├── .gitignore
├── README.md
├── cuckoomon_hardened
├── cuckoomon.dll
└── cuckoomon_vbox_hardened.patch
├── malware_analysis
├── APT_NGO_wuaclt
│ ├── OpenIOC
│ │ └── 3433dad8-879e-40d9-98b3-92ddc75f0dcd.ioc
│ ├── snort
│ │ └── apt-wuactl.rules
│ └── yara
│ │ ├── APT_NGO_wuaclt.yar
│ │ └── APT_NGO_wuaclt_PDF.yar
├── Batchwiper
│ └── 548cfc54-42b9-48c6-a753-02e74246699b.ioc
├── CFR
│ └── 41bd34a6-dff3-435b-8a98-6ec7ab0d222b.ioc
├── CommentCrew
│ └── apt1.yara
├── FPU
│ └── fpu.yar
├── Georbot
│ ├── GeorBotBinary.yara
│ ├── GeorBotMemory.yara
│ ├── georbot.ioc
│ └── snort_georbot.rules
├── Hangover
│ └── hangover.yar
├── OSX_Leverage
│ ├── leverage.yar
│ └── snort_leverage.rules
├── RedOctober
│ └── 48290d24-834c-4097-abc5-4f22d3bd8f3c.ioc
├── Sykipot
│ └── snort
│ │ └── sykipot.rules
└── Urausy
│ └── urausy_skypedat.yar
├── malware_rulesets
└── yara
│ ├── avdetect.yar
│ ├── dbgdetect.yar
│ ├── index.yar
│ ├── sandboxdetect.yar
│ └── vmdetect.yar
├── peid2yar
├── README.md
├── aux
│ ├── pefile_test_sigs.py
│ └── peid_sigs_sanitizer.py
├── dbs
│ ├── UserDB.TXT
│ ├── epcompilersigs.peid
│ ├── eppackersigs.peid
│ ├── userdb_exeinfope.txt
│ ├── userdb_jclausing.txt
│ └── userdb_panda.txt
├── outputs
│ ├── UserDB.yar
│ ├── epcompilersigs.yar
│ ├── eppackersigs.yar
│ ├── userdb_exeinfope.yar
│ ├── userdb_jclausing.yar
│ └── userdb_panda.yar
└── peid2yar.py
├── tools
└── disaep.py
├── urlquery-chrome
├── README.md
├── main.css
├── manifest.json
├── options.html
├── options.js
└── urlquery.js
└── yarad
├── README.md
├── pyarad
├── pyarad.py
├── stress_test.py
├── stress_test_inet.py
├── test_scan.py
└── test_scan_inet.py
└── yarad
├── fingerprints
├── flash.yar
└── index.yar
├── unpack.py
├── yarad.cfg
└── yarad.py
/.gitignore:
--------------------------------------------------------------------------------
1 | *.pyc
2 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # AlienVault Labs
2 | ## git repository
3 |
4 | WARNING! This repository is deprecated, clone the new one! [https://github.com/AlienVault-Labs/AlienVaultLabs](https://github.com/AlienVault-Labs/AlienVaultLabs)
5 |
6 | Alienvault Labs Projects Random Stuff
7 |
8 | [http://labs.alienvault.com/labs/](http://labs.alienvault.com/labs/)
9 |
--------------------------------------------------------------------------------
/cuckoomon_hardened/cuckoomon.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/jaimeblasco/AlienvaultLabs/7613be50c50693d785017ce037879bd3eeacb9b2/cuckoomon_hardened/cuckoomon.dll
--------------------------------------------------------------------------------
/cuckoomon_hardened/cuckoomon_vbox_hardened.patch:
--------------------------------------------------------------------------------
1 | diff --git a/cuckoomon.c b/cuckoomon.c
2 | index bdc0cd9..6161e51 100644
3 | --- a/cuckoomon.c
4 | +++ b/cuckoomon.c
5 | @@ -55,6 +55,8 @@ static hook_t g_hooks[] = {
6 | HOOK(ntdll, NtOpenFile),
7 | HOOK(ntdll, NtReadFile),
8 | HOOK(ntdll, NtWriteFile),
9 | + HOOK(kernel32, GetFileAttributesA),
10 | + HOOK(kernel32, GetFileAttributesExA),
11 |
12 | // lowest variant of MoveFile()
13 | HOOK(kernel32, MoveFileWithProgressW),
14 | diff --git a/hook_file.c b/hook_file.c
15 | index 9323eb6..89b1ae6 100644
16 | --- a/hook_file.c
17 | +++ b/hook_file.c
18 | @@ -18,6 +18,7 @@ along with this program. If not, see .
19 |
20 | #include
21 | #include
22 | +#include
23 | #include "hooking.h"
24 | #include "ntapi.h"
25 | #include "log.h"
26 | @@ -185,3 +186,38 @@ HOOKDEF(BOOL, WINAPI, CreateDirectoryExW,
27 | LOQ("u", "DirectoryName", lpNewDirectory);
28 | return ret;
29 | }
30 | +
31 | +/* Hardened */
32 | +HOOKDEF(DWORD, WINAPI, GetFileAttributesA,
33 | + __in LPCTSTR lpFileName
34 | +) {
35 | + BOOL ret;
36 | + if (strstr(lpFileName, "VBox") != NULL) {
37 | + ret = INVALID_FILE_ATTRIBUTES;
38 | + LOQ("s", "Hardening", "Faked GetFileAttributesA return");
39 | + }
40 | + else {
41 | + ret = Old_GetFileAttributesA(lpFileName);
42 | + }
43 | + LOQ("s", "GetFileAttributesA", lpFileName);
44 | + return ret;
45 | +}
46 | +
47 | +/* Hardened */
48 | +HOOKDEF(DWORD, WINAPI, GetFileAttributesExA,
49 | + __in LPCTSTR lpFileName,
50 | + __in GET_FILEEX_INFO_LEVELS fInfoLevelId,
51 | + __out LPVOID lpFileInformation
52 | +) {
53 | + BOOL ret;
54 | + if (strstr(lpFileName, "VBox") != NULL) {
55 | + ret = 0;
56 | + LOQ("s", "Hardening", "Faked GetFileAttributesExA return");
57 | + }
58 | + else {
59 | + ret = Old_GetFileAttributesExA(lpFileName, fInfoLevelId,
60 | + lpFileInformation);
61 | + }
62 | + LOQ("s", "GetFileAttributesExA", lpFileName);
63 | + return ret;
64 | +}
65 | diff --git a/hook_reg.c b/hook_reg.c
66 | index 0752b9c..da5e816 100644
67 | --- a/hook_reg.c
68 | +++ b/hook_reg.c
69 | @@ -18,6 +18,7 @@ along with this program. If not, see .
