Skip to content

R
rules
Commit 2574cfbe by Marc Rivero López Committed by GitHub
Options

Update APT_Dubnium.yar 

Fixed style  rule
parent ca774e3c
Showing with 145 additions and 116 deletions
malware/APT_Dubnium.yar
...@@ -7,132 +7,161 @@ ...@@ -7,132 +7,161 @@
/* Rule Set ----------------------------------------------------------------- */ /* Rule Set ----------------------------------------------------------------- */
rule Dubnium_Sample_1 { rule Dubnium_Sample_1
meta: {
description = "Detects sample mentioned in the Dubnium Report"
author = "Florian Roth" meta:
reference = "https://goo.gl/AW9Cuu" description = "Detects sample mentioned in the Dubnium Report"
date = "2016-06-10" author = "Florian Roth"
hash1 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba" reference = "https://goo.gl/AW9Cuu"
strings: date = "2016-06-10"
$key1 = "3b840e20e9555e9fb031c4ba1f1747ce25cc1d0ff664be676b9b4a90641ff194" fullword ascii hash1 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
$key2 = "90631f686a8c3dbc0703ffa353bc1fdf35774568ac62406f98a13ed8f47595fd" fullword ascii
condition: strings:
uint16(0) == 0x5a4d and filesize < 2000KB and all of them $key1 = "3b840e20e9555e9fb031c4ba1f1747ce25cc1d0ff664be676b9b4a90641ff194" fullword ascii
$key2 = "90631f686a8c3dbc0703ffa353bc1fdf35774568ac62406f98a13ed8f47595fd" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 2000KB and all of them
} }
rule Dubnium_Sample_2 { rule Dubnium_Sample_2
meta: {
description = "Detects sample mentioned in the Dubnium Report"
author = "Florian Roth" meta:
reference = "https://goo.gl/AW9Cuu" description = "Detects sample mentioned in the Dubnium Report"
date = "2016-06-10" author = "Florian Roth"
hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b" reference = "https://goo.gl/AW9Cuu"
strings: date = "2016-06-10"
$x1 = ":*:::D:\\:c:~:" fullword ascii hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
$s2 = "SPMUVR" fullword ascii
condition: strings:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them ) $x1 = ":*:::D:\\:c:~:" fullword ascii
$s2 = "SPMUVR" fullword ascii
condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
} }
rule Dubnium_Sample_3 { rule Dubnium_Sample_3
meta: {
description = "Detects sample mentioned in the Dubnium Report"
author = "Florian Roth" meta:
reference = "https://goo.gl/AW9Cuu" description = "Detects sample mentioned in the Dubnium Report"
date = "2016-06-10" author = "Florian Roth"
hash1 = "caefcdf2b4e5a928cdf9360b70960337f751ec4a5ab8c0b75851fc9a1ab507a8" reference = "https://goo.gl/AW9Cuu"
hash2 = "e0362d319a8d0e13eda782a0d8da960dd96043e6cc3500faeae521d1747576e5" date = "2016-06-10"
hash3 = "a77d1c452291a6f2f6ed89a4bac88dd03d38acde709b0061efd9f50e6d9f3827" hash1 = "caefcdf2b4e5a928cdf9360b70960337f751ec4a5ab8c0b75851fc9a1ab507a8"
strings: hash2 = "e0362d319a8d0e13eda782a0d8da960dd96043e6cc3500faeae521d1747576e5"
$x1 = "copy /y \"%s\" \"%s\" " fullword ascii hash3 = "a77d1c452291a6f2f6ed89a4bac88dd03d38acde709b0061efd9f50e6d9f3827"
$x2 = "del /f \"%s\" " fullword ascii
$s1 = "del /f /ah \"%s\" " fullword ascii strings:
$s2 = "if exist \"%s\" goto Rept " fullword ascii $x1 = "copy /y \"%s\" \"%s\" " fullword ascii
$s3 = "\\*.*.lnk" fullword ascii $x2 = "del /f \"%s\" " fullword ascii
$s4 = "Dropped" fullword ascii $s1 = "del /f /ah \"%s\" " fullword ascii
condition: $s2 = "if exist \"%s\" goto Rept " fullword ascii
uint16(0) == 0x5a4d and filesize < 2000KB and 5 of them $s3 = "\\*.*.lnk" fullword ascii
$s4 = "Dropped" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 2000KB and 5 of them
} }
rule Dubnium_Sample_5 { rule Dubnium_Sample_5
meta: {
description = "Detects sample mentioned in the Dubnium Report"
author = "Florian Roth" meta:
reference = "https://goo.gl/AW9Cuu" description = "Detects sample mentioned in the Dubnium Report"
date = "2016-06-10" author = "Florian Roth"
super_rule = 1 reference = "https://goo.gl/AW9Cuu"
hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b" date = "2016-06-10"
hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8" super_rule = 1
hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf" hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b" hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0" hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
hash6 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba" hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
hash7 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9" hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
hash8 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f" hash6 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
hash9 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b" hash7 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
strings: hash8 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
$s1 = "$innn[i$[i$^i[e[mdi[m$jf1Wehn[^Whl[^iin_hf$11mahZijnjbi[^[W[f1n$dej$[hn]1[W1ni1l[ic1j[mZjchl$$^he[[j[a[1_iWc[e[" fullword ascii hash9 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
$s2 = "h$YWdh[$ij7^e$n[[_[h[i[[[\\][1$1[[j1W1[1cjm1[$[k1ZW_$$ncn[[Inbnnc[I9enanid[fZCX" fullword ascii
condition: strings:
uint16(0) == 0x5a4d and filesize < 9000KB and all of them $s1 = "$innn[i$[i$^i[e[mdi[m$jf1Wehn[^Whl[^iin_hf$11mahZijnjbi[^[W[f1n$dej$[hn]1[W1ni1l[ic1j[mZjchl$$^he[[j[a[1_iWc[e[" fullword ascii
$s2 = "h$YWdh[$ij7^e$n[[_[h[i[[[\\][1$1[[j1W1[1cjm1[$[k1ZW_$$ncn[[Inbnnc[I9enanid[fZCX" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 9000KB and all of them
} }
rule Dubnium_Sample_6 { rule Dubnium_Sample_6
meta: {
description = "Detects sample mentioned in the Dubnium Report"
author = "Florian Roth" meta:
reference = "https://goo.gl/AW9Cuu" description = "Detects sample mentioned in the Dubnium Report"
date = "2016-06-10" author = "Florian Roth"
super_rule = 1 reference = "https://goo.gl/AW9Cuu"
hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b" date = "2016-06-10"
hash2 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0" super_rule = 1
hash3 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba" hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
strings: hash2 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
$s1 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&()`~-_=+[{]{;',." fullword ascii hash3 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
$s2 = "e_$0[bW\\RZY\\jb\\ZY[nimiRc[jRZ]" fullword ascii
$s3 = "f_RIdJ0W9RFb[$Fbc9[k_?Wn" fullword ascii strings:
condition: $s1 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&()`~-_=+[{]{;',." fullword ascii
uint16(0) == 0x5a4d and filesize < 4000KB and all of them $s2 = "e_$0[bW\\RZY\\jb\\ZY[nimiRc[jRZ]" fullword ascii
$s3 = "f_RIdJ0W9RFb[$Fbc9[k_?Wn" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 4000KB and all of them
} }
rule Dubnium_Sample_7 { rule Dubnium_Sample_7
meta: {
description = "Detects sample mentioned in the Dubnium Report"
author = "Florian Roth" meta:
reference = "https://goo.gl/AW9Cuu" description = "Detects sample mentioned in the Dubnium Report"
date = "2016-06-10" author = "Florian Roth"
super_rule = 1 reference = "https://goo.gl/AW9Cuu"
hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b" date = "2016-06-10"
hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8" super_rule = 1
hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf" hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b" hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0" hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
hash6 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9" hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
hash7 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f" hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
hash8 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b" hash6 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
strings: hash7 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
$s1 = "hWI[$lZ![nJ_[[lk[8Ihlo8ZiIl[[[$Ynk[f_8[88WWWJW[YWnl$$Z[ilf!$IZ$!W>Wl![W!k!$l!WoW8$nj8![8n_I^$[>_n[ZY[[Xhn_c!nnfK[!Z" fullword ascii hash8 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
$s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii
condition: strings:
uint16(0) == 0x5a4d and filesize < 9000KB and all of them $s1 = "hWI[$lZ![nJ_[[lk[8Ihlo8ZiIl[[[$Ynk[f_8[88WWWJW[YWnl$$Z[ilf!$IZ$!W>Wl![W!k!$l!WoW8$nj8![8n_I^$[>_n[ZY[[Xhn_c!nnfK[!Z" fullword ascii
$s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 9000KB and all of them
} }
rule Dubnium_Sample_SSHOpenSSL { rule Dubnium_Sample_SSHOpenSSL
meta: {
description = "Detects sample mentioned in the Dubnium Report"
author = "Florian Roth" meta:
reference = "https://goo.gl/AW9Cuu" description = "Detects sample mentioned in the Dubnium Report"
date = "2016-06-10" author = "Florian Roth"
hash1 = "6f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b" reference = "https://goo.gl/AW9Cuu"
hash2 = "feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8" date = "2016-06-10"
hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf" hash1 = "6f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
hash4 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f" hash2 = "feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
hash5 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9" hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
hash6 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b" hash4 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
strings: hash5 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
$s1 = "sshkeypairgen.exe" fullword wide hash6 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
$s2 = "OpenSSL: FATAL" fullword ascii
condition: strings:
uint16(0) == 0x5a4d and filesize < 9000KB and all of them $s1 = "sshkeypairgen.exe" fullword wide
$s2 = "OpenSSL: FATAL" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 9000KB and all of them
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment