├── malware ├── APT_Hikit.yar ├── LostDoor.yar ├── F0xy.yar ├── Bublik_downloader.yar ├── Zegost.yar ├── Grozlex.yar ├── YahLover.yar ├── Notepad.yar ├── Boouset.yar ├── Cerberus.yar ├── Turla.yar ├── ShadowTech.yar ├── Urausy.yar ├── FakeM.yar ├── jRAT.yar ├── Dexter.yar ├── Miscelanea_RTF.yar ├── LuckyCat.yar ├── Stealer.yar ├── Shamoon.yar ├── Mirage.yar ├── Android_Malware.yar ├── LogPOS.yar ├── PoisonIvy.yar ├── APT_pcclient.yar ├── APT_Kaba.yar ├── Leverage.yar ├── APT3102.yar ├── Ezcob.yar ├── BlackEnergy.yar ├── Kelihos.yar ├── Zeus.yar ├── NetPass.yar ├── RAT_Terminator.yar ├── Dridex.yar ├── Warp.yar ├── favorite.yar ├── PubSab.yar ├── Olyx.yar ├── Lenovo_superfish.yar ├── Yayih.yar ├── Njrat.yar ├── APT_NGO_wuaclt.yar ├── netwiredRC.yar ├── APT_DeputyDog_Fexel.yar ├── cxpid.yar ├── Safenet.yar ├── naspyupdate.yar ├── Install11.yar ├── Glasses.yar ├── PlugX.yar ├── Scarhikn.yar ├── NSFree.yar ├── Cookies.yar ├── Naikon.yar ├── Intel_Virtualization.yar ├── Bangat.yar ├── Wimmie.yar ├── T5000.yar ├── Vidgrab.yar ├── Regsubdat.yar ├── Babar.yar ├── NetTraveler.yar ├── Scieron.yar ├── Bolonyokte.yar ├── APT_Mongall.yar ├── MacControl.yar ├── KINS.yar ├── Ramsonware.yar ├── DarkComet.yar ├── APT9002.yar ├── APT_Careto.yar ├── Gh0st.yar ├── IMuler.yar ├── iexpl0ree.yar ├── Derusbi.yar ├── Rooter.yar ├── LURK0.yar ├── Skeleton.yar ├── Quarian.yar ├── RCS.yar ├── Xtreme.yar ├── Surtr.yar ├── Gholee.yar ├── Casper.yar ├── BlackShades.yar ├── WoolenGoldfish.yar ├── Enfal.yar ├── APT_c16.yar ├── Anthem_DeepPanda.yar ├── Waterbug.yar ├── APT_Hellsing.yar ├── FinSpy.yar ├── APT_OPCleaver.yar ├── Miscelanea_Linux.yar ├── Opcleaver.yar ├── FiveEyes.yar └── APT_Regin.yar ├── README.md ├── crypto.yar └── malicious_document.yar /malware/APT_Hikit.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule APT_Hikit_msrv 9 | { 10 | meta: 11 | author = "ThreatConnect Intelligence Research Team" 12 | strings: 13 | $m = {6D 73 72 76 2E 64 6C 6C 00 44 6C 6C} 14 | condition: 15 | any of them 16 | } 17 | -------------------------------------------------------------------------------- /malware/LostDoor.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule lost_door : Trojan 9 | { 10 | meta: 11 | author="Kevin Falcoz" 12 | date="23/02/2013" 13 | description="Lost Door" 14 | 15 | strings: 16 | $signature1={45 44 49 54 5F 53 45 52 56 45 52} /*EDIT_SERVER*/ 17 | 18 | condition: 19 | $signature1 20 | } 21 | -------------------------------------------------------------------------------- /malware/F0xy.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule ws_f0xy_downloader { 9 | meta: 10 | description = "f0xy malware downloader" 11 | author = "Nick Griffin (Websense)" 12 | 13 | strings: 14 | $mz="MZ" 15 | $string1="bitsadmin /transfer" 16 | $string2="del rm.bat" 17 | $string3="av_list=" 18 | 19 | condition: 20 | ($mz at 0) and (all of ($string*)) 21 | } 22 | -------------------------------------------------------------------------------- /malware/Bublik_downloader.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule Bublik : Downloader 9 | { 10 | meta: 11 | author="Kevin Falcoz" 12 | date="29/09/2013" 13 | description="Bublik Trojan Downloader" 14 | 15 | strings: 16 | $signature1={63 6F 6E 73 6F 6C 61 73} 17 | $signature2={63 6C 55 6E 00 69 6E 66 6F 2E 69 6E 69} 18 | 19 | condition: 20 | $signature1 and $signature2 21 | } 22 | -------------------------------------------------------------------------------- /malware/Zegost.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule Zegost : Trojan 9 | { 10 | meta: 11 | author="Kevin Falcoz" 12 | date="10/06/2013" 13 | description="Zegost Trojan" 14 | 15 | strings: 16 | $signature1={39 2F 66 33 30 4C 69 35 75 62 4F 35 44 4E 41 44 44 78 47 38 73 37 36 32 74 71 59 3D} 17 | $signature2={00 BA DA 22 51 42 6F 6D 65 00} 18 | 19 | condition: 20 | $signature1 and $signature2 21 | } 22 | -------------------------------------------------------------------------------- /malware/Grozlex.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule Grozlex : Stealer 9 | { 10 | meta: 11 | author="Kevin Falcoz" 12 | date="20/08/2013" 13 | description="Grozlex Stealer - Possible HCStealer" 14 | 15 | strings: 16 | $signature={4C 00 6F 00 67 00 73 00 20 00 61 00 74 00 74 00 61 00 63 00 68 00 65 00 64 00 20 00 62 00 79 00 20 00 69 00 43 00 6F 00 7A 00 65 00 6E} 17 | 18 | condition: 19 | $signature 20 | } 21 | -------------------------------------------------------------------------------- /malware/YahLover.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule YahLover : Worm 9 | { 10 | meta: 11 | author="Kevin Falcoz" 12 | date="10/06/2013" 13 | description="YahLover" 14 | 15 | strings: 16 | $signature1={42 00 49 00 54 00 52 00 4F 00 54 00 41 00 54 00 45 00 00 00 42 00 49 00 54 00 53 00 48 00 49 00 46 00 54 00 00 00 00 00 42 00 49 00 54 00 58 00 4F 00 52} 17 | 18 | condition: 19 | $signature1 20 | } 21 | 22 | -------------------------------------------------------------------------------- /malware/Notepad.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule TROJAN_Notepad { 9 | meta: 10 | Author = "RSA_IR" 11 | Date = "4Jun13" 12 | File = "notepad.exe v 1.1" 13 | MD5 = "106E63DBDA3A76BEEB53A8BBD8F98927" 14 | strings: 15 | $s1 = "75BAA77C842BE168B0F66C42C7885997" 16 | $s2 = "B523F63566F407F3834BCC54AAA32524" 17 | condition: 18 | $s1 or $s2 19 | } 20 | 21 | 22 | -------------------------------------------------------------------------------- /malware/Boouset.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule BoousetCode : Boouset Family 9 | { 10 | meta: 11 | description = "Boouset code tricks" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-19" 14 | 15 | strings: 16 | $boousetdat = { C6 ?? ?? ?? ?? 00 62 C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 75 } 17 | 18 | condition: 19 | any of them 20 | } 21 | 22 | -------------------------------------------------------------------------------- /malware/Cerberus.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule Cerberus : rat 9 | { 10 | meta: 11 | description = "Cerberus" 12 | author = "Jean-Philippe Teissier / @Jipe_" 13 | date = "2013-01-12" 14 | filetype = "memory" 15 | version = "1.0" 16 | 17 | strings: 18 | $checkin = "Ypmw1Syv023QZD" 19 | $clientpong = "wZ2pla" 20 | $serverping = "wBmpf3Pb7RJe" 21 | $generic = "cerberus" nocase 22 | 23 | condition: 24 | any of them 25 | } 26 | -------------------------------------------------------------------------------- /malware/Turla.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule WaterBug_turla_dll 9 | { 10 | meta: 11 | description = "Symantec Waterbug Attack - Trojan Turla DLL" 12 | author = "Symantec Security Response" 13 | date = "22.01.2015" 14 | reference = "http://t.co/rF35OaAXrl" 15 | 16 | strings: 17 | $a = /([A-Za-z0-9]{2,10}_){,2}Win32\.dll\x00/ 18 | 19 | condition: 20 | pe.exports("ee") and $a 21 | } 22 | -------------------------------------------------------------------------------- /malware/ShadowTech.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule ShadowTech 9 | { 10 | meta: 11 | description = "ShadowTech RAT" 12 | author = "botherder https://github.com/botherder" 13 | 14 | strings: 15 | $string1 = /\#(S)trings/ 16 | $string2 = /\#(G)UID/ 17 | $string3 = /\#(B)lob/ 18 | $string4 = /(S)hadowTech Rat\.exe/ 19 | $string5 = /(S)hadowTech_Rat/ 20 | 21 | condition: 22 | all of them 23 | } 24 | -------------------------------------------------------------------------------- /malware/Urausy.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule urausy_skype_dat { 9 | meta: 10 | author = "AlienVault Labs" 11 | description = "Yara rule to match against memory of processes infected by Urausy skype.dat" 12 | strings: 13 | $a = "skype.dat" ascii wide 14 | $b = "skype.ini" ascii wide 15 | $win1 = "CreateWindow" 16 | $win2 = "YIWEFHIWQ" ascii wide 17 | $desk1 = "CreateDesktop" 18 | $desk2 = "MyDesktop" ascii wide 19 | condition: 20 | $a and $b and (all of ($win*) or all of ($desk*)) 21 | } 22 | -------------------------------------------------------------------------------- /malware/FakeM.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule HTMLVariant : FakeM Family HTML Variant 9 | { 10 | meta: 11 | description = "Identifier for html variant of FAKEM" 12 | author = "Katie Kleemola" 13 | last_updated = "2014-05-20" 14 | 15 | strings: 16 | // decryption loop 17 | $s1 = { 8B 55 08 B9 00 50 00 00 8D 3D ?? ?? ?? 00 8B F7 AD 33 C2 AB 83 E9 04 85 C9 75 F5 } 18 | //mov byte ptr [ebp - x] y, x: 0x10-0x1 y: 0-9,A-F 19 | $s2 = { C6 45 F? (3?|4?) } 20 | 21 | condition: 22 | $s1 and #s2 == 16 23 | 24 | } 25 | -------------------------------------------------------------------------------- /malware/jRAT.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | rule jRAT_conf : rat 8 | { 9 | meta: 10 | description = "jRAT configuration" 11 | author = "Jean-Philippe Teissier / @Jipe_" 12 | date = "2013-10-11" 13 | filetype = "memory" 14 | version = "1.0" 15 | ref1 = "https://github.com/MalwareLu/config_extractor/blob/master/config_jRAT.py" 16 | ref2 = "http://www.ghettoforensics.com/2013/10/dumping-malware-configuration-data-from.html" 17 | 18 | strings: 19 | $a = /port=[0-9]{1,5}SPLIT/ 20 | 21 | condition: 22 | $a 23 | } 24 | -------------------------------------------------------------------------------- /malware/Dexter.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule Dexter_Malware { 9 | meta: 10 | description = "Detects the Dexter Trojan/Agent http://goo.gl/oBvy8b" 11 | author = "Florian Roth" 12 | reference = "http://goo.gl/oBvy8b" 13 | date = "2015/02/10" 14 | score = 70 15 | strings: 16 | $s0 = "Java Security Plugin" fullword wide 17 | $s1 = "%s\\%s\\%s.exe" fullword wide 18 | $s2 = "Sun Java Security Plugin" fullword wide 19 | $s3 = "\\Internet Explorer\\iexplore.exe" fullword wide 20 | condition: 21 | all of them 22 | } 23 | -------------------------------------------------------------------------------- /malware/Miscelanea_RTF.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | 9 | rule rtf_multiple 10 | { 11 | meta: 12 | author = "@patrickrolsen" 13 | maltype = "Multiple" 14 | version = "0.1" 15 | reference = "fd69a799e21ccb308531ce6056944842" 16 | date = "01/04/2014" 17 | strings: 18 | $rtf = { 7b 5c 72 74 ?? ?? } // {\rt01 {\rtf1 {\rtxa 19 | $string1 = "author user" 20 | $string2 = "title Vjkygdjdtyuj" nocase 21 | $string3 = "company ooo" 22 | $string4 = "password 00000000" 23 | condition: 24 | ($rtf at 0) and (all of ($string*)) 25 | } 26 | -------------------------------------------------------------------------------- /malware/LuckyCat.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule LuckyCatCode : LuckyCat Family 9 | { 10 | meta: 11 | description = "LuckyCat code tricks" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-19" 14 | 15 | strings: 16 | $xordecrypt = { BF 0F 00 00 00 F7 F7 ?? ?? ?? ?? 32 14 39 80 F2 7B } 17 | $dll = { C6 ?? ?? ?? 64 C6 ?? ?? ?? 6C C6 ?? ?? ?? 6C } 18 | $commonletters = { B? 63 B? 61 B? 73 B? 65 } 19 | 20 | condition: 21 | $xordecrypt or ($dll and $commonletters) 22 | } 23 | -------------------------------------------------------------------------------- /malware/Stealer.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule universal_1337_stealer_serveur : Stealer 9 | { 10 | meta: 11 | author="Kevin Falcoz" 12 | date="24/02/2013" 13 | description="Universal 1337 Stealer Serveur" 14 | 15 | strings: 16 | $signature1={2A 5B 53 2D 50 2D 4C 2D 49 2D 54 5D 2A} /*[S-P-L-I-T]*/ 17 | $signature2={2A 5B 48 2D 45 2D 52 2D 45 5D 2A} /*[H-E-R-E]*/ 18 | $signature3={46 54 50 7E} /*FTP~*/ 19 | $signature4={7E 31 7E 31 7E 30 7E 30} /*~1~1~0~0*/ 20 | 21 | condition: 22 | $signature1 and $signature2 or $signature3 and $signature4 23 | } 24 | -------------------------------------------------------------------------------- /malware/Shamoon.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | 9 | rule CrowdStrike_Shamoon_DroppedFile { 10 | meta: 11 | description = "Rule to detect Shamoon malware http://goo.gl/QTxohN" 12 | reference = "http://www.rsaconference.com/writable/presentations/file_upload/exp-w01-hacking-exposed-day-of-destruction.pdf" 13 | strings: 14 | $testn123 = "test123" wide 15 | $testn456 = "test456" wide 16 | $testn789 = "test789" wide 17 | $testdomain = "testdomain.com" wide $pingcmd = "ping -n 30 127.0.0.1 >nul" wide 18 | condition: 19 | (any of ($testn*) or $pingcmd) and $testdomain 20 | } 21 | -------------------------------------------------------------------------------- /malware/Mirage.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule MirageStrings : Mirage Family 9 | { 10 | meta: 11 | description = "Mirage Identifying Strings" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-25" 14 | 15 | strings: 16 | $ = "Neo,welcome to the desert of real." wide ascii 17 | $ = "/result?hl=en&id=%s" 18 | 19 | condition: 20 | any of them 21 | } 22 | 23 | rule Mirage : Family 24 | { 25 | meta: 26 | description = "Mirage" 27 | author = "Seth Hardy" 28 | last_modified = "2014-06-25" 29 | 30 | condition: 31 | MirageStrings 32 | } 33 | -------------------------------------------------------------------------------- /malware/Android_Malware.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule Android_Malware : iBanking 9 | { 10 | meta: 11 | author = "Xylitol xylitol@malwareint.com" 12 | date = "2014-02-14" 13 | description = "Match first two bytes, files and string present in iBanking" 14 | reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3166" 15 | 16 | strings: 17 | // Generic android 18 | $pk = {50 4B} 19 | $file1 = "AndroidManifest.xml" 20 | // iBanking related 21 | $file2 = "res/drawable-xxhdpi/ok_btn.jpg" 22 | $string1 = "bot_id" 23 | $string2 = "type_password2" 24 | condition: 25 | ($pk at 0 and 2 of ($file*) and ($string1 or $string2)) 26 | } 27 | -------------------------------------------------------------------------------- /malware/LogPOS.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | rule LogPOS 8 | { 9 | meta: 10 | author = "Morphick Security" 11 | description = "Detects Versions of LogPOS" 12 | md5 = "af13e7583ed1b27c4ae219e344a37e2b" 13 | strings: 14 | $mailslot = "\\\\.\\mailslot\\LogCC" 15 | $get = "GET /%s?encoding=%c&t=%c&cc=%I64d&process=" 16 | //64A130000000 mov eax, dword ptr fs:[0x30] 17 | //8B400C mov eax, dword ptr [eax + 0xc] 18 | //8B401C mov eax, dword ptr [eax + 0x1c] 19 | //8B4008 mov eax, dword ptr [eax + 8] 20 | $sc = {64 A1 30 00 00 00 8B 40 0C 8B 40 1C 8B 40 08 } 21 | condition: 22 | $sc and 1 of ($mailslot,$get) 23 | } 24 | -------------------------------------------------------------------------------- /malware/PoisonIvy.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule poisonivy : rat 9 | { 10 | meta: 11 | description = "Poison Ivy" 12 | author = "Jean-Philippe Teissier / @Jipe_" 13 | date = "2013-02-01" 14 | filetype = "memory" 15 | version = "1.0" 16 | ref1 = "https://code.google.com/p/volatility/source/browse/trunk/contrib/plugins/malware/poisonivy.py" 17 | 18 | strings: 19 | $a = { 53 74 75 62 50 61 74 68 ?? 53 4F 46 54 57 41 52 45 5C 43 6C 61 73 73 65 73 5C 68 74 74 70 5C 73 68 65 6C 6C 5C 6F 70 65 6E 5C 63 6F 6D 6D 61 6E 64 [22] 53 6F 66 74 77 61 72 65 5C 4D 69 63 72 6F 73 6F 66 74 5C 41 63 74 69 76 65 20 53 65 74 75 70 5C 49 6E 73 74 61 6C 6C 65 64 20 43 6F 6D 70 6F 6E 65 6E 74 73 5C } 20 | 21 | condition: 22 | $a 23 | } 24 | 25 | -------------------------------------------------------------------------------- /malware/APT_pcclient.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule backdoor_apt_pcclient 9 | { 10 | meta: 11 | author = "@patrickrolsen" 12 | maltype = "APT.PCCLient" 13 | filetype = "DLL" 14 | version = "0.1" 15 | description = "Detects the dropper: 869fa4dfdbabfabe87d334f85ddda234 AKA dw20.dll/msacm32.drv dropped by 4a85af37de44daf5917f545c6fd03902 (RTF)" 16 | date = "2012-10" 17 | strings: 18 | $magic = { 4d 5a } // MZ 19 | $string1 = "www.micro1.zyns.com" 20 | $string2 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" 21 | $string3 = "msacm32.drv" wide 22 | $string4 = "C:\\Windows\\Explorer.exe" wide 23 | $string5 = "Elevation:Administrator!" wide 24 | $string6 = "C:\\Users\\cmd\\Desktop\\msacm32\\Release\\msacm32.pdb" 25 | condition: 26 | $magic at 0 and 4 of ($string*) 27 | } 28 | -------------------------------------------------------------------------------- /malware/APT_Kaba.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule rtf_Kaba_jDoe 9 | { 10 | meta: 11 | author = "@patrickrolsen" 12 | maltype = "APT.Kaba" 13 | filetype = "RTF" 14 | version = "0.1" 15 | description = "fe439af268cd3de3a99c21ea40cf493f, d0e0e68a88dce443b24453cc951cf55f, b563af92f144dea7327c9597d9de574e, and def0c9a4c732c3a1e8910db3f9451620" 16 | date = "2013-12-10" 17 | strings: 18 | $magic1 = { 7b 5c 72 74 30 31 } // {\rt01 19 | $magic2 = { 7b 5c 72 74 66 31 } // {\rtf1 20 | $magic3 = { 7b 5c 72 74 78 61 33 } // {\rtxa3 21 | $author1 = { 4A 6F 68 6E 20 44 6F 65 } // "John Doe" 22 | $author2 = { 61 75 74 68 6f 72 20 53 74 6f 6e 65 } // "author Stone" 23 | $string1 = { 44 30 [16] 43 46 [23] 31 31 45 } 24 | condition: 25 | ($magic1 or $magic2 or $magic3 at 0) and all of ($author*) and $string1 26 | } 27 | -------------------------------------------------------------------------------- /malware/Leverage.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule leverage_a 9 | { 10 | meta: 11 | author = "earada@alienvault.com" 12 | version = "1.0" 13 | description = "OSX/Leverage.A" 14 | date = "2013/09" 15 | strings: 16 | $a1 = "ioreg -l | grep \"IOPlatformSerialNumber\" | awk -F" 17 | $a2 = "+:Users:Shared:UserEvent.app:Contents:MacOS:" 18 | $a3 = "rm '/Users/Shared/UserEvent.app/Contents/Resources/UserEvent.icns'" 19 | $script1 = "osascript -e 'tell application \"System Events\" to get the hidden of every login item'" 20 | $script2 = "osascript -e 'tell application \"System Events\" to get the name of every login item'" 21 | $script3 = "osascript -e 'tell application \"System Events\" to get the path of every login item'" 22 | $properties = "serverVisible \x00" 23 | condition: 24 | all of them 25 | } 26 | -------------------------------------------------------------------------------- /malware/APT3102.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule APT3102Code : APT3102 Family 9 | { 10 | meta: 11 | description = "3102 code features" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-25" 14 | 15 | strings: 16 | $setupthread = { B9 02 07 00 00 BE ?? ?? ?? ?? 8B F8 6A 00 F3 A5 } 17 | 18 | condition: 19 | any of them 20 | } 21 | 22 | rule APT3102Strings : APT3102 Family 23 | { 24 | meta: 25 | description = "3102 Identifying Strings" 26 | author = "Seth Hardy" 27 | last_modified = "2014-06-25" 28 | 29 | strings: 30 | $ = "rundll32_exec.dll\x00Update" 31 | // this is in the encrypted code - shares with 9002 variant 32 | //$ = "POST http://%ls:%d/%x HTTP/1.1" 33 | 34 | condition: 35 | any of them 36 | } 37 | -------------------------------------------------------------------------------- /malware/Ezcob.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule EzcobStrings : Ezcob Family 9 | { 10 | meta: 11 | description = "Ezcob Identifying Strings" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-23" 14 | 15 | strings: 16 | $ = "\x12F\x12F\x129\x12E\x12A\x12E\x12B\x12A\x12-\x127\x127\x128\x123\x12" 17 | $ = "\x121\x12D\x128\x123\x12B\x122\x12E\x128\x12-\x12B\x122\x123\x12D\x12" 18 | $ = "Ezcob" wide ascii 19 | $ = "l\x12i\x12u\x122\x120\x121\x123\x120\x124\x121\x126" 20 | $ = "20110113144935" 21 | 22 | condition: 23 | any of them 24 | } 25 | 26 | rule Ezcob : Family 27 | { 28 | meta: 29 | description = "Ezcob" 30 | author = "Seth Hardy" 31 | last_modified = "2014-06-23" 32 | 33 | condition: 34 | EzcobStrings 35 | } 36 | -------------------------------------------------------------------------------- /malware/BlackEnergy.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule BlackEnergy_BE_2 { 9 | meta: 10 | description = "Detects BlackEnergy 2 Malware" 11 | author = "Florian Roth" 12 | reference = "http://goo.gl/DThzLz" 13 | date = "2015/02/19" 14 | hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77" 15 | strings: 16 | $mz = { 4d 5a } 17 | $s0 = " Windows system utility service " fullword ascii 18 | $s1 = "WindowsSysUtility - Unicode" fullword wide 19 | $s2 = "msiexec.exe" fullword wide 20 | $s3 = "WinHelpW" fullword ascii 21 | $s4 = "ReadProcessMemory" fullword ascii 22 | condition: 23 | ( $mz at 0 ) and filesize < 250KB and all of ($s*) 24 | } 25 | -------------------------------------------------------------------------------- /malware/Kelihos.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule KelihosHlux 9 | { 10 | meta: 11 | author = "@malpush" 12 | maltype = "KelihosHlux" 13 | description = "http://malwared.ru" 14 | date = "22/02/2014" 15 | strings: 16 | $KelihosHlux_HexString = { 73 20 7D 8B FE 95 E4 12 4F 3F 99 3F 6E C8 28 26 C2 41 D9 8F C1 6A 72 A6 CE 36 0F 73 DD 2A 72 B0 CC D1 07 8B 2B 98 73 0E 7E 8C 07 DC 6C 71 63 F4 23 27 DD 17 56 AE AB 1E 30 52 E7 54 51 F7 20 ED C7 2D 4B 72 E0 77 8E B4 D2 A8 0D 8D 6A 64 F9 B7 7B 08 70 8D EF F3 9A 77 F6 0D 88 3A 8F BB C8 89 F5 F8 39 36 BA 0E CB 38 40 BF 39 73 F4 01 DC C1 17 BF C1 76 F6 84 8F BD 87 76 BC 7F 85 41 81 BD C6 3F BC 39 BD C0 89 47 3E 92 BD 80 60 9D 89 15 6A C6 B9 89 37 C4 FF 00 3D 45 38 09 CD 29 00 90 BB B6 38 FD 28 9C 01 39 0E F9 30 A9 66 6B 19 C9 F8 4C 3E B1 C7 CB 1B C9 3A 87 3E 8E 74 E7 71 D1 } 17 | 18 | condition: 19 | $KelihosHlux_HexString 20 | } 21 | -------------------------------------------------------------------------------- /malware/Zeus.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule Windows_Malware : Zeus_1134 9 | { 10 | meta: 11 | author = "Xylitol xylitol@malwareint.com" 12 | date = "2014-03-03" 13 | description = "Match first two bytes, protocol and string present in Zeus 1.1.3.4" 14 | reference = "http://www.xylibox.com/2014/03/zeus-1134.html" 15 | 16 | strings: 17 | $mz = {4D 5A} 18 | $protocol1 = "X_ID: " 19 | $protocol2 = "X_OS: " 20 | $protocol3 = "X_BV: " 21 | $stringR1 = "InitializeSecurityDescriptor" 22 | $stringR2 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 23 | condition: 24 | ($mz at 0 and all of ($protocol*) and ($stringR1 or $stringR2)) 25 | } 26 | -------------------------------------------------------------------------------- /malware/NetPass.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule NetpassStrings : NetPass Variant { 9 | 10 | meta: 11 | description = "Identifiers for netpass variant" 12 | author = "Katie Kleemola" 13 | last_updated = "2014-05-29" 14 | 15 | strings: 16 | $exif1 = "Device Protect ApplicatioN" wide 17 | $exif2 = "beep.sys" wide //embedded exe name 18 | $exif3 = "BEEP Driver" wide //embedded exe description 19 | 20 | $string1 = "\x00NetPass Update\x00" 21 | $string2 = "\x00%s:DOWNLOAD\x00" 22 | $string3 = "\x00%s:UPDATE\x00" 23 | $string4 = "\x00%s:uNINSTALL\x00" 24 | 25 | condition: 26 | all of ($exif*) or any of ($string*) 27 | 28 | } 29 | 30 | rule NetPass : Variant { 31 | meta: 32 | description = "netpass variant" 33 | author = "Katie Kleemola" 34 | last_updated = "2014-07-08" 35 | condition: 36 | NetpassStrings 37 | } 38 | 39 | 40 | -------------------------------------------------------------------------------- /malware/RAT_Terminator.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | 9 | rule TerminatorRat : rat 10 | { 11 | meta: 12 | description = "Terminator RAT" 13 | author = "Jean-Philippe Teissier / @Jipe_" 14 | date = "2013-10-24" 15 | filetype = "memory" 16 | version = "1.0" 17 | ref1 = "http://www.fireeye.com/blog/technical/malware-research/2013/10/evasive-tactics-terminator-rat.html" 18 | 19 | strings: 20 | $a = "Accelorator" 21 | $b = "12356" 22 | 23 | condition: 24 | all of them 25 | } 26 | 27 | 28 | 29 | rule TROJAN_Notepad_shell_crew { 30 | meta: 31 | author = "RSA_IR" 32 | Date = "4Jun13" 33 | File = "notepad.exe v 1.1" 34 | MD5 = "106E63DBDA3A76BEEB53A8BBD8F98927" 35 | strings: 36 | $s1 = "75BAA77C842BE168B0F66C42C7885997" 37 | $s2 = "B523F63566F407F3834BCC54AAA32524" 38 | condition: 39 | $s1 or $s2 40 | } 41 | -------------------------------------------------------------------------------- /malware/Dridex.