70 |
71 | #include
72 | #include
73 | +#include
74 | #include "hooking.h"
75 | #include "ntapi.h"
76 | #include "log.h"
77 | @@ -25,6 +26,7 @@ along with this program. If not, see .
78 | static IS_SUCCESS_LONGREG();
79 | static const char *module_name = "registry";
80 |
81 | +/* Hardened */
82 | HOOKDEF(LONG, WINAPI, RegOpenKeyExA,
83 | __in HKEY hKey,
84 | __in_opt LPCTSTR lpSubKey,
85 | @@ -32,8 +34,19 @@ HOOKDEF(LONG, WINAPI, RegOpenKeyExA,
86 | __in REGSAM samDesired,
87 | __out PHKEY phkResult
88 | ) {
89 | - LONG ret = Old_RegOpenKeyExA(hKey, lpSubKey, ulOptions, samDesired,
90 | - phkResult);
91 | + LONG ret;
92 | + if (strstr(lpSubKey, "VirtualBox") != NULL) {
93 | + ret = 1;
94 | + LOQ("s", "Hardening", "Faked RegOpenKeyExA return");
95 | + }
96 | + else if (strstr(lpSubKey, "ControlSet") != NULL) {
97 | + ret = 1;
98 | + LOQ("s", "Hardening", "Faked RegOpenKeyExA return");
99 | + }
100 | + else {
101 | + ret = Old_RegOpenKeyExA(hKey, lpSubKey, ulOptions, samDesired,
102 | + phkResult);
103 | + }
104 | LOQ("psP", "Registry", hKey, "SubKey", lpSubKey, "Handle", phkResult);
105 | return ret;
106 | }
107 | @@ -216,6 +229,7 @@ HOOKDEF(LONG, WINAPI, RegSetValueExW,
108 | return ret;
109 | }
110 |
111 | +/* Hardened */
112 | HOOKDEF(LONG, WINAPI, RegQueryValueExA,
113 | __in HKEY hKey,
114 | __in_opt LPCTSTR lpValueName,
115 | @@ -224,8 +238,25 @@ HOOKDEF(LONG, WINAPI, RegQueryValueExA,
116 | __out_opt LPBYTE lpData,
117 | __inout_opt LPDWORD lpcbData
118 | ) {
119 | - LONG ret = Old_RegQueryValueExA(hKey, lpValueName, lpReserved, lpType,
120 | - lpData, lpcbData);
121 | + LONG ret;
122 | + /* HARDWARE\\Description\\System "SystemBiosVersion" */
123 | + if (strstr(lpValueName, "SystemBiosVersion") != NULL) {
124 | + ret = ERROR_SUCCESS;
125 | + LOQ("s", "Hardening", "Faked RegQueryValueExA return");
126 | + }
127 | + /* HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0 "Identifier" */
128 | + else if (strstr(lpValueName, "Identifier") != NULL) {
129 | + ret = ERROR_SUCCESS;
130 | + LOQ("s", "Hardening", "Faked RegQueryValueExA return");
131 | + }
132 | + else if (strstr(lpValueName, "ProductId") != NULL) {
133 | + ret = ERROR_SUCCESS;
134 | + LOQ("s", "Hardening", "Faked RegQueryValueExA return");
135 | + }
136 | + else {
137 | + ret = Old_RegQueryValueExA(hKey, lpValueName, lpReserved, lpType,
138 | + lpData, lpcbData);
139 | + }
140 | LOQ("psLB", "Handle", hKey, "ValueName", lpValueName,
141 | "Type", lpType, "Buffer", lpcbData, lpData);
142 | return ret;
143 | diff --git a/hooks.h b/hooks.h
144 | index 035f047..e40f190 100644
145 | --- a/hooks.h
146 | +++ b/hooks.h
147 | @@ -93,6 +93,16 @@ extern HOOKDEF(BOOL, WINAPI, CreateDirectoryExW,
148 | __in_opt LPSECURITY_ATTRIBUTES lpSecurityAttributes
149 | );
150 |
151 | +extern HOOKDEF(DWORD, WINAPI, GetFileAttributesA,
152 | + __in LPCTSTR lpFileName
153 | +);
154 | +
155 | +extern HOOKDEF(DWORD, WINAPI, GetFileAttributesExA,
156 | + __in LPCTSTR lpFileName,
157 | + __in GET_FILEEX_INFO_LEVELS fInfoLevelId,
158 | + __out LPVOID lpFileInformation
159 | +);
160 | +
161 | //
162 | // Registry Hooks
163 | //
164 |
--------------------------------------------------------------------------------
/malware_analysis/APT_NGO_wuaclt/OpenIOC/3433dad8-879e-40d9-98b3-92ddc75f0dcd.ioc:
--------------------------------------------------------------------------------
1 |
2 |
3 | APT NGO WUACLT
4 | This family of malware consists of backdoors that attempt to fetch encoded commands over HTTP. The malware is capable of downloading a file, downloading and executing a file, executing arbitrary shell commands, or sleeping a specified interval.
