/
rat_dibik.py
38 lines (31 loc) · 1.09 KB
/
rat_dibik.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
# Copyright (C) 2010-2015 Cuckoo Foundation.
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# This signature was contributed by RedSocks - http://redsocks.nl
# See the file 'docs/LICENSE' for copying permission.
from lib.cuckoo.common.abstracts import Signature
class Dibik(Signature):
name = "rat_dibik"
description = "Creates known Dibik/Shark Backdoor files, registry keys and/or mutexes"
severity = 3
categories = ["rat"]
families = ["dibik"]
authors = ["RedSocks"]
minimum = "2.0"
mutexes_re = [
".*\\$OK",
".*\\$AZ",
".*\\$ZR",
]
files_re = [
"C:\\\\Windows\\\\(system32|syswow64)\\\\eeS.EXE",
]
def on_complete(self):
for indicator in self.mutexes_re:
match = self.check_mutex(pattern=indicator, regex=True)
if match:
self.mark_ioc("mutex", match)
for indicator in self.files_re:
match = self.check_file(pattern=indicator, regex=True)
if match:
self.mark_ioc("file", match)
return self.has_marks()