cve-2021-44228

localhost.run

get-my-ip.ddns.softether-network.net

update-check.softether-network.net

vpn.company.com

hideservers.net

localtunnel.net

twitter.com

conhost.exe

'bitsadmin.exe

'certreq.exe

'cmdl32.exe

'diantz.exe

'expand.exe

'findstr.exe

'gfxdownloadwrapper.exe

'ieexec.exe

'makecab.exe

'printbrm.exe

'squirrel.exe

'xwizard.exe

response.html

pe.dat

befec87a9742ba8e8f6e61e1133f55fb

6de8cc7217cb3e0c235fcdde83b1140b

2586bb9e27a4b3da4ed0f5d15883f84e

995f7d9ca805cce59acbeff82ed4adc6

96842ad6cc00fab5776171c56812b9a5

35fcc4b19946d1bc9c21add1f42d2b63

61d59eb2799b1a77eedf34b145cf23e1

9fb1191ba0064d317a883677ce568023

ce5d96252315e2c9d5fd9aeb98ae28ae

UNC3500

UNC3661

UNC530

UNC961

UNC1575

UNC1615

UNC2984

UNC3804

APT28

APT22

http://schemas.openxmlformats.org/package/2006/relationships

http://35.189.145.119/hamcore.se2

http://35.189.145.119/vpn_bridge.config

rule M_Hunting_VPNEngine_OOXML_Target_1 {
	meta:
		description = "Detects an external relationship link in an OOXML with a VPN or proxy domain."
		author = "Mandiant"
	strings:
		$relationship_external = /TargetMode=[\"\']External[\"\']/ ascii wide nocase
		$anchor = "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">"
		$s1 = " Target=" ascii nocase
		$s2 = " TargetMode=" ascii nocase
		$s3 = " Type=" ascii nocase
		$s4 = " Id=" ascii nocase
		$re = /Target=[\"\'][^\"\']{0,100}(vpn|proxy).{0,100}/ ascii nocase
	condition:
		(filesize < 10KB) and $anchor and $relationship_external and (1 of ($s*)) and $re
}

rule M_Hunting_MacOS_VPNEngine_MachO_FEBeta_1 {
	meta:
		author = "Mandiant"
		description = "This rule looks for Mach-O files with strings indicating relationship with a VPN client or domain."
		md5 = "6de8cc7217cb3e0c235fcdde83b1140b"
	strings:
		$s1 = /vpn[^\.]{0,50}\.(exe|dll|lnk|hta|rtf|ps1|vbs|vbe|pdf|doc)/ ascii nocase fullword
		$s2 = /proxy[^\.]{0,50}\.(exe|dll|lnk|hta|rtf|ps1|vbs|vbe|pdf|doc)/ ascii nocase fullword
		$s3 = /vpn[a-zA-Z0-9\.]{0,50}\.(com|io|ru|org|net)/ ascii nocase
		$s4 = /proxy[a-zA-Z0-9\.]{0,50}\.(com|io|ru|org|net)/ ascii nocase
		$s6 = /localhost[^a-zA-Z0-9]{0,5}tunnel/ ascii nocase fullword
	condition:
		filesize < 15MB and (uint32(0) == 0xBEBAFECA or uint32(0) == 0xFEEDFACE or uint32(0) == 0xFEEDFACF or uint32(0) == 0xCEFAEDFE) and (1 of them)
}

rule M_Hunting_VPNEngine_NgrokConfig_2 {
	meta:
		author = "Mandiant"
		description = "Rule looks for Ngrok YML config file."
		md5 = "5d1dbfdc47e820605fedabb98cf17dd5"
	strings:
		$header = "authtoken:"
		$tokenRE = /authtoken:\s[a-zA-Z0-9]{26,30}_[a-zA-Z0-9]{19,22}/
	condition:
		filesize < 1MB and $header at 0 and $tokenRE
}

rule M_METHODOLOGY_VPNEngine_LoadVPNProxyChromeExtension_1 {
	meta:
		author = "Mandiant"
		description = "Hunting rule that looks for files containing strings pertaining to execution of Chrome to launch an extension with VPN or proxy equities."
	strings:
		$r1 = /chrome[^\r\n]*?--load-extension=/ ascii wide nocase
		$s1 = "chrome" ascii wide
		$s2 = "--load-extension=" ascii wide
		$p1 = "vpn" ascii wide nocase fullword
		$p2 = "proxy" ascii wide nocase fullword
	condition:
		filesize < 50KB and all of ($s*) and $r1 and ($p1 or $p2)
}

