cve-2019-19781

cve-2018-13379

botlib.work

botlib.new

agent.sh

nvd.nist.gov

www.botconf.eu

botlib.key

malware-wellmes-9b78.html

2b6233eb3e872ff78988f4a8f3f6a3ba

00654dd07721e7551641f90cba832e98c0acb030e2848e5efc0e1752c067ec07

03e9adae529155961f1f18212ff70181bde0e3da3d7f22961a6e2b1c9da2dd2e

14e9b5e214572cb13ff87727d680633f5ee238259043357c94302654c546cad2

21129ad17800b11cdb36906ba7f6105e3bd1cf44575f77df58ba91640ba0cab9

2daba469f50cd1b77481e605aeae0f28bf14cedfcd8e4369193e5e04c523bc38

4c8671411da91eb5967f408c2a6ff6baf25ff7c40c65ff45ee33b352a711bf9c

797159c202ca41356bee18c5303d37e9d2a43ca43d0ce02e1fd9e7045b925d11

84b846a42d94431520d3d2d14262f3d3a5d96762e56b0ae471b853d1603ca403

92a856a2216e107496ee086e1c8cfe14e15145e7a247539815fd37e5a18b84d9

953b5fc9977e2d50f3f72c6ce85e89428937117830c0ed67d468e2d93aa7ec9a

a117b2a904c24df62581500176183fbc282a740e4f11976cdfc01fe664a02292

b75a5be703d9ba3721d046db80f62886e10009b455fa5cdfd73ce78f9f53ec5a

c1a0b73bad4ca30a5c18db56c1cba4f5db75f3d53daf62ddc598aae2933345f3

dd3da0c596fd699900cdd103f097fe6614ac69787edfa6fa84a8f471ecb836bb

e3d6057b4c2a7d8fa7250f0781ea6dab4a977551c13fe2f0a86f3519b2aaee7a

f622d031207d22c633ccec187a24c50980243cb4717d21fad6588dacbf9c29e9

83014ab5b3f63b0253cdab6d715f5988ac9014570fa4ab2b267c7cf9ba237d18

58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2

a4b790ddffb3d2e6691dcacae08fb0bfa1ae56b6c73d70688b097ffa831af064

103.103.128.221

103.205.8.72

103.253.41.68

103.253.41.90

111.90.146.143

119.160.234.163

119.81.173.130

120.53.12.132

122.114.226.172

141.98.212.55

146.0.76.37

169.239.128.110

178.211.39.6

185.145.128.35

191.101.180.78

193.182.144.105

209.58.186.196

209.58.186.240

27.102.130.115

31.7.63.141

45.123.190.167

45.152.84.57

5.199.174.164

79.141.168.109

85.93.2.116

185.225.226.16

45.129.229.48

https://www.ncsc.gov.uk/news/citrix-alert

https://nvd.nist.gov/vuln/detail/cve-2019-9670

https://www.botconf.eu/wp-content/uploads/2018/12/2018-y-ishikawa-s-nagano-

https://www.ncsc.gov.uk/guidance/multi-factor-authentication-online-

https://www.ncsc.gov.uk/phishing

https://www.ncsc.gov.uk/guidance/preventing-lateral-movement

rule wellmess_botlib_function_names {
	meta:
		description = "Rule to detect WellMess Golang samples based on 
the function names used by the actor"
		author = "NCSC"
		hash = "8749c1495af4fd73ccfc84b32f56f5e78549d81feefb0c1d1c3475a74345f6a8"
	strings:
		$s1 = "botlib.wellMess" ascii wide
		$s2 = "botlib.saveFile" ascii wide
		$s3 = "botlib.reply" ascii wide
