Overview - Yara rules

rule zhLookUp {
	strings:
		$s1 = "zhLookUp.Properties"
	condition:
		all of them
}

rule trojan_win_cobaltstrike : Commodity {
	meta:
		author = " [email protected] "
		date = "2021-05-25"
		description = "The CobaltStrike malware family."
		hash = "b041efb8ba2a88a3d172f480efa098d72eef13e42af6aa5fb838e6ccab500a7c"
	strings:
		$s1 = "%s (admin)" fullword
		$s2 = { 48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65 74 2D 73 74 72 65 61 6D 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 0D 0A 0D 0A 00 }
		$s3 = "d/d/d d:d:d" fullword
		$s4 = "%s as %s\\%s: %d" fullword
		$s5 = "%s&%s=%s" fullword
		$s6 = "rijndael" fullword
		$s7 = "(null)"
	condition:
		all of them
}

import "pe"

rule S1deloadStealer_PDB_path {
	meta:
		author = "Acs David - Bitdefender"
		date = "2022-12-05"
		hash = ""
	condition:
		pe.is_pe and pe.pdb_path contains "C:\\Users\\KienTi\\Documents" and filesize <= 1MB and pe.imports("mscoree.dll")
}

rule PoS_Malware_fastpos2 : FastPOS2 {
	meta:
		author = "Trend Micro, Inc"
		date = "2016-09-21"
		description = "Used to detect newer FastPOS variants and their modules."
		sample_filetype = "exe"
	strings:
		$pdb0 = "\\_hookLoader\\Release\\_hookLoader.pdb" nocase
		$pdb1 = "\\_hookKlg\\Release\\_hookKlg.pdb" nocase
		$pdb2 = "\\_hookKlg\\x64\\Release\\_hookKlg.pdb" nocase
		$pdb3 = "\\_hookProc\\Release\\_hookProc.pdb" nocase
		$pdb4 = "\\_hookProc\\x64\\Release\\_hookProc.pdb" nocase
		$pdb5 = "\\_hookRecvSrvc\\Release\\_hookRecvSrvc.pdb" nocase
		$exec_ref0 = "\\kl32.exe"
		$exec_ref1 = "\\servhelp.exe"
		$exec_ref2 = "\\kbd.exe"
		$exec_ref3 = "\\servproc.exe"
		$exec_ref4 = "\\service.exe"
		$exec_ref5 = "\\proc64.exe"
		$exec_ref6 = "\\proc32.exe"
		$exec_ref7 = "//cdosys.php"
		$string0 = "DeleteService"
		$string1 = "CreateMailslotA"
		$string2 = "StartServiceCtrlDispatcherA"
		$string3 = "\\\\.\\mailslot\\trackslot"
		$string4 = "Can't install hook service"
		$string5 = " -r to remove hook." wide
	condition:
		(any of ($pdb*)) and (3 of ($exec_ref*)) and (2 of ($string*))
}

rule go_language_pe {
	strings:
		$go1 = "go.buildid" ascii wide
		$go2 = "go.buildi" ascii wide
		$go3 = "Go build ID:" ascii wide
		$go4 = "Go buildinf:"
		$go5 = "runtime.cgo"
		$go6 = "runtime.go"
		$go7 = "GOMAXPRO"
		$str1 = "kernel32.dll" nocase
	condition:
		uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and 2 of ($go*) and all of ($str*)
}

rule COATHANGER_files {
	meta:
		description = "Detects COATHANGER files by used filenames"
		malware = "COATHANGER"
		author = "NLD MIVD - JSCU"
		date = "20240206"
	strings:
		$1 = "/data2/"
		$2 = "/httpsd"
		$3 = "/preload.so"
		$4 = "/authd"
		$5 = "/tmp/packfile"
		$6 = "/smartctl"
		$7 = "/etc/ld.so.preload"
		$8 = "/newcli"
		$9 = "/bin/busybox"
	condition:
		(uint32(0) == 0x464c457f or uint32(4) == 0x464c457f) and filesize < 5MB and 4 of them
}

rule apt_RU_MoonlightMaze_customlokitools {
	meta:
		author = "Kaspersky Lab"
		date = "2017-03-15"
		version = "1.1"
		last_modified = "2017-03-22"
		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
		description = "Rule to detect Moonlight Maze Loki samples by custom attacker-
authored strings"
		hash = "14cce7e641d308c3a177a8abb5457019"
		hash = "a3164d2bbc45fb1eef5fde7eb8b245ea"
		hash = "dabee9a7ea0ddaf900ef1e3e166ffe8a"
		hash = "1980958afffb6a9d5a6c73fc1e2795c2"
		hash = "e59f92aadb6505f29a9f368ab803082e"
	strings:
		$a1 = "Write file Ok..." ascii wide
		$a2 = "ERROR: Can not open socket...." ascii wide
		$a3 = "Error in parametrs:" ascii wide
		$a4 = "Usage: @<get/put> <IP> <PORT> <file>" ascii wide
		$a5 = "ERROR: Not connect..." ascii wide
		$a6 = "Connect successful...." ascii wide
		$a7 = "clnt <%d> rqstd n ll kll" ascii wide
		$a8 = "clnt <%d> rqstd swap" ascii wide
		$a9 = "cld nt sgnl prcs grp" ascii wide
		$a10 = "cld nt sgnl prnt" ascii wide
		$a11 = "ork error" ascii fullword
	condition:
		((any of ($a*)))
}

rule loki2crypto {
	meta:
		author = "Costin Raiu, Kaspersky Lab"
		date = "2017-03-21"
		version = "1.0"
		description = "Rule to detect hardcoded DH modulus used in 1996/1997 Loki2 
sourcecode; #ifdef STRONG_CRYPTO /* 384-bit strong prime */"
		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
		hash = "19fbd8cbfb12482e8020a887d6427315"
		hash = "ea06b213d5924de65407e8931b1e4326"
		hash = "14ecd5e6fc8e501037b54ca263896a11"
		hash = "e079ec947d3d4dacb21e993b760a65dc"
		hash = "edf900cebb70c6d1fcab0234062bfc28"
	strings:
		$modulus = { DA E1 01 CD D8 C9 70 AF C2 E4 F2 7A 41 8B 43 39 52 9B 4B 4D E5 85 F8 49 }
	condition:
		(any of them)
}

rule apt_RU_MoonlightMaze_cle_tool {
	meta:
		author = "Kaspersky Lab"
		date = "2017-03-27"
		version = "1.0"
		last_modified = "2017-03-27"
		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
		description = "Rule to detect Moonlight Maze 'cle' log cleaning tool"
		hash = "647d7b711f7b4434145ea30d0ef207b0"
	strings:
		$a1 = "./a filename template_file" ascii wide
		$a2 = "May be %s is empty?" ascii wide
		$a3 = "template string = |%s|" ascii wide
		$a4 = "No blocks !!!"
		$a5 = "No data in this block !!!!!!" ascii wide
		$a6 = "No good line"
	condition:
		((3 of ($a*)))
}

rule apt_RU_MoonlightMaze_encrypted_keylog {
	meta:
		author = "Kaspersky Lab"
		date = "2017-03-27"
		version = "1.0"
		last_modified = "2017-03-27"
		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
		description = "Rule to detect Moonlight Maze encrypted keylogger logs"
	strings:
		$a1 = { 47 01 22 2A 6D 3E 39 2C }
	condition:
		($a1 at 0)
}

rule apt_RU_MoonlightMaze_wipe {
	meta:
		author = "Kaspersky Lab"
		date = "2017-03-27"
		version = "1.0"
		last_modified = "2017-03-27"
		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
		description = "Rule to detect log cleaner based on wipe.c"
		reference2 = "http://www.afn.org/~afn28925/wipe.c"
		hash = "e69efc504934551c6a77b525d5343241"
	strings:
		$a1 = "ERROR: Unlinking tmp WTMP file."
		$a2 = "USAGE: wipe [ u|w|l|a ] ...options..."
		$a3 = "Erase acct entries on tty :   wipe a [username] [tty]"
		$a4 = "Alter lastlog entry       :   wipe l [username] [tty] [time] [host]"
	condition:
		(uint32(0) == 0x464c457f) and (2 of them)
}

import "pe"

rule apt_win_freshfire : APT29 {
	meta:
		author = " [email protected] "
		date = "2021-05-27"
		description = "The FRESHFIRE malware family. The malware acts as a downloader, pulling down an encrypted snippet of code from a remote source, executing it, and deleting it from the remote server."
		hash = "ad67aaa50fd60d02f1378b4155f69cffa9591eaeb80523489a2355512cc30e8c"
	strings:
		$uniq1 = "UlswcXJJWhtHIHrVqWJJ"
		$uniq2 = "gyibvmt\x00"
		$path1 = "root/time/%d/%s.json"
		$path2 = "C:\\dell.sdr"
		$path3 = "root/data/%d/%s.json"
	condition:
		(pe.number_of_exports == 1 and pe.exports("WaitPrompt")) or any of ($uniq*) or 2 of ($path*)
}

rule MofuLoader {
	meta:
		description = "detect MofuLoader in memory"
	strings:
		$ror = { C1 C? 0C }
		$api_hashing = { 81 F? A1 A3 A0 1D 74 ?? 81 F? D0 A7 17 47 74 ?? 81 F? A3 2C 59 8F 74 ?? 81 F? A0 F0 1F B0 74 ?? 81 F? 4F 6A 65 D7 }
	condition:
		all of them
}