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule Dridex_Trojan_XML { 9 | meta: 10 | description = "Dridex Malware in XML Document" 11 | author = "Florian Roth @4nc4p" 12 | reference = "https://threatpost.com/dridex-banking-trojan-spreading-via-macros-in-xml-files/111503" 13 | date = "2015/03/08" 14 | hash1 = "88d98e18ed996986d26ce4149ae9b2faee0bc082" 15 | hash2 = "3b2d59adadf5ff10829bb5c27961b22611676395" 16 | hash3 = "e528671b1b32b3fa2134a088bfab1ba46b468514" 17 | hash4 = "981369cd53c022b434ee6d380aa9884459b63350" 18 | hash5 = "96e1e7383457293a9b8f2c75270b58da0e630bea" 19 | strings: 20 | // can be ascii or wide formatted - therefore no restriction 21 | $c_xml = "" 23 | $c_macro = "w:macrosPresent=\"yes\"" 24 | $c_binary = "0" 26 | $c_1_line = "1" 27 | condition: 28 | all of ($c*) 29 | } 30 | -------------------------------------------------------------------------------- /malware/Warp.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule WarpCode : Warp Family 9 | { 10 | meta: 11 | description = "Warp code features" 12 | author = "Seth Hardy" 13 | last_modified = "2014-07-10" 14 | 15 | strings: 16 | // character replacement 17 | $ = { 80 38 2B 75 03 C6 00 2D 80 38 2F 75 03 C6 00 5F } 18 | 19 | condition: 20 | any of them 21 | } 22 | 23 | rule WarpStrings : Warp Family 24 | { 25 | meta: 26 | description = "Warp Identifying Strings" 27 | author = "Seth Hardy" 28 | last_modified = "2014-07-10" 29 | 30 | strings: 31 | $ = "/2011/n325423.shtml?" 32 | $ = "wyle" 33 | $ = "\\~ISUN32.EXE" 34 | 35 | condition: 36 | any of them 37 | } 38 | 39 | rule Warp : Family 40 | { 41 | meta: 42 | description = "Warp" 43 | author = "Seth Hardy" 44 | last_modified = "2014-07-10" 45 | 46 | condition: 47 | WarpCode or WarpStrings 48 | } 49 | -------------------------------------------------------------------------------- /malware/favorite.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule FavoriteCode : Favorite Family 9 | { 10 | meta: 11 | description = "Favorite code features" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-24" 14 | 15 | strings: 16 | // standard string hiding 17 | $ = { C6 45 ?? 3B C6 45 ?? 27 C6 45 ?? 34 C6 45 ?? 75 C6 45 ?? 6B C6 45 ?? 6C C6 45 ?? 3B C6 45 ?? 2F } 18 | $ = { C6 45 ?? 6F C6 45 ?? 73 C6 45 ?? 73 C6 45 ?? 76 C6 45 ?? 63 C6 45 ?? 65 C6 45 ?? 78 C6 45 ?? 65 } 19 | 20 | condition: 21 | any of them 22 | } 23 | 24 | rule FavoriteStrings : Favorite Family 25 | { 26 | meta: 27 | description = "Favorite Identifying Strings" 28 | author = "Seth Hardy" 29 | last_modified = "2014-06-24" 30 | 31 | strings: 32 | $string1 = "!QAZ4rfv" 33 | $file1 = "msupdater.exe" 34 | $file2 = "FAVORITES.DAT" 35 | 36 | condition: 37 | any of ($string*) or all of ($file*) 38 | } 39 | -------------------------------------------------------------------------------- /malware/PubSab.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule PubSabCode : PubSab Family 9 | { 10 | meta: 11 | description = "PubSab code tricks" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-19" 14 | 15 | strings: 16 | $decrypt = { 6B 45 E4 37 89 CA 29 C2 89 55 E4 } 17 | 18 | condition: 19 | any of them 20 | } 21 | 22 | rule PubSabStrings : PubSab Family 23 | { 24 | meta: 25 | description = "PubSab Identifying Strings" 26 | author = "Seth Hardy" 27 | last_modified = "2014-06-19" 28 | 29 | strings: 30 | $ = "_deamon_init" 31 | $ = "com.apple.PubSabAgent" 32 | $ = "/tmp/screen.jpeg" 33 | 34 | condition: 35 | any of them 36 | } 37 | 38 | rule PubSab : Family 39 | { 40 | meta: 41 | description = "PubSab" 42 | author = "Seth Hardy" 43 | last_modified = "2014-06-19" 44 | 45 | condition: 46 | PubSabCode or PubSabStrings 47 | } 48 | -------------------------------------------------------------------------------- /malware/Olyx.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule OlyxCode : Olyx Family 9 | { 10 | meta: 11 | description = "Olyx code tricks" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-19" 14 | 15 | strings: 16 | $six = { C7 40 04 36 36 36 36 C7 40 08 36 36 36 36 } 17 | $slash = { C7 40 04 5C 5C 5C 5C C7 40 08 5C 5C 5C 5C } 18 | 19 | condition: 20 | any of them 21 | } 22 | 23 | rule OlyxStrings : Olyx Family 24 | { 25 | meta: 26 | description = "Olyx Identifying Strings" 27 | author = "Seth Hardy" 28 | last_modified = "2014-06-19" 29 | 30 | strings: 31 | $ = "/Applications/Automator.app/Contents/MacOS/DockLight" 32 | 33 | condition: 34 | any of them 35 | } 36 | 37 | rule Olyx : Family 38 | { 39 | meta: 40 | description = "Olyx" 41 | author = "Seth Hardy" 42 | last_modified = "2014-06-19" 43 | 44 | condition: 45 | OlyxCode or OlyxStrings 46 | } 47 | -------------------------------------------------------------------------------- /malware/Lenovo_superfish.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | /* LENOVO Superfish -------------------------------------------------------- */ 9 | 10 | rule VisualDiscovery_Lonovo_Superfish_SSL_Hijack { 11 | meta: 12 | description = "Lenovo Superfish SSL Interceptor - file VisualDiscovery.exe" 13 | author = "Florian Roth / improved by kbandla" 14 | reference = "https://twitter.com/4nc4p/status/568325493558272000" 15 | date = "2015/02/19" 16 | hash1 = "99af9cfc7ab47f847103b5497b746407dc566963" 17 | hash2 = "f0b0cd0227ba302ac9ab4f30d837422c7ae66c46" 18 | hash3 = "f12edf2598d8f0732009c5cd1df5d2c559455a0b" 19 | hash4 = "343af97d47582c8150d63cbced601113b14fcca6" 20 | strings: 21 | $mz = { 4d 5a } 22 | //$s1 = "VisualDiscovery.exe" fullword wide 23 | $s2 = "Invalid key length used to initialize BlowFish." fullword ascii 24 | $s3 = "GetPCProxyHandler" fullword ascii 25 | $s4 = "StartPCProxy" fullword ascii 26 | $s5 = "SetPCProxyHandler" fullword ascii 27 | condition: 28 | ( $mz at 0 ) and filesize < 2MB and all of ($s*) 29 | } 30 | -------------------------------------------------------------------------------- /malware/Yayih.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule YayihCode : Yayih Family 9 | { 10 | meta: 11 | description = "Yayih code features" 12 | author = "Seth Hardy" 13 | last_modified = "2014-07-11" 14 | 15 | strings: 16 | // encryption 17 | $ = { 80 04 08 7A 03 C1 8B 45 FC 80 34 08 19 03 C1 41 3B 0A 7C E9 } 18 | 19 | condition: 20 | any of them 21 | } 22 | 23 | rule YayihStrings : Yayih Family 24 | { 25 | meta: 26 | description = "Yayih Identifying Strings" 27 | author = "Seth Hardy" 28 | last_modified = "2014-07-11" 29 | 30 | strings: 31 | $ = "/bbs/info.asp" 32 | $ = "\\msinfo.exe" 33 | $ = "%s\\%srcs.pdf" 34 | $ = "\\aumLib.ini" 35 | 36 | condition: 37 | any of them 38 | } 39 | 40 | rule Yayih : Family 41 | { 42 | meta: 43 | description = "Yayih" 44 | author = "Seth Hardy" 45 | last_modified = "2014-07-11" 46 | 47 | condition: 48 | YayihCode or YayihStrings 49 | } 50 | 51 | -------------------------------------------------------------------------------- /malware/Njrat.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule Njrat 9 | { 10 | meta: 11 | description = "Njrat" 12 | author = "botherder https://github.com/botherder" 13 | 14 | strings: 15 | $string1 = /(F)romBase64String/ 16 | $string2 = /(B)ase64String/ 17 | $string3 = /(C)onnected/ wide ascii 18 | $string4 = /(R)eceive/ 19 | $string5 = /(S)end/ wide ascii 20 | $string6 = /(D)ownloadData/ wide ascii 21 | $string7 = /(D)eleteSubKey/ wide ascii 22 | $string8 = /(g)et_MachineName/ 23 | $string9 = /(g)et_UserName/ 24 | $string10 = /(g)et_LastWriteTime/ 25 | $string11 = /(G)etVolumeInformation/ 26 | $string12 = /(O)SFullName/ wide ascii 27 | $string13 = /(n)etsh firewall/ wide 28 | $string14 = /(c)md\.exe \/k ping 0 & del/ wide 29 | $string15 = /(c)md\.exe \/c ping 127\.0\.0\.1 & del/ wide 30 | $string16 = /(c)md\.exe \/c ping 0 -n 2 & del/ wide 31 | $string17 = {7C 00 27 00 7C 00 27 00 7C} 32 | 33 | condition: 34 | 10 of them 35 | } 36 | -------------------------------------------------------------------------------- /malware/APT_NGO_wuaclt.