		$s4 = "botlib.init" ascii wide
		$s5 = "botlib.generateRandomString" ascii wide
		$s6 = "botlib.encrypt" ascii wide
		$s7 = "botlib.deleteFile" ascii wide
		$s8 = "botlib.convertFromString" ascii wide
		$s9 = "botlib.chunksM" ascii wide
		$s10 = "botlib.Work" ascii wide
		$s11 = "botlib.UnpackB" ascii wide
		$s12 = "botlib.Unpack" ascii wide
		$s13 = "botlib.UDFile" ascii wide
		$s14 = "botlib.Split" ascii wide
		$s15 = "botlib.Service" ascii wide
		$s16 = "botlib.SendMessage" ascii wide
		$s17 = "botlib.Send.func1" ascii wide
		$s18 = "botlib.Send" ascii wide
		$s19 = "botlib.ReceiveMessage" ascii wide
		$s20 = "botlib.RandStringBytes" ascii wide
		$s21 = "botlib.RandInt" ascii wide
		$s22 = "botlib.Post" ascii wide
		$s23 = "botlib.Parse" ascii wide
		$s24 = "botlib.Pad" ascii wide
		$s25 = "botlib.Pack" ascii wide
		$s26 = "botlib.New" ascii wide
		$s27 = "botlib.KeySizeError.Error" ascii wide
		$s28 = "botlib.Key" ascii wide
		$s29 = "botlib.Join" ascii wide
		$s30 = "botlib.GetRandomBytes" ascii wide
		$s31 = "botlib.GenerateSymmKey" ascii wide
		$s32 = "botlib.FromNormalToBase64" ascii wide
		$s33 = "botlib.EncryptText" ascii wide
		$s34 = "botlib.Download" ascii wide
		$s35 = "botlib.Decipher" ascii wide
		$s36 = "botlib.Command" ascii wide
		$s37 = "botlib.Cipher" ascii wide
		$s38 = "botlib.CalculateMD5Hash" ascii wide
		$s39 = "botlib.Base64ToNormal" ascii wide
		$s40 = "botlib.AES_Encrypt" ascii wide
		$s41 = "botlib.AES_Decrypt" ascii wide
		$s42 = "botlib.(*rc6cipher).Encrypt" ascii wide
		$s43 = "botlib.(*rc6cipher).Decrypt" ascii wide
		$s44 = "botlib.(*rc6cipher).BlockSize" ascii wide
		$s45 = "botlib.(*KeySizeError).Error" ascii wide
		$s46 = "botlib.DownloadDNS" ascii wide
		$s47 = "botlib.JoinDnsChunks" ascii wide
		$s48 = "botlib.SendDNS" ascii wide
		$s49 = "botlib.CreateDNSName" ascii wide
	condition:
		((uint16(0) == 0x5a4d and uint16(uint16(0x3c)) == 0x4550) or uint32(0) == 0x464c457f) and any of them
}

rule wellmess_regex_used_for_parsing_beacons {
	meta:
		description = "Detects WellMess Golang and .NET samples based 
on the regex they used to parse commands and beacon information"
		author = "NCSC"
		hash = "8749c1495af4fd73ccfc84b32f56f5e78549d81feefb0c1d1c3475a74345f6a8"
	strings:
		$a = "fileName:(?<fn>.*?)\\sargs:(?<arg>.*)\\snotwait:(?<nw>.*)" ascii wide
		$b = "<;(?<key>[^;]*?);>(?<value>[^<]*?)<;[^;]*?;>" ascii wide
	condition:
		((uint16(0) == 0x5a4d and uint16(uint16(0x3c)) == 0x4550) or uint32(0) == 0x464c457f) and any of them
}

