2019-10-31-strongpity-apt-malware-yara

import "pe"
rule apt_win32_strongpity {
   meta:
      author = "@vk_Intel"
      reference = "Detects possible StrongPity Sample Oct 2019"
      date = "2019-10-31"
      sha256 = "b75fbe3b21d83e2000928349d1610f292e1a4c072fd0454309fe1c6c7d85ff46"
   strings:
      $str0 = "cmd.exe /C ping 6.6.3.3 -n 5 " fullword wide
      $str1 = "spoolsrv32.exe" fullword wide
      $xor = { 66 ?? ?? ?? ?? ?? ?? ?? ?? 40 3b c1 72 ??}
      $str2 = "-w 3220 & rmdir /Q /S \"" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and
         filesize < 300KB and
         pe.imphash() == "7783f5400d697e1c14ca6539a9e978bc" and
         ( (2 of ($str*) and $xor) or all of them )
      ) or ( all of them )
}