Skip to content

Commit 45b72f9

Browse files
eset-researcheset-research
committed
Add YARA and Sigma rules for Invisimole
1 parent db8ea39 commit 45b72f9

20 files changed

+1238
-0
lines changed

‎invisimole/invisimole.yar

Lines changed: 297 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,297 @@
1+
// For feedback or questions contact us at: [email protected]
2+
// https://github.com/eset/malware-ioc/
3+
//
4+
// These YARA rules are provided to the community under the two-clause BSD
5+
// license as follows:
6+
//
7+
// Copyright (c) 2021, ESET
8+
// All rights reserved.
9+
//
10+
// Redistribution and use in source and binary forms, with or without
11+
// modification, are permitted provided that the following conditions are met:
12+
//
13+
// 1. Redistributions of source code must retain the above copyright notice, this
14+
// list of conditions and the following disclaimer.
15+
//
16+
// 2. Redistributions in binary form must reproduce the above copyright notice,
17+
// this list of conditions and the following disclaimer in the documentation
18+
// and/or other materials provided with the distribution.
19+
//
20+
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
21+
// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22+
// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
23+
// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
24+
// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25+
// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
26+
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27+
// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28+
// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
29+
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30+
//
31+
32+
import "pe"
33+
34+
private rule InvisiMole_Blob {
35+
meta:
36+
description = "Detects InvisiMole blobs by magic values"
37+
author = "ESET Research"
38+
date = "2021-05-17"
39+
reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
40+
source = "https://github.com/eset/malware-ioc/"
41+
license = "BSD 2-Clause"
42+
version = "1"
43+
44+
strings:
45+
$magic_old_32 = {F9 FF D0 DE}
46+
$magic_old_64 = {64 FF D0 DE}
47+
$magic_new_32 = {86 DA 11 CE}
48+
$magic_new_64 = {64 DA 11 CE}
49+
50+
condition:
51+
($magic_old_32 at 0) or ($magic_old_64 at 0) or ($magic_new_32 at 0) or ($magic_new_64 at 0)
52+
}
53+
54+
rule apt_Windows_InvisiMole_Logs {
55+
meta:
56+
description = "Detects log files with collected created by InvisiMole's RC2CL backdoor"
57+
author = "ESET Research"
58+
date = "2021-05-17"
59+
reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
60+
source = "https://github.com/eset/malware-ioc/"
61+
license = "BSD 2-Clause"
62+
version = "1"
63+
64+
condition:
65+
uint32(0) == 0x08F1CAA1 or
66+
uint32(0) == 0x08F1CAA2 or
67+
uint32(0) == 0x08F1CCC0 or
68+
uint32(0) == 0x08F2AFC0 or
69+
uint32(0) == 0x083AE4DF or
70+
uint32(0) == 0x18F2CBB1 or
71+
uint32(0) == 0x1900ABBA or
72+
uint32(0) == 0x24F2CEA1 or
73+
uint32(0) == 0xDA012193 or
74+
uint32(0) == 0xDA018993 or
75+
uint32(0) == 0xDA018995 or
76+
uint32(0) == 0xDD018991
77+
}
78+
79+
rule apt_Windows_InvisiMole_SFX_Dropper {
80+
81+
meta:
82+
description = "Detects trojanized InvisiMole files: patched RAR SFX droppers with added InvisiMole blobs (config encrypted XOR 2A at the end of a file)"
83+
author = "ESET Research"
84+
date = "2021-05-17"
85+
reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
86+
source = "https://github.com/eset/malware-ioc/"
87+
license = "BSD 2-Clause"
88+
version = "1"
89+
90+
strings:
91+
$encrypted_config = {5F 59 4F 58 19 18 04 4E 46 46 2A 5D 59 5A 58 43 44 5E 4C 7D 2A 0F 2A 59 2A 78 2A 4B 2A 58 2A 0E 2A 6F 2A 72 2A 4B 2A 0F 2A 4E 2A 04 2A 0F 2A 4E 2A 76 2A 0F 2A 79 2A 2A 2A 79 42 4F 46 46 6F 52 4F 49 5F 5E 4F 7D 2A 79 42 4F 46 46 19 18 04 4E 46 46 2A 7C 43 58 5E 5F 4B 46 6B 46 46 45 49 2A 66 45 4B 4E 66 43 48 58 4B 58 53 6B}
92+
93+
condition:
94+
uint16(0) == 0x5A4D and $encrypted_config
95+
}
96+
97+
rule apt_Windows_InvisiMole_CPL_Loader {
98+
meta:
99+
description = "CPL loader"
100+
author = "ESET Research"
101+
date = "2021-05-17"
102+
reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
103+
source = "https://github.com/eset/malware-ioc/"
104+
license = "BSD 2-Clause"
105+
version = "1"
106+
107+
strings:
108+
$s1 = "WScr%steObject(\"WScr%s.Run(\"::{20d04fe0-3a%s30309d}\\\\::{21EC%sDD-08002B3030%s\", 0);"
109+
$s2 = "\\Control.js" wide
110+
$s3 = "\\Control Panel.lnk" wide
111+
$s4 = "FPC 3.0.4 [2019/04/13] for x86_64 - Win64"
112+
$s5 = "FPC 3.0.4 [2019/04/13] for i386 - Win32"
113+
$s6 = "imageapplet.dat" wide
114+
$s7 = "wkssvmtx"
115+
116+
condition:
117+
uint16(0) == 0x5A4D and (3 of them)
118+
}
119+
120+
rule apt_Windows_InvisiMole_Wrapper_DLL {
121+
meta:
122+
description = "Detects InvisiMole wrapper DLL with embedded RC2CL and RC2FM backdoors, by export and resource names"
123+
author = "ESET Research"
124+
date = "2021-05-17"
125+
reference = "https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"
126+
source = "https://github.com/eset/malware-ioc/"
127+
license = "BSD 2-Clause"
128+
version = "1"
129+
130+
condition:
131+
pe.exports("GetDataLength") and
132+
for any y in (0..pe.number_of_resources - 1): (
133+
pe.resources[y].type == pe.RESOURCE_TYPE_RCDATA and pe.resources[y].name_string == "R\x00C\x002\x00C\x00L\x00"
134+
) and
135+
for any y in (0..pe.number_of_resources - 1): (
136+
pe.resources[y].type == pe.RESOURCE_TYPE_RCDATA and pe.resources[y].name_string == "R\x00C\x002\x00F\x00M\x00"
137+
)
138+
}
139+
140+
rule apt_Windows_InvisiMole_DNS_Downloader {
141+
142+
meta:
143+
description = "InvisiMole DNS downloader"
144+
author = "ESET Research"
145+
date = "2021-05-17"
146+
reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
147+
source = "https://github.com/eset/malware-ioc/"
148+
license = "BSD 2-Clause"
149+
version = "1"
150+
151+
strings:
152+
$d = "DnsQuery_A"
153+
154+
$s1 = "Wireshark-is-running-{9CA78EEA-EA4D-4490-9240-FC01FCEF464B}" xor
155+
$s2 = "AddIns\\" ascii wide xor
156+
$s3 = "pcornomeex." xor
157+
$s4 = "weriahsek.rxe" xor
158+
$s5 = "dpmupaceex." xor
159+
$s6 = "TCPViewClass" xor
160+
$s7 = "PROCMON_WINDOW_CLASS" xor
161+
$s8 = "Key%C"
162+
$s9 = "AutoEx%C" xor
163+
$s10 = "MSO~"
164+
$s11 = "MDE~"
165+
$s12 = "DNS PLUGIN, Step %d" xor
166+
$s13 = "rundll32.exe \"%s\",StartUI"
167+
168+
condition:
169+
((uint16(0) == 0x5A4D) or InvisiMole_Blob) and $d and 5 of ($s*)
170+
}
171+
172+
rule apt_Windows_InvisiMole_RC2CL_Backdoor {
173+
174+
meta:
175+
description = "InvisiMole RC2CL backdoor"
176+
author = "ESET Research"
177+
date = "2021-05-17"
178+
reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
179+
source = "https://github.com/eset/malware-ioc/"
