Skip to content

Commit eec567b

Browse files
shu-tomshu-tom
committed
Added new yara rules 2023-01-31
1 parent 615afa0 commit eec567b

File tree

5 files changed

+147
-3
lines changed

5 files changed

+147
-3
lines changed

‎BlackTech/blacktech.yara

+1-1
Original file line numberDiff line numberDiff line change
@@ -355,7 +355,7 @@ rule BlackTech_BTSDoor_str {
355355
(1 of ($pdb*) or 4 of ($data*))
356356
}
357357

358-
rule BlackTech_mabackdoor_str {
358+
rule BlackTech_Hipid_str {
359359
meta:
360360
description = "Multi-architecture (ARM or x64) backdoor in BlackTech"
361361
author = "JPCERT/CC Incident Response Group"

‎Lazarus/lazarus.yara

+52-2
Original file line numberDiff line numberDiff line change
@@ -429,11 +429,12 @@ rule Lazarus_obfuscate_string {
429429
all of them
430430
}
431431

432-
rule Lazarus_Bpanda3_str {
432+
rule Lazarus_VSingle_github {
433433
meta:
434-
description = "Bpanda3 backdoor in Lazarus"
434+
description = "VSingle using GitHub in Lazarus"
435435
author = "JPCERT/CC Incident Response Group"
436436
hash = "199ba618efc6af9280c5abd86c09cdf2d475c09c8c7ffc393a35c3d70277aed1"
437+
hash = "2eb16dbc1097a590f07787ab285a013f5fe235287cb4fb948d4f9cce9efa5dbc"
437438

438439
strings:
439440
$str1 = "Arcan3" ascii wide fullword
@@ -464,3 +465,52 @@ rule Lazarus_Bpanda3_str {
464465
uint32(uint32(0x3c)) == 0x00004550 and
465466
8 of ($str*))
466467
}
468+
469+
rule Lazarus_BTREE_str {
470+
meta:
471+
description = "BTREE malware using Lazarus"
472+
author = "JPCERT/CC Incident Response Group"
473+
hash = "4fb31b9f5432fd09f1fa51a35e8de98fca6081d542827b855db4563be2e50e58"
474+
475+
strings:
476+
$command1 = "curl -A cur1-agent -L %s -s -d da" ascii wide
477+
$command2 = "cmd /c timeout /t 10 & rundll32 \"%s\" #1" ascii wide
478+
$command3 = "rundll32.exe %s #1 %S" ascii wide
479+
$command4 = "%s\\marcoor.dll" ascii wide
480+
$rc4key = "FaDm8CtBH7W660wlbtpyWg4jyLFbgR3IvRw6EdF8IG667d0TEimzTiZ6aBteigP3" ascii wide
481+
482+
condition:
483+
2 of ($command*) or $rc4key
484+
}
485+
486+
//import "pe"
487+
//import "hash"
488+
489+
//rule Lazarus_PDFIcon {
490+
// meta:
491+
// description = "PDF icon used in PE file by Lazarus"
492+
// author = "JPCERT/CC Incident Response Group"
493+
// hash = "e5466b99c1af9fe3fefdd4da1e798786a821c6d853a320d16cc10c06bc6f3fc5"
494+
495+
// condition:
496+
// for any i in (0..pe.number_of_resources - 1) : (
497+
// hash.sha256(pe.resources[i].offset, pe.resources[i].length) == "b3e0e069d00fb2a746b7ed1eb3d6470772a684349800fc84bae9f40c8a43d87a"
498+
// )
499+
//}
500+
501+
rule Lazarus_msi_str {
502+
meta:
503+
description = "msi file using Lazarus"
504+
author = "JPCERT/CC Incident Response Group"
505+
hash = "f0b6d6981e06c7be2e45650e5f6d39570c1ee640ccb157ddfe42ee23ad4d1cdb"
506+
507+
strings:
508+
$magic = /^\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00/
509+
$s1 = "New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 1) -RepetitionDuration (New-TimeSpan -Days 300)" ascii wide
510+
$s2 = "New-ScheduledTaskAction -Execute \"c:\\windows\\system32\\pcalua.exe" ascii wide
511+
$s3 = "function sendbi(pd)" ascii wide
512+
$s4 = "\\n\\n\"+g_mac()+\"\\n\\n\"+g_proc()" ascii wide
513+
514+
condition:
515+
$magic at 0 and 2 of ($s*)
516+
}