5 | Mandiant
6 | 2013-02-10T06:11:53
7 |
8 | MINIASP
9 | APT
10 | APT1
11 | Backdoor
12 |
13 |
14 |
15 |
16 |
17 | 6eebee2aebd5194db62cb8230502378c
18 |
19 |
20 |
21 | 620c6a6cff832e35090487680123f52b
22 |
23 |
24 |
25 | 81b03cbcfc4b9d090cd8f5e5da816895
26 |
27 |
28 |
29 | e476e4a24f8b4ff4c8a0b260aa35fc9f
30 |
31 |
32 |
33 | 77fbfed235d6062212a3e43211a5706e
34 |
35 |
36 |
37 | 52509abd1cc7b7fb391b19929e0d99c0
38 |
39 |
40 |
41 | miniasp
42 | unique strings found in most samples in family
43 |
44 |
45 |
46 | http://%s/record.asp?device_t=%s
47 | unique strings found in most samples in family
48 |
49 |
50 |
51 | open internet failed...
52 | unique strings found in most samples in family
53 |
54 |
55 |
56 | q0nc9w8edaoiuk2mzrfy3xt1p5ls67g4bvhj
57 | unique strings found in most samples in family
58 |
59 |
60 |
61 |
62 |
63 | 28160
64 |
65 |
66 |
67 | 497783
68 |
69 |
70 |
71 | 56320
72 |
73 |
74 |
75 |
76 |
77 | 2011-10-14T08:20:10Z
78 |
79 |
80 |
81 | 2011-10-23T07:42:47Z
82 |
83 |
84 |
85 | 2012-06-04T12:57:35Z
86 |
87 |
88 |
89 | 2012-06-09T13:19:49Z
90 |
91 |
92 |
93 |
94 |
95 | acrord32ram.exe
96 |
97 |
98 |
99 | winword.exe
100 |
101 |
102 |
103 | acrord32.exe
104 |
105 |
106 |
107 | ituneshelper.exe
108 |
109 |
110 |
111 | power_gen_2012.exe
112 |
113 |
114 |
115 | checksum_mismatch
116 | anomaly found in some samples
117 |
118 |
119 |
120 | checksum_is_zero
121 | anomaly found in some samples
122 |
123 |
124 |
125 | contains_eof_data
126 | anomaly found in some samples
127 |
128 |
129 |
130 |
131 |
132 |
--------------------------------------------------------------------------------
/malware_analysis/APT_NGO_wuaclt/snort/apt-wuactl.rules:
--------------------------------------------------------------------------------
1 | alert udp $HOME_NET any -> any 53 (msg:"ET DNS APT_NGO_wuaclt C2 Domain micorsofts.net"; content:"|0a|micorsofts|03|net|00|"; nocase; classtype:bad-unknown; sid:1111111112; rev:1; threshold: type limit, track by_src, count 1, seconds 300; reference:url,http://labs.alienvault.com; )
2 | alert udp $HOME_NET any -> any 53 (msg:"ET DNS APT_NGO_wuaclt C2 Domain micorsofts.com"; content:"|09|micorsofts|03|com|00|"; nocase; classtype:bad-unknown; sid:1111111113; rev:1; threshold: type limit, track by_src, count 1, seconds 300; reference:url,http://labs.alienvault.com; )
3 | alert udp $HOME_NET any -> any 53 (msg:"ET DNS APT_NGO_wuaclt C2 Domain hotmal1.com"; content:"|07|hotmal1|03|com|00|"; nocase; classtype:bad-unknown; sid:1111111114; rev:1; threshold: type limit, track by_src, count 1, seconds 300; reference:url,http://labs.alienvault.com; )
4 | alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN APT_NGO_wuaclt C2 Check-in"; flow:to_server,established; content:"/news/show.asp?id1="; http_uri; fast_pattern:only; content:"User-Agent|3a| Mozilla/4.0 |28|compatible|3b| MSIE 6.0|3b| Windows NT 5.1|3b| SV1"; http_header; reference:url,labs.alienvault.com; sid:1111111115; rev:1;)
5 | alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN APT_NGO_wuaclt"; flow:to_server,established; content:"/pics/"; http_uri; content:".asp?id="; http_uri; content:"User-Agent|3a| Mozilla/4.0 |28|compatible|3b| MSIE 6.0|3b| Windows NT 5.1|3b| SP Q"; http_header; content:"|0d 0a|Cookies|3a 20|"; fast_pattern:only; reference:url,labs.alienvault.com; sid:1111111116; rev:1;)
6 |
--------------------------------------------------------------------------------
/malware_analysis/APT_NGO_wuaclt/yara/APT_NGO_wuaclt.yar:
--------------------------------------------------------------------------------
1 | rule APT_NGO_wuaclt
2 | {
3 | strings:
4 | $a = "%%APPDATA%%\\Microsoft\\wuauclt\\wuauclt.dat"
5 | $b = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
6 | $c = "/news/show.asp?id%d=%d"
7 |
8 | $d = "%%APPDATA%%\\Microsoft\\wuauclt\\"
9 | $e = "0l23kj@nboxu"
10 |
11 | $f = "%%s.asp?id=%%d&Sid=%%d"
12 | $g = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SP Q%%d)"
13 | $h = "Cookies: UseID=KGIOODAOOK%%s"
14 |
15 | condition:
16 | ($a and $b and $c) or ($d and $e) or ($f and $g and $h)
17 | }
18 |
--------------------------------------------------------------------------------
/malware_analysis/APT_NGO_wuaclt/yara/APT_NGO_wuaclt_PDF.yar:
--------------------------------------------------------------------------------
1 | rule APT_NGO_wuaclt_PDF
2 | {
3 | strings:
4 | $pdf = "%PDF" nocase
