whois.ripe.net

gmail.com

us-cert.cisa.gov

ftp.malware.us-cert.gov

submit@malware.us-cert.gov

odbccads.exe

winds.exe

f7_dump_64.exe

%temp%\idpe988.tmp

3764a0f1762a294f662f3bf86bac776f

e9c2b8bd1583baf3493824bf7b3ec51e

9b071311ecd1a72bfd715e34dbd1bd77

7b1ce3fe542c6ae2919aa94e20dc860e

28e4e7104cbffa97a0aa2f53b5ebcbcdba360ec416b34bb617e2f8891d204816

3c2c835042a05f8d974d9b35b994bcf8d5a0ce19128ebb362804c2d0f3eb42c0

7ea294d30903c0ab690bc02b64b20af0cfe66a168d4622e55dee4d6233783751

d071c4959d00a1ef9cce535056c6b01574d8a8104a7c3b00a237031ef930b10f

4cd7efdb1a7ac8c4387c515a7b1925931beb212b95c4f9d8b716dbe18f54624f

155.94.211.207

185.136.163.104

185.136.163.255

134.119.177.0

134.119.176.0

162.245.191.255

155.94.255.255

https://us-cert.cisa.gov/forms/feedback

rule CISA_10382580_03 : loader {
	meta:
		Author = "CISA Code & Media Analysis"
		Incident = "10382580"
		Date = "2022-05-02"
		Last_Modified = "20220602_1200"
		Actor = "n/a"
		Category = "Loader"
		Family = "n/a"
		Description = "Detects loader samples"
		MD5_1 = "3764a0f1762a294f662f3bf86bac776f"
		SHA256_1 = "f7f7b059b6a7dbd75b30b685b148025a0d4ceceab405e553ca28cacdeae43fab"
		MD5_2 = "21fa1a043460c14709ef425ce24da4fd"
		SHA256_2 = "66966ceae7e3a8aace6c27183067d861f9d7267aed30473a95168c3fe19f2c16"
		MD5_3 = "e9c2b8bd1583baf3493824bf7b3ec51e"
		SHA256_3 = "7ea294d30903c0ab690bc02b64b20af0cfe66a168d4622e55dee4d6233783751"
		MD5_4 = "de0d57bdc10fee1e1e16e225788bb8de"
		SHA256_4 = "33b89b8915aaa59a3c9db23343e8c249b2db260b9b10e88593b6ff2fb5f71d2b"
		MD5_5 = "9b071311ecd1a72bfd715e34dbd1bd77"
		SHA256_5 = "3c2c835042a05f8d974d9b35b994bcf8d5a0ce19128ebb362804c2d0f3eb42c0"
		MD5_6 = "05d38bc82d362dd57190e3cb397f807d"
		SHA256_6 = "4cd7efdb1a7ac8c4387c515a7b1925931beb212b95c4f9d8b716dbe18f54624f"
	strings:
		$s0 = { B8 01 00 00 00 48 6B C0 00 C6 44 04 20 A8 B8 01 }
		$s1 = { 00 00 48 6B C0 01 C6 44 04 20 9A B8 01 00 00 }
		$s2 = { 48 6B C0 02 C6 44 04 20 93 B8 01 00 00 00 48 }
		$s3 = { C0 03 C6 44 04 20 9B B8 01 00 00 00 48 6B C0 }
	condition:
		all of them
}

rule CISA_10382580_01 : rat {
	meta:
		Author = "CISA Code & Media Analysis"
		Incident = "10382580"
		Date = "2022-05-25"
		Last_Modified = "20220602_1200"
		Actor = "n/a"
		Category = "Remote Access Tool"
		Family = "n/a"
		Description = "Detects Remote Access Tool samples"
		MD5_1 = "199a32712998c6d736a05b2dbd24a761"
		SHA256_1 = "88a5e4b24747648a4e3f0a2d5282b51683260f9208b06788fc858c44559da1e8"
	strings:
		$s0 = { 0F B6 40 0F 6B C8 47 41 0F B6 40 0B 02 D1 6B C8 }
		$s1 = { 35 41 0F B6 00 41 88 58 01 41 88 78 02 41 88 70 }
		$s2 = { 66 83 F8 1E }
		$s3 = { 66 83 F8 52 }
	condition:
		all of them
}