cve-2019-11510

cve-2019-9670

botlib.post

botlib.download

www.ncsc.gov.uk

blogs.jpcert.or.jp

botlib.ini

main.zip

lets-go-with-a-go-rat-_final.pdf

042a51567eea19d5aca71050b4535d33d2ed43ba

0322c4c2d511f73ab55bf3f43b1b0f152188d7146cc67ff497ad275d9dd1c20f

0b8e6a11adaa3df120ec15846bb966d674724b6b92eae34d63b665e0698e0193

1fed2e1b077af08e73fb5ecffd2e5169d5289a825dcaf2d8742bb8030e487641

2285a264ffab59ab5a1eb4e2b9bcab9baf26750b6c551ee3094af56a4442ac41

49bfff6b91ee71bbf8fd94829391a36b844ffba104c145e01c92732ada52c8ba

5ca4a9f6553fea64ad2c724bf71d0fac2b372f9e7ce2200814c98aac647172fb

7c39841ba409bce4c2c35437ecf043f22910984325c70b9530edf15d826147ee

8749c1495af4fd73ccfc84b32f56f5e78549d81feefb0c1d1c3475a74345f6a8

93e9383ae8ad2371d457fc4c1035157d887a84bbfe66fbbb3769c5637de59c75

a03a71765b1b0ea7de4fbcb557dcfa995ff9068e92db9b2dada9dd0841203145

a3ca47e1083b93ea90ace1ca30d9ef71163e8a95ee00500cbd3fd021da0c18af

bec1981e422c1e01c14511d384a33c9bcc66456c1274bbbac073da825a3f537d

d7e7182f498440945fc8351f0e82ad2d5844530ebdba39051d2205b730400381

e329607379a01483fc914a47c0062d5a3a8d8d65f777fbad2c5a841a90a0af09

f3af394d9c3f68dff50b467340ca59a11a14a3d56361e6cffd1cf2312a7028ad

fd3969d32398bbe3709e9da5f8326935dde664bbc36753bd41a0b111712c0950

0c5ad1e8fe43583e279201cdb1046aea742bae59685e6da24e963a41df987494

65495d173e305625696051944a36a031ea94bb3a4f13034d8be740982bc4ab75

103.216.221.19

103.13.240.46

103.253.41.102

103.253.41.82

103.73.188.101

111.90.150.176

119.160.234.194

119.81.178.105

122.114.197.185

141.255.164.29

145.249.107.73

149.202.12.210

176.119.29.37

185.120.77.166

185.99.133.112

192.48.88.107

202.59.9.59

209.58.186.197

220.158.216.130

31.170.107.186

45.120.156.69

45.152.84.57

5.199.174.164

79.141.168.109

85.93.2.116

185.225.226.16

45.129.229.48

https://www.ncsc.gov.uk/news/citrix-alert

https://nvd.nist.gov/vuln/detail/cve-2019-9670

https://www.botconf.eu/wp-content/uploads/2018/12/2018-y-ishikawa-s-nagano-

https://www.ncsc.gov.uk/guidance/multi-factor-authentication-online-

https://www.ncsc.gov.uk/phishing

https://www.ncsc.gov.uk/guidance/preventing-lateral-movement

rule wellmess_botlib_function_names {
	meta:
		description = "Rule to detect WellMess Golang samples based on the 
function names used by the actor"
		author = "NCSC"
		hash = "8749c1495af4fd73ccfc84b32f56f5e78549d81feefb0c1d1c3475a74345f6a8"
	strings:
		$s1 = "botlib.wellMess" ascii wide
		$s2 = "botlib.saveFile" ascii wide
		$s3 = "botlib.reply" ascii wide
