YARA rules for APT28
132 rules · scoped to actor · back to APT28
YARA rules whose family, name, or description matches this actor or its tooling. Use these for binary-pattern hunts.
rule COZY_FANCY_BEAR_Hunt {
meta:
description = "Detects Cozy Bear / Fancy Bear C2 Server IPs"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
date = "2016-06-14"
id = "e81b4368-7383-5a48-a89a-f91b9306326e"
strings:
$s1 = "185.100.84.134" ascii wide fullword
$s2 = "58.49.58.58" ascii wide fullword
$s3 = "218.1.98.203" ascii wide fullword
$s4 = "187.33.33.8" ascii wide fullword
$s5 = "185.86.148.227" ascii wide fullword
$s6 = "45.32.129.185" ascii wide fullword
$s7 = "23.227.196.217" ascii wide fullword
condition:
uint16(0) == 0x5a4d and 1 of them
}
rule Sofacy_Malware_StrangeSpaces {
meta:
description = "Detetcs strange strings from Sofacy malware with many spaces"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
date = "2015-12-04"
id = "60f99b88-f256-5289-852c-c0bf27f1cbd4"
strings:
$s2 = "Delete Temp Folder Service " fullword wide
$s3 = " Operating System " fullword wide
$s4 = "Microsoft Corporation " fullword wide
$s5 = " Microsoft Corporation. All rights reserved. " fullword wide
condition:
uint16(0) == 0x5a4d and filesize < 50KB and 3 of them
}
rule Sofacy_Malware_AZZY_Backdoor_1 {
meta:
description = "AZZY Backdoor - Sample 1"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
date = "2015-12-04"
hash = "a9dc96d45702538c2086a749ba2fb467ba8d8b603e513bdef62a024dfeb124cb"
id = "184dc45e-8014-5dcf-a033-d77586c60fdf"
strings:
$s0 = "advstorshell.dll" fullword wide
$s1 = "advshellstore.dll" fullword ascii
$s2 = "Windows Advanced Storage Shell Extension DLL" fullword wide
condition:
uint16(0) == 0x5a4d and filesize < 150KB and 2 of them
}
rule Sofacy_AZZY_Backdoor_Implant_1 {
meta:
description = "AZZY Backdoor Implant 4.3 - Sample 1"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
date = "2015-12-04"
hash = "1bab1a3e0e501d3c14652ecf60870e483ed4e90e500987c35489f17a44fef26c"
id = "ec6bf8ca-ccb9-532e-8b0d-1fba59efa2da"
strings:
$s1 = "\\tf394kv.dll" wide
$s2 = "DWN_DLL_MAIN.dll" fullword ascii
$s3 = "?SendDataToServer_2@@YGHPAEKEPAPAEPAK@Z" ascii
$s4 = "?Applicate@@YGHXZ" ascii
$s5 = "?k@@YGPAUHINSTANCE__@@PBD@Z" ascii
condition:
uint16(0) == 0x5a4d and filesize < 300KB and 2 of them
}
rule Sofacy_AZZY_Backdoor_HelperDLL {
meta:
description = "Dropped C&C helper DLL for AZZY 4.3"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
date = "2015-12-04"
hash = "6cd30c85dd8a64ca529c6eab98a757fb326de639a39b597414d5340285ba91c6"
id = "eae089a0-21dc-5d6e-a4bc-7181dc9b8b35"
strings:
$s0 = "snd.dll" fullword ascii
$s1 = "InternetExchange" fullword ascii
$s2 = "SendData"
condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them
}
rule Sofacy_CollectorStealer_Gen1 {
meta:
description = "Generic rule to detect Sofacy Malware Collector Stealer"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
date = "2015-12-04"
super_rule = 1
hash1 = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
hash2 = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
id = "f9462dd9-f6b6-59f4-a443-12d6f3be444e"
strings:
$s0 = "NvCpld.dll" fullword ascii
$s1 = "NvStop" fullword ascii
$s2 = "NvStart" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
