webinternal.anyplex.com

ajayjangid.in

leadsblue.com

mantis.quick.net.pl

abba-servicios.mx

olidhealth.com

crickethighlights.today

manextapi.dll

preextapi.dll

mscoree.dll

printfilterpipelinesvc.exe

p.dat

c:\programdata\mscoree.dll

presentationhost.exe

jquery.php

index.php

prod.php

compat.php

contact.php

a9e30c16df400c3f24fc4e9d76db78ef

30358639af2ecc217bbc26008c5640a7

866f9f205fa1d47af27173b5eb464363

a2109276dc704dedf481a4f6c8914c6e

91b6d6efa5840d6c1f10a72c66e925ce

49425d6dedb5f88bddc053cc8fd5f0f4

05b6f459be513bf6120e9b2b85f6c844

A105-492

A105-494

A105-508

TEMP.HERMIT

UNC577

http://webinternal.anyplex.com/images/query_image.jsp

https://ajayjangid.in/js/jquery/jquery.php

https://leadsblue.com/wp-content/wp-utility/index.php

http://mantis.quick.net.pl/library/securimage/index.php

http://abba-servicios.mx/wordpress/wp-content/themes/config.php

https://olidhealth.com/wp-includes/php-compat/compat.php

https://crickethighlights.today/wp-content/plugins/contact.php

rule M_Hunt_APT_PLANKWALK_Code_String {
	meta:
		author = "Mandiant"
		description = "Detects a format string containing code and token found in PLANKWALK"
	strings:
		$hex = { 63 6F 64 65 [1-6] 3D 25 64 26 [1-6] 75 73 65 72 [1-6] 3D 25 73 26 [1-6] 74 6F 6B 65 }
	condition:
		(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $hex
}

rule M_APT_Loader_Win_LIDSHOT_1 {
	meta:
		author = "Mandiant"
		description = "Detects LIDSHOT implant"
	strings:
		$code1 = { 4C 89 6D ?? 4C 89 6D ?? C7 45 ?? 01 23 45 67 C7 45 ?? 89 AB CD EF C7 45 ?? FE DC BA 98 C7 45 ?? 76 54 32 10 4C 89 6C 24 ?? 48 C7 45 ?? 0F 00 00 00 C6 44 24 ?? 00 }
		$code2 = { B8 1F 85 EB 51 41 F7 E8 C1 FA 03 8B CA C1 E9 1F 03 D1 6B CA 19 }
		$code3 = { C7 45 ?? 30 6B 4C 6C 66 C7 45 ?? 55 00 }
	condition:
		uint16(0) == 0x5a4d and all of them
}

rule M_DropperMemonly_TOUCHSHIFT_1 {
	meta:
		author = "Mandiant"
		description = "Hunting rule for TOUCHSHIFT"
	strings:
		$p00_0 = { 09 43 ?? EB ?? FF 43 ?? B0 ?? EB ?? E8 [4] C7 00 [4] E8 [4] 32 C0 }
		$p00_1 = { 4C 63 05 [4] BA [4] 4C 8B 0D [4] 48 8B 0D [4] FF 15 [4] 4C 63 05 [4] BA [4] 4C 8B 0D [4] 48 8B 0D }
	condition:
		uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and (($p00_0 in (70000 .. 90000) and $p00_1 in (0 .. 64000)))
}

rule M_Hunting_TOUCHKEY {
	meta:
		author = "Mandiant"
		description = "Hunting rule For TOUCHKEY"
	strings:
		$a1 = "Normal.dost"
		$a2 = "Normal.docb"
		$c1 = "[SELECT]" ascii wide
		$c2 = "[SLEEP]" ascii wide
		$c3 = "[LSHIFT]" ascii wide
		$c4 = "[RSHIFT]" ascii wide
		$c5 = "[ENTER]" ascii wide
		$c6 = "[SPACE]" ascii wide
	condition:
		(uint16(0) == 0x5A4D) and uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and (5 of ($c*)) and $a1 and $a2
}

rule M_Hunting_HOOKSHOT {
	meta:
		author = "Mandiant"
		description = "Hunting rule for HOOKSHOT"
	strings:
		$p00_0 = { 8B B1 [4] 40 88 73 ?? 85 F6 75 ?? 48 8B 81 [4] 48 8B 88 [4] 48 85 C9 74 ?? E8 }
		$p00_1 = { 8B F3 48 8B EA 85 DB 0F 84 [4] 4C 8D 2D [4] 66 90 4C 8D 44 24 ?? 8B D6 48 8B CD }
	condition:
		uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and (($p00_0 in (470000 .. 490000) and $p00_1 in (360000 .. 380000)))
}