rule Industroyer_Malware_1 {
meta:
description = "Detects Industroyer related malware"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://goo.gl/x81cSy"
date = "2017-06-13"
hash1 = "ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910"
hash2 = "018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81"
id = "f5ab571c-03a7-538a-ada1-0930d15af5cf"
strings:
$s1 = "haslo.exe" fullword ascii
$s2 = "SYSTEM\\CurrentControlSet\\Services\\%ls" fullword wide
$s3 = "SYS_BASCON.COM" fullword wide
$s4 = "*.pcmt" fullword wide
$s5 = "*.pcmi" fullword wide
$x1 = { 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73
00 5C 00 25 00 6C 00 73 00 00 00 49 00 6D 00 61
00 67 00 65 00 50 00 61 00 74 00 68 00 00 00 43
00 3A 00 5C 00 00 00 44 00 3A 00 5C 00 00 00 45
00 3A 00 5C 00 00 00 }
$x2 = "haslo.dat\x00Crash"
condition:
( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) or 2 of them )
}
rule Industroyer_Malware_2 {
meta:
description = "Detects Industroyer related malware"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://goo.gl/x81cSy"
date = "2017-06-13"
hash1 = "3e3ab9674142dec46ce389e9e759b6484e847f5c1e1fc682fc638fc837c13571"
hash2 = "37d54e3d5e8b838f366b9c202f75fa264611a12444e62ae759c31a0d041aa6e4"
hash3 = "ecaf150e087ddff0ec6463c92f7f6cca23cc4fd30fe34c10b3cb7c2a6d135c77"
hash1 = "6d707e647427f1ff4a7a9420188a8831f433ad8c5325dc8b8cc6fc5e7f1f6f47"
id = "0561a7bb-3b6c-5caf-9131-04924cee1e0f"
strings:
$x1 = "sc create %ls type= own start= auto error= ignore binpath= \"%ls\" displayname= \"%ls\"" fullword wide
$x2 = "10.15.1.69:3128" fullword wide
$s1 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)" fullword wide
$s2 = "/c sc stop %s" fullword wide
$s3 = "sc start %ls" fullword wide
$s4 = "93.115.27.57" fullword wide
$s5 = "5.39.218.152" fullword wide
$s6 = "tierexe" fullword wide
$s7 = "comsys" fullword wide
$s8 = "195.16.88.6" fullword wide
$s9 = "TieringService" fullword wide
$a1 = "TEMP\x00\x00DEF" fullword wide
$a2 = "TEMP\x00\x00DEF-C" fullword wide
$a3 = "TEMP\x00\x00DEF-WS" fullword wide
$a4 = "TEMP\x00\x00DEF-EP" fullword wide
$a5 = "TEMP\x00\x00DC-2-TEMP" fullword wide
$a6 = "TEMP\x00\x00DC-2" fullword wide
$a7 = "TEMP\x00\x00CES-McA-TEMP" fullword wide
$a8 = "TEMP\x00\x00SRV_WSUS" fullword wide
$a9 = "TEMP\x00\x00SRV_DC-2" fullword wide
$a10 = "TEMP\x00\x00SCE-WSUS01" fullword wide
condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) or 3 of them or 1 of ($a*) ) or ( 5 of them )
}
rule Industroyer_Portscan_3 {
meta:
description = "Detects Industroyer related custom port scaner"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://goo.gl/x81cSy"
date = "2017-06-13"
hash1 = "893e4cca7fe58191d2f6722b383b5e8009d3885b5913dcd2e3577e5a763cdb3f"
id = "f6675466-d469-562b-9fb6-7b72bce8a726"
strings:
$s1 = "!ZBfamily" fullword ascii
$s2 = ":g/outddomo;" fullword ascii
$s3 = "GHIJKLMNOTST" fullword ascii
/* Decompressed File */
$d1 = "Error params Arguments!!!" fullword wide
$d2 = "^(.+?.exe).*\\s+-ip\\s*=\\s*(.+)\\s+-ports\\s*=\\s*(.+)$" fullword wide
$d3 = "Exhample:App.exe -ip= 127.0.0.1-100," fullword wide
$d4 = "Error IP Range %ls - %ls" fullword wide
$d5 = "Can't closesocket." fullword wide
condition:
( uint16(0) == 0x5a4d and filesize < 500KB and all of ($s*) or 2 of ($d*) )
}
rule Industroyer_Portscan_3_Output {
meta:
description = "Detects Industroyer related custom port scaner output file"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://goo.gl/x81cSy"
date = "2017-06-13"
id = "4469f056-674c-5a44-84a5-12a65b8586d5"
strings:
$s1 = "WSA library load complite." fullword ascii
$s2 = "Connection refused" fullword ascii
condition:
all of them
}
rule Industroyer_Malware_4 {
meta:
description = "Detects Industroyer related malware"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://goo.gl/x81cSy"
date = "2017-06-13"
hash1 = "21c1fdd6cfd8ec3ffe3e922f944424b543643dbdab99fa731556f8805b0d5561"
id = "f197d2a5-eecb-51ed-b991-7643efb3f749"
strings:
$s1 = "haslo.dat" fullword wide
$s2 = "defragsvc" fullword ascii
/* .dat\x00\x00Crash */
$a1 = { 00 2E 00 64 00 61 00 74 00 00 00 43 72 61 73 68 00 00 00 }
condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of ($s*) or $a1 )
}
rule Industroyer_Malware_5 {
meta:
description = "Detects Industroyer related malware"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://goo.gl/x81cSy"
date = "2017-06-13"
hash1 = "7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad"
id = "52ce21a0-0c72-585c-a805-c5077a7445af"
strings:
$x1 = "D2MultiCommService.exe" fullword ascii
$x2 = "Crash104.dll" fullword ascii
$x3 = "iec104.log" fullword ascii
$x4 = "IEC-104 client: ip=%s; port=%s; ASDU=%u " fullword ascii
$s1 = "Error while getaddrinfo executing: %d" fullword ascii
$s2 = "return info-Remote command" fullword ascii
$s3 = "Error killing process ..." fullword ascii
$s4 = "stop_comm_service_name" fullword ascii
$s5 = "*1* Data exchange: Send: %d (%s)" fullword ascii
condition:
( uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or 4 of them ) ) or ( all of them )
}