1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
/*
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
import "pe"
rule NaikonCode : Naikon Family
{
meta:
description = "Naikon code features"
author = "Seth Hardy"
last_modified = "2014-06-25"
strings:
// decryption
$ = { 0F AF C1 C1 E0 1F } // imul eax, ecx; shl eah, 1fh
$ = { 35 5A 01 00 00} // xor eax, 15ah
$ = { 81 C2 7F 14 06 00 } // add edx, 6147fh
condition:
all of them
}
rule NaikonStrings : Naikon Family
{
meta:
description = "Naikon Identifying Strings"
author = "Seth Hardy"
last_modified = "2014-06-25"
strings:
$ = "NOKIAN95/WEB"
$ = "/tag=info&id=15"
$ = "skg(3)=&3.2d_u1"
$ = "\\Temp\\iExplorer.exe"
$ = "\\Temp\\\"TSG\""
condition:
any of them
}
rule Naikon : Family
{
meta:
description = "Naikon"
author = "Seth Hardy"
last_modified = "2014-06-25"
condition:
NaikonCode or NaikonStrings
}
rule Backdoor_Naikon_APT_Sample1 {
meta:
description = "Detects backdoors related to the Naikon APT"
author = "Florian Roth"
reference = "https://goo.gl/7vHyvh"
date = "2015-05-14"
hash = "d5716c80cba8554eb79eecfb4aa3d99faf0435a1833ec5ef51f528146c758eba"
hash = "f5ab8e49c0778fa208baad660fe4fa40fc8a114f5f71614afbd6dcc09625cb96"
strings:
$x0 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
$x1 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
$x2 = "greensky27.vicp.net" fullword ascii
$x3 = "\\tempvxd.vxd.dll" fullword wide
$x4 = "otna.vicp.net" fullword ascii
$x5 = "smithking19.gicp.net" fullword ascii
$s1 = "User-Agent: webclient" fullword ascii
$s2 = "\\User.ini" fullword ascii
$s3 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200" ascii
$s4 = "\\UserProfile.dll" fullword wide
$s5 = "Connection:Keep-Alive: %d" fullword ascii
$s6 = "Referer: http://%s:%d/" fullword ascii
$s7 = "%s %s %s %d %d %d " fullword ascii
$s8 = "%s--%s" fullword wide
$s9 = "Run File Success!" fullword wide
$s10 = "DRIVE_REMOTE" fullword wide
$s11 = "ProxyEnable" fullword wide
$s12 = "\\cmd.exe" fullword wide
condition:
uint16(0) == 0x5a4d and filesize < 1000KB and
(
1 of ($x*) or 7 of ($s*)
)
}