sssnake/autarch
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

Browse Source
This commit is contained in:
SsSnake
2026-07-13 15:45:47 -07:00
parent 925216290f
commit e48d577bd5
387 changed files with 211976 additions and 921 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
data/ioc/yara/filetypes.yara Normal file
View File

@@ -0,0 +1,40 @@
private rule IsRTF : RTF
{
meta:
description = "Identifier for RTF files"
author = "Seth Hardy"
last_modified = "2014-05-05"
strings:
$magic = /^\s*{\\rt/
condition:
$magic
}
private rule IsOLE : OLE
{
meta:
description = "Identifier for OLE files"
author = "Seth Hardy"
last_modified = "2014-05-06"
strings:
$magic = {d0 cf 11 e0 a1 b1 1a e1}
condition:
$magic at 0
}
private rule IsPE : PE
{
meta:
description = "Identifier for PE files"
last_modified = "2014-07-11"
strings:
$magic = { 5a 4d }
condition:
$magic at 0 and uint32(uint32(0x3C)) == 0x00004550
}

289
data/ioc/yara/keyboy.yar Normal file
View File

@@ -0,0 +1,289 @@
import "pe"
/*
*
* This section of the rules are all specific to the new 2016
* KeyBoy sample targeting the Tibetan community. Other following
* sections capture file characteristics observed across multiple
* years of development. Don't miss the exploit doc signatures
* at the very end.
*
*/
rule new_keyboy_export
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the new 2016 sample's export"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
//The malware family seems to share many exports
//but this is the new kid on the block.
pe.exports("cfsUpdate")
}
rule new_keyboy_header_codes
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the 2016 sample's header codes"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
strings:
$s1 = "*l*" wide fullword
$s2 = "*a*" wide fullword
$s3 = "*s*" wide fullword
$s4 = "*d*" wide fullword
$s5 = "*f*" wide fullword
$s6 = "*g*" wide fullword
$s7 = "*h*" wide fullword
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
all of them
}
/*
*
* This section of the rules are all broader and will hit on
* older KeyBoy samples and other samples possibly part of a
* a larger development effort.
*
*/
rule keyboy_commands
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the 2016 sample's sent and received commands"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
strings:
$s1 = "Update" wide fullword
$s2 = "UpdateAndRun" wide fullword
$s3 = "Refresh" wide fullword
$s4 = "OnLine" wide fullword
$s5 = "Disconnect" wide fullword
$s6 = "Pw_Error" wide fullword
$s7 = "Pw_OK" wide fullword
$s8 = "Sysinfo" wide fullword
$s9 = "Download" wide fullword
$s10 = "UploadFileOk" wide fullword
$s11 = "RemoteRun" wide fullword
$s12 = "FileManager" wide fullword
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
6 of them
}
rule keyboy_errors
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the sample's shell error2 log statements"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
strings:
//These strings are in ASCII pre-2015 and UNICODE in 2016
$error = "Error2" ascii wide
//2016 specific:
$s1 = "Can't find [%s]!Check the file name and try again!" ascii wide
$s2 = "Open [%s] error! %d" ascii wide
$s3 = "The Size of [%s] is zero!" ascii wide
$s4 = "CreateThread DownloadFile[%s] Error!" ascii wide
$s5 = "UploadFile [%s] Error:Connect Server Failed!" ascii wide
$s6 = "Receive [%s] Error(Recved[%d] != Send[%d])!" ascii wide
$s7 = "Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s" ascii wide
$s8 = "CreateThread UploadFile[%s] Error!" ascii wide
//Pre-2016:
$s9 = "Ready Download [%s] ok!" ascii wide
$s10 = "Get ControlInfo from FileClient error!" ascii wide
$s11 = "FileClient has a error!" ascii wide
$s12 = "VirtualAlloc SendBuff Error(%d)" ascii wide
$s13 = "ReadFile [%s] Error(%d)..." ascii wide
$s14 = "ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error..." ascii wide
$s15 = "CreateThread DownloadFile[%s] Error!" ascii wide
$s16 = "RecvData MyRecv_Info Size Error!" ascii wide
$s17 = "RecvData MyRecv_Info Tag Error!" ascii wide
$s18 = "SendData szControlInfo_1 Error!" ascii wide
$s19 = "SendData szControlInfo_3 Error!" ascii wide
$s20 = "VirtualAlloc RecvBuff Error(%d)" ascii wide
$s21 = "RecvData Error!" ascii wide
$s22 = "WriteFile [%s} Error(%d)..." ascii wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
$error and 3 of ($s*)
}
rule keyboy_systeminfo
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the system information format before sending to C2"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
strings:
//These strings are ASCII pre-2015 and UNICODE in 2016
$s1 = "SystemVersion: %s" ascii wide
$s2 = "Product ID: %s" ascii wide
$s3 = "InstallPath: %s" ascii wide
$s4 = "InstallTime: %d-%d-%d, %02d:%02d:%02d" ascii wide
$s5 = "ResgisterGroup: %s" ascii wide
$s6 = "RegisterUser: %s" ascii wide
$s7 = "ComputerName: %s" ascii wide
$s8 = "WindowsDirectory: %s" ascii wide
$s9 = "System Directory: %s" ascii wide
$s10 = "Number of Processors: %d" ascii wide
$s11 = "CPU[%d]: %s: %sMHz" ascii wide
$s12 = "RAM: %dMB Total, %dMB Free." ascii wide
$s13 = "DisplayMode: %d x %d, %dHz, %dbit" ascii wide
$s14 = "Uptime: %d Days %02u:%02u:%02u" ascii wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
7 of them
}
rule keyboy_related_exports
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the new 2016 sample's export"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
//The malware family seems to share many exports
//but this is the new kid on the block.
pe.exports("Embedding") or
pe.exports("SSSS") or
pe.exports("GetUP")
}
// Note: The use of the .Init section has been observed in nearly
// all samples with the exception of the 2013 VN dropper from the
// Rapid7 blog. The config data was stored in that sample's .data
// section.
rule keyboy_init_config_section
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the Init section where the config is stored"
date = "2016-08-28"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
//Payloads are normally smaller but the new dropper we spotted
//is a bit larger.
filesize < 300KB and
//Observed virtual sizes of the .Init section vary but they've
//always been 1024, 2048, or 4096 bytes.
for any i in (0..pe.number_of_sections - 1):
(
pe.sections[i].name == ".Init" and
pe.sections[i].virtual_size % 1024 == 0
)
}
/*
*
* These signatures fire on the exploit documents used in this
* operation.
*
*/
rule CVE_2012_0158_KeyBoy {
meta:
author = "Etienne Maynier <etienne@citizenlab.ca>"
description = "CVE-2012-0158 variant"
file = "8307e444cad98b1b59568ad2eba5f201"
strings:
$a = "d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001" nocase // OLE header
$b = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" nocase // junk data
$c = /5(\{\\b0\}|)[ ]*2006F00(\{\\b0\}|)[ ]*6F007(\{\\b0\}|)[ ]*400200045(\{\\b0\}|)[ ]*006(\{\\b0\}|)[ ]*E007(\{\\b0\}|)[ ]*400720079/ nocase
$d = "MSComctlLib.ListViewCtrl.2"
$e = "ac38c874503c307405347aaaebf2ac2c31ebf6e8e3" nocase //decoding shellcode
condition:
all of them
}

40
data/ioc/yara/malware_families/3102.yara Normal file
View File

@@ -0,0 +1,40 @@
private rule APT3102Code : APT3102 Family
{
meta:
description = "3102 code features"
author = "Seth Hardy"
last_modified = "2014-06-25"
strings:
$setupthread = { B9 02 07 00 00 BE ?? ?? ?? ?? 8B F8 6A 00 F3 A5 }
condition:
any of them
}
private rule APT3102Strings : APT3102 Family
{
meta:
description = "3102 Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-25"
strings:
$ = "rundll32_exec.dll\x00Update"
// this is in the encrypted code - shares with 9002 variant
//$ = "POST http://%ls:%d/%x HTTP/1.1"
condition:
any of them
}
rule APT3102 : Family
{
meta:
description = "3102"
author = "Seth Hardy"
last_modified = "2014-06-25"
condition:
APT3102Code or APT3102Strings
}

47
data/ioc/yara/malware_families/9002.yara Normal file
View File

@@ -0,0 +1,47 @@
private rule APT9002Code : APT9002 Family
{
meta:
description = "9002 code features"
author = "Seth Hardy"
last_modified = "2014-06-25"
strings:
// start code block
$ = { B9 7A 21 00 00 BE ?? ?? ?? ?? 8B F8 ?? ?? ?? F3 A5 }
// decryption from other variant with multiple start threads
$ = { 8A 14 3E 8A 1C 01 32 DA 88 1C 01 8B 54 3E 04 40 3B C2 72 EC }
condition:
any of them
}
private rule APT9002Strings : APT9002 Family
{
meta:
description = "9002 Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-25"
strings:
$ = "POST http://%ls:%d/%x HTTP/1.1"
$ = "%%TEMP%%\\%s_p.ax" wide ascii
$ = "%TEMP%\\uid.ax" wide ascii
$ = "%%TEMP%%\\%s.ax" wide ascii
// also triggers on surtr $ = "mydll.dll\x00DoWork"
$ = "sysinfo\x00sysbin01"
$ = "\\FlashUpdate.exe"
condition:
any of them
}
rule APT9002 : Family
{
meta:
description = "9002"
author = "Seth Hardy"
last_modified = "2014-06-25"
condition:
APT9002Code or APT9002Strings
}

190
data/ioc/yara/malware_families/UP007.yara Normal file
View File

@@ -0,0 +1,190 @@
rule dubseven_file_set
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for service files loading UP007"
strings:
$file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
$file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
$file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
$file4 = "\\Microsoft\\Internet Explorer\\main.dll"
$file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
$file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
$file7 = "\\Microsoft\\Internet Explorer\\mon"
$file8 = "\\Microsoft\\Internet Explorer\\runas.exe"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
//Just a few of these as they differ
3 of ($file*)
}
rule dubseven_dropper_registry_checks
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for registry keys checked for by the dropper"
strings:
$reg1 = "SOFTWARE\\360Safe\\Liveup"
$reg2 = "Software\\360safe"
$reg3 = "SOFTWARE\\kingsoft\\Antivirus"
$reg4 = "SOFTWARE\\Avira\\Avira Destop"
$reg5 = "SOFTWARE\\rising\\RAV"
$reg6 = "SOFTWARE\\JiangMin"
$reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
all of ($reg*)
}
rule dubseven_dropper_dialog_remains
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for related dialog remnants. How rude."
strings:
$dia1 = "fuckMessageBox 1.0" wide
$dia2 = "Rundll 1.0" wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
any of them
}
rule maindll_mutex
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches on the maindll mutex"
strings:
$mutex = "h31415927tttt"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$mutex
}
rule SLServer_dialog_remains
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for related dialog remnants."
strings:
$slserver = "SLServer" wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$slserver
}
rule SLServer_mutex
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for the mutex."
strings:
$mutex = "M&GX^DSF&DA@F"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$mutex
}
rule SLServer_command_and_control
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for the C2 server."
strings:
$c2 = "safetyssl.security-centers.com"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$c2
}
rule SLServer_campaign_code
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for the related campaign code."
strings:
$campaign = "wthkdoc0106"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$campaign
}
rule SLServer_unknown_string
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for a unique string."
strings:
$string = "test-b7fa835a39"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$string
}

45
data/ioc/yara/malware_families/bangat.yara Normal file
View File

@@ -0,0 +1,45 @@
private rule BangatCode : Bangat Family
{
meta:
description = "Bangat code features"
author = "Seth Hardy"
last_modified = "2014-07-10"
strings:
// dec [ebp + procname], push eax, push edx, call get procaddress
$ = { FE 4D ?? 8D 4? ?? 50 5? FF }
condition:
any of them
}
private rule BangatStrings : Bangat Family
{
meta:
description = "Bangat Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-07-10"
strings:
$lib1 = "DreatePipe"
$lib2 = "HetSystemDirectoryA"
$lib3 = "SeleaseMutex"
$lib4 = "DloseWindowStation"
$lib5 = "DontrolService"
$file = "~hhC2F~.tmp"
$mc = "~_MC_3~"
condition:
all of ($lib*) or $file or $mc
}
rule Bangat : Family
{
meta:
description = "Bangat"
author = "Seth Hardy"
last_modified = "2014-07-10"
condition:
BangatCode or BangatStrings
}

42
data/ioc/yara/malware_families/boouset.yara Normal file
View File

@@ -0,0 +1,42 @@
private rule BoousetCode : Boouset Family
{
meta:
description = "Boouset code tricks"
author = "Seth Hardy"
last_modified = "2014-06-19"
strings:
$boousetdat = { C6 ?? ?? ?? ?? 00 62 C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 75 }
condition:
any of them
}
private rule BoousetStrings : Boouset Family
{
meta:
description = "Boouset Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-19"
strings:
$ = "Q\x00\x00\x00\x00W\x00\x00\x00\x00E\x00\x00\x00\x00R\x00\x00\x00\x00T\x00\x00\x00\x00Y\x00\x00\x00\x00"
$ = "A\x00\x00\x00\x00S\x00\x00\x00\x00D\x00\x00\x00\x00F\x00\x00\x00\x00G\x00\x00\x00\x00H"
$ = "Z\x00\x00\x00\x00X\x00\x00\x00\x00C\x00\x00\x00\x00V\x00\x00\x00\x00B\x00\x00\x00\x00N\x00\x00\x00\x00"
$ = "\\~Z8314.tmp"
$ = "hulee midimap" wide ascii
condition:
any of them
}
rule Boouset : Family
{
meta:
description = "Boouset"
author = "Seth Hardy"
last_modified = "2014-06-19"
condition:
BoousetCode or BoousetStrings
}

