Skip to content

R
rules
Commit 6ddb9952 by Marc Rivero López Committed by GitHub
Options

Update APT_Equation.yar 

Fixed style rule
parent 8da187d5
Showing with 556 additions and 475 deletions
malware/APT_Equation.yar
...@@ -7,13 +7,16 @@ import "pe" ...@@ -7,13 +7,16 @@ import "pe"
/* Equation APT ------------------------------------------------------------ */ /* Equation APT ------------------------------------------------------------ */
rule apt_equation_exploitlib_mutexes : mutex { rule apt_equation_exploitlib_mutexes
{
meta: meta:
copyright = "Kaspersky Lab" copyright = "Kaspersky Lab"
description = "Rule to detect Equation group's Exploitation library http://goo.gl/ivt8EW" description = "Rule to detect Equation group's Exploitation library http://goo.gl/ivt8EW"
version = "1.0" version = "1.0"
last_modified = "2015-02-16" last_modified = "2015-02-16"
reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/" reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
strings: strings:
$mz="MZ" $mz="MZ"
$a1="prkMtx" wide $a1="prkMtx" wide
...@@ -21,562 +24,640 @@ rule apt_equation_exploitlib_mutexes : mutex { ...@@ -21,562 +24,640 @@ rule apt_equation_exploitlib_mutexes : mutex {
$a3="cnFormVoidFBC" wide $a3="cnFormVoidFBC" wide
$a4="cnFormSyncExFBC" $a4="cnFormSyncExFBC"
$a5="cnFormVoidFBC" $a5="cnFormVoidFBC"
condition: condition:
(($mz at 0) and any of ($a*)) (($mz at 0) and any of ($a*))
} }
rule apt_equation_doublefantasy_genericresource { rule apt_equation_doublefantasy_genericresource
{
meta: meta:
copyright = "Kaspersky Lab" copyright = "Kaspersky Lab"
description = "Rule to detect DoubleFantasy encoded config http://goo.gl/ivt8EW" description = "Rule to detect DoubleFantasy encoded config http://goo.gl/ivt8EW"
version = "1.0" version = "1.0"
last_modified = "2015-02-16" last_modified = "2015-02-16"
reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/" reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
strings: strings:
$mz="MZ" $mz="MZ"
$a1={06 00 42 00 49 00 4E 00 52 00 45 00 53 00} $a1={06 00 42 00 49 00 4E 00 52 00 45 00 53 00}
$a2="yyyyyyyyyyyyyyyy" $a2="yyyyyyyyyyyyyyyy"
$a3="002" $a3="002"
condition: condition:
(($mz at 0) and all of ($a*)) and filesize < 500000 (($mz at 0) and all of ($a*)) and filesize < 500000
} }
rule apt_equation_equationlaser_runtimeclasses { rule apt_equation_equationlaser_runtimeclasses
meta: {
copyright = "Kaspersky Lab"
description = "Rule to detect the EquationLaser malware" meta:
version = "1.0" copyright = "Kaspersky Lab"
last_modified = "2015-02-16" description = "Rule to detect the EquationLaser malware"
reference = "https://securelist.com/blog/" version = "1.0"
strings: last_modified = "2015-02-16"
$a1="?a73957838_2@@YAXXZ" reference = "https://securelist.com/blog/"
$a2="?a84884@@YAXXZ"
$a3="?b823838_9839@@YAXXZ" strings:
$a4="?e747383_94@@YAXXZ" $a1="?a73957838_2@@YAXXZ"
$a5="?e83834@@YAXXZ" $a2="?a84884@@YAXXZ"
$a6="?e929348_827@@YAXXZ" $a3="?b823838_9839@@YAXXZ"
condition: $a4="?e747383_94@@YAXXZ"
any of them $a5="?e83834@@YAXXZ"
$a6="?e929348_827@@YAXXZ"
condition:
any of them
} }
rule apt_equation_cryptotable : crypto { rule apt_equation_cryptotable
meta: {
copyright = "Kaspersky Lab"
description = "Rule to detect the crypto library used in Equation group malware" meta:
version = "1.0" copyright = "Kaspersky Lab"
last_modified = "2015-02-16" description = "Rule to detect the crypto library used in Equation group malware"
reference = "https://securelist.com/blog/" version = "1.0"
strings: last_modified = "2015-02-16"
$a={37 DF E8 B6 C7 9C 0B AE 91 EF F0 3B 90 C6 80 85 5D 19 4B 45 44 12 3C E2 0D 5C 1C 7B C4 FF D6 05 17 14 4F 03 74 1E 41 DA 8F 7D DE 7E 99 F1 35 AC B8 46 93 CE 23 82 07 EB 2B D4 72 71 40 F3 B0 F7 78 D7 4C D1 55 1A 39 83 18 FA E1 9A 56 B1 96 AB A6 30 C5 5F BE 0C 50 C1} reference = "https://securelist.com/blog/"
condition:
$a strings:
$a={37 DF E8 B6 C7 9C 0B AE 91 EF F0 3B 90 C6 80 85 5D 19 4B 45 44 12 3C E2 0D 5C 1C 7B C4 FF D6 05 17 14 4F 03 74 1E 41 DA 8F 7D DE 7E 99 F1 35 AC B8 46 93 CE 23 82 07 EB 2B D4 72 71 40 F3 B0 F7 78 D7 4C D1 55 1A 39 83 18 FA E1 9A 56 B1 96 AB A6 30 C5 5F BE 0C 50 C1}
