1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
import "pe"
rule SierraAlfa
{
meta:
copyright = "2015 Novetta Solutions"
author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
Source = "4d4b17ddbcf4ce397f76cf0a2e230c9d513b23065f746a5ee2de74f447be39b9.ex_"
strings:
/*
8D 54 24 08 lea edx, [esp+128h+argp]
52 push edx ; argp
68 7E 66 04 80 push 8004667Eh ; cmd
56 push esi ; s
E8 DB 51 00 00 call ioctlsocket
8D 44 24 14 lea eax, [esp+128h+name]
6A 10 push 10h ; namelen
50 push eax ; name
56 push esi ; s
E8 C8 51 00 00 call connect
8B 8C 24 34 01 00 00 mov ecx, [esp+128h+dwTimeout]
8D 54 24 0C lea edx, [esp+128h+timeout]
52 push edx ; timeout
8D 44 24 28 lea eax, [esp+12Ch+writefds]
6A 00 push 0 ; exceptfds
50 push eax ; writefds
6A 00 push 0 ; readfds
6A 00 push 0 ; nfds
89 74 24 3C mov [esp+13Ch+writefds.fd_array], esi
89 7C 24 38 mov [esp+13Ch+writefds.fd_count], edi
89 4C 24 20 mov [esp+13Ch+timeout.tv_sec], ecx
C7 44 24 24 00 00 00 00 mov [esp+13Ch+timeout.tv_usec], 0
E8 92 51 00 00 call select
33 C9 xor ecx, ecx
56 push esi ; s
85 C0 test eax, eax
0F 9F C1 setnle cl
8B F9 mov edi, ecx
E8 7D 51 00 00 call closesocket
*/
$connectTest = {8D [3] 5? 68 7E 66 04 80 5? E8 [4] 8D [3] 6A 10 5? 5? E8 [4] 8B [6] 8D [3] 5? 8D [3] 6A 00 5? 6A 00 6A 00 89 [3] 89 [3] 89 [3] C7 [7] E8 [4] 33 ?? 5? 85 C0 0F 9F ?? 8B ?? E8}
/*
E8 D8 62 00 00 call rand
8B F8 mov edi, eax
E8 D1 62 00 00 call rand
0F AF F8 imul edi, eax
E8 C9 62 00 00 call rand
0F AF C7 imul eax, edi
99 cdq
33 C2 xor eax, edx
2B C2 sub eax, edx
33 D2 xor edx, edx
F7 F6 div esi
8B FA mov edi, edx
57 push edi
E8 05 13 00 00 call sub_402BD0
*/
$maths = { E8 [4] 8B ?? E8 [4] 0F AF ?? E8 [4] 0F AF ?? 99 33 ?? 2B ?? 33 ?? F7 ?? 8B ?? 5? E8}
$s1 = "recdiscm32.exe"
$s2 = "\\\\%s\\shared$\\syswow64"
$s3 = "\\\\%s\\shared$\\system32"
condition:
$connectTest in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
or $maths in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
or 3 of ($s*)
}