5 | $comment = {3C 21 2D 2D 0D 0A 63 57 4B 51 6D 5A 6C 61 56 56 56 56 56 56 56 56 56 56 56 56 56 63 77 53 64 63 6A 4B 7A 38 35 6D 37 4A 56 6D 37 4A 46 78 6B 5A 6D 5A 6D 52 44 63 5A 58 41 73 6D 5A 6D 5A 7A 42 4A 31 79 73 2F 4F 0D 0A}
6 |
7 | condition:
8 | $pdf at 0 and $comment in (0..200)
9 | }
10 |
11 |
12 |
--------------------------------------------------------------------------------
/malware_analysis/Batchwiper/548cfc54-42b9-48c6-a753-02e74246699b.ioc:
--------------------------------------------------------------------------------
1 |
2 |
3 | Batchwiper
4 | http://www.certcc.ir/index.php?name=news&file=article&sid=2293
5 | Jaime.Blasco
6 | 2012-12-17T10:26:50
7 |
8 |
9 |
10 |
11 |
12 | f3dd76477e16e26571f8c64a7fd4a97b
13 |
14 |
15 |
16 | fa0b300e671f73b3b0f7f415ccbe9d41
17 |
18 |
19 |
20 | c4cd216112cbc5b8c046934843c579f6
21 |
22 |
23 |
24 | ea7ed6b50a9f7b31caeea372a327bd37
25 |
26 |
27 |
28 | b7117b5d8281acd56648c9d08fadf630
29 |
30 |
31 |
32 | \system32\SLEEP.EXE
33 |
34 |
35 |
36 | \system32\jucheck.exe
37 |
38 |
39 |
40 | \system32\juboot.exe
41 |
42 |
43 |
44 | \Start Menu\Programs\Startup\GrooveMonitor.exe
45 |
46 |
47 |
48 | \Local Settings\Temp\1.tmp\juboot.bat
49 |
50 |
51 |
52 | \Local Settings\Temp\4.tmp\jucheck.bat
53 |
54 |
55 |
56 | \Local Settings\Temp\1.tmp\WmiPrv.bat
57 |
58 |
59 |
60 |
61 | SOFTWARE\Microsoft\Windows\CurrentVersion\Run
62 |
63 |
64 |
65 | jucheck.exe
66 |
67 |
68 |
69 |
70 |
--------------------------------------------------------------------------------
/malware_analysis/CFR/41bd34a6-dff3-435b-8a98-6ec7ab0d222b.ioc:
--------------------------------------------------------------------------------
1 |
2 |
3 | Council on Foreign Relations Payload
4 | Indicators of compromise for the payload delivered by the Council on Foreign Relations waterhole attack using an Internet Explorer 8 zeroday
5 | Jaime Blasco
6 | 2012-12-29T13:07:26
7 |
8 |
9 |
10 |
11 |
12 | 39F206C64E2621AF0E7983C44E5E91FB
13 |
14 |
15 |
16 | \Temp\qwea.dat
17 |
18 |
19 |
20 | \Temp\flowertep.jpg
21 |
22 |
23 |
24 | \Program Files\Common Files\DirectDB.exe
25 |
26 |
27 |
28 |
29 | xsainfo[1].jpg
30 |
31 |
32 |
33 | \Temporary Internet Files\
34 |
35 |
36 |
37 |
38 |
39 | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{785942B1-FDE7-447F-A9C2-694A721FA120}
40 |
41 |
42 |
43 | DirectDB.exe
44 |
45 |
46 |
47 |
48 |
49 | HKEY_LOCAL_MACHINE\SOFTWARE\STS
50 |
51 |
52 |
53 | nck
54 |
55 |
56 |
57 |
58 |
59 | &!#@&
60 |
61 |
62 |
63 |
64 | DirectDB.exe
65 |
66 |
67 |
68 | iexplore.exe
69 |
70 |
71 |
72 |
73 |
74 |
--------------------------------------------------------------------------------
/malware_analysis/CommentCrew/apt1.yara:
--------------------------------------------------------------------------------
1 |
2 | rule LIGHTDART_APT1 {
3 | meta:
4 | author = "AlienVault Labs"
5 | info = "CommentCrew-threat-apt1"
6 |
7 | strings:
8 | $s1 = "ret.log" wide ascii
9 | $s2 = "Microsoft Internet Explorer 6.0" wide ascii
10 | $s3 = "szURL Fail" wide ascii
11 | $s4 = "szURL Successfully" wide ascii
12 | $s5 = "%s&sdate=%04ld-%02ld-%02ld" wide ascii
13 | condition:
14 | all of them
15 | }
16 |
17 | rule AURIGA_APT1 {
18 | meta:
19 | author = "AlienVault Labs"
20 | info = "CommentCrew-threat-apt1"
21 |
22 | strings:
23 | $s1 = "superhard corp." wide ascii
24 | $s2 = "microsoft corp." wide ascii
25 | $s3 = "[Insert]" wide ascii
26 | $s4 = "[Delete]" wide ascii
27 | $s5 = "[End]" wide ascii
28 | $s6 = "!(*@)(!@KEY" wide ascii
29 | $s7 = "!(*@)(!@SID=" wide ascii
30 | condition:
31 | all of them
32 | }
33 |
34 | rule AURIGA_driver_APT1 {
35 | meta:
36 | author = "AlienVault Labs"
37 | info = "CommentCrew-threat-apt1"
38 |
39 | strings:
40 | $s1 = "Services\\riodrv32" wide ascii
41 | $s2 = "riodrv32.sys" wide ascii
42 | $s3 = "svchost.exe" wide ascii
43 | $s4 = "wuauserv.dll" wide ascii
44 | $s5 = "arp.exe" wide ascii
45 | $pdb = "projects\\auriga" wide ascii
46 |
47 | condition:
48 | all of ($s*) or $pdb
49 | }
50 |
51 | rule BANGAT_APT1 {
52 | meta:
53 | author = "AlienVault Labs"
54 | info = "CommentCrew-threat-apt1"
55 |
56 | strings:
57 | $s1 = "superhard corp." wide ascii
58 | $s2 = "microsoft corp." wide ascii
59 | $s3 = "[Insert]" wide ascii
60 | $s4 = "[Delete]" wide ascii
61 | $s5 = "[End]" wide ascii
62 | $s6 = "!(*@)(!@KEY" wide ascii
63 | $s7 = "!(*@)(!@SID=" wide ascii
64 | $s8 = "end binary output" wide ascii
65 | $s9 = "XriteProcessMemory" wide ascii
66 | $s10 = "IE:Password-Protected sites" wide ascii
67 | $s11 = "pstorec.dll" wide ascii
68 |
69 | condition:
70 | all of them
71 | }
72 |
73 | rule BISCUIT_GREENCAT_APT1 {
74 | meta:
75 | author = "AlienVault Labs"
76 | info = "CommentCrew-threat-apt1"
77 |
78 | strings:
79 | $s1 = "zxdosml" wide ascii
80 | $s2 = "get user name error!" wide ascii
81 | $s3 = "get computer name error!" wide ascii
82 | $s4 = "----client system info----" wide ascii
83 | $s5 = "stfile" wide ascii
84 | $s6 = "cmd success!" wide ascii
85 |
86 | condition:
87 | all of them
88 | }
89 |
90 | rule BOUNCER_APT1 {
91 | meta:
92 | author = "AlienVault Labs"
93 | info = "CommentCrew-threat-apt1"
94 |
95 | strings:
96 | $s1 = "*Qd9kdgba33*%Wkda0Qd3kvn$*&><(*&%$E#%$#1234asdgKNAg@!gy565dtfbasdg" wide ascii
97 | $s2 = "IDR_DATA%d" wide ascii
98 |
99 | $s3 = "asdfqwe123cxz" wide ascii
100 | $s4 = "Mode must be 0(encrypt) or 1(decrypt)." wide ascii
101 |
102 | condition:
103 | ($s1 and $s2) or ($s3 and $s4)
104 |
105 | }
106 |
107 | rule BOUNCER_DLL_APT1 {
108 | meta:
109 | author = "AlienVault Labs"
110 | info = "CommentCrew-threat-apt1"
111 |
112 | strings:
113 | $s1 = "new_connection_to_bounce():" wide ascii
114 | $s2 = "usage:%s IP port [proxip] [port] [key]" wide ascii
115 |
116 | condition:
117 | all of them
118 | }
119 |
120 | rule CALENDAR_APT1 {
121 | meta:
122 | author = "AlienVault Labs"
123 | info = "CommentCrew-threat-apt1"
124 |
125 | strings:
126 | $s1 = "content" wide ascii
127 | $s2 = "title" wide ascii
128 | $s3 = "entry" wide ascii
129 | $s4 = "feed" wide ascii
130 | $s5 = "DownRun success" wide ascii
131 | $s6 = "%s@gmail.com" wide ascii
132 | $s7 = "" wide ascii
133 |
134 | $b8 = "W4qKihsb+So=" wide ascii
135 | $b9 = "PoqKigY7ggH+VcnqnTcmhFCo9w==" wide ascii
136 | $b10 = "8oqKiqb5880/uJLzAsY=" wide ascii
137 |
138 | condition:
139 | all of ($s*) or all of ($b*)
140 | }
141 |
142 | rule COMBOS_APT1 {
143 | meta:
144 | author = "AlienVault Labs"
145 | info = "CommentCrew-threat-apt1"
146 |
147 | strings:
148 | $s1 = "Mozilla4.0 (compatible; MSIE 7.0; Win32)" wide ascii
149 | $s2 = "Mozilla5.1 (compatible; MSIE 8.0; Win32)" wide ascii
150 | $s3 = "Delay" wide ascii
151 | $s4 = "Getfile" wide ascii
152 | $s5 = "Putfile" wide ascii
153 | $s6 = "---[ Virtual Shell]---" wide ascii
154 | $s7 = "Not Comming From Our Server %s." wide ascii
155 |
156 |
157 | condition:
158 | all of them
159 | }
160 |
161 | rule DAIRY_APT1 {
162 | meta:
163 | author = "AlienVault Labs"
164 | info = "CommentCrew-threat-apt1"
165 |
166 | strings:
167 | $s1 = "Mozilla/4.0 (compatible; MSIE 7.0;)" wide ascii
168 | $s2 = "KilFail" wide ascii
169 | $s3 = "KilSucc" wide ascii
170 | $s4 = "pkkill" wide ascii
171 | $s5 = "pklist" wide ascii
172 |
173 |
174 | condition:
175 | all of them
176 | }
177 |
178 | rule GLOOXMAIL_APT1 {
179 | meta:
180 | author = "AlienVault Labs"
181 | info = "CommentCrew-threat-apt1"
182 |
183 | strings:
184 | $s1 = "Kill process success!" wide ascii
185 | $s2 = "Kill process failed!" wide ascii
186 | $s3 = "Sleep success!" wide ascii
187 | $s4 = "based on gloox" wide ascii
188 |
189 | $pdb = "glooxtest.pdb" wide ascii
190 |
191 | condition:
192 | all of ($s*) or $pdb
193 | }
194 |
195 | rule GOGGLES_APT1 {
196 | meta:
197 | author = "AlienVault Labs"
198 | info = "CommentCrew-threat-apt1"
199 |
200 | strings:
201 | $s1 = "Kill process success!" wide ascii
202 | $s2 = "Kill process failed!" wide ascii
203 | $s3 = "Sleep success!" wide ascii
204 | $s4 = "based on gloox" wide ascii
205 |
206 | $pdb = "glooxtest.pdb" wide ascii
207 |
208 | condition:
209 | all of ($s*) or $pdb
210 | }
211 |
212 | rule HACKSFASE1_APT1 {
213 | meta:
214 | author = "AlienVault Labs"
215 | info = "CommentCrew-threat-apt1"
216 |
217 | strings:
218 | $s1 = {cb 39 82 49 42 be 1f 3a}
219 |
220 | condition:
221 | all of them
222 | }
223 |
224 | rule HACKSFASE2_APT1 {
225 | meta:
226 | author = "AlienVault Labs"
227 | info = "CommentCrew-threat-apt1"
228 |
229 | strings:
230 | $s1 = "Send to Server failed." wide ascii
231 | $s2 = "HandShake with the server failed. Error:" wide ascii
232 | $s3 = "Decryption Failed. Context Expired." wide ascii
233 |
234 | condition:
235 | all of them
236 | }
237 |
238 | rule KURTON_APT1 {
239 | meta:
240 | author = "AlienVault Labs"
241 | info = "CommentCrew-threat-apt1"
242 |
243 | strings:
244 | $s1 = "Mozilla/4.0 (compatible; MSIE8.0; Windows NT 5.1)" wide ascii
245 | $s2 = "!(*@)(!@PORT!(*@)(!@URL" wide ascii
246 | $s3 = "MyTmpFile.Dat" wide ascii
247 | $s4 = "SvcHost.DLL.log" wide ascii
248 |
249 | condition:
250 | all of them
251 | }
252 |
253 | rule LONGRUN_APT1 {
254 | meta:
255 | author = "AlienVault Labs"
256 | info = "CommentCrew-threat-apt1"
257 |
258 | strings:
259 | $s1 = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0; Trident/4.0)" wide ascii
260 | $s2 = "%s\\%c%c%c%c%c%c%c" wide ascii
261 | $s3 = "wait:" wide ascii
262 | $s4 = "Dcryption Error! Invalid Character" wide ascii
263 |
264 | condition:
265 | all of them
266 | }
267 |
268 | rule MACROMAIL_APT1 {
269 | meta:
270 | author = "AlienVault Labs"
271 | info = "CommentCrew-threat-apt1"
272 |
273 | strings:
274 | $s1 = "svcMsn.dll" wide ascii
275 | $s2 = "RundllInstall" wide ascii
276 | $s3 = "Config service %s ok." wide ascii
277 | $s4 = "svchost.exe" wide ascii
278 |
279 | condition:
280 | all of them
281 | }
282 |
283 | rule MANITSME_APT1 {
284 | meta:
285 | author = "AlienVault Labs"
286 | info = "CommentCrew-threat-apt1"
287 |
288 | strings:
289 | $s1 = "Install an Service hosted by SVCHOST." wide ascii
290 | $s2 = "The Dll file that to be released." wide ascii
291 | $s3 = "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
292 | $s4 = "svchost.exe" wide ascii
293 |
294 | $e1 = "Man,it's me" wide ascii
295 | $e2 = "Oh,shit" wide ascii
296 | $e3 = "Hallelujah" wide ascii
297 | $e4 = "nRet == SOCKET_ERROR" wide ascii
298 |
299 | $pdb1 = "rouji\\release\\Install.pdb" wide ascii
300 | $pdb2 = "rouji\\SvcMain.pdb" wide ascii
301 |
302 | condition:
303 | (all of ($s*)) or (all of ($e*)) or $pdb1 or $pdb2
304 | }
305 |
306 | rule MINIASP_APT1 {
307 | meta:
308 | author = "AlienVault Labs"
309 | info = "CommentCrew-threat-apt1"
310 |
311 | strings:
312 | $s1 = "miniasp" wide ascii
313 | $s2 = "wakeup=" wide ascii
314 | $s3 = "download ok!" wide ascii
315 | $s4 = "command is null!" wide ascii
316 | $s5 = "device_input.asp?device_t=" wide ascii
317 |
318 |
319 | condition:
320 | all of them
321 | }
322 |
323 | rule NEWSREELS_APT1 {
324 | meta:
325 | author = "AlienVault Labs"
326 | info = "CommentCrew-threat-apt1"
327 |
328 | strings:
329 | $s1 = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0)" wide ascii
330 | $s2 = "name=%s&userid=%04d&other=%c%s" wide ascii
331 | $s3 = "download ok!" wide ascii
332 | $s4 = "command is null!" wide ascii
333 | $s5 = "noclient" wide ascii
334 | $s6 = "wait" wide ascii
335 | $s7 = "active" wide ascii
336 | $s8 = "hello" wide ascii
337 |
338 |
339 | condition:
340 | all of them
341 | }
342 |
343 | rule SEASALT_APT1 {
344 | meta:
345 | author = "AlienVault Labs"
346 | info = "CommentCrew-threat-apt1"
347 |
348 | strings:
349 | $s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98) KSMM" wide ascii
350 | $s2 = "upfileok" wide ascii
351 | $s3 = "download ok!" wide ascii
352 | $s4 = "upfileer" wide ascii
353 | $s5 = "fxftest" wide ascii
354 |
355 |
356 | condition:
357 | all of them
358 | }
359 |
360 | rule STARSYPOUND_APT1 {
361 | meta:
362 | author = "AlienVault Labs"
363 | info = "CommentCrew-threat-apt1"
364 |
365 | strings:
366 | $s1 = "*(SY)# cmd" wide ascii
367 | $s2 = "send = %d" wide ascii
368 | $s3 = "cmd.exe" wide ascii
369 | $s4 = "*(SY)#" wide ascii
370 |
371 |
372 | condition:
373 | all of them
374 | }
375 |
376 | rule SWORD_APT1 {
377 | meta:
378 | author = "AlienVault Labs"
379 | info = "CommentCrew-threat-apt1"
380 |
381 | strings:
382 | $s1 = "@***@*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>>>" wide ascii
383 | $s2 = "sleep:" wide ascii
384 | $s3 = "down:" wide ascii
385 | $s4 = "*========== Bye Bye ! ==========*" wide ascii
386 |
387 |
388 | condition:
389 | all of them
390 | }
391 |
392 |
393 | rule thequickbrow_APT1 {
394 | meta:
395 | author = "AlienVault Labs"
396 | info = "CommentCrew-threat-apt1"
397 |
398 | strings:
399 | $s1 = "thequickbrownfxjmpsvalzydg" wide ascii
400 |
401 |
402 | condition:
403 | all of them
404 | }
405 |
406 |
407 | rule TABMSGSQL_APT1 {
408 | meta:
409 | author = "AlienVault Labs"
410 | info = "CommentCrew-threat-apt1"
411 |
412 | strings:
413 | $s1 = "letusgohtppmmv2.0.0.1" wide ascii
414 | $s2 = "Mozilla/4.0 (compatible; )" wide ascii
415 | $s3 = "filestoc" wide ascii
416 | $s4 = "filectos" wide ascii
417 | $s5 = "reshell" wide ascii
