360.cn

docs.microsoft.com

ncsc.gov.uk

libcurl.dll

searchindexer.exe

svchost.exe

zhudongfangyu.exe

egui.exe

ccsvchst.exe

tmbmsrv.exe

mcshield.exe

ws2_32.dll

kernel32.dll

46077a32e433a56eb8ba64dcbf86bc60

5f983177f3f9ce6cb72088f3da96435d

c1890a6447c991880467b86a013dbeaa66cc615f

f19bb3b49d548bce4d35e9cf83fba112ef8e087a422b86d1376a395466fdff2d

9863ac60b92fad160ce88353760c7c4f21f8e9c3190b18b374bdbca3a7d1a3fb

T1543.003

T1134.001

T1574.002

T1070.004

T1036.005

T1518.001

T1573.001

T1041

https://docs.microsoft.com/en-us/windows/win32/api/winsock/ns-winsock-linger

HKEY_LOCAL_MACHINE\SYSTEM\CurrentContr

import "pe"

rule SparrowDoor_clipshot {
	meta:
		author = "NCSC"
		description = "The SparrowDoor loader contains a feature it calls 
clipshot, which logs clipboard data to a file."
		date = "2022-02-28"
		hash1 = "989b3798841d06e286eb083132242749c80fdd4d"
	strings:
		$exsting_cmp = { 8B 1E 3B 19 75 ?? 83 E8 04 83 C1 04 83 C6 04 83 F8 04 }
		$time_format_string = "%d/%d/%d %d:%d"
		$cre_fil_args = { 6A 00 68 80 00 00 00 6A 04 6A 00 6A 02 68 00 00 00 40 52 }
	condition:
		(uint16(0) == 0x5A4D) and uint32(uint32(0x3C)) == 0x00004550 and all of them and (pe.imports("User32.dll", "OpenClipboard") and pe.imports("User32.dll", "GetClipboardData") and pe.imports("Kernel32.dll", "GetLocalTime") and pe.imports("Kernel32.dll", "GlobalSize"))
}

rule SparrowDoor_shellcode {
	meta:
		author = "NCSC"
		description = "Targets code features of the reflective loader for 
SparrowDoor. Targeting in memory."
		date = "2022-02-28"
		hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
	strings:
		$peb = { 8B 48 08 89 4D FC 8B 51 3C 8B 54 0A 78 8B 74 0A 20 03 D1 03 F1 B3 64 }
		$getp_match = { 8B 06 03 C1 80 38 47 75 34 80 78 01 65 75 2E 80 78 02 74 75 28 80 78 03 50 75 22 80 78 04 72 75 1C 80 78 06 63 75 16 80 78 05 6F 75 10 80 78 07 41 75 0A }
		$k_check = { 8B 48 20 8A 09 80 F9 6B 74 05 80 F9 4B 75 05 }
		$resolve_load_lib = { C7 45 C4 4C 6F 61 64 C7 45 C8 4C 69 62 72 C7 45 CC 61 72 79 41 C7 45 D0 00 00 00 00 FF 75 FC FF 55 E4 }
	condition:
		3 of them
}

rule SparrowDoor_xor {
	meta:
		author = "NCSC"
		description = "Highlights XOR routines in SparrowDoor. No MZ/PE 
match as the backdoor has no header. Targeting in memory."
		date = "2022-02-28"
		hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
	strings:
		$xor_routine_outbound = { B8 39 8E E3 38 F7 E1 D1 EA 8D 14 D2 8B C1 2B C2 8A [4] 00 30 14 39 41 3B CE }
		$xor_routine_inbound = { B8 25 49 92 24 F7 E1 8B C1 2B C2 D1 E8 03 C2 C1 E8 02 8D 14 C5 [4] 2B D0 8B C1 2B C2 }
		$xor_routine_config = { 8B D9 83 E3 07 0F [6] 30 18 8D 1C 07 83 E3 07 0F [6] 30 58 01 8D 1C 28 83 E3 07 0F [6] 30 58 02 8D 1C 02 83 E3 07 0F [6] 30 58 03 8B DE 83 E3 07 0F [6] 30 58 04 83 C6 05 83 C1 05 }
	condition:
		2 of them
}