43
data/ioc/yara/malware_families/comfoo.yara Normal file
View File

@@ -0,0 +1,43 @@
private rule ComfooCode : Comfoo Family
{
meta:
description = "Comfoo code features"
author = "Seth Hardy"
last_modified = "2014-06-20"
strings:
$resource = { 6A 6C 6A 59 55 E8 01 FA FF FF }
condition:
any of them
}
private rule ComfooStrings : Comfoo Family
{
meta:
description = "Comfoo Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-20"
strings:
$ = "fefj90"
$ = "iamwaitingforu653890"
$ = "watchevent29021803"
$ = "THIS324NEWGAME"
$ = "ms0ert.temp"
$ = "\\mstemp.temp"
condition:
any of them
}
rule Comfoo : Family
{
meta:
description = "Comfoo"
author = "Seth Hardy"
last_modified = "2014-06-20"
condition:
ComfooCode or ComfooStrings
}

38
data/ioc/yara/malware_families/cookies.yara Normal file
View File

@@ -0,0 +1,38 @@
private rule CookiesStrings : Cookies Family
{
meta:
description = "Cookies Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-20"
strings:
$zip1 = "ntdll.exePK"
$zip2 = "AcroRd32.exePK"
$zip3 = "Setup=ntdll.exe\x0d\x0aSilent=1\x0d\x0a"
$zip4 = "Setup=%temp%\\AcroRd32.exe\x0d\x0a"
$exe1 = "Leave GetCommand!"
$exe2 = "perform exe success!"
$exe3 = "perform exe failure!"
$exe4 = "Entry SendCommandReq!"
$exe5 = "Reqfile not exist!"
$exe6 = "LeaveDealUpfile!"
$exe7 = "Entry PostData!"
$exe8 = "Leave PostFile!"
$exe9 = "Entry PostFile!"
$exe10 = "\\unknow.zip" wide ascii
$exe11 = "the url no respon!"
condition:
(2 of ($zip*)) or (2 of ($exe*))
}
rule Cookies : Family
{
meta:
description = "Cookies"
author = "Seth Hardy"
last_modified = "2014-06-20"
condition:
CookiesStrings
}

42
data/ioc/yara/malware_families/cxpid.yara Normal file
View File

@@ -0,0 +1,42 @@
private rule cxpidCode : cxpid Family
{
meta:
description = "cxpid code features"
author = "Seth Hardy"
last_modified = "2014-06-23"
strings:
$entryjunk = { 55 8B EC B9 38 04 00 00 6A 00 6A 00 49 75 F9 }
condition:
any of them
}
private rule cxpidStrings : cxpid Family
{
meta:
description = "cxpid Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-23"
strings:
$ = "/cxpid/submit.php?SessionID="
$ = "/cxgid/"
$ = "E21BC52BEA2FEF26D005CF"
$ = "E21BC52BEA39E435C40CD8"
$ = " -,L-,O+,Q-,R-,Y-,S-"
condition:
any of them
}
rule cxpid : Family
{
meta:
description = "cxpid"
author = "Seth Hardy"
last_modified = "2014-06-23"
condition:
cxpidCode or cxpidStrings
}

69
data/ioc/yara/malware_families/enfal.yara Normal file
View File

@@ -0,0 +1,69 @@
private rule EnfalCode : Enfal Family
{
meta:
description = "Enfal code tricks"
author = "Seth Hardy"
last_modified = "2014-06-19"
strings:
// mov al, 20h; sub al, bl; add [ebx+esi], al; push esi; inc ebx; call edi; cmp ebx, eax
$decrypt = { B0 20 2A C3 00 04 33 56 43 FF D7 3B D8 }
condition:
any of them
}
private rule EnfalStrings : Enfal Family
{
meta:
description = "Enfal Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-19"
strings:
$ = "D:\\work\\\xe6\xba\x90\xe5\x93\xa5\xe5\x85\x8d\xe6\x9d\x80\\tmp\\Release\\ServiceDll.pdb"
$ = "e:\\programs\\LuridDownLoader"
$ = "LuridDownloader for Falcon"
$ = "DllServiceTrojan"
$ = "\\k\\\xe6\xa1\x8c\xe8\x9d\xa2\\"
$ = "EtenFalcon\xef\xbc\x88\xe4\xbf\xae\xe6\x94\xb9\xef\xbc\x89"
$ = "Madonna\x00Jesus"
$ = "/iupw82/netstate"
$ = "fuckNodAgain"
$ = "iloudermao"
$ = "Crpq2.cgi"
$ = "Clnpp5.cgi"
$ = "Dqpq3ll.cgi"
$ = "dieosn83.cgi"
$ = "Rwpq1.cgi"
$ = "/Ccmwhite"
$ = "/Cmwhite"
$ = "/Crpwhite"
$ = "/Dfwhite"
$ = "/Query.txt"
$ = "/Ufwhite"
$ = "/cgl-bin/Clnpp5.cgi"
$ = "/cgl-bin/Crpq2.cgi"
$ = "/cgl-bin/Dwpq3ll.cgi"
$ = "/cgl-bin/Owpq4.cgi"
$ = "/cgl-bin/Rwpq1.cgi"
$ = "/trandocs/mm/"
$ = "/trandocs/netstat"
$ = "NFal.exe"
$ = "LINLINVMAN"
$ = "7NFP4R9W"
condition:
any of them
}
rule Enfal : Family
{
meta:
description = "Enfal"
author = "Seth Hardy"
last_modified = "2014-06-19"
condition:
EnfalCode or EnfalStrings
}

28
data/ioc/yara/malware_families/ezcob.yara Normal file
View File

@@ -0,0 +1,28 @@
private rule EzcobStrings : Ezcob Family
{
meta:
description = "Ezcob Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-23"
strings:
$ = "\x12F\x12F\x129\x12E\x12A\x12E\x12B\x12A\x12-\x127\x127\x128\x123\x12"
$ = "\x121\x12D\x128\x123\x12B\x122\x12E\x128\x12-\x12B\x122\x123\x12D\x12"
$ = "Ezcob" wide ascii
$ = "l\x12i\x12u\x122\x120\x121\x123\x120\x124\x121\x126"
$ = "20110113144935"
condition:
any of them
}
rule Ezcob : Family
{
meta:
description = "Ezcob"
author = "Seth Hardy"
last_modified = "2014-06-23"
condition:
EzcobStrings
}

42
data/ioc/yara/malware_families/fakem.yara Normal file
View File

@@ -0,0 +1,42 @@
private rule HTMLVariant : FakeM Family HTML Variant
{
meta:
description = "Identifier for html variant of FAKEM"
author = "Katie Kleemola"
last_updated = "2014-05-20"
strings:
// decryption loop
$s1 = { 8B 55 08 B9 00 50 00 00 8D 3D ?? ?? ?? 00 8B F7 AD 33 C2 AB 83 E9 04 85 C9 75 F5 }
//mov byte ptr [ebp - x] y, x: 0x10-0x1 y: 0-9,A-F
$s2 = { C6 45 F? (3?|4?) }
condition:
$s1 and #s2 == 16
}
//todo: need rules for other variants
rule FakeM : Family
{
meta:
description = "FakeM"
author = "Katie Kleemola"
last_updated = "2014-07-03"
condition:
HTMLVariant
}
rule FAKEMhtml : Variant
{
meta:
description = "Rule for just the HTML Variant"
author = "Katie Kleemola"
last_updated = "2014-07-10"
condition:
HTMLVariant
}

42
data/ioc/yara/malware_families/favorite.yara Normal file
View File

@@ -0,0 +1,42 @@
private rule FavoriteCode : Favorite Family
{
meta:
description = "Favorite code features"
author = "Seth Hardy"
last_modified = "2014-06-24"
strings:
// standard string hiding
$ = { C6 45 ?? 3B C6 45 ?? 27 C6 45 ?? 34 C6 45 ?? 75 C6 45 ?? 6B C6 45 ?? 6C C6 45 ?? 3B C6 45 ?? 2F }
$ = { C6 45 ?? 6F C6 45 ?? 73 C6 45 ?? 73 C6 45 ?? 76 C6 45 ?? 63 C6 45 ?? 65 C6 45 ?? 78 C6 45 ?? 65 }
condition:
any of them
}
private rule FavoriteStrings : Favorite Family
{
meta:
description = "Favorite Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-24"
strings:
$string1 = "!QAZ4rfv"
$file1 = "msupdater.exe"
$file2 = "FAVORITES.DAT"
condition:
any of ($string*) or all of ($file*)
}
rule Favorite : Family
{
meta:
description = "Favorite"
author = "Seth Hardy"
last_modified = "2014-06-24"
condition:
FavoriteCode or FavoriteStrings
}

43
data/ioc/yara/malware_families/glasses.yara Normal file
View File

@@ -0,0 +1,43 @@
private rule GlassesCode : Glasses Family
{
meta:
description = "Glasses code features"
author = "Seth Hardy"
last_modified = "2014-07-22"
strings:
$ = { B8 AB AA AA AA F7 E1 D1 EA 8D 04 52 2B C8 }
$ = { B8 56 55 55 55 F7 E9 8B 4C 24 1C 8B C2 C1 E8 1F 03 D0 49 3B CA }
condition:
any of them
}
private rule GlassesStrings : Glasses Family
{
meta:
description = "Strings used by Glasses"
author = "Seth Hardy"
last_modified = "2014-07-22"
strings:
$ = "thequickbrownfxjmpsvalzydg"
$ = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0; Trident/4.0; %s.%s)"
$ = "\" target=\"NewRef\"></a>"
condition:
all of them
}
rule Glasses : Family
{
meta:
description = "Glasses family"
author = "Seth Hardy"
last_modified = "2014-07-22"
condition:
GlassesCode or GlassesStrings
}

57
data/ioc/yara/malware_families/iexpl0re.yara Normal file
View File

@@ -0,0 +1,57 @@
private rule iexpl0reCode : iexpl0ree Family
{
meta:
description = "iexpl0re code features"
author = "Seth Hardy"
last_modified = "2014-07-21"
strings:
$ = { 47 83 FF 64 0F 8C 6D FF FF FF 33 C0 5F 5E 5B C9 C3 }
$ = { 80 74 0D A4 44 41 3B C8 7C F6 68 04 01 00 00 }
$ = { 8A C1 B2 07 F6 EA 30 04 31 41 3B 4D 10 7C F1 }
$ = { 47 83 FF 64 0F 8C 79 FF FF FF 33 C0 5F 5E 5B C9 C3 }
// 88h decrypt
$ = { 68 88 00 00 00 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 }
$ = { BB 88 00 00 00 53 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 }
condition:
any of them
}
private rule iexpl0reStrings : iexpl0re Family
{
meta:
description = "Strings used by iexpl0re"
author = "Seth Hardy"
last_modified = "2014-07-21"
strings:
$ = "%USERPROFILE%\\IEXPL0RE.EXE"
$ = "\"<770j (("
$ = "\\Users\\%s\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IEXPL0RE.LNK"
$ = "\\Documents and Settings\\%s\\Application Data\\Microsoft\\Internet Explorer\\IEXPL0RE.EXE"
$ = "LoaderV5.dll"
// stage 2
$ = "POST /index%0.9d.asp HTTP/1.1"
$ = "GET /search?n=%0.9d&"
$ = "DUDE_AM_I_SHARP-3.14159265358979x6.626176"
$ = "WHO_A_R_E_YOU?2.99792458x1.25663706143592"
$ = "BASTARD_&&_BITCHES_%0.8x"
$ = "c:\\bbb\\eee.txt"
condition:
any of them
}
rule iexpl0re : Family
{
meta:
description = "iexpl0re family"
author = "Seth Hardy"
last_modified = "2014-07-21"
condition:
iexpl0reCode or iexpl0reStrings
}

60
data/ioc/yara/malware_families/imuler.yara Normal file
View File

@@ -0,0 +1,60 @@
private rule IMulerCode : IMuler Family
{
meta:
description = "IMuler code tricks"
author = "Seth Hardy"
last_modified = "2014-06-16"
strings:
// Load these function strings 4 characters at a time. These check the first two blocks:
$L4_tmpSpotlight = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 53 70 6F }
$L4_TMPAAABBB = { C7 ?? ?? ?? ?? ?? 54 4D 50 41 C7 ?? ?? ?? ?? ?? 41 41 42 42 }
$L4_FILEAGENTVer = { C7 ?? 46 49 4C 45 C7 ?? 04 41 47 45 4E }
$L4_TMP0M34JDF8 = { C7 ?? ?? ?? ?? ?? 54 4D 50 30 C7 ?? ?? ?? ?? ?? 4D 33 34 4A }
$L4_tmpmdworker = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 2E 6D 64 }
condition:
any of ($L4*)
}
private rule IMulerStrings : IMuler Family
{
meta:
description = "IMuler Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-16"
strings:
$ = "/cgi-mac/"
$ = "xnocz1"
$ = "checkvir.plist"
$ = "/Users/apple/Documents/mac back"
$ = "iMuler2"
$ = "/Users/imac/Desktop/macback/"
$ = "xntaskz.gz"
$ = "2wmsetstatus.cgi"
$ = "launch-0rp.dat"
$ = "2wmupload.cgi"
$ = "xntmpz"
$ = "2wmrecvdata.cgi"
$ = "xnorz6"
$ = "2wmdelfile.cgi"
$ = "/LanchAgents/checkvir"
$ = "0PERA:%s"
$ = "/tmp/Spotlight"
$ = "/tmp/launch-ICS000"
condition:
any of them
}
rule IMuler : Family
{
meta:
description = "IMuler"
author = "Seth Hardy"
last_modified = "2014-06-16"
condition:
IMulerCode or IMulerStrings
}

