Overview - Yara rules

rule xor_add {
	meta:
		Author = "CISA trusted 3rd party"
		Incident = "10135536"
		Date = "2018-04-19"
		Category = "Hidden_Cobra"
		Family = "n/a"
		Description = "n/a"
	strings:
		$decode = { 80 EA 28 80 F2 47 }
		$encode = { 80 F2 47 80 C2 28 }
	condition:
		uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550 and all of them
}

import "pe"

rule Poulight_Stealer_May_2020 {
	meta:
		description = "Yara rule for Poulight Stealer"
		hash = "8ef7b98e2fc129f59dd8f23d324df1f92277fcc16da362918655a1115c74ab95"
		author = "Cybaze - Yoroi  ZLab"
		last_updated = "2020-05-07"
		tlp = "white"
		category = "informational"
	strings:
		$s1 = "http//fff.gearhostpreview.com/ARMBot"
		$s2 = "WBcG91bGxpZ2h0Lhttp://poullight.ru/keys.txt"
		$s3 = "Poullight.exe"
		$s4 = "\\wallets\\wallet.dat" ascii wide
		$s5 = "=====================================" ascii wide
		$s6 = { 2F 7B 00 30 00 7D 00 3C 00 63 00 6C 00 62 00 61 00 73 00 65 00 3E 00 7B 00 ?? 00 7D 00 3C 00 2F 00 63 00 6C 00 62 00 61 00 73 00 65 00 3E 00 }
		$s7 = "Select * from Win32_ComputerSystem" ascii wide
	condition:
		uint16(0) == 0x5A4D and all of them
}

rule CISA_3P_10327841_02 : SOLARFLARE trojan {
	meta:
		Author = "CISA Trusted Third Party"
		Incident = "10327841.r1.v1"
		Date = "2021-03-04"
		Actor = "n/a"
		Category = "Trojan"
		Family = "SOLARFLARE"
		Description = "Detects strings in WindowsDSVC_exe samples"
		MD5_1 = "4de28110bfb88fdcdf4a0133e118d998"
		SHA256_1 = "fa1959dd382ce868c975599c6c3cc536aa0073be44fc8a6571a20fb0c8bea836"
	strings:
		$Go_Lang = "Go build ID:"
		$main_func = "main.main"
		$main_encrypt = "main.encrypt"
		$main_MD5 = "main.GetMD5Hash"
		$main_beacon = "main.beaconing"
		$main_command = "main.resolve_command"
		$main_key1 = "main.request_session_key"
		$main_key2 = "main.retrieve_session_key"
		$main_clean = "main.clean_file"
		$main_wget = "main.wget_file"
	condition:
		(uint16(0) == 0x5A4D) and all of them
}

rule malware_bumblebee_packed {
	meta:
		author = "Marc Salinas @ CheckPoint Research"
		malware_family = "BumbleBee"
		date = "13/07/2022"
		description = "Detects the packer used by bumblebee, the rule is based on the code responsible for allocating memory for a critical structure in its logic."
		dll_jul = "6bc2ab410376c1587717b2293f2f3ce47cb341f4c527a729da28ce00adaaa8db"
		dll_jun = "82aab01a3776e83695437f63dacda88a7e382af65af4af1306b5dbddbf34f9eb"
		dll_may = "a5bcb48c0d29fbe956236107b074e66ffc61900bc5abfb127087bb1f4928615c"
		iso_jul = "ca9da17b4b24bb5b24cc4274cc7040525092dffdaa5922f4a381e5e21ebf33aa"
		iso_jun = "13c573cad2740d61e676440657b09033a5bec1e96aa1f404eed62ba819858d78"
		iso_may = "b2c28cdc4468f65e6fe2f5ef3691fa682057ed51c4347ad6b9672a9e19b5565e"
		zip_jun = "7024ec02c9670d02462764dcf99b9a66b29907eae5462edb7ae974fe2efeebad"
		zip_may = "68ac44d1a9d77c25a97d2c443435459d757136f0d447bfe79027f7ef23a89fce"
	strings:
		$heapalloc = { 48 8? EC [1-6] FF 15 ?? ?? 0? 00 [0-5] 33 D2 4? [2-5] 4? ?? ?? FF 15 ?? ?? 0? 00 [8-11] 48 89 05 ?? ?? ?? 00 E8 ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? 00 }
	condition:
		$heapalloc
}