rule Sofacy_CollectorStealer_Gen2 {
meta:
description = "File collectors / USB stealers - Generic"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
date = "2015-12-04"
hash = "e917166adf6e1135444f327d8fff6ec6c6a8606d65dda4e24c2f416d23b69d45"
hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
hash = "b1f2d461856bb6f2760785ee1af1a33c71f84986edf7322d3e9bd974ca95f92d"
id = "03ced94f-de20-56c5-bf17-1ec7d8610684"
strings:
$s1 = "msdetltemp.dll" fullword ascii
$s2 = "msdeltemp.dll" fullword wide
$s3 = "Delete Temp Folder Service" fullword wide
condition:
uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
}
rule Sofacy_CollectorStealer_Gen3 {
meta:
description = "File collectors / USB stealers - Generic"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
date = "2015-12-04"
hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
hash = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
id = "d2ee1a22-6aae-51fc-9043-a7ba99769376"
strings:
$s1 = "NvCpld.dll" fullword ascii
$s4 = "NvStart" fullword ascii
$s5 = "NvStop" fullword ascii
$a1 = "%.4d%.2d%.2d%.2d%.2d%.2d%.2d%.4d" fullword wide
$a2 = "IGFSRVC.dll" fullword wide
$a3 = "Common User Interface" fullword wide
$a4 = "igfsrvc Module" fullword wide
$b1 = " Operating System " fullword wide
$b2 = "Microsoft Corporation " fullword wide
condition:
uint16(0) == 0x5a4d and filesize < 150KB and
( all of ($s*) and (all of ($a*) or all of ($b*)))
}
rule Sofacy_Campaign_Mal_Feb18_cdnver {
meta:
description = "Detects Sofacy malware"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://twitter.com/ClearskySec/status/960924755355369472"
date = "2018-02-07"
hash1 = "12e6642cf6413bdf5388bee663080fa299591b2ba023d069286f3be9647547c8"
id = "a5c72ddd-91b0-5410-9d81-38a138ec7efe"
strings:
$x1 = "cdnver.dll" fullword wide
$x2 = { 25 73 0A 00 00 00 00 00 30 00 00 00 20 00 2D 00
20 00 00 00 0A 00 00 00 25 00 73 00 00 00 00 00
69 00 6D 00 61 00 67 00 65 00 2F 00 6A 00 70 00
65 00 67 }
$s1 = "S7%s - %lu" fullword ascii
$s2 = "SNFIRNW" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 90KB and (
pe.imphash() == "01f3d0fe6fb9d9df24620e67afc143c7" or
1 of ($x*) or
2 of them
)
}
rule Sofacy_Trojan_Loader_Feb18_1 {
meta:
description = "Sofacy Activity Feb 2018"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://www.reverse.it/sample/e3399d4802f9e6d6d539e3ae57e7ea9a54610a7c4155a6541df8e94d67af086e?environmentId=100"
date = "2018-03-01"
hash1 = "335565711db93cd02d948f472c51598be4d62d60f70f25a20449c07eae36c8c5"
id = "358d7a77-0ff5-572e-9cd8-b2cebaace02f"
strings:
$x1 = "%appdata%\\nad.dll" fullword wide
$s3 = "%appdata%\\nad.bat" fullword wide
$s1 = "apds.dll" fullword ascii
$s2 = "nad.dll\"" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 300KB and (
pe.imphash() == "a2d1be6502b4b3c28959a4fb0196ea45" or
pe.exports("VidBitRpl") or
1 of ($x*) or
2 of them
)
}
rule Sofacy_Jun16_Sample1 {
meta:
description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://goo.gl/mzAa97"
date = "2016-06-14"
score = 85
hash1 = "be1cfa10fcf2668ae01b98579b345ebe87dab77b6b1581c368d1aba9fd2f10a0"
id = "62b577e3-7ccb-59df-a944-96ffe9b16d3d"
strings:
$s1 = "clconfg.dll" fullword ascii
$s2 = "ASijnoKGszdpodPPiaoaghj8127391" fullword wide
condition:
( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($s*) ) ) or ( all of them )
}
rule Sofacy_Jun16_Sample2 {
meta:
description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://goo.gl/mzAa97"
date = "2016-06-14"
score = 85
hash1 = "57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc413116b1d6ffedf1b"
hash2 = "69940a20ab9abb31a03fcefe6de92a16ed474bbdff3288498851afc12a834261"
hash3 = "aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632"
id = "21561e13-a190-565e-a08b-e6a07c84c3db"
strings:
$x1 = "DGMNOEP" fullword ascii
$x2 = "/%s%s%s/?%s=" fullword ascii
$s1 = "Control Panel\\Dehttps=https://%snetwork.proxy.ht2" fullword ascii
$s2 = "http=http://%s:%Control Panel\\Denetwork.proxy.ht&ol1mS9" fullword ascii
$s3 = "svchost.dll" fullword wide
$s4 = "clconfig.dll" fullword wide
condition:
( uint16(0) == 0x5a4d and filesize < 100KB and ( all of ($x*) ) ) or ( 3 of them )
}
rule Sofacy_Jun16_Sample3 {
meta:
description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://goo.gl/mzAa97"
date = "2016-06-14"
score = 85
hash1 = "c2551c4e6521ac72982cb952503a2e6f016356e02ee31dea36c713141d4f3785"
id = "f97bc840-0d9a-5a9e-9e13-7b7f8acc53a5"
strings:
$s1 = "ASLIiasiuqpssuqkl713h" fullword wide
condition:
uint16(0) == 0x5a4d and filesize < 200KB and $s1
}
rule apt_sofacy_xtunnel {
meta:
author = "Claudio Guarnieri"
description = "Sofacy Malware - German Bundestag"
score = 75
id = "aef091b5-cedf-5443-ab61-8b2dbc7e77fd"
strings:
$xaps = ":\\PROJECT\\XAPS_"
$variant11 = "XAPS_OBJECTIVE.dll" $variant12 = "start"
$variant21 = "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0"
$variant22 = "is you live?"
$mix1 = "176.31.112.10"
$mix2 = "error in select, errno %d" $mix3 = "no msg"
$mix4 = "is you live?"
$mix5 = "127.0.0.1"
$mix6 = "err %d"
$mix7 = "i`m wait"
$mix8 = "hello"
$mix9 = "OpenSSL 1.0.1e 11 Feb 2013" $mix10 = "Xtunnel.exe"
condition:
((uint16(0) == 0x5A4D) or (uint16(0) == 0xCFD0)) and (($xaps) or (all of ($variant1*)) or (all of ($variant2*)) or (6 of ($mix*)))
}
rule Winexe_RemoteExec {
meta:
description = "Winexe tool for remote execution (also used by Sofacy group)"
author = "Florian Roth (Nextron Systems), Robert Simmons"
reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
date = "2015-06-19"
modified = "2021-02-11"
hash1 = "5130f600cd9a9cdc82d4bad938b20cbd2f699aadb76e7f3f1a93602330d9997d"
hash2 = "d19dfdbe747e090c5aa2a70cc10d081ac1aa88f360c3f378288a3651632c4429"
score = 70
id = "5079557a-0461-5b04-b0f2-4265bf7ec041"
strings:
$s1 = "error Cannot LogonUser(%s,%s,%s) %d" ascii fullword
$s2 = "error Cannot ImpersonateNamedPipeClient %d" ascii fullword
$s3 = "\\\\.\\pipe\\ahexec" fullword ascii
$s4 = "\\\\.\\pipe\\wmcex" fullword ascii
$s5 = "implevel" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 115KB and (
3 of them or
pe.imphash() == "2f8a475933ac82b8e09eaf26b396b54d"
)
}
rule Sofacy_Mal2 {
meta:
description = "Sofacy Group Malware Sample 2"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
date = "2015-06-19"
hash = "566ab945f61be016bfd9e83cc1b64f783b9b8deb891e6d504d3442bc8281b092"
score = 70
id = "1547cc67-7d7c-5ec9-816c-15b7d523376a"
strings:
$x1 = "PROJECT\\XAPS_OBJECTIVE_DLL\\" ascii
$x2 = "XAPS_OBJECTIVE.dll" fullword ascii
$s1 = "i`m wait" fullword ascii
