├── FoxIT_Ponmocup_STIX_1_2.xml ├── README.md ├── actual_ips.txt ├── domains.txt ├── registry_keys.txt ├── resolving_ips.txt ├── snort_signatures.txt └── yara_signatures.txt /FoxIT_Ponmocup_STIX_1_2.xml: -------------------------------------------------------------------------------- 1 | 19 | 20 | 21 | 22 | Ponmocup Indicators 23 | Indicators 24 | 25 | 26 | //node() | //@* 27 | 28 | 29 | 30 | 31 | 32 | 33 | 2015-12-02T00:00:00 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 214.66.10.71 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 85.17.133.194 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 85.17.133.194 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 62.212.68.230 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 217.23.3.249 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 85.17.133.193 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 95.211.240.194 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 85.17.133.194 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | 114 | 85.17.133.193 115 | 116 | 117 | 118 | 119 | 120 | 121 | 122 | 123 | 85.17.133.193 124 | 125 | 126 | 127 | 128 | 129 | 130 | 131 | 132 | 95.211.240.194 133 | 134 | 135 | 136 | 137 | 138 | 139 | 140 | 141 | 78.109.28.249 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 85.17.133.194 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 62.212.68.230 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | 85.17.133.193 169 | 170 | 171 | 172 | 173 | 174 | 175 | 176 | 177 | 85.17.133.194 178 | 179 | 180 | 181 | 182 | 183 | 184 | 185 | 186 | 217.23.3.244 187 | 188 | 189 | 190 | 191 | 192 | 193 | 194 | 195 | 185.17.184.249 196 | 197 | 198 | 199 | 200 | 201 | 202 | 203 | 204 | 78.109.28.249 205 | 206 | 207 | 208 | 209 | 210 | 211 | 212 | 213 | 85.17.133.194 214 | 215 | 216 | 217 | 218 | 219 | 220 | 221 | 222 | 217.23.3.249 223 | 224 | 225 | 226 | 227 | 228 | 229 | 230 | 231 | 62.212.68.230 232 | 233 | 234 | 235 | 236 | 237 | 238 | 239 | 240 | 93.115.88.220 241 | 242 | 243 | 244 | 245 | 246 | 247 | 248 | 249 | 89.172.227.240 250 | 251 | 252 | 253 | 254 | 255 | 256 | 257 | 258 | 85.17.133.194 259 | 260 | 261 | 262 | 263 | 264 | 265 | 266 | 267 | 85.17.133.193 268 | 269 | 270 | 271 | 272 | 273 | 274 | 275 | 276 | 78.109.28.248 277 | 278 | 279 | 280 | 281 | 282 | 283 | 284 | 285 | 85.17.133.194 286 | 287 | 288 | 289 | 290 | 291 | 292 | 293 | 294 | 78.109.28.248 295 | 296 | 297 | 298 | 299 | 300 | 301 | 302 | 303 | 185.17.184.249 304 | 305 | 306 | 307 | 308 | 309 | 310 | 311 | 312 | 62.212.68.230 313 | 314 | 315 | 316 | 317 | 318 | 319 | 320 | 321 | 26.252.164.23 322 | 323 | 324 | 325 | 326 | 327 | 328 | 329 | 330 | 217.23.3.243 331 | 332 | 333 | 334 | 335 | 336 | 337 | 338 | 339 | 62.212.68.230 340 | 341 | 342 | 343 | 344 | 345 | 346 | 347 | 348 | 62.212.68.230 349 | 350 | 351 | 352 | 353 | 354 | 355 | 356 | 357 | 62.212.68.230 358 | 359 | 360 | 361 | 362 | 363 | 364 | 365 | 366 | 62.212.68.230 367 | 368 | 369 | 370 | 371 | 372 | 373 | 374 | 375 | 182.62.211.45 376 | 377 | 378 | 379 | 380 | 381 | 382 | 383 | 384 | 62.212.68.230 385 | 386 | 387 | 388 | 389 | 390 | 391 | 392 | 393 | 62.212.68.230 394 | 395 | 396 | 397 | 398 | 399 | 400 | 401 | 402 | 85.17.133.193 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 78.109.28.250 412 | 413 | 414 | 415 | 416 | 417 | 418 | 419 | 420 | 217.23.3.244 421 | 422 | 423 | 424 | 425 | 426 | 427 | 428 | 429 | 78.109.28.248 430 | 431 | 432 | 433 | 434 | 435 | 436 | 437 | 438 | 85.17.133.194 439 | 440 | 441 | 442 | 443 | 444 | 445 | 446 | 447 | 95.211.240.193 448 | 449 | 450 | 451 | 452 | 453 | 454 | 455 | 456 | 85.17.133.193 457 | 458 | 459 | 460 | 461 | 462 | 463 | 464 | 465 | 85.17.133.194 466 | 467 | 468 | 469 | 470 | 471 | 472 | 473 | 474 | 28.16.103.211 475 | 476 | 477 | 478 | 479 | 480 | 481 | 482 | 483 | 85.17.133.193 484 | 485 | 486 | 487 | 488 | 489 | 490 | 491 | 492 | 232.187.207.67 493 | 494 | 495 | 496 | 497 | 498 | 499 | 500 | 501 | 217.23.3.243 502 | 503 | 504 | 505 | 506 | 507 | 508 | 509 | 510 | 85.17.133.193 511 | 512 | 513 | 514 | 515 | 516 | 517 | 518 | 519 | abccornet.com 520 | 521 | 522 | 523 | 524 | 525 | 526 | 527 | 528 | adertisecorp.com 529 | 530 | 531 | 532 | 533 | 534 | 535 | 536 | 537 | affilipcorp.com 538 | 539 | 540 | 541 | 542 | 543 | 544 | 545 | 546 | anexcorp.org 547 | 548 | 549 | 550 | 551 | 552 | 553 | 554 | 555 | britishfederal.org 556 | 557 | 558 | 559 | 560 | 561 | 562 | 563 | 564 | changinessmen.com 565 | 566 | 567 | 568 | 569 | 570 | 571 | 572 | 573 | claimsreference.net 574 | 575 | 576 | 577 | 578 | 579 | 580 | 581 | 582 | clickoptimiser.net 583 | 584 | 585 | 586 | 587 | 588 | 589 | 590 | 591 | contentdeliveryorg.net 592 | 593 | 594 | 595 | 596 | 597 | 598 | 599 | 600 | contextexpert.org 601 | 602 | 603 | 604 | 605 | 606 | 607 | 608 | 609 | continuatu.com 610 | 611 | 612 | 613 | 614 | 615 | 616 | 617 | 618 | culminaccessful.com 619 | 620 | 621 | 622 | 623 | 624 | 625 | 626 | 627 | cybernan.net 628 | 629 | 630 | 631 | 632 | 633 | 634 | 635 | 636 | defenciclovis.com 637 | 638 | 639 | 640 | 641 | 642 | 643 | 644 | 645 | descriptioned.com 646 | 647 | 648 | 649 | 650 | 651 | 652 | 653 | 654 | detroportans.com 655 | 656 | 657 | 658 | 659 | 660 | 661 | 662 | 663 | directiculture.com 664 | 665 | 666 | 667 | 668 | 669 | 670 | 671 | 672 | directlyvast.com 673 | 674 | 675 | 676 | 677 | 678 | 679 | 680 | 681 | dogmationation.com 682 | 683 | 684 | 685 | 686 | 687 | 688 | 689 | 690 | dynodns.org 691 | 692 | 693 | 694 | 695 | 696 | 697 | 698 | 699 | enckfeld.net 700 | 701 | 702 | 703 | 704 | 705 | 706 | 707 | 708 | familyinteresting.com 709 | 710 | 711 | 712 | 713 | 714 | 715 | 716 | 717 | fasternation.net 718 | 719 | 720 | 721 | 722 | 723 | 724 | 725 | 726 | freewayreg.com 727 | 728 | 729 | 730 | 731 | 732 | 733 | 734 | 735 | headedpicked.com 736 | 737 | 738 | 739 | 740 | 741 | 742 | 743 | 744 | headedpicked.net 745 | 746 | 747 | 748 | 749 | 750 | 751 | 752 | 753 | highlytraditional.org 754 | 755 | 756 | 757 | 758 | 759 | 760 | 761 | 762 | himmeding.com 763 | 764 | 765 | 766 | 767 | 768 | 769 | 770 | 771 | howeveraged.net 772 | 773 | 774 | 775 | 776 | 777 | 778 | 779 | 780 | hydroelection.net 781 | 782 | 783 | 784 | 785 | 786 | 787 | 788 | 789 | illegedly.com 790 | 791 | 792 | 793 | 794 | 795 | 796 | 797 | 798 | imagesharehost.com 799 | 800 | 801 | 802 | 803 | 804 | 805 | 806 | 807 | leadwriting.com 808 | 809 | 810 | 811 | 812 | 813 | 814 | 815 | 816 | meetinglimited.com 817 | 818 | 819 | 820 | 821 | 822 | 823 | 824 | 825 | netdiscovery.org 826 | 827 | 828 | 829 | 830 | 831 | 832 | 833 | 834 | picasootoolbar.com 835 | 836 | 837 | 838 | 839 | 840 | 841 | 842 | 843 | piclbumestream.com 844 | 845 | 846 | 847 | 848 | 849 | 850 | 851 | 852 | postdone.com 853 | 854 | 855 | 856 | 857 | 858 | 859 | 860 | 861 | ratilovskoye.com 862 | 863 | 864 | 865 | 866 | 867 | 868 | 869 | 870 | recising.com 871 | 872 | 873 | 874 | 875 | 876 | 877 | 878 | 879 | searchforthat.net 880 | 881 | 882 | 883 | 884 | 885 | 886 | 887 | 888 | sectionsfear.com 889 | 890 | 891 | 892 | 893 | 894 | 895 | 896 | 897 | separtila.com 898 | 899 | 900 | 901 | 902 | 903 | 904 | 905 | 906 | standardbay.net 907 | 908 | 909 | 910 | 911 | 912 | 913 | 914 | 915 | streamingadv.com 916 | 917 | 918 | 919 | 920 | 921 | 922 | 923 | 924 | ternations.com 925 | 926 | 927 | 928 | 929 | 930 | 931 | 932 | 933 | thomaslaid.net 934 | 935 | 936 | 937 | 938 | 939 | 940 | 941 | 942 | traffictradexpert.com 943 | 944 | 945 | 946 | 947 | 948 | 949 | 950 | 951 | twicecitizens.com 952 | 953 | 954 | 955 | 956 | 957 | 958 | 959 | 960 | veristats.net 961 | 962 | 963 | 964 | 965 | 966 | 967 | 968 | 969 | virtualsearches.com 970 | 971 | 972 | 973 | 974 | 975 | 976 | 977 | 978 | workerssan.net 979 | 980 | 981 | 982 | 983 | 984 | 985 | 986 | 987 | yaltimate.com 988 | 989 | 990 | 991 | 992 | 993 | 994 | 995 | 996 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\1 997 | 998 | 999 | 1000 | 1001 | 1002 | 1003 | 1004 | 1005 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\2 1006 | 1007 | 1008 | 1009 | 1010 | 1011 | 1012 | 1013 | 1014 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\3 1015 | 1016 | 1017 | 1018 | 1019 | 1020 | 1021 | 1022 | 1023 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\4 1024 | 1025 | 1026 | 1027 | 1028 | 1029 | 1030 | 1031 | 1032 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\5 1033 | 1034 | 1035 | 1036 | 1037 | 1038 | 1039 | 1040 | 1041 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\6 1042 | 1043 | 1044 | 1045 | 1046 | 1047 | 1048 | 1049 | 1050 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\7 1051 | 1052 | 1053 | 1054 | 1055 | 1056 | 1057 | 1058 | 1059 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\8 1060 | 1061 | 1062 | 1063 | 1064 | 1065 | 1066 | 1067 | 1068 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\9 1069 | 1070 | 1071 | 1072 | 1073 | 1074 | 1075 | 1076 | 1077 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\10 1078 | 1079 | 1080 | 1081 | 1082 | 1083 | 1084 | 1085 | 1086 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\11 1087 | 1088 | 1089 | 1090 | 1091 | 1092 | 1093 | 1094 | $EXTERNAL_NET $HTTP_PORTS (msg:"FOX-SRT - Trojan - Ponmocup HTTP Request (generic)"; flow:established,to_server; content:"Accept: */*|0d 0a|";fast_ pattern;http_header; content:"Pragma|3a| no-cache|0d 0a|";http_header; content:"Cache- Control|3a| no-cache|0d 0a|";http_header; content:!"Referer|3a|";http_header; content:"Cookie|3a| ";http_header; pcre:"/^Host\x3A[^\r\n]+?\d{1,3}\x2e\d{1,3}\x2e\d{1,3}\ x2e\d{1,3}\r\n/Hm"; content:!"Accept-Encoding|3a| ";http_header; content:!"Accept-Language|3a| ";http_header; content:!"Content-Type|3a| ";http_header; reference:url,http://blog.Fox-IT.com/2015/12/02/ponmocup-a-giant-hiding-in-the-shadows; threshold:type limit, track by_src, count 1, seconds 600; classtype:trojan-activity; priority:1; sid:21001533; rev:1;)]]> 1095 | 1096 | 1097 | 1098 | 1099 | 1100 | 1101 | $EXTERNAL_NET $HTTP_PORTS (msg:"FOX-SRT - Trojan - Ponmocup plugin-specific check-in"; content:"GET"; http_method; content:"HTTP/1.1|0d0a|Accept: */*"; distance:0; content:"Content-Type: application/x-www-form-urlencoded"; fast_pattern; distance:0; pcre:"/Host: ([0-9]{1,3}\.){3}[0-9]{1,3}\x0d/"; distance:0; content:"User-Agent: Mozilla/4."; distance:0; content:"Cookie: "; pcre:"/Cookie: [a-z0-9]{1,10}=[a-z0-9+/]{20,500} (=){0,2}/i"; distance:0; urilen:<50,norm; content:!"Referer"; threshold:type limit, track by_src, count 1, seconds 600; classtype:trojan-activity; reference:url,http://blog.Fox-IT.com/2015/12/02/ponmocup-a-giant-hiding-in-the-shadows; sid:21001686; rev:1;)]]> 1102 | 1103 | 1104 | 1105 | 1106 | 1107 | 1108 | any any (msg:"FOX-SRT - Trojan - Ponmocup plugin #2600 (SIP scanner)"; content:"User-Agent|3a| Zoiper for Windows rev.1812|0d0a|"; threshold: type limit, count 1, seconds 3600, track by_src; reference:url,http://blog.Fox-IT.com/2015/12/02/ponmocup-a-giant-hiding-in-the-shadows; sid:21001493; classtype:trojan-activity; rev:1;)]]> 1109 | 1110 | 1111 | 1112 | 1113 | 1114 | 1115 | 1168 | 1169 | 1170 | 1171 | 1172 | 1173 | 1174 | 1175 | 1176 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | Ponmocup Indicators of Compromise 2 | ================================== 3 | 4 | This repository contains the indicators of compromise for Ponmocup. 5 | 6 | Ponmocup is one of the most successful and longest running botnets of the past decade. First detected in 2006, as Vundo or Virtumonde, and detected as Ponmocup starting in 2011, we believe this is one of the most underestimated botnets still under continuous development. 7 | 8 | Though Ponmocup has received a minimal amount of attention from the security community, it is in fact a sophisticated botnet serving different purposes. Though these purposes have often been described as low-risk functionalities, the malware is actually used by a group of sophisticated criminals who use the botnet for various (financials) gains, and are likely conducting a limited amount of targeted attacks. 