YARA rules for PoisonIvy
10 rules · scoped to tool · back to PoisonIvy
YARA rules whose family, name, or description matches this tool or its tooling. Use these for binary-pattern hunts.
rule PoisonIvy_Sample_APT {
meta:
description = "Detects a PoisonIvy APT malware group"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
score = 70
reference = "VT Analysis"
date = "2015-06-03"
hash = "b874b76ff7b281c8baa80e4a71fc9be514093c70"
id = "8d3b8222-8949-57dc-99b7-092189416efd"
strings:
$s0 = "pidll.dll" fullword ascii /* score: '11.02' */
$s1 = "sens32.dll" fullword wide /* score: '11.015' */
$s3 = "FileDescription" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19311 times */
$s4 = "OriginalFilename" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19040 times */
$s5 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
$s9 = "Microsoft Media Device Service Provider" fullword wide /* score: '-3' */ /* Goodware String - occured 8 times */
condition:
uint16(0) == 0x5a4d and filesize < 47KB and all of them
}
rule PoisonIvy_Sample_APT_2 {
meta:
description = "Detects a PoisonIvy Malware"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
score = 70
reference = "VT Analysis"
date = "2015-06-03"
hash = "333f956bf3d5fc9b32183e8939d135bc0fcc5770"
id = "4d64ccd2-add8-5749-8178-f2c5336e1495"
strings:
$s0 = "pidll.dll" fullword ascii /* score: '11.02' */
$s1 = "sens32.dll" fullword wide /* score: '11.015' */
$s2 = "9.0.1.56" fullword wide /* score: '9.5' */
$s3 = "FileDescription" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19311 times */
$s4 = "OriginalFilename" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19040 times */
$s5 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
$s6 = "\"%=%14=" fullword ascii /* score: '4.5' */
$s7 = "091A1G1R1_1g1u1z1" fullword ascii /* score: '4' */ /* Goodware String - occured 1 times */
$s8 = "gHsMZz" fullword ascii /* score: '3.005' */
$s9 = "Microsoft Media Device Service Provider" fullword wide /* score: '-3' */ /* Goodware String - occured 8 times */
$s10 = "Copyright (C) Microsoft Corp." fullword wide /* score: '-7' */ /* Goodware String - occured 12 times */
$s11 = "MFC42.DLL" fullword ascii /* score: '-31' */ /* Goodware String - occured 36 times */
$s12 = "MSVCRT.dll" fullword ascii /* score: '-235' */ /* Goodware String - occured 240 times */
$s13 = "SpecialBuild" fullword wide /* score: '-1561' */ /* Goodware String - occured 1566 times */
$s14 = "PrivateBuild" fullword wide /* score: '-1585' */ /* Goodware String - occured 1590 times */
$s15 = "Comments" fullword wide /* score: '-2149' */ /* Goodware String - occured 2154 times */
$s16 = "040904b0" fullword wide /* score: '-2365' */ /* Goodware String - occured 2370 times */
$s17 = "LegalTrademarks" fullword wide /* score: '-3518' */ /* Goodware String - occured 3523 times */
$s18 = "CreateThread" fullword ascii /* score: '-3909' */ /* Goodware String - occured 3914 times */
$s19 = "ntdll.dll" fullword ascii /* score: '-4675' */ /* Goodware String - occured 4680 times */
$s20 = "_adjust_fdiv" ascii /* score: '-5450' */ /* Goodware String - occured 5455 times */
condition:
uint16(0) == 0x5a4d and filesize < 47KB and all of them
}
rule PoisonIvy_Sample_APT_3 {
meta:
description = "Detects a PoisonIvy Malware"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
score = 70
reference = "VT Analysis"
date = "2015-06-03"
hash = "df3e1668ac20edecc12f2c1a873667ea1a6c3d6a"
id = "e2e0bf75-7704-585f-b2b3-727d14946c76"
strings:
$s0 = "\\notepad.exe" ascii /* score: '11.025' */
$s1 = "\\RasAuto.dll" ascii /* score: '11.025' */
$s3 = "winlogon.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 13 times */
condition:
uint16(0) == 0x5a4d and all of them
}
rule PoisonIvy_Sample_APT_4 {
meta:
description = "Detects a PoisonIvy Sample APT"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
score = 70
reference = "VT Analysis"
date = "2015-06-03"
hash = "558f0f0b728b6da537e2666fbf32f3c9c7bd4c0c"
id = "02bf546b-99a2-5ffb-8ee7-7bb005ef953b"
strings:
$s0 = "Microsoft Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '15.04' */
$s1 = "idll.dll" fullword ascii /* score: '11.02' */
$s2 = "mgmts.dll" fullword wide /* score: '11.0' */
$s3 = "Microsoft(R) Windows(R)" fullword wide /* score: '6.025' */
$s4 = "ServiceMain" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 322 times */
$s5 = "Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 3 times */
$s6 = "SetServiceStatus" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 741 times */
$s7 = "OriginalFilename" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19040 times */
$s8 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
condition:
uint16(0) == 0x5a4d and filesize < 100KB and 7 of them
}
rule PoisonIvy_Sample_5 {
meta:
description = "Detects PoisonIvy RAT sample set"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
score = 70
reference = "VT Analysis"
date = "2015-06-03"
hash = "545e261b3b00d116a1d69201ece8ca78d9704eb2"
id = "61f7efd4-745a-5f06-a66d-b4b2a2ecc614"
strings:
$s0 = "Microsoft Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '15.04' */
$s2 = "pidll.dll" fullword ascii /* score: '11.02' */
$s3 = "\\mspmsnsv.dll" ascii /* score: '11.005' */
$s4 = "\\sfc.exe" ascii /* score: '11.005' */
$s13 = "ServiceMain" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 322 times */
$s15 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
$s17 = "LookupPrivilegeValueA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 336 times */
condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
rule PoisonIvy_Sample_6 {
meta:
description = "Detects PoisonIvy RAT sample set"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
score = 70
reference = "VT Analysis"
date = "2015-06-03"
hash1 = "8c2630ab9b56c00fd748a631098fa4339f46d42b"
hash2 = "36b4cbc834b2f93a8856ff0e03b7a6897fb59bd3"
id = "f364fad0-3684-5500-b21b-396f1e259217"
strings:
$x1 = "124.133.252.150" fullword ascii /* score: '9.5' */
$x3 = "http://124.133.254.171/up/up.asp?id=%08x&pcname=%s" fullword ascii /* score: '24.01' */
$z1 = "\\temp\\si.txt" ascii /* PEStudio Blacklist: strings */ /* score: '27.01' */
$z2 = "Daemon Dynamic Link Library" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.02' */
$z3 = "Microsoft Windows CTF Loader" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.03' */
$z4 = "\\tappmgmts.dll" ascii /* score: '11.005' */
$z5 = "\\appmgmts.dll" ascii /* score: '11.0' */
$s0 = "%USERPROFILE%\\AppData\\Local\\Temp\\Low\\ctfmon.log" fullword ascii /* PEStudio Blacklist: strings */ /* score: '43.015' */
$s1 = "%USERPROFILE%\\AppData\\Local\\Temp\\ctfmon.tmp" fullword ascii /* PEStudio Blacklist: strings */ /* score: '37.015' */
$s2 = "\\temp\\ctfmon.tmp" ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
$s3 = "SOFTWARE\\Classes\\http\\shell\\open\\commandV" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.025' */
$s4 = "CONNECT %s:%i HTTP/1.0" fullword ascii /* PEStudio Blacklist: strings */ /* score: '19.02' */
$s5 = "start read histry key" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.04' */
$s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii /* score: '18.03' */
$s7 = "[password]%s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.025' */
$s8 = "Daemon.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.02' */
$s9 = "[username]%s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '12.035' */
$s10 = "advpack" fullword ascii /* score: '7.005' */
$s11 = "%s%2.2X" fullword ascii /* score: '7.0' */
