sssnake/autarch
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

Browse Source
This commit is contained in:
SsSnake
2026-07-13 15:45:47 -07:00
parent 925216290f
commit e48d577bd5
387 changed files with 211976 additions and 921 deletions
Download Patch File Download Diff File Expand all files Collapse all files

270
data/ioc/spyware/citizen_lab/201611_KeyBoy/iocs.csv Normal file
View File

@@ -0,0 +1,270 @@
uuid,event_id,category,type,value,comment,to_ids,date
5820ab7b-5a8c-4164-8113-49798e96ca05,17,Artifacts dropped,md5,"495adb1b9777002ecfe22aaf52fcee93","Wab32res.dll payload, KeyBoy 20160509",1,20161107
5820ab93-8b90-4f61-8591-497a8e96ca05,17,Network activity,ip-dst,"103.40.102.233","C2 IP",1,20161116
5820ab93-ca00-4627-a8e9-497a8e96ca05,17,Network activity,ip-dst,"45.125.12.147","C2 IP",1,20161110
5820aba7-e398-41cb-939b-49798e96ca05,17,Network activity,domain,"tibetvoices.com","domain linked to one of the C2 IPs",1,20161107
5820abec-8b88-4398-ba31-497a8e96ca05,17,Network activity,ip-dst,"116.193.154.69","C2 IP",1,20161107
5820ac1b-05c0-4d60-8fc5-497a8e96ca05,17,Artifacts dropped,md5,"0c7e55509e0b6d4277b3facf864af018","Payload KeyBoy P_20150313",1,20161107
5820ac33-586c-4674-b96d-49798e96ca05,17,Network activity,domain,"www.eleven.mypop3.org","C2 domains",1,20161116
5820ac33-aa80-4d97-99a2-49798e96ca05,17,Network activity,domain,"www.about.jkub.com","C2 domains",1,20161107
5820ac34-dfc4-4772-8fb6-49798e96ca05,17,Network activity,domain,"www.backus.myftp.name","C2 domains",1,20161116
5820ac71-ff98-486d-b2e6-49798e96ca05,17,Artifacts dropped,md5,"98977426d544bd145979f65f0322ae30","Payload KeyBoy 20151108",1,20161107
5820ac98-f508-4869-9701-497a8e96ca05,17,Network activity,ip-dst,"103.242.134.243","C2 IP",1,20161116
5820ad1d-5d34-489f-97b8-497a8e96ca05,17,Network activity,ip-dst,"157.7.84.81","IPs for C2 Host: www.about.jkub[.]com",1,20161107
5820ad1d-a7c0-4f84-9d29-497a8e96ca05,17,Network activity,ip-dst,"45.32.47.148","IPs for C2 Host: www.about.jkub[.]com",1,20161107
5820ad50-de2c-4f26-bd5c-497a8e96ca05,17,Network activity,ip-dst,"192.241.149.43","IP behind C2 Host: www.backus.myftp[.]name",1,20161107
5820ad9c-c3c4-455e-a5f2-497a8e96ca05,17,Artifacts dropped,md5,"c5b5f01ba24d6c02636388809f44472e","Payload KeyBoy 20151108",1,20161107
5820adb2-5520-499c-95d3-49798e96ca05,17,Artifacts dropped,md5,"371bc132499f455f06fa80696db0df27","64b KeyBoy payload 20151108",1,20161107
5820ae20-ebec-43d6-9f95-497a8e96ca05,17,Artifacts dropped,yara,"import ""pe""
rule new_keyboy_export
{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the new 2016 sample's export""
date = ""2016-08-28""
md5 = ""495adb1b9777002ecfe22aaf52fcee93""
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
//The malware family seems to share many exports
//but this is the new kid on the block.
