63 lines
2.0 KiB
Plaintext
63 lines
2.0 KiB
Plaintext
|
rule apt32_macos_dropper {
|
||
|
|
meta:
|
||
|
|
author = "Amnesty Tech"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$s1 = "setStartup" ascii
|
||
|
|
$s2 = "getSizeDataLoader" ascii
|
||
|
|
$s3 = "GET_LAUNCHNAME" ascii
|
||
|
|
$s4 = "GET_PROCESSNAME" ascii
|
||
|
|
$s5 = "getProcessnameRoot" ascii
|
||
|
|
$s6 = "getProcessnameUser" ascii
|
||
|
|
$s7 = "getProcessPathRoot" ascii
|
||
|
|
$s8 = "getLabelnameRoot" ascii
|
||
|
|
$s9 = "getLabelnameUser" ascii
|
||
|
|
$s10 = "stringFromHex" ascii
|
||
|
|
$s11 = "_b64_decode_ex" ascii
|
||
|
|
|
||
|
|
condition:
|
||
|
|
(uint16(0) == 0xfacf or uint16(0) == 0xface) and 9 of them
|
||
|
|
}
|
||
|
|
|
||
|
|
rule apt32_macos_backdoor_2018_encryption_key {
|
||
|
|
strings:
|
||
|
|
$key = { 63 49 2f 6e 22 00 10 fe 33 4f 2f c5 05 b2 11 03 ba 5b dd 02 }
|
||
|
|
$ccc = "CCCrypt" ascii
|
||
|
|
condition:
|
||
|
|
(uint16(0) == 0xfacf or uint16(0) == 0xface) and all of them
|
||
|
|
}
|
||
|
|
|
||
|
|
rule apt32_macos_backdoor_2019_encryption_key {
|
||
|
|
meta:
|
||
|
|
report = "https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/"
|
||
|
|
strings:
|
||
|
|
$key1 = { 9D 72 74 AD 7B CE F0 DE D2 9B DB B4 28 C2 51 DF 8B 35 0B 92 }
|
||
|
|
$key2 = {2c e4 25 29 5e 2a 20 40 9c a5 13 1e 61 1e 51 6f 2c b7 a7 7f }
|
||
|
|
$key3 = { 8b b2 c4 67 56 5c 63 42 8e f0 cf c5 f4 8d 87 ae 58 0c 5b a4 }
|
||
|
|
$ccc = "CCCrypt" ascii
|
||
|
|
condition:
|
||
|
|
(uint16(0) == 0xfacf or uint16(0) == 0xface) and $ccc and any of ($key*)
|
||
|
|
}
|
||
|
|
|
||
|
|
rule apt32_macos_backdoor_2018 {
|
||
|
|
meta:
|
||
|
|
author = "Amnesty Tech"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$s1 = "respondDownloadThreadP" ascii
|
||
|
|
$s2 = "checkProcessExist" ascii
|
||
|
|
$s3 = "setFristRandom" ascii
|
||
|
|
$s4 = "getInstalledTime" ascii
|
||
|
|
$s5 = "getSerialNumber" ascii
|
||
|
|
$s6 = "appendPathComponent" ascii
|
||
|
|
$s7 = "initFirstRandom" ascii
|
||
|
|
$s8 = "CFURLToString" ascii
|
||
|
|
$s9 = "GET_DOMAIN_CLIENT_INFO" ascii
|
||
|
|
$s10 = "getFirstRandom_Header" ascii
|
||
|
|
$s11 = "respondLoadLunaThread" ascii
|
||
|
|
|
||
|
|
condition:
|
||
|
|
(uint16(0) == 0xfacf or uint16(0) == 0xface) and 9 of them
|
||
|
|
|
||
|
|
}
|