Skip to content

Commit 28762bd

Browse files
shu-tomshu-tom
committed
Added new yara rules 2023-12-15
1 parent 19d4687 commit 28762bd

11 files changed

+218
-44
lines changed

‎Lazarus/lazarus.yara

+21-1
Original file line numberDiff line numberDiff line change
@@ -555,4 +555,24 @@ rule Lazarus_magicpoint_code {
555555
uint16(0) == 0x5A4D and
556556
uint32(uint32(0x3c)) == 0x00004550 and
557557
4 of ($str*)
558-
}
558+
}
559+
560+
rule lazarus_dbgsymbols_str{
561+
meta:
562+
description = "Exploit tools in Lazarus"
563+
author = "JPCERT/CC Incident Response Group"
564+
hash = "50869d2a713acf406e160d6cde3b442fafe7cfe1221f936f3f28c4b9650a66e9"
565+
566+
strings:
567+
$str1 = "getsymbol" nocase
568+
$str2 = "dbgsymbol.com" wide
569+
$str3 = "c:\\symbols" wide
570+
$str4 = "symchk.exe /r /if %s /s SRV*%s*%s" wide
571+
$str5 = "Symbol Download Finished!" wide
572+
$filename = "symbolcheck.dll" wide
573+
574+
condition:
575+
uint16(0) == 0x5A4D and
576+
uint32(uint32(0x3c)) == 0x00004550 and
577+
3 of ($str*) and all of ($filename)
578+
}

‎Tick/tick.yara

+34
Original file line numberDiff line numberDiff line change
@@ -287,3 +287,37 @@ rule tick_ABK_downloader_susp_ua {
287287
// (filesize<50MB) and
288288
// (cuckoo.sync.mutex(/PPGword/) or cuckoo.sync.mutex(/CQFB/))
289289
//}
290+
291+
rule malware_gokcpdoor_golang {
292+
meta:
293+
description = "gokcpdoor"
294+
author = "JPCERT/CC Incident Response Group"
295+
hash = "2dd8ab1493a97e0a4416e077d6ce1c35c7b2d8749592b319a7e2a8f4cd1cc008"
296+
297+
strings:
298+
$gofunc1 = "CopyConn2StdinPipe" ascii wide
299+
$gofunc2 = "CopyStdoutPipe2Conn" ascii wide
300+
$gofunc3 = "handleConnection" ascii wide
301+
$gofunc4 = "addudpforward" ascii wide
302+
$gofunc5 = "addtcpforward" ascii wide
303+
$gofunc6 = "addsocks5" ascii wide
304+
$gofunc7 = "handleConnWait" ascii wide
305+
$gofunc8 = "readconfig" ascii wide
306+
$log1 = "[+] socks5 add ok" ascii wide
307+
$log2 = "[+] portforward add ok" ascii wide
308+
$log3 = "[-] First param must be one of [add,del,list]" ascii wide
309+
$log4 = "[-] socks5 del param num must exceed 3!" ascii wide
310+
$log5 = "[*] portforward list:" ascii wide
311+
$log6 = "[*] please input a supported command, you can see help first!" ascii wide
312+
$str1 = "!!!ok!!!"
313+
$str2 = {23 23 23 64 6F 77 6E 6C} // ###downloadend$$$
314+
$str3 = {23 23 23 75 70 6C 6F 61} // ###uploadend$$$
315+
$gofile1 = "kcp.go" ascii wide
316+
$gofile2 = "udp.go" ascii wide
317+
$gofile3 = "target.go" ascii wide
318+
$gofile4 = "exec_lin.go" ascii wide
319+
$gofile5 = "gokcpdoor[0-9]" ascii wide
320+
321+
condition:
322+
6 of ($gofunc*) or 5 of ($log*) or all of ($str*) or all of ($gofile*)
323+
}

‎other/IcedID.yara

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
rule malware_IcedID_loader {
2+
meta:
3+
description = "IcedID Loader"
4+
author = "JPCERT/CC Incident Response Group"
5+
hash = "6ae543b0a3380779b65bff8c3ca0267f741173aed0d35265d6c92c0298fb924c"
6+
7+
strings:
8+
$a1 = "update_data.dat" wide
9+
$a2 = "files/bp.dat" ascii
10+
$a3 = "Update_%x" wide
11+
$a4 = "Custom_update" wide
12+
$b1 = {35 87 63 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 35 9A 76 00 00}
13+
$b2 = {C7 ?? ?? C5 9D 1C 81} // FNV1a
14+
$b3 = {69 ?? ?? 93 01 00 01} // FNV1a
15+
16+
condition:
17+
uint16(0) == 0x5A4D and
18+
uint32(uint32(0x3c)) == 0x00004550 and
19+
(all of ($a*) or all of ($b*))
20+
}