pe.exports(""cfsUpdate"")
}","",1,20161107
5820ae49-9114-4d4d-b043-49798e96ca05,17,Artifacts dropped,yara,"rule new_keyboy_header_codes
{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the 2016 sample's header codes""
date = ""2016-08-28""
md5 = ""495adb1b9777002ecfe22aaf52fcee93""
strings:
$s1 = ""*l*"" wide fullword
$s2 = ""*a*"" wide fullword
$s3 = ""*s*"" wide fullword
$s4 = ""*d*"" wide fullword
$s5 = ""*f*"" wide fullword
$s6 = ""*g*"" wide fullword
$s7 = ""*h*"" wide fullword
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
all of them
}","",1,20161107
5820ae5c-cac4-4c1a-a969-497a8e96ca05,17,Artifacts dropped,yara,"rule keyboy_commands
{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the 2016 sample's sent and received commands""
date = ""2016-08-28""
md5 = ""495adb1b9777002ecfe22aaf52fcee93""
strings:
$s1 = ""Update"" wide fullword
$s2 = ""UpdateAndRun"" wide fullword
$s3 = ""Refresh"" wide fullword
$s4 = ""OnLine"" wide fullword
$s5 = ""Disconnect"" wide fullword
$s6 = ""Pw_Error"" wide fullword
$s7 = ""Pw_OK"" wide fullword
$s8 = ""Sysinfo"" wide fullword
$s9 = ""Download"" wide fullword
$s10 = ""UploadFileOk"" wide fullword
$s11 = ""RemoteRun"" wide fullword
$s12 = ""FileManager"" wide fullword
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
6 of them
}","",1,20161107
5820ae72-a878-4992-b659-49798e96ca05,17,Artifacts dropped,yara,"rule keyboy_errors
{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the sample's shell error2 log statements""
date = ""2016-08-28""
md5 = ""495adb1b9777002ecfe22aaf52fcee93""
strings:
//These strings are in ASCII pre-2015 and UNICODE in 2016
$error = ""Error2"" ascii wide
//2016 specific:
$s1 = ""Can't find [%s]!Check the file name and try again!"" ascii wide
$s2 = ""Open [%s] error! %d"" ascii wide
$s3 = ""The Size of [%s] is zero!"" ascii wide
$s4 = ""CreateThread DownloadFile[%s] Error!"" ascii wide
$s5 = ""UploadFile [%s] Error:Connect Server Failed!"" ascii wide
$s6 = ""Receive [%s] Error(Recved[%d] != Send[%d])!"" ascii wide
$s7 = ""Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s"" ascii wide
$s8 = ""CreateThread UploadFile[%s] Error!"" ascii wide
//Pre-2016:
$s9 = ""Ready Download [%s] ok!"" ascii wide
$s10 = ""Get ControlInfo from FileClient error!"" ascii wide
$s11 = ""FileClient has a error!"" ascii wide
$s12 = ""VirtualAlloc SendBuff Error(%d)"" ascii wide
$s13 = ""ReadFile [%s] Error(%d)..."" ascii wide
$s14 = ""ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error..."" ascii wide
$s15 = ""CreateThread DownloadFile[%s] Error!"" ascii wide
$s16 = ""RecvData MyRecv_Info Size Error!"" ascii wide
$s17 = ""RecvData MyRecv_Info Tag Error!"" ascii wide
$s18 = ""SendData szControlInfo_1 Error!"" ascii wide
$s19 = ""SendData szControlInfo_3 Error!"" ascii wide
$s20 = ""VirtualAlloc RecvBuff Error(%d)"" ascii wide
$s21 = ""RecvData Error!"" ascii wide
$s22 = ""WriteFile [%s} Error(%d)..."" ascii wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
$error and 3 of ($s*)
}","",1,20161107
5820ae84-8770-42eb-a2f4-497a8e96ca05,17,Artifacts dropped,yara,"rule keyboy_systeminfo
{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the system information format before sending to C2""
date = ""2016-08-28""
md5 = ""495adb1b9777002ecfe22aaf52fcee93""
strings:
//These strings are ASCII pre-2015 and UNICODE in 2016
$s1 = ""SystemVersion: %s"" ascii wide
$s2 = ""Product ID: %s"" ascii wide
$s3 = ""InstallPath: %s"" ascii wide
$s4 = ""InstallTime: %d-%d-%d, %02d:%02d:%02d"" ascii wide
$s5 = ""ResgisterGroup: %s"" ascii wide
$s6 = ""RegisterUser: %s"" ascii wide
$s7 = ""ComputerName: %s"" ascii wide
$s8 = ""WindowsDirectory: %s"" ascii wide
$s9 = ""System Directory: %s"" ascii wide
$s10 = ""Number of Processors: %d"" ascii wide
$s11 = ""CPU[%d]: %s: %sMHz"" ascii wide
$s12 = ""RAM: %dMB Total, %dMB Free."" ascii wide
$s13 = ""DisplayMode: %d x %d, %dHz, %dbit"" ascii wide
$s14 = ""Uptime: %d Days %02u:%02u:%02u"" ascii wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
7 of them
}","",1,20161107
5820ae9b-0028-4ea1-bc1f-49798e96ca05,17,Artifacts dropped,yara,"import ""pe""
rule keyboy_related_exports
{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the new 2016 sample's export""
date = ""2016-08-28""
md5 = ""495adb1b9777002ecfe22aaf52fcee93""
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
//The malware family seems to share many exports
//but this is the new kid on the block.