180+
license = "BSD 2-Clause"
181+
version = "1"
182+
183+
strings:
184+
$s1 = "RC2CL" wide
185+
186+
$s2 = "hp12KsNh92Dwd" wide
187+
$s3 = "ZLib package %s: files: %d, total size: %d" wide
188+
$s4 = "\\Un4seen" wide
189+
$s5 = {9E 01 3A AD} // encryption key
190+
191+
$s6 = "~mrc_" wide
192+
$s7 = "~src_" wide
193+
$s8 = "~wbc_" wide
194+
$s9 = "zdf_" wide
195+
$s10 = "~S0PM" wide
196+
$s11 = "~A0FM" wide
197+
$s12 = "~70Z63\\" wide
198+
$s13 = "~E070C" wide
199+
$s14 = "~N031E" wide
200+
201+
$s15 = "%szdf_%s.data" wide
202+
$s16 = "%spicture.crd" wide
203+
$s17 = "%s70zf_%s.cab" wide
204+
$s18 = "%spreview.crd" wide
205+
206+
$s19 = "Value_Bck" wide
207+
$s20 = "Value_WSFX_ZC" wide
208+
$s21 = "MachineAccessStateData" wide
209+
$s22 = "SettingsSR2" wide
210+
211+
condition:
212+
((uint16(0) == 0x5A4D) or InvisiMole_Blob) and 5 of ($s*)
213+
}
214+
215+
rule apt_Windows_InvisiMole {
216+
217+
meta:
218+
description = "InvisiMole magic values, keys and strings"
219+
author = "ESET Research"
220+
date = "2021-05-17"
221+
reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
222+
source = "https://github.com/eset/malware-ioc/"
223+
license = "BSD 2-Clause"
224+
version = "1"
225+
226+
strings:
227+
$s1 = "CryptProtectData"
228+
$s2 = "CryptUnprotectData"
229+
$s3 = {9E 01 3A AD}
230+
$s4 = "GET /getversion2a/%d%.2X%.2X/U%sN HTTP/1.1"
231+
$s5 = "PULSAR_LOADER.dll"
232+
233+
/*
234+
cmp reg, 0DED0FFF9h
235+
*/
236+
$check_magic_old_32 = {3? F9 FF D0 DE}
237+
238+
/*
239+
cmp reg, 0DED0FF64h
240+
*/
241+
$check_magic_old_64 = {3? 64 FF D0 DE}
242+
243+
/*
244+
cmp dword ptr [reg], 0CE11DA86h
245+
*/
246+
$check_magic_new_32 = {81 3? 86 DA 11 CE}
247+
248+
/*
249+
cmp dword ptr [reg], 0CE11DA64h
250+
*/
251+
$check_magic_new_64 = {81 3? 64 DA 11 CE}
252+
253+
condition:
254+
((uint16(0) == 0x5A4D) or InvisiMole_Blob) and (any of ($check_magic*)) and (2 of ($s*))
255+
}
256+
257+
rule apt_Windows_InvisiMole_C2 {
258+
259+
meta:
260+
description = "InvisiMole C&C servers"
261+
author = "ESET Research"
262+
date = "2021-05-17"
263+
reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
264+
source = "https://github.com/eset/malware-ioc/"
265+
license = "BSD 2-Clause"
266+
version = "1"
267+
268+
strings:
269+
$s1 = "46.165.220.228" ascii wide
270+
$s2 = "80.255.3.66" ascii wide
271+
$s3 = "85.17.26.174" ascii wide
272+
$s4 = "185.193.38.55" ascii wide
273+
$s5 = "194.187.249.157" ascii wide
274+
$s6 = "195.154.255.211" ascii wide
275+
$s7 = "153.re" ascii wide fullword
276+
$s8 = "adstat.red" ascii wide
277+
$s9 = "adtrax.net" ascii wide
278+
$s10 = "akamai.sytes.net" ascii wide
279+
$s11 = "amz-eu401.com" ascii wide
280+
$s12 = "blabla234342.sytes.net" ascii wide
281+
$s13 = "mx1.be" ascii wide fullword
282+
$s14 = "statad.de" ascii wide
283+
$s15 = "time.servehttp.com" ascii wide
284+
$s16 = "upd.re" ascii wide fullword
285+
$s17 = "update.xn--6frz82g" ascii wide
286+
$s18 = "updatecloud.sytes.net" ascii wide
287+
$s19 = "updchecking.sytes.net" ascii wide
288+
$s20 = "wlsts.net" ascii wide
289+
$s21 = "ro2.host" ascii wide fullword
290+
$s22 = "2ld.xyz" ascii wide fullword
291+
$s23 = "the-haba.com" ascii wide
292+
$s24 = "82.202.172.134" ascii wide
293+
$s25 = "update.xn--6frz82g" ascii wide
294+
295+
condition:
296+
((uint16(0) == 0x5A4D) or InvisiMole_Blob) and $s21 and any of them
297+
}