43
data/ioc/yara/malware_families/insta11.yara Normal file
View File

@@ -0,0 +1,43 @@
private rule Insta11Code : Insta11 Family
{
meta:
description = "Insta11 code features"
author = "Seth Hardy"
last_modified = "2014-06-23"
strings:
// jmp $+5; push 423h
$jumpandpush = { E9 00 00 00 00 68 23 04 00 00 }
condition:
any of them
}
private rule Insta11Strings : Insta11 Family
{
meta:
description = "Insta11 Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-23"
strings:
$ = "XTALKER7"
$ = "Insta11 Microsoft" wide ascii
$ = "wudMessage"
$ = "ECD4FC4D-521C-11D0-B792-00A0C90312E1"
$ = "B12AE898-D056-4378-A844-6D393FE37956"
condition:
any of them
}
rule Insta11 : Family
{
meta:
description = "Insta11"
author = "Seth Hardy"
last_modified = "2014-06-23"
condition:
Insta11Code or Insta11Strings
}

289
data/ioc/yara/malware_families/keyboy.yara Normal file
View File

@@ -0,0 +1,289 @@
import "pe"
/*
*
* This section of the rules are all specific to the new 2016
* KeyBoy sample targeting the Tibetan community. Other following
* sections capture file characteristics observed across multiple
* years of development. Don't miss the exploit doc signatures
* at the very end.
*
*/
rule new_keyboy_export
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the new 2016 sample's export"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
//The malware family seems to share many exports
//but this is the new kid on the block.
pe.exports("cfsUpdate")
}
rule new_keyboy_header_codes
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the 2016 sample's header codes"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
strings:
$s1 = "*l*" wide fullword
$s2 = "*a*" wide fullword
$s3 = "*s*" wide fullword
$s4 = "*d*" wide fullword
$s5 = "*f*" wide fullword
$s6 = "*g*" wide fullword
$s7 = "*h*" wide fullword
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
all of them
}
/*
*
* This section of the rules are all broader and will hit on
* older KeyBoy samples and other samples possibly part of a
* a larger development effort.
*
*/
rule keyboy_commands
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the 2016 sample's sent and received commands"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
strings:
$s1 = "Update" wide fullword
$s2 = "UpdateAndRun" wide fullword
$s3 = "Refresh" wide fullword
$s4 = "OnLine" wide fullword
$s5 = "Disconnect" wide fullword
$s6 = "Pw_Error" wide fullword
$s7 = "Pw_OK" wide fullword
$s8 = "Sysinfo" wide fullword
$s9 = "Download" wide fullword
$s10 = "UploadFileOk" wide fullword
$s11 = "RemoteRun" wide fullword
$s12 = "FileManager" wide fullword
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
6 of them
}
rule keyboy_errors
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the sample's shell error2 log statements"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
strings:
//These strings are in ASCII pre-2015 and UNICODE in 2016
$error = "Error2" ascii wide
//2016 specific:
$s1 = "Can't find [%s]!Check the file name and try again!" ascii wide
$s2 = "Open [%s] error! %d" ascii wide
$s3 = "The Size of [%s] is zero!" ascii wide
$s4 = "CreateThread DownloadFile[%s] Error!" ascii wide
$s5 = "UploadFile [%s] Error:Connect Server Failed!" ascii wide
$s6 = "Receive [%s] Error(Recved[%d] != Send[%d])!" ascii wide
$s7 = "Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s" ascii wide
$s8 = "CreateThread UploadFile[%s] Error!" ascii wide
//Pre-2016:
$s9 = "Ready Download [%s] ok!" ascii wide
$s10 = "Get ControlInfo from FileClient error!" ascii wide
$s11 = "FileClient has a error!" ascii wide
$s12 = "VirtualAlloc SendBuff Error(%d)" ascii wide
$s13 = "ReadFile [%s] Error(%d)..." ascii wide
$s14 = "ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error..." ascii wide
$s15 = "CreateThread DownloadFile[%s] Error!" ascii wide
$s16 = "RecvData MyRecv_Info Size Error!" ascii wide
$s17 = "RecvData MyRecv_Info Tag Error!" ascii wide
$s18 = "SendData szControlInfo_1 Error!" ascii wide
$s19 = "SendData szControlInfo_3 Error!" ascii wide
$s20 = "VirtualAlloc RecvBuff Error(%d)" ascii wide
$s21 = "RecvData Error!" ascii wide
$s22 = "WriteFile [%s} Error(%d)..." ascii wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
$error and 3 of ($s*)
}
rule keyboy_systeminfo
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the system information format before sending to C2"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
strings:
//These strings are ASCII pre-2015 and UNICODE in 2016
$s1 = "SystemVersion: %s" ascii wide
$s2 = "Product ID: %s" ascii wide
$s3 = "InstallPath: %s" ascii wide
$s4 = "InstallTime: %d-%d-%d, %02d:%02d:%02d" ascii wide
$s5 = "ResgisterGroup: %s" ascii wide
$s6 = "RegisterUser: %s" ascii wide
$s7 = "ComputerName: %s" ascii wide
$s8 = "WindowsDirectory: %s" ascii wide
$s9 = "System Directory: %s" ascii wide
$s10 = "Number of Processors: %d" ascii wide
$s11 = "CPU[%d]: %s: %sMHz" ascii wide
$s12 = "RAM: %dMB Total, %dMB Free." ascii wide
$s13 = "DisplayMode: %d x %d, %dHz, %dbit" ascii wide
$s14 = "Uptime: %d Days %02u:%02u:%02u" ascii wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
7 of them
}
rule keyboy_related_exports
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the new 2016 sample's export"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
//The malware family seems to share many exports
//but this is the new kid on the block.
pe.exports("Embedding") or
pe.exports("SSSS") or
pe.exports("GetUP")
}
// Note: The use of the .Init section has been observed in nearly
// all samples with the exception of the 2013 VN dropper from the
// Rapid7 blog. The config data was stored in that sample's .data
// section.
rule keyboy_init_config_section
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the Init section where the config is stored"
date = "2016-08-28"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
//Payloads are normally smaller but the new dropper we spotted
//is a bit larger.
filesize < 300KB and
//Observed virtual sizes of the .Init section vary but they've
//always been 1024, 2048, or 4096 bytes.
for any i in (0..pe.number_of_sections - 1):
(
pe.sections[i].name == ".Init" and
pe.sections[i].virtual_size % 1024 == 0
)
}
/*
*
* These signatures fire on the exploit documents used in this
* operation.
*
*/
rule CVE_2012_0158_KeyBoy {
meta:
author = "Etienne Maynier <etienne@citizenlab.ca>"
description = "CVE-2012-0158 variant"
file = "8307e444cad98b1b59568ad2eba5f201"
strings:
$a = "d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001" nocase // OLE header
$b = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" nocase // junk data
$c = /5(\{\\b0\}|)[ ]*2006F00(\{\\b0\}|)[ ]*6F007(\{\\b0\}|)[ ]*400200045(\{\\b0\}|)[ ]*006(\{\\b0\}|)[ ]*E007(\{\\b0\}|)[ ]*400720079/ nocase
$d = "MSComctlLib.ListViewCtrl.2"
$e = "ac38c874503c307405347aaaebf2ac2c31ebf6e8e3" nocase //decoding shellcode
condition:
all of them
}

46
data/ioc/yara/malware_families/luckycat.yara Normal file
View File

@@ -0,0 +1,46 @@
private rule LuckyCatCode : LuckyCat Family
{
meta:
description = "LuckyCat code tricks"
author = "Seth Hardy"
last_modified = "2014-06-19"
strings:
$xordecrypt = { BF 0F 00 00 00 F7 F7 ?? ?? ?? ?? 32 14 39 80 F2 7B }
$dll = { C6 ?? ?? ?? 64 C6 ?? ?? ?? 6C C6 ?? ?? ?? 6C }
$commonletters = { B? 63 B? 61 B? 73 B? 65 }
condition:
$xordecrypt or ($dll and $commonletters)
}
private rule LuckyCatStrings : LuckyCat Family
{
meta:
description = "LuckyCat Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-19"
strings:
$xorencrypted = { 77 76 75 7B 7A 79 78 7F 7E 7D 7C 73 72 71 70 }
$tempvbs = "%s\\~temp.vbs"
$countphp = "count.php\x00"
$trojanname = /WMILINK=.*TrojanName=/
$tmpfile = "d0908076343423d3456.tmp"
$dirfile = "cmd /c dir /s /a C:\\\\ >'+tmpfolder+'\\\\C.tmp"
$ipandmac = "objIP.DNSHostName+'_'+objIP.MACAddress.split(':').join('')+'_'+addinf+'@')"
condition:
any of them
}
rule LuckyCat : Family
{
meta:
description = "LuckyCat"
author = "Seth Hardy"
last_modified = "2014-06-19"
condition:
LuckyCatCode or LuckyCatStrings
}

86
data/ioc/yara/malware_families/lurk0+cctv0.yara Normal file
View File

@@ -0,0 +1,86 @@
private rule LURK0Header : Family LURK0 {
meta:
description = "5 char code for LURK0"
author = "Katie Kleemola"
last_updated = "07-21-2014"
strings:
$ = { C6 [5] 4C C6 [5] 55 C6 [5] 52 C6 [5] 4B C6 [5] 30 }
condition:
any of them
}
private rule CCTV0Header : Family CCTV0 {
meta:
description = "5 char code for LURK0"
author = "Katie Kleemola"
last_updated = "07-21-2014"
strings:
//if its just one char a time
$ = { C6 [5] 43 C6 [5] 43 C6 [5] 54 C6 [5] 56 C6 [5] 30 }
// bit hacky but for when samples dont just simply mov 1 char at a time
$ = { B0 43 88 [3] 88 [3] C6 [3] 54 C6 [3] 56 [0-12] (B0 30 | C6 [3] 30) }
condition:
any of them
}
private rule SharedStrings : Family {
meta:
description = "Internal names found in LURK0/CCTV0 samples"
author = "Katie Kleemola"
last_updated = "07-22-2014"
strings:
// internal names
$i1 = "Butterfly.dll"
$i2 = /\\BT[0-9.]+\\ButterFlyDLL\\/
$i3 = "ETClientDLL"
// dbx
$d1 = "\\DbxUpdateET\\" wide
$d2 = "\\DbxUpdateBT\\" wide
$d3 = "\\DbxUpdate\\" wide
// other folders
$mc1 = "\\Micet\\"
// embedded file names
$n1 = "IconCacheEt.dat" wide
$n2 = "IconConfigEt.dat" wide
$m1 = "\x00\x00ERXXXXXXX\x00\x00" wide
$m2 = "\x00\x00111\x00\x00" wide
$m3 = "\x00\x00ETUN\x00\x00" wide
$m4 = "\x00\x00ER\x00\x00" wide
condition:
any of them //todo: finetune this
}
rule LURK0 : Family LURK0 {
meta:
description = "rule for lurk0"
author = "Katie Kleemola"
last_updated = "07-22-2014"
condition:
LURK0Header and SharedStrings
}
rule CCTV0 : Family CCTV0 {
meta:
description = "rule for cctv0"
author = "Katie Kleemola"
last_updated = "07-22-2014"
condition:
CCTV0Header and SharedStrings
}

47
data/ioc/yara/malware_families/maccontrol.yara Normal file
View File

@@ -0,0 +1,47 @@
private rule MacControlCode : MacControl Family
{
meta:
description = "MacControl code tricks"
author = "Seth Hardy"
last_modified = "2014-06-17"
strings:
// Load these function strings 4 characters at a time. These check the first two blocks:
$L4_Accept = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 3A 20 }
$L4_AcceptLang = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 2D 4C }
$L4_Pragma = { C7 ?? 50 72 61 67 C7 ?? 04 6D 61 3A 20 }
$L4_Connection = { C7 ?? 43 6F 6E 6E C7 ?? 04 65 63 74 69 }
$GEThgif = { C7 ?? 47 45 54 20 C7 ?? 04 2F 68 2E 67 }
condition:
all of ($L4*) or $GEThgif
}
private rule MacControlStrings : MacControl Family
{
meta:
description = "MacControl Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-17"
strings:
$ = "HTTPHeadGet"
$ = "/Library/launched"
$ = "My connect error with no ip!"
$ = "Send File is Failed"
$ = "****************************You Have got it!****************************"
condition:
any of them
}
rule MacControl : Family
{
meta:
description = "MacControl"
author = "Seth Hardy"
last_modified = "2014-06-16"
condition:
MacControlCode or MacControlStrings
}

42
data/ioc/yara/malware_families/malware-families.yara Normal file
View File

@@ -0,0 +1,42 @@
include "3102.yara"
include "9002.yara"
include "bangat.yara"
include "boouset.yara"
include "comfoo.yara"
include "cookies.yara"
include "cxpid.yara"
include "enfal.yara"
include "ezcob.yara"
include "fakem.yara"
include "favorite.yara"
include "glasses.yara"
include "iexpl0re.yara"
include "imuler.yara"
include "insta11.yara"
include "luckycat.yara"
include "lurk0+cctv0.yara"
include "maccontrol.yara"
include "mirage.yara"
include "mongal.yara"
include "msattacker.yara"
include "naikon.yara"
include "naspyupdate.yara"
include "nettraveler.yara"
include "nsfree.yara"
include "olyx.yara"
include "plugx.yara"
include "pubsab.yara"
include "quarian.yara"
include "regsubdat.yara"
include "remote.yara"
include "rookie.yara"
include "rooter.yara"
include "safenet.yara"
include "scarhikn.yara"
include "surtr.yara"
include "t5000.yara"
include "vidgrab.yara"
include "warp.yara"
include "wimmie.yara"
include "xtreme.yara"
include "yayih.yara"

