Skip to content

R
rules
Commit 190e4883 by Marc Rivero López Committed by GitHub
Options

Update APT_WoolenGoldfish.yar

parent 058ef81b
Showing with 92 additions and 82 deletions
malware/APT_WoolenGoldfish.yar
...@@ -5,95 +5,105 @@ ...@@ -5,95 +5,105 @@
import "pe" import "pe"
rule WoolenGoldfish_Sample_1
{
rule WoolenGoldfish_Sample_1 : APT { meta:
meta: description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ" author = "Florian Roth"
author = "Florian Roth" reference = "http://goo.gl/NpJpVZ"
reference = "http://goo.gl/NpJpVZ" date = "2015/03/25"
date = "2015/03/25" score = 60
score = 60 hash = "7ad0eb113bc575363a058f4bf21dbab8c8f7073a"
hash = "7ad0eb113bc575363a058f4bf21dbab8c8f7073a"
strings: strings:
$s1 = "Cannot execute (%d)" fullword ascii $s1 = "Cannot execute (%d)" fullword ascii
$s16 = "SvcName" fullword ascii $s16 = "SvcName" fullword ascii
condition:
all of them condition:
all of them
} }
rule WoolenGoldfish_Generic_1 { rule WoolenGoldfish_Generic_1
meta: {
description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
author = "Florian Roth"
reference = "http://goo.gl/NpJpVZ"
date = "2015/03/25"
score = 90
super_rule = 1
hash0 = "5d334e0cb4ff58859e91f9e7f1c451ffdc7544c3"
hash1 = "d5b2b30fe2d4759c199e3659d561a50f88a7fb2e"
hash2 = "a42f1ad2360833baedd2d5f59354c4fc3820c475"
strings:
$x0 = "Users\\Wool3n.H4t\\"
$x1 = "C-CPP\\CWoolger"
$x2 = "NTSuser.exe" fullword wide
$s1 = "107.6.181.116" fullword wide meta:
$s2 = "oShellLink.Hotkey = \"CTRL+SHIFT+F\"" fullword description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
$s3 = "set WshShell = WScript.CreateObject(\"WScript.Shell\")" fullword author = "Florian Roth"
$s4 = "oShellLink.IconLocation = \"notepad.exe, 0\"" fullword reference = "http://goo.gl/NpJpVZ"
$s5 = "set oShellLink = WshShell.CreateShortcut(strSTUP & \"\\WinDefender.lnk\")" fullword date = "2015/03/25"
$s6 = "wlg.dat" fullword score = 90
$s7 = "woolger" fullword wide super_rule = 1
$s8 = "[Enter]" fullword hash0 = "5d334e0cb4ff58859e91f9e7f1c451ffdc7544c3"
$s9 = "[Control]" fullword hash1 = "d5b2b30fe2d4759c199e3659d561a50f88a7fb2e"
condition: hash2 = "a42f1ad2360833baedd2d5f59354c4fc3820c475"
( 1 of ($x*) and 2 of ($s*) ) or
( 6 of ($s*) ) strings:
$x0 = "Users\\Wool3n.H4t\\"
$x1 = "C-CPP\\CWoolger"
$x2 = "NTSuser.exe" fullword wide
$s1 = "107.6.181.116" fullword wide
$s2 = "oShellLink.Hotkey = \"CTRL+SHIFT+F\"" fullword
$s3 = "set WshShell = WScript.CreateObject(\"WScript.Shell\")" fullword
$s4 = "oShellLink.IconLocation = \"notepad.exe, 0\"" fullword
$s5 = "set oShellLink = WshShell.CreateShortcut(strSTUP & \"\\WinDefender.lnk\")" fullword
$s6 = "wlg.dat" fullword
$s7 = "woolger" fullword wide
$s8 = "[Enter]" fullword
$s9 = "[Control]" fullword
condition:
( 1 of ($x*) and 2 of ($s*) ) or ( 6 of ($s*) )
} }
rule WoolenGoldfish_Generic_2 { rule WoolenGoldfish_Generic_2
meta: {
description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
author = "Florian Roth" meta:
reference = "http://goo.gl/NpJpVZ" description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
date = "2015/03/25" author = "Florian Roth"
score = 90 reference = "http://goo.gl/NpJpVZ"
hash1 = "47b1c9caabe3ae681934a33cd6f3a1b311fd7f9f" date = "2015/03/25"
hash2 = "62172eee1a4591bde2658175dd5b8652d5aead2a" score = 90
hash3 = "7fef48e1303e40110798dfec929ad88f1ad4fbd8" hash1 = "47b1c9caabe3ae681934a33cd6f3a1b311fd7f9f"
hash4 = "c1edf6e3a271cf06030cc46cbd90074488c05564" hash2 = "62172eee1a4591bde2658175dd5b8652d5aead2a"
strings: hash3 = "7fef48e1303e40110798dfec929ad88f1ad4fbd8"
$s0 = "modules\\exploits\\littletools\\agent_wrapper\\release" ascii hash4 = "c1edf6e3a271cf06030cc46cbd90074488c05564"
condition:
all of them strings:
$s0 = "modules\\exploits\\littletools\\agent_wrapper\\release" ascii
condition:
all of them
} }
rule WoolenGoldfish_Generic_3 { rule WoolenGoldfish_Generic_3
meta: {
description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
author = "Florian Roth"
reference = "http://goo.gl/NpJpVZ"
date = "2015/03/25"
score = 90
hash1 = "86222ef166474e53f1eb6d7e6701713834e6fee7"
hash2 = "e8dbcde49c7f760165ebb0cb3452e4f1c24981f5"
strings:
$x1 = "... get header FATAL ERROR !!! %d bytes read > header_size" fullword ascii
$x2 = "index.php?c=%S&r=%x&u=1&t=%S" fullword wide
$x3 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii
$s0 = "kernel32.dll GetProcAddressLoadLibraryAws2_32.dll" fullword ascii meta:
$s1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
$s2 = "Attempting to unlock uninitialized lock!" fullword ascii author = "Florian Roth"
$s4 = "unable to load kernel32.dll" fullword ascii reference = "http://goo.gl/NpJpVZ"
$s5 = "index.php?c=%S&r=%x" fullword wide date = "2015/03/25"
$s6 = "%s len:%d " fullword ascii score = 90
$s7 = "Encountered error sending syscall response to client" fullword ascii hash1 = "86222ef166474e53f1eb6d7e6701713834e6fee7"
$s9 = "/info.dat" fullword ascii hash2 = "e8dbcde49c7f760165ebb0cb3452e4f1c24981f5"
$s10 = "Error entering thread lock" fullword ascii
$s11 = "Error exiting thread lock" fullword ascii strings:
$s12 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii $x1 = "... get header FATAL ERROR !!! %d bytes read > header_size" fullword ascii
condition: $x2 = "index.php?c=%S&r=%x&u=1&t=%S" fullword wide
( 1 of ($x*) ) or $x3 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii
( 8 of ($s*) ) $s0 = "kernel32.dll GetProcAddressLoadLibraryAws2_32.dll" fullword ascii
$s1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide
$s2 = "Attempting to unlock uninitialized lock!" fullword ascii
$s4 = "unable to load kernel32.dll" fullword ascii
$s5 = "index.php?c=%S&r=%x" fullword wide
$s6 = "%s len:%d " fullword ascii
$s7 = "Encountered error sending syscall response to client" fullword ascii
$s9 = "/info.dat" fullword ascii
$s10 = "Error entering thread lock" fullword ascii
$s11 = "Error exiting thread lock" fullword ascii
$s12 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii
condition:
( 1 of ($x*) ) or ( 8 of ($s*) )
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment