2019-11-01-possible-spynet-loader-vk-yara.yar

import "pe"

rule crime_win32_spynet_1 {
   meta:
      author = "@VK_Intel"
      description = "Detects possible SpyNet malware Oct 31"
      reference = "https://twitter.com/VK_Intel/status/1190317493224689667"
      date = "2019-11-01"
      hash1 = "f61870ea2b807f6a3314ff303942961b6f4009464da09d98ea202d3450534ad3"
   strings:
      $str0 = "GET /tor/rendezvous2/%s HTTP/1.1" fullword ascii
      $str1 = "http://jpb3hvq7v7bsyemq.onion/get_data.php" fullword ascii
      $str2 = "Host: 127.0.0.1" fullword ascii
      $str3 = "http://45.114.8.161/exit.node" fullword ascii
      $str4 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" fullword ascii
      $str5 = "http://127.0.0.1:%hu" fullword ascii
      $str6 = "Proxy-Connection: Keep-Alive%s" fullword ascii
      $str7 = "%s%s%sConnection: close" fullword ascii
      $str8 = "200 Connection Established" fullword ascii

      $time_tick_func1 ={ 74 ?? 33 c0 b9 58 f4 b7 00 87 ?? 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? b9 5c f4 b7 00 87 ?? b8 4c f4 b7 00 87 ?? 8b ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? b0 01 eb ?? a1 ?? ?? ?? ?? 85 c0 74 ?? 50 56 ff ?? ?? ?? ?? ??}
   condition:
      ( uint16(0) == 0x5a4d and
         filesize < 400KB and
         pe.imphash() == "976d7526635154758685732dca42bdba" and
         ( ( 6 of ($str*) and $time_tick_func1 ) or ( $str0 and $str1 ) )
      ) or ( all of them )
}