condition:
uint16(0) == 0x5a4d and ( 1 of ($x*) ) and $s1
}
rule Sofacy_Mal3 {
meta:
description = "Sofacy Group Malware Sample 3"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
date = "2015-06-19"
modified = "2023-01-06"
hash = "5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1"
score = 70
id = "67d002ef-4ed9-54ce-a6ef-49b7f3b951e2"
strings:
$s1 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" fullword ascii
$s2 = ".?AVAgentModuleRemoteKeyLogger@@" fullword ascii
$s3 = "<font size=4 color=red>process isn't exist</font>" fullword ascii
$s4 = "<font size=4 color=red>process is exist</font>" fullword ascii
$s5 = ".winnt.check-fix.com" ascii
$s6 = ".update.adobeincorp.com" ascii
$s7 = ".microsoft.checkwinframe.com" ascii
$s8 = "adobeincorp.com" fullword wide
$s9 = "# EXC: HttpSender - Cannot create Get Channel!" fullword ascii
$x1 = "User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/" wide
$x2 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2" wide
$x3 = "C:\\Windows\\System32\\cmd.exe" fullword wide
condition:
uint16(0) == 0x5a4d and filesize < 300KB and (
2 of ($s*) or
( 1 of ($s*) and all of ($x*) )
)
}
rule Sofacy_Bundestag_Batch {
meta:
description = "Sofacy Bundestags APT Batch Script"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
date = "2015-06-19"
score = 70
id = "869dafec-1387-5640-b608-b84cf0d43342"
strings:
$s1 = "for %%G in (.pdf, .xls, .xlsx, .doc, .docx)" ascii
$s2 = "cmd /c copy"
$s3 = "forfiles"
condition:
filesize < 10KB and 2 of them
}
rule Sofacy_Oct17_1 {
meta:
description = "Detects Sofacy malware reported in October 2017"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
date = "2017-10-23"
hash1 = "522fd9b35323af55113455d823571f71332e53dde988c2eb41395cf6b0c15805"
id = "6896dcf3-e422-5a40-bc1e-d1f35ae95c14"
strings:
$x1 = "%localappdata%\\netwf.dll" fullword wide
$x2 = "set path = \"%localappdata%\\netwf.dll\"" fullword ascii
$x3 = "%localappdata%\\netwf.bat" fullword wide
$x4 = "KlpSvc.dll" fullword ascii
/* used for generic approach */
$g1 = "set path = \"%localappdata%\\" ascii
$g2 = "%localappdata%\\" wide
$s1 = "start rundll32.exe %path %,#1a" fullword ascii
$s2 = "gshell32" fullword wide
$s3 = "s - %lu" fullword ascii
$s4 = "be run i" fullword ascii
$s5 = "ingToBinhary" fullword ascii
$s6 = "%j%Xjs" fullword ascii
$s7 = "if NOT exist %path % (exit)" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 300KB and (
pe.imphash() == "a2d1be6502b4b3c28959a4fb0196ea45" or
pe.exports("KlpSvc") or
( 1 of ($x*) or 4 of them ) or
( $s1 and all of ($g*) )
)
}
rule Sofacy_Oct17_2 {
meta:
description = "Detects Sofacy malware reported in October 2017"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
date = "2017-10-23"
hash1 = "ef027405492bc0719437eb58c3d2774cc87845f30c40040bbebbcc09a4e3dd18"
id = "c820eab0-9b64-5718-8681-a4f515ee462b"
strings:
$x1 = "netwf.dll" fullword wide
$s1 = "%s - %s - %2.2x" fullword wide
$s2 = "%s - %lu" fullword ascii
$s3 = "%s \"%s\", %s" fullword wide
$s4 = "%j%Xjsf" fullword ascii
condition:
( uint16(0) == 0x5a4d and filesize < 90KB and (
pe.imphash() == "13344e2a717849489bcd93692f9646f7" or
( 4 of them )
)
) or ( all of them )
}
rule Sofacy_Fybis_ELF_Backdoor_Gen1 {
meta:
