Skip to content

Commit 0722a93

Browse files
shu-tomshu-tom
committed
Added new yara rules 2024-02-13
1 parent 609aeb0 commit 0722a93

File tree

5 files changed

+220
-1
lines changed

5 files changed

+220
-1
lines changed

‎Lazarus/lazarus.yara

+25
Original file line numberDiff line numberDiff line change
@@ -576,3 +576,28 @@ rule lazarus_dbgsymbols_str{
576576
uint32(uint32(0x3c)) == 0x00004550 and
577577
3 of ($str*) and all of ($filename)
578578
}
579+
580+
rule Lazarus_npmLoader_dll {
581+
meta:
582+
description = "npmLoaderDll using Lazarus"
583+
author = "JPCERT/CC Incident Response Group"
584+
hash = "b4c8c149005a43ae043038d4d62631dc1a0f57514c7cbf4f7726add7ec67981a"
585+
hash = "eb8756ace46662a031c1d2422a91f0725ea7c4de74bfff4fce2693e7967be16e"
586+
hash = "aec915753612bb003330ce7ffc67cfa9d7e3c12310f0ecfd0b7e50abf427989a"
587+
588+
strings:
589+
$jnkcode = { 66 66 66 66 ?? ?? ?? ?? 00 00 00 00 00 }
590+
$enccode1 = { 81 E2 FF 03 00 00 41 81 E1 FF 03 00 00 81 E7 FF 03 00 00 81 E1 FF 03 00 00 }
591+
$enccode2 = { 48 33 D1 8B C1 41 C1 CA 0A C1 C0 09 81 E2 FF 03 00 00 44 33 D0 }
592+
$pdb1 = "F:\\workspace\\CBG\\Loader\\npmLoaderDll\\x64\\Release\\npmLoaderDll.pdb" ascii wide
593+
$pdb2 = "F:\\workspace\\CBG\\npmLoaderDll\\x64\\Release\\npmLoaderDll.pdb" ascii wide
594+
$pdb3 = "D:\\workspace\\CBG\\Windows\\Loader\\npmLoaderDll\\x64\\Release\\npmLoaderDll.pdb" ascii wide
595+
$pdb4 = "npmLoaderDll\\x64\\Release\\npmLoaderDll.pdb" ascii wide
596+
597+
condition:
598+
uint16(0) == 0x5A4D and
599+
uint32(uint32(0x3c)) == 0x00004550 and
600+
(
601+
(1 of ($pdb*)) or ($jnkcode and all of ($enccode*))
602+
)
603+
}

‎other/ivanti_connect_secure.yara

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
rule webshell_DSLog_str {
2+
meta:
3+
description = "Ivanti Connect Secure infected DSLog.pm backdoor"
4+
author = "JPCERT/CC Incident Response Group"
5+
hash = "88071ac4500021da896d0a92c935dcb9ca5c2dfe02caa0ee1b924d8b72ae404e"
6+
7+
strings:
8+
$str1 = "my $ua = $ENV{HTTP_USER_AGENT};" ascii
9+
$str2 = "my $req = $ENV{QUERY_STRING};" ascii
10+
$str3 = "my @param = split(/&/, $req);" ascii
11+
$str4 = "system(${res[1]});" ascii
12+
$str5 = "$res[1] =~ tr/!-~/P-~!-O/;" ascii
13+
14+
condition:
15+
all of them
16+
}

‎other/phpmal.yara

+33
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,36 @@ rule malware_seospam_php {
3636
condition:
3737
7 of them
3838
}
39+
40+
rule malware_ruoji_phpwebshell {
41+
meta:
42+
description = "ruoji webshell"
43+
author = "JPCERT/CC Incident Response Group"
44+
hash = "8a389390a9ce4aba962e752218c5e9ab879b58280049a5e02b9143e750265064"
45+
46+
strings:
47+
$s1 = "zxcszxctzxcrzxc_zxcrzxcezxc" ascii
48+
$s2 = "<?php if ($_COOKIE[" ascii
49+
$s3 = "'] !== $_GET['" ascii
50+
$s4 = "'] && @md5($_GET['" ascii
51+
$s5 = "']) === @md5($_GET['" ascii
52+
53+
condition:
54+
4 of them
55+
}
56+
57+
rule malware_spider_phpwebshell {
58+
meta:
59+
description = "Spider PHP Shell"
60+
author = "JPCERT/CC Incident Response Group"
61+
hash = "ae17d97d8f7fd5216776e2ec457a2d60567bc6cc175206d0641861f71a7e7614"
62+
63+
strings:
64+
$s1 = "<title> Spider PHP Shell" ascii
65+
$s2 = "<li><a href=\"?s=k\" id=\"t_10\" onclick=\"switchTab('t_10')\" target=\"main\"> Linux" ascii
66+
$s3 = "if($_COOKIE['admin_spiderpass'] != md5($password))" ascii
67+
$s4 = "case \"b\" : Guama_b(); break;" ascii
68+
69+
condition:
70+
2 of them
71+
}

‎other/sqroot.yara

+114-1
Original file line numberDiff line numberDiff line change
@@ -90,4 +90,117 @@ rule malware_sqroot_webphp {
9090
condition:
9191
uint32(0) == 0x68703f3c and
9292
4 of ($func*)
93-
}
93+
}
94+
95+
rule malware_sqroot_cat {
96+
meta:
97+
description = "cat plugin downloaded by sqroot"
98+
author = "JPCERT/CC Incident Response Group"
99+
100+
strings:
101+
$s1 = "Catcher start" wide
102+
$s2 = "Catcher exit" wide
103+
$s3 = "[%04d/%02d/%02d %02d:%02d:%02d] %s\n" wide
104+
$s4 = {2A 00 6C 00 6F 00 67 00 00 00 00 00 23 00 21 00}
105+
106+
condition:
107+
uint16(0) == 0x5A4D and
108+
uint32(uint32(0x3c)) == 0x00004550 and
109+
3 of them
110+
}
111+
112+
rule malware_sqroot_snapshot {
113+
meta:
114+
description = "snapshot plugin downloaded by sqroot"
115+
author = "JPCERT/CC Incident Response Group"
116+
117+
strings:
118+
$s1 = "e:\\vsprojects\\crataegus\\snaptik\\maz\\miniz.c" wide
119+
$s2 = "%s-%02d%02d_%02d%02d%02d.maz" wide
120+
$s3 = "%s%s_%02d%02d%02d(%d).png" wide
121+
$s4 = "gdi_cache" wide
122+
$s5 = "capture_flag.ini" wide
123+
$s6 = "cf_mptmb" wide
124+
$s7 = "cf_pakdir" wide
125+
$s8 = "DoGdiCapture" ascii
126+
127+
condition:
128+
uint16(0) == 0x5A4D and
129+
uint32(uint32(0x3c)) == 0x00004550 and
130+
4 of them
131+
}
132+
133+
rule malware_sqroot_keylogger {
134+
meta:
135+
description = "keylog plugin downloaded by sqroot"
136+
author = "JPCERT/CC Incident Response Group"
137+
138+
strings:
139+
$s1 = "record-%04d%02d%02d-%02d%02d%02d.ini" ascii
140+
$s2 = "g_hKeyLogMsgLoopThread exit" ascii
141+
$s3 = "OCR_INI_DEBUG.abc" ascii
142+
$s4 = {59 6F 75 27 72 65 20 61 63 74 69 76 61 74 65 64 00 00 00 00 52 33 32 41 63 74 69 76 65}
143+
144+
condition:
145+
uint16(0) == 0x5A4D and
146+
uint32(uint32(0x3c)) == 0x00004550 and
147+
2 of them
148+
}
149+
150+
rule malware_sqroot_pluginloader {
151+
meta:
152+
description = "plugin loader downloaded by sqroot"
153+
author = "JPCERT/CC Incident Response Group"
154+
155+
strings:
156+
$a1 = "Active() found" ascii
157+
$a2 = "Active:Thread created!" ascii
158+
$b1 = {6A 74 70 61 00}
159+
$b2 = {6A 74 70 63 00}
160+
$b3 = {6A 74 70 74 00}
161+
$b4 = "%s*.tmp" ascii
162+
$c1 = "SignalS1" ascii
163+
$c2 = "SignalS2" ascii
164+
$c3 = "SignalS3" ascii
165+
166+
condition:
167+
uint16(0) == 0x5A4D and
168+
uint32(uint32(0x3c)) == 0x00004550 and
169+
5 of them
170+
}
171+
172+
rule malware_sqroot_coreloader {
173+
meta:
174+
description = "loader downloaded by sqroot"
175+
author = "JPCERT/CC Incident Response Group"
176+
177+
strings:
178+
$query = "%s?hid=%s&uid=%s&cid=%x" ascii
179+
$decode_routine = {8A 8A ?? ?? ?? ?? 02 C1 32 C1 2A C1 0F B6 8E ?? ?? ?? ?? 88 86 ?? ?? ?? ?? 8D 46 ?? 99 F7 FF 8A 82 ?? ?? ?? ?? 02 C8 32 C8 2A C8 88 8E ?? ?? ?? ?? 83 C6 02 81 FE 0A 04 00 00}
180+
181+
condition:
182+
uint16(0) == 0x5A4D and
183+
uint32(uint32(0x3c)) == 0x00004550 and
184+
all of them
185+
}
186+
187+
rule malware_sqroot_corerat {
188+
meta:
189+
description = "RAT downloaded by sqroot"
190+
author = "JPCERT/CC Incident Response Group"
191+
192+
strings:
193+
$a1 = "openfile %s error!" ascii
194+
$a2 = "remote file error!" ascii
195+
$a3 = "upload well!" ascii
196+
$a4 = "%s?hid=%s&uid=%s&cid=%x" ascii
197+
$a5 = "%s|%s|%s|%s|%s|%s|%d|%s|" ascii
198+
$b1 = {68 24 11 00 00 E8}
199+
$b2 = {C7 03 37 11 00 00}
200+
201+
condition:
202+
uint16(0) == 0x5A4D and
203+
uint32(uint32(0x3c)) == 0x00004550 and
204+
(all of ($a*) or all of ($b*))
205+
}
206+