condition:
$a
} }
/* Equation Group - Kaspersky ---------------------------------------------- */ /* Equation Group - Kaspersky ---------------------------------------------- */
rule Equation_Kaspersky_TripleFantasy_1 { rule Equation_Kaspersky_TripleFantasy_1
meta: {
description = "Equation Group Malware - TripleFantasy http://goo.gl/ivt8EW"
author = "Florian Roth" meta:
reference = "http://goo.gl/ivt8EW" description = "Equation Group Malware - TripleFantasy http://goo.gl/ivt8EW"
date = "2015/02/16" author = "Florian Roth"
hash = "b2b2cd9ca6f5864ef2ac6382b7b6374a9fb2cbe9" reference = "http://goo.gl/ivt8EW"
strings: date = "2015/02/16"
$mz = { 4d 5a } hash = "b2b2cd9ca6f5864ef2ac6382b7b6374a9fb2cbe9"
$s0 = "%SystemRoot%\\system32\\hnetcfg.dll" fullword wide strings:
$s1 = "%WINDIR%\\System32\\ahlhcib.dll" fullword wide $mz = { 4d 5a }
$s2 = "%WINDIR%\\sjyntmv.dat" fullword wide $s0 = "%SystemRoot%\\system32\\hnetcfg.dll" fullword wide
$s3 = "Global\\{8c38e4f3-591f-91cf-06a6-67b84d8a0102}" fullword wide $s1 = "%WINDIR%\\System32\\ahlhcib.dll" fullword wide
$s4 = "%WINDIR%\\System32\\owrwbsdi" fullword wide $s2 = "%WINDIR%\\sjyntmv.dat" fullword wide
$s5 = "Chrome" fullword wide $s3 = "Global\\{8c38e4f3-591f-91cf-06a6-67b84d8a0102}" fullword wide
$s6 = "StringIndex" fullword ascii $s4 = "%WINDIR%\\System32\\owrwbsdi" fullword wide
$s5 = "Chrome" fullword wide
$x1 = "itemagic.net@443" fullword wide $s6 = "StringIndex" fullword ascii
$x2 = "team4heat.net@443" fullword wide $x1 = "itemagic.net@443" fullword wide
$x5 = "62.216.152.69@443" fullword wide $x2 = "team4heat.net@443" fullword wide
$x6 = "84.233.205.37@443" fullword wide $x5 = "62.216.152.69@443" fullword wide
$x6 = "84.233.205.37@443" fullword wide
$z1 = "www.microsoft.com@80" fullword wide $z1 = "www.microsoft.com@80" fullword wide
$z2 = "www.google.com@80" fullword wide $z2 = "www.google.com@80" fullword wide
$z3 = "127.0.0.1:3128" fullword wide $z3 = "127.0.0.1:3128" fullword wide
condition:
( $mz at 0 ) and filesize < 300000 and condition:
( ( $mz at 0 ) and filesize < 300000 and (( all of ($s*) and all of ($z*) ) or ( all of ($s*) and 1 of ($x*) ))
( all of ($s*) and all of ($z*) ) or
( all of ($s*) and 1 of ($x*) )
)
} }
rule Equation_Kaspersky_DoubleFantasy_1 { rule Equation_Kaspersky_DoubleFantasy_1
meta: {
description = "Equation Group Malware - DoubleFantasy"
author = "Florian Roth" meta:
reference = "http://goo.gl/ivt8EW" description = "Equation Group Malware - DoubleFantasy"
date = "2015/02/16" author = "Florian Roth"
hash = "d09b4b6d3244ac382049736ca98d7de0c6787fa2" reference = "http://goo.gl/ivt8EW"
strings: date = "2015/02/16"
$mz = { 4d 5a } hash = "d09b4b6d3244ac382049736ca98d7de0c6787fa2"
$z1 = "msvcp5%d.dll" fullword ascii strings:
$mz = { 4d 5a }
$s0 = "actxprxy.GetProxyDllInfo" fullword ascii $z1 = "msvcp5%d.dll" fullword ascii
$s3 = "actxprxy.DllGetClassObject" fullword ascii $s0 = "actxprxy.GetProxyDllInfo" fullword ascii
$s5 = "actxprxy.DllRegisterServer" fullword ascii $s3 = "actxprxy.DllGetClassObject" fullword ascii
$s6 = "actxprxy.DllUnregisterServer" fullword ascii $s5 = "actxprxy.DllRegisterServer" fullword ascii
$s6 = "actxprxy.DllUnregisterServer" fullword ascii
$x1 = "yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy" ascii $x1 = "yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy" ascii
$x2 = "191H1a1" fullword ascii $x2 = "191H1a1" fullword ascii
$x3 = "November " fullword ascii $x3 = "November " fullword ascii
$x4 = "abababababab" fullword ascii $x4 = "abababababab" fullword ascii
$x5 = "January " fullword ascii $x5 = "January " fullword ascii
$x6 = "October " fullword ascii $x6 = "October " fullword ascii
$x7 = "September " fullword ascii $x7 = "September " fullword ascii
condition:
( $mz at 0 ) and filesize < 350000 and condition:
( ( $mz at 0 ) and filesize < 350000 and (( $z1 ) or ( all of ($s*) and 6 of ($x*) ))
( $z1 ) or
( all of ($s*) and 6 of ($x*) )
)
} }
rule Equation_Kaspersky_GROK_Keylogger { rule Equation_Kaspersky_GROK_Keylogger
meta: {
description = "Equation Group Malware - GROK keylogger"
author = "Florian Roth" meta:
reference = "http://goo.gl/ivt8EW" description = "Equation Group Malware - GROK keylogger"
date = "2015/02/16" author = "Florian Roth"
hash = "50b8f125ed33233a545a1aac3c9d4bb6aa34b48f" reference = "http://goo.gl/ivt8EW"
strings: date = "2015/02/16"
$mz = { 4d 5a } hash = "50b8f125ed33233a545a1aac3c9d4bb6aa34b48f"
$s0 = "c:\\users\\rmgree5\\" ascii
$s1 = "msrtdv.sys" fullword wide strings:
$mz = { 4d 5a }
$x1 = "svrg.pdb" fullword ascii $s0 = "c:\\users\\rmgree5\\" ascii
$x2 = "W32pServiceTable" fullword ascii $s1 = "msrtdv.sys" fullword wide
$x3 = "In forma" fullword ascii $x1 = "svrg.pdb" fullword ascii
$x4 = "ReleaseF" fullword ascii $x2 = "W32pServiceTable" fullword ascii
$x5 = "criptor" fullword ascii $x3 = "In forma" fullword ascii
$x6 = "astMutex" fullword ascii $x4 = "ReleaseF" fullword ascii
$x7 = "ARASATAU" fullword ascii $x5 = "criptor" fullword ascii
$x8 = "R0omp4ar" fullword ascii $x6 = "astMutex" fullword ascii
$x7 = "ARASATAU" fullword ascii
$z1 = "H.text" fullword ascii $x8 = "R0omp4ar" fullword ascii
$z2 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" fullword wide $z1 = "H.text" fullword ascii
$z4 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment" wide fullword $z2 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
condition: $z4 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment" wide fullword
( $mz at 0 ) and filesize < 250000 and
( condition:
$s0 or ( $mz at 0 ) and filesize < 250000 and ($s0 or ( $s1 and 6 of ($x*) ) or ( 6 of ($x*) and all of ($z*) ))
( $s1 and 6 of ($x*) ) or
( 6 of ($x*) and all of ($z*) )
)
} }
rule Equation_Kaspersky_GreyFishInstaller { rule Equation_Kaspersky_GreyFishInstaller
meta: {
description = "Equation Group Malware - Grey Fish"
author = "Florian Roth" meta:
reference = "http://goo.gl/ivt8EW" description = "Equation Group Malware - Grey Fish"
date = "2015/02/16" author = "Florian Roth"
hash = "58d15d1581f32f36542f3e9fb4b1fc84d2a6ba35" reference = "http://goo.gl/ivt8EW"
strings: date = "2015/02/16"
$s0 = "DOGROUND.exe" fullword wide hash = "58d15d1581f32f36542f3e9fb4b1fc84d2a6ba35"
$s1 = "Windows Configuration Services" fullword wide
$s2 = "GetMappedFilenameW" fullword ascii strings:
condition: $s0 = "DOGROUND.exe" fullword wide
all of them $s1 = "Windows Configuration Services" fullword wide
$s2 = "GetMappedFilenameW" fullword ascii
condition:
all of them
} }
rule Equation_Kaspersky_EquationDrugInstaller { rule Equation_Kaspersky_EquationDrugInstaller
meta: {
description = "Equation Group Malware - EquationDrug installer LUTEUSOBSTOS"
author = "Florian Roth" meta:
reference = "http://goo.gl/ivt8EW" description = "Equation Group Malware - EquationDrug installer LUTEUSOBSTOS"
date = "2015/02/16" author = "Florian Roth"
hash = "61fab1b8451275c7fd580895d9c68e152ff46417" reference = "http://goo.gl/ivt8EW"
strings: date = "2015/02/16"
$mz = { 4d 5a } hash = "61fab1b8451275c7fd580895d9c68e152ff46417"
$s0 = "\\system32\\win32k.sys" fullword wide strings:
$s1 = "ALL_FIREWALLS" fullword ascii $mz = { 4d 5a }
$x1 = "@prkMtx" fullword wide $s0 = "\\system32\\win32k.sys" fullword wide
$x2 = "STATIC" fullword wide $s1 = "ALL_FIREWALLS" fullword ascii
$x3 = "windir" fullword wide $x1 = "@prkMtx" fullword wide
$x4 = "cnFormVoidFBC" fullword wide $x2 = "STATIC" fullword wide
$x5 = "CcnFormSyncExFBC" fullword wide $x3 = "windir" fullword wide
$x6 = "WinStaObj" fullword wide $x4 = "cnFormVoidFBC" fullword wide
$x7 = "BINRES" fullword wide $x5 = "CcnFormSyncExFBC" fullword wide
condition: $x6 = "WinStaObj" fullword wide
( $mz at 0 ) and filesize < 500000 and all of ($s*) and 5 of ($x*) $x7 = "BINRES" fullword wide
condition:
( $mz at 0 ) and filesize < 500000 and all of ($s*) and 5 of ($x*)
} }
rule Equation_Kaspersky_EquationLaserInstaller { rule Equation_Kaspersky_EquationLaserInstaller
meta: {
description = "Equation Group Malware - EquationLaser Installer"
author = "Florian Roth" meta:
reference = "http://goo.gl/ivt8EW" description = "Equation Group Malware - EquationLaser Installer"
date = "2015/02/16" author = "Florian Roth"
hash = "5e1f56c1e57fbff96d4999db1fd6dd0f7d8221df" reference = "http://goo.gl/ivt8EW"
strings: date = "2015/02/16"
