1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
/*
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
// Operation Potao yara rules
// For feedback or questions contact us at: github@eset.com
// https://github.com/eset/malware-ioc/
//
// These yara rules are provided to the community under the two-clause BSD
// license as follows:
//
// Copyright (c) 2015, ESET
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are met:
//
// 1. Redistributions of source code must retain the above copyright notice, this
// list of conditions and the following disclaimer.
//
// 2. Redistributions in binary form must reproduce the above copyright notice,
// this list of conditions and the following disclaimer in the documentation
// and/or other materials provided with the distribution.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
//
private rule PotaoDecoy
{
strings:
$mz = { 4d 5a }
$str1 = "eroqw11"
$str2 = "2sfsdf"
$str3 = "RtlDecompressBuffer"
$wiki_str = "spanned more than 100 years and ruined three consecutive" wide
$old_ver1 = {53 68 65 6C 6C 33 32 2E 64 6C 6C 00 64 61 66 73 72 00 00 00 64 61 66 73 72 00 00 00 64 6F 63 (00 | 78)}
$old_ver2 = {6F 70 65 6E 00 00 00 00 64 6F 63 00 64 61 66 73 72 00 00 00 53 68 65 6C 6C 33 32 2E 64 6C 6C 00}
condition:
($mz at 0) and ( (all of ($str*)) or any of ($old_ver*) or $wiki_str )
}
private rule PotaoDll
{
strings:
$mz = { 4d 5a }
$dllstr1 = "?AVCncBuffer@@"
$dllstr2 = "?AVCncRequest@@"
$dllstr3 = "Petrozavodskaya, 11, 9"
$dllstr4 = "_Scan@0"
$dllstr5 = "\x00/sync/document/"
$dllstr6 = "\\temp.temp"
$dllname1 = "node69MainModule.dll"
$dllname2 = "node69-main.dll"
$dllname3 = "node69MainModuleD.dll"
$dllname4 = "task-diskscanner.dll"
$dllname5 = "\x00Screen.dll"
$dllname6 = "Poker2.dll"
$dllname7 = "PasswordStealer.dll"
$dllname8 = "KeyLog2Runner.dll"
$dllname9 = "GetAllSystemInfo.dll"
$dllname10 = "FilePathStealer.dll"
condition:
($mz at 0) and (any of ($dllstr*) and any of ($dllname*))
}
private rule PotaoUSB
{
strings:
$mz = { 4d 5a }
$binary1 = { 33 C0 8B C8 83 E1 03 BA ?? ?? ?? 00 2B D1 8A 0A 32 88 ?? ?? ?? 00 2A C8 FE C9 88 88 ?? ?? ?? 00 40 3D ?? ?? 00 00 7C DA C3 }
$binary2 = { 55 8B EC 51 56 C7 45 FC 00 00 00 00 EB 09 8B 45 FC 83 C0 01 89 45 FC 81 7D FC ?? ?? 00 00 7D 3D 8B 4D FC 0F BE 89 ?? ?? ?? 00 8B 45 FC 33 D2 BE 04 00 00 00 F7 F6 B8 03 00 00 00 2B C2 0F BE 90 ?? ?? ?? 00 33 CA 2B 4D FC 83 E9 01 81 E1 FF 00 00 00 8B 45 FC 88 88 ?? ?? ?? 00 EB B1 5E 8B E5 5D C3}
condition:
($mz at 0) and any of ($binary*)
}
private rule PotaoSecondStage
{
strings:
$mz = { 4d 5a }
// hash of CryptBinaryToStringA and CryptStringToBinaryA
$binary1 = {51 7A BB 85 [10-180] E8 47 D2 A8}
// old hash of CryptBinaryToStringA and CryptStringToBinaryA
$binary2 = {5F 21 63 DD [10-30] EC FD 33 02}
$binary3 = {CA 77 67 57 [10-30] BA 08 20 7A}
$str1 = "?AVCrypt32Import@@"
$str2 = "%.5llx"
condition:
($mz at 0) and any of ($binary*) and any of ($str*)
}
rule Potao
{
meta:
Author = "Anton Cherepanov"
Date = "2015/07/29"
Description = "Operation Potao"
Reference = "http://www.welivesecurity.com/wp-content/uploads/2015/07/Operation-Potao-Express_final_v2.pdf"
Source = "https://github.com/eset/malware-ioc/"
Contact = "threatintel@eset.com"
License = "BSD 2-Clause"
condition:
PotaoDecoy or PotaoDll or PotaoUSB or PotaoSecondStage
}