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule APT_NGO_wuaclt 9 | { 10 | meta: 11 | author = "AlienVault Labs" 12 | strings: 13 | $a = "%%APPDATA%%\\Microsoft\\wuauclt\\wuauclt.dat" 14 | $b = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 15 | $c = "/news/show.asp?id%d=%d" 16 | 17 | $d = "%%APPDATA%%\\Microsoft\\wuauclt\\" 18 | $e = "0l23kj@nboxu" 19 | 20 | $f = "%%s.asp?id=%%d&Sid=%%d" 21 | $g = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SP Q%%d)" 22 | $h = "Cookies: UseID=KGIOODAOOK%%s" 23 | 24 | condition: 25 | ($a and $b and $c) or ($d and $e) or ($f and $g and $h) 26 | } 27 | 28 | rule APT_NGO_wuaclt_PDF 29 | { 30 | meta: 31 | author = "AlienVault Labs" 32 | 33 | strings: 34 | $pdf = "%PDF" nocase 35 | $comment = {3C 21 2D 2D 0D 0A 63 57 4B 51 6D 5A 6C 61 56 56 56 56 56 56 56 56 56 56 56 56 56 63 77 53 64 63 6A 4B 7A 38 35 6D 37 4A 56 6D 37 4A 46 78 6B 5A 6D 5A 6D 52 44 63 5A 58 41 73 6D 5A 6D 5A 7A 42 4A 31 79 73 2F 4F 0D 0A} 36 | 37 | condition: 38 | $pdf at 0 and $comment in (0..200) 39 | } 40 | -------------------------------------------------------------------------------- /malware/netwiredRC.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | rule NetWiredRC_B : rat 8 | { 9 | meta: 10 | description = "NetWiredRC" 11 | author = "Jean-Philippe Teissier / @Jipe_" 12 | date = "2014-12-23" 13 | filetype = "memory" 14 | version = "1.1" 15 | 16 | strings: 17 | $mutex = "LmddnIkX" 18 | 19 | $str1 = "%s.Identifier" 20 | $str2 = "%d:%I64u:%s%s;" 21 | $str3 = "%s%.2d-%.2d-%.4d" 22 | $str4 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]" 23 | $str5 = "%.2d/%.2d/%d %.2d:%.2d:%.2d" 24 | 25 | $klg1 = "[Backspace]" 26 | $klg2 = "[Enter]" 27 | $klg3 = "[Tab]" 28 | $klg4 = "[Arrow Left]" 29 | $klg5 = "[Arrow Up]" 30 | $klg6 = "[Arrow Right]" 31 | $klg7 = "[Arrow Down]" 32 | $klg8 = "[Home]" 33 | $klg9 = "[Page Up]" 34 | $klg10 = "[Page Down]" 35 | $klg11 = "[End]" 36 | $klg12 = "[Break]" 37 | $klg13 = "[Delete]" 38 | $klg14 = "[Insert]" 39 | $klg15 = "[Print Screen]" 40 | $klg16 = "[Scroll Lock]" 41 | $klg17 = "[Caps Lock]" 42 | $klg18 = "[Alt]" 43 | $klg19 = "[Esc]" 44 | $klg20 = "[Ctrl+%c]" 45 | 46 | condition: 47 | $mutex or (1 of ($str*) and 1 of ($klg*)) 48 | } 49 | -------------------------------------------------------------------------------- /malware/APT_DeputyDog_Fexel.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule APT_DeputyDog_Fexel 9 | { 10 | meta: 11 | author = "ThreatConnect Intelligence Research Team" 12 | strings: 13 | $180 = "180.150.228.102" wide ascii 14 | $0808cmd = {25 30 38 78 30 38 78 00 5C 00 63 00 6D 00 64 00 2E 00 65 00 78 00 65 [2-6] 43 00 61 00 6E 00 27 00 74 00 20 00 6F 00 70 00 65 00 6E 00 20 00 73 00 68 00 65 00 6C 00 6C 00 21} 15 | $cUp = "Upload failed! [Remote error code:" nocase wide ascii 16 | $DGGYDSYRL = {00 44 47 47 59 44 53 59 52 4C 00} 17 | $GDGSYDLYR = "GDGSYDLYR_%" wide ascii 18 | condition: 19 | any of them 20 | } 21 | 22 | rule APT_DeputyDog 23 | { 24 | meta: 25 | Author = "FireEye Labs" 26 | Date = "2013/09/21" 27 | Description = "detects string seen in samples used in 2013-3893 0day attacks" 28 | Reference = "https://www.fireeye.com/blog/threat-research/2013/09/operation-deputydog-zero-day-cve-2013-3893-attack-against-japanese-targets.html" 29 | 30 | strings: 31 | $mz = {4d 5a} 32 | $a = "DGGYDSYRL" 33 | 34 | condition: 35 | ($mz at 0) and $a 36 | } -------------------------------------------------------------------------------- /malware/cxpid.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule cxpidStrings : cxpid Family 9 | { 10 | meta: 11 | description = "cxpid Identifying Strings" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-23" 14 | 15 | strings: 16 | $ = "/cxpid/submit.php?SessionID=" 17 | $ = "/cxgid/" 18 | $ = "E21BC52BEA2FEF26D005CF" 19 | $ = "E21BC52BEA39E435C40CD8" 20 | $ = " -,L-,O+,Q-,R-,Y-,S-" 21 | 22 | condition: 23 | any of them 24 | } 25 | 26 | rule cxpidCode : cxpid Family 27 | { 28 | meta: 29 | description = "cxpid code features" 30 | author = "Seth Hardy" 31 | last_modified = "2014-06-23" 32 | 33 | strings: 34 | $entryjunk = { 55 8B EC B9 38 04 00 00 6A 00 6A 00 49 75 F9 } 35 | 36 | condition: 37 | any of them 38 | } 39 | 40 | rule cxpid : Family 41 | { 42 | meta: 43 | description = "cxpid" 44 | author = "Seth Hardy" 45 | last_modified = "2014-06-23" 46 | 47 | condition: 48 | cxpidCode or cxpidStrings 49 | } 50 | -------------------------------------------------------------------------------- /malware/Safenet.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule SafeNetCode : SafeNet Family 9 | { 10 | meta: 11 | description = "SafeNet code features" 12 | author = "Seth Hardy" 13 | last_modified = "2014-07-16" 14 | 15 | strings: 16 | // add edi, 14h; cmp edi, 50D0F8h 17 | $ = { 83 C7 14 81 FF F8 D0 40 00 } 18 | condition: 19 | any of them 20 | } 21 | 22 | rule SafeNetStrings : SafeNet Family 23 | { 24 | meta: 25 | description = "Strings used by SafeNet" 26 | author = "Seth Hardy" 27 | last_modified = "2014-07-16" 28 | 29 | strings: 30 | $ = "6dNfg8Upn5fBzGgj8licQHblQvLnUY19z5zcNKNFdsDhUzuI8otEsBODrzFCqCKr" 31 | $ = "/safe/record.php" 32 | $ = "_Rm.bat" wide ascii 33 | $ = "try\x0d\x0a\x09\x09\x09\x09 del %s" wide ascii 34 | $ = "Ext.org" wide ascii 35 | 36 | condition: 37 | any of them 38 | 39 | } 40 | 41 | rule SafeNet : Family 42 | { 43 | meta: 44 | description = "SafeNet family" 45 | 46 | condition: 47 | SafeNetCode or SafeNetStrings 48 | 49 | } 50 | 51 | -------------------------------------------------------------------------------- /malware/naspyupdate.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule nAspyUpdateCode : nAspyUpdate Family 9 | { 10 | meta: 11 | description = "nAspyUpdate code features" 12 | author = "Seth Hardy" 13 | last_modified = "2014-07-14" 14 | 15 | strings: 16 | // decryption loop in dropper 17 | $ = { 8A 54 24 14 8A 01 32 C2 02 C2 88 01 41 4E 75 F4 } 18 | 19 | condition: 20 | any of them 21 | } 22 | 23 | rule nAspyUpdateStrings : nAspyUpdate Family 24 | { 25 | meta: 26 | description = "nAspyUpdate Identifying Strings" 27 | author = "Seth Hardy" 28 | last_modified = "2014-07-14" 29 | 30 | strings: 31 | $ = "\\httpclient.txt" 32 | $ = "password <=14" 33 | $ = "/%ldn.txt" 34 | $ = "Kill You\x00" 35 | 36 | condition: 37 | any of them 38 | } 39 | 40 | rule nAspyUpdate : Family 41 | { 42 | meta: 43 | description = "nAspyUpdate" 44 | author = "Seth Hardy" 45 | last_modified = "2014-07-14" 46 | 47 | condition: 48 | nAspyUpdateCode or nAspyUpdateStrings 49 | } 50 | 51 | 52 | -------------------------------------------------------------------------------- /malware/Install11.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule Insta11Code : Insta11 Family 9 | { 10 | meta: 11 | description = "Insta11 code features" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-23" 14 | 15 | strings: 16 | // jmp $+5; push 423h 17 | $jumpandpush = { E9 00 00 00 00 68 23 04 00 00 } 18 | 19 | condition: 20 | any of them 21 | } 22 | 23 | rule Insta11Strings : Insta11 Family 24 | { 25 | meta: 26 | description = "Insta11 Identifying Strings" 27 | author = "Seth Hardy" 28 | last_modified = "2014-06-23" 29 | 30 | strings: 31 | $ = "XTALKER7" 32 | $ = "Insta11 Microsoft" wide ascii 33 | $ = "wudMessage" 34 | $ = "ECD4FC4D-521C-11D0-B792-00A0C90312E1" 35 | $ = "B12AE898-D056-4378-A844-6D393FE37956" 36 | 37 | condition: 38 | any of them 39 | } 40 | 41 | rule Insta11 : Family 42 | { 43 | meta: 44 | description = "Insta11" 45 | author = "Seth Hardy" 46 | last_modified = "2014-06-23" 47 | 48 | condition: 49 | Insta11Code or Insta11Strings 50 | } 51 | -------------------------------------------------------------------------------- /malware/Glasses.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule GlassesCode : Glasses Family 9 | { 10 | meta: 11 | description = "Glasses code features" 12 | author = "Seth Hardy" 13 | last_modified = "2014-07-22" 14 | 15 | strings: 16 | $ = { B8 AB AA AA AA F7 E1 D1 EA 8D 04 52 2B C8 } 17 | $ = { B8 56 55 55 55 F7 E9 8B 4C 24 1C 8B C2 C1 E8 1F 03 D0 49 3B CA } 18 | 19 | condition: 20 | any of them 21 | } 22 | 23 | rule GlassesStrings : Glasses Family 24 | { 25 | meta: 26 | description = "Strings used by Glasses" 27 | author = "Seth Hardy" 28 | last_modified = "2014-07-22" 29 | 30 | strings: 31 | $ = "thequickbrownfxjmpsvalzydg" 32 | $ = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0; Trident/4.0; %s.