pe.exports(""Embedding"") or
pe.exports(""SSSS"") or
pe.exports(""GetUP"")
}","",1,20161107
5820aeb4-7f4c-4e5b-af06-497a8e96ca05,17,Artifacts dropped,yara,"import ""pe""
rule keyboy_init_config_section
{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the Init section where the config is stored""
date = ""2016-08-28""
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
//Payloads are normally smaller but the new dropper we spotted
//is a bit larger.
filesize < 300KB and
//Observed virtual sizes of the .Init section vary but they've
//always been 1024, 2048, or 4096 bytes.
for any i in (0..pe.number_of_sections - 1):
(
pe.sections[i].name == "".Init"" and
pe.sections[i].virtual_size % 1024 == 0
)
}","",1,20161107
5820aed7-4eac-4c87-ac4e-49798e96ca05,17,Payload delivery,yara,"rule CVE_2012_0158_KeyBoy {
meta:
author = ""Etienne Maynier <etienne@citizenlab.ca>""
description = ""CVE-2012-0158 variant""
file = ""8307e444cad98b1b59568ad2eba5f201""
strings:
$a = ""d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001"" nocase // OLE header
$b = ""ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"" nocase // junk data
$c = /5(\{\\b0\}|)[ ]*2006F00(\{\\b0\}|)[ ]*6F007(\{\\b0\}|)[ ]*400200045(\{\\b0\}|)[ ]*006(\{\\b0\}|)[ ]*E007(\{\\b0\}|)[ ]*400720079/ nocase
$d = ""MSComctlLib.ListViewCtrl.2""
$e = ""ac38c874503c307405347aaaebf2ac2c31ebf6e8e3"" nocase //decoding shellcode
condition:
all of them
}","",1,20161107
5820aeee-3fdc-47cc-b940-497a8e96ca05,17,Payload delivery,yara,"rule keyboy_exploit_doc_meta{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the meta associated with these exploit docs""
date = ""2016-09-30""
strings:
$role = ""{\\author Master}{\\operator Master}""
$creatim = ""{\\creatim\\yr2015\\mo10\\dy16\\hr11\\min37}""
$revtim = ""{\\revtim\\yr2015\\mo10\\dy16\\hr13\\min54}""
condition:
uint32be(0) == 0x7B5C7274 and
filesize < 1MB and
all of them
}","",1,20161107
58235402-9d54-437c-b845-69fe8e96ca05,17,Artifacts dropped,regkey,"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ver","Contains the Keyboy version",1,20161116
5823989b-68f0-4831-b1d8-49798e96ca05,17,Payload delivery,sha256,"5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49","dw20.exe dropper",1,20161109
582398da-78c0-47ed-8bb9-49798e96ca05,17,Artifacts dropped,sha256,"9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04","Wab32res.dll payload, KeyBoy 20160509",1,20161109
5823990b-db7c-45c9-9afb-69fe8e96ca05,17,Payload delivery,md5,"23d284245e53ae4fe05c517d807ffccf","dropper of 'agewkassif' version",1,20161109
5823995f-701c-4616-84f5-49798e96ca05,17,Payload delivery,sha256,"542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf","dropper of 'agewkassif' sample",1,20161109
58239987-0038-44ba-997f-49798e96ca05,17,Artifacts dropped,md5,"087bffa8a570079948310dc9731c5709","wab32res.dll, agewkassif version",1,20161109
582399a3-04f8-4542-b205-49798e96ca05,17,Artifacts dropped,sha256,"5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88","Wab32res.dll payload, KeyBoy agewkassif version",1,20161109
582c9016-1a1c-471e-890f-69fe8e96ca05,17,Network activity,ip-dst,"112.10.117.47","Other IP hosting tibetvoices.com",1,20161116
1 uuid event_id category type value comment to_ids date
2 5820ab7b-5a8c-4164-8113-49798e96ca05 17 Artifacts dropped md5 495adb1b9777002ecfe22aaf52fcee93 Wab32res.dll payload, KeyBoy 20160509 1 20161107