rule M_Hunting_VPNEngine_ChromeExtensionInBinary_1 {
	meta:
		author = "Mandiant"
		md5 = "2e09a136e40143ed3317c9ce6ea027a6"
	strings:
		$manifest1 = "\"manifest_version\":" ascii nocase
		$manifest2 = "\"name\":" ascii nocase
		$manifest3 = "\"version\":" ascii nocase
		$optional1 = "\"author\":" ascii nocase
		$optional2 = "\"browser_action\":" ascii nocase
		$optional3 = "\"content_security_policy\":" ascii nocase
		$optional4 = "\"default_icon\":" ascii nocase
		$optional5 = "\"default_locale\":" ascii nocase
		$optional6 = "\"default_title\":" ascii nocase
		$optional7 = "\"description\":" ascii nocase
		$optional8 = "\"differential_fingerprint\":" ascii nocase
		$optional9 = "\"icons\":" ascii nocase
		$optional10 = "\"permissions\":" ascii nocase
		$optional11 = "\"background\":" ascii nocase
		$anchorre1 = /\"default_title\": \"[^\"]{0,100}[pP]roxy[^\"]{0,100}\"/
		$anchorre2 = /\"description\": \"[^\"]{0,100}[pP]roxy[^\"]{0,100}\"/
		$anchorre3 = /\"name\": \"[^\"]{0,100}[pP]roxy[^\"]{0,100}\"/
		$anchorre4 = /\"short_name\": \"[^\"]{0,100}[pP]roxy[^\"]{0,100}\"/
		$anchorre5 = /\"default_title\": \"[^\"]{0,100}(VPN|\s+vpn|vpn\s+)[^\"]{0,100}\"/
		$anchorre6 = /\"description\": \"[^\"]{0,100}(VPN|\s+vpn|vpn\s+)[^\"]{0,100}\"/
		$anchorre7 = /\"name\": \"[^\"]{0,100}(VPN|\s+vpn|vpn\s+)[^\"]{0,100}\"/
		$anchorre8 = /\"short_name\": \"[^\"]{0,100}(VPN|\s+vpn|vpn\s+)[^\"]{0,100}\"/
	condition:
		((uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) or (uint32(0) == 0x464c457f)) and filesize < 20MB and $manifest1 and $manifest2 and $manifest3 and (2 of ($optional*)) and (1 of ($anchorre*))
}

rule M_Hunting_Win_VPNEngine_PDB_1 {
	meta:
		author = "Mandiant"
		description = "Rule looks for VPN or Proxy PDB."
		md5 = "2bf422e19e721b461f9e98271fb28ad3"
	strings:
		$pdb = /RSDS[\x00-\xFF]{20}[a-zA-Z]:\\[\x00-\xFF]{0,500}(vpn|proxy)[\x00-\xFF]{0,500}\.pdb\x00/ ascii wide nocase
	condition:
		filesize < 5MB and uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and $pdb
}

rule M_Hunting_AscensionEngine_golocaltunnel_1 {
	meta:
		author = "Mandiant"
		description = "Rule looks for binaries that use golocaltunnel."
		md5 = "35fcc4b19946d1bc9c21add1f42d2b63"
	strings:
		$anchor1 = "localtunnel.go" ascii wide nocase
		$func1 = "readAtmost" ascii wide nocase
		$func2 = "Network" ascii wide nocase
		$func3 = "WaitFor" ascii wide nocase
		$func4 = "Accept" ascii wide nocase
		$func5 = "Addr" ascii wide nocase
		$func6 = "URL" ascii wide nocase
		$func7 = "ReachedEOF" ascii wide nocase
		$func8 = "setDefaults" ascii wide nocase
	condition:
		((uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) or (uint32(0) == 0x464c457f)) and filesize < 20MB and $anchor1 and (3 of ($func*))
}

rule M_Hunting_AscensionEngine_zdtun_1 {
	meta:
		author = "Mandiant"
		description = "Rule looks for binaries that use zdtun."
		md5 = "f224e0c1ad6d27c76b1f87fdb8ada639"
	strings:
		$anchor = "zdtun" ascii wide nocase
		$s1 = "zdtun_conn_close" ascii wide nocase
		$s2 = "zdtun_conn_dnat" ascii wide nocase
		$s3 = "zdtun_conn_proxy" ascii wide nocase
		$s4 = "zdtun_conn_set_userdata" ascii wide nocase
		$s5 = "zdtun_fds" ascii wide nocase
		$s6 = "zdtun_finalize" ascii wide nocase
		$s7 = "zdtun_get_stats" ascii wide nocase
		$s8 = "zdtun_make_iphdr" ascii wide nocase
		$s9 = "zdtun_purge_expired" ascii wide nocase
		$s10 = "zdtun_set_dnat_info" ascii wide nocase
		$s11 = "zdtun_set_mtu" ascii wide nocase
		$s12 = "zdtun_set_socks5_proxy" ascii wide nocase
		$s13 = "zdtun_conn_get_userdata" ascii wide nocase
		$s14 = "zdtun_userdata" ascii wide nocase
		$s15 = "zdtun_init" ascii wide nocase
	condition:
		((uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) or (uint32(0) == 0x464c457f)) and filesize < 20MB and $anchor and (5 of ($s*))
}