autarch/data/ioc/yara/rules.yara

rule powershell_dropper {
    meta:
        author = "Etienne Maynier"
        email = "etienne@citizenlab.ca"

    strings:
        $a = "$decentID = [System.Convert]::FromBase64String($indecentID)"
        $b = "if($tmp[1].CPU -gt 0) {} else {[ReverseTCPShell]::run()}"
        $c = "function Get-RSACode()"
        $d = "-file %temp%\\233.ps1"

    condition:
        1 of them
}

rule dropper_strings {
    meta:
        author = "Etienne Maynier"
        email = "etienne@citizenlab.ca"

    strings:
        $a = "bitsadmin /canceft\\windows\\currebitsadmin /addfibitsadmin /Resumbitsadmin /SetNosoftware"
        $b = "\\microsotifyCmdLine %s rle %s c:\\windowsbitsadmin /creat\\system32\\net.ex"
        $c = "rundll32.exe %s Main"
        $d = "d1fasg34"
        $e = "FindResource %s error"

    condition:
        uint16(0) == 0x5A4D and 2 of them
}

rule payload_wab32res_strings {
    meta:
        author = "Etienne Maynier"
        email = "etienne@citizenlab.ca"

    strings:
        $a1 = "%02d%02d%02d%02d%02d%03d"
        $a2 = "459B2-3311-54C3- /Processid:{712"
        $a3 = "CreateProcess %s"
        $a4 = "FakeRun.dll"
        $a5 = "Release\\FakeRun.pdb"

    condition:
        uint16(0) == 0x5A4D and 2 of them
}

rule pcnt_cert {
    meta:
        author = "Etienne Maynier"
        email = "etienne@citizenlab.ca"

    strings:
        $a = "MIIDWjCCAkICCQCdeJZhGKJakTANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJV"
        $b = "UzERMA8GA1UECAwITmVicmFza2ExEDAOBgNVBAcMB0xpbmNvbG4xDTALBgNVBAoM"
        $c = "BFBDTlQxDTALBgNVBAsMBFBDTlQxHTAbBgkqhkiG9w0BCQEWDnBjbnRAZ21haWwu"
        $d = "Y29tMB4XDTE4MDEwNjA2MDMyMloXDTI4MDEwNDA2MDMyMlowbzELMAkGA1UEBhMC"
        $e = "VVMxETAPBgNVBAgMCE5lYnJhc2thMRAwDgYDVQQHDAdMaW5jb2xuMQ0wCwYDVQQK"
        $f = "DARQQ05UMQ0wCwYDVQQLDARQQ05UMR0wGwYJKoZIhvcNAQkBFg5wY250QGdtYWls"
        $g = "LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK+ihHezE6jjS2Vl"
        $h = "/rIIQsrczmbjU/4KYDiLiCcrxN0tht6GzL281KGoW13IiQvKILANmx02IAy5tzij"
        $i = "0W9ZvFAIRRYVDpoSU+EyXz4LjHgXvw6VeG9v3HV99iSmphkq7mLYee0EPYP6wSdB"

    condition:
        uint16(0) == 0x5A4D and all of them
}

rule custom_decryption {
    meta:
        author = "Etienne Maynier"
        email = "etienne@citizenlab.ca"

    strings:
        $encrypt = { 8b d6 81 e2 07 00 00 80 79 05 4a 83 ca f8 42 8a 04 1e 0f be 0c 95 28 7e 46 00 34 01 0f be c0 0f af c8 80 f1 67 88 0c 1e 46 3b f7 7c d3 }
        $encrypt2 = { 8A 0C 30 8B D0 83 E2 07 80 F1 01 0F BE C9 0F BE 54 95 D0 0F AF D1 80 F2 85 88 14 30 40 }
        $decrypt_file1 = { 0f b6 01 8b d6 83 e2 07 34 01 0f be c0 83 c6 04 0f be }
        $decrypt_file2 = { 0f af d0 0f b6 41 01 34 01 0f be c0 88 11 8d 14 0f 83 e2 07 0f be }
        $decrypt_file3 = { 0f af d0 0f b6 41 02 34 01 0f be c0 88 51 01 8d 14 0b 83 e2 07 0f be }
        $decrypt_file4 = { 0f af d0 0f b6 41 03 34 01 0f be c0 88 51 02 8b 55 fc 03 d1 83 e2 07 0f be }

    condition:
        uint16(0) == 0x5A4D and ($encrypt or $encrypt2 or all of ($decrypt_file*))
}

rule tclient_strings {
    meta:
        author = "Etienne Maynier"
        email = "etienne@citizenlab.ca"

    strings:
        $a = "sdf81msdf7"
        $b = "software\\klive"
        $c = "\\Registry\\User\\%s\\Software\\KLive"
        $d = "%s\\wab32res.dll"
        $e = "[!]NtDeleteValueKey Error:%ul"
        $f = "%sDebugLog.TXT"
        $g = "Server connect to [%s:%d] Sucesse! token = %s"
        $h = "192.168.70.1"
        $i = "Start %d connect %s:%d"