9 | 10 | Full report on the Ponmocup botnet can be found here: 11 | 12 | * http://f0x.nl/ponmocup (short link) 13 | * http://blog.fox-it.com/2015/12/02/ponmocup-a-giant-hiding-in-the-shadows 14 | 15 | ### Available IOCs 16 | 17 | | filename | description | 18 | |-----------------------------------------------|----------------------------------------------------------------------------------------------------------| 19 | | *[domains.txt](domains.txt)* | The hardcoded domains used by Ponmocup (used to calculated the real C2 ip) | 20 | | *[resolving_ips.txt](resolving_ips.txt)* | Resolved ip addresses of the ponmocup domains (used to calculate the real C2 ip) | 21 | | *[actual_ips.txt](actual_ips.txt)* | Calculated C2 ip addresses that Ponmocup will connect to for C2 traffic | 22 | | *[registry_keys.txt](registry_keys.txt)* | Known Windows Registry keys used by Ponmocup | 23 | 24 | ### Available signatures 25 | | filename | description | 26 | |-----------------------------------------------|----------------------------------------------------------------------------------------------------------| 27 | | *[snort_signatures.txt](snort_signatures.txt)* | Contains Snort signatures for detecting Ponmocup | 28 | | *[yara_signatures.txt](yara_signatures.txt)* | Contains Yara signatures to detect Ponmocup (in memory) | 29 | 30 | 31 | ### Availabe STIX Package 32 | | filename | description | 33 | |-----------------------------------------------|------------------------------------------ 34 | | *[FoxIT_Ponmocup_STIX_1_2.xml](FoxIT_Ponmocup_STIX_1_2.xml)* | STIX package containing all the indicators and signatures | 35 | 36 | 37 | -------------------------------------------------------------------------------- /actual_ips.txt: -------------------------------------------------------------------------------- 1 | 182.62.211.45 2 | 185.17.184.249 3 | 214.66.10.71 4 | 217.23.3.243 5 | 217.23.3.244 6 | 217.23.3.249 7 | 232.187.207.67 8 | 26.252.164.23 9 | 28.16.103.211 10 | 62.212.68.230 11 | 78.109.28.248 12 | 78.109.28.249 13 | 78.109.28.250 14 | 85.17.133.193 15 | 85.17.133.194 16 | 89.172.227.240 17 | 93.115.88.220 18 | 95.211.240.193 19 | 95.211.240.194 20 | -------------------------------------------------------------------------------- /domains.txt: -------------------------------------------------------------------------------- 1 | abccornet.com 2 | adertisecorp.com 3 | affilipcorp.com 4 | anexcorp.org 5 | britishfederal.org 6 | changinessmen.com 7 | claimsreference.net 8 | clickoptimiser.net 9 | contentdeliveryorg.net 10 | contextexpert.org 11 | continuatu.com 12 | culminaccessful.com 13 | cybernan.net 14 | defenciclovis.com 15 | descriptioned.com 16 | detroportans.com 17 | directiculture.com 18 | directlyvast.com 19 | dogmationation.com 20 | dynodns.org 21 | enckfeld.net 22 | familyinteresting.com 23 | fasternation.net 24 | freewayreg.com 25 | headedpicked.com 26 | headedpicked.net 27 | highlytraditional.org 28 | himmeding.com 29 | howeveraged.net 30 | hydroelection.net 31 | illegedly.com 32 | imagesharehost.com 33 | leadwriting.com 34 | meetinglimited.com 35 | netdiscovery.org 36 | picasootoolbar.com 37 | piclbumestream.com 38 | postdone.com 39 | ratilovskoye.com 40 | recising.com 41 | searchforthat.net 42 | sectionsfear.com 43 | separtila.com 44 | standardbay.net 45 | streamingadv.com 46 | ternations.com 47 | thomaslaid.net 48 | traffictradexpert.com 49 | twicecitizens.com 50 | veristats.net 51 | virtualsearches.com 52 | workerssan.net 53 | yaltimate.com 54 | -------------------------------------------------------------------------------- /registry_keys.txt: -------------------------------------------------------------------------------- 1 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\1 2 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\2 3 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\3 4 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\4 5 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\5 6 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\6 7 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\7 8 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\8 9 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\9 10 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\10 11 | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\11 12 | -------------------------------------------------------------------------------- /resolving_ips.txt: -------------------------------------------------------------------------------- 1 | 109.74.195.149 2 | 243.182.100.227 3 | 4.227.70.65 4 | 63.77.106.1 5 | 166.178.113.144 6 | 231.150.98.137 7 | 31.171.130.249 8 | 85.66.23.125 9 | 6.88.25.80 10 | 80.213.59.50 11 | 222.219.85.79 12 | 234.102.81.206 13 | 116.181.5.61 14 | 156.44.195.200 15 | 21.8.194.15 16 | 42.107.140.147 17 | 199.172.52.66 18 | 227.248.14.79 19 | 155.83.123.22 20 | 44.36.245.224 21 | 168.23.171.69 22 | 204.37.98.202 23 | 253.101.238.123 24 | 94.75.201.33 25 | 40.22.124.164 26 | 49.197.32.49 27 | 104.127.201.198 28 | 144.61.46.13 29 | 203.136.214.219 30 | 253.134.178.81 31 | 106.8.16.175 32 | 204.11.56.48 33 | 41.252.243.242 34 | 151.225.26.181 35 | 106.110.29.248 36 | 114.225.99.185 37 | 2.171.234.238 38 | 50.116.56.144 39 | 102.209.206.89 40 | 7.34.116.64 41 | 38.155.216.69 42 | 27.251.60.63 43 | 158.76.160.100 44 | 100.134.242.235 45 | 124.3.139.20 46 | 25.20.33.76 47 | 189.140.10.37 48 | 59.228.144.104 49 | 204.11.56.48 50 | 29.205.223.64 51 | 94.75.201.33 52 | 118.15.53.129 53 | 22.149.159.105 54 | -------------------------------------------------------------------------------- /snort_signatures.txt: -------------------------------------------------------------------------------- 1 | alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FOX-SRT - Trojan - Ponmocup HTTP Request (generic)"; flow:established,to_server; content:"Accept: */*|0d 0a|";fast_ pattern;http_header; content:"Pragma|3a| no-cache|0d 0a|";http_header; content:"Cache- Control|3a| no-cache|0d 0a|";http_header; content:!"Referer|3a|";http_header; content:"Cookie|3a| ";http_header; pcre:"/^Host\x3A[^\r\n]+?