418 |
419 | condition:
420 | all of them
421 | }
422 |
423 | rule CCREWBACK1
424 | {
425 | meta:
426 | author = "AlienVault Labs"
427 | info = "CommentCrew-threat-apt1"
428 |
429 | strings:
430 | $a = "postvalue" wide ascii
431 | $b = "postdata" wide ascii
432 | $c = "postfile" wide ascii
433 | $d = "hostname" wide ascii
434 | $e = "clientkey" wide ascii
435 | $f = "start Cmd Failure!" wide ascii
436 | $g = "sleep:" wide ascii
437 | $h = "downloadcopy:" wide ascii
438 | $i = "download:" wide ascii
439 | $j = "geturl:" wide ascii
440 | $k = "1.234.1.68" wide ascii
441 |
442 | condition:
443 | 4 of ($a,$b,$c,$d,$e) or $f or 3 of ($g,$h,$i,$j) or $k
444 | }
445 |
446 | rule TrojanCookies_CCREW
447 | {
448 | meta:
449 | author = "AlienVault Labs"
450 | info = "CommentCrew-threat-apt1"
451 |
452 | strings:
453 | $a = "sleep:" wide ascii
454 | $b = "content=" wide ascii
455 | $c = "reqpath=" wide ascii
456 | $d = "savepath=" wide ascii
457 | $e = "command=" wide ascii
458 |
459 |
460 | condition:
461 | 4 of ($a,$b,$c,$d,$e)
462 | }
463 |
464 | rule GEN_CCREW1
465 | {
466 | meta:
467 | author = "AlienVault Labs"
468 | info = "CommentCrew-threat-apt1"
469 |
470 | strings:
471 | $a = "W!r@o#n$g" wide ascii
472 | $b = "KerNel32.dll" wide ascii
473 |
474 | condition:
475 | any of them
476 | }
477 |
478 | rule Elise
479 | {
480 | meta:
481 | author = "AlienVault Labs"
482 | info = "CommentCrew-threat-apt1"
483 |
484 | strings:
485 | $a = "SetElise.pdb" wide ascii
486 |
487 | condition:
488 | $a
489 | }
490 |
491 | rule EclipseSunCloudRAT
492 | {
493 | meta:
494 | author = "AlienVault Labs"
495 | info = "CommentCrew-threat-apt1"
496 |
497 | strings:
498 | $a = "Eclipse_A" wide ascii
499 | $b = "\\PJTS\\" wide ascii
500 | $c = "Eclipse_Client_B.pdb" wide ascii
501 | $d = "XiaoME" wide ascii
502 | $e = "SunCloud-Code" wide ascii
503 | $f = "/uc_server/data/forum.asp" wide ascii
504 |
505 | condition:
506 | any of them
507 | }
508 |
509 | rule MoonProject
510 | {
511 | meta:
512 | author = "AlienVault Labs"
513 | info = "CommentCrew-threat-apt1"
514 |
515 | strings:
516 | $a = "Serverfile is smaller than Clientfile" wide ascii
517 | $b = "\\M tools\\" wide ascii
518 | $c = "MoonDLL" wide ascii
519 | $d = "\\M tools\\" wide ascii
520 |
521 | condition:
522 | any of them
523 | }
524 |
525 | rule ccrewDownloader1
526 | {
527 | meta:
528 | author = "AlienVault Labs"
529 | info = "CommentCrew-threat-apt1"
530 |
531 | strings:
532 | $a = {DD B5 61 F0 20 47 20 57 D6 65 9C CB 31 1B 65 42}
533 |
534 | condition:
535 | any of them
536 | }
537 |
538 | rule ccrewDownloader2
539 | {
540 | meta:
541 | author = "AlienVault Labs"
542 | info = "CommentCrew-threat-apt1"
543 |
544 | strings:
545 | $a = "3gZFQOBtY3sifNOl" wide ascii
546 | $b = "docbWUWsc2gRMv9HN7TFnvnKcrWUUFdAEem9DkqRALoD" wide ascii
547 | $c = "6QVSOZHQPCMc2A8HXdsfuNZcmUnIqWrOIjrjwOeagILnnScxadKEr1H2MZNwSnaJ" wide ascii
548 |
549 | condition:
550 | any of them
551 | }
552 |
553 |
554 | rule ccrewMiniasp
555 | {
556 | meta:
557 | author = "AlienVault Labs"
558 | info = "CommentCrew-threat-apt1"
559 |
560 | strings:
561 | $a = "MiniAsp.pdb" wide ascii
562 | $b = "device_t=" wide ascii
563 |
564 | condition:
565 | any of them
566 | }
567 |
568 |
569 | rule ccrewSSLBack2
570 | {
571 | meta:
572 | author = "AlienVault Labs"
573 | info = "CommentCrew-threat-apt1"
574 |
575 | strings:
576 | $a = {39 82 49 42 BE 1F 3A}
577 |
578 | condition:
579 | any of them
580 | }
581 |
582 | rule ccrewSSLBack3
583 | {
584 | meta:
585 | author = "AlienVault Labs"
586 | info = "CommentCrew-threat-apt1"
587 |
588 | strings:
589 | $a = "SLYHKAAY" wide ascii
590 |
591 | condition:
592 | any of them
593 | }
594 |
595 |
596 | rule ccrewSSLBack1
597 | {
598 | meta:
599 | author = "AlienVault Labs"
600 | info = "CommentCrew-threat-apt1"
601 |
602 | strings:
603 | $a = "!@#%$^#@!" wide ascii
604 | $b = "64.91.80.6" wide ascii
605 |
606 | condition:
607 | any of them
608 | }
609 |
610 | rule ccrewDownloader3
611 | {
612 | meta:
613 | author = "AlienVault Labs"
614 | info = "CommentCrew-threat-apt1"
615 |
616 | strings:
617 | $a = "ejlcmbv" wide ascii
618 | $b = "bhxjuisv" wide ascii
619 | $c = "yqzgrh" wide ascii
620 | $d = "uqusofrp" wide ascii
621 | $e = "Ljpltmivvdcbb" wide ascii
622 | $f = "frfogjviirr" wide ascii
623 | $g = "ximhttoskop" wide ascii
624 | condition:
625 | 4 of them
626 | }
627 |