$mz = { 4d 5a } hash = "5e1f56c1e57fbff96d4999db1fd6dd0f7d8221df"
$s0 = "Failed to get Windows version" fullword ascii
$s1 = "lsasrv32.dll and lsass.exe" fullword wide strings:
$s2 = "\\\\%s\\mailslot\\%s" fullword ascii $mz = { 4d 5a }
$s3 = "%d-%d-%d %d:%d:%d Z" fullword ascii $s0 = "Failed to get Windows version" fullword ascii
$s4 = "lsasrv32.dll" fullword ascii $s1 = "lsasrv32.dll and lsass.exe" fullword wide
$s5 = "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" fullword ascii $s2 = "\\\\%s\\mailslot\\%s" fullword ascii
$s6 = "%s %02x %s" fullword ascii $s3 = "%d-%d-%d %d:%d:%d Z" fullword ascii
$s7 = "VIEWERS" fullword ascii $s4 = "lsasrv32.dll" fullword ascii
$s8 = "5.2.3790.220 (srv03_gdr.040918-1552)" fullword wide $s5 = "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" fullword ascii
condition: $s6 = "%s %02x %s" fullword ascii
( $mz at 0 ) and filesize < 250000 and 6 of ($s*) $s7 = "VIEWERS" fullword ascii
$s8 = "5.2.3790.220 (srv03_gdr.040918-1552)" fullword wide
condition:
( $mz at 0 ) and filesize < 250000 and 6 of ($s*)
} }
rule Equation_Kaspersky_FannyWorm { rule Equation_Kaspersky_FannyWorm
meta: {
description = "Equation Group Malware - Fanny Worm"
author = "Florian Roth" meta:
reference = "http://goo.gl/ivt8EW" description = "Equation Group Malware - Fanny Worm"
date = "2015/02/16" author = "Florian Roth"
hash = "1f0ae54ac3f10d533013f74f48849de4e65817a7" reference = "http://goo.gl/ivt8EW"
strings: date = "2015/02/16"
$mz = { 4d 5a } hash = "1f0ae54ac3f10d533013f74f48849de4e65817a7"
$s1 = "x:\\fanny.bmp" fullword ascii strings:
$s2 = "32.exe" fullword ascii $mz = { 4d 5a }
$s3 = "d:\\fanny.bmp" fullword ascii $s1 = "x:\\fanny.bmp" fullword ascii
$s2 = "32.exe" fullword ascii
$x1 = "c:\\windows\\system32\\kernel32.dll" fullword ascii $s3 = "d:\\fanny.bmp" fullword ascii
$x2 = "System\\CurrentControlSet\\Services\\USBSTOR\\Enum" fullword ascii $x1 = "c:\\windows\\system32\\kernel32.dll" fullword ascii
$x3 = "System\\CurrentControlSet\\Services\\PartMgr\\Enum" fullword ascii $x2 = "System\\CurrentControlSet\\Services\\USBSTOR\\Enum" fullword ascii
$x4 = "\\system32\\win32k.sys" fullword wide $x3 = "System\\CurrentControlSet\\Services\\PartMgr\\Enum" fullword ascii
$x5 = "\\AGENTCPD.DLL" fullword ascii $x4 = "\\system32\\win32k.sys" fullword wide
$x6 = "agentcpd.dll" fullword ascii $x5 = "\\AGENTCPD.DLL" fullword ascii
$x7 = "PADupdate.exe" fullword ascii $x6 = "agentcpd.dll" fullword ascii
$x8 = "dll_installer.dll" fullword ascii $x7 = "PADupdate.exe" fullword ascii
$x9 = "\\restore\\" fullword ascii $x8 = "dll_installer.dll" fullword ascii
$x10 = "Q:\\__?__.lnk" fullword ascii $x9 = "\\restore\\" fullword ascii
$x11 = "Software\\Microsoft\\MSNetMng" fullword ascii $x10 = "Q:\\__?__.lnk" fullword ascii
$x12 = "\\shelldoc.dll" fullword ascii $x11 = "Software\\Microsoft\\MSNetMng" fullword ascii
$x13 = "file size = %d bytes" fullword ascii $x12 = "\\shelldoc.dll" fullword ascii
$x14 = "\\MSAgent" fullword ascii $x13 = "file size = %d bytes" fullword ascii
$x15 = "Global\\RPCMutex" fullword ascii $x14 = "\\MSAgent" fullword ascii
$x16 = "Global\\DirectMarketing" fullword ascii $x15 = "Global\\RPCMutex" fullword ascii
condition: $x16 = "Global\\DirectMarketing" fullword ascii
( $mz at 0 ) and filesize < 300000 and
( condition:
( 2 of ($s*) ) or ( $mz at 0 ) and filesize < 300000 and (( 2 of ($s*) ) or ( 1 of ($s*) and 6 of ($x*) ) or ( 14 of ($x*)))
( 1 of ($s*) and 6 of ($x*) ) or
( 14 of ($x*) )
)
} }
rule Equation_Kaspersky_HDD_reprogramming_module { rule Equation_Kaspersky_HDD_reprogramming_module
meta: {
description = "Equation Group Malware - HDD reprogramming module"
author = "Florian Roth" meta:
reference = "http://goo.gl/ivt8EW" description = "Equation Group Malware - HDD reprogramming module"
date = "2015/02/16" author = "Florian Roth"
hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500" reference = "http://goo.gl/ivt8EW"
strings: date = "2015/02/16"
$mz = { 4d 5a } hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
$s0 = "nls_933w.dll" fullword ascii
strings:
$s1 = "BINARY" fullword wide $mz = { 4d 5a }
$s2 = "KfAcquireSpinLock" fullword ascii $s0 = "nls_933w.dll" fullword ascii
