angtechy.com

artvoice.internetdocss.com

business.internetdocss.com

chinaaid.internetdocss.com

cqyrxy.com

docs.internetdocss.com

epochtimes.internetdocss.com

index.ackques.com

login-live.space

mail-defense.tk

mail-epochtimes.space

ndtv.internetdocss.com

plshl.com

savetibet.internetdocss.com

striker.internetdocss.com

tibet.internetdocss.com

tootopia.internetdocss.com

video.internetdocss.com

webmail-mpt.space

www.apple.internetdocss.com

www.hktechy.com

163.com

steven-jain@outlook.com

www.doc

x86.exe

x64.exe

c:\\windows\\nethelp.dll

index.html

serverdo.exe

e6c0ac26b473d1e0fa9f74fdf1d01af8

3a2b1a98c0a31ed32759f48df34b4bc8

c74608c70a59371cbf016316bebfab06

1412102eda0c2e5a5a85cb193dbb1524

6d1d6987d0677f40e473befab121ab1b

cd32ce54ed94dfbde7fb85930a16597d

d4ea9027edca1d01c62d9f43a2975d30

3697a1f9150de181026ce089c10657c3

bc902a5e56cbbaa82f4af26cf9f4567e

6e109cbbd181ad567b90463d48302c72

17030637d18335c7267d09ec0ebc637c

f34d5f2d4577ed6d9ceec516c1f5a744

122.10.84.146

144.48.220.167

211.44.63.39

27.126.179.156

27.126.179.158

27.126.179.160

http://doc.internetdocss.com/nethelp

http://doc.internetdocss.com/word

import "pe"

rule apt_ZZ_RedAlpha_2017Campaign_nethelp {
	meta:
		desc = "RedAlpha 2017 Campaign, NetHelp Drop"
		author = "JAG-S, Insikt Group, RecordedFuture"
		TLP = "White"
		md5_x86 = "42256b4753724f7feb411bc9912155fd"
		md5_x86 = "6d1d6987d0677f40e473befab121ab1b"
		md5_x64 = "8f0fe2620f8dadf93eee285834e35655"
		md5_x64 = "cd32ce54ed94dfbde7fb85930a16597d"
		md5_x64_striker = "6dd1be1e491d5bf9cd14686c185c3009"
	strings:
		$postreq1 = "POST /index.html HTTP/1.1" ascii wide
		$postreq2 = "Host: index.ackques.com" ascii wide
		$postreq3 = "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 
Chrome /53.0" ascii wide
		$postreq4 = "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*" ascii wide
		$postreq5 = "Accept-Language: en-US;q=0.5,en;q=0.3" ascii wide
		$postreq6 = "Accept-Encoding: gzip, deflate" ascii wide
		$postreq7 = "Content-Type: application/x-www-form-urlencoded" ascii wide
		$postreq8 = "Content-Length: %d" ascii wide
		$postreq9 = "Connection: keep-alive" ascii wide
		$postreq10 = "Upgrade-Insecure-Requests: 1" ascii wide
		$cnc1 = "index.ackques.com" ascii wide
		$cnc2 = "www.hktechy.com" ascii wide
		$cnc3 = "striker.internetdocss.com" ascii wide
		$service1 = "Windows Internet Help" ascii wide
		$service2 = "Client.dll" ascii wide
		$service3 = "ServiceMain" ascii wide
	condition:
		uint16(0) == 0x5A4D and filesize < 500KB and ((pe.imphash() == "bc902a5e56cbbaa82f4af26cf9f4567e" or pe.imphash() == "af5487e77c16d987ca02d59bdcf38489" or pe.imphash() == "6e109cbbd181ad567b90463d48302c72" or pe.imphash() == "df09df6d5ae774f280c43e3cc0e4a142") or (all of ($postreq*) or any of ($cnc*) or all of ($service*)))
}

import "pe"

rule apt_ZZ_RedAlpha_njRat {
	meta:
		author = "JAG-S, Insikt Group, Recorded Future"
		TLP = "White"
		md5 = "c74608c70a59371cbf016316bebfab06"
		date = "04-14-2018"
		desc = "Second-stage njRAT, RedAlpha config"
		version = "1.1"
	strings:
		$installName = "serverdo.exe" wide
		$port = "9527" wide
		$version = "0.7d" wide
		$c2 = "doc.internetdocss.com" wide
	condition:
		uint16(0) == 0x5A4D and filesize < 50KB and pe.imphash() == "f34d5f2d4577ed6d9ceec516c1f5a744" and all of them
}