rule wellmail_certificate_base64_snippets {
	meta:
		description = "Rule for detection of WellMail based on base64 
snippets of certificates used"
		author = "NCSC"
		hash = "0c5ad1e8fe43583e279201cdb1046aea742bae59685e6da24e963a41df987494"
	strings:
		$a1 = "BgNVHQ4EBwQFAQIDBA"
		$a2 = "YDVR0OBAcEBQECAwQG"
		$a3 = "GA1UdDgQHBAUBAgMEB"
		$b1 = "BgNVBAoTE0dNTyBHbG9iYWxTaWduLCBJbm"
		$b2 = "YDVQQKExNHTU8gR2xvYmFsU2lnbiwgSW5j"
		$b3 = "GA1UEChMTR01PIEdsb2JhbFNpZ24sIEluY"
	condition:
		uint32(0) == 0x464C457F and any of ($a*) and any of ($b*)
}

rule sorefang_encryption_key_2b62 {
	meta:
		description = "Rule to detect SoreFang based on hardcoded 
encryption key"
		author = "NCSC"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
	strings:
		$ = "2b6233eb3e872ff78988f4a8f3f6a3ba"
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them
}

rule sorefang_command_elem_cookie_ga_boundary_string {
	meta:
		description = "Rule to detect SoreFang based on scheduled task 
element and Cookie header/boundary strings"
		author = "NCSC"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
	strings:
		$ = "<Command>" wide
		$ = "Cookie:_ga="
		$ = "------974767299852498929531610575"
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 2 of them
}

rule sorefang_add_random_commas_spaces {
	meta:
		description = "Rule to detect SoreFang based on function that 
adds commas and spaces"
		author = "NCSC"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
	strings:
		$ = { E8 ?? ?? ?? ?? B9 06 00 00 00 99 F7 F9 8B CE 83 FA 04 7E 09 6A 02 68 ?? ?? ?? ?? EB 07 6A 01 68 ?? ?? ?? ?? }
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them
}

rule sorefang_custom_encode_decode {
	meta:
		description = "Rule to detect SoreFang based on the custom 
encoding/decoding algorithm function"
		author = "NCSC"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
	strings:
		$ = { 55 8B EC 8B D1 53 56 8B 75 08 8B DE 80 42 62 FA 8A 4A 62 66 D3 EB 57 3A 5A 5C 74 0F }
		$ = { 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE C1 88 4A 62 8A 4A 62 B8 01 00 00 00 }
		$ = { 8A 46 62 84 C0 74 3E 3C 06 73 12 0F B6 C0 B9 06 00 00 00 2B C8 C6 46 62 06 66 D3 66 60 0F B7 4E 60 }
		$ = { 80 3C 38 0D 0F 84 93 01 00 00 C6 42 62 06 8B 56 14 83 FA 10 72 04 8B 06 }
		$ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5B 3B C8 75 07 8B 55 EC B3 3E }
		$ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5E 3B C8 75 0B 8B 55 EC D0 EB C6 42 62 05 }
		$ = { 8B 55 EC 0F BE 04 38 0F B6 DB 0F B6 4A 5F 3B C1 B8 3F 00 00 00 0F 44 D8 }
		$ = { 8A 4A 62 66 8B 52 60 66 D3 E2 0F B6 C3 66 0B D0 8B 45 EC 66 89 50 60 8A 45 F3 02 C1 88 45 F3 3C 08 72 2E 04 F8 8A C8 88 45 F3 66 D3 EA 8B 4D 08 0F B6 C2 50 }
		$ = { 3A 5A 5C 74 0F 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE C1 88 4A 62 }
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them
}

rule sorefang_disk_enumeration_strings {
	meta:
		description = "Rule to detect SoreFang based on disk 
enumeration strings"
		author = "NCSC"
		hash = "a4b790ddffb3d2e6691dcacae08fb0bfa1ae56b6c73d70688b097ffa831af064"
	strings:
		$ = "\x0D\x0AFree on disk: "
		$ = "Total disk: "
		$ = "Error in GetDiskFreeSpaceEx\x0D\x0A"
		$ = "\x0D\x0AVolume label: "
		$ = "Serial number: "
		$ = "File system: "
		$ = "Error in GetVolumeInformation\x0D\x0A"
		$ = "I can not het information about this disk\x0D\x0A"
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
}