$s3 = "HAL.dll" fullword ascii $s1 = "BINARY" fullword wide
$s4 = "READ_REGISTER_UCHAR" fullword ascii $s2 = "KfAcquireSpinLock" fullword ascii
condition: $s3 = "HAL.dll" fullword ascii
( $mz at 0 ) and filesize < 300000 and all of ($s*) $s4 = "READ_REGISTER_UCHAR" fullword ascii
condition:
( $mz at 0 ) and filesize < 300000 and all of ($s*)
} }
rule Equation_Kaspersky_EOP_Package { rule Equation_Kaspersky_EOP_Package
meta: {
description = "Equation Group Malware - EoP package and malware launcher"
author = "Florian Roth" meta:
reference = "http://goo.gl/ivt8EW" description = "Equation Group Malware - EoP package and malware launcher"
date = "2015/02/16" author = "Florian Roth"
hash = "2bd1b1f5b4384ce802d5d32d8c8fd3d1dc04b962" reference = "http://goo.gl/ivt8EW"
strings: date = "2015/02/16"
$mz = { 4d 5a } hash = "2bd1b1f5b4384ce802d5d32d8c8fd3d1dc04b962"
$s0 = "abababababab" fullword ascii
$s1 = "abcdefghijklmnopq" fullword ascii strings:
$s2 = "@STATIC" fullword wide $mz = { 4d 5a }
$s3 = "$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" fullword ascii $s0 = "abababababab" fullword ascii
$s4 = "@prkMtx" fullword wide $s1 = "abcdefghijklmnopq" fullword ascii
$s5 = "prkMtx" fullword wide $s2 = "@STATIC" fullword wide
$s6 = "cnFormVoidFBC" fullword wide $s3 = "$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" fullword ascii
condition: $s4 = "@prkMtx" fullword wide
( $mz at 0 ) and filesize < 100000 and all of ($s*) $s5 = "prkMtx" fullword wide
$s6 = "cnFormVoidFBC" fullword wide
condition:
( $mz at 0 ) and filesize < 100000 and all of ($s*)
} }
rule Equation_Kaspersky_TripleFantasy_Loader { rule Equation_Kaspersky_TripleFantasy_Loader
meta: {
description = "Equation Group Malware - TripleFantasy Loader"
author = "Florian Roth" meta:
reference = "http://goo.gl/ivt8EW" description = "Equation Group Malware - TripleFantasy Loader"
date = "2015/02/16" author = "Florian Roth"
hash = "4ce6e77a11b443cc7cbe439b71bf39a39d3d7fa3" reference = "http://goo.gl/ivt8EW"
strings: date = "2015/02/16"
$mz = { 4d 5a } hash = "4ce6e77a11b443cc7cbe439b71bf39a39d3d7fa3"
$x1 = "Original Innovations, LLC" fullword wide strings:
$x2 = "Moniter Resource Protocol" fullword wide $mz = { 4d 5a }
$x3 = "ahlhcib.dll" fullword wide $x1 = "Original Innovations, LLC" fullword wide
$x2 = "Moniter Resource Protocol" fullword wide
$s0 = "hnetcfg.HNetGetSharingServicesPage" fullword ascii $x3 = "ahlhcib.dll" fullword wide
$s1 = "hnetcfg.IcfGetOperationalMode" fullword ascii $s0 = "hnetcfg.HNetGetSharingServicesPage" fullword ascii
$s2 = "hnetcfg.IcfGetDynamicFwPorts" fullword ascii $s1 = "hnetcfg.IcfGetOperationalMode" fullword ascii
$s3 = "hnetcfg.HNetFreeFirewallLoggingSettings" fullword ascii $s2 = "hnetcfg.IcfGetDynamicFwPorts" fullword ascii
$s4 = "hnetcfg.HNetGetShareAndBridgeSettings" fullword ascii $s3 = "hnetcfg.HNetFreeFirewallLoggingSettings" fullword ascii
$s5 = "hnetcfg.HNetGetFirewallSettingsPage" fullword ascii $s4 = "hnetcfg.HNetGetShareAndBridgeSettings" fullword ascii
condition: $s5 = "hnetcfg.HNetGetFirewallSettingsPage" fullword ascii
( $mz at 0 ) and filesize < 50000 and ( all of ($x*) and all of ($s*) )
condition:
( $mz at 0 ) and filesize < 50000 and ( all of ($x*) and all of ($s*) )
} }
/* Rule generated from the mentioned keywords */ /* Rule generated from the mentioned keywords */
rule Equation_Kaspersky_SuspiciousString { rule Equation_Kaspersky_SuspiciousString
meta: {
description = "Equation Group Malware - suspicious string found in sample"
author = "Florian Roth" meta:
reference = "http://goo.gl/ivt8EW" description = "Equation Group Malware - suspicious string found in sample"
date = "2015/02/17" author = "Florian Roth"
score = 60 reference = "http://goo.gl/ivt8EW"
strings: date = "2015/02/17"
$mz = { 4d 5a } score = 60
$s1 = "i386\\DesertWinterDriver.pdb" fullword strings:
$s2 = "Performing UR-specific post-install..." $mz = { 4d 5a }
$s3 = "Timeout waiting for the \"canInstallNow\" event from the implant-specific EXE!" $s1 = "i386\\DesertWinterDriver.pdb" fullword
$s4 = "STRAITSHOOTER30.exe" $s2 = "Performing UR-specific post-install..."