description = "Detects Sofacy Fysbis Linux Backdoor"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
date = "2016-02-13"
modified = "2023-01-27"
score = 80
hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
id = "c6abf33e-9c5b-5e0f-b7f0-a0741bf9cc3a"
strings:
$x1 = "Your command not writed to pipe" fullword ascii
$x2 = "Terminal don`t started for executing command" fullword ascii
$x3 = "Command will have end with \\n" fullword ascii
$s1 = "WantedBy=multi-user.target' >> /usr/lib/systemd/system/" ascii
$s2 = "Success execute command or long for waiting executing your command" fullword ascii
$s3 = "ls /etc | egrep -e\"fedora*|debian*|gentoo*|mandriva*|mandrake*|meego*|redhat*|lsb-*|sun-*|SUSE*|release\"" fullword ascii
$s4 = "rm -f /usr/lib/systemd/system/" ascii
$s5 = "ExecStart=" fullword ascii
$s6 = "<table><caption><font size=4 color=red>TABLE EXECUTE FILES</font></caption>" fullword ascii
condition:
( uint16(0) == 0x457f and filesize < 500KB and 1 of ($x*) ) or
( 1 of ($x*) and 3 of ($s*) )
}
rule Sofacy_Fysbis_ELF_Backdoor_Gen2 {
meta:
description = "Detects Sofacy Fysbis Linux Backdoor"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
date = "2016-02-13"
score = 80
hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
hash3 = "fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61"
id = "d4e3a8bb-b23a-53a4-b5fb-b321a3417b43"
strings:
$s1 = "RemoteShell" ascii
$s2 = "basic_string::_M_replace_dispatch" fullword ascii
$s3 = "HttpChannel" ascii
condition:
uint16(0) == 0x457f and filesize < 500KB and all of them
}
rule MAL_Sednit_DelphiDownloader_Apr18_2 {
meta:
description = "Detects malware from Sednit Delphi Downloader report"
author = "Florian Roth (Nextron Systems)"
reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
date = "2018-04-24"
hash1 = "53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda"
hash2 = "657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4"
hash3 = "5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182"
hash4 = "0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f"
hash5 = "72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3"
id = "6ccd2f21-de44-52fb-912e-d3ecbe57e389"
strings:
$s1 = "2D444F574E4C4F41445F53544152542D" ascii /* hex encoded string '-DOWNLOAD_START-' */
$s2 = "55504C4F41445F414E445F455845435554455F46494C45" ascii /* hex encoded string 'UPLOAD_AND_EXECUTE_FILE' */
$s3 = "4D6F7A696C6C612076352E31202857696E646F7773204E5420362E313B2072763A362E302E3129204765636B6F2F32303130303130312046697265666F782F36" ascii /* hex encoded string 'Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1' */
$s4 = "41646F62654461696C79557064617465" ascii /* hex encoded string 'AdobeDailyUpdate' */
$s5 = "53595354454D494E464F2026205441534B4C495354" ascii /* hex encoded string 'SYSTEMINFO & TASKLIST' */
$s6 = "6373727376632E657865" ascii /* hex encoded string 'csrsvc.exe' */
$s7 = "536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E" ascii /* hex encoded string 'Software\Microsoft\Windows\CurrentVersion\Run' */
$s8 = "5C536F6674776172655C4D6963726F736F66745C57696E646F7773204E545C43757272656E7456657273696F6E" ascii /* hex encoded string '\Software\Microsoft\Windows NT\CurrentVersion' */
$s9 = "5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E" ascii /* hex encoded string '\Software\Microsoft\Windows\CurrentVersion' */
$s0 = "2D444F574E4C4F41445F53544152542D" ascii /* hex encoded string '-DOWNLOAD_START-' */
$fp1 = "<key name=\"profiles\">"
condition:
filesize < 4000KB and 1 of ($s*) and not 1 of ($fp*)
}
rule MAL_Sednit_DelphiDownloader_Apr18_3 {
meta:
description = "Detects malware from Sednit Delphi Downloader report"
author = "Florian Roth (Nextron Systems)"
reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
date = "2018-04-24"
modified = "2023-01-06"
hash1 = "ecb835d03060db1ea3496ceca2d79d7c4c6c671c9907e0b0e73bf8d3371fa931"
hash2 = "e355a327479dcc4e71a38f70450af02411125c5f101ba262e8df99f9f0fef7b6"
id = "2200fbdc-3600-51d4-a273-dc7fd4127c05"
strings:
$ = "Processor Level: " fullword ascii
$ = "CONNECTION ERROR" fullword ascii
$ = "FILE_EXECUTE_AND_KILL_MYSELF" ascii
$ = "-KILL_PROCESS-" ascii
$ = "-FILE_EXECUTE-" ascii
$ = "-DOWNLOAD_ERROR-" ascii
$ = "CMD_EXECUTE" fullword ascii
$ = "\\Interface\\Office\\{31E12FE8-937F-1E32-871D-B1C9AOEF4D4}\\" ascii
$ = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 2000KB and 3 of them
}
rule IMPLANT_6_v1
{
meta:
description = "Sednit / EVILTOSS Implant by APT28"
author = "US CERT"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
date = "2017-02-10"
score = 85
id = "0554ec8e-f45d-5afc-8874-dc8adfac5cdf"
strings:
$STR1 = "dll.dll" wide ascii
$STR2 = "Init1" wide ascii
$STR3 = "netui.dll" wide ascii
condition:
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
}
rule IMPLANT_6_v2 {
meta:
description = "Sednit / EVILTOSS Implant by APT28"
author = "US CERT"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
date = "2017-02-10"
score = 85
id = "59bfbef2-ff0e-59df-9d08-15001cec8ecf"
strings:
$obf_func = { 8B 45 F8 6A 07 03 C7 33 D2 89 45 E8 8D 47 01 5B 02 4D 0F F7 F3 6A 07 8A 04 32 33 D2 F6 E9 8A C8 8B C7 F7 F3 8A 44 3E FE 02 45 FC 02 0C 32 B2 03 F6 EA 8A D8 8D 47 FF 33 D2 5F F7 F7 02 5D 14 8B 45 E8 8B 7D F4 C0 E3 06 02 1C 32 32 CB 30 08 8B 4D 14 41 47 83 FF 09 89 4D 14 89 7D F4 72 A1 }
condition:
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
}
rule IMPLANT_6_v3 {
meta:
description = "Sednit / EVILTOSS Implant by APT28"
author = "US CERT"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
date = "2017-02-10"
score = 85
id = "db090bc5-a90f-5b66-8fcb-29b423dddbf7"
strings:
$deob_func = { 8D 46 01 02 D1 83 E0 07 8A 04 38 F6 EA 8B D6 83 E2 07 0A
04 3A 33 D2 8A 54 37 FE 03 D3 03 D1 D3 EA 32 C2 8D 56 FF 83 E2 07 8A
1C 3A 8A 14 2E 32 C3 32 D0 41 88 14 2E 46 83 FE 0A 7C ?? }
condition:
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
}
rule IMPLANT_6_v4 {
meta:
description = "Sednit / EVILTOSS Implant by APT28"
author = "US CERT"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
date = "2017-02-10"
score = 85
id = "27118ec8-3713-5670-88d2-3ac57c155c0d"
strings:
$ASM = {53 5? 5? [6-15] ff d? 8b ?? b? a0 86 01 00 [7-13] ff d? ?b
[6-10] c0 [0-1] c3}
condition:
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
}
rule IMPLANT_6_v5 {
meta:
description = "Sednit / EVILTOSS Implant by APT28"
author = "US CERT"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
date = "2017-02-10"
score = 85
id = "d035eaff-8c2a-53a2-b629-6448b2bcc9f6"
strings:
$STR1 = { 83 EC 18 8B 4C 24 24 B8 AB AA AA AA F7 E1 8B 44 24 20 53 55 8B
EA 8D 14 08 B8 AB AA AA AA 89 54 24 1C F7 E2 56 8B F2 C1 ED 02 8B DD
57 8B 7C 24 38 89 6C 24 1C C1 EE 02 3B DE 89 5C 24 18 89 74 24 20 0F
83 CF 00 00 00 8D 14 5B 8D 44 12 FE 89 44 24 10 3B DD 0F 85 CF 00 00
00 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B CA 83 F9 06 89 4C 24 38 0F 83
86 00 00 00 8A C3 B2 06 F6 EA 8B 54 24 10 88 44 24 30 8B 44 24 2C 8D
71 02 03 D0 89 54 24 14 8B 54 24 10 33 C0 8A 44 37 FE 03 D6 8B D8 8D
46 FF 0F AF DA 33 D2 BD 06 00 00 00 F7 F5 C1 EB 07 8A 04 3A 33 D2 32
D8 8D 46 01 F7 F5 8A 44 24 30 02 C1 8A 0C 3A 33 D2 32 C8 8B C6 F7 F5
8A 04 3A 22 C8 8B 44 24 14 02 D9 8A 0C 30 32 CB 88 0C 30 8B 4C 24 38
41 46 83 FE 08 89 4C 24 38 72 A1 8B 5C 24 18 8B 6C 24 1C 8B 74 24 20
8B 4C 24 10 43 83 C1 06 3B DE 89 4C 24 10 8B 4C 24 34 89 5C 24 18 0F
82 3C FF FF FF 3B DD 75 1A 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B CA EB
0D 33 C9 89 4C 24 38 E9 40 FF FF FF 33 C9 8B 44 24 24 33 D2 BE 06 00
00 00 89 4C 24 38 F7 F6 3B CA 89 54 24 24 0F 83 95 00 00 00 8A C3 B2
06 F6 EA 8D 1C 5B 88 44 24 30 8B 44 24 2C 8D 71 02 D1 E3 89 5C 24 34
8D 54 03 FE 89 54 24 14 EB 04 8B 5C 24 34 33 C0 BD 06 00 00 00 8A 44
3E FE 8B D0 8D 44 1E FE 0F AF D0 C1 EA 07 89 54 24 2C 8D 46 FF 33 D2
BB 06 00 00 00 F7 F3 8B 5C 24 2C 8A 04 3A 33 D2 32 D8 8D 46 01 F7 F5
8A 44 24 30 02 C1 8A 0C 3A 33 D2 32 C8 8B C6 F7 F5 8A 04 3A 22 C8 8B
44 24 14 02 D9 8A 0C 06 32 CB 88 0C 06 8B 4C 24 38 8B 44 24 24 41 46
3B C8 89 4C 24 38 72 8F 5F 5E 5D 5B 83 C4 18 C2 10 00 }
condition:
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
}
rule IMPLANT_6_v6 {
meta:
description = "Sednit / EVILTOSS Implant by APT28"
author = "US CERT"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
date = "2017-02-10"
score = 85
id = "89cc3764-d60c-5cbd-af32-a90d8b3400d7"
strings:
$Init1_fun = {68 10 27 00 00 FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 6A FF 50
FF 15 ?? ?? ?? ?? 33 C0 C3}
condition:
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
}
rule IMPLANT_6_v7 {
meta:
description = "Sednit / EVILTOSS Implant by APT28"
author = "US CERT"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
date = "2017-02-10"
score = 85
strings:
$STR1 = "Init1"
$OPT1 = "ServiceMain"
$OPT2 = "netids" nocase wide ascii
$OPT3 = "netui" nocase wide ascii
$OPT4 = "svchost.exe" wide ascii
$OPT5 = "network" nocase wide ascii
condition:
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and $STR1 and 2 of ($OPT*)
}
rule MAL_OSX_FancyBear_Agent_Jul18_1 {
meta:
description = "Detects FancyBear Agent for OSX"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://twitter.com/DrunkBinary/status/1018448895054098432"
date = "2018-07-15"
hash1 = "d3be93f6ce59b522ff951cef9d59ef347081ffe33d4203cd5b5df0aaa9721aa2"
id = "ae717f70-7196-561a-916f-1598ab38c77a"
strings:
$x1 = "/Users/kazak/Desktop/" ascii
$s1 = "launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist" fullword ascii
$s2 = "mkdir -p /Users/Shared/.local/ &> /dev/null" fullword ascii
$s3 = "chmod 755 /Users/Shared/start.sh" fullword ascii
$s4 = "chmod 755 %s/%s &> /dev/null" fullword ascii
$s6 = "chmod 755 /Users/Shared/.local/kextd" fullword ascii
condition:
uint16(0) == 0xfacf and filesize < 3000KB and ( 1 of ($x*) and 4 of them )
}