628 |
629 | rule ccrewQAZ
630 | {
631 | meta:
632 | author = "AlienVault Labs"
633 | info = "CommentCrew-threat-apt1"
634 |
635 | strings:
636 | $a = "!QAZ@WSX" wide ascii
637 |
638 | condition:
639 | $a
640 | }
641 |
642 | rule metaxcd
643 | {
644 | meta:
645 | author = "AlienVault Labs"
646 | info = "CommentCrew-threat-apt1"
647 |
648 | strings:
649 | $a = "]id=" wide ascii
808 | condition:
809 | all of them
810 | }
811 |
812 | rule APT1_WEBC2_TABLE
813 | {
814 | meta:
815 | author = "AlienVault Labs"
816 | info = "CommentCrew-threat-apt1"
817 |
818 | strings:
819 | $msg1 = "Fail To Execute The Command" wide ascii
820 | $msg2 = "Execute The Command Successfully" wide ascii
821 | $gif1 = /\w+\.gif/
822 | $gif2 = "GIF89" wide ascii
823 | condition:
824 | 3 of them
825 | }
826 |
827 | rule APT1_WEBC2_RAVE
828 | {
829 | meta:
830 | author = "AlienVault Labs"
831 | info = "CommentCrew-threat-apt1"
832 |
833 | strings:
834 | $1 = "iniet.exe" wide ascii
835 | $2 = "cmd.exe" wide ascii
836 | $3 = "SYSTEM\\CurrentControlSet\\Services\\DEVFS" wide ascii
837 | $4 = "Device File System" wide ascii
838 | condition:
839 | 3 of them
840 | }
841 |
842 | rule APT1_WEBC2_QBP
843 | {
844 | meta:
845 | author = "AlienVault Labs"
846 | info = "CommentCrew-threat-apt1"
847 |
848 | strings:
849 | $1 = "2010QBP" wide ascii
850 | $2 = "adobe_sl.exe" wide ascii
851 | $3 = "URLDownloadToCacheFile" wide ascii
852 | $4 = "dnsapi.dll" wide ascii
853 | $5 = "urlmon.dll" wide ascii
854 | condition:
855 | 4 of them
856 | }
857 |
858 | rule APT1_WEBC2_KT3
859 | {
860 | meta:
861 | author = "AlienVault Labs"
862 | info = "CommentCrew-threat-apt1"
863 |
864 | strings:
865 | $1 = "*!Kt3+v|" wide ascii
866 | $2 = " s:" wide ascii
867 | $3 = " dne" wide ascii
868 | condition:
869 | all of them
870 | }
871 |
872 | rule APT1_WEBC2_HEAD
873 | {
874 | meta:
875 | author = "AlienVault Labs"
876 | info = "CommentCrew-threat-apt1"
877 |
878 | strings:
879 | $1 = "Ready!" wide ascii
880 | $2 = "connect ok" wide ascii
881 | $3 = "WinHTTP 1.0" wide ascii
882 | $4 = "" wide ascii
883 | condition:
884 | all of them
885 | }
886 |
887 | rule APT1_WEBC2_GREENCAT
888 | {
889 | meta:
890 | author = "AlienVault Labs"
891 | info = "CommentCrew-threat-apt1"
892 |
893 | strings:
894 | $1 = "reader_sl.exe" wide ascii
895 | $2 = "MS80547.bat" wide ascii
896 | $3 = "ADR32" wide ascii
897 | $4 = "ControlService failed!" wide ascii
898 | condition:
899 | 3 of them
900 | }
901 |
902 | rule APT1_WEBC2_DIV
903 | {
904 | meta:
905 | author = "AlienVault Labs"
906 | info = "CommentCrew-threat-apt1"
907 |
908 | strings:
909 | $1 = "3DC76854-C328-43D7-9E07-24BF894F8EF5" wide ascii
910 | $2 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide ascii
911 | $3 = "Hello from MFC!" wide ascii
912 | $4 = "Microsoft Internet Explorer" wide ascii
913 | condition:
914 | 3 of them
915 | }
916 |
917 | rule APT1_WEBC2_CSON
918 | {
919 | meta:
920 | author = "AlienVault Labs"
921 | info = "CommentCrew-threat-apt1"
922 |
923 | strings:
924 | $httpa1 = "/Default.aspx?INDEX=" wide ascii
925 | $httpa2 = "/Default.aspx?ID=" wide ascii
926 | $httpb1 = "Win32" wide ascii
927 | $httpb2 = "Accept: text*/*" wide ascii
928 | $exe1 = "xcmd.exe" wide ascii
929 | $exe2 = "Google.exe" wide ascii
930 | condition:
931 | 1 of ($exe*) and 1 of ($httpa*) and all of ($httpb*)
932 | }
933 |
934 | rule APT1_WEBC2_CLOVER
935 | {
936 | meta:
937 | author = "AlienVault Labs"
938 | info = "CommentCrew-threat-apt1"
939 |
940 | strings:
941 | $msg1 = "BUILD ERROR!" wide ascii
942 | $msg2 = "SUCCESS!" wide ascii
943 | $msg3 = "wild scan" wide ascii
944 | $msg4 = "Code too clever" wide ascii
945 | $msg5 = "insufficient lookahead" wide ascii
946 | $ua1 = "Mozilla/4.0 (compatible; MSIE 6.1; Windows NT 5.1; SV1)" wide ascii
947 | $ua2 = "Mozilla/5.0 (Windows; Windows NT 5.1; en-US; rv:1.8.0.12) Firefox/1.5.0.12" wide ascii
948 | condition:
949 | 2 of ($msg*) and 1 of ($ua*)
950 | }
951 |
952 | rule APT1_WEBC2_BOLID
953 | {
954 | meta:
955 | author = "AlienVault Labs"
956 | info = "CommentCrew-threat-apt1"
957 |
958 | strings:
959 | $vm = "VMProtect" wide ascii
960 | $http = "http://[c2_location]/[page].html" wide ascii
961 | condition:
962 | all of them
963 | }
964 |
965 | rule APT1_WEBC2_ADSPACE
966 | {
967 | meta:
968 | author = "AlienVault Labs"
969 | info = "CommentCrew-threat-apt1"
970 |
971 | strings:
972 | $1 = "