25
data/ioc/yara/malware_families/mirage.yara Normal file
View File

@@ -0,0 +1,25 @@
private rule MirageStrings : Mirage Family
{
meta:
description = "Mirage Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-25"
strings:
$ = "Neo,welcome to the desert of real." wide ascii
$ = "/result?hl=en&id=%s"
condition:
any of them
}
rule Mirage : Family
{
meta:
description = "Mirage"
author = "Seth Hardy"
last_modified = "2014-06-25"
condition:
MirageStrings
}

41
data/ioc/yara/malware_families/mongal.yara Normal file
View File

@@ -0,0 +1,41 @@
private rule MongalCode : Mongal Family
{
meta:
description = "Mongal code features"
author = "Seth Hardy"
last_modified = "2014-07-15"
strings:
// gettickcount value checking
$ = { 8B C8 B8 D3 4D 62 10 F7 E1 C1 EA 06 2B D6 83 FA 05 76 EB }
condition:
any of them
}
private rule MongalStrings : Mongal Family
{
meta:
description = "Mongal Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-07-15"
strings:
$ = "NSCortr.dll"
$ = "NSCortr1.dll"
$ = "Sina.exe"
condition:
any of them
}
rule Mongal : Family
{
meta:
description = "Mongal"
author = "Seth Hardy"
last_modified = "2014-07-15"
condition:
MongalCode or MongalStrings
}

35
data/ioc/yara/malware_families/msattacker.yara Normal file
View File

@@ -0,0 +1,35 @@
private rule MsAttackerStage2 : MsAttacker Family
{
meta:
description = "Identifying strings for MsAttacker stage 2"
last_modified = "2015-03-12"
strings:
$ = "MiniJS.dll"
$ = "%s \"rundll32.exe %s RealService %s\" /f"
$ = "reg delete HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Start Pages\" /f"
$ = "3111431114311121270018000127001808012700180"
$ = "Global\\MSAttacker %d"
condition:
any of them
}
private rule MsAttackerStage1 : MsAttacker Family
{
meta:
description = "Identifying strings for MsAttacker stage 1"
last_modified = "2015-03-12"
strings:
$ = "http://122.10.117.152/download/ms/CryptBase.32.cab"
$ = "http://122.10.117.152/download/ms/CryptBase.64.cab"
$ = "http://122.10.117.152/download/ms/MiniJS.dll"
$ = "MiniJS.dll"
$ = "%s;new Downloader('%s', '%s').Fire();"
$ = "rundll32.exe %s RealService %s"
condition:
any of them
}
rule MsAttacker : MsAttacker Family {
condition:
MsAttackerStage1 or MsAttackerStage2
}

45
data/ioc/yara/malware_families/naikon.yara Normal file
View File

@@ -0,0 +1,45 @@
private rule NaikonCode : Naikon Family
{
meta:
description = "Naikon code features"
author = "Seth Hardy"
last_modified = "2014-06-25"
strings:
// decryption
$ = { 0F AF C1 C1 E0 1F } // imul eax, ecx; shl eah, 1fh
$ = { 35 5A 01 00 00} // xor eax, 15ah
$ = { 81 C2 7F 14 06 00 } // add edx, 6147fh
condition:
all of them
}
private rule NaikonStrings : Naikon Family
{
meta:
description = "Naikon Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-25"
strings:
$ = "NOKIAN95/WEB"
$ = "/tag=info&id=15"
$ = "skg(3)=&3.2d_u1"
$ = "\\Temp\\iExplorer.exe"
$ = "\\Temp\\\"TSG\""
condition:
any of them
}
rule Naikon : Family
{
meta:
description = "Naikon"
author = "Seth Hardy"
last_modified = "2014-06-25"
condition:
NaikonCode or NaikonStrings
}

42
data/ioc/yara/malware_families/naspyupdate.yara Normal file
View File

@@ -0,0 +1,42 @@
private rule nAspyUpdateCode : nAspyUpdate Family
{
meta:
description = "nAspyUpdate code features"
author = "Seth Hardy"
last_modified = "2014-07-14"
strings:
// decryption loop in dropper
$ = { 8A 54 24 14 8A 01 32 C2 02 C2 88 01 41 4E 75 F4 }
condition:
any of them
}
private rule nAspyUpdateStrings : nAspyUpdate Family
{
meta:
description = "nAspyUpdate Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-07-14"
strings:
$ = "\\httpclient.txt"
$ = "password <=14"
$ = "/%ldn.txt"
$ = "Kill You\x00"
condition:
any of them
}
rule nAspyUpdate : Family
{
meta:
description = "nAspyUpdate"
author = "Seth Hardy"
last_modified = "2014-07-14"
condition:
nAspyUpdateCode or nAspyUpdateStrings
}

88
data/ioc/yara/malware_families/nettraveler.yara Normal file
View File

@@ -0,0 +1,88 @@
//will match both exe and dll components
private rule NetTravExports : NetTraveler Family {
meta:
description = "Export names for dll component"
author = "Katie Kleemola"
last_updated = "2014-05-20"
strings:
//dll component exports
$ = "?InjectDll@@YAHPAUHWND__@@K@Z"
$ = "?UnmapDll@@YAHXZ"
$ = "?g_bSubclassed@@3HA"
condition:
any of them
}
private rule NetTravStrings : NetTraveler Family {
meta:
description = "Identifiers for NetTraveler DLL"
author = "Katie Kleemola"
last_updated = "2014-05-20"
strings:
//network strings
$ = "?action=updated&hostid="
$ = "travlerbackinfo"
$ = "?action=getcmd&hostid="
$ = "%s?action=gotcmd&hostid="
$ = "%s?hostid=%s&hostname=%s&hostip=%s&filename=%s&filestart=%u&filetext="
//debugging strings
$ = "\x00Method1 Fail!!!!!\x00"
$ = "\x00Method3 Fail!!!!!\x00"
$ = "\x00method currect:\x00"
$ = /\x00\x00[\w\-]+ is Running!\x00\x00/
$ = "\x00OtherTwo\x00"
condition:
any of them
}
private rule NetpassStrings : NetPass Variant {
meta:
description = "Identifiers for netpass variant"
author = "Katie Kleemola"
last_updated = "2014-05-29"
strings:
$exif1 = "Device Protect ApplicatioN" wide
$exif2 = "beep.sys" wide //embedded exe name
$exif3 = "BEEP Driver" wide //embedded exe description
$string1 = "\x00NetPass Update\x00"
$string2 = "\x00%s:DOWNLOAD\x00"
$string3 = "\x00%s:UPDATE\x00"
$string4 = "\x00%s:uNINSTALL\x00"
condition:
all of ($exif*) or any of ($string*)
}
rule NetTraveler : Family {
meta:
description = "Nettravelr"
author = "Katie Kleemola"
last_updated = "2014-07-08"
condition:
NetTravExports or NetTravStrings or NetpassStrings
}
rule NetPass : Variant {
meta:
description = "netpass variant"
author = "Katie Kleemola"
last_updated = "2014-07-08"
condition:
NetpassStrings
}

44
data/ioc/yara/malware_families/nsfree.yara Normal file
View File

@@ -0,0 +1,44 @@
private rule NSFreeCode : NSFree Family
{
meta:
description = "NSFree code features"
author = "Seth Hardy"
last_modified = "2014-06-24"
strings:
// push vars then look for MZ
$ = { 53 56 57 66 81 38 4D 5A }
// nops then look for PE\0\0
$ = { 90 90 90 90 81 3F 50 45 00 00 }
condition:
all of them
}
private rule NSFreeStrings : NSFree Family
{
meta:
description = "NSFree Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-24"
strings:
$ = "\\MicNS\\" nocase
$ = "NSFreeDll" wide ascii
// xor 0x58 dos stub
$ = { 0c 30 31 2b 78 28 2a 37 3f 2a 39 35 78 3b 39 36 36 37 }
condition:
any of them
}
rule NSFree : Family
{
meta:
description = "NSFree"
author = "Seth Hardy"
last_modified = "2014-06-24"
condition:
NSFreeCode or NSFreeStrings
}

39
data/ioc/yara/malware_families/olyx.yara Normal file
View File

@@ -0,0 +1,39 @@
private rule OlyxCode : Olyx Family
{
meta:
description = "Olyx code tricks"
author = "Seth Hardy"
last_modified = "2014-06-19"
strings:
$six = { C7 40 04 36 36 36 36 C7 40 08 36 36 36 36 }
$slash = { C7 40 04 5C 5C 5C 5C C7 40 08 5C 5C 5C 5C }
condition:
any of them
}
private rule OlyxStrings : Olyx Family
{
meta:
description = "Olyx Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-19"
strings:
$ = "/Applications/Automator.app/Contents/MacOS/DockLight"
condition:
any of them
}
rule Olyx : Family
{
meta:
description = "Olyx"
author = "Seth Hardy"
last_modified = "2014-06-19"
condition:
OlyxCode or OlyxStrings
}

52
data/ioc/yara/malware_families/plugx.yara Normal file
View File

@@ -0,0 +1,52 @@
private rule PlugXBootLDRCode : PlugX Family
{
meta:
description = "PlugX boot.ldr code tricks"
author = "Seth Hardy"
last_modified = "2014-06-12"
strings:
$callpop = { E8 00 00 00 00 58 }
// Compares [eax+n] to GetProcAdd, one character at a time. This goes up to GetP:
$GetProcAdd = { 80 38 47 75 36 80 78 01 65 75 30 80 78 02 74 75 2A 80 78 03 50 }
// Load these function strings 4 characters at a time. These check the first two blocks:
$L4_LoadLibraryA = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 4C 6F 61 64 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 4C 69 62 72 }
$L4_VirtualAlloc = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 56 69 72 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 75 61 6C 41 }
$L4_VirtualFree = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 56 69 72 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 75 61 6C 46 }
$L4_ExitThread = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 45 78 69 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 54 68 72 65 }
$L4_ntdll = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 6E 74 64 6C 66 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) C6 00 }
$L4_RtlDecompressBuffer = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 52 74 6C 44 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 65 63 6F 6D }
$L4_memcpy = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 6D 65 6D 63 66 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 70 79 }
condition:
($callpop at 0) or $GetProcAdd or (all of ($L4_*))
}
private rule PlugXStrings : PlugX Family
{
meta:
description = "PlugX Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-12"
strings:
$BootLDR = "boot.ldr" wide ascii
$Dwork = "d:\\work" nocase
$Plug25 = "plug2.5"
$Plug30 = "Plug3.0"
$Shell6 = "Shell6"
condition:
$BootLDR or ($Dwork and ($Plug25 or $Plug30 or $Shell6))
}
rule PlugX : Family
{
meta:
description = "PlugX"
author = "Seth Hardy"
last_modified = "2014-06-12"
condition:
PlugXBootLDRCode or PlugXStrings
}

40
data/ioc/yara/malware_families/pubsab.yara Normal file
View File

@@ -0,0 +1,40 @@
private rule PubSabCode : PubSab Family
{
meta:
description = "PubSab code tricks"
author = "Seth Hardy"
last_modified = "2014-06-19"
strings:
$decrypt = { 6B 45 E4 37 89 CA 29 C2 89 55 E4 }
condition:
any of them
}
private rule PubSabStrings : PubSab Family
{
meta:
description = "PubSab Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-19"
strings:
$ = "_deamon_init"
$ = "com.apple.PubSabAgent"
$ = "/tmp/screen.jpeg"
condition:
any of them
}
rule PubSab : Family
{
meta:
description = "PubSab"
author = "Seth Hardy"
last_modified = "2014-06-19"
condition:
PubSabCode or PubSabStrings
}

64
data/ioc/yara/malware_families/quarian.yara Normal file
View File

@@ -0,0 +1,64 @@
private rule QuarianCode : Quarian Family
{
meta:
description = "Quarian code features"
author = "Seth Hardy"
last_modified = "2014-07-09"
strings:
// decrypt in intelnat.sys
$ = { C1 E? 04 8B ?? F? C1 E? 05 33 C? }
// decrypt in mswsocket.dll
$ = { C1 EF 05 C1 E3 04 33 FB }
$ = { 33 D8 81 EE 47 86 C8 61 }
// loop in msupdate.dll
$ = { FF 45 E8 81 45 EC CC 00 00 00 E9 95 FE FF FF }
condition:
any of them
}
private rule QuarianStrings : Quarian Family
{
meta:
description = "Quarian Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-07-09"
strings:
$ = "s061779s061750"
$ = "[OnUpLoadFile]"
$ = "[OnDownLoadFile]"
$ = "[FileTransfer]"
$ = "---- Not connect the Manager, so start UnInstall ----"
$ = "------- Enter CompressDownLoadDir ---------"
$ = "------- Enter DownLoadDirectory ---------"
$ = "[HandleAdditionalData]"
$ = "[mswsocket.dll]"
$ = "msupdate.dll........Enter ThreadCmd!"
$ = "ok1-1"
$ = "msupdate_tmp.dll"
$ = "replace Rpcss.dll successfully!"
$ = "f:\\loadhiddendriver-mdl\\objfre_win7_x86\\i386\\intelnat.pdb"
$ = "\\drivercashe\\" wide ascii
$ = "\\microsoft\\windwos\\" wide ascii
$ = "\\DosDevices\\LOADHIDDENDRIVER" wide ascii
$ = "\\Device\\LOADHIDDENDRIVER" wide ascii
$ = "Global\\state_maping" wide ascii
$ = "E:\\Code\\2.0\\2.0_multi-port\\2.0\\ServerInstall_New-2010-0913_sp3\\msupdataDll\\Release\\msupdate_tmp.pdb"
$ = "Global\\unInstall_event_1554_Ower" wide ascii
condition:
any of them
}
rule Quarian : Family
{
meta:
description = "Quarian"
author = "Seth Hardy"
last_modified = "2014-07-09"
condition:
QuarianCode or QuarianStrings
}

