us-cert.cisa.gov

www.us-cert.gov

avsvmcloud.com

malware.us-cert.gov

submit@malware.us-cert.gov

businesslayer.dll

846e27a652a5e1bfbd0ddd38a16dc865

32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77

d0d626deb3f9484e649294a8dfa814c5568f846d5aa02d4cdad5d041a29d5600

https://www.cisa.gov/supply-chain-compromise.

https://www.surveymonkey.com/r/g8stdry

rule CISA_10318927_01 : trojan rat SOLAR_FIRE {
	meta:
		Author = "CISA Code & Media Analysis"
		Incident = "10318927"
		Date = "2020-12-13"
		Last_Modified = "20201213_2145"
		Actor = "n/a"
		Category = "TROJAN RAT"
		Family = "SOLAR_FIRE"
		Description = "This signature is based off of unique strings embedded within the modified Solar Winds app"
		MD5_1 = "b91ce2fa41029f6955bff20079468448"
		SHA256_1 = "32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77"
		MD5_2 = "846e27a652a5e1bfbd0ddd38a16dc865"
		SHA256_2 = "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6"
	strings:
		$s0 = { 63 00 30 00 6B 00 74 00 54 00 69 00 37 00 4B 00 4C 00 43 00 6A 00 4A 00 7A 00 4D 00 38 00 44 }
		$s1 = { 41 00 41 00 3D 00 3D 00 00 21 38 00 33 00 56 00 30 00 64 00 6B 00 78 00 4A 00 4B 00 55 }
		$s2 = { 63 00 2F 00 46 00 77 00 44 00 6E 00 44 00 4E 00 53 00 30 00 7A 00 4B 00 53 00 55 00 30 00 42 00 41 00 41 00 3D 00 3D }
		$s3 = { 53 00 69 00 30 00 75 00 42 00 67 00 41 00 3D 00 00 21 38 00 77 00 77 00 49 00 4C 00 6B 00 33 00 4B 00 53 00 79 00 30 00 42 }
	condition:
		all of them
}

rule FireEye_20_00025668_02 : SUNBURST APT backdoor {
	meta:
		Author = "FireEye"
		Date = "2020-12-13"
		Last_Modified = "20201213_1917"
		Actor = "n/a"
		Category = "Backdoor"
		Family = "SUNBURST"
		Description = "The SUNBURST backdoor uses a domain generation algorithm (DGA) as part of C2 communications. This rule is looking for each branch of the code that checks for which HTTP method is being used. This is in one large conjunction, and all branches are then tied together via disjunction. The grouping is intentionally designed so that if any part of the DGA is re-used in another sample, this signature should match that re-used portion. SUNBURST is a backdoor that has the ability to spawn and kill processes, write and delete files, set and create registry keys, gather system information, and disable a set of forensic analysis tools and services."
		MD5_1 = ""
		SHA256_1 = ""
	strings:
		$a = "0y3Kzy8BAA==" wide
		$aa = "S8vPKynWL89PS9OvNqjVrTYEYqNa3fLUpDSgTLVxrR5IzggA" wide
		$ab = "S8vPKynWL89PS9OvNqjVrTYEYqPaauNaPZCYEQA=" wide
		$ac = "C88sSs1JLS4GAA==" wide
		$ad = "C/UEAA==" wide
		$ae = "C89MSU8tKQYA" wide
		$af = "8wvwBQA=" wide
		$ag = "cyzIz8nJBwA=" wide
		$ah = "c87JL03xzc/LLMkvysxLBwA=" wide
		$ai = "88tPSS0GAA==" wide
		$aj = "C8vPKc1NLQYA" wide
		$ak = "88wrSS1KS0xOLQYA" wide
		$al = "c87PLcjPS80rKQYA" wide
		$am = "Ky7PLNAvLUjRBwA=" wide
		$an = "06vIzQEA" wide
		$b = "0y3NyyxLLSpOzIlPTgQA" wide
		$c = "001OBAA=" wide
		$d = "0y0oysxNLKqMT04EAA==" wide
		$e = "0y3JzE0tLknMLQAA" wide
		$f = "003PyU9KzAEA" wide
		$h = "0y1OTS4tSk1OBAA=" wide
		$i = "K8jO1E8uytGvNqitNqytNqrVA/IA" wide
		$j = "c8rPSQEA" wide
		$k = "c8rPSfEsSczJTAYA" wide
		$l = "c60oKUp0ys9JAQA=" wide
		$m = "c60oKUp0ys9J8SxJzMlMBgA=" wide
		$n = "8yxJzMlMBgA=" wide
		$o = "88lMzygBAA==" wide
		$p = "88lMzyjxLEnMyUwGAA==" wide
		$q = "C0pNL81JLAIA" wide
		$r = "C07NzXTKz0kBAA==" wide
		$s = "C07NzXTKz0nxLEnMyUwGAA==" wide
		$t = "yy9IzStOzCsGAA==" wide
		$u = "y8svyQcA" wide
		$v = "SytKTU3LzysBAA==" wide
		$w = "C84vLUpOdc5PSQ0oygcA" wide
		$x = "C84vLUpODU4tykwLKMoHAA==" wide
		$y = "C84vLUpO9UjMC07MKwYA" wide
		$z = "C84vLUpO9UjMC04tykwDAA==" wide
	condition:
		($a and $b and $c and $d and $e and $f and $h and $i) or ($j and $k and $l and $m and $n and $o and $p and $q and $r and $s and ($aa or $ab)) or ($t and $u and $v and $w and $x and $y and $z and ($aa or $ab)) or ($ac and $ad and $ae and $af and $ag and $ah and ($am or $an)) or ($ai and $aj and $ak and $al and ($am or $an))
}