 06 02 7B 12 00 00 04 16 6F 0F 00
|
|
00 06 02 7B 12 00 00 04 6F 06 00 00 06 02 7B 12
|
|
00 00 04 6F 10 00 00 06 2C 23 02 28 20 00 00 06
|
|
02 28 21 00 00 06 02 7B 12 00 00 04 16 }
|
|
|
|
$strings = {
|
|
2E 00 73 00 69 00 66 00 00 09 2E 00 66 00 6C 00
|
|
63 00 00 1B 73 00 65 00 6C 00 65 00 63 00 74 00
|
|
65 00 64 00 46 00 69 00 6C 00 65 00 73
|
|
}
|
|
condition:
|
|
uint16(0) == 0x5A4D and all of them
|
|
}
|