$s5 = "standalonegrok_2.1.1.1" $s3 = "Timeout waiting for the \"canInstallNow\" event from the implant-specific EXE!"
$s6 = "c:\\users\\rmgree5\\" $s4 = "STRAITSHOOTER30.exe"
condition: $s5 = "standalonegrok_2.1.1.1"
( $mz at 0 ) and filesize < 500000 and all of ($s*) $s6 = "c:\\users\\rmgree5\\"
condition:
( $mz at 0 ) and filesize < 500000 and all of ($s*)
} }
/* EquationDrug Update 11.03.2015 - http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/ */ /* EquationDrug Update 11.03.2015 - http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/ */
rule EquationDrug_NetworkSniffer1 { rule EquationDrug_NetworkSniffer1
meta: {
description = "EquationDrug - Backdoor driven by network sniffer - mstcp32.sys, fat32.sys"
author = "Florian Roth @4nc4p" meta:
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/" description = "EquationDrug - Backdoor driven by network sniffer - mstcp32.sys, fat32.sys"
date = "2015/03/11" author = "Florian Roth @4nc4p"
hash = "26e787997a338d8111d96c9a4c103cf8ff0201ce" reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
strings: date = "2015/03/11"
$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide hash = "26e787997a338d8111d96c9a4c103cf8ff0201ce"
$s1 = "\\Registry\\User\\CurrentUser\\" fullword wide
$s3 = "sys\\mstcp32.dbg" fullword ascii strings:
$s7 = "mstcp32.sys" fullword wide $s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
$s8 = "p32.sys" fullword ascii $s1 = "\\Registry\\User\\CurrentUser\\" fullword wide
$s9 = "\\Device\\%ws_%ws" fullword wide $s3 = "sys\\mstcp32.dbg" fullword ascii
$s10 = "\\DosDevices\\%ws" fullword wide $s7 = "mstcp32.sys" fullword wide
$s11 = "\\Device\\%ws" fullword wide $s8 = "p32.sys" fullword ascii
condition: $s9 = "\\Device\\%ws_%ws" fullword wide
all of them $s10 = "\\DosDevices\\%ws" fullword wide
$s11 = "\\Device\\%ws" fullword wide
condition:
all of them
} }
rule EquationDrug_CompatLayer_UnilayDLL { rule EquationDrug_CompatLayer_UnilayDLL
meta: {
description = "EquationDrug - Unilay.DLL"
author = "Florian Roth @4nc4p" meta:
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/" description = "EquationDrug - Unilay.DLL"
date = "2015/03/11" author = "Florian Roth @4nc4p"
hash = "a3a31937956f161beba8acac35b96cb74241cd0f" reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
strings: date = "2015/03/11"
$mz = { 4d 5a } hash = "a3a31937956f161beba8acac35b96cb74241cd0f"
$s0 = "unilay.dll" fullword ascii
condition: strings:
( $mz at 0 ) and $s0 $mz = { 4d 5a }
$s0 = "unilay.dll" fullword ascii
condition:
( $mz at 0 ) and $s0
} }
rule EquationDrug_HDDSSD_Op { rule EquationDrug_HDDSSD_Op
meta: {
description = "EquationDrug - HDD/SSD firmware operation - nls_933w.dll"
author = "Florian Roth @4nc4p" meta:
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/" description = "EquationDrug - HDD/SSD firmware operation - nls_933w.dll"
date = "2015/03/11" author = "Florian Roth @4nc4p"
hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500" reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
strings: date = "2015/03/11"
$s0 = "nls_933w.dll" fullword ascii hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
condition:
all of them strings:
$s0 = "nls_933w.dll" fullword ascii
condition:
all of them
} }
rule EquationDrug_NetworkSniffer2 { rule EquationDrug_NetworkSniffer2
meta: {
description = "EquationDrug - Network Sniffer - tdip.sys"
author = "Florian Roth @4nc4p" meta:
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/" description = "EquationDrug - Network Sniffer - tdip.sys"
date = "2015/03/11" author = "Florian Roth @4nc4p"
hash = "7e3cd36875c0e5ccb076eb74855d627ae8d4627f" reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
strings: date = "2015/03/11"
$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide hash = "7e3cd36875c0e5ccb076eb74855d627ae8d4627f"
$s1 = "IP Transport Driver" fullword wide
$s2 = "tdip.sys" fullword wide strings:
$s3 = "sys\\tdip.dbg" fullword ascii $s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
$s4 = "dip.sys" fullword ascii $s1 = "IP Transport Driver" fullword wide
$s5 = "\\Device\\%ws_%ws" fullword wide $s2 = "tdip.sys" fullword wide
$s6 = "\\DosDevices\\%ws" fullword wide $s3 = "sys\\tdip.dbg" fullword ascii
$s7 = "\\Device\\%ws" fullword wide $s4 = "dip.sys" fullword ascii
condition: $s5 = "\\Device\\%ws_%ws" fullword wide
all of them $s6 = "\\DosDevices\\%ws" fullword wide
$s7 = "\\Device\\%ws" fullword wide
condition:
all of them
} }
rule EquationDrug_NetworkSniffer3 { rule EquationDrug_NetworkSniffer3
meta: {
description = "EquationDrug - Network Sniffer - tdip.sys"
author = "Florian Roth @4nc4p" meta:
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/" description = "EquationDrug - Network Sniffer - tdip.sys"