‎other/RestyLink.yara

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
rule malware_droplink_str {
2+
meta:
3+
description = "malware using dropbox api(TRANSBOX, PLUGBOX)"
4+
author = "JPCERT/CC Incident Response Group"
5+
hash = "bdc15b09b78093a1a5503a1a7bfb487f7ef4ca2cb8b4d1d1bdf9a54cdc87fae4"
6+
hash = "6e5e2ed25155428b8da15ac78c8d87d2c108737402ecba90d70f305056aeabaa"
7+
8+
strings:
9+
$data1 = "%u/%u_%08X_%u_%u.jpg" ascii wide
10+
$data2 = "%u/%u.jpg" ascii wide
11+
$data3 = "%u/%s" ascii wide
12+
$data4 = "%u/%u.3_bk.jpg"
13+
$data5 = "%u/%u.2_bk.jpg" ascii wide
14+
$data6 = "%u/%u_%08X_%d.jpg" ascii wide
15+
$data7 = "%s\",\"mode\":\"overwrite" ascii wide
16+
$data8 = "Dropbox-API-Art-Type:" ascii wide
17+
$data9 = "/2/files/upload" ascii wide
18+
$data10 = "Dropbox-API-Arg: {\"path\":\"/" ascii wide
19+
$data11 = "/oauth2/token" ascii wide
20+
$data12 = "LoadPlgFromRemote.dll" ascii wide
21+
$data13 = "FILETRANDLL.dll" ascii wide
22+
$data14 = "NVIDLA" ascii wide
23+
$data15 = "start.ini" ascii wide
24+
$data16 = "RunMain" ascii wide
25+
$data17 = "cfg.png" ascii wide
26+
$data18 = "DWrite.dll" ascii wide
27+
$pdb1 = "\\\\daddev\\office10\\2609.0\\setup\\x86\\ship\\program files\\common files\\microsoft shared\\office10\\1033\\DWINTLO.PDB" ascii
28+
29+
condition:
30+
uint16(0) == 0x5A4D and
31+
uint32(uint32(0x3c)) == 0x00004550 and
32+
filesize<1MB and
33+
(1 of ($pdb*) or 5 of ($data*))
34+
}
35+
36+
rule malware_RestyLink_lnk {
37+
meta:
38+
description = "RestyLink lnk file"
39+
author = "JPCERT/CC Incident Response Group"
40+
hash = "90a223625738e398d2cf0be8d37144392cc2e7d707b096a7bfc0a52b408d98b1"
41+
hash = "9aa2187dbdeef231651769ec8dc5f792c2a9a7233fbbbcf383b05ff3d6179fcf"
42+
hash = "3feb9275050827543292a97cbf18c50c552a1771c4423c4df4f711a39696ed93"
43+
44+
strings:
45+
$cmd1 = "C:\\Windows\\System32\\cmd.exe" wide
46+
$cmd2 = "Windows\\system32\\ScriptRunner.exe" wide
47+
$command1 = "/c set a=start winword.exe /aut&&set" wide
48+
$command2 = "&&set n=omation /vu /q&&cmd /c %a%%n% %m%" wide
49+
$command3 = "-appvscript explorer.exe https://" wide
50+
$command4 = "-appvscript curl.exe -s https://" wide
51+
52+
condition:
53+
uint16(0) == 0x004c and
54+
filesize<100KB and
55+
1 of ($cmd*) and
56+
1 of ($command*)
57+
}

‎other/brc4.yara

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
rule malware_BRC4_code {
2+
meta:
3+
description = "Brute Ratel C4"
4+
author = "JPCERT/CC Incident Response Group"
5+
hash = "54e844b5ae4a056ca8df4ca7299249c4910374d64261c83ac55e5fdf1b59f01d"
6+
hash = "31acf37d180ab9afbcf6a4ec5d29c3e19c947641a2d9ce3ce56d71c1f576c069"
7+
hash = "973f573cab683636d9a70b8891263f59e2f02201ffb4dd2e9d7ecbb1521da03e"
8+
9+
strings:
10+
$func1 = { 41 57 41 56 41 55 41 54 55 57 56 53 48 81 EC A8 00 00 00 E8 }
11+
$func2 = { 50 68 ?? ?? 00 00 B8 00 00 00 00 50 B8 00 00 00 00 50 B8 00 00 00 00 }
12+
$func3 = { 50 B8 00 00 00 00 50 B8 00 00 00 00 50 B8 00 00 00 00 50 B8 00 00 00 00 50 B8 (02|01) 00 00 00 }
13+
14+
condition:
15+
uint16(0) == 0x5A4D and
16+
uint32(uint32(0x3c)) == 0x00004550 and
17+
filesize<500KB and
18+
($func1 or #func2 > 2 or #func3 > 2)
19+
}

‎other/darkcloud.yara

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule malware_DarkCloud_Stealer_str {
2+
meta:
3+
description = "DarkCloud Stealer"
4+
author = "JPCERT/CC Incident Response Group"
5+
hash = "a8f6bcae61ed785c8ee0703fb9d3d72b717302c4bc5d651fd2a7aa83b1b696ea"
6+
7+
strings:
8+
$vb1 = "__vba" ascii wide
9+
$vb2 = "VB6.OLB" ascii wide
10+
$name1 = "DarkCloud Gecko Recovery" ascii wide
11+
$name2 = "DarkCloud CryptoWallets" ascii wide
12+
$name3 = "DarkCloud FilesGrabber" ascii wide
13+
$name4 = "DarkCloud Credentials" ascii wide
14+
$name5 = "===============DARKCLOUD===============" ascii wide
15+
16+
condition:
17+
uint16(0) == 0x5a4d and any of ($vb*) and 3 of ($name*)
18+
}

0 commit comments

Comments
 (0)