27 lines
1.1 KiB
Text
27 lines
1.1 KiB
Text
rule malware_windows_moonlightmaze_loki
|
|
{
|
|
meta:
|
|
description = "Rule to detect Moonlight Maze Loki samples by custom attacker-authored strings"
|
|
reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
|
|
author = "Kaspersky Lab"
|
|
md5_1 = "14cce7e641d308c3a177a8abb5457019"
|
|
md5_2 = "a3164d2bbc45fb1eef5fde7eb8b245ea"
|
|
md5_3 = "dabee9a7ea0ddaf900ef1e3e166ffe8a"
|
|
md5_4 = "1980958afffb6a9d5a6c73fc1e2795c2"
|
|
md5_5 = "e59f92aadb6505f29a9f368ab803082e"
|
|
strings:
|
|
$a1 = "Write file Ok..." ascii wide
|
|
$a2 = "ERROR: Can not open socket...." ascii wide
|
|
$a3 = "Error in parametrs:" ascii wide
|
|
$a4 = "Usage: @<get/put> <IP> <PORT> <file>" ascii wide
|
|
$a5 = "ERROR: Not connect..." ascii wide
|
|
$a6 = "Connect successful...." ascii wide
|
|
$a7 = "clnt <%d> rqstd n ll kll" ascii wide
|
|
$a8 = "clnt <%d> rqstd swap" ascii wide
|
|
$a9 = "cld nt sgnl prcs grp" ascii wide
|
|
$a10 = "cld nt sgnl prnt" ascii wide
|
|
// keeping only ascii version of string ->
|
|
$a11 = "ork error" ascii fullword
|
|
condition:
|
|
2 of ($a*)
|
|
}
|