		$s4 = "botlib.init" ascii wide
		$s5 = "botlib.generateRandomString" ascii wide
		$s6 = "botlib.encrypt" ascii wide
		$s7 = "botlib.deleteFile" ascii wide
		$s8 = "botlib.convertFromString" ascii wide
		$s9 = "botlib.chunksM" ascii wide
		$s10 = "botlib.Work" ascii wide
		$s11 = "botlib.UnpackB" ascii wide
		$s12 = "botlib.Unpack" ascii wide
		$s13 = "botlib.UDFile" ascii wide
		$s14 = "botlib.Split" ascii wide
		$s15 = "botlib.Service" ascii wide
		$s16 = "botlib.SendMessage" ascii wide
		$s17 = "botlib.Send.func1" ascii wide
		$s18 = "botlib.Send" ascii wide
		$s19 = "botlib.ReceiveMessage" ascii wide
		$s20 = "botlib.RandStringBytes" ascii wide
		$s21 = "botlib.RandInt" ascii wide
		$s22 = "botlib.Post" ascii wide
		$s23 = "botlib.Parse" ascii wide
		$s24 = "botlib.Pad" ascii wide
		$s25 = "botlib.Pack" ascii wide
		$s26 = "botlib.New" ascii wide
		$s27 = "botlib.KeySizeError.Error" ascii wide
		$s28 = "botlib.Key" ascii wide
		$s29 = "botlib.Join" ascii wide
		$s30 = "botlib.GetRandomBytes" ascii wide
		$s31 = "botlib.GenerateSymmKey" ascii wide
		$s32 = "botlib.FromNormalToBase64" ascii wide
		$s33 = "botlib.EncryptText" ascii wide
		$s34 = "botlib.Download" ascii wide
		$s35 = "botlib.Decipher" ascii wide
		$s36 = "botlib.Command" ascii wide
		$s37 = "botlib.Cipher" ascii wide
		$s38 = "botlib.CalculateMD5Hash" ascii wide
		$s39 = "botlib.Base64ToNormal" ascii wide
		$s40 = "botlib.AES_Encrypt" ascii wide
		$s41 = "botlib.AES_Decrypt" ascii wide
		$s42 = "botlib.(*rc6cipher).Encrypt" ascii wide
		$s43 = "botlib.(*rc6cipher).Decrypt" ascii wide
		$s44 = "botlib.(*rc6cipher).BlockSize" ascii wide
		$s45 = "botlib.(*KeySizeError).Error" ascii wide
		$s46 = "botlib.DownloadDNS" ascii wide
		$s47 = "botlib.JoinDnsChunks" ascii wide
		$s48 = "botlib.SendDNS" ascii wide
		$s49 = "botlib.CreateDNSName" ascii wide
	condition:
		((uint16(0) == 0x5a4d and uint16(uint16(0x3c)) == 0x4550) or uint32(0) == 0x464c457f) and any of them
}

rule wellmess_regex_used_for_parsing_beacons {
	meta:
		description = "Detects WellMess Golang and .NET samples based on the 
regex they used to parse commands and beacon information"
		author = "NCSC"
		hash = "8749c1495af4fd73ccfc84b32f56f5e78549d81feefb0c1d1c3475a74345f6a8"
	strings:
		$a = "fileName:(?<fn>.*?)\\sargs:(?<arg>.*)\\snotwait:(?<nw>.*)" ascii wide
		$b = "<;(?<key>[^;]*?);>(?<value>[^<]*?)<;[^;]*?;>" ascii wide
	condition:
		((uint16(0) == 0x5a4d and uint16(uint16(0x3c)) == 0x4550) or uint32(0) == 0x464c457f) and any of them
}

rule wellmail_certificate_base64_snippets {
	meta:
		description = "Rule for detection of WellMail based on base64 
snippets of certificates used"
		author = "NCSC"
		hash = "0c5ad1e8fe43583e279201cdb1046aea742bae59685e6da24e963a41df987494"
	strings:
		$a1 = "BgNVHQ4EBwQFAQIDBA"
		$a2 = "YDVR0OBAcEBQECAwQG"
		$a3 = "GA1UdDgQHBAUBAgMEB"
		$b1 = "BgNVBAoTE0dNTyBHbG9iYWxTaWduLCBJbm"
		$b2 = "YDVQQKExNHTU8gR2xvYmFsU2lnbiwgSW5j"
		$b3 = "GA1UEChMTR01PIEdsb2JhbFNpZ24sIEluY"
	condition:
		uint32(0) == 0x464C457F and any of ($a*) and any of ($b*)
}

rule sorefang_encryption_key_2b62 {
	meta:
		description = "Rule to detect SoreFang based on hardcoded encryption 
key"
		author = "NCSC"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
	strings:
		$ = "2b6233eb3e872ff78988f4a8f3f6a3ba"
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them
}

rule sorefang_command_elem_cookie_ga_boundary_string {
	meta:
		description = "Rule to detect SoreFang based on scheduled task 
element and Cookie header/boundary strings"
		author = "NCSC"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
	strings:
		$ = "<Command>" wide
		$ = "Cookie:_ga="
		$ = "------974767299852498929531610575"
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 2 of them
}

rule sorefang_add_random_commas_spaces {
	meta:
		description = "Rule to detect SoreFang based on function that adds 
commas and spaces"
		author = "NCSC"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
	strings:
		$ = { E8 ?? ?? ?? ?? B9 06 00 00 00 99 F7 F9 8B CE 83 FA 04 7E 09 6A 02 68 ?? ?? ?? ?? EB 07 6A 01 68 ?? ?? ?? ?? }
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them
}

rule sorefang_custom_encode_decode {
	meta:
		description = "Rule to detect SoreFang based on the custom 
encoding/decoding algorithm function"
		author = "NCSC"
		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
	strings:
		$ = { 55 8B EC 8B D1 53 56 8B 75 08 8B DE 80 42 62 FA 8A 4A 62 66 D3 EB 57 3A 5A 5C 74 0F }
		$ = { 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE C1 88 4A 62 8A 4A 62 B8 01 00 00 00 }
		$ = { 8A 46 62 84 C0 74 3E 3C 06 73 12 0F B6 C0 B9 06 00 00 00 2B C8 C6 46 62 06 66 D3 66 60 0F B7 4E 60 }
		$ = { 80 3C 38 0D 0F 84 93 01 00 00 C6 42 62 06 8B 56 14 83 FA 10 72 04 8B 06 }
		$ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5B 3B C8 75 07 8B 55 EC B3 3E }
		$ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5E 3B C8 75 0B 8B 55 EC D0 EB C6 42 62 05 }
		$ = { 8B 55 EC 0F BE 04 38 0F B6 DB 0F B6 4A 5F 3B C1 B8 3F 00 00 00 0F 44 D8 }
		$ = { 8A 4A 62 66 8B 52 60 66 D3 E2 0F B6 C3 66 0B D0 8B 45 EC 66 89 50 60 8A 45 F3 02 C1 88 45 F3 3C 08 72 2E 04 F8 8A C8 88 45 F3 66 D3 EA 8B 4D 08 0F B6 C2 50 }
		$ = { 3A 5A 5C 74 0F 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE C1 88 4A 62 }
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them
}

rule sorefang_disk_enumeration_strings {
	meta:
		description = "Rule to detect SoreFang based on disk enumeration 
strings"
		author = "NCSC"
		hash = "a4b790ddffb3d2e6691dcacae08fb0bfa1ae56b6c73d70688b097ffa831af064"
	strings:
		$ = "\x0D\x0AFree on disk: "
		$ = "Total disk: "
		$ = "Error in GetDiskFreeSpaceEx\x0D\x0A"
		$ = "\x0D\x0AVolume label: "
		$ = "Serial number: "
		$ = "File system: "
		$ = "Error in GetVolumeInformation\x0D\x0A"
		$ = "I can not het information about this disk\x0D\x0A"
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
}