    condition:
        uint16(0) == 0x5A4D and 3 of them
}

rule tclient_string {
    meta:
        author= "Etienne Maynier"
        email = "etienne@citizenlab.ca"

    strings:
        $a = "showgodmoney1gz"
        $b = "MDDEFGEGETGIZ"

    condition:
        uint16(0) == 0x5A4D and 2 of them
}

rule dsng_installer_dll_characteristics {
    meta:
        author = "Matt Brooks, @cmatthewbrooks"

    strings:
        $s1 = "dsng.dll"
        $s2 = "InstallD" fullword
        $s3 = "InstallZ" fullword

    condition:
        //MZ header
        uint16(0) == 0x5A4D and

        //PE signature
        uint32(uint32(0x3C)) == 0x00004550 and

        all of them
}

rule dsng_installer_dll_stringset {
    meta:
        author = "Matt Brooks, @cmatthewbrooks"

    strings:
        $s1 = "KCOM Server Security Guard"
        $s2 = "LoadFlgDllFun"
        $s3 = "Installv" fullword
        $s4 = "Dll path %s"
        $s5 = "MainFunVvv"
        $s6 = "http://dsas.asdf.com/"

    condition:
        //MZ header
        uint16(0) == 0x5A4D and
        //PE signature
        uint32(uint32(0x3C)) == 0x00004550 and
        2 of them
}

rule tibetan_indecent_rtf_meta {
    meta:
        author = "Matt Brooks, @cmatthewbrooks"

    strings:
        $operator = "{\\operator Windows \\'d3\\'c3\\'bb\\'a7}"

    condition:
        any of them
}

rule tibetan_indecent_ppsx_meta
{
    meta:
        author = "Matt Brooks, @cmatthewbrooks"

    strings:
        $createdby = "<dc:creator>Windows User</dc:creator>"
        $createdate = "<dcterms:created xsi:type=\"dcterms:W3CDTF\">2017-10-23T00:57:05Z</dcterms:created>"

    condition:
        all of them
}

rule tibetan_indecent_powershell
{
    meta:
        author = "Matt Brooks, @cmatthewbrooks"

    strings:
        $decents1 = "$indecentID" ascii wide
        $decents2 = "$decentID" ascii wide
        $decents3 = "powershell" ascii wide nocase

    condition:
        all of them
}

rule tibetan_indecent_pe_loader_pdb
{
    meta:
        author = "Matt Brooks, @cmatthewbrooks"

    strings:
        //C:\Users\learn\Desktop\免杀\
        $pdb = {43 3a 5c 55 73 65 72 73 5c 6c 65 61 72 6e 5c 44 65 73 6b 74 6f 70 5c e5 85 8d e6 9d 80}

    condition:
        all of them
}

rule tibetan_indecent_powershell_tcpshell_funcs
{
    meta:
        author = "Matt Brooks, @cmatthewbrooks"

    strings:
        $class = "public class ReverseTCPShell" ascii wide nocase
        $func1 = "public static void run" ascii wide nocase
        $func2 = "public static void runth" ascii wide nocase
        $func3 = "public static void start" ascii wide nocase
        $func4 = "public static bool isOnline" ascii wide nocase
        $func5 = "public static void startCmd" ascii wide nocase
        $func6 = "public static void CmdExited" ascii wide nocase
        $func7 = "public static void DataReceived" ascii wide nocase
        $func8 = "public static void FileReceive" ascii wide nocase
        $func9 = "public static void CmdManager" ascii wide nocase
        $func10 = "public static void SortOutputHandler" ascii wide nocase
        $func11 = "public static void SendLoginInfo" ascii wide nocase
        $func12 = "public static void Send" ascii wide nocase
        $func13 = "public static int SendWithSplit" ascii wide nocase

    condition:
        6 of them

}

rule tibetan_indecent_infrastructure_strings
{
    meta:
        author = "Matt Brooks, @cmatthewbrooks"

    strings:
        $cc1 = "103.55.24.196" ascii wide nocase
        $cc2 = "118.99.59.105" ascii wide nocase
        $cc3 = "27.126.186.222" ascii wide nocase
        $cc4 = "45.127.97.222" ascii wide nocase
        $cc5 = "comemail.email" ascii wide nocase
        $cc6 = "commail.co" ascii wide nocase
        $cc7 = "daynew.today" ascii wide nocase
        $cc8 = "daynews.today" ascii wide nocase
        $cc9 = "tibetfrum.info" ascii wide nocase
        $cc10 = "tibethouse.info" ascii wide nocase
        $cc11 = "tibetnews.info" ascii wide nocase
        $cc12 = "tibetnews.today" ascii wide nocase

    condition:
        any of them

}

rule silent_ppk_strings
{
    meta:
        author = "Geoff Alexander <geoff@citizenlab.ca>"

    strings:
        $s1 = "MainCommandJobSub"
        $s2 = "MainFun002"
        $s3 = "mRecvPkgFun"
        $s4 = "while -- ClientConnect"
        $s5 = "svsdll.log"
        $s6 = "ppk.dat"

    condition:
        uint16(0) == 0x5a4d and 4 of ($s*)
}