rule Karkoff_Attack_2020_Excel_macro {
	meta:
		description = "Yara Rule for new APT34 Karkoff campaign excel malicious macro"
		author = "Cybaze Zlab_Yoroi"
		last_updated = "2020-03-02"
		tlp = "white"
		category = "informational"
	strings:
		$a1 = "EncodedData0"
		$a2 = "NewTask9"
		$a3 = "EAAMYEKwUAAEsEWQUAAMYEnQUAAMYEqAUAAJwSrgU"
		$a4 = "TVqQAAMAAAAEAAAA"
	condition:
		all of them
}

rule Windows_0day_Exploit_1 {
	meta:
		description = "Windows 0day EPATHOBJ local ring0 Exploit"
	strings:
		$a = "PATHRECORD" fullword
		$b = "HRGN" fullword
		$c = "FlattenPath" fullword
		$d = "EndPath" fullword
		$e = "PolyDraw" fullword
	condition:
		all of them
}

rule Ransom : Crypren {
	meta:
		weight = 1
		Author = "@pekeinfo"
		reference = ""
	strings:
		$a = "won't be able to recover your files anymore.</p>"
		$b = { 6A 03 68 ?? ?? ?? ?? B9 74 F1 AE 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 98 3A 00 00 FF D6 6A 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? }
		$c = "Please restart your computer and wait for instructions for decrypting your files"
	condition:
		any of them
}

rule Lu0Bot_detection {
	meta:
		description = "Detection of Lu0Bot"
		date = "2023-09-26"
		family = "Lu0Bot"
	strings:
		$start_code = /var \_0x[a-f0-9]{4,6}/
		$altBase64 = "'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/='"
		$domain = "var acc="
		$end_code = "}ini();"
		$func = "ginf"
	condition:
		all of them and #start_code >= 50
}

rule money_ransomware {
	meta:
		author = "Yoroi Malware ZLab"
		description = "Rule for Money Ransomware"
		last_updated = "2023-03-28"
		tlp = "WHITE"
		category = "informational"
	strings:
		$1 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C7 45 E8 00 00 00 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F0 85 F6 0F 84 ?? ?? ?? ?? EB ?? 8B 4D E0 8B 01 FF 50 04 89 45 E4 8D 45 E4 50 83 EC 08 8B C4 C7 00 ?? ?? ?? ?? C7 40 04 3E 00 00 00 E8 ?? ?? ?? ?? 83 C4 0C B8 ?? ?? ?? ?? C3 }
		$2 = { 8D 47 30 3B C6 74 ?? 8B C8 E8 ?? ?? ?? ?? 8B 0E 89 4F 30 8B 46 04 89 47 34 8B 46 08 89 47 38 C7 06 00 00 00 00 C7 46 04 00 00 00 00 C7 46 08 00 00 00 00 8D ?? 14 FF FF FF E8 ?? ?? ?? ?? }
	condition:
		uint16(0) == 0x5A4D and ($1 or $2)
}

import "elf"

rule Kinsing_Malware {
	meta:
		author = "Aluma Lavi, CyberArk"
		date = "22-01-2021"
		version = "1.0"
		hash = "d247687e9bdb8c4189ac54d10efd29aee12ca2af78b94a693113f382619a175b"
		description = "Kinsing/NSPPS malware"
	strings:
		$rc4_key = { 37 36 34 31 35 33 34 34 36 62 36 31 }
		$firewire = "./firewire -iL $INPUT --rate $RATE -p$PORT -oL $OUTPUT"
		$packa1 = "google/btree" ascii wide
		$packa2 = "kardianos/osext" ascii wide
		$packa3 = "kelseyhightower/envconfig" ascii wide
		$packa4 = "markbates/pkger" ascii wide
		$packa5 = "nu7hatch/gouuid" ascii wide
		$packa6 = "paulbellamy/ratecounter" ascii wide
		$packa7 = "peterbourgon/diskv" ascii wide
		$func1 = "main.RC4" ascii wide
		$func2 = "main.runTaskWithScan" ascii wide
		$func3 = "main.backconnect" ascii wide
		$func4 = "main.downloadAndExecute" ascii wide
		$func5 = "main.startCmd" ascii wide
		$func6 = "main.execTaskOut" ascii wide
		$func7 = "main.minerRunningCheck" ascii wide
	condition:
		(uint16(0) == 0x457F and not (elf.sections[0].size + elf.sections[1].size + elf.sections[2].size + elf.sections[3].size + elf.sections[4].size + elf.sections[5].size + elf.sections[6].size + elf.sections[7].size > filesize)) and ($rc4_key or $firewire or all of ($packa*) or 4 of ($func*))
}