‎other/MedusaLocker.yara

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
rule malware_MedusaLocker3_str {
2+
meta:
3+
description = "MedusaLocker3 ransomware"
4+
author = "JPCERT/CC Incident Response Group"
5+
hash = "d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae"
6+
7+
strings:
8+
$s1 = "D:\\Education\\locker\\bin\\stub_win_x64_encrypter.pdb" ascii
9+
$s2 = "SOFTWARE\\PAIDMEMES" wide
10+
$s3 = "sMasterPublicKey" ascii
11+
$s4 = "[+] Keys retrieved from registry" wide
12+
13+
condition:
14+
uint16(0) == 0x5A4D and
15+
uint32(uint32(0x3c)) == 0x00004550 and
16+
3 of them
17+
}

‎other/SteelClover.yara

-36
This file was deleted.

‎other/TokyoX.yara

+1-2
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,10 @@ rule malware_TokyoX_RAT {
1919

2020
strings:
2121
$mz = { 74 6F 6B 79 6F 00 00 00 } // tokyo
22-
$pe = "PE"
2322
$format1 = "%08lX%04lX%04lX%02lx%02lx%02lx%02lx%02lx%02lx%02lx%02lx"
2423
$format2 = "%d-%d-%d %d:%d:%d" wide
2524
$uniq_path = "C:\\Windows\\SysteSOFTWARE\\Microsoft\\Windows NT\\Cu"
2625
2726
condition:
28-
($mz at 0 and $pe in (0x0..0x200)) or all of ($format*) or $uniq_path
27+
($mz at 0 and all of ($format*)) or $uniq_path
2928
}

‎other/machOdownloader.yara

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
2+
3+
rule malware_unknown_machOdownloader {
4+
meta:
5+
description = "Mach-O malware"
6+
author = "JPCERT/CC Incident Response Group"
7+
hash = "3266e99f14079b55e428193d5b23aa60862fe784ac8b767c5a1d49dfe80afeeb "
8+
9+
strings:
10+
$str1 = "DiagPeersHelper" ascii
11+
$str2 = "DiagnosticsPeer" ascii
12+
$str3 = "ticsPeer/" ascii
13+
14+
/*
15+
48 B9 3F 72 65 73 70 6F 6E 73 mov rcx, 736E6F707365723Fh
16+
*/
17+
$func0 = { 48 B9 3F 72 65 73 70 6F 6E 73 }
18+
19+
/*
20+
48 B8 74 61 72 20 7A 78 76 66 mov rax, 6676787A20726174h
21+
*/
22+
$func1 = { 48 B8 74 61 72 20 7A 78 76 66 }
23+
24+
/*
25+
E8 60 04 00 00 call _strlen
26+
C7 84 05 20 E7 FF FF 27 20 2D 43 mov dword ptr [rbp+rax+shellcmd], 432D2027h
27+
C7 84 05 23 E7 FF FF 43 20 27 00 mov dword ptr [rbp+rax+shellcmd+3], 272043h
28+
48 89 DF mov rdi, rbx ; __s1
29+
4C 89 E6 mov rsi, r12 ; __s2
30+
E8 33 04 00 00 call _strcat
31+
48 89 DF mov rdi, rbx ; __s
32+
E8 37 04 00 00 call _strlen
33+
*/
34+
$func2 = { E8 [4] C7 84 05 [4] 27 20 2D 43 C7 84 05 [4] 43 20 27 00 48 89 DF 4C 89 E6 E8 33 04 00 00 }
35+
36+
condition:
37+
(uint32(0) == 0xfeedface or /* 32 bit */
38+
uint32(0) == 0xcefaedfe or /* NXSwapInt(MH_MAGIC */
39+
uint32(0) == 0xfeedfacf or /* 64 bit */
40+
uint32(0) == 0xcffaedfe or /* NXSwapInt(MH_MAGIC_64) */
41+
uint32(0) == 0xcafebabe or /* FAT, Java */
42+
uint32(0) == 0xbebafeca or /* NXSwapInt(FAT_MAGIC) */
43+
uint32(0) == 0xcafebabf or /* FAT 64 bit */
44+
uint32(0) == 0xbfbafeca ) /* NXSwapLong(FAT_MAGIC_64) */
45+
and (filesize < 10MB)
46+
and ( ( 2 of ($str*) ) or ( 2 of ($func*) ))
47+
}

