ch0ic3/CyberThreatIntel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Create YARA_Rule_Bitter_Variant1_August_2019.txt

Browse Source
This commit is contained in:
StrangerealIntel 2019-08-27 14:27:09 +02:00 committed by GitHub
parent e7f38875a0
commit 5eacdead31
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 60 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
offshore APT organization/Bitter/27-08-19/YARA_Rule_Bitter_Variant1_August_2019.txt Normal file
View File

@ -0,0 +1,60 @@
#=====================================================
# Hard coded encoded (Variant 1)
# "bqqmjdbujpo0y.xxx.gpsn.vsmfodpefe" -> "application/x-www-form-urlencoded"
# "0fiSfdws/qiq" -> "/ehRecvr.php"
# "0I0N0V0\\0o0v0 -> "/H/M/U/[[/n/u/"
# "QPTU" -> "POST"
# "lffq.bmjwf" -> "keep-alive"
# "Dpoofdujpo" -> "Connection:"
# "Iptu;" -> "Host:"
# "IUUQ02/1" -> "HTTP/1.0"
#=====================================================
rule ArtraDownlaoder_bin_Variant1
{
meta:
description = "Artra Downloader"
author = "James_inthe_box, Arkbird"
reference = "dcb8531b0879d46949dd63b1ac094f5588c26867805d0795e244f4f9b8077ed1"
date = "2019/08"
maltype = "Loader"
strings:
$string1 = "bqqmjdbujpo0y.xxx.gpsn.vsmfodpefe"
$string2 = "=%s&st=%d"
$string3 = "Content-length: %d"
$string4 = "0I0N0V0\\0o0v0"
$string5 = "ID=%s"
$string6 = "QPTU"
$string7 = "lffq.bmjwf"
$string8 = "Dpoofdujpo"
$string9 = "Iptu;"
$string10 = "IUUQ02/1"
condition:
uint16(0) == 0x5A4D and all of ($string*) and filesize < 100KB
}
rule ArtraDownlaoder_mem_Variant1
{
meta:
description = "Artra Downloader"
author = "James_inthe_box, Arkbird"
reference = "dcb8531b0879d46949dd63b1ac094f5588c26867805d0795e244f4f9b8077ed1"
date = "2019/08"
maltype = "Loader"
strings:
$string1 = "bqqmjdbujpo0y.xxx.gpsn.vsmfodpefe"
$string2 = "=%s&st=%d"
$string3 = "Content-length: %d"
$string4 = "0I0N0V0\\0o0v0"
$string5 = "ID=%s"
$string6 = "QPTU"
$string7 = "lffq.bmjwf"
$string8 = "Dpoofdujpo"
$string9 = "Iptu;"
$string10 = "IUUQ02/1"
condition:
all of ($string*) and filesize > 100KB
}