jsac.jpcert.or.jp

blog.trendmicro.co.jp

www.rare-coisns.com

ncscinfoleg@ncsc.gov.uk

0x2b28b200000.dmp

2b28af80000-2b28af92fff.dmp

0b182464a2351a9d79c1222bb1fdf35e.dll

rec.dll

kernel32.dll

vmwarehostopen.exe

www.rar

httpswin32.dll

bbc49eac5b7c30708704233416694591

d40a4f0b426b5500d0e7e331f99c6aca

c0e649fa591ed6c5746d394cb2de3c72

037261d5571813b9640921afac8aafbe

8fd99d9066020003358aa3e23c9af3d4911ce979

266852db4ad2d293469515820fd5e7c228cd4b3e

d2b8f4fe6eedb8b87521772fc823da596f2403b7

e74affd6c766156e3fe803917f28da08fe7000ef

41daf4c86e14da87bf2f94b36115a1e7da76d14af0aba0c251bb3e9dbfb40bad

79024943b61d9c7fe7f8e225f2825ee4fbdeb6dcf2ecdfda3f6414bd6f87bf32

83030f299a776114878bcd2ade585d97836ef4ddb6943cb796be2c88bcb83a83

9d6e14cd244f6c49e11d2b47f12116b5848aaed7a6aaa218fb023b33f7c12a3b

206.189.46.22

T1129

T1055.009

T1083

T1016

T1071.001

T1573

https://www.mandiant.com/resources/precalculated-string-hashes-reverse-engineering-shellcode

https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

rule BusyBuzzard_command_switching_and_ok_response {
	meta:
		author = "NCSC"
		description = "Detects code bytes used by Busy Buzzard to switch 
between the different commands, as well as a test for an 'ok' response 
from the C2 server"
		date = "2022-03-25"
		hash1 = "8fd99d9066020003358aa3e23c9af3d4911ce979"
		hash2 = "266852db4ad2d293469515820fd5e7c228cd4b3e"
		hash3 = "d2b8f4fe6eedb8b87521772fc823da596f2403b7"
		hash4 = "6a673508d46c0bbff74ee24384c8bc841c11ea4d"
		hash5 = "e74affd6c766156e3fe803917f28da08fe7000ef"
		hash6 = "48152eeb1d74a84ba86b34f419cf1c7a105e41ff"
	strings:
		$tcp = { 3C 64 74 ?? 3C 66 74 ?? 3C 6C 74 ?? 3C 73 75 ?? 8D 57 FB 48 8D 4B 05 E8 }
		$http1 = { 3C 64 74 ?? 3C 73 }
		$http2 = { 80 3B 6F 75 ?? 80 7B 01 6B 74 }
	condition:
		$tcp or (all of ($http*))
}

rule BusyBuzzard_original_dll_names {
	meta:
		author = "NCSC"
		description = "Detects Busy Buzzard original DLL names embedded 
within the binary"
		date = "2022-03-25"
		hash1 = "8fd99d9066020003358aa3e23c9af3d4911ce979"
		hash2 = "266852db4ad2d293469515820fd5e7c228cd4b3e"
		hash3 = "6a673508d46c0bbff74ee24384c8bc841c11ea4d"
		hash4 = "e74affd6c766156e3fe803917f28da08fe7000ef"
		hash5 = "48152eeb1d74a84ba86b34f419cf1c7a105e41ff"
	strings:
		$ = "httpsWin32.dll\x00"
		$ = "tcpcX64.dll\x00"
	condition:
		any of them
}

rule BusyBuzzard_https_cmd_response_stack_strings {
	meta:
		author = "NCSC"
		description = "Detects command response strings, built on the 
stack, used by the HTTPS variant of Busy Buzzard"
		date = "2022-03-25"
		hash1 = "6a673508d46c0bbff74ee24384c8bc841c11ea4d"
		hash2 = "e74affd6c766156e3fe803917f28da08fe7000ef"
		hash3 = "48152eeb1d74a84ba86b34f419cf1c7a105e41ff"
	strings:
		$ = { C7 ( 45 ?? | 85 ?? ?? ?? ?? ) 63 6D 64 3D }
		$ = { C7 ( 45 ?? | 85 ?? ?? ?? ?? ) 26 74 79 70 66 C7 ( 45 ?? | 85 ?? ?? ?? ?? ) 65 3D }
		$ = { C7 ( 45 ?? | 85 ?? ?? ?? ?? ) 26 72 65 74 66 C7 ( 45 ?? | 85 ?? ?? ?? ?? ) 3D 00 }
	condition:
		all of them
}

rule BusyBuzzard_shellcode_loader_x64 {
	meta:
		author = "NCSC"
		description = "Detects code bytes used for resolving function 
addresses in the Busy Buzzard shellcode loader"
		date = "2022-03-25"
		hash1 = "8fd99d9066020003358aa3e23c9af3d4911ce979"
		hash2 = "266852db4ad2d293469515820fd5e7c228cd4b3e"
	strings:
		$ = { 3D 67 65 74 70 }
		$ = { 3D 64 64 72 65 }
		$ = { C7 45 50 49 73 42 61 }
		$ = { C7 45 54 64 52 65 61 }
		$ = { C7 45 58 64 50 74 72 }
		$ = { C7 45 20 49 6D 61 67 }
		$ = { C7 45 24 65 52 76 61 }
		$ = { C7 45 28 54 6F 56 61 }
		$ = { 48 C7 C0 30 00 00 00 65 48 8B 00 48 8B 40 60 48 8B 40 18 48 8B 40 10 48 8B 00 48 8B 00 48 8B 40 30 C3 }
	condition:
		all of them
}

import "pe"

rule identify_kernel32_version {
	condition:
		(uint16(0) == 0x5a4d) and pe.is_dll() and pe.is_64bit() and (pe.export_details[pe.exports_index("GetProcAddress")].offset == pe.rva_to_offset(0x19d70)) and (pe.export_details[pe.exports_index("LoadLibraryA")].offset == pe.rva_to_offset(0x1f560)) and (pe.export_details[pe.exports_index("VirtualAlloc")].offset == pe.rva_to_offset(0x1b220)) and (pe.export_details[pe.exports_index("VirtualFree")].offset == pe.rva_to_offset(0x1b970))
}