date = "2015/03/11" author = "Florian Roth @4nc4p"
hash = "14599516381a9646cd978cf962c4f92386371040" reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
strings: date = "2015/03/11"
$s0 = "Corporation. All rights reserved." fullword wide hash = "14599516381a9646cd978cf962c4f92386371040"
$s1 = "IP Transport Driver" fullword wide
$s2 = "tdip.sys" fullword wide strings:
$s3 = "tdip.pdb" fullword ascii $s0 = "Corporation. All rights reserved." fullword wide
condition: $s1 = "IP Transport Driver" fullword wide
all of them $s2 = "tdip.sys" fullword wide
$s3 = "tdip.pdb" fullword ascii
condition:
all of them
} }
rule EquationDrug_VolRec_Driver { rule EquationDrug_VolRec_Driver
meta: {
description = "EquationDrug - Collector plugin for Volrec - msrstd.sys"
author = "Florian Roth @4nc4p" meta:
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/" description = "EquationDrug - Collector plugin for Volrec - msrstd.sys"
date = "2015/03/11" author = "Florian Roth @4nc4p"
hash = "ee2b504ad502dc3fed62d6483d93d9b1221cdd6c" reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
strings: date = "2015/03/11"
$s0 = "msrstd.sys" fullword wide hash = "ee2b504ad502dc3fed62d6483d93d9b1221cdd6c"
$s1 = "msrstd.pdb" fullword ascii
$s2 = "msrstd driver" fullword wide strings:
condition: $s0 = "msrstd.sys" fullword wide
all of them $s1 = "msrstd.pdb" fullword ascii
$s2 = "msrstd driver" fullword wide
condition:
all of them
} }
rule EquationDrug_KernelRootkit { rule EquationDrug_KernelRootkit
meta: {
description = "EquationDrug - Kernel mode stage 0 and rootkit (Windows 2000 and above) - msndsrv.sys"
author = "Florian Roth @4nc4p" meta:
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/" description = "EquationDrug - Kernel mode stage 0 and rootkit (Windows 2000 and above) - msndsrv.sys"
date = "2015/03/11" author = "Florian Roth @4nc4p"
hash = "597715224249e9fb77dc733b2e4d507f0cc41af6" reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
strings: date = "2015/03/11"
$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide hash = "597715224249e9fb77dc733b2e4d507f0cc41af6"
$s1 = "Parmsndsrv.dbg" fullword ascii
$s2 = "\\Registry\\User\\CurrentUser\\" fullword wide strings:
$s3 = "msndsrv.sys" fullword wide $s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
$s5 = "\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Control\\Windows" fullword wide $s1 = "Parmsndsrv.dbg" fullword ascii
$s6 = "\\Device\\%ws_%ws" fullword wide $s2 = "\\Registry\\User\\CurrentUser\\" fullword wide
$s7 = "\\DosDevices\\%ws" fullword wide $s3 = "msndsrv.sys" fullword wide
$s9 = "\\Device\\%ws" fullword wide $s5 = "\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Control\\Windows" fullword wide
condition: $s6 = "\\Device\\%ws_%ws" fullword wide
all of them $s7 = "\\DosDevices\\%ws" fullword wide
$s9 = "\\Device\\%ws" fullword wide
condition:
all of them
} }
rule EquationDrug_Keylogger { rule EquationDrug_Keylogger
meta: {
description = "EquationDrug - Key/clipboard logger driver - msrtvd.sys"
author = "Florian Roth @4nc4p" meta:
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/" description = "EquationDrug - Key/clipboard logger driver - msrtvd.sys"
date = "2015/03/11" author = "Florian Roth @4nc4p"
hash = "b93aa17b19575a6e4962d224c5801fb78e9a7bb5" reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
strings: date = "2015/03/11"
$s0 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" fullword wide hash = "b93aa17b19575a6e4962d224c5801fb78e9a7bb5"
$s2 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\En" wide
$s3 = "\\DosDevices\\Gk" fullword wide strings:
$s5 = "\\Device\\Gk0" fullword wide $s0 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
condition: $s2 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\En" wide
all of them $s3 = "\\DosDevices\\Gk" fullword wide
$s5 = "\\Device\\Gk0" fullword wide
condition:
all of them
} }
rule EquationDrug_NetworkSniffer4 { rule EquationDrug_NetworkSniffer4
meta: {
description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
author = "Florian Roth @4nc4p" meta:
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/" description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
date = "2015/03/11" author = "Florian Roth @4nc4p"
hash = "cace40965f8600a24a2457f7792efba3bd84d9ba" reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
strings: date = "2015/03/11"
$s0 = "Copyright 1999 RAVISENT Technologies Inc." fullword wide hash = "cace40965f8600a24a2457f7792efba3bd84d9ba"
$s1 = "\\systemroot\\" fullword ascii
$s2 = "RAVISENT Technologies Inc." fullword wide strings:
$s3 = "Created by VIONA Development" fullword wide $s0 = "Copyright 1999 RAVISENT Technologies Inc." fullword wide