‎other/stealc.yara

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
rule malware_Stealc_str {
2+
meta:
3+
description = "Stealc infostealer"
4+
author = "JPCERT/CC Incident Response Group"
5+
hash = "c9bcdc77108fd94f32851543d38be6982f3bb611c3a1115fc90013f965ed0b66"
6+
7+
strings:
8+
$decode_code = {
9+
68 D0 07 00 00
10+
6A 00
11+
8D 85 ?? ?? ?? ??
12+
50
13+
FF 15 ?? ?? ?? ??
14+
83 C4 0C
15+
C7 85 ?? ?? ?? ?? 00 00 00 00
16+
EB ??
17+
8B 8D ?? ?? ?? ??
18+
83 C1 01
19+
89 8D ?? ?? ?? ??
20+
81 BD ?? ?? ?? ?? 00 01 00 00
21+
}
22+
$anti_code1 = {6A 04 68 00 30 00 00 68 C0 41 C8 17 6A 00 FF 15}
23+
$anti_code2 = {90 8A C0 68 C0 9E E6 05 8B 45 ?? 50 E8}
24+
$s1 = "- IP: IP?" ascii
25+
$s2 = "- Country: ISO?" ascii
26+
$s3 = "- Display Resolution:" ascii
27+
28+
condition:
29+
uint16(0) == 0x5A4D and
30+
uint32(uint32(0x3c)) == 0x00004550 and
31+
($decode_code or all of ($anti_code*) or all of ($s*))
32+
}

0 commit comments

Comments
 (0)