‎other/phpmal.yara

+23
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,26 @@ rule malware_lvscam_phpwebshell {
1313
condition:
1414
2 of them
1515
}
16+
17+
rule malware_seospam_php {
18+
meta:
19+
description = "PHP using Japanese SEO Spam"
20+
author = "JPCERT/CC Incident Response Group"
21+
hash = "619cf6a757a1967382287c30d95b55bed3750e029a7040878d2f23efda29f8f0"
22+
23+
strings:
24+
$func1 = "function dageget($" ascii
25+
$func2 = "function sbot()" ascii
26+
$func3 = "function st_uri()" ascii
27+
$func4 = "function is_htps()" ascii
28+
$query1 = /sha1\(sha1\(@\$_GET\[\"(a|\\x61|\\141)"\]\)\);/ ascii
29+
$query2 = /sha1\(sha1\(@\$_GET\[\"(b|\\x62|\\142)"\]\)\);/ ascii
30+
$query3 = /@\$_GET\[\"(p|\\x70|\\160)(d|\\x64|\\144)\"\]/ ascii
31+
$content1 = "nobotuseragent" ascii
32+
$content2 = "okhtmlgetcontent" ascii
33+
$content3 = "okxmlgetcontent" ascii
34+
$content4 = "pingxmlgetcontent" ascii
35+
36+
condition:
37+
7 of them
38+
}

‎other/seaspy.yara

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
rule malware_SeaSpy_str {
2+
meta:
3+
description = "malware SeaSpy"
4+
author = "JPCERT/CC Incident Response Group"
5+
hash = "3f26a13f023ad0dcd7f2aa4e7771bba74910ee227b4b36ff72edc5f07336f115"
6+
hash = "5e3c128749f7ae4616a4620e0b53c0e5381724a790bba8314acb502ce7334df2"
7+
8+
strings:
9+
$msg1 = "<Network-Interface> <Listen-Port>" ascii fullword
10+
$msg2 = "<Network-Interface>. e.g." ascii fullword
11+
$msg3 = "Port value out of range." ascii fullword
12+
$msg4 = "enter open tty shell..." ascii fullword
13+
$msg5 = "NO port code" ascii fullword
14+
$msg6 = "pcap_lookupnet: %s" ascii fullword
15+
$msg7 = "pcap_compile" ascii fullword
16+
$msg8 = "pcap_setfilter" ascii fullword
17+
$msg9 = "Child process id:%d" ascii fullword
18+
$func1 = "open_tty_shell" ascii fullword
19+
$func2 = "start_pcap_listener" ascii fullword
20+
$func3 = "pcap_open_live" ascii fullword
21+
$func4 = "pcap_setfilter" ascii fullword
22+
$func5 = "reverse_shell" ascii fullword
23+
$key1 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuJDBIgz2Gb70ExKb7fww" ascii fullword
24+
25+
condition:
26+
uint32(0) == 0x464C457F and
27+
(4 of ($msg*) or 4 of ($func*) or 1 of ($key*))
28+
}

‎other/steelclover.yara

+5-5
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,11 @@ rule SteelClover_PowerShell_str {
2525
hash = "05e6f7a4184c9688ccef4dd17ae8ce0fe788df1677c6ba754b37a895a1e430e9"
2626

2727
strings:
28-
$a1 = "function Add-Encryption" ascii wide nocase
29-
$a2 = "function Remove-Encryption" ascii wide nocase
30-
$a3 = "Remove-Encryption -FolderPath $env:APPDATA -Password" ascii wide nocase
31-
$b1 = "function Install-GnuPg" ascii wide nocase
32-
$b2 = "Install-GnuPG -DownloadFolderPath $env:APPDATA" ascii wide nocase
28+
$a1 = "function Add-Encryption" ascii
29+
$a2 = "function Remove-Encryption" ascii
30+
$a3 = "Remove-Encryption -FolderPath $env:APPDATA -Password" ascii
31+
$b1 = "function Install-GnuPg" ascii
32+
$b2 = "Install-GnuPG -DownloadFolderPath $env:APPDATA" ascii
3333
3434
condition:
3535
all of ($a*) or all of ($b*)

‎other/tool.yara

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
rule tool_frp_str {
2+
meta:
3+
description = "Detect fast reverse proxy (frp)"
4+
author = "JPCERT/CC Incident Response Group"
5+
reference = "https://github.com/fatedier/frp"
6+
7+
strings:
8+
$str1 = "json:\"dst_addr\""
9+
$str2 = "json:\"bind_addr\""
10+
$str3 = "json:\"proxy_name\""
11+
$str4 = "json:\"log_way\""
12+
$str5 = "json:\"maxdays\""
13+
$str6 = "json:\"sk\""
14+
$str7 = "json:\"authenticate_new_work_conns\""
15+
$str8 = "json:\"detailed_errors_to_client\""
16+
$str9 = "json:\"oidc_skip_expiry_check\""
17+
$str10 = "json:\"health_check_interval_s\""
18+
$str11 = "json:\"token_type,omitempty\""
19+
20+
condition:
21+
6 of ($str*)
22+
}

0 commit comments

Comments
 (0)