%s)" 33 | $ = "\" target=\"NewRef\">" 34 | 35 | condition: 36 | all of them 37 | 38 | } 39 | 40 | rule Glasses : Family 41 | { 42 | meta: 43 | description = "Glasses family" 44 | author = "Seth Hardy" 45 | last_modified = "2014-07-22" 46 | 47 | condition: 48 | GlassesCode or GlassesStrings 49 | 50 | } 51 | -------------------------------------------------------------------------------- /malware/PlugX.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule PlugXStrings : PlugX Family 9 | { 10 | meta: 11 | description = "PlugX Identifying Strings" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-12" 14 | 15 | strings: 16 | $BootLDR = "boot.ldr" wide ascii 17 | $Dwork = "d:\\work" nocase 18 | $Plug25 = "plug2.5" 19 | $Plug30 = "Plug3.0" 20 | $Shell6 = "Shell6" 21 | 22 | condition: 23 | $BootLDR or ($Dwork and ($Plug25 or $Plug30 or $Shell6)) 24 | } 25 | 26 | rule plugX : rat 27 | { 28 | meta: 29 | author = "Jean-Philippe Teissier / @Jipe_" 30 | description = "PlugX RAT" 31 | date = "2014-05-13" 32 | filetype = "memory" 33 | version = "1.0" 34 | ref1 = "https://github.com/mattulm/IR-things/blob/master/volplugs/plugx.py" 35 | 36 | strings: 37 | $v1a = { 47 55 4C 50 00 00 00 00 } 38 | $v1b = "/update?id=%8.8x" 39 | $v1algoa = { BB 33 33 33 33 2B } 40 | $v1algob = { BB 44 44 44 44 2B } 41 | $v2a = "Proxy-Auth:" 42 | $v2b = { 68 A0 02 00 00 } 43 | $v2k = { C1 8F 3A 71 } 44 | 45 | condition: 46 | $v1a at 0 or $v1b or (($v2a or $v2b) and (($v1algoa and $v1algob) or $v2k)) 47 | } 48 | -------------------------------------------------------------------------------- /malware/Scarhikn.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule ScarhiknStrings : Scarhikn Family 9 | { 10 | meta: 11 | description = "Scarhikn Identifying Strings" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-25" 14 | 15 | strings: 16 | $ = "9887___skej3sd" 17 | $ = "haha123" 18 | 19 | condition: 20 | any of them 21 | } 22 | 23 | 24 | 25 | rule ScarhiknCode : Scarhikn Family 26 | { 27 | meta: 28 | description = "Scarhikn code features" 29 | author = "Seth Hardy" 30 | last_modified = "2014-06-25" 31 | 32 | strings: 33 | // decryption 34 | $ = { 8B 06 8A 8B ?? ?? ?? ?? 30 0C 38 03 C7 55 43 E8 ?? ?? ?? ?? 3B D8 59 72 E7 } 35 | $ = { 8B 02 8A 8D ?? ?? ?? ?? 30 0C 30 03 C6 8B FB 83 C9 FF 33 C0 45 F2 AE F7 D1 49 3B E9 72 E2 } 36 | 37 | condition: 38 | any of them 39 | } 40 | 41 | rule Scarhikn : Family 42 | { 43 | meta: 44 | description = "Scarhikn" 45 | author = "Seth Hardy" 46 | last_modified = "2014-06-25" 47 | 48 | condition: 49 | ScarhiknCode or ScarhiknStrings 50 | } 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | -------------------------------------------------------------------------------- /malware/NSFree.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule NSFreeCode : NSFree Family 9 | { 10 | meta: 11 | description = "NSFree code features" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-24" 14 | 15 | strings: 16 | // push vars then look for MZ 17 | $ = { 53 56 57 66 81 38 4D 5A } 18 | // nops then look for PE\0\0 19 | $ = { 90 90 90 90 81 3F 50 45 00 00 } 20 | 21 | condition: 22 | all of them 23 | } 24 | 25 | rule NSFreeStrings : NSFree Family 26 | { 27 | meta: 28 | description = "NSFree Identifying Strings" 29 | author = "Seth Hardy" 30 | last_modified = "2014-06-24" 31 | 32 | strings: 33 | $ = "\\MicNS\\" nocase 34 | $ = "NSFreeDll" wide ascii 35 | // xor 0x58 dos stub 36 | $ = { 0c 30 31 2b 78 28 2a 37 3f 2a 39 35 78 3b 39 36 36 37 } 37 | 38 | condition: 39 | any of them 40 | } 41 | 42 | rule NSFree : Family 43 | { 44 | meta: 45 | description = "NSFree" 46 | author = "Seth Hardy" 47 | last_modified = "2014-06-24" 48 | 49 | condition: 50 | NSFreeCode or NSFreeStrings 51 | } 52 | 53 | 54 | -------------------------------------------------------------------------------- /malware/Cookies.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule CookiesStrings : Cookies Family 9 | { 10 | meta: 11 | description = "Cookies Identifying Strings" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-20" 14 | 15 | strings: 16 | $zip1 = "ntdll.exePK" 17 | $zip2 = "AcroRd32.exePK" 18 | $zip3 = "Setup=ntdll.exe\x0d\x0aSilent=1\x0d\x0a" 19 | $zip4 = "Setup=%temp%\\AcroRd32.exe\x0d\x0a" 20 | $exe1 = "Leave GetCommand!" 21 | $exe2 = "perform exe success!" 22 | $exe3 = "perform exe failure!" 23 | $exe4 = "Entry SendCommandReq!" 24 | $exe5 = "Reqfile not exist!" 25 | $exe6 = "LeaveDealUpfile!" 26 | $exe7 = "Entry PostData!" 27 | $exe8 = "Leave PostFile!" 28 | $exe9 = "Entry PostFile!" 29 | $exe10 = "\\unknow.zip" wide ascii 30 | $exe11 = "the url no respon!" 31 | 32 | condition: 33 | (2 of ($zip*)) or (2 of ($exe*)) 34 | } 35 | 36 | rule Cookies : Family 37 | { 38 | meta: 39 | description = "Cookies" 40 | author = "Seth Hardy" 41 | last_modified = "2014-06-20" 42 | 43 | condition: 44 | CookiesStrings 45 | } 46 | 47 | -------------------------------------------------------------------------------- /malware/Naikon.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule NaikonCode : Naikon Family 9 | { 10 | meta: 11 | description = "Naikon code features" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-25" 14 | 15 | strings: 16 | // decryption 17 | $ = { 0F AF C1 C1 E0 1F } // imul eax, ecx; shl eah, 1fh 18 | $ = { 35 5A 01 00 00} // xor eax, 15ah 19 | $ = { 81 C2 7F 14 06 00 } // add edx, 6147fh 20 | 21 | condition: 22 | all of them 23 | } 24 | 25 | rule NaikonStrings : Naikon Family 26 | { 27 | meta: 28 | description = "Naikon Identifying Strings" 29 | author = "Seth Hardy" 30 | last_modified = "2014-06-25" 31 | 32 | strings: 33 | $ = "NOKIAN95/WEB" 34 | $ = "/tag=info&id=15" 35 | $ = "skg(3)=&3.2d_u1" 36 | $ = "\\Temp\\iExplorer.exe" 37 | $ = "\\Temp\\\"TSG\"" 38 | 39 | condition: 40 | any of them 41 | } 42 | 43 | rule Naikon : Family 44 | { 45 | meta: 46 | description = "Naikon" 47 | author = "Seth Hardy" 48 | last_modified = "2014-06-25" 49 | 50 | condition: 51 | NaikonCode or NaikonStrings 52 | } 53 | 54 | -------------------------------------------------------------------------------- /malware/Intel_Virtualization.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule Intel_Virtualization_Wizard_exe { 9 | meta: 10 | author = "cabrel@zerklabs.com" 11 | description = "Dynamic DLL abuse executable" 12 | 13 | file_1_seen = "2013-05-21" 14 | file_1_sha256 = "7787757ae851f4a162f46f794be1532ab78e1928185212bdab83b3106f28c708" 15 | 16 | strings: 17 | $a = {4C 6F 61 64 53 54 52 49 4E 47} 18 | $b = {49 6E 69 74 69 61 6C 69 7A 65 4B 65 79 48 6F 6F 6B} 19 | $c = {46 69 6E 64 52 65 73 6F 75 72 63 65 73} 20 | $d = {4C 6F 61 64 53 54 52 49 4E 47 46 72 6F 6D 48 4B 43 55} 21 | $e = {68 63 63 75 74 69 6C 73 2E 44 4C 4C} 22 | condition: 23 | all of them 24 | } 25 | 26 | rule Intel_Virtualization_Wizard_dll { 27 | meta: 28 | author = "cabrel@zerklabs.com" 29 | description = "Dynamic DLL (Malicious)" 30 | 31 | file_1_seen = "2013-05-21" 32 | file_1_sha256 = "485ae043b6a5758789f1d33766a26d8b45b9fde09cde0512aa32d4bd1ee04f28" 33 | 34 | strings: 35 | $a = {48 3A 5C 46 61 73 74 5C 50 6C 75 67 28 68 6B 63 6D 64 29 5C} 36 | $b = {64 6C 6C 5C 52 65 6C 65 61 73 65 5C 48 69 6A 61 63 6B 44 6C 6C 2E 70 64 62} 37 | 38 | condition: 39 | ($a and $b) and Intel_Virtualization_Wizard_exe 40 | } 41 | -------------------------------------------------------------------------------- /malware/Bangat.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule BangatCode : Bangat Family 9 | { 10 | meta: 11 | description = "Bangat code features" 12 | author = "Seth Hardy" 13 | last_modified = "2014-07-10" 14 | 15 | strings: 16 | // dec [ebp + procname], push eax, push edx, call get procaddress 17 | $ = { FE 4D ?? 8D 4? ?? 50 5? FF } 18 | 19 | condition: 20 | any of them 21 | } 22 | 23 | rule BangatStrings : Bangat Family 24 | { 25 | meta: 26 | description = "Bangat Identifying Strings" 27 | author = "Seth Hardy" 28 | last_modified = "2014-07-10" 29 | 30 | strings: 31 | $lib1 = "DreatePipe" 32 | $lib2 = "HetSystemDirectoryA" 33 | $lib3 = "SeleaseMutex" 34 | $lib4 = "DloseWindowStation" 35 | $lib5 = "DontrolService" 36 | $file = "~hhC2F~.tmp" 37 | $mc = "~_MC_3~" 38 | 39 | condition: 40 | all of ($lib*) or $file or $mc 41 | } 42 | 43 | rule Bangat : Family 44 | { 45 | meta: 46 | description = "Bangat" 47 | author = "Seth Hardy" 48 | last_modified = "2014-07-10" 49 | 50 | condition: 51 | BangatCode or BangatStrings 52 | } 53 | 54 | 55 | -------------------------------------------------------------------------------- /malware/Wimmie.