3 5820ab93-8b90-4f61-8591-497a8e96ca05 17 Network activity ip-dst 103.40.102.233 C2 IP 1 20161116
4 5820ab93-ca00-4627-a8e9-497a8e96ca05 17 Network activity ip-dst 45.125.12.147 C2 IP 1 20161110
5 5820aba7-e398-41cb-939b-49798e96ca05 17 Network activity domain tibetvoices.com domain linked to one of the C2 IPs 1 20161107
6 5820abec-8b88-4398-ba31-497a8e96ca05 17 Network activity ip-dst 116.193.154.69 C2 IP 1 20161107
7 5820ac1b-05c0-4d60-8fc5-497a8e96ca05 17 Artifacts dropped md5 0c7e55509e0b6d4277b3facf864af018 Payload KeyBoy P_20150313 1 20161107
8 5820ac33-586c-4674-b96d-49798e96ca05 17 Network activity domain www.eleven.mypop3.org C2 domains 1 20161116
9 5820ac33-aa80-4d97-99a2-49798e96ca05 17 Network activity domain www.about.jkub.com C2 domains 1 20161107
10 5820ac34-dfc4-4772-8fb6-49798e96ca05 17 Network activity domain www.backus.myftp.name C2 domains 1 20161116
11 5820ac71-ff98-486d-b2e6-49798e96ca05 17 Artifacts dropped md5 98977426d544bd145979f65f0322ae30 Payload KeyBoy 20151108 1 20161107
12 5820ac98-f508-4869-9701-497a8e96ca05 17 Network activity ip-dst 103.242.134.243 C2 IP 1 20161116
13 5820ad1d-5d34-489f-97b8-497a8e96ca05 17 Network activity ip-dst 157.7.84.81 IPs for C2 Host: www.about.jkub[.]com 1 20161107
14 5820ad1d-a7c0-4f84-9d29-497a8e96ca05 17 Network activity ip-dst 45.32.47.148 IPs for C2 Host: www.about.jkub[.]com 1 20161107
15 5820ad50-de2c-4f26-bd5c-497a8e96ca05 17 Network activity ip-dst 192.241.149.43 IP behind C2 Host: www.backus.myftp[.]name 1 20161107
16 5820ad9c-c3c4-455e-a5f2-497a8e96ca05 17 Artifacts dropped md5 c5b5f01ba24d6c02636388809f44472e Payload KeyBoy 20151108 1 20161107
17 5820adb2-5520-499c-95d3-49798e96ca05 17 Artifacts dropped md5 371bc132499f455f06fa80696db0df27 64b KeyBoy payload 20151108 1 20161107
18 5820ae20-ebec-43d6-9f95-497a8e96ca05 17 Artifacts dropped yara import "pe" rule new_keyboy_export { meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the new 2016 sample's export" date = "2016-08-28" md5 = "495adb1b9777002ecfe22aaf52fcee93" condition: //MZ header uint16(0) == 0x5A4D and //PE signature uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and //The malware family seems to share many exports //but this is the new kid on the block. pe.exports("cfsUpdate") } 1 20161107
19 5820ae49-9114-4d4d-b043-49798e96ca05 17 Artifacts dropped yara rule new_keyboy_header_codes { meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the 2016 sample's header codes" date = "2016-08-28" md5 = "495adb1b9777002ecfe22aaf52fcee93" strings: $s1 = "*l*" wide fullword $s2 = "*a*" wide fullword $s3 = "*s*" wide fullword $s4 = "*d*" wide fullword $s5 = "*f*" wide fullword $s6 = "*g*" wide fullword $s7 = "*h*" wide fullword condition: //MZ header uint16(0) == 0x5A4D and //PE signature uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and all of them } 1 20161107
20 5820ae5c-cac4-4c1a-a969-497a8e96ca05 17 Artifacts dropped yara rule keyboy_commands { meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the 2016 sample's sent and received commands" date = "2016-08-28" md5 = "495adb1b9777002ecfe22aaf52fcee93" strings: $s1 = "Update" wide fullword $s2 = "UpdateAndRun" wide fullword $s3 = "Refresh" wide fullword $s4 = "OnLine" wide fullword $s5 = "Disconnect" wide fullword $s6 = "Pw_Error" wide fullword $s7 = "Pw_OK" wide fullword $s8 = "Sysinfo" wide fullword $s9 = "Download" wide fullword $s10 = "UploadFileOk" wide fullword $s11 = "RemoteRun" wide fullword $s12 = "FileManager" wide fullword condition: //MZ header uint16(0) == 0x5A4D and //PE signature uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and 6 of them } 1 20161107