$s12 = "advAPI32" fullword ascii /* score: '6.015' */
condition:
( uint16(0) == 0x5a4d and 1 of ($x*) ) or
( 8 of ($s*) ) or
( 1 of ($z*) and 3 of ($s*) )
}
rule PoisonIvy_Sample_7 {
meta:
description = "Detects PoisonIvy RAT sample set"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
score = 70
reference = "VT Analysis"
date = "2015-06-03"
hash = "9480cf544beeeb63ffd07442233eb5c5f0cf03b3"
id = "01224053-d95e-5144-981b-76cd7e57e1c3"
strings:
$s0 = "Microsoft Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '15.04' */
$s2 = "pidll.dll" fullword ascii /* score: '11.02' */
$s10 = "ServiceMain" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 322 times */
$s11 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
$s12 = "Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 3 times */
$s13 = "Microsoft(R) Windows(R) Operating System" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 128 times */
condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them
}
rule PoisonIvy_RAT_ssMUIDLL {
meta:
description = "Detects PoisonIvy RAT DLL mentioned in Palo Alto Blog in April 2016"
author = "Florian Roth (Nextron Systems) (with the help of yarGen and Binarly)"
reference = "http://goo.gl/WiwtYT"
date = "2016-04-22"
hash1 = "7a424ad3f3106b87e8e82c7125834d7d8af8730a2a97485a639928f66d5f6bf4"
hash2 = "6eb7657603edb2b75ed01c004d88087abe24df9527b272605b8517a423557fe6"
hash3 = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
hash4 = "8b805f508879ecdc9bba711cfbdd570740c4825b969c1b4db980c134ac8fef1c"
hash5 = "ac99d4197e41802ff9f8852577955950332947534d8e2a0e3b6c1dd1715490d4"
id = "f2535b70-cf17-5435-9fc8-2dfdf70d95ac"
strings:
$s1 = "ssMUIDLL.dll" fullword ascii
// 0x10001f81 6a 00 push 0
// 0x10001f83 c6 07 e9 mov byte ptr [edi], 0xe9
// 0x10001f86 ff d6 call esi
$op1 = { 6a 00 c6 07 e9 ff d6 } // sample=e9ccf4e139bbbd114b67cc3cee260d1cb638c9d0 address=0x10001f81
// 0x100012a9 02 cb add cl, bl
// 0x100012ab 6a 00 push 0
// 0x100012ad 88 0f mov byte ptr [edi], cl
// 0x100012af ff d6 call esi
// 0x100012b1 47 inc edi
// 0x100012b2 ff 4d fc dec dword ptr [ebp - 4]
// 0x100012b5 75 ?? jne 0x10001290
$op2 = { 02 cb 6a 00 88 0f ff d6 47 ff 4d fc 75 } // sample=e9ccf4e139bbbd114b67cc3cee260d1cb638c9d0 address=0x100012a9
// 0x10001f93 6a 00 push 0
// 0x10001f95 88 7f 02 mov byte ptr [edi + 2], bh
// 0x10001f98 ff d6 call esi
$op3 = { 6a 00 88 7f 02 ff d6 } // sample=e9ccf4e139bbbd114b67cc3cee260d1cb638c9d0 address=0x10001f93
condition:
( uint16(0) == 0x5a4d and filesize < 20KB and ( all of ($op*) ) ) or ( all of them )
}
rule PoisonIvy_Generic_3 {
meta:
description = "PoisonIvy RAT Generic Rule"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
date = "2015-05-14"
hash = "e1cbdf740785f97c93a0a7a01ef2614be792afcd"
id = "0f6a47ee-b741-59cc-b2d6-6bf3989ce8e7"
strings:
$k1 = "Tiger324{" fullword ascii
$s2 = "WININET.dll" fullword ascii
$s3 = "mscoree.dll" fullword wide
$s4 = "WS2_32.dll" fullword
$s5 = "Explorer.exe" fullword wide
$s6 = "USER32.DLL"
$s7 = "CONOUT$"
$s8 = "login.asp"
$h1 = "HTTP/1.0"
$h2 = "POST"
$h3 = "login.asp"
$h4 = "check.asp"
$h5 = "result.asp"
$h6 = "upload.asp"
condition:
uint16(0) == 0x5a4d and filesize < 500KB and
(
$k1 or all of ($s*) or all of ($h*)
)
}
rule RAT_PoisonIvy
{
meta:
author = "Kevin Breen <kevin@techanarchy.net>"
date = "01.04.2014"
description = "Detects PoisonIvy RAT"
reference = "http://malwareconfig.com/stats/PoisonIvy"
maltype = "Remote Access Trojan"
filetype = "exe"
id = "371686d3-878f-56fc-a702-ec49845f486b"
strings:
$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
$string1 = "CONNECT %s:%i HTTP/1.0"
$string2 = "ws2_32"
$string3 = "cks=u"
$string4 = "thj@h"
$string5 = "advpack"
condition:
$stub at 0x1620 and all of ($string*) or (all of them)
}