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule WimmieShellcode : Wimmie Family 9 | { 10 | meta: 11 | description = "Wimmie code features" 12 | author = "Seth Hardy" 13 | last_modified = "2014-07-17" 14 | 15 | strings: 16 | // decryption loop 17 | $ = { 49 30 24 39 83 F9 00 77 F7 8D 3D 4D 10 40 00 B9 0C 03 00 00 } 18 | $xordecrypt = {B9 B4 1D 00 00 [8] 49 30 24 39 83 F9 00 } 19 | 20 | condition: 21 | any of them 22 | } 23 | 24 | rule WimmieStrings : Wimmie Family 25 | { 26 | meta: 27 | description = "Strings used by Wimmie" 28 | author = "Seth Hardy" 29 | last_modified = "2014-07-17" 30 | 31 | strings: 32 | $ = "\x00ScriptMan" 33 | $ = "C:\\WINDOWS\\system32\\sysprep\\cryptbase.dll" wide ascii 34 | $ = "ProbeScriptFint" wide ascii 35 | $ = "ProbeScriptKids" 36 | 37 | condition: 38 | any of them 39 | 40 | } 41 | 42 | rule Wimmie : Family 43 | { 44 | meta: 45 | description = "Wimmie family" 46 | author = "Seth Hardy" 47 | last_modified = "2014-07-17" 48 | 49 | condition: 50 | WimmieShellcode or WimmieStrings 51 | 52 | } 53 | -------------------------------------------------------------------------------- /malware/T5000.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule T5000Strings : T5000 Family 9 | { 10 | meta: 11 | description = "T5000 Identifying Strings" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-26" 14 | 15 | strings: 16 | $ = "_tmpR.vbs" 17 | $ = "_tmpg.vbs" 18 | $ = "Dtl.dat" wide ascii 19 | $ = "3C6FB3CA-69B1-454f-8B2F-BD157762810E" 20 | $ = "EED5CA6C-9958-4611-B7A7-1238F2E1B17E" 21 | $ = "8A8FF8AD-D1DE-4cef-B87C-82627677662E" 22 | $ = "43EE34A9-9063-4d2c-AACD-F5C62B849089" 23 | $ = "A8859547-C62D-4e8b-A82D-BE1479C684C9" 24 | $ = "A59CF429-D0DD-4207-88A1-04090680F714" 25 | $ = "utd_CE31" wide ascii 26 | $ = "f:\\Project\\T5000\\Src\\Target\\1 KjetDll.pdb" 27 | $ = "l:\\MyProject\\Vc 7.1\\T5000\\T5000Ver1.28\\Target\\4 CaptureDLL.pdb" 28 | $ = "f:\\Project\\T5000\\Src\\Target\\4 CaptureDLL.pdb" 29 | $ = "E:\\VS2010\\xPlat2\\Release\\InstRes32.pdb" 30 | 31 | condition: 32 | any of them 33 | } 34 | 35 | rule T5000 : Family 36 | { 37 | meta: 38 | description = "T5000" 39 | author = "Seth Hardy" 40 | last_modified = "2014-06-26" 41 | 42 | condition: 43 | T5000Strings 44 | } 45 | -------------------------------------------------------------------------------- /malware/Vidgrab.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule VidgrabCode : Vidgrab Family 9 | { 10 | meta: 11 | description = "Vidgrab code tricks" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-20" 14 | 15 | strings: 16 | $divbyzero = { B8 02 00 00 00 48 48 BA 02 00 00 00 83 F2 02 F7 F0 } 17 | // add eax, ecx; xor byte ptr [eax], ??h; inc ecx 18 | $xorloop = { 03 C1 80 30 (66 | 58) 41 } 19 | $junk = { 8B 4? ?? 8B 4? ?? 03 45 08 52 5A } 20 | 21 | condition: 22 | all of them 23 | } 24 | 25 | rule VidgrabStrings : Vidgrab Family 26 | { 27 | meta: 28 | description = "Vidgrab Identifying Strings" 29 | author = "Seth Hardy" 30 | last_modified = "2014-06-20" 31 | 32 | strings: 33 | $ = "IDI_ICON5" wide ascii 34 | $ = "starter.exe" 35 | $ = "wmifw.exe" 36 | $ = "Software\\rar" 37 | $ = "tmp092.tmp" 38 | $ = "temp1.exe" 39 | 40 | condition: 41 | 3 of them 42 | } 43 | 44 | rule Vidgrab : Family 45 | { 46 | meta: 47 | description = "Vidgrab" 48 | author = "Seth Hardy" 49 | last_modified = "2014-06-20" 50 | 51 | condition: 52 | VidgrabCode or VidgrabStrings 53 | } 54 | -------------------------------------------------------------------------------- /malware/Regsubdat.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule RegSubDatCode : RegSubDat Family 9 | { 10 | meta: 11 | description = "RegSubDat code features" 12 | author = "Seth Hardy" 13 | last_modified = "2014-07-14" 14 | 15 | strings: 16 | // decryption loop 17 | $ = { 80 34 3? 99 40 (3D FB 65 00 00 | 3B C6) 7? F? } 18 | // push then pop values 19 | $ = { 68 FF FF 7F 00 5? } 20 | $ = { 68 FF 7F 00 00 5? } 21 | 22 | condition: 23 | all of them 24 | } 25 | 26 | rule RegSubDatStrings : RegSubDat Family 27 | { 28 | meta: 29 | description = "RegSubDat Identifying Strings" 30 | author = "Seth Hardy" 31 | last_modified = "2014-07-14" 32 | 33 | strings: 34 | $avg1 = "Button" 35 | $avg2 = "Allow" 36 | $avg3 = "Identity Protection" 37 | $avg4 = "Allow for all" 38 | $avg5 = "AVG Firewall Asks For Confirmation" 39 | $mutex = "0x1A7B4C9F" 40 | 41 | condition: 42 | all of ($avg*) or $mutex 43 | } 44 | 45 | rule RegSubDat : Family 46 | { 47 | meta: 48 | description = "RegSubDat" 49 | author = "Seth Hardy" 50 | last_modified = "2014-07-14" 51 | 52 | condition: 53 | RegSubDatCode or RegSubDatStrings 54 | } 55 | -------------------------------------------------------------------------------- /malware/Babar.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule SNOWGLOBE_Babar_Malware { 9 | meta: 10 | description = "Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe" 11 | author = "Florian Roth" 12 | reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france" 13 | date = "2015/02/18" 14 | hash = "27a0a98053f3eed82a51cdefbdfec7bb948e1f36" 15 | score = 80 16 | strings: 17 | $mz = { 4d 5a } 18 | $z0 = "admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper" ascii fullword 19 | $z1 = "User-Agent: Mozilla/4.0 (compatible; MSI 6.0;" ascii fullword 20 | $z2 = "ExecQueryFailled!" fullword ascii 21 | $z3 = "NBOT_COMMAND_LINE" fullword 22 | $z4 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]" fullword 23 | 24 | $s1 = "/s /n %s \"%s\"" fullword ascii 25 | $s2 = "%%WINDIR%%\\%s\\%s" fullword ascii 26 | $s3 = "/c start /wait " fullword ascii 27 | $s4 = "(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)" ascii 28 | 29 | $x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" fullword ascii 30 | $x2 = "%COMMON_APPDATA%" fullword ascii 31 | $x4 = "CONOUT$" fullword ascii 32 | $x5 = "cmd.exe" fullword ascii 33 | $x6 = "DLLPATH" fullword ascii 34 | condition: 35 | ( $mz at 0 ) and filesize < 1MB and 36 | ( 37 | ( 1 of ($z*) and 1 of ($x*) ) or 38 | ( 3 of ($s*) and 4 of ($x*) ) 39 | ) 40 | } 41 | -------------------------------------------------------------------------------- /malware/NetTraveler.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule NetTravStrings : NetTraveler Family { 9 | 10 | 11 | meta: 12 | description = "Identifiers for NetTraveler DLL" 13 | author = "Katie Kleemola" 14 | last_updated = "2014-05-20" 15 | 16 | strings: 17 | //network strings 18 | $ = "?action=updated&hostid=" 19 | $ = "travlerbackinfo" 20 | $ = "?action=getcmd&hostid=" 21 | $ = "%s?action=gotcmd&hostid=" 22 | $ = "%s?hostid=%s&hostname=%s&hostip=%s&filename=%s&filestart=%u&filetext=" 23 | 24 | //debugging strings 25 | $ = "\x00Method1 Fail!!!!!\x00" 26 | $ = "\x00Method3 Fail!!!!!\x00" 27 | $ = "\x00method currect:\x00" 28 | $ = /\x00\x00[\w\-]+ is Running!\x00\x00/ 29 | $ = "\x00OtherTwo\x00" 30 | 31 | condition: 32 | any of them 33 | 34 | } 35 | 36 | rule NetTravExports : NetTraveler Family { 37 | 38 | meta: 39 | description = "Export names for dll component" 40 | author = "Katie Kleemola" 41 | last_updated = "2014-05-20" 42 | 43 | strings: 44 | //dll component exports 45 | $ = "?InjectDll@@YAHPAUHWND__@@K@Z" 46 | $ = "?UnmapDll@@YAHXZ" 47 | $ = "?g_bSubclassed@@3HA" 48 | 49 | condition: 50 | any of them 51 | } 52 | 53 | rule NetTraveler : Family { 54 | meta: 55 | description = "Nettravelr" 56 | author = "Katie Kleemola" 57 | last_updated = "2014-07-08" 58 | 59 | condition: 60 | NetTravExports or NetTravStrings or NetpassStrings 61 | 62 | } 63 | 64 | -------------------------------------------------------------------------------- /malware/Scieron.