21 5820ae72-a878-4992-b659-49798e96ca05 17 Artifacts dropped yara rule keyboy_errors { meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the sample's shell error2 log statements" date = "2016-08-28" md5 = "495adb1b9777002ecfe22aaf52fcee93" strings: //These strings are in ASCII pre-2015 and UNICODE in 2016 $error = "Error2" ascii wide //2016 specific: $s1 = "Can't find [%s]!Check the file name and try again!" ascii wide $s2 = "Open [%s] error! %d" ascii wide $s3 = "The Size of [%s] is zero!" ascii wide $s4 = "CreateThread DownloadFile[%s] Error!" ascii wide $s5 = "UploadFile [%s] Error:Connect Server Failed!" ascii wide $s6 = "Receive [%s] Error(Recved[%d] != Send[%d])!" ascii wide $s7 = "Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s" ascii wide $s8 = "CreateThread UploadFile[%s] Error!" ascii wide //Pre-2016: $s9 = "Ready Download [%s] ok!" ascii wide $s10 = "Get ControlInfo from FileClient error!" ascii wide $s11 = "FileClient has a error!" ascii wide $s12 = "VirtualAlloc SendBuff Error(%d)" ascii wide $s13 = "ReadFile [%s] Error(%d)..." ascii wide $s14 = "ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error..." ascii wide $s15 = "CreateThread DownloadFile[%s] Error!" ascii wide $s16 = "RecvData MyRecv_Info Size Error!" ascii wide $s17 = "RecvData MyRecv_Info Tag Error!" ascii wide $s18 = "SendData szControlInfo_1 Error!" ascii wide $s19 = "SendData szControlInfo_3 Error!" ascii wide $s20 = "VirtualAlloc RecvBuff Error(%d)" ascii wide $s21 = "RecvData Error!" ascii wide $s22 = "WriteFile [%s} Error(%d)..." ascii wide condition: //MZ header uint16(0) == 0x5A4D and //PE signature uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and $error and 3 of ($s*) } 1 20161107
22 5820ae84-8770-42eb-a2f4-497a8e96ca05 17 Artifacts dropped yara rule keyboy_systeminfo { meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the system information format before sending to C2" date = "2016-08-28" md5 = "495adb1b9777002ecfe22aaf52fcee93" strings: //These strings are ASCII pre-2015 and UNICODE in 2016 $s1 = "SystemVersion: %s" ascii wide $s2 = "Product ID: %s" ascii wide $s3 = "InstallPath: %s" ascii wide $s4 = "InstallTime: %d-%d-%d, %02d:%02d:%02d" ascii wide $s5 = "ResgisterGroup: %s" ascii wide $s6 = "RegisterUser: %s" ascii wide $s7 = "ComputerName: %s" ascii wide $s8 = "WindowsDirectory: %s" ascii wide $s9 = "System Directory: %s" ascii wide $s10 = "Number of Processors: %d" ascii wide $s11 = "CPU[%d]: %s: %sMHz" ascii wide $s12 = "RAM: %dMB Total, %dMB Free." ascii wide $s13 = "DisplayMode: %d x %d, %dHz, %dbit" ascii wide $s14 = "Uptime: %d Days %02u:%02u:%02u" ascii wide condition: //MZ header uint16(0) == 0x5A4D and //PE signature uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and 7 of them } 1 20161107
23 5820ae9b-0028-4ea1-bc1f-49798e96ca05 17 Artifacts dropped yara import "pe" rule keyboy_related_exports { meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the new 2016 sample's export" date = "2016-08-28" md5 = "495adb1b9777002ecfe22aaf52fcee93" condition: //MZ header uint16(0) == 0x5A4D and //PE signature uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and //The malware family seems to share many exports //but this is the new kid on the block. pe.exports("Embedding") or pe.exports("SSSS") or pe.exports("GetUP") } 1 20161107
