www.fbi.gov

adversary.crowdstrike.com

news.sophos.com

nakedsecurity.sophos.com

sourceforge.net

general.one

blog.malwarebytes.com

www.vmray.com

www.abuseipdb.com

attack.mitre.org

o76s3m7l5ogig4u5.onion

ixltdyumdlthrtgx.onion

eclipso.ch

tutanota.com

cock.li

secmail.pro

bingoshow.xyz

news.pocketstay.com

login.wwpcrisis.com

nodes.fioressence.com

office.drpease.com

lafeedback.com

twimg-us.azureedge.net

cdn.auditor.adobe.com

roofingspecialists.info

pieceofheavenptc.info

newschools.info

potasip.com

advancedanalysis.be

67146@eclipso.ch

61258@eclipso.ch

78470@tutanota.com

98722@airmail.cc

rickhood@armormail.net

chooc9@secmail.pro

rei5ah@protonmail.com

ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html

c:\windows\system32\notepad.exe

vssadmin.exe

recycle.bin

payloadbin-readme.txt

c:\users\lucas\documents\onenote notebooks\personal\contact-to-decrypt.txt

c:\users\lucas\desktop\ppt_ch10.ppt

wsqmcons.exe

bromium-emotet-technical-analysis-report.pdf

classicstartmenu.exe

mod_c.exe

smpl.tmp

cobaltstrike_2.txt

trustedikstaller.exe

hexba8.tmp

ie4uinit.exe

hfiref0x

antonio-s1

2F5338DABD40348C71D858459FE7B8ED

a21562f8f1177e17d7975065d13ff0182cbef1c2

b4061d4227e08cfaa3190dea9926571fca2736a1

c9b25177db2f6eaddb4b028a9284b4fb5c3ffcd0

e23637ea81751e558fca17ef1a54b6e39d2e83c3

3cb0cb07cc2542f1d98060adccda726ea865db98

f8fc84030c579070b36c99c836ac4b5c32bbc2c4

fe0c77959bc7c016a49f71c765de947e3294a667

763d356d30e81d1cd15f6bc6a31f96181edb0b8f

c3154048ac74ceac75fdc62820ef66f1bdb31334

f6d738baea6802cbbb3ae63b39bf65fbd641a1f0d2f0c819a8c56f677b97bed1

185.82.127.86

37.48.84.156

79.110.52.138

195.189.96.41

138.124.180.216

185.250.151.33

54.192.229.106

54.192.229.43

T1584.004

T1047

T1106

T1584

T1134.001

T1027.004

T1218

T1027.005

T1562

T1497

T1553.002

T1036.005

T1087.002

T1553

T1558

T1069.002

T1135

T1105

T1069

https://twitter.com/nca_uk/status/1202618928209498114?s=20

https://home.treasury.gov/news/press-releases/sm845

https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2

https://awakesecurity.com/blog/incident-response-hades-ransomware-gang-or-hafnium

https://www.crowdstrike.com/blog/hades-ransomware-successor-to-indrik-spiders-wastedlocker

https://www.zdnet.com/article/hacker-gang-behind-garmin-attack-doesnt-have-a-history-of-stealing-user-data/?&web_view=true

https://www.trendmicro.com/it_it/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html

https://github.com/hfiref0x/uacme

https://blog.morphisec.com/bitpaymer-ransomware-with-new-custom-packer-framework

https://techcrunch.com/2021/10/12/olympus-confirms-us-cyberattack-weeks-after-blackmatter-ransomware-hit-emea-systems

https://www.bleepingcomputer.com/news/security/evil-corp-demands-40-million-in-new-macaw-ransomware-attacks

https://www.bromium.com/wp-content/uploads/2019/07/bromium-emotet-technical-analysis-report.pdf

https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software

https://www.vmray.com/cyber-security-blog/wastedlocker-ransomware-threat-bulletin

https://www.accenture.com/us-en/blogs/cyber-defense/unknown-threat-group-using-hades-ransomware

https://www.abuseipdb.com/check/185.82.127.86

https://www.securonix.com/securonix-threat-research-detecting-wastedlocker-ransomware-using-security-analytics

https://attack.mitre.org/techniques/t1584/004

https://attack.mitre.org/techniques/t1047

https://attack.mitre.org/techniques/t1106

https://attack.mitre.org/techniques/t1134/001

https://attack.mitre.org/techniques/t1027/004

https://attack.mitre.org/techniques/t1218

https://attack.mitre.org/techniques/t1027/002

https://attack.mitre.org/techniques/t1564

https://attack.mitre.org/techniques/t1480

https://attack.mitre.org/techniques/t1558/003

https://attack.mitre.org/techniques/t1482

https://attack.mitre.org/techniques/t1083

https://attack.mitre.org/techniques/t1087/001

https://attack.mitre.org/techniques/t1486

https://t.me/phdecrypt

rule CryptOne {
	meta:
		Author = "@Tera0017/@SentinelOne"
		Family = "Evil Corp Packer-CryptOne"
	strings:
		$x86_code1 = { 68 FC 4A 06 00 68 F4 E0 01 00 E8 }
		$x86_code2 = { 6A 15 E8 [4] 83 C4 04 A3 [4] 68 45 7E 00 00 }
		$x86_code3 = { 83 C4 08 8B 55 ?? 8B 45 ?? 8D 8C 10 [4] 89 }
		$x64_code1 = { C7 ?? ?? ?? 05 0D 00 00 }
		$x64_code2 = { 48 03 44 24 48 48 03 44 24 48 48 03 44 24 48 48 03 44 24 48 }
		$x64_code3 = { 41 8D 84 03 ?? ?? 00 00 }
		$str1 = "\\{aa5b6a80-b834-11d0-932f-00a0c90dcaa9}"
		$str2 = "\\{b196b287-bab4-101a-b69c-00aa00341d07}"
	condition:
		(all of ($x64*)) or (all of ($x86*)) or (any of ($str*) and (2 of ($x64*) or 2 of ($x86*)))
}

rule MAL_JS_SocGholish_Mar21_1 : js socgholish {
	meta:
		description = "Triggers on SocGholish JS files"
		author = "Nils Kuhnert"
		date = "2021-03-29"
		hash = "7ccbdcde5a9b30f8b2b866a5ca173063dec7bc92034e7cf10e3eebff017f3c23"
		hash = "f6d738baea6802cbbb3ae63b39bf65fbd641a1f0d2f0c819a8c56f677b97bed1"
		hash = "c7372ffaf831ad963c0a9348beeaadb5e814ceeb878a0cc7709473343d63a51c"
	strings:
		$try = "try"
		$s1 = "new ActiveXObject('Scripting.FileSystemObject');"
		$s2 = "['DeleteFile']"
		$s3 = "['WScript']['ScriptFullName']"
		$s4 = "['WScript']['Sleep'](1000)"
		$s5 = "new ActiveXObject('MSXML2.XMLHTTP')"
		$s6 = "this['eval']"
		$s7 = "String['fromCharCode']"
		$s8 = "2), 16),"
		$s9 = "= 103,"
		$s10 = "'00000000'"
	condition:
		$try in (0 .. 10) and filesize > 3KB and filesize < 5KB and 8 of ($s*)
}

rule PayloadBin_digital_cert {
	meta:
		Author = "SentinelLabs"
		Family = "Evil Corp PayloadBIN digital cert signature"
	strings:
		$signer1 = "TAKE CARE SP Z O O"
		$serial1 = { 00 98 9A 33 B7 2A 2A A2 9E 32 D0 A5 E1 55 C5 39 63 }
	condition:
		(int16(0) == 0x5A4D) and (($signer1) and ($serial1))
}