\d{1,3}\x2e\d{1,3}\x2e\d{1,3}\ x2e\d{1,3}\r\n/Hm"; content:!"Accept-Encoding|3a| ";http_header; content:!"Accept-Language|3a| ";http_header; content:!"Content-Type|3a| ";http_header; reference:url,http://blog.Fox-IT.com/2015/12/02/ponmocup-a-giant-hiding-in-the-shadows; threshold:type limit, track by_src, count 1, seconds 600; classtype:trojan-activity; priority:1; sid:21001533; rev:1;) 2 | 3 | alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FOX-SRT - Trojan - Ponmocup plugin-specific check-in"; content:"GET"; http_method; content:"HTTP/1.1|0d0a|Accept: */*"; distance:0; content:"Content-Type: application/x-www-form-urlencoded"; fast_pattern; distance:0; pcre:"/Host: ([0-9]{1,3}\.){3}[0-9]{1,3}\x0d/R"; content:"User-Agent: Mozilla/4."; distance:0; content:"Cookie: "; pcre:"/Cookie: [a-z0-9]{1,10}=[a-z0-9+/]{20,500} (=){0,2}/iR"; urilen:<50,norm; content:!"Referer"; threshold:type limit, track by_src, count 1, seconds 600; classtype:trojan-activity; reference:url,http://blog.Fox-IT.com/2015/12/02/ponmocup-a-giant-hiding-in-the-shadows; sid:21001686; rev:2;) 4 | 5 | alert udp $HOME_NET $SIP_PORTS -> any any (msg:"FOX-SRT - Trojan - Ponmocup plugin #2600 (SIP scanner)"; content:"User-Agent|3a| Zoiper for Windows rev.1812|0d0a|"; threshold: type limit, count 1, seconds 3600, track by_src; reference:url,http://blog.Fox-IT.com/2015/12/02/ponmocup-a-giant-hiding-in-the-shadows; sid:21001493; classtype:trojan-activity; rev:1;) 6 | -------------------------------------------------------------------------------- /yara_signatures.txt: -------------------------------------------------------------------------------- 1 | rule Ponmocup : plugins 2 | { 3 | meta: 4 | description = "Ponmocup plugin detection (memory)" 5 | author = "Danny Heppener, Fox-IT" 6 | strings: 7 | $1100 = {4D 5A 90 [29] 4C 04} 8 | $1201 = {4D 5A 90 [29] B1 04} 9 | $1300 = {4D 5A 90 [29] 14 05} 10 | $1350 = {4D 5A 90 [29] 46 05} 11 | $1400 = {4D 5A 90 [29] 78 05} 12 | $1402 = {4D 5A 90 [29] 7A 05} 13 | $1403 = {4D 5A 90 [29] 7B 05} 14 | $1404 = {4D 5A 90 [29] 7C 05} 15 | $1405 = {4D 5A 90 [29] 7D 05} 16 | $1406 = {4D 5A 90 [29] 7E 05} 17 | $1500 = {4D 5A 90 [29] DC 05} 18 | $1501 = {4D 5A 90 [29] DD 05} 19 | $1502 = {4D 5A 90 [29] DE 05} 20 | $1505 = {4D 5A 90 [29] E1 05} 21 | $1506 = {4D 5A 90 [29] E2 05} 22 | $1507 = {4D 5A 90 [29] E3 05} 23 | $1508 = {4D 5A 90 [29] E4 05} 24 | $1509 = {4D 5A 90 [29] E5 05} 25 | $1510 = {4D 5A 90 [29] E6 05} 26 | $1511 = {4D 5A 90 [29] E7 05} 27 | $1512 = {4D 5A 90 [29] E8 05} 28 | $1600 = {4D 5A 90 [29] 40 06} 29 | $1601 = {4D 5A 90 [29] 41 06} 30 | $1700 = {4D 5A 90 [29] A4 06} 31 | $1800 = {4D 5A 90 [29] 08 07} 32 | $1801 = {4D 5A 90 [29] 09 07} 33 | $1802 = {4D 5A 90 [29] 0A 07} 34 | $1803 = {4D 5A 90 [29] 0B 07} 35 | $2001 = {4D 5A 90 [29] D1 07} 36 | $2002 = {4D 5A 90 [29] D2 07} 37 | $2003 = {4D 5A 90 [29] D3 07} 38 | $2004 = {4D 5A 90 [29] D4 07} 39 | $2500 = {4D 5A 90 [29] C4 09} 40 | $2501 = {4D 5A 90 [29] C5 09} 41 | $2550 = {4D 5A 90 [29] F6 09} 42 | $2600 = {4D 5A 90 [29] 28 0A} 43 | $2610 = {4D 5A 90 [29] 32 0A} 44 | $2700 = {4D 5A 90 [29] 8C 0A} 45 | $2701 = {4D 5A 90 [29] 8D 0A} 46 | $2750 = {4D 5A 90 [29] BE 0A} 47 | $2760 = {4D 5A 90 [29] C8 0A} 48 | $2810 = {4D 5A 90 [29] FA 0A} 49 | 50 | condition: 51 | any of them 52 | } 53 | --------------------------------------------------------------------------------