24 5820aeb4-7f4c-4e5b-af06-497a8e96ca05 17 Artifacts dropped yara import "pe" rule keyboy_init_config_section { meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the Init section where the config is stored" date = "2016-08-28" condition: //MZ header uint16(0) == 0x5A4D and //PE signature uint32(uint32(0x3C)) == 0x00004550 and //Payloads are normally smaller but the new dropper we spotted //is a bit larger. filesize < 300KB and //Observed virtual sizes of the .Init section vary but they've //always been 1024, 2048, or 4096 bytes. for any i in (0..pe.number_of_sections - 1): ( pe.sections[i].name == ".Init" and pe.sections[i].virtual_size % 1024 == 0 ) } 1 20161107
25 5820aed7-4eac-4c87-ac4e-49798e96ca05 17 Payload delivery yara rule CVE_2012_0158_KeyBoy { meta: author = "Etienne Maynier <etienne@citizenlab.ca>" description = "CVE-2012-0158 variant" file = "8307e444cad98b1b59568ad2eba5f201" strings: $a = "d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001" nocase // OLE header $b = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" nocase // junk data $c = /5(\{\\b0\}|)[ ]*2006F00(\{\\b0\}|)[ ]*6F007(\{\\b0\}|)[ ]*400200045(\{\\b0\}|)[ ]*006(\{\\b0\}|)[ ]*E007(\{\\b0\}|)[ ]*400720079/ nocase $d = "MSComctlLib.ListViewCtrl.2" $e = "ac38c874503c307405347aaaebf2ac2c31ebf6e8e3" nocase //decoding shellcode condition: all of them } 1 20161107
26 5820aeee-3fdc-47cc-b940-497a8e96ca05 17 Payload delivery yara rule keyboy_exploit_doc_meta{ meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the meta associated with these exploit docs" date = "2016-09-30" strings: $role = "{\\author Master}{\\operator Master}" $creatim = "{\\creatim\\yr2015\\mo10\\dy16\\hr11\\min37}" $revtim = "{\\revtim\\yr2015\\mo10\\dy16\\hr13\\min54}" condition: uint32be(0) == 0x7B5C7274 and filesize < 1MB and all of them } 1 20161107
27 58235402-9d54-437c-b845-69fe8e96ca05 17 Artifacts dropped regkey HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ver Contains the Keyboy version 1 20161116
28 5823989b-68f0-4831-b1d8-49798e96ca05 17 Payload delivery sha256 5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49 dw20.exe dropper 1 20161109
29 582398da-78c0-47ed-8bb9-49798e96ca05 17 Artifacts dropped sha256 9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04 Wab32res.dll payload, KeyBoy 20160509 1 20161109
30 5823990b-db7c-45c9-9afb-69fe8e96ca05 17 Payload delivery md5 23d284245e53ae4fe05c517d807ffccf dropper of 'agewkassif' version 1 20161109
31 5823995f-701c-4616-84f5-49798e96ca05 17 Payload delivery sha256 542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf dropper of 'agewkassif' sample 1 20161109
32 58239987-0038-44ba-997f-49798e96ca05 17 Artifacts dropped md5 087bffa8a570079948310dc9731c5709 wab32res.dll, agewkassif version 1 20161109
33 582399a3-04f8-4542-b205-49798e96ca05 17 Artifacts dropped sha256 5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88 Wab32res.dll payload, KeyBoy agewkassif version 1 20161109
34 582c9016-1a1c-471e-890f-69fe8e96ca05 17 Network activity ip-dst 112.10.117.47 Other IP hosting tibetvoices.com 1 20161116