‎invisimole/sigma/win_apt_invisimole_cpl_chain.yml

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
action: global
2+
title: InvisiMole Control Panel Misuse Chain
3+
id: d57fd9ea-0ed5-4435-bff0-c998f0feeacf
4+
status: experimental
5+
description: Detects artefacts associated with InvisiMole Control Panel persistence chain, as reported in June 2020
6+
references:
7+
- https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/
8+
author: ESET Research
9+
date: 2021/05/17
10+
tags:
11+
- attack.defense_evasion
12+
- attack.execution
13+
- attack.persistence
14+
- attack.t1218.002
15+
- attack.t1059.007
16+
- attack.t1547.001
17+
- attack.t1547.009
18+
falsepositives:
19+
- Unknown
20+
level: high
21+
---
22+
logsource:
23+
category: registry_event
24+
product: windows
25+
definition: 'Note that you have to configure logging events associated with this registry key'
26+
detection:
27+
selection:
28+
TargetObject: 'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Control Panel\CPLs\infocard'
29+
Details|endswith: '\Microsoft\AddIns\infocardadd.cpl'
30+
condition: selection
31+
---
32+
logsource:
33+
category: file_event
34+
product: windows
35+
detection:
36+
selection:
37+
TargetFilename|endswith:
38+
- '\Startup\Control Panel.lnk'
39+
- '\AppData\Roaming\Control\Control.js'
40+
- '\Microsoft\AddIns\infocardadd.cpl'
41+
- '\Microsoft\AddIns\imageapplet.dat'
42+
condition: selection
43+
---
44+
logsource:
45+
category: image_load
46+
product: windows
47+
definition: 'Note that you have to configure logging for loading CPL files'
48+
detection:
49+
filename:
50+
ImageLoaded|endswith: '\Microsoft\AddIns\infocardadd.cpl'
51+
hash:
52+
sha1:
53+
- '9f64fec50d4447175459aab33bc9126f9a3370d8'
54+
- 'a3aff8ce55907daa1f3360ded01bcf3f6f9d0cf2'
55+
condition: 1 of them

‎invisimole/sigma/win_apt_invisimole_eternalblue.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
action: global
2+
title: InvisiMole Artefacts
3+
id: 67c9bdff-2de7-4214-9734-6d48e1bf1381
4+
status: experimental
5+
description: Detects artefacts associated with lateral movement technique used by InvisiMole Group, as reported in June 2020
6+
references:
7+
- https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/
8+
author: ESET Research
9+
date: 2021/05/17
10+
falsepositives:
11+
- Unknown
12+
level: high
13+
---
14+
logsource:
15+
category: image_load
16+
product: windows
17+
detection:
18+
selection:
19+
ImageLoaded|endswith:
20+
- '\stg0D0CE03.dll'
21+
- '\stg0D33E0A.dll'
22+
condition: selection

0 commit comments

Comments
 (0)