rule APT_MAL_LNX_RedMenshen_BPFDoor_Controller_Generic_May22_1 {
	meta:
		description = "Detects BPFDoor malware"
		author = "Florian Roth"
		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
		date = "2022-05-09"
		score = 90
		hash1 = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
		hash2 = "1925e3cd8a1b0bba0d297830636cdb9ebf002698c8fa71e0063581204f4e8345"
		hash3 = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
		hash4 = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78"
		hash5 = "599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683"
		hash6 = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
		hash7 = "5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3"
		hash8 = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
		hash9 = "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c"
		hash10 = "96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9"
		hash11 = "97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc"
		hash12 = "c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276"
		hash13 = "c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c"
		hash14 = "f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72"
		hash15 = "f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27"
		hash16 = "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"
		hash17 = "fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a"
	strings:
		$op1 = { C6 80 01 01 00 00 00 48 8B 45 ?8 0F B6 90 01 01 00 00 48 8B 45 ?8 88 90 00 01 00 00 C6 45 ?? 00 0F B6 45 ?? 88 45 }
		$op2 = { 48 89 55 C8 48 8B 45 C8 48 89 45 ?? 48 8B 45 C8 0F B6 80 00 01 00 00 88 45 F? 48 8B 45 C8 0F B6 80 01 01 00 00 }
		$op3 = { 48 89 45 ?? 48 8B 45 C8 0F B6 80 00 01 00 00 88 45 F? 48 8B 45 C8 0F B6 80 01 01 00 00 88 45 F? C7 45 F8 00 00 00 00 }
		$op4 = { 48 89 7D D8 89 75 D4 48 89 55 C8 48 8B 45 C8 48 89 45 ?? 48 8B 45 C8 0F B6 80 00 01 00 00 88 45 F? }
		$op5 = { 48 8B 45 ?8 C6 80 01 01 00 00 00 48 8B 45 ?8 0F B6 90 01 01 00 00 48 8B 45 ?8 88 90 00 01 00 00 C6 45 ?? 00 0F B6 45 }
		$op6 = { 89 75 D4 48 89 55 C8 48 8B 45 C8 48 89 45 ?? 48 8B 45 C8 0F B6 80 00 01 00 00 88 45 F? 48 8B 45 C8 }
	condition:
		uint16(0) == 0x457f and filesize < 200KB and 2 of them or 4 of them
}

rule ComputraceAgent {
	meta:
		description = "Absolute Computrace Agent Executable"
		thread_level = 3
		in_the_wild = true
	strings:
		$a = { D1 E0 F5 8B 4D 0C 83 D1 00 8B EC FF 33 83 C3 04 }
		$mz = { 4D 5A }
		$b1 = { 72 70 63 6E 65 74 70 2E 65 78 65 00 72 70 63 6E 65 74 70 00 }
		$b2 = { 54 61 67 49 64 00 }
	condition:
		($mz at 0) and ($a or ($b1 and $b2))
}

import "pe"

rule upx_packer_modified_pandora : Packer {
	meta:
		author = "Marius 'f0wL' Genheimer <hello@dissectingmalwa.re>"
		description = "Detects modified UPX packer used by Pandora Ransomware"
		reference = "https://dissectingmalwa.re/blog/pandora/"
		date = "2022-03-16"
		tlp = "WHITE"
		hash = "5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b"
	strings:
		$header = { 33 2E 30 30 00 55 50 58 21 }
	condition:
		uint16(0) == 0x5a4d and pe.imphash() == "51a8b4c9f41b0c0ca57db63e21505b0d" and $header and for any i in (0 .. pe.number_of_sections) : ( pe.sections[i].name == "pppp" and pe.sections[i + 1].name == "cccc" ) and filesize > 112KB and filesize < 1MB
}