rule Njrat
{
meta:
description = "Njrat"
author = "botherder https://github.com/botherder"
strings:
$string1 = /(F)romBase64String/
$string2 = /(B)ase64String/
$string3 = /(C)onnected/ wide ascii
$string4 = /(R)eceive/
$string5 = /(S)end/ wide ascii
$string6 = /(D)ownloadData/ wide ascii
$string7 = /(D)eleteSubKey/ wide ascii
$string8 = /(g)et_MachineName/
$string9 = /(g)et_UserName/
$string10 = /(g)et_LastWriteTime/
$string11 = /(G)etVolumeInformation/
$string12 = /(O)SFullName/ wide ascii
$string13 = /(n)etsh firewall/ wide
$string14 = /(c)md\.exe \/k ping 0 & del/ wide
$string15 = /(c)md\.exe \/c ping 127\.0\.0\.1 & del/ wide
$string16 = /(c)md\.exe \/c ping 0 -n 2 & del/ wide
$string17 = {7C 00 27 00 7C 00 27 00 7C}
condition:
10 of them
}
rule asyncrat {
meta:
author = "jeFF0Falltrades"
strings:
$val_async = "AsyncClient" wide ascii nocase
$val_schtasks = "/c schtasks /create /f /sc onlogon /rl highest /tn" wide ascii
$val_pong = "ActivatePong" wide ascii
$val_ext = "(ext8,ext16,ex32) type $c7,$c8,$c9" wide ascii
$aes_exc = "masterKey can not be null or empty" wide ascii
$aes_salt = { BF EB 1E 56 FB CD 97 3B B2 19 24 30 A5 78 43 3D 56 44 D2 1E 62 B9 D4 F1 80 E7 E6 C3 39 41 }
$patt_aes = { 6F [4] 80 ?? 00 00 04 7E ?? 00 00 04 73 }
$patt_settings = { 72 [2] 00 70 80 [2] 00 04 }
condition:
5 of them or (2 of ($val*) and 1 of ($aes*)) or (4 of them and #patt_settings >= 15)
}
rule AsyncRat
{
meta:
author = "kevoreilly, JPCERT/CC Incident Response Group"
description = "AsyncRat Payload"
cape_type = "AsyncRat Payload"
strings:
$salt = {BF EB 1E 56 FB CD 97 3B B2 19 02 24 30 A5 78 43 00 3D 56 44 D2 1E 62 B9 D4 F1 80 E7 E6 C3 39 41}
$b1 = {00 00 00 0D 53 00 48 00 41 00 32 00 35 00 36 00 00}
$b2 = {09 50 00 6F 00 6E 00 67 00 00}
$string1 = "Pastebin" ascii wide nocase
$string2 = "Pong" wide
$string3 = "Stub.exe" ascii wide
$kitty = "StormKitty" ascii
condition:
uint16(0) == 0x5A4D and not $kitty and ($salt and (2 of ($str*) or 1 of ($b*))) or (all of ($b*) and 2 of ($str*))
}
rule REMCOS_RAT_variants: remcos rat winmalware
{
meta:
Author = "Adam M. Swanda"
Website = "https://www.deadbits.org"
Repo = "https://github.com/deadbits/yara-rules"
Date = "2019-07-18"
Description = "Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian's recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type."
strings:
$funcs1 = "autogetofflinelogs" ascii fullword
$funcs2 = "clearlogins" ascii fullword
$funcs3 = "getofflinelogs" ascii fullword
$funcs4 = "execcom" ascii fullword
$funcs5 = "deletekeylog" ascii fullword
$funcs6 = "remscriptexecd" ascii fullword
$funcs7 = "getwindows" ascii fullword
$funcs8 = "fundlldata" ascii fullword
$funcs9 = "getfunlib" ascii fullword
$funcs10 = "autofflinelogs" ascii fullword
$funcs11 = "getclipboard" ascii fullword
$funcs12 = "getscrslist" ascii fullword
$funcs13 = "offlinelogs" ascii fullword
$funcs14 = "getcamsingleframe" ascii fullword
$funcs15 = "listfiles" ascii fullword
$funcs16 = "getproclist" ascii fullword
$funcs17 = "onlinelogs" ascii fullword
$funcs18 = "getdrives" ascii fullword
$funcs19 = "remscriptsuccess" ascii fullword
$funcs20 = "getcamframe" ascii fullword
$str_a1 = "C:\\Windows\\System32\\cmd.exe" ascii fullword
$str_a2 = "C:\\WINDOWS\\system32\\userinit.exe" ascii fullword
$str_a3 = "/k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWOR" ascii
$str_a4 = "/k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWOR" ascii
$str_a5 = "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" ascii fullword
$str_b1 = "CreateObject(\"Scripting.FileSystemObject\").DeleteFile(Wscript.ScriptFullName)" wide fullword
$str_b2 = "Executing file: " ascii fullword
$str_b3 = "GetDirectListeningPort" ascii fullword
$str_b4 = "Set fso = CreateObject(\"Scripting.FileSystemObject\")" wide fullword
$str_b5 = "licence_code.txt" ascii fullword
$str_b6 = "\\restart.vbs" wide fullword
$str_b7 = "\\update.vbs" wide fullword
$str_b8 = "\\uninstall.vbs" wide fullword
$str_b9 = "Downloaded file: " ascii fullword
$str_b10 = "Downloading file: " ascii fullword
$str_b11 = "KeepAlive Enabled! Timeout: %i seconds" ascii fullword
$str_b12 = "Failed to upload file: " ascii fullword
$str_b13 = "StartForward" ascii fullword
$str_b14 = "StopForward" ascii fullword
$str_b15 = "fso.DeleteFile \"" wide fullword
$str_b16 = "On Error Resume Next" wide fullword
$str_b17 = "fso.DeleteFolder \"" wide fullword
$str_b18 = "Uploaded file: " ascii fullword
$str_b19 = "Unable to delete: " ascii fullword
$str_b20 = "while fso.FileExists(\"" wide fullword
$str_c0 = "[Firefox StoredLogins not found]" ascii fullword
$str_c1 = "Software\\Classes\\mscfile\\shell\\open\\command" ascii fullword
$str_c2 = "[Chrome StoredLogins found, cleared!]" ascii fullword
$str_c3 = "[Chrome StoredLogins not found]" ascii fullword
$str_c4 = "[Firefox StoredLogins cleared!]" ascii fullword
$str_c5 = "Remcos_Mutex_Inj" ascii fullword
$str_c6 = "\\logins.json" ascii fullword
$str_c7 = "[Chrome Cookies found, cleared!]" ascii fullword
$str_c8 = "[Firefox Cookies not found]" ascii fullword
$str_c9 = "[Chrome Cookies not found]" ascii fullword
$str_c10 = "[Firefox cookies found, cleared!]" ascii fullword
$str_c11 = "mscfile\\shell\\open\\command" ascii fullword
$str_c12 = "\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" ascii fullword
$str_c13 = "eventvwr.exe" ascii fullword
condition:
uint16(0) == 0x5a4d and filesize < 600KB
and
(
((8 of ($funcs*)) or all of ($funcs*))
or
((1 of ($str_a*) and 4 of them) or all of ($str_a*))
or
((8 of ($str_b*)) or all of ($str_b*))
or
all of ($str_c*)
)
}