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule Scieron 9 | { 10 | meta: 11 | author = "Symantec Security Response" 12 | ref = "http://www.symantec.com/connect/tr/blogs/scarab-attackers-took-aim-select-russian-targets-2012" 13 | date = "22.01.15" 14 | 15 | strings: 16 | // .text:10002069 66 83 F8 2C cmp ax, ',' 17 | // .text:1000206D 74 0C jz short loc_1000207B 18 | // .text:1000206F 66 83 F8 3B cmp ax, ';' 19 | // .text:10002073 74 06 jz short loc_1000207B 20 | // .text:10002075 66 83 F8 7C cmp ax, '|' 21 | // .text:10002079 75 05 jnz short loc_10002080 22 | $code1 = {66 83 F? 2C 74 0C 66 83 F? 3B 74 06 66 83 F? 7C 75 05} 23 | 24 | // .text:10001D83 83 F8 09 cmp eax, 9 ; switch 10 cases 25 | // .text:10001D86 0F 87 DB 00 00 00 ja loc_10001E67 ; jumptable 10001D8C default case 26 | // .text:10001D8C FF 24 85 55 1F 00+ jmp ds:off_10001F55[eax*4] ; switch jump 27 | $code2 = {83 F? 09 0F 87 ?? 0? 00 00 FF 24} 28 | 29 | $str1 = "IP_PADDING_DATA" wide ascii 30 | $str2 = "PORT_NUM" wide ascii 31 | 32 | condition: 33 | all of them 34 | } 35 | -------------------------------------------------------------------------------- /malware/Bolonyokte.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule Bolonyokte : rat 9 | { 10 | meta: 11 | description = "UnknownDotNet RAT - Bolonyokte" 12 | author = "Jean-Philippe Teissier / @Jipe_" 13 | date = "2013-02-01" 14 | filetype = "memory" 15 | version = "1.0" 16 | 17 | strings: 18 | $campaign1 = "Bolonyokte" ascii wide 19 | $campaign2 = "donadoni" ascii wide 20 | 21 | $decoy1 = "nyse.com" ascii wide 22 | $decoy2 = "NYSEArca_Listing_Fees.pdf" ascii wide 23 | $decoy3 = "bf13-5d45cb40" ascii wide 24 | 25 | $artifact1 = "Backup.zip" ascii wide 26 | $artifact2 = "updates.txt" ascii wide 27 | $artifact3 = "vdirs.dat" ascii wide 28 | $artifact4 = "default.dat" 29 | $artifact5 = "index.html" 30 | $artifact6 = "mime.dat" 31 | 32 | $func1 = "FtpUrl" 33 | $func2 = "ScreenCapture" 34 | $func3 = "CaptureMouse" 35 | $func4 = "UploadFile" 36 | 37 | $ebanking1 = "Internet Banking" wide 38 | $ebanking2 = "(Online Banking)|(Online banking)" 39 | $ebanking3 = "(e-banking)|(e-Banking)" nocase 40 | $ebanking4 = "login" 41 | $ebanking5 = "en ligne" wide 42 | $ebanking6 = "bancaires" wide 43 | $ebanking7 = "(eBanking)|(Ebanking)" wide 44 | $ebanking8 = "Anmeldung" wide 45 | $ebanking9 = "internet banking" nocase wide 46 | $ebanking10 = "Banking Online" nocase wide 47 | $ebanking11 = "Web Banking" wide 48 | $ebanking12 = "Power" 49 | 50 | condition: 51 | any of ($campaign*) or 2 of ($decoy*) or 2 of ($artifact*) or all of ($func*) or 3 of ($ebanking*) 52 | } 53 | -------------------------------------------------------------------------------- /malware/APT_Mongall.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule Backdoor_APT_Mongal 9 | { 10 | meta: 11 | author = "@patrickrolsen" 12 | maltype = "Backdoor.APT.Mongall" 13 | version = "0.1" 14 | reference = "fd69a799e21ccb308531ce6056944842" 15 | date = "01/04/2014" 16 | strings: 17 | $author = "author user" 18 | $title = "title Vjkygdjdtyuj" nocase 19 | $comp = "company ooo" 20 | $cretime = "creatim\\yr2012\\mo4\\dy19\\hr15\\min10" 21 | $passwd = "password 00000000" 22 | condition: 23 | all of them 24 | } 25 | 26 | rule MongalCode : Mongal Family 27 | { 28 | meta: 29 | description = "Mongal code features" 30 | author = "Seth Hardy" 31 | last_modified = "2014-07-15" 32 | 33 | strings: 34 | // gettickcount value checking 35 | $ = { 8B C8 B8 D3 4D 62 10 F7 E1 C1 EA 06 2B D6 83 FA 05 76 EB } 36 | 37 | condition: 38 | any of them 39 | } 40 | 41 | rule MongalStrings : Mongal Family 42 | { 43 | meta: 44 | description = "Mongal Identifying Strings" 45 | author = "Seth Hardy" 46 | last_modified = "2014-07-15" 47 | 48 | strings: 49 | $ = "NSCortr.dll" 50 | $ = "NSCortr1.dll" 51 | $ = "Sina.exe" 52 | 53 | condition: 54 | any of them 55 | } 56 | 57 | rule Mongal : Family 58 | { 59 | meta: 60 | description = "Mongal" 61 | author = "Seth Hardy" 62 | last_modified = "2014-07-15" 63 | 64 | condition: 65 | MongalCode or MongalStrings 66 | } 67 | 68 | 69 | -------------------------------------------------------------------------------- /malware/MacControl.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule MacControlCode : MacControl Family 9 | { 10 | meta: 11 | description = "MacControl code tricks" 12 | author = "Seth Hardy" 13 | last_modified = "2014-06-17" 14 | 15 | strings: 16 | // Load these function strings 4 characters at a time. These check the first two blocks: 17 | $L4_Accept = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 3A 20 } 18 | $L4_AcceptLang = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 2D 4C } 19 | $L4_Pragma = { C7 ?? 50 72 61 67 C7 ?? 04 6D 61 3A 20 } 20 | $L4_Connection = { C7 ?? 43 6F 6E 6E C7 ?? 04 65 63 74 69 } 21 | $GEThgif = { C7 ?? 47 45 54 20 C7 ?? 04 2F 68 2E 67 } 22 | 23 | condition: 24 | all of ($L4*) or $GEThgif 25 | } 26 | 27 | rule MacControlStrings : MacControl Family 28 | { 29 | meta: 30 | description = "MacControl Identifying Strings" 31 | author = "Seth Hardy" 32 | last_modified = "2014-06-17" 33 | 34 | strings: 35 | $ = "HTTPHeadGet" 36 | $ = "/Library/launched" 37 | $ = "My connect error with no ip!" 38 | $ = "Send File is Failed" 39 | $ = "****************************You Have got it!****************************" 40 | 41 | condition: 42 | any of them 43 | } 44 | 45 | rule MacControl : Family 46 | { 47 | meta: 48 | description = "MacControl" 49 | author = "Seth Hardy" 50 | last_modified = "2014-06-16" 51 | 52 | condition: 53 | MacControlCode or MacControlStrings 54 | } 55 | 56 | 57 | -------------------------------------------------------------------------------- /malware/KINS.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | rule KINS_dropper { 8 | meta: 9 | author = "AlienVault Labs aortega@alienvault.com" 10 | description = "Match protocol, process injects and windows exploit present in KINS dropper" 11 | reference = "http://goo.gl/arPhm3" 12 | strings: 13 | // Network protocol 14 | $n1 = "tid=%d&ta=%s-%x" fullword 15 | $n2 = "fid=%d" fullword 16 | $n3 = "%[^.].%[^(](%[^)])" fullword 17 | // Injects 18 | $i0 = "%s [%s %d] 77 %s" 19 | $i01 = "Global\\%s%x" 20 | $i1 = "Inject::InjectProcessByName()" 21 | $i2 = "Inject::CopyImageToProcess()" 22 | $i3 = "Inject::InjectProcess()" 23 | $i4 = "Inject::InjectImageToProcess()" 24 | $i5 = "Drop::InjectStartThread()" 25 | // UAC bypass 26 | $uac1 = "ExploitMS10_092" 27 | $uac2 = "\\globalroot\\systemroot\\system32\\tasks\\" ascii wide 28 | $uac3 = "HighestAvailable" ascii wide 29 | condition: 30 | 2 of ($n*) and 2 of ($i*) and 2 of ($uac*) 31 | } 32 | 33 | rule KINS_DLL_zeus { 34 | meta: 35 | author = "AlienVault Labs aortega@alienvault.com" 36 | description = "Match default bot in KINS leaked dropper, Zeus" 37 | reference = "http://goo.gl/arPhm3" 38 | strings: 39 | // Network protocol 40 | $n1 = "%BOTID%" fullword 41 | $n2 = "%opensocks%" fullword 42 | $n3 = "%openvnc%" fullword 43 | $n4 = /Global\\(s|v)_ev/ fullword 44 | // Crypted strings 45 | $s1 = "\x72\x6E\x6D\x2C\x36\x7D\x76\x77" 46 | $s2 = "\x18\x04\x0F\x12\x16\x0A\x1E\x08\x5B\x11\x0F\x13" 47 | $s3 = "\x39\x1F\x01\x07\x15\x19\x1A\x33\x19\x0D\x1F" 48 | $s4 = "\x62\x6F\x71\x78\x63\x61\x7F\x69\x2D\x67\x79\x65" 49 | $s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71" 50 | condition: 51 | all of ($n*) and 1 of ($s*) 52 | } 53 | -------------------------------------------------------------------------------- /malware/Ramsonware.yar: -------------------------------------------------------------------------------- 1 | /* 2 | This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. 3 | 4 | */ 5 | 6 | import "pe" 7 | 8 | rule CryptoLocker_set1 9 | { 10 | meta: 11 | author = "Christiaan Beek, Christiaan_Beek@McAfee.com" 12 | date = "2014-04-13" 13 | description = "Detection of Cryptolocker Samples" 14 | 15 | strings: 16 | $string0 = "static" 17 | $string1 = " kscdS" 18 | $string2 = "Romantic" 19 | $string3 = "CompanyName" wide 20 | $string4 = "ProductVersion" wide 21 | $string5 = "9%9R9f9q9" 22 | $string6 = "IDR_VERSION1" wide 23 | $string7 = " " 24 | $string8 = "LookFor" wide 25 | $string9 = ":n;t;y;" 26 | $string10 = "