47
data/ioc/yara/malware_families/regsubdat.yara Normal file
View File

@@ -0,0 +1,47 @@
private rule RegSubDatCode : RegSubDat Family
{
meta:
description = "RegSubDat code features"
author = "Seth Hardy"
last_modified = "2014-07-14"
strings:
// decryption loop
$ = { 80 34 3? 99 40 (3D FB 65 00 00 | 3B C6) 7? F? }
// push then pop values
$ = { 68 FF FF 7F 00 5? }
$ = { 68 FF 7F 00 00 5? }
condition:
all of them
}
private rule RegSubDatStrings : RegSubDat Family
{
meta:
description = "RegSubDat Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-07-14"
strings:
$avg1 = "Button"
$avg2 = "Allow"
$avg3 = "Identity Protection"
$avg4 = "Allow for all"
$avg5 = "AVG Firewall Asks For Confirmation"
$mutex = "0x1A7B4C9F"
condition:
all of ($avg*) or $mutex
}
rule RegSubDat : Family
{
meta:
description = "RegSubDat"
author = "Seth Hardy"
last_modified = "2014-07-14"
condition:
RegSubDatCode or RegSubDatStrings
}

81
data/ioc/yara/malware_families/remote.yara Normal file
View File

@@ -0,0 +1,81 @@
private rule RSharedStrings : Surtr Family {
meta:
description = "identifiers for remote and gmremote"
author = "Katie Kleemola"
last_updated = "07-21-2014"
strings:
$ = "nView_DiskLoydb" wide
$ = "nView_KeyLoydb" wide
$ = "nView_skins" wide
$ = "UsbLoydb" wide
$ = "%sBurn%s" wide
$ = "soul" wide
condition:
any of them
}
private rule RemoteStrings : Remote Variant Surtr Family {
meta:
description = "indicators for remote.dll - surtr stage 2"
author = "Katie Kleemola"
last_updated = "07-21-2014"
strings:
$ = "\x00Remote.dll\x00"
$ = "\x00CGm_PlugBase::"
$ = "\x00ServiceMain\x00_K_H_K_UH\x00"
$ = "\x00_Remote_\x00" wide
condition:
any of them
}
private rule GmRemoteStrings : GmRemote Variant Family Surtr {
meta:
description = "identifiers for gmremote: surtr stage 2"
author = "Katie Kleemola"
last_updated = "07-21-2014"
strings:
$ = "\x00x86_GmRemote.dll\x00"
$ = "\x00D:\\Project\\GTProject\\Public\\List\\ListManager.cpp\x00"
$ = "\x00GmShutPoint\x00"
$ = "\x00GmRecvPoint\x00"
$ = "\x00GmInitPoint\x00"
$ = "\x00GmVerPoint\x00"
$ = "\x00GmNumPoint\x00"
$ = "_Gt_Remote_" wide
$ = "%sBurn\\workdll.tmp" wide
condition:
any of them
}
/*
* Check if File has shared identifiers among Surtr Stage 2's
* Then look for unique identifiers to each variant
*/
rule GmRemote : Family Surtr Variant GmRemote {
meta:
description = "identifier for gmremote"
author = "Katie Kleemola"
last_updated = "07-25-2014"
condition:
RSharedStrings and GmRemoteStrings
}
rule Remote : Family Surtr Variant Remote {
meta:
description = "identifier for remote"
author = "Katie Kleemola"
last_updated = "07-25-2014"
condition:
RSharedStrings and RemoteStrings
}

43
data/ioc/yara/malware_families/rookie.yara Normal file
View File

@@ -0,0 +1,43 @@
private rule RookieCode : Rookie Family
{
meta:
description = "Rookie code features"
author = "Seth Hardy"
last_modified = "2014-06-25"
strings:
// hidden AutoConfigURL
$ = { C6 ?? ?? ?? 41 C6 ?? ?? ?? 75 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 43 C6 ?? ?? ?? 6F C6 ?? ?? ?? 6E C6 ?? ?? ?? 66 }
// hidden ProxyEnable
$ = { C6 ?? ?? ?? 50 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 78 C6 ?? ?? ?? 79 C6 ?? ?? ?? 45 C6 ?? ?? ?? 6E C6 ?? ?? ?? 61 }
// xor on rand value?
$ = { 8B 1D 10 A1 40 00 [18] FF D3 8A 16 32 D0 88 16 }
condition:
any of them
}
private rule RookieStrings : Rookie Family
{
meta:
description = "Rookie Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-25"
strings:
$ = "RookIE/1.0"
condition:
any of them
}
rule Rookie : Family
{
meta:
description = "Rookie"
author = "Seth Hardy"
last_modified = "2014-06-25"
condition:
RookieCode or RookieStrings
}

43
data/ioc/yara/malware_families/rooter.yara Normal file
View File

@@ -0,0 +1,43 @@
private rule RooterCode : Rooter Family
{
meta:
description = "Rooter code features"
author = "Seth Hardy"
last_modified = "2014-07-10"
strings:
// xor 0x30 decryption
$ = { 80 B0 ?? ?? ?? ?? 30 40 3D 00 50 00 00 7C F1 }
condition:
any of them
}
private rule RooterStrings : Rooter Family
{
meta:
description = "Rooter Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-07-10"
strings:
$group1 = "seed\x00"
$group2 = "prot\x00"
$group3 = "ownin\x00"
$group4 = "feed0\x00"
$group5 = "nown\x00"
condition:
3 of ($group*)
}
rule Rooter : Family
{
meta:
description = "Rooter"
author = "Seth Hardy"
last_modified = "2014-07-10"
condition:
RooterCode or RooterStrings
}

42
data/ioc/yara/malware_families/safenet.yara Normal file
View File

@@ -0,0 +1,42 @@
private rule SafeNetCode : SafeNet Family
{
meta:
description = "SafeNet code features"
author = "Seth Hardy"
last_modified = "2014-07-16"
strings:
// add edi, 14h; cmp edi, 50D0F8h
$ = { 83 C7 14 81 FF F8 D0 40 00 }
condition:
any of them
}
private rule SafeNetStrings : SafeNet Family
{
meta:
description = "Strings used by SafeNet"
author = "Seth Hardy"
last_modified = "2014-07-16"
strings:
$ = "6dNfg8Upn5fBzGgj8licQHblQvLnUY19z5zcNKNFdsDhUzuI8otEsBODrzFCqCKr"
$ = "/safe/record.php"
$ = "_Rm.bat" wide ascii
$ = "try\x0d\x0a\x09\x09\x09\x09 del %s" wide ascii
$ = "Ext.org" wide ascii
condition:
any of them
}
rule SafeNet : Family
{
meta:
description = "SafeNet family"
condition:
SafeNetCode or SafeNetStrings
}

41
data/ioc/yara/malware_families/scarhikn.yara Normal file
View File

@@ -0,0 +1,41 @@
private rule ScarhiknCode : Scarhikn Family
{
meta:
description = "Scarhikn code features"
author = "Seth Hardy"
last_modified = "2014-06-25"
strings:
// decryption
$ = { 8B 06 8A 8B ?? ?? ?? ?? 30 0C 38 03 C7 55 43 E8 ?? ?? ?? ?? 3B D8 59 72 E7 }
$ = { 8B 02 8A 8D ?? ?? ?? ?? 30 0C 30 03 C6 8B FB 83 C9 FF 33 C0 45 F2 AE F7 D1 49 3B E9 72 E2 }
condition:
any of them
}
private rule ScarhiknStrings : Scarhikn Family
{
meta:
description = "Scarhikn Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-25"
strings:
$ = "9887___skej3sd"
$ = "haha123"
condition:
any of them
}
rule Scarhikn : Family
{
meta:
description = "Scarhikn"
author = "Seth Hardy"
last_modified = "2014-06-25"
condition:
ScarhiknCode or ScarhiknStrings
}

51
data/ioc/yara/malware_families/surtr.yara Normal file
View File

@@ -0,0 +1,51 @@
private rule SurtrCode : Surtr Family {
meta:
author = "Katie Kleemola"
description = "Code features for Surtr Stage1"
last_updated = "2014-07-16"
strings:
//decrypt config
$ = { 8A ?? ?? 84 ?? ?? 74 ?? 3C 01 74 ?? 34 01 88 41 3B ?? 72 ?? }
//if Burn folder name is not in strings
$ = { C6 [3] 42 C6 [3] 75 C6 [3] 72 C6 [3] 6E C6 [3] 5C }
//mov char in _Fire
$ = { C6 [3] 5F C6 [3] 46 C6 [3] 69 C6 [3] 72 C6 [3] 65 C6 [3] 2E C6 [3] 64 }
condition:
any of them
}
private rule SurtrStrings : Surtr Family {
meta:
author = "Katie Kleemola"
description = "Strings for Surtr"
last_updated = "2014-07-16"
strings:
$ = "\x00soul\x00"
$ = "\x00InstallDll.dll\x00"
$ = "\x00_One.dll\x00"
$ = "_Fra.dll"
$ = "CrtRunTime.log"
$ = "Prod.t"
$ = "Proe.t"
$ = "Burn\\"
$ = "LiveUpdata_Mem\\"
condition:
any of them
}
rule Surtr : Family {
meta:
author = "Katie Kleemola"
description = "Rule for Surtr Stage One"
last_updated = "2014-07-16"
condition:
SurtrStrings or SurtrCode
}

37
data/ioc/yara/malware_families/t5000.yara Normal file
View File

@@ -0,0 +1,37 @@
private rule T5000Strings : T5000 Family
{
meta:
description = "T5000 Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-26"
strings:
$ = "_tmpR.vbs"
$ = "_tmpg.vbs"
$ = "Dtl.dat" wide ascii
$ = "3C6FB3CA-69B1-454f-8B2F-BD157762810E"
$ = "EED5CA6C-9958-4611-B7A7-1238F2E1B17E"
$ = "8A8FF8AD-D1DE-4cef-B87C-82627677662E"
$ = "43EE34A9-9063-4d2c-AACD-F5C62B849089"
$ = "A8859547-C62D-4e8b-A82D-BE1479C684C9"
$ = "A59CF429-D0DD-4207-88A1-04090680F714"
$ = "utd_CE31" wide ascii
$ = "f:\\Project\\T5000\\Src\\Target\\1 KjetDll.pdb"
$ = "l:\\MyProject\\Vc 7.1\\T5000\\T5000Ver1.28\\Target\\4 CaptureDLL.pdb"
$ = "f:\\Project\\T5000\\Src\\Target\\4 CaptureDLL.pdb"
$ = "E:\\VS2010\\xPlat2\\Release\\InstRes32.pdb"
condition:
any of them
}
rule T5000 : Family
{
meta:
description = "T5000"
author = "Seth Hardy"
last_modified = "2014-06-26"
condition:
T5000Strings
}

46
data/ioc/yara/malware_families/vidgrab.yara Normal file
View File

@@ -0,0 +1,46 @@
private rule VidgrabCode : Vidgrab Family
{
meta:
description = "Vidgrab code tricks"
author = "Seth Hardy"
last_modified = "2014-06-20"
strings:
$divbyzero = { B8 02 00 00 00 48 48 BA 02 00 00 00 83 F2 02 F7 F0 }
// add eax, ecx; xor byte ptr [eax], ??h; inc ecx
$xorloop = { 03 C1 80 30 (66 | 58) 41 }
$junk = { 8B 4? ?? 8B 4? ?? 03 45 08 52 5A }
condition:
all of them
}
private rule VidgrabStrings : Vidgrab Family
{
meta:
description = "Vidgrab Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-20"
strings:
$ = "IDI_ICON5" wide ascii
$ = "starter.exe"
$ = "wmifw.exe"
$ = "Software\\rar"
$ = "tmp092.tmp"
$ = "temp1.exe"
condition:
3 of them
}
rule Vidgrab : Family
{
meta:
description = "Vidgrab"
author = "Seth Hardy"
last_modified = "2014-06-20"
condition:
VidgrabCode or VidgrabStrings
}

41
data/ioc/yara/malware_families/warp.yara Normal file
View File

@@ -0,0 +1,41 @@
private rule WarpCode : Warp Family
{
meta:
description = "Warp code features"
author = "Seth Hardy"
last_modified = "2014-07-10"
strings:
// character replacement
$ = { 80 38 2B 75 03 C6 00 2D 80 38 2F 75 03 C6 00 5F }
condition:
any of them
}
private rule WarpStrings : Warp Family
{
meta:
description = "Warp Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-07-10"
strings:
$ = "/2011/n325423.shtml?"
$ = "wyle"
$ = "\\~ISUN32.EXE"
condition:
any of them
}
rule Warp : Family
{
meta:
description = "Warp"
author = "Seth Hardy"
last_modified = "2014-07-10"
condition:
WarpCode or WarpStrings
}

