Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
119 lines (98 sloc) 3.97 KB
rule malware_sakula_xorloop {
meta:
description = "XOR loops from Sakula malware"
author = "David Cannings"
md5 = "fc6497fe708dbda9355139721b6181e7"
strings:
$mz = "MZ"
// XOR decode loop (non-null, non-key byte only)
$opcodes_decode_loop01 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }
// XOR decode
$opcodes_decode_loop02 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }
condition:
$mz at 0 and any of ($opcodes*)
}
rule malware_sakula_memory {
meta:
description = "Sakula malware - strings after unpacking (memory rule)"
author = "David Cannings"
md5 = "b3852b9e7f2b8954be447121bb6b65c3"
strings:
$str01 = "cmd.exe /c ping 127.0.0.1 & del \"%s\""
$str02 = "cmd.exe /c rundll32 \"%s\" Play \"%s\""
$str03 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+SV1)"
$str04 = "cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c \"%s\""
$str05 = "Self Process Id:%d"
$str06 = "%d_%d_%d_%s"
$str07 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
$str08 = "cmd.exe /c rundll32 \"%s\" ActiveQvaw \"%s\""
// Encode loop, operations: rol 1; xor ??;
$opcodes01 = { 83 F9 00 74 0E 31 C0 8A 03 D0 C0 34 ?? 88 03 49 43 EB ED }
// Encode loop, single byte XOR
$opcodes02 = { 31 C0 8A 04 13 32 01 83 F8 00 75 0E 83 FA 00 74 04 49 4A }
condition:
4 of them
}
rule malware_sakula_shellcode {
meta:
description = "Sakula shellcode - taken from decoded setup.msi but may not be unique enough to identify Sakula"
author = "David Cannings"
strings:
/*
55 push ebp
89 E5 mov ebp, esp
E8 00 00 00 00 call $+5
58 pop eax
83 C0 06 add eax, 6
C9 leave
C3 retn
*/
// Get EIP technique (may not be unique enough to identify Sakula)
// Note this only appears in memory or decoded files
$opcodes01 = { 55 89 E5 E8 00 00 00 00 58 83 C0 06 C9 C3 }
/*
8B 5E 3C mov ebx, [esi+3Ch] ; Offset to PE header
8B 5C 1E 78 mov ebx, [esi+ebx+78h] ; Length of headers
8B 4C 1E 20 mov ecx, [esi+ebx+20h] ; Number of data directories
53 push ebx
8B 5C 1E 24 mov ebx, [esi+ebx+24h] ; Export table
01 F3 add ebx, esi
*/
// Export parser
$opcodes02 = { 8B 5E 3C 8B 5C 1E 78 8B 4C 1E 20 53 8B 5C 1E 24 01 F3 }
condition:
any of them
}
rule malware_sakula_loader {
meta:
description = "A small DLL loader (~6KiB) for Sakula malware"
author = "David Cannings"
md5 = "58d56d6e2cafca33e5a9303a36228ef6"
strings:
/*
59 pop ecx
5B pop ebx
6A 69 push 'i'
68 70 2E 6D 73 push 'sm.p'
68 73 65 74 75 push 'utes'
54 push esp ; Source
FF 35 04 20 00 10 push ds:lpFileName ; Dest
E8 29 1F 00 00 call strcat
*/
// String stacking for 'setup.msi'
$opcodes_string_stack01 = { 6A 69 68 70 2E 6D 73 68 73 65 74 75 }
/*
48 dec eax
83 F8 00 cmp eax, 0
0F 84 B2 00 00 00 jz loc_10001171
8A 18 mov bl, [eax]
80 F3 5C xor bl, 5Ch
80 FB 00 cmp bl, 0
*/
$opcodes_decode_loop = { 48 83 F8 00 0F ?? ?? ?? ?? ?? 8A 18 80 F3 ?? 80 FB 00 }
// Generic toolmarks from the compiler
$str01 = "Win32 Program!"
$str02 = "GoLink, GoAsm www.GoDevTool.com"
condition:
1 of ($opcodes*) and 1 of ($str*)
}