Update Miscelanea.yar

malware/Miscelanea.yar

@@ -884,3 +884,163 @@ rule VirusRat
 	condition:
 		all of them
 }
+rule ice_ix_12xy : banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "ICE-IX 1.2.x.y trojan banker"
+		date = "2013-01-12"
+		filetype = "memory"
+		version = "1.0" 
+	
+	strings:
+		$regexp1= /bn1=.{32}&sk1=[0-9a-zA-Z]{32}/
+		$a = "bn1="
+		$b = "&sk1="
+		$c = "mario"								//HardDrive GUID artifact
+		$d = "FIXME"
+		$e = "RFB 003.003"							//VNC artifact
+		$ggurl = "http://www.google.com/webhp"
+
+	condition:
+		$regexp1 or ($a and $b) or all of ($c,$d,$e,$ggurl) 
+}
+rule qadars : banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "Qadars - Mobile part. Maybe Perkele."
+		version = "1.0" 
+		filetype = "memory"
+		ref1 = "http://www.lexsi-leblog.fr/cert/qadars-nouveau-malware-bancaire-composant-mobile.html"
+
+	strings:
+		$cmd1 = "m?D"
+		$cmd2 = "m?S"
+		$cmd3 = "ALL"
+		$cmd4 = "FILTER"
+		$cmd5 = "NONE"
+		$cmd6 = "KILL"
+		$cmd7 = "CANCEL"
+		$cmd8 = "SMS"
+		$cmd9 = "DIVERT"
+		$cmd10 = "MESS"
+		$nofilter = "nofilter1111111"
+		$botherderphonenumber1 = "+380678409210"
+
+	condition:
+		all of ($cmd*) or $nofilter or any of ($botherderphonenumber*)
+}
+rule shylock :  banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "Shylock Banker"
+		date = "2013-12-12" 
+		version = "1.0" 
+		ref1 = "http://iocbucket.com/iocs/1b4660d57928df5ca843c21df0b2adb117026cba"
+		ref2 = "http://www.trusteer.com/blog/merchant-fraud-returns-%E2%80%93-shylock-polymorphic-financial-malware-infections-rise"
+		ref3 = "https://www.csis.dk/en/csis/blog/3811/"
+
+	strings:
+		$process1 = "MASTER"
+		$process2 = "_SHUTDOWN"
+		$process3 = "EVT_VNC"
+		$process4 = "EVT_BACK"
+		$process5 = "EVT_VNC"
+		$process6 = "IE_Hook::GetRequestInfo"
+		$process7 = "FF_Hook::getRequestInfo"
+		$process8 = "EX_Hook::CreateProcess"
+		$process9 = "hijackdll.dll"
+		$process10 = "MTX_"
+		$process11 = "FF::PR_WriteHook entry"
+		$process12 = "FF::PR_WriteHook exit"
+		$process13 = "HijackProcessAttach::*** MASTER *** MASTER *** MASTER *** %s PID=%u"
+		$process14 = "HijackProcessAttach::entry"
+		$process15 = "FF::BEFORE INJECT"
+		$process16 = "FF::AFTER INJECT"
+		$process17 = "IE::AFTER INJECT"
+		$process18 = "IE::BEFORE INJECT"
+		$process19 = "*** VNC *** VNC *** VNC *** VNC *** VNC *** VNC *** VNC *** VNC *** VNC *** VNC *** %s"
+		$process20 = "*** LOG INJECTS *** %s"
+		$process21 = "*** inject to process %s not allowed"
+		$process22 = "*** BackSocks *** BackSocks *** BackSocks *** BackSocks *** BackSocks *** BackSocks *** BackSocks *** %s"
+		$process23 = ".?AVFF_Hook@@"
+		$process24 = ".?AVIE_Hook@@"
+		$process25 = "Inject::InjectDllFromMemory"
+		$process26 = "BadSocks.dll"	
+		$domain1 = "extensadv.cc"
+		$domain2 = "topbeat.cc"
+		$domain3 = "brainsphere.cc"
+		$domain4 = "commonworldme.cc"
+		$domain5 = "gigacat.cc"
+		$domain6 = "nw-serv.cc"
+		$domain7 = "paragua-analyst.cc"
+		
+	condition:
+		3 of ($process*) or any of ($domain*)
+}
+rule spyeye : banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "SpyEye X.Y memory"
+		date = "2012-05-23" 
+		version = "1.0" 
+		filetype = "memory"
+
+	strings:
+		$spyeye = "SpyEye"
+		$a = "%BOTNAME%"
+		$b = "globplugins"
+		$c = "data_inject"
+		$d = "data_before"
+		$e = "data_after"
+		$f = "data_end"
+		$g = "bot_version"
+		$h = "bot_guid"
+		$i = "TakeBotGuid"
+		$j = "TakeGateToCollector"
+		$k = "[ERROR] : Omfg! Process is still active? Lets kill that mazafaka!"
+		$l = "[ERROR] : Update is not successfull for some reason"
+		$m = "[ERROR] : dwErr == %u"
+		$n = "GRABBED DATA"
+		
+	condition:
+		$spyeye or (any of ($a,$b,$c,$d,$e,$f,$g,$h,$i,$j,$k,$l,$m,$n))
+}
+
+rule spyeye_plugins : banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "SpyEye X.Y Plugins memory"
+		date = "2012-05-23" 
+		version = "1.0" 
+		filetype = "memory"
+
+	strings:
+		$a = "webfakes.dll"
+		$b = "config.dat"			//may raise some FP
+		$c = "collectors.txt"
+		$d = "webinjects.txt"
+		$e = "screenshots.txt"
+		$f = "billinghammer.dll"
+		$g = "block.dll"			//may raise some FP
+		$h = "bugreport.dll"		//may raise some FP
+		$i = "ccgrabber.dll"
+		$j = "connector2.dll"
+		$k = "creditgrab.dll"
+		$l = "customconnector.dll"
+		$m = "ffcertgrabber.dll"
+		$n = "ftpbc.dll"
+		$o = "rdp.dll"				//may raise some FP
+		$p = "rt_2_4.dll"
+		$q = "socks5.dll"			//may raise some FP
+		$r = "spySpread.dll"
+		$s = "w2chek4_4.dll"
+		$t = "w2chek4_6.dll"
+	
+	condition:
+		any of them
+}