45
data/ioc/yara/malware_families/wimmie.yara Normal file
View File

@@ -0,0 +1,45 @@
private rule WimmieShellcode : Wimmie Family
{
meta:
description = "Wimmie code features"
author = "Seth Hardy"
last_modified = "2014-07-17"
strings:
// decryption loop
$ = { 49 30 24 39 83 F9 00 77 F7 8D 3D 4D 10 40 00 B9 0C 03 00 00 }
$xordecrypt = {B9 B4 1D 00 00 [8] 49 30 24 39 83 F9 00 }
condition:
any of them
}
private rule WimmieStrings : Wimmie Family
{
meta:
description = "Strings used by Wimmie"
author = "Seth Hardy"
last_modified = "2014-07-17"
strings:
$ = "\x00ScriptMan"
$ = "C:\\WINDOWS\\system32\\sysprep\\cryptbase.dll" wide ascii
$ = "ProbeScriptFint" wide ascii
$ = "ProbeScriptKids"
condition:
any of them
}
rule Wimmie : Family
{
meta:
description = "Wimmie family"
author = "Seth Hardy"
last_modified = "2014-07-17"
condition:
WimmieShellcode or WimmieStrings
}

42
data/ioc/yara/malware_families/xtreme.yara Normal file
View File

@@ -0,0 +1,42 @@
private rule XtremeRATCode : XtremeRAT Family
{
meta:
description = "XtremeRAT code features"
author = "Seth Hardy"
last_modified = "2014-07-09"
strings:
// call; fstp st
$ = { E8 ?? ?? ?? ?? DD D8 }
// hiding string
$ = { C6 85 ?? ?? ?? ?? 4D C6 85 ?? ?? ?? ?? 70 C6 85 ?? ?? ?? ?? 64 C6 85 ?? ?? ?? ?? 62 C6 85 ?? ?? ?? ?? 6D }
condition:
all of them
}
private rule XtremeRATStrings : XtremeRAT Family
{
meta:
description = "XtremeRAT Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-07-09"
strings:
$ = "dqsaazere"
$ = "-GCCLIBCYGMING-EH-TDM1-SJLJ-GTHR-MINGW32"
condition:
any of them
}
rule XtremeRAT : Family
{
meta:
description = "XtremeRAT"
author = "Seth Hardy"
last_modified = "2014-07-09"
condition:
XtremeRATCode or XtremeRATStrings
}

42
data/ioc/yara/malware_families/yayih.yara Normal file
View File

@@ -0,0 +1,42 @@
rule YayihCode : Yayih Family
{
meta:
description = "Yayih code features"
author = "Seth Hardy"
last_modified = "2014-07-11"
strings:
// encryption
$ = { 80 04 08 7A 03 C1 8B 45 FC 80 34 08 19 03 C1 41 3B 0A 7C E9 }
condition:
any of them
}
rule YayihStrings : Yayih Family
{
meta:
description = "Yayih Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-07-11"
strings:
$ = "/bbs/info.asp"
$ = "\\msinfo.exe"
$ = "%s\\%srcs.pdf"
$ = "\\aumLib.ini"
condition:
any of them
}
rule Yayih : Family
{
meta:
description = "Yayih"
author = "Seth Hardy"
last_modified = "2014-07-11"
condition:
YayihCode or YayihStrings
}

154
data/ioc/yara/novispy.yara Normal file
View File

@@ -0,0 +1,154 @@
rule APT_serbia_novispy_android_accesibilityservice {
meta:
description = "Rule for Serbian NoviSpy Android spyware APK, com.accesibilityservice version"
author = "Donncha O Cearbhaill, Amnesty International"
sample = "99673ce7f10e938ed73ed4a99930fbd6499983caa7a2c1b9e3f0e0bb0a5df602"
strings:
$dex = { 64 65 78 0A 30 33 ?? 00 }
// C2 communication
$c2_1 = "195.178.51.251"
$c2_2 = "79.101.110.108"
$c2_3 = "188.93.127.34"
// Unique Strings
$u_1 = "kataklinger vibercajzna" ascii nocase
$u_2 = "select action_command.* from action_command where action_id = ? and trigger_type = ?" ascii nocase
$u_3 = "6FDF20EAFA2D58AF609C72AE7092BB45" ascii nocase
$u_4 = "{\"cellChangeMonitoring\":true,\"signalStrengthMonitoring\":true,\"temperatureDelta\":1," ascii nocase
$u_5 = "{\"fileUpload\":false,\"audioRecording\":false,\"cellChangeMonitoring\":true,"ascii nocase
$u_6 = "\"serverIp\":\"188.93.127.34\"" ascii nocase
$u_7 = "ucitavanjepodataka" ascii nocase
// Other strings
$s_1 = "test.dat" ascii
$s_2 = "/active.config" ascii
$s_3 = "message_map.ser" ascii
$s_4 = "event type =" ascii
$s_5 = "change type subtree" ascii
$s_6 = "change type content description" ascii
$s_7 = "change type pane title" ascii
$s_8 = "content change type pane_appeared" ascii
$s_9 = "window state changed" ascii
$s_10 = "notification state changed" ascii
$s_11 = "window content changed" ascii
$s_12 = "view scrolled" ascii
$s_13 = "type selection changed" ascii
$s_14 = "type announcement" ascii
$s_15 = "scroll position =" ascii
$s_16 = "imei=%s;imsi=%s;phone=%s;sim_serial=%s;os=%s"
$s_17 = "imei=%s;imsi=%s;phone=%s;sim_serial=%s;roaming=%s;os=%s"
$s_18 = "last message = %s, level = %d, hash = %s, node count = %d"
$s_19 = "MyAccessibilityService"
condition:
$dex at 0 and (
any of ($u*) or
any of ($c2*) or
7 of ($s*)
)
}
rule APT_serbia_novispy_android_serv_services {
meta:
description = "Rule for Serbian NoviSpy Android spyware APK, com.serv.services version"
author = "Donncha O Cearbhaill, Amnesty International"
sample = "087fc1217c897033425fe7f1f12b913cd48918c875e99c25bdb9e1ffcf80f57e"
strings:
$dex = { 64 65 78 0A 30 33 ?? 00 }
// C2 communication
$c2_comm_1 = "178.220.122.57"
// Unique Strings
// C2 commands received via SMS
$sms_c2_cmd_1 = "C_ARF" ascii
$sms_c2_cmd_2 = "C_ARN" ascii
$sms_c2_cmd_3 = "C_AWF" ascii
$sms_c2_cmd_4 = "C_AWI" ascii
$sms_c2_cmd_5 = "C_AWN" ascii
$sms_c2_cmd_6 = "C_CRF" ascii
$sms_c2_cmd_7 = "C_CRN" ascii
$sms_c2_cmd_8 = "C_LCW" ascii
$sms_c2_cmd_9 = "C_MNS" ascii
$sms_c2_cmd_10 = "C_MXS" ascii
$sms_c2_cmd_11 = "C_R_F" ascii
$sms_c2_cmd_12 = "C_R_N" ascii
$sms_c2_cmd_13 = "C_SMF" ascii
$sms_c2_cmd_14 = "C_SMN" ascii
$sms_c2_cmd_15 = "C_SWF" ascii
$sms_c2_cmd_16 = "C_SWN" ascii
$sms_c2_cmd_17 = "C_UIR" ascii
$sms_c2_cmd_18 = "C_UMF" ascii
$sms_c2_cmd_19 = "C_UMN" ascii
$sms_c2_cmd_20 = "C_UWF" ascii
$sms_c2_cmd_21 = "C_UWN" ascii
$sms_c2_cmd_22 = "C_WLF" ascii
$sms_c2_cmd_23 = "C_WLN" ascii
// C2 commands received via FTP.
// This is not a comprehensive list of commands, generic command names are excluded to prevent false positives.
$ftp_c2_cmd_1 = "CALL_REC_OFF" ascii
$ftp_c2_cmd_2 = "CALL_REC_ON" ascii
$ftp_c2_cmd_3 = "CHARGING_REC_OFF" ascii
$ftp_c2_cmd_4 = "CHARGING_REC_ON" ascii
$ftp_c2_cmd_5 = "SECURE_REC_OFF" ascii
$ftp_c2_cmd_6 = "SECURE_REC_ON" ascii
$ftp_c2_cmd_7 = "SSD_MOBILE_OFF" ascii
$ftp_c2_cmd_8 = "SSD_MOBILE_ON" ascii
$ftp_c2_cmd_9 = "SSD_WIFI_OFF" ascii
$ftp_c2_cmd_10 = "SSD_WIFI_ON" ascii
$ftp_c2_cmd_11 = "UPLOAD_INTERVAL" ascii
$ftp_c2_cmd_12 = "UPLOAD_MOBILE_OFF" ascii
$ftp_c2_cmd_13 = "UPLOAD_MOBILE_ON" ascii
$ftp_c2_cmd_14 = "UPLOAD_WIFI_OFF" ascii
$ftp_c2_cmd_15 = "UPLOAD_WIFI_ON" ascii
$ftp_c2_cmd_16 = "AUTO_WIFI_INTERVAL" ascii
$ftp_c2_cmd_17 = "WIFI_LOCK_ON" ascii
$ftp_c2_cmd_18 = "WIFI_LOCK_OFF" ascii
$ftp_c2_cmd_19 = "AUTO_WIFI_ON" ascii
$ftp_c2_cmd_20 = "AUTO_WIFI_OFF" ascii
$ftp_c2_cmd_21 = "START_AUDIO" ascii
// App local settings configured based on C2 commands.
$setting_1 = "UIR" ascii
$setting_2 = "ULW" ascii
$setting_3 = "ULM" ascii
$setting_4 = "SSW" ascii
$setting_5 = "SSM" ascii
$setting_6 = "CRN" ascii
$setting_7 = "SRN" ascii
$setting_8 = "CRC" ascii
$setting_9 = "MXS" ascii
$setting_10 = "MNS" ascii
$setting_11 = "AWF" ascii
$setting_12 = "AWI" ascii
$setting_13 = "CHR" ascii
$setting_14 = "WLS" ascii
$setting_15 = "A_R_N" ascii
$setting_16 = "A_R_F" ascii
$setting_17 = "U_I" ascii
$setting_18 = "U_W_N" ascii
$setting_19 = "S_W_N" ascii
$setting_20 = "U_M_F" ascii
$setting_21 = "S_M_F" ascii
$setting_22 = "A_W_F" ascii
$setting_23 = "A_W_I" ascii
$setting_24 = "W_L_N" ascii
$setting_25 = "C_R_F" ascii
$setting_26 = "CH_R_F" ascii
$setting_27 = "S_R_N" ascii
condition:
$dex at 0 and (
any of ($c2_comm*) or
20 of ($sms_c2_cmd*) or
20 of ($ftp_c2_cmd*) or
20 of ($setting*)
)
}

265
data/ioc/yara/oleidentifiers.yara Normal file
View File

@@ -0,0 +1,265 @@
include "filetypes.yara"
/*
These string lists generated on the command line by:
Author:
file ~/samples/all/* | perl -ne 'if(/Author: (.*?), Template:/) { $x = $1; $x =~ s/\"/\\\"/g; while($x =~ /\\(\d{3})/) { $n = oct($1); $nn = sprintf("%02x",$n); $x =~ s/\\$1/\\x$nn/; chomp $x; } print " \$ = \"\\x00$x\\x00\\x1e\"\n"; };' | sort | uniq
Title:
$ file ~/samples/all/* | perl -ne 'if(/Title: (.*?), Author:/) { $x = $1; $x =~ s/\"/\\\"/g; while($x =~ /\\(\d{3})/) { $n = oct($1); $nn = sprintf("%02x",$n); $x =~ s/\\$1/\\x$nn/; chomp $x; } print " \$ = \"\\x00$x\\x00\\x1e\"\n"; };' | sort | uniq
Last Saved By:
$ file ~/samples/all/* | perl -ne 'if(/Last Saved By: (.*?), Revision/) { $x = $1; $x =~ s/\"/\\\"/g; while($x =~ /\\(\d{3})/) { $n = oct($1); $nn = sprintf("%02x",$n); $x =~ s/\\$1/\\x$nn/; chomp $x; } print " \$ = \"\\x00$x\\x00\\x1e\"\n"; };' | sort | uniq
*/
rule OLEAuthor : Author OLEMetadata
{
meta:
description = "Identifier for known OLE document authors"
author = "Seth Hardy"
last_modified = "2014-05-07"
strings:
$ = "\x00111\x00\x1e"
$ = "\x0011\x00\x1e"
$ = "\x00123\x00\x1e"
$ = "\x002chu\x00\x1e"
$ = "\x007513A3DEA183474\x00\x1e"
$ = "\x00abc\x00\x1e"
$ = "\x00Administrator\x00\x1e"
$ = "\x00admin\x00\x1e"
$ = "\x00Aggarwal, Aakash\x00\x1e"
$ = "\x00beat\x00\x1e"
$ = "\x00Ben\x00\x1e"
$ = "\x00bf\x00\x1e"
$ = "\x00Booksway\x00\x1e"
$ = "\x00Bosh\x00\x1e"
$ = "\x00captain\x00\x1e"
$ = "\x00CC2\x00\x1e"
$ = "\x00cyano\x00\x1e"
$ = "\x00Dinesh\x00\x1e"
$ = "\x00Dolker\x00\x1e"
$ = "\x00Drokpa\x00\x1e"
$ = "\x00Findo\x00\x1e"
$ = "\x00FLORINE DATESSEN\x00\x1e"
$ = "\x00funghain\x00\x1e"
$ = "\x00HealthDeptt-01\x00\x1e"
$ = "\x00hy9901a\x00\x1e"
$ = "\x00IBM User\x00\x1e"
$ = "\x00IBM\x00\x1e"
$ = "\x00Igny\x00\x1e"
$ = "\x00IITK\x00\x1e"
$ = "\x00I. K\x00\x1e"
$ = "\x00Jamal Al-Masraf\x00\x1e"
$ = "\x00Joyce Havinga\x00\x1e"
$ = "\x00kalume\x00\x1e"
$ = "\x00Karma\x00\x1e"
$ = "\x00karmayeshi\x00\x1e"
$ = "\x00KChase\x00\x1e"
$ = "\x00ken\x00\x1e"
$ = "\x00khenrab\x00\x1e"
$ = "\x00Kunga Tashi\x00\x1e"
$ = "\x00Lenovo User\x00\x1e"
$ = "\x00Lenovo\x00\x1e"
$ = "\x00lenovo\x00\x1e"
$ = "\x00Lharisang\x00\x1e"
$ = "\x00Luitgard Hammerer\x00\x1e"
$ = "\x00MC SYSTEM\x00\x1e"
$ = "\x00mpzhang\x00\x1e"
$ = "\x00neuroking\x00\x1e"
$ = "\x00Ngawang Gelek\x00\x1e"
$ = "\x00niu2\x00\x1e"
$ = "\x00Owner\x00\x1e"
$ = "\x00pema tashi\x00\x1e"
$ = "\x00pepe\x00\x1e"
$ = "\x00perhat64\x00\x1e"
$ = "\x00Remote\x00\x1e"
$ = "\x00ResuR\x00\x1e"
$ = "\x00roy\x00\x1e"
$ = "\x00Samphel\x00\x1e"
$ = "\x00sard\x00\x1e"
$ = "\x00shirley\x00\x1e"
$ = "\x00shungqar\x00\x1e"
$ = "\x00Sofia Olsson\x00\x1e"
$ = "\x00Sonam Dolkar\x00\x1e"
$ = "\x00Son Huynh Hong\x00\x1e"
$ = "\x00system\x00\x1e"
$ = "\x00teguete\x00\x1e"
$ = "\x00tensangmo\x00\x1e"
$ = "\x00tenzin1959\x00\x1e"
$ = "\x00Tenzin\x00\x1e"
$ = "\x00Tran Duy Linh\x00\x1e"
$ = "\x00Traudl\x00\x1e"
$ = "\x00Tsedup\x00\x1e"
$ = "\x00Tsering Tamding\x00\x1e"
$ = "\x00unknown\x00\x1e"
$ = "\x00USER\x00\x1e"
$ = "\x00User\x00\x1e"
$ = "\x00user\x00\x1e"
$ = "\x00votoystein\x00\x1e"
$ = "\x00walkinnet\x00\x1e"
$ = "\x00World Uyghur Congress\x00\x1e"
$ = "\x00www\x00\x1e"
$ = "\x00 \x00\x1e"
$ = "\x00 \x00\x1e"
$ = "\x00 \x00\x1e"
$ = "\x00 \x00\x1e"
$ = "\x00\xf4_y\xb7\x80\x05\x9e\xbf\x00\x1e"
$ = "\x00xp\x00\x1e"
$ = "\x00YCanPDF\x00\x1e"
$ = "\x00y\x00\x1e"
$ = "\x00zsh\x00\x1e"
condition:
IsOLE and (any of them)
}
rule OLETitle : Title OLEMetadata
{
meta:
description = "Identifier for known OLE document titles"
author = "Seth Hardy"
last_modified = "2014-05-07"
strings:
$ = "\x0001:00\x00\x1e"
$ = "\x00 23-Aprel chushidin keyin saet bir yirim,Xitayning 3 neper paylaqchisi seriqbuya yezida oy arilap yurup paylaqchiliq qiliwatqanda bir oyge toplann\xcaghan bir gurup uyghur yashlarni korgen we ularning yenida pichaq we tam teshidighan eswablarni korup gum\x00\x1e"
$ = "\x0046-120603 fice W648\x00\x1e"
$ = "\x0054-120602 15s\xb7K\x0c]\xb7\x00\x1e"
$ = "\x005-Iyul Urumchi Qirghinchiliqi heqide qisqiche Dokilat \x00\x1e"
$ = "\x00April 20-21, 2013\x00\x1e"
$ = "\x00asdfasdfasdf\x00\x1e"
$ = "\x00Bamako, le 04 d\x00\x1e"
$ = "\x00Best\x00\x1e"
$ = "\x00Dear All,\x00\x1e"
$ = "\x00Dear President and Executive Members,\x00\x1e"
$ = "\x00Full list of self-immolations in Tibet\x00\x1e"
$ = "\x00Help stop the destruction of my home, Lhasa, Tibet\x00\x1e"
$ = "\x00HHDL'visit in European\x00\x1e"
$ = "\x00II) Overview & Analysis:\x00\x1e"
$ = "\x00Institute for Defence Studies and Analyses\x00\x1e"
$ = "\x00IPT APPLICATION FORM\x00\x1e"
$ = "\x00Jharkhand supports Indian Parliamentary resolution on Tibet crisis\x00\x1e"
$ = "\x00Lieutenant General KENOSE BARRY PHILLIPE,\x00\x1e"
$ = "\x00OPERATIONAL MANUAL:\x00\x1e"
$ = "\x00PART 2 - Overview and Analysis\x00\x1e"
$ = "\x00PowerPoint Presentation\x00\x1e"
$ = "\x00Progress Chart: 15\x00\x1e"
$ = "\x00Progress Chart:\x00\x1e"
$ = "\x00Progress Chart\x00\x1e"
$ = "\x00RC\x00\x1e"
$ = "\x00(RESENDING)\x00\x1e"
$ = "\x00Talking Points EU-China Human Rights Dialogue June 2011\x00\x1e"
$ = "\x00TANC Community Center\x00\x1e"
$ = "\x00The Charg\x00\x1e"
$ = "\x00The following schedule of plans has been finalized for the purpose of holding the Second Special General Meeting of Tibetans being organized jointly by the Tibetan Parliament-in-Exile and the Kashag headed by the Kalon Tripa in accordance with the provis\x00\x1e"
$ = "\x00The Tibet Museum Project\x00\x1e"
$ = "\x00Tibetan Community in Switzerland & Liechtenstein, Binzstrasse 15, CH-8045 Zurich, Switzerland \x00\x1e"
$ = "\x00TSERING BHUTI\x00\x1e"
$ = "\x00Tsering Bhuti\x00\x1e"
$ = "\x00 \x00\x1e"
$ = "\x00#\x00\x1e"
$ = "\x00\x8d\x00\x1e"
$ = "\x00\x8d\x9a\x06\xb7\x00\x1e"
$ = "\x00\xc8\xf8!\xb7\x00\x1e"
$ = "\x00Yes, I would like to raise this point: how many more young Tibetan lives are to be sacrificed in these awful self immolations before China is likely to change its Tibet policies in favour of Tibetan autonomy\x00\x1e"
condition:
IsOLE and (any of them)
}
rule OLELastSavedBy : LastSavedBy OLEMetadata
{
meta:
description = "Identifier for known OLE document Last Saved By field"
author = "Seth Hardy"
last_modified = "2014-05-07"
strings:
$ = "\x00111\x00\x1e"
$ = "\x0011\x00\x1e"
$ = "\x00123\x00\x1e"
$ = "\x00Administrator\x00\x1e"
$ = "\x00Admin\x00\x1e"
$ = "\x00Alex\x00\x1e"
$ = "\x00Audit\x00\x1e"
$ = "\x00A\x00\x1e"
$ = "\x00beat\x00\x1e"
$ = "\x00Ben\x00\x1e"
$ = "\x00bf\x00\x1e"
$ = "\x00Booksway\x00\x1e"
$ = "\x00Bosh\x00\x1e"
$ = "\x00captain\x00\x1e"
$ = "\x00CL_nelson\x00\x1e"
$ = "\x00Core\x00\x1e"
$ = "\x00cyano\x00\x1e"
$ = "\x00dainzin\x00\x1e"
$ = "\x00Dolker\x00\x1e"
$ = "\x00Findo\x00\x1e"
$ = "\x00FLORINE DATESSEN\x00\x1e"
$ = "\x00funghain\x00\x1e"
$ = "\x00HP\x00\x1e"
$ = "\x00hy9901a\x00\x1e"
$ = "\x00IBM User\x00\x1e"
$ = "\x00IBM\x00\x1e"
$ = "\x00Igny\x00\x1e"
$ = "\x00I. K\x00\x1e"
$ = "\x00ITCO\x00\x1e"
$ = "\x00jds\x00\x1e"
$ = "\x00Joyce Havinga\x00\x1e"
$ = "\x00karmayeshi\x00\x1e"
$ = "\x00ken\x00\x1e"
$ = "\x00khenrab\x00\x1e"
$ = "\x00Kunga Tashi\x00\x1e"
$ = "\x00lebrale\x00\x1e"
$ = "\x00Lenovo User\x00\x1e"
$ = "\x00Lenovo\x00\x1e"
$ = "\x00lenovo\x00\x1e"
$ = "\x00Lharisang\x00\x1e"
$ = "\x00Lhundup Damcho\x00\x1e"
$ = "\x00MC SYSTEM\x00\x1e"
$ = "\x00mm\x00\x1e"
$ = "\x00mpzhang\x00\x1e"
$ = "\x00neuroking\x00\x1e"
$ = "\x00niu2\x00\x1e"
$ = "\x00Normal.d\x00\x1e"
$ = "\x00Normal.w\x00\x1e"
$ = "\x00Normal\x00\x1e"
$ = "\x00one\x00\x1e"
$ = "\x00Owner\x00\x1e"
$ = "\x00pema tashi\x00\x1e"
$ = "\x00pepe\x00\x1e"
$ = "\x00PhiDiem\x00\x1e"
$ = "\x00ResuR\x00\x1e"
$ = "\x00roy\x00\x1e"
$ = "\x00Samphel\x00\x1e"
$ = "\x00system\x00\x1e"
$ = "\x00TCC Dhasa1\x00\x1e"
$ = "\x00tensangmo\x00\x1e"
$ = "\x00Tenzin\x00\x1e"
$ = "\x00test\x00\x1e"
$ = "\x00Tibet Ever\x00\x1e"
$ = "\x00Tran Duy Linh\x00\x1e"
$ = "\x00Traudl\x00\x1e"
$ = "\x00unknown\x00\x1e"
$ = "\x00User\x00\x1e"
$ = "\x00user\x00\x1e"
$ = "\x00USR\x00\x1e"
$ = "\x00walkinnet\x00\x1e"
$ = "\x00WIN7\x00\x1e"
$ = "\x00www\x00\x1e"
$ = "\x00 \x00\x1e"
$ = "\x00 \x00\x1e"
$ = "\x00 \x00\x1e"
$ = "\x00 \x00\x1e"
$ = "\x00y\x00\x1e"
condition:
IsOLE and (any of them)
}

14
data/ioc/yara/payloads.yara Normal file
View File

@@ -0,0 +1,14 @@
rule XYPayload : Payload
{
meta:
description = "Identifier for payloads using XXXXYYYY/YYYYXXXX markers"
author = "Seth Hardy"
last_modified = "2014-05-05"
strings:
$start_marker = "XXXXYYYY"
$end_marker = "YYYYXXXX"
condition:
$start_marker and $end_marker
}

162
data/ioc/yara/rules.yar Normal file
View File

@@ -0,0 +1,162 @@
rule PSS_Agent {
meta:
description = "PSS Agent versions 4.x and 5.x"
author = "Geoffrey Alexander <geoff@citizenlab.ca>"
date = "2017-07-20"
strings:
$cmdproc = "CmdProc_" wide
$u1 = "SS_Agent" ascii
$u2 = "pss-agent" ascii
$u3 = "DC615DA9-94B5-4477-9C33-3A393BC9E63F" ascii
$u4 = { 06 1f 41 49 4d 48 50 4f 31 }
$s1 = "util::Process::" ascii
$s2 = "util::Resource::" ascii
$s3 = "util::System::" ascii
$s4 = "/M:{0FA12518-0120-0910-A43C-0DAA276D2EA4}" wide
$s5 = "Command is not allowed due to potential detection threat: %1%." wide
$s6 = "(%d) %.64s\\%.64s\\%.64s|%.64s|%.64s|%.64s|%.64s|%.64s|%.64s" wide
$s7 = "Name: %s Due: %02d/%02d/%04d %02d:%02d:%02d, Length: %d seconds" wide
$s8 = "Image will be taken on the next Skype call session." wide
$s9 = "\\\\.\\pipe\\BrowseIPC" wide
$s10 = "RES_BINARY" wide
$s11 = "/{433a-bbaf439-12982d4a-9c27}" wide
condition:
uint16(0) == 0x5a4d and $cmdproc and 1 of ($u*) and 4 of ($s*)
}
rule PSS_Pipeserver {
meta:
description = "PSS Pipeserver versions 4.x and 5.x"
author = "Geoffrey Alexander <geoff@citizenlab.ca>"
data = "2017-07-20"
strings:
$u1 = "pss-agent" ascii
$u2 = "PSS_Agent" ascii
$u3 = "Agent path too long (>= MAX_PATH)" ascii
$u4 = "Agent is not running, executing it now\\n" ascii
$u5 = "Failed to create PssClock!" ascii
$s1 = "LnkProxy" ascii
$s2 = "CUSTOMER\\Agent" ascii
$s3 = "BrowseIPC" ascii
$s4 = "CustomerConfig is not initialized yet" ascii
$s5 = "RES_BINARY" ascii
$s6 = "ipc::security_access::" ascii
$s7 = "util::Resource::" ascii
$s8 = "util::System::" ascii
$s9 = "AgentAdminGlobalEventName" wide
$s10 = "AgentDummyKillGlobalEventName" wide
$s11 = "AgentGlobalEventName" wide
$s12 = "AgentKillGlobalEventName" wide
$s13 = "AgentPipeServerInitGlobalEventName" wide
$s14 = "AgentUninstallGlobalEventName" wide
$s15 = "/M:{0FA12518-0120-0910-A43C-0DAA276D2EA4}" wide
$s16 = "\\\\.\\pipe\\BrowseIPC" wide
$s17 = "RES_BINARY" wide
$s18 = "/{433a-bbaf439-12982d4a-9c27}" wide
condition:
uint16(0) == 0x5a4d and 1 of ($u*) and 8 of ($s*)
}
rule PSS_lnkproxy {
meta:
description = "PSS lnkproxy versions 4.x and 5.x"
author = "Geoffrey Alexander <geoff@citizenlab.ca>"
date = "2017-07-20"
strings:
$s1 = "COMMAND_LINE_BEGIN:" ascii
$s2 = ":COMMAND_LINE_END:" ascii
$s3 = "Could not execute process when no command is specified" ascii
$s4 = "lnkproxy.db" ascii
$s5 = "SPAWN_COMMAND_BEGIN:" ascii
$s6 = ":SPAWN_COMMAND_END" ascii
$s7 = "util::Deserializer::" ascii
$s8 = "util::FileDeserializer::" ascii
$s9 = "util::File::" ascii
$s10 = "util::Process::" ascii
$s11 = "util::System::" ascii
condition:
uint16(0) == 0x5a4d and 4 of ($s*)
}
rule PSS_Agent_v6 {
meta:
description = "PSS Agent version 6.0.0 and 6.1.0"
author = "Geoffrey Alexander <geoff@citizenlab.ca>"
date = "2017-07-20"
strings:
$cmdproc = "CmdProc_" wide
$u1 = "C:\\Windows\\temp\\KB2979214.pdb" ascii
$u2 = { 06 1f 41 49 4d 48 50 4f 31 }
$s1 = "Did not complete transaction with pipe server" wide
$s2 = "SkypeControlAPIAttach" wide
$s3 = "SkypeControlAPIDiscover" wide
$s4 = "URL###Execute" wide
$s5 = "Failed to AddClipboardFormatListener, error [" ascii
$s6 = "transactionrequest.<xmlattr>" wide
$s7 = "DC615DA9-94B5-4477-9C33-3A393BC9E63F" ascii
$s8 = "getip.<xmlattr>.agentid" wide
$s9 = "AVAgentInstallException@agent@@" ascii
$s10 = "AVAgentCommandsException@agent@@" ascii
$s11 = "AVAgentCustomerConfigException@agent@@" ascii
$s12 = "AVTransactionParsingException@communication@@agent" ascii
$s13 = "AVStorageException@config@agent@@" ascii
$s14 = "AVDBStorageException@db@agent@@" ascii
$str_decrypt_loop = { 8b 47 04 8b ce 83 e1 03 c1 e1 03 ba ?? ?? ?? ?? d3 ea 32 54 35 ?? 88 14 06 46 3b f3 }
condition:
uint16(0) == 0x5a4d and $cmdproc and $str_decrypt_loop and 1 of ($u*) and 8 of ($s*)
}
rule PSS_lnkproxy_v6 {
meta:
description = "PSS lnkproxy version 6.0.0 and 6.1.0"
author = "Geoffrey Alexander <geoff@citizenlab.ca>"
date = "2017-07-20"
strings:
$s1 = "C:\\Windows\\temp\\KB2971112.pdb"
$s2 = "AVResourceException@exception@util@@" ascii
$s3 = "AVLnkControllerException@LnkProxy@@" ascii
$s4 = "AVLnkPayloadException@@" ascii
$s5 = "AVShellLinkException@LnkProxy@@" ascii
$s6 = "AVFileUtilitiesException@LnkProxy@@" ascii
$s7 = "AVLnkEntryException@LnkProxy@@" ascii
$s8 = "AVFileRollbackException@LnkProxy@@" ascii
$str_decrypt_loop = { 8b 47 04 8b ce 83 e1 03 c1 e1 03 ba ?? ?? ?? ?? d3 ea 32 54 35 ?? 88 14 06 46 3b f3 }
condition:
uint16(0) == 0x5a4d and 3 of ($s*) and $str_decrypt_loop
}
rule PSS_Pipeserver_v6 {
meta:
description = "PSS Pipeserver version 6.0.0 and 6.1.0"
author = "Geoffrey Alexander <geoff@citizenlab.ca>"
date = "2017-07-20"
strings:
$p1 = "PSS_Agent" ascii
$p2 = "pss-agent" ascii
$s1 = "%2s%u.%u.%u.%u\\\\n" wide
$s2 = "CustomerConfigException@agent" ascii
$str_decrypt_loop = { 8b 47 04 8b ce 83 e1 03 c1 e1 03 ba ?? ?? ?? ?? d3 ea 32 54 35 ?? 88 14 06 46 3b f3 }
condition:
uint16(0) == 0x5a4d and $str_decrypt_loop and 1 of ($p*) and 1 of ($s*)
}

273
data/ioc/yara/rules.yara Normal file
View File

@@ -0,0 +1,273 @@
rule powershell_dropper {
meta:
author = "Etienne Maynier"
email = "etienne@citizenlab.ca"
strings:
$a = "$decentID = [System.Convert]::FromBase64String($indecentID)"
$b = "if($tmp[1].CPU -gt 0) {} else {[ReverseTCPShell]::run()}"
$c = "function Get-RSACode()"
$d = "-file %temp%\\233.ps1"
condition:
1 of them
}
rule dropper_strings {
meta:
author = "Etienne Maynier"
email = "etienne@citizenlab.ca"
strings:
$a = "bitsadmin /canceft\\windows\\currebitsadmin /addfibitsadmin /Resumbitsadmin /SetNosoftware"
$b = "\\microsotifyCmdLine %s rle %s c:\\windowsbitsadmin /creat\\system32\\net.ex"
$c = "rundll32.exe %s Main"
$d = "d1fasg34"
$e = "FindResource %s error"
condition:
uint16(0) == 0x5A4D and 2 of them
}
rule payload_wab32res_strings {
meta:
author = "Etienne Maynier"
email = "etienne@citizenlab.ca"
strings:
$a1 = "%02d%02d%02d%02d%02d%03d"
$a2 = "459B2-3311-54C3- /Processid:{712"
$a3 = "CreateProcess %s"
$a4 = "FakeRun.dll"
$a5 = "Release\\FakeRun.pdb"
condition:
uint16(0) == 0x5A4D and 2 of them
}
rule pcnt_cert {
meta:
author = "Etienne Maynier"
email = "etienne@citizenlab.ca"
strings:
$a = "MIIDWjCCAkICCQCdeJZhGKJakTANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJV"
$b = "UzERMA8GA1UECAwITmVicmFza2ExEDAOBgNVBAcMB0xpbmNvbG4xDTALBgNVBAoM"
$c = "BFBDTlQxDTALBgNVBAsMBFBDTlQxHTAbBgkqhkiG9w0BCQEWDnBjbnRAZ21haWwu"
$d = "Y29tMB4XDTE4MDEwNjA2MDMyMloXDTI4MDEwNDA2MDMyMlowbzELMAkGA1UEBhMC"
$e = "VVMxETAPBgNVBAgMCE5lYnJhc2thMRAwDgYDVQQHDAdMaW5jb2xuMQ0wCwYDVQQK"
$f = "DARQQ05UMQ0wCwYDVQQLDARQQ05UMR0wGwYJKoZIhvcNAQkBFg5wY250QGdtYWls"
$g = "LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK+ihHezE6jjS2Vl"
$h = "/rIIQsrczmbjU/4KYDiLiCcrxN0tht6GzL281KGoW13IiQvKILANmx02IAy5tzij"
$i = "0W9ZvFAIRRYVDpoSU+EyXz4LjHgXvw6VeG9v3HV99iSmphkq7mLYee0EPYP6wSdB"
condition:
uint16(0) == 0x5A4D and all of them
}
rule custom_decryption {
meta:
author = "Etienne Maynier"
email = "etienne@citizenlab.ca"
strings:
$encrypt = { 8b d6 81 e2 07 00 00 80 79 05 4a 83 ca f8 42 8a 04 1e 0f be 0c 95 28 7e 46 00 34 01 0f be c0 0f af c8 80 f1 67 88 0c 1e 46 3b f7 7c d3 }
$encrypt2 = { 8A 0C 30 8B D0 83 E2 07 80 F1 01 0F BE C9 0F BE 54 95 D0 0F AF D1 80 F2 85 88 14 30 40 }
$decrypt_file1 = { 0f b6 01 8b d6 83 e2 07 34 01 0f be c0 83 c6 04 0f be }
$decrypt_file2 = { 0f af d0 0f b6 41 01 34 01 0f be c0 88 11 8d 14 0f 83 e2 07 0f be }
$decrypt_file3 = { 0f af d0 0f b6 41 02 34 01 0f be c0 88 51 01 8d 14 0b 83 e2 07 0f be }
$decrypt_file4 = { 0f af d0 0f b6 41 03 34 01 0f be c0 88 51 02 8b 55 fc 03 d1 83 e2 07 0f be }
condition:
uint16(0) == 0x5A4D and ($encrypt or $encrypt2 or all of ($decrypt_file*))
}
rule tclient_strings {
meta:
author = "Etienne Maynier"
email = "etienne@citizenlab.ca"
strings:
$a = "sdf81msdf7"
$b = "software\\klive"
$c = "\\Registry\\User\\%s\\Software\\KLive"
$d = "%s\\wab32res.dll"
$e = "[!]NtDeleteValueKey Error:%ul"
$f = "%sDebugLog.TXT"
$g = "Server connect to [%s:%d] Sucesse! token = %s"
$h = "192.168.70.1"
$i = "Start %d connect %s:%d"
condition:
uint16(0) == 0x5A4D and 3 of them
}
rule tclient_string {
meta:
author= "Etienne Maynier"
email = "etienne@citizenlab.ca"
strings:
$a = "showgodmoney1gz"
$b = "MDDEFGEGETGIZ"
condition:
uint16(0) == 0x5A4D and 2 of them
}
rule dsng_installer_dll_characteristics {
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
$s1 = "dsng.dll"
$s2 = "InstallD" fullword
$s3 = "InstallZ" fullword
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
all of them
}
rule dsng_installer_dll_stringset {
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
$s1 = "KCOM Server Security Guard"
$s2 = "LoadFlgDllFun"
$s3 = "Installv" fullword
$s4 = "Dll path %s"
$s5 = "MainFunVvv"
$s6 = "http://dsas.asdf.com/"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
2 of them
}
rule tibetan_indecent_rtf_meta {
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
$operator = "{\\operator Windows \\'d3\\'c3\\'bb\\'a7}"
condition:
any of them
}
rule tibetan_indecent_ppsx_meta
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
$createdby = "<dc:creator>Windows User</dc:creator>"
$createdate = "<dcterms:created xsi:type=\"dcterms:W3CDTF\">2017-10-23T00:57:05Z</dcterms:created>"
condition:
all of them
}
rule tibetan_indecent_powershell
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
$decents1 = "$indecentID" ascii wide
$decents2 = "$decentID" ascii wide
$decents3 = "powershell" ascii wide nocase
condition:
all of them
}
rule tibetan_indecent_pe_loader_pdb
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
//C:\Users\learn\Desktop\免杀\
$pdb = {43 3a 5c 55 73 65 72 73 5c 6c 65 61 72 6e 5c 44 65 73 6b 74 6f 70 5c e5 85 8d e6 9d 80}
condition:
all of them
}
rule tibetan_indecent_powershell_tcpshell_funcs
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
$class = "public class ReverseTCPShell" ascii wide nocase
$func1 = "public static void run" ascii wide nocase
$func2 = "public static void runth" ascii wide nocase
$func3 = "public static void start" ascii wide nocase
$func4 = "public static bool isOnline" ascii wide nocase
$func5 = "public static void startCmd" ascii wide nocase
$func6 = "public static void CmdExited" ascii wide nocase
$func7 = "public static void DataReceived" ascii wide nocase
$func8 = "public static void FileReceive" ascii wide nocase
$func9 = "public static void CmdManager" ascii wide nocase
$func10 = "public static void SortOutputHandler" ascii wide nocase
$func11 = "public static void SendLoginInfo" ascii wide nocase
$func12 = "public static void Send" ascii wide nocase
$func13 = "public static int SendWithSplit" ascii wide nocase
condition:
6 of them
}
rule tibetan_indecent_infrastructure_strings
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
$cc1 = "103.55.24.196" ascii wide nocase
$cc2 = "118.99.59.105" ascii wide nocase
$cc3 = "27.126.186.222" ascii wide nocase
$cc4 = "45.127.97.222" ascii wide nocase
$cc5 = "comemail.email" ascii wide nocase
$cc6 = "commail.co" ascii wide nocase
$cc7 = "daynew.today" ascii wide nocase
$cc8 = "daynews.today" ascii wide nocase
$cc9 = "tibetfrum.info" ascii wide nocase
$cc10 = "tibethouse.info" ascii wide nocase
$cc11 = "tibetnews.info" ascii wide nocase
$cc12 = "tibetnews.today" ascii wide nocase
condition:
any of them
}
rule silent_ppk_strings
{
meta:
author = "Geoff Alexander <geoff@citizenlab.ca>"
strings:
$s1 = "MainCommandJobSub"
$s2 = "MainFun002"
$s3 = "mRecvPkgFun"
$s4 = "while -- ClientConnect"
$s5 = "svsdll.log"
$s6 = "ppk.dat"
condition:
uint16(0) == 0x5a4d and 4 of ($s*)
}