$s4 = "\\Registry\\User\\CurrentUser\\" fullword wide $s1 = "\\systemroot\\" fullword ascii
$s5 = "\\device\\harddiskvolume" fullword wide $s2 = "RAVISENT Technologies Inc." fullword wide
$s7 = "ATMDKDRV.SYS" fullword wide $s3 = "Created by VIONA Development" fullword wide
$s8 = "\\Device\\%ws_%ws" fullword wide $s4 = "\\Registry\\User\\CurrentUser\\" fullword wide
$s9 = "\\DosDevices\\%ws" fullword wide $s5 = "\\device\\harddiskvolume" fullword wide
$s10 = "CineMaster C 1.1 WDM Main Driver" fullword wide $s7 = "ATMDKDRV.SYS" fullword wide
$s11 = "\\Device\\%ws" fullword wide $s8 = "\\Device\\%ws_%ws" fullword wide
$s13 = "CineMaster C 1.1 WDM" fullword wide $s9 = "\\DosDevices\\%ws" fullword wide
condition: $s10 = "CineMaster C 1.1 WDM Main Driver" fullword wide
all of them $s11 = "\\Device\\%ws" fullword wide
$s13 = "CineMaster C 1.1 WDM" fullword wide
condition:
all of them
} }
rule EquationDrug_PlatformOrchestrator { rule EquationDrug_PlatformOrchestrator
meta: {
description = "EquationDrug - Platform orchestrator - mscfg32.dll, svchost32.dll"
author = "Florian Roth @4nc4p" meta:
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/" description = "EquationDrug - Platform orchestrator - mscfg32.dll, svchost32.dll"
date = "2015/03/11" author = "Florian Roth @4nc4p"
hash = "febc4f30786db7804008dc9bc1cebdc26993e240" reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
strings: date = "2015/03/11"
$s0 = "SERVICES.EXE" fullword wide hash = "febc4f30786db7804008dc9bc1cebdc26993e240"
$s1 = "\\command.com" fullword wide
$s2 = "Microsoft(R) Windows (TM) Operating System" fullword wide strings:
$s3 = "LSASS.EXE" fullword wide $s0 = "SERVICES.EXE" fullword wide
$s4 = "Windows Configuration Services" fullword wide $s1 = "\\command.com" fullword wide
$s8 = "unilay.dll" fullword ascii $s2 = "Microsoft(R) Windows (TM) Operating System" fullword wide
condition: $s3 = "LSASS.EXE" fullword wide
all of them $s4 = "Windows Configuration Services" fullword wide
$s8 = "unilay.dll" fullword ascii
condition:
all of them
} }
rule EquationDrug_NetworkSniffer5 { rule EquationDrug_NetworkSniffer5
meta: {
description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
author = "Florian Roth @4nc4p" meta:
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/" description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
date = "2015/03/11" author = "Florian Roth @4nc4p"
hash = "09399b9bd600d4516db37307a457bc55eedcbd17" reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
strings: date = "2015/03/11"
$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide hash = "09399b9bd600d4516db37307a457bc55eedcbd17"
$s1 = "\\Registry\\User\\CurrentUser\\" fullword wide
$s2 = "atmdkdrv.sys" fullword wide strings:
$s4 = "\\Device\\%ws_%ws" fullword wide $s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
$s5 = "\\DosDevices\\%ws" fullword wide $s1 = "\\Registry\\User\\CurrentUser\\" fullword wide
$s6 = "\\Device\\%ws" fullword wide $s2 = "atmdkdrv.sys" fullword wide
condition: $s4 = "\\Device\\%ws_%ws" fullword wide
all of them $s5 = "\\DosDevices\\%ws" fullword wide
$s6 = "\\Device\\%ws" fullword wide
condition:
all of them
} }
rule EquationDrug_FileSystem_Filter { rule EquationDrug_FileSystem_Filter
meta: {
description = "EquationDrug - Filesystem filter driver – volrec.sys, scsi2mgr.sys"
author = "Florian Roth @4nc4p" meta:
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/" description = "EquationDrug - Filesystem filter driver – volrec.sys, scsi2mgr.sys"
date = "2015/03/11" author = "Florian Roth @4nc4p"
hash = "57fa4a1abbf39f4899ea76543ebd3688dcc11e13" reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
strings: date = "2015/03/11"
$s0 = "volrec.sys" fullword wide hash = "57fa4a1abbf39f4899ea76543ebd3688dcc11e13"
$s1 = "volrec.pdb" fullword ascii
$s2 = "Volume recognizer driver" fullword wide strings:
condition: $s0 = "volrec.sys" fullword wide
all of them $s1 = "volrec.pdb" fullword ascii
$s2 = "Volume recognizer driver" fullword wide
condition:
all of them
} }
rule apt_equation_keyword {
rule apt_equation_keyword
{
meta: meta:
description = "Rule to detect Equation group's keyword in executable file" description = "Rule to detect Equation group's keyword in executable file"
author = "Florian Roth @4nc4p" author = "Florian Roth @4nc4p"
last_modified = "2015-09-26" last_modified = "2015-09-26"
reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/" reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
strings: strings:
$a1 = "Backsnarf_AB25" wide $a1 = "Backsnarf_AB25" wide
$a2 = "Backsnarf_AB25" ascii $a2 = "Backsnarf_AB25" ascii
condition: condition:
uint16(0) == 0x5a4d and 1 of ($a*) uint16(0) == 0x5a4d and 1 of ($a*)
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment