crates.io

cock.li

blogs.blackberry.com

www.bleepingcomputer.com

www.fireeye.com

blog.netlab.360.com

www.binarydefense.com

blogs.jpcert.or.jp

1c7qp243xy9g1qeffp1k1nvo-wpengine.netdna-ssl.com

livebook.manning.com

nim-lang.org

stackoverflow.blog

www.zdnet.com

news.drweb.com

golangbot.com

broadcom.com

www.goggleheadedhacker.com

www.crowdstrike.com

twitter.com

vovanandlexus@cock.li

dirtytest.exe

use-of-delphi-packer-to-evade-malware-classification.html

malware-wellmes-9b78.html

areas-of-d-usage.html

news.html

why-cargo-exists.html

moloch--

graydon

indygreg

stratisiot

epi052

a584e0e9fb9f4fbc415a1ef3c40e8812

APT29

https://www.linkedin.com/in/eric-milam

https://en.wikipedia.org/wiki/iloveyou

https://www.virusbulletin.com/virusbulletin/2014/07

https://en.wikipedia.org/wiki/yara

https://blog.netlab.360.com/blackrota-a-heavily-obfuscated-backdoor-written-in-go

https://github.com/burrowers/garble

https://github.com/casualx/obfstr

https://gs.statcounter.com/os-market-share

https://blogs.blackberry.com/en/2019/08/mirai-botnet-spawns-echobot-malware

https://en.wikipedia.org/wiki/cozy_bear

https://1c7qp243xy9g1qeffp1k1nvo-wpengine.netdna-ssl.com/wp-content/uploads/2015/04/math-

https://dlang.org/areas-of-d-usage.html

https://blogs.blackberry.com/en/author

https://web.archive.org/web/20160626002904/http:/nim-lang.org/news.html

https://blogs.blackberry.com/en/2019/09

https://foundation.rust-lang.org/members

https://stackoverflow.blog/2020/05/27/2020-stack-overflow-developer-survey-results

https://stackoverflow.blog/2020/01/20/what-is-rust-and-why-is-it-so-popular

https://doc.rust-lang.org/cargo/guide/why-cargo-exists.html

https://news.drweb.com/show/?i=10193&lng=en&c=14

https://github.com/darkarp/chromepass

https://golangbot.com/goroutines

https://github.com/stratisiot/gobfuscator

https://www.goggleheadedhacker.com/blog/post/22

https://github.com/fireeye

https://github.com/epi052/feroxbuster

https://blog.golang.org/survey2020-results

https://twitter.com/stvemillertime/status/1404532957604323329

import "pe"
import "math"
import "hash"

rule Mal_InfoStealer_RemcosRAT {
	meta:
		description = "Dlang wrapped RemcosRAT"
		author = "Blackberry Threat Research & Intelligence"
	strings:
		$f0 = { 48 3A 2F 50 72 75 65 62 61 73 2F 43 }
		$f1 = { 43 43 52 59 50 54 45 52 42 4C 41 55 }
		$DLang_Str1 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\utf.d" ascii wide
		$DLang_Str2 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\file.d" ascii wide
		$DLang_Str3 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\format.d" ascii wide
		$DLang_Str4 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\base64.d" ascii wide
		$DLang_Str5 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\stdio.d" ascii wide
	condition:
		uint16(0) == 0x5a4d and filesize < 700KB and pe.imphash() == "06f23da70e8da5f1231dae542708d4b9" and all of ($f*) and 3 of ($DLang_Str*)
}

import "pe"
import "math"
import "hash"

rule Mal_Ransom_Vovalex {
	meta:
		description = "Vovalex Ransomware"
		author = "Blackberry Threat Research & Intelligence"
	strings:
		$f0 = { 52 45 41 44 4D 45 2E 56 4F 56 41 4C }
		$f1 = { 6E 6F 74 65 70 61 64 00 }
		$rans_note1 = "Send us a mail with proofs of transaction: VovanAndLexus@cock.li"
		$rans_note2 = "README.VOVALEX.txt"
		$rans_note3 = "VovanAndLexus@cock.li"
		$rans_note4 = "Monero: 4B45W7V1sJAZBnPSnvcipa5k7BRyC4w8GCTfQCUL2XRx5CFzG3iJtEk2kqEvFbF7FagEafRYFfQ6FJnZmep5TsnrSfxpMkS"
		$rans_note5 = "Send 0.5 XMR to this Monero wallet: 4B45W7V1sJAZBnPSnvcipa5k7BRyC4w8GCTfQCUL2XRx5CFzG3iJtEk2kqEvFbF7FagEafRYFfQ6FJnZmep5TsnrSfxpMkS"
	condition:
		pe.is_64bit() and all of ($f*) and 4 of ($rans_note*)
}

rule Mal_ShellcodeLoader_Nim {
	meta:
		author = "Blackberry Threat Research & Intelligence"
		description = "Tags Nim Specific function name and either shellcode headers or the presence of the string shellcode"
	strings:
		$nim_outOfMemHook = { 6F 75 74 4F 66 4D 65 6D 48 6F 6F 6B 5F 5F 6B 5A 4E 61 41 37 75 31 4D 66 53 57 35 5A 65 6F 47 76 77 38 78 67 00 }
		$shellcode_fiber_header_x86 = { FC E8 ( 89 | 82 ) 00 00 00 60 89 E5 31 D2 }
		$shellcode_fiber_header_x64 = { FC 48 83 E4 F0 E8 ( C0 | CC ) 00 00 00 }
		$shellcode = "shellcode" nocase
	condition:
		uint16(0) == 0x5a4d and $nim_outOfMemHook and (($shellcode_fiber_header_x86 or $shellcode_fiber_header_x64) or $shellcode)
}