Peeking at Reaper’s surveillance operations
Contents
During our day to day hunting to protect our customers, we came across two Command and Control servers (C2s) of the North Korea-nexus intrusion set Reaper (aka APT37) with open directories, allowing us to observe hosted implants as well as victim’s exfiltrated data.
Reaper is active since at least 2012, primarily conducting cyberespionage campaigns against NGOs and civil society (dissidents, journalists, DPRK defectors). Reaper’s assessed missions are surveillance and counter intelligence in support of DPRK’s strategic interests, notably the Ministry of State Security (MSS) aka. Bowibu. Reaper used infection vectors in past campaigns include watering holes exploiting 0 day vulnerabilities, and phishing emails with malicious attachment.
SEKOIA.IO analysts’ investigation led to the uncovering of several phishing webpages, a CHM infection vector, new PowerShell implants and Chinotto malware modules, a Reaper signature malware documented by Kaspersky in November 2021. We assess the recently observed activity almost certainly pertains to the surveillance of North …
Reaper is active since at least 2012, primarily conducting cyberespionage campaigns against NGOs and civil society (dissidents, journalists, DPRK defectors). Reaper’s assessed missions are surveillance and counter intelligence in support of DPRK’s strategic interests, notably the Ministry of State Security (MSS) aka. Bowibu. Reaper used infection vectors in past campaigns include watering holes exploiting 0 day vulnerabilities, and phishing emails with malicious attachment.
SEKOIA.IO analysts’ investigation led to the uncovering of several phishing webpages, a CHM infection vector, new PowerShell implants and Chinotto malware modules, a Reaper signature malware documented by Kaspersky in November 2021. We assess the recently observed activity almost certainly pertains to the surveillance of North …
IoC
001e8e66fa4afc58cab23f5ee490f3080ef985c83d3b2a4555fc9c39cfe56bd8
0082ab20f15c2bb53e75a379add7d8eb7ac59518cbd27156f2904027e7203918
00c6f19b4f42951e1dcbc935e6f1af09a048f8e5915014eb8c5352ee2babb7d8
0474bb7c100c5187c838e5cf14969fdaf04ed541e373aa3b1ad607dd2b420a1b
06d8ae2e5a6854d17ce66f915cb7bbd0fa8eb1148c2ad3622e09bebd9264f0fd
089e4dfd8b25afe596eff05baae86156a4e3243c84faa15416cff31a5120e107
0a468e474f9d7750c055e1b7277e8fcd13f034d6097edc6f6171162ec15fcfe5
0af162367ec8827c5ed0d296bc3fc8a6fe33b6df19039437e43125b8ab9dd9d3
0b6202a043f8dcf0690660c5c8f7a75f07336ca5576164295da34a569129548f
0bfcb60146b8ef0acfe54299df86a6cd68c31c3e62947e0eb7b83cbd90b71cb3
0c903896be88775a634efdd42143f7bdd16377ab577ab7ac839fc7e509b85841
0cbe696107c11fd325972c95ead964defdea935f9be3b29337c38f76056a878a
0f65721ba56ee137a6522c7fd48ff602845d6545c08e59c2c884e701c1c274bb
125be0978eaa70919fbb7533a7b7f21955de727c33f045bf486ed892cd841ec1
1304fbeca197e4e67959c0b89b619cc109e4825d0da26ac41277eb34d2a19bc6
1409c4d0bd9a22a1e5adf016fffb83bbf3bd9f72ae0773780a409b980ed97763
141.105.65.165
14b18e336d9f1a19fd5403085c9956097e883f80579a3ff0004d734826a253e1
172.93.193.158
1736203103aa95501153005d50d5b8b1b0460f29166c392ed97209d2f593984c
176db67fd9ed5eebf320449f8b653b2ad5334864e8bc46a81b6dd9ee7bef229b
17e14f0a0d5d808df5cccc5c3f0fd9a3942e7258983d6f9953a24e1b62b41a28
1830b84698851535c1029d10190e5d5518f90472102918a336222e9e9c7dba1b
196d58c29671803a9c6c4e73d270b96794991675f8edb224c278c8cf67642cbd
1a4c29c7a67eeab072b89ab0b4847fcf83336c09de7aba7eec1aac8cfdde9583
1aa0139e9e1e60887670d70d78bf6076c5c0bf49c9df2601ecd68ad2b862fb81
1b57434023e8b2b6eb85ab958c98c31bfe365ce09d6e72d09e8115e572aafee5
1b89ca9313c9ef14fcf5ade01eff751ff83dd27ffa3439d457eac90f6339c83a
1fcf8bfcd70b97c6d3c9ac93602db4ee41a5d09f0a4b92fa67b76668fb33811d
23a092e8c24e35b0c2e56472ee5db018f5ba7b5c0d7479de4ac2e4d82f789ef4
24fda087c6a8a4d0e00a1fbf92ca07263b16a08df34eaefceafd0050dd9a102c
2512ef129e9952b30447d091eae462145b37c0ceab7045a8b9e353e174c482c5
26d1f930bcd224f2c0ab89a2e33665db481d6474f102edcf02f5c90a308e3e1f
272c2d1d12e2292954d16d159c66734bedaec183c1e99a312c58f169ec8fb0c6
28cbc0b2085189dec811d7ace5e391b7abb481dabac4e006ca81b0511b9f3646
28f9e114295870dc579e05484d0235b09c08685f089ea00acf436ff6becab2fe
2a17730d4c0502641a8667438ae236695591492ad8439013375cbd1f4da58102
2a22da882f05dc159b055b01de7331e22fb6b5ce858308015a912b49487c56f0
2ab09b25fdca324b3008d76d90c5ef83757ff1b8a95ea34a9b5c5f4dfc4f6d3d
2b44ae43016b349a4a21154184edb90f533ee26ace7526cc83ee72bdbe85fbda
2b8d88c4f6f3d2cf38b2504a11d5985ed36bd74e752e2612bc187d45d7882e03
2e704a466eef2396f0b148bb0f25e3389594a9b5410e77f58d895b890a792513
2e787f310ab0c4bda52b9c2eed449400d6258ee185a86961f741a32f659793b7
2ec6af06df2ba4703c713b92b6be1d47757db14d3fb919314061bbe0a41020f1
2f5be3773e7e3a2f6806cdef154adfabc454c0e57a49e437c5889ce09b739302
2fa36a4eb676f3afb1774224bc59041944ddfa4a3417630d01659ba3f0ced834
303f1a96eff7e259b6800c01312d6e359c21a88f755ac5704fd7ea60fb4df6c7
309cb38fbcd0132552fc739dd37d32c24b91ba712bebb9886d4638bceb2d8bf3
312267a3432293b0e205758f24bdf35a7f1fe7e9882c2826f2632eb96ef48753
33f56b7bf8b72efb633b3e9fa66408746fb0d194eba2f218e9866e12e745a640
340cf043f51b1350c204a76ff592515ff65ecfabec03191286d807f80067c913
35ea90ba0d75a758abec880413c3f87d171bf34d93465fa868e6a09e5058daaf
360512254b342558d8f17305b673b75c7d7986f12aae2f602952298cacf5d238
37e096338a78cb06d6236cb5a04cf125f191871ded3c9421f08a37890a095eb8
389606b368ffc1857bda56c1a2b8208dd79f99d88122f7a487bffb391ed5deb3
38c77365c8c363f1c407304416dcf3c0943f5edf1d17bf70c3fe96afecf3979e
3aa507d86ffd9facaf9fb3c3fbc77dcfd07a481cc6f3e6b03a97c83e4e04d836
3c0b996e37dd3a2c6a457891065e09d47cd1fc25a91f2001ac8813de0a5e55f9
3d2738ff73af2bc88cb9c396b31f6991177cd869f9ca7ab44203f3721b98f8c2
3d6c99e137bf5653134049caf9010d4c6d82360bf569ecca05fe15440d7fd0b0
3e999cb0df708a46b5b7a569a7afba09ce119130f33570c7126e8f2da4f19c98
3eed452d24c7959e19afd6de5ccf883a91de5202c8cd722a18863297ad4ed8b1
3f0f0060bebd891008eaf8a647d91803107fc52294ceaab8b59b89958db4a0de
3fd6b62c05f80415a6cde676fb27cce74944d0cbe6c9fb951da41212056ef2b3
40341da349e684593bbd01b244f94c28aa024ee49c3b3ebc89960e53e40750ae
40f18cccf214923c22d9e7b15aa0567a85dea050e2d18dae283784547628c960
420b95072126ad9d8870ddea47165f28b0fd1b06770b9b1c49c6ad5b0ca6e7bc
432b526d0ad3ccaf193339662dc45cba35b93936ff08649ccd93fcb3fce194bc
44a32b053b8798841bc2f786d8c4656a95b2371a6f9d723a239f1a1ffd1c2867
44a3905e0374b92bd8aa54c35d9435ed928e1f2ce57a7f333d1a2c094488c111
45f0f3798132f94daead2f4e3194181ce432dd8758b7d217987c3527bd7c2104
468515f4517e0381745899e6cdda73e7e201a22f19e70795fc719d3f877b9571
490f03bcd7f20254c5231a9a2074b656e78863af0ddc3eea71edac0bca01fd4f
49134674c357cd2c8b7ec4b2db1a5a97bf0814a5c30efb9d1e90e9f6f98f4c63
4a023cde70fb47127c8b1b9ed57942be12a216adf354db51142679d13c7ea10b
4a1ca5a873799887b10a24822bbccec347f18e5694a6ae462275b2bdfe3ee823
4b91650adbd633d7e5e966ada2716372589511d345808f15d57125e842bec100
4c4717654b2f87d74faced201ae28af84029a635dcf389961cfa2a4836fe0036
4dc0552fe262b3ca3b8fa2d3bea81041e07d1461361f86c1e5f4662bc10c0014
4dd424f71c03a5866a299b21ceb936efe6d9090f5bdc7956026b32cad60f6e6b
5053390bde150b771f8efe344b692c6c5718ba9203a4b23f5323af1ee9060ff2
53445c36b0eacfeef3e705ca8238128d2c9bc29f79a13104c4d6446029878a32
55e09b18d5ac5900d8662e7ac58879cfd86a3dec4534c08cdd6d17ab85008646
56d70d7d4903a6f420a4cad926837f2f41d9eb7d70d9cfe201326deb68c179b3
575631e9548b0f91addf3ce68bc5b4b9e86a17c069a221815062e1aa93d2978e
57d8142c0c2c0f3eaa0e16c906564f5c9e0b3e62511c2629e831db4fd00c21c5
58cdb73495c2d6120f81f3752828f532b6a70ce7617b725e6989cf2d9cdb6aa4
5abf924d3c301db179ee4050ea727dfbeef03a97d042c72a7ad50930d0fd82e0
5bf170c95ca0e2079653d694f783b5bcd38f274ea875f67f0b60db4ac552a66c
5e67b5aed329e6545a36eff46bb6db8bdaa17841a4ec77228955d81872fed549
5ff2a0b2338643e86d2251f46302e21f33d02394f006533fa6942f40c203f379
60804ebbb655ea68b9e0bce63d5edbd03e0f75837f44539fec28dc12d44b5ba5
61ee9e33e5409cd5dff6b40c9c85294d3e95334c3e9cd2700d54de710b9381c5
63737cfc78cabd12bad6792dffbcaf54b1e326d7a72bc920c3653bfec07e15c4
644c6bb170d58c69709ddf49b6ba49b3aadd58b443ee485a03fb25f915fb6710
64fe964f342acca6d85d247c4f67503e4222a58dfc5c644dedc2006a4b356d39
65ddc56b5e10a02f2e9faeb2ebfb091364bad9c8660653d24a1bd584b16026b4
66ce691aa5d7e36ee39b35aa8707270e4d293a934ad7074f92c919247f1c419f
684d5709b03061bc2eb872c0cab80c7ce2ed5f091227917c324013c72a1008ca
68a0f1ce34b6d0e00bc39e95c1a99da13dfee5168b37450e095455aefc90aa69
6a55c5f8f0de6883705bbc0e050d9a5a34d8311e80b738e644e119e1502219a5
6b912eeda69069fb6a3fa3cfc10db029e8ebbee936cab19137cad103d9fc6abd
6c1f0deadbfe5aede933592a9692b18879232a29bfdda5a666b91475b4746612
6d2757eb9c7d8be1b2b496153434b09d514578b4a1185cdf3c0978047b26fed0
6e216b265ea391f71f2a609df995f36b9ba8b17c8859f6d8e4ce4a076d351efd
6fad04c836bc923f12ebaec8d8fb0c7091b044bf6f5c97e36d7bf46b8494f978
6ffa429872ad543e7c74dd0b1cbdbc9c9ee5bbec7ae0f387cfba13bd107ba068
70dcc03cde3dd5c5ec6a6a240190cfb51667aaba9c867e20281e8dfc43afa891
751bfe7e49cdbc48029894fca27f9d7abeaa320a77d48b6cb12bf11f356e64e3
7562ba1e1f29851edb5b16a440b931ba4dd8620b314e0aa37df8546ccfcf7023
797841fca8c7b30176a2df8ba07d2620cf0b2596bdf1776ea190c0836fb2445c
79c0c48614379371e3da809c512a945c19f48b326d2d28ea1603fb394fb18e81
7a0fd034239c02a18d30f15e4c8f6b6b0edc2c2cce6072c3d309a799ab0f46d1
7c7986ce54bd28ab5a6e106df28a6339de6e547a2a8a25205bb6749df49df1ad
7d899e2baef34c189185511eaa3cbc94429c5000c9bd37de232192832149f8a4
7d8fe44087a4baf4b7b138a45dff35454b232d7416378618d0df02eb43d097cf
8078fc582b8f5eb81ef5d8da2b11fb4ce63f52fdeb1c2ceb3ac7a01113f9f3ee
8094606aa5b179dc811f314bd9c9be06dc7ad783fbcc53c756b1e8930b810048
830ae000cadb5c34fe3015f3e63db802a6459270ffc9ab0b2fae569f96e29f7e
83339569ccfdb2464e75e96374175264a0cf44a04f6be374ab7f6ba954548d6c
855692647f5a49bb05d4232fd95952e95d2aa05443219c1ac68815e38ece95cd
85b7117fe753df26f4fc2e5739c793f4e3aacd79121d40758298ef7eb9f412d5
8ba472a4b33e5bbdd18d3be9791d4f75d4aaced3e8a7dd2c8fca61b71fdacce6
8e1de01cfc5537f9d4ceccfa3ff5d6007bb586ac2fa7be47357339e781934079
8f4751ed22619b04009c4b85ec45c8140b570835ca4c638c9e6019e7b7eb66c7
90057baa8591591b56eff9c74a3408090a67cd9b6580315d12376370ca9b0b2c
90946317edb0a2a53e0cb39153a0064882cada1497da37091cf8f6fae8c869ab
92387eedc56e285eedf8091b7af1d88c40c78033b0756324895435037ac25b4d
96956d3ce39ba84610cd6c7ef3b09f36455884d323f981cf8426a6788aaf5d5e
97d3e5542cfa57e8e89220575f089d0ac78004523eaebed967c512b31a017657
993659ea08e47329f07f6c510710965761859b2e264c36aec6836fa4d95f8944
9c30265e5b8f7b6017141815001a0678a99d05dc8302b50517c47d5f282b3c36
9f44c0654c6e6c4bf02474ebdf9fd8efd852bb0cc7d845778048a1d912de089c
9fdc4b3d6fbccc1abd8a08acd52b6380627e350faa99fcc348e5ed366c7b37af
a0d9f57ff92f8668154579ad33c561cc0631c0148087fd9c3ebb68b7b2c45493
a1be71b666587f287983fdc6239ef002befdf371065d5e465dd51cbfff089b51
a320ef003f43b28960043f95076c2066891e3a6a785476a2615a1f7b50a11c78
a3405b7bbb7a3b693888bb90b2949ecb50b803470d36e15eed41e6b4d2f8e3b0
a3ce6ebe702b7938867d6685ff23fbf9b34f534bffe2fcf54e96c9ff64979c60
a542497b909b584a9c4f367688cc43f24e54b85061c6b2dc2092cc29e4948cc9
a60a1be84f74a05aeb7fd10a1639f02f8c743a63f7c36ef054de42fda22eb0fa
a88dc9a152cc7758a1df5aa33cf7b31cdb14e593a8744f2059602a49b8b04e0f
aa1fbee11d870b4a32d7cfb79ed4ab9025ef8a71a9fc30f7538dc45d95950a69
aaa4717731cb4c3101fedf67827d5df5a3419e3cb742ddc4ee0571d9c0cb9e64
ac31880c5a10e7227064b7098a2e73e5001349123b0e9b6ac2aa8efa055d73fa
ae8cb9b2a65efb15e0aeaa9327a77a90425d86154f24305943f49eb28eac8fd5
aee439785267e66243759d675e1ca6d079f1c5d236db1711c7d18359c8788fe8
b0729b96dd478308be5562606abf20eadb0c59c0ea32315ab35a68d89aaae4d9
b152bdde179b30dfd3b01bc42d8d16ddf430b851cc480104d54d366259347b70
b28636d4eae43bb5a2e404a410655fb48c3d6d6993263dbe25d08d71540f87e9
b364bac52981edd74fbc45cca4216e66da5df9918000cc4617156ab42c914e7e
b4a8d58b5d5e49d9d65b8b9faba344923cbac87473f2a32c646e359799ed655e
b73ee977154402f8eecc5a446baf0dba456a37d1ca9348858540a8d048f3fd37
b90a2b0249407b271a5d849fe82cbf4e9a31c2c6259caf515c9be3897e327414
bdb33062bddd53043bab508e8e96b7c8353549d8eaa4b9004e7b3303e8a4e91b
be813ade90ff636f36c0712ad6d0c7b1e06d7fe0d38e0b5e224ee21a98546d79
c0a36e340cc38c9abd07029e3d621395575c9a4a64459334ef84b623d1058865
c125be691e0d7d063e31623d811c8d95a1196d524ffd0ae6a11938bf366c2aa1
c1c6ed30404d00b3d1b9c9c7f45733fd9972a492b5e534e47c8cccbcc4d3e714
c2be74900eb885d40574f30f7f9385eb19e2d76767a93b92cbe1c917ad29df89
c80fbab8c27cb9be91885a470377088d6639b95b85dfe5ae3c346e537b143a87
c96f75c3f347b385576b17257142bc37fdfde835aa2668cd35acf41957b15278
c9d2c8b6011a53e68e4a6c6e51142cef3348951d0b379e49b1a65a1891538df5
c9ea7afef5ac790297bdd0fb78c06186516957542e5da326075a0e2d230c27c1
cbace070ba83e1d6a86bc3a51e3fc7ec633f1a9ee55d283b6d1a8308f758c1d7
ccb6b0e02f7a9d7a541d0ed352706de943c178650a675eff667cb848ec0dc977
cd2028bf873293aa330eb21ab96f8e71fa91e2d212852e81f292e769c0fba2d7
cd372b72548033c351d7df63f1ff6f04fadd102fa4723801231c9927844e679f
ce83fa08a4f6e8ecf88ecbd40cce042e5ada2ebdd8627922eb998edefe356c30
d1d6eba6c0aeaf18877ee2ac91a905574fde27d0531d8cf6951f4862fd07b1a0
d38edf68e3e7e3c347383d4f43146e17ab9ff51a67c9269954edc4a83b559202
d45352bcdc17fb98965d268f2882fe8db978772bf8be5b6a24da817c783d1368
d4e43b65c6700283c58e65157346a316af470334e2dd6446f052e64d4a5a42dc
d83f0944fc2a3ba8f2eb45ace9206348fd9294cfc05ee770956a2a083a41df93
d8511450360f12c8206cd9747ecdf2eb3e27462ad269132d11528de58429ff3e
d892f170764e99dae34d7dded5da591b8e2a05791a5f85fc360ee2a524601faf
da80179429bd95820713b830a1e5e2acf9350824b1a5d24617bd801d62618979
db00c18b7226475879499581bbcd7d0a041c53cf6683ba459ff0893b978c5839
db70f269d62c43bd09580858731853a589e0f32f2d3c915b15cb9f0b4b9f12d2
dbe075d10f84322b0eba3bdee9450d7cf17cc45ec7734a803e15b47580074969
dd200000456233c623e49ad468e07eee0b6a8de6fec51c907ca4dca48bb9676d
dd67152d52a3ddb83527bf46e77a586b949545ad8c9cbdd6f88b6e60e067a9c5
e10d107c0560269b2eb38611ff9f9f01f5464cf5cebf31fb0edf296cd593bab3
e17541ea5ae08696c70fe829f4e20b5bce59145c00d2ac8c2c9254b419e7db5a
e6d9c5a401a733ceb80b004deb347092affe572eda4e1ca6aa6c77bb0c6ea7e8
e7cce1c49655ecba7c570f873b10d1ec735fedc2310179abb0163b13cbd7d625
e951ac958495b047026950ba041fa6189678a3147ea4b08dbf1804d263d963d4
e96a18b5837c7a7d83215d70ca10b84ee8c7b6e8dbd4d215586ec062d328ce86
ead97a3920ff557299bcd4ccde1770c759263b93b70414258ec9030bbd0cb750
eafa24ae237490d9160229e06765214813fe758eef3e5fd2c24b720477410528
ec176a9f7c23929750bf9485822c95e4dc8912b0e27d64c5c47b450bf000a7e5
ec24a8554d242091e461caad508075d0d549bcc1a608ed3803e0b948906cebf3
ec734dcecfab5dc78f9a44045e7afd0bdfd34921b6f64d7e8e06354e1c44abe0
eccf1afe41b4b2d7a303b43c47c925b4ff39f25b288ac5cd40b253f6d99da493
ee8d94ccb72f028e8f0c2db6a33faac4aea437b5acafb8f6e7749278ca15054a
f4ebde259d4d5036a9b864d634a1b474c10d2ee10d0b7b6fc2079836f8847ee3
f6eaa1d0517cc7937571a3dc73bda357b9e8607338e0a12ecf80185cc30762ae
f878ab1481c51d23010a19ce8123c03309977764608a24e2861cc973db1607fa
f9089cca1c398d0dd4a4dc937d79436ef56ddd57786bf9f9fc1eb86a57e3d236
fa8e90c61468b7a7f0aad8c08ac22d574c4e3f8ab6ae68ce98a5361bbad125bd
fb3bbcd36a43ff19f17aae99bc0313b4599e1a17b1800e4f02d82a0682a5ca6a
fd0e435a872feb72db7a50ad5475de9673721ec08335c8d0a32f61d3c4824bbe
fd64f19a2fd762a4b6c5aba8ec8517684733dfb975b52a679bc48411af0138f0
fd824d0a10e176c09d7f320808a08ae80676bad2247816d53b934283adccd53b
fe3d64c5cb086c9ef8c55ed1a520d1d71595e056862b6d3471a948ecff72ccd7
feab7940559392bbf38f29267509340569160e0a3b257fd86e5c65ae087ea014
ff5fc46c9598a5fbc9b54fbbd05ee0bb86549ecbba715093413326b58a1b9d2b
http://141.105.65.165/data/*
http://141.105.65.165/files/*
http://141.105.65.165/main/*
http://141.105.65.165/support/*
http://172.93.193.158/data/*
http://attiferstudio.com/install.bak/sony/*
http://hk-law.co.kr/data/file/joomla/*
http://jdwanxiang.com/win/shenti/*
http://koaagj.co.kr/files/2014/12/fix/*
http://ri-guard.com/download/temp/cn-var/*
https://clovery-shapes.000webhostapp.com/defcon/*
rule APT_Reaper_Chinotto { meta: id = "eff8fd11-dc7a-4011-b083-181d0cca8790" version = "1.0" malware = "Chinotto" intrusion_set = "Reaper" description = "Detects obfuscation or string of Chinotto" source = "SEKOIA.IO" creation_date = "2023-02-27" classification = "TLP:WHITE" strings: $chunk_1 = { C7 85 ?? ?? ?? ?? ?? ?? ?? 00 C7 85 ?? ?? ?? ?? ?? ?? ?? 00 33 C0 EB 03 8D 49 00 8B 8C 85 ?? ?? ?? ?? 3B 8C 85 ?? ?? ?? ?? } $chunk_2 = { C7 84 24 ?? ?? ?? ?? ?? ?? 0? 00 C7 84 24 ?? ?? ?? ?? ?? ?? 0? 00 33 C0 EB 0D 8D A4 24 00 00 00 00 8D 9B 00 00 00 00 8B 8C 84 ?? ?? ?? ?? 3B 8C 84 ?? ?? ?? ?? } $movs_zip_dir_start = { C7 45 ?? 5A 69 70 20 C7 45 ?? 44 69 72 20 C7 45 ?? 53 74 61 72 C7 45 ?? 74 20 2D 20 } condition: uint16be(0) == 0x4d5a and filesize < 1MB and ($chunk_1 or $chunk_2 or $movs_zip_dir_start) }
rule apt_Reaper_AblyGo_Reverse_Shell { meta: id = "77778ef6-5d24-4888-93c8-390066dbf361" version = "1.0" source = "SEKOIA.IO" intrusion_set = "Reaper" description = "Detects AblyGo reverse shell implant" creation_date = "2023-03-09" classification = "TLP:WHITE" strings: $ = "main.reverse.func1" $ = "github.com/ably/ably-go/ably.(*RealtimeChannels).Get" $ = "github.com/ably/ably-go/ably.WithKey" condition: (uint32be(0) == 0x7f454c46 or uint16be(0) == 0x4d5a) and filesize < 20MB and all of them }
rule apt_Reaper_Chinotto_PowerShell_Variant { meta: id = "fa42b225-58fe-4e00-b84b-df37491d8fdd" version = "1.0" malware = "Chinotto" intrusion_set = "Reaper" description = "Detects Reaper Chinotto Powershell Variant" source = "SEKOIA.IO" creation_date = "2023-03-06" classification = "TLP:WHITE" strings: $ = "$env:COMPUTERNAME + '-' + $env:USERNAME;" ascii wide $ = "while($true -eq $true)" ascii wide $ = "Start-Sleep -Seconds" ascii wide $ = " -ne 'null' -and $" ascii wide $ = "= 'R=' + [System.Convert]::" ascii wide $ = "[string]$([char]0x0D) + [string]$([char]0x0A);" ascii wide condition: 4 of them }
rule apt_Reaper_MFC42_Loader { meta: id = "23a3eaff-2813-48a2-91c6-c5bc1c0873ac" version = "1.0" intrusion_set = "Reaper" description = "Detects MFC42 loaders (Reaper)" source = "SEKOIA.IO" creation_date = "2023-03-09" classification = "TLP:WHITE" strings: $ = {50 68 01 00 00 00 B8 4D 3C 2B 1A FF D0} condition: uint16be(0) == 0x4d5a and filesize < 2MB and all of them }
0082ab20f15c2bb53e75a379add7d8eb7ac59518cbd27156f2904027e7203918
00c6f19b4f42951e1dcbc935e6f1af09a048f8e5915014eb8c5352ee2babb7d8
0474bb7c100c5187c838e5cf14969fdaf04ed541e373aa3b1ad607dd2b420a1b
06d8ae2e5a6854d17ce66f915cb7bbd0fa8eb1148c2ad3622e09bebd9264f0fd
089e4dfd8b25afe596eff05baae86156a4e3243c84faa15416cff31a5120e107
0a468e474f9d7750c055e1b7277e8fcd13f034d6097edc6f6171162ec15fcfe5
0af162367ec8827c5ed0d296bc3fc8a6fe33b6df19039437e43125b8ab9dd9d3
0b6202a043f8dcf0690660c5c8f7a75f07336ca5576164295da34a569129548f
0bfcb60146b8ef0acfe54299df86a6cd68c31c3e62947e0eb7b83cbd90b71cb3
0c903896be88775a634efdd42143f7bdd16377ab577ab7ac839fc7e509b85841
0cbe696107c11fd325972c95ead964defdea935f9be3b29337c38f76056a878a
0f65721ba56ee137a6522c7fd48ff602845d6545c08e59c2c884e701c1c274bb
125be0978eaa70919fbb7533a7b7f21955de727c33f045bf486ed892cd841ec1
1304fbeca197e4e67959c0b89b619cc109e4825d0da26ac41277eb34d2a19bc6
1409c4d0bd9a22a1e5adf016fffb83bbf3bd9f72ae0773780a409b980ed97763
141.105.65.165
14b18e336d9f1a19fd5403085c9956097e883f80579a3ff0004d734826a253e1
172.93.193.158
1736203103aa95501153005d50d5b8b1b0460f29166c392ed97209d2f593984c
176db67fd9ed5eebf320449f8b653b2ad5334864e8bc46a81b6dd9ee7bef229b
17e14f0a0d5d808df5cccc5c3f0fd9a3942e7258983d6f9953a24e1b62b41a28
1830b84698851535c1029d10190e5d5518f90472102918a336222e9e9c7dba1b
196d58c29671803a9c6c4e73d270b96794991675f8edb224c278c8cf67642cbd
1a4c29c7a67eeab072b89ab0b4847fcf83336c09de7aba7eec1aac8cfdde9583
1aa0139e9e1e60887670d70d78bf6076c5c0bf49c9df2601ecd68ad2b862fb81
1b57434023e8b2b6eb85ab958c98c31bfe365ce09d6e72d09e8115e572aafee5
1b89ca9313c9ef14fcf5ade01eff751ff83dd27ffa3439d457eac90f6339c83a
1fcf8bfcd70b97c6d3c9ac93602db4ee41a5d09f0a4b92fa67b76668fb33811d
23a092e8c24e35b0c2e56472ee5db018f5ba7b5c0d7479de4ac2e4d82f789ef4
24fda087c6a8a4d0e00a1fbf92ca07263b16a08df34eaefceafd0050dd9a102c
2512ef129e9952b30447d091eae462145b37c0ceab7045a8b9e353e174c482c5
26d1f930bcd224f2c0ab89a2e33665db481d6474f102edcf02f5c90a308e3e1f
272c2d1d12e2292954d16d159c66734bedaec183c1e99a312c58f169ec8fb0c6
28cbc0b2085189dec811d7ace5e391b7abb481dabac4e006ca81b0511b9f3646
28f9e114295870dc579e05484d0235b09c08685f089ea00acf436ff6becab2fe
2a17730d4c0502641a8667438ae236695591492ad8439013375cbd1f4da58102
2a22da882f05dc159b055b01de7331e22fb6b5ce858308015a912b49487c56f0
2ab09b25fdca324b3008d76d90c5ef83757ff1b8a95ea34a9b5c5f4dfc4f6d3d
2b44ae43016b349a4a21154184edb90f533ee26ace7526cc83ee72bdbe85fbda
2b8d88c4f6f3d2cf38b2504a11d5985ed36bd74e752e2612bc187d45d7882e03
2e704a466eef2396f0b148bb0f25e3389594a9b5410e77f58d895b890a792513
2e787f310ab0c4bda52b9c2eed449400d6258ee185a86961f741a32f659793b7
2ec6af06df2ba4703c713b92b6be1d47757db14d3fb919314061bbe0a41020f1
2f5be3773e7e3a2f6806cdef154adfabc454c0e57a49e437c5889ce09b739302
2fa36a4eb676f3afb1774224bc59041944ddfa4a3417630d01659ba3f0ced834
303f1a96eff7e259b6800c01312d6e359c21a88f755ac5704fd7ea60fb4df6c7
309cb38fbcd0132552fc739dd37d32c24b91ba712bebb9886d4638bceb2d8bf3
312267a3432293b0e205758f24bdf35a7f1fe7e9882c2826f2632eb96ef48753
33f56b7bf8b72efb633b3e9fa66408746fb0d194eba2f218e9866e12e745a640
340cf043f51b1350c204a76ff592515ff65ecfabec03191286d807f80067c913
35ea90ba0d75a758abec880413c3f87d171bf34d93465fa868e6a09e5058daaf
360512254b342558d8f17305b673b75c7d7986f12aae2f602952298cacf5d238
37e096338a78cb06d6236cb5a04cf125f191871ded3c9421f08a37890a095eb8
389606b368ffc1857bda56c1a2b8208dd79f99d88122f7a487bffb391ed5deb3
38c77365c8c363f1c407304416dcf3c0943f5edf1d17bf70c3fe96afecf3979e
3aa507d86ffd9facaf9fb3c3fbc77dcfd07a481cc6f3e6b03a97c83e4e04d836
3c0b996e37dd3a2c6a457891065e09d47cd1fc25a91f2001ac8813de0a5e55f9
3d2738ff73af2bc88cb9c396b31f6991177cd869f9ca7ab44203f3721b98f8c2
3d6c99e137bf5653134049caf9010d4c6d82360bf569ecca05fe15440d7fd0b0
3e999cb0df708a46b5b7a569a7afba09ce119130f33570c7126e8f2da4f19c98
3eed452d24c7959e19afd6de5ccf883a91de5202c8cd722a18863297ad4ed8b1
3f0f0060bebd891008eaf8a647d91803107fc52294ceaab8b59b89958db4a0de
3fd6b62c05f80415a6cde676fb27cce74944d0cbe6c9fb951da41212056ef2b3
40341da349e684593bbd01b244f94c28aa024ee49c3b3ebc89960e53e40750ae
40f18cccf214923c22d9e7b15aa0567a85dea050e2d18dae283784547628c960
420b95072126ad9d8870ddea47165f28b0fd1b06770b9b1c49c6ad5b0ca6e7bc
432b526d0ad3ccaf193339662dc45cba35b93936ff08649ccd93fcb3fce194bc
44a32b053b8798841bc2f786d8c4656a95b2371a6f9d723a239f1a1ffd1c2867
44a3905e0374b92bd8aa54c35d9435ed928e1f2ce57a7f333d1a2c094488c111
45f0f3798132f94daead2f4e3194181ce432dd8758b7d217987c3527bd7c2104
468515f4517e0381745899e6cdda73e7e201a22f19e70795fc719d3f877b9571
490f03bcd7f20254c5231a9a2074b656e78863af0ddc3eea71edac0bca01fd4f
49134674c357cd2c8b7ec4b2db1a5a97bf0814a5c30efb9d1e90e9f6f98f4c63
4a023cde70fb47127c8b1b9ed57942be12a216adf354db51142679d13c7ea10b
4a1ca5a873799887b10a24822bbccec347f18e5694a6ae462275b2bdfe3ee823
4b91650adbd633d7e5e966ada2716372589511d345808f15d57125e842bec100
4c4717654b2f87d74faced201ae28af84029a635dcf389961cfa2a4836fe0036
4dc0552fe262b3ca3b8fa2d3bea81041e07d1461361f86c1e5f4662bc10c0014
4dd424f71c03a5866a299b21ceb936efe6d9090f5bdc7956026b32cad60f6e6b
5053390bde150b771f8efe344b692c6c5718ba9203a4b23f5323af1ee9060ff2
53445c36b0eacfeef3e705ca8238128d2c9bc29f79a13104c4d6446029878a32
55e09b18d5ac5900d8662e7ac58879cfd86a3dec4534c08cdd6d17ab85008646
56d70d7d4903a6f420a4cad926837f2f41d9eb7d70d9cfe201326deb68c179b3
575631e9548b0f91addf3ce68bc5b4b9e86a17c069a221815062e1aa93d2978e
57d8142c0c2c0f3eaa0e16c906564f5c9e0b3e62511c2629e831db4fd00c21c5
58cdb73495c2d6120f81f3752828f532b6a70ce7617b725e6989cf2d9cdb6aa4
5abf924d3c301db179ee4050ea727dfbeef03a97d042c72a7ad50930d0fd82e0
5bf170c95ca0e2079653d694f783b5bcd38f274ea875f67f0b60db4ac552a66c
5e67b5aed329e6545a36eff46bb6db8bdaa17841a4ec77228955d81872fed549
5ff2a0b2338643e86d2251f46302e21f33d02394f006533fa6942f40c203f379
60804ebbb655ea68b9e0bce63d5edbd03e0f75837f44539fec28dc12d44b5ba5
61ee9e33e5409cd5dff6b40c9c85294d3e95334c3e9cd2700d54de710b9381c5
63737cfc78cabd12bad6792dffbcaf54b1e326d7a72bc920c3653bfec07e15c4
644c6bb170d58c69709ddf49b6ba49b3aadd58b443ee485a03fb25f915fb6710
64fe964f342acca6d85d247c4f67503e4222a58dfc5c644dedc2006a4b356d39
65ddc56b5e10a02f2e9faeb2ebfb091364bad9c8660653d24a1bd584b16026b4
66ce691aa5d7e36ee39b35aa8707270e4d293a934ad7074f92c919247f1c419f
684d5709b03061bc2eb872c0cab80c7ce2ed5f091227917c324013c72a1008ca
68a0f1ce34b6d0e00bc39e95c1a99da13dfee5168b37450e095455aefc90aa69
6a55c5f8f0de6883705bbc0e050d9a5a34d8311e80b738e644e119e1502219a5
6b912eeda69069fb6a3fa3cfc10db029e8ebbee936cab19137cad103d9fc6abd
6c1f0deadbfe5aede933592a9692b18879232a29bfdda5a666b91475b4746612
6d2757eb9c7d8be1b2b496153434b09d514578b4a1185cdf3c0978047b26fed0
6e216b265ea391f71f2a609df995f36b9ba8b17c8859f6d8e4ce4a076d351efd
6fad04c836bc923f12ebaec8d8fb0c7091b044bf6f5c97e36d7bf46b8494f978
6ffa429872ad543e7c74dd0b1cbdbc9c9ee5bbec7ae0f387cfba13bd107ba068
70dcc03cde3dd5c5ec6a6a240190cfb51667aaba9c867e20281e8dfc43afa891
751bfe7e49cdbc48029894fca27f9d7abeaa320a77d48b6cb12bf11f356e64e3
7562ba1e1f29851edb5b16a440b931ba4dd8620b314e0aa37df8546ccfcf7023
797841fca8c7b30176a2df8ba07d2620cf0b2596bdf1776ea190c0836fb2445c
79c0c48614379371e3da809c512a945c19f48b326d2d28ea1603fb394fb18e81
7a0fd034239c02a18d30f15e4c8f6b6b0edc2c2cce6072c3d309a799ab0f46d1
7c7986ce54bd28ab5a6e106df28a6339de6e547a2a8a25205bb6749df49df1ad
7d899e2baef34c189185511eaa3cbc94429c5000c9bd37de232192832149f8a4
7d8fe44087a4baf4b7b138a45dff35454b232d7416378618d0df02eb43d097cf
8078fc582b8f5eb81ef5d8da2b11fb4ce63f52fdeb1c2ceb3ac7a01113f9f3ee
8094606aa5b179dc811f314bd9c9be06dc7ad783fbcc53c756b1e8930b810048
830ae000cadb5c34fe3015f3e63db802a6459270ffc9ab0b2fae569f96e29f7e
83339569ccfdb2464e75e96374175264a0cf44a04f6be374ab7f6ba954548d6c
855692647f5a49bb05d4232fd95952e95d2aa05443219c1ac68815e38ece95cd
85b7117fe753df26f4fc2e5739c793f4e3aacd79121d40758298ef7eb9f412d5
8ba472a4b33e5bbdd18d3be9791d4f75d4aaced3e8a7dd2c8fca61b71fdacce6
8e1de01cfc5537f9d4ceccfa3ff5d6007bb586ac2fa7be47357339e781934079
8f4751ed22619b04009c4b85ec45c8140b570835ca4c638c9e6019e7b7eb66c7
90057baa8591591b56eff9c74a3408090a67cd9b6580315d12376370ca9b0b2c
90946317edb0a2a53e0cb39153a0064882cada1497da37091cf8f6fae8c869ab
92387eedc56e285eedf8091b7af1d88c40c78033b0756324895435037ac25b4d
96956d3ce39ba84610cd6c7ef3b09f36455884d323f981cf8426a6788aaf5d5e
97d3e5542cfa57e8e89220575f089d0ac78004523eaebed967c512b31a017657
993659ea08e47329f07f6c510710965761859b2e264c36aec6836fa4d95f8944
9c30265e5b8f7b6017141815001a0678a99d05dc8302b50517c47d5f282b3c36
9f44c0654c6e6c4bf02474ebdf9fd8efd852bb0cc7d845778048a1d912de089c
9fdc4b3d6fbccc1abd8a08acd52b6380627e350faa99fcc348e5ed366c7b37af
a0d9f57ff92f8668154579ad33c561cc0631c0148087fd9c3ebb68b7b2c45493
a1be71b666587f287983fdc6239ef002befdf371065d5e465dd51cbfff089b51
a320ef003f43b28960043f95076c2066891e3a6a785476a2615a1f7b50a11c78
a3405b7bbb7a3b693888bb90b2949ecb50b803470d36e15eed41e6b4d2f8e3b0
a3ce6ebe702b7938867d6685ff23fbf9b34f534bffe2fcf54e96c9ff64979c60
a542497b909b584a9c4f367688cc43f24e54b85061c6b2dc2092cc29e4948cc9
a60a1be84f74a05aeb7fd10a1639f02f8c743a63f7c36ef054de42fda22eb0fa
a88dc9a152cc7758a1df5aa33cf7b31cdb14e593a8744f2059602a49b8b04e0f
aa1fbee11d870b4a32d7cfb79ed4ab9025ef8a71a9fc30f7538dc45d95950a69
aaa4717731cb4c3101fedf67827d5df5a3419e3cb742ddc4ee0571d9c0cb9e64
ac31880c5a10e7227064b7098a2e73e5001349123b0e9b6ac2aa8efa055d73fa
ae8cb9b2a65efb15e0aeaa9327a77a90425d86154f24305943f49eb28eac8fd5
aee439785267e66243759d675e1ca6d079f1c5d236db1711c7d18359c8788fe8
b0729b96dd478308be5562606abf20eadb0c59c0ea32315ab35a68d89aaae4d9
b152bdde179b30dfd3b01bc42d8d16ddf430b851cc480104d54d366259347b70
b28636d4eae43bb5a2e404a410655fb48c3d6d6993263dbe25d08d71540f87e9
b364bac52981edd74fbc45cca4216e66da5df9918000cc4617156ab42c914e7e
b4a8d58b5d5e49d9d65b8b9faba344923cbac87473f2a32c646e359799ed655e
b73ee977154402f8eecc5a446baf0dba456a37d1ca9348858540a8d048f3fd37
b90a2b0249407b271a5d849fe82cbf4e9a31c2c6259caf515c9be3897e327414
bdb33062bddd53043bab508e8e96b7c8353549d8eaa4b9004e7b3303e8a4e91b
be813ade90ff636f36c0712ad6d0c7b1e06d7fe0d38e0b5e224ee21a98546d79
c0a36e340cc38c9abd07029e3d621395575c9a4a64459334ef84b623d1058865
c125be691e0d7d063e31623d811c8d95a1196d524ffd0ae6a11938bf366c2aa1
c1c6ed30404d00b3d1b9c9c7f45733fd9972a492b5e534e47c8cccbcc4d3e714
c2be74900eb885d40574f30f7f9385eb19e2d76767a93b92cbe1c917ad29df89
c80fbab8c27cb9be91885a470377088d6639b95b85dfe5ae3c346e537b143a87
c96f75c3f347b385576b17257142bc37fdfde835aa2668cd35acf41957b15278
c9d2c8b6011a53e68e4a6c6e51142cef3348951d0b379e49b1a65a1891538df5
c9ea7afef5ac790297bdd0fb78c06186516957542e5da326075a0e2d230c27c1
cbace070ba83e1d6a86bc3a51e3fc7ec633f1a9ee55d283b6d1a8308f758c1d7
ccb6b0e02f7a9d7a541d0ed352706de943c178650a675eff667cb848ec0dc977
cd2028bf873293aa330eb21ab96f8e71fa91e2d212852e81f292e769c0fba2d7
cd372b72548033c351d7df63f1ff6f04fadd102fa4723801231c9927844e679f
ce83fa08a4f6e8ecf88ecbd40cce042e5ada2ebdd8627922eb998edefe356c30
d1d6eba6c0aeaf18877ee2ac91a905574fde27d0531d8cf6951f4862fd07b1a0
d38edf68e3e7e3c347383d4f43146e17ab9ff51a67c9269954edc4a83b559202
d45352bcdc17fb98965d268f2882fe8db978772bf8be5b6a24da817c783d1368
d4e43b65c6700283c58e65157346a316af470334e2dd6446f052e64d4a5a42dc
d83f0944fc2a3ba8f2eb45ace9206348fd9294cfc05ee770956a2a083a41df93
d8511450360f12c8206cd9747ecdf2eb3e27462ad269132d11528de58429ff3e
d892f170764e99dae34d7dded5da591b8e2a05791a5f85fc360ee2a524601faf
da80179429bd95820713b830a1e5e2acf9350824b1a5d24617bd801d62618979
db00c18b7226475879499581bbcd7d0a041c53cf6683ba459ff0893b978c5839
db70f269d62c43bd09580858731853a589e0f32f2d3c915b15cb9f0b4b9f12d2
dbe075d10f84322b0eba3bdee9450d7cf17cc45ec7734a803e15b47580074969
dd200000456233c623e49ad468e07eee0b6a8de6fec51c907ca4dca48bb9676d
dd67152d52a3ddb83527bf46e77a586b949545ad8c9cbdd6f88b6e60e067a9c5
e10d107c0560269b2eb38611ff9f9f01f5464cf5cebf31fb0edf296cd593bab3
e17541ea5ae08696c70fe829f4e20b5bce59145c00d2ac8c2c9254b419e7db5a
e6d9c5a401a733ceb80b004deb347092affe572eda4e1ca6aa6c77bb0c6ea7e8
e7cce1c49655ecba7c570f873b10d1ec735fedc2310179abb0163b13cbd7d625
e951ac958495b047026950ba041fa6189678a3147ea4b08dbf1804d263d963d4
e96a18b5837c7a7d83215d70ca10b84ee8c7b6e8dbd4d215586ec062d328ce86
ead97a3920ff557299bcd4ccde1770c759263b93b70414258ec9030bbd0cb750
eafa24ae237490d9160229e06765214813fe758eef3e5fd2c24b720477410528
ec176a9f7c23929750bf9485822c95e4dc8912b0e27d64c5c47b450bf000a7e5
ec24a8554d242091e461caad508075d0d549bcc1a608ed3803e0b948906cebf3
ec734dcecfab5dc78f9a44045e7afd0bdfd34921b6f64d7e8e06354e1c44abe0
eccf1afe41b4b2d7a303b43c47c925b4ff39f25b288ac5cd40b253f6d99da493
ee8d94ccb72f028e8f0c2db6a33faac4aea437b5acafb8f6e7749278ca15054a
f4ebde259d4d5036a9b864d634a1b474c10d2ee10d0b7b6fc2079836f8847ee3
f6eaa1d0517cc7937571a3dc73bda357b9e8607338e0a12ecf80185cc30762ae
f878ab1481c51d23010a19ce8123c03309977764608a24e2861cc973db1607fa
f9089cca1c398d0dd4a4dc937d79436ef56ddd57786bf9f9fc1eb86a57e3d236
fa8e90c61468b7a7f0aad8c08ac22d574c4e3f8ab6ae68ce98a5361bbad125bd
fb3bbcd36a43ff19f17aae99bc0313b4599e1a17b1800e4f02d82a0682a5ca6a
fd0e435a872feb72db7a50ad5475de9673721ec08335c8d0a32f61d3c4824bbe
fd64f19a2fd762a4b6c5aba8ec8517684733dfb975b52a679bc48411af0138f0
fd824d0a10e176c09d7f320808a08ae80676bad2247816d53b934283adccd53b
fe3d64c5cb086c9ef8c55ed1a520d1d71595e056862b6d3471a948ecff72ccd7
feab7940559392bbf38f29267509340569160e0a3b257fd86e5c65ae087ea014
ff5fc46c9598a5fbc9b54fbbd05ee0bb86549ecbba715093413326b58a1b9d2b
http://141.105.65.165/data/*
http://141.105.65.165/files/*
http://141.105.65.165/main/*
http://141.105.65.165/support/*
http://172.93.193.158/data/*
http://attiferstudio.com/install.bak/sony/*
http://hk-law.co.kr/data/file/joomla/*
http://jdwanxiang.com/win/shenti/*
http://koaagj.co.kr/files/2014/12/fix/*
http://ri-guard.com/download/temp/cn-var/*
https://clovery-shapes.000webhostapp.com/defcon/*
rule APT_Reaper_Chinotto { meta: id = "eff8fd11-dc7a-4011-b083-181d0cca8790" version = "1.0" malware = "Chinotto" intrusion_set = "Reaper" description = "Detects obfuscation or string of Chinotto" source = "SEKOIA.IO" creation_date = "2023-02-27" classification = "TLP:WHITE" strings: $chunk_1 = { C7 85 ?? ?? ?? ?? ?? ?? ?? 00 C7 85 ?? ?? ?? ?? ?? ?? ?? 00 33 C0 EB 03 8D 49 00 8B 8C 85 ?? ?? ?? ?? 3B 8C 85 ?? ?? ?? ?? } $chunk_2 = { C7 84 24 ?? ?? ?? ?? ?? ?? 0? 00 C7 84 24 ?? ?? ?? ?? ?? ?? 0? 00 33 C0 EB 0D 8D A4 24 00 00 00 00 8D 9B 00 00 00 00 8B 8C 84 ?? ?? ?? ?? 3B 8C 84 ?? ?? ?? ?? } $movs_zip_dir_start = { C7 45 ?? 5A 69 70 20 C7 45 ?? 44 69 72 20 C7 45 ?? 53 74 61 72 C7 45 ?? 74 20 2D 20 } condition: uint16be(0) == 0x4d5a and filesize < 1MB and ($chunk_1 or $chunk_2 or $movs_zip_dir_start) }
rule apt_Reaper_AblyGo_Reverse_Shell { meta: id = "77778ef6-5d24-4888-93c8-390066dbf361" version = "1.0" source = "SEKOIA.IO" intrusion_set = "Reaper" description = "Detects AblyGo reverse shell implant" creation_date = "2023-03-09" classification = "TLP:WHITE" strings: $ = "main.reverse.func1" $ = "github.com/ably/ably-go/ably.(*RealtimeChannels).Get" $ = "github.com/ably/ably-go/ably.WithKey" condition: (uint32be(0) == 0x7f454c46 or uint16be(0) == 0x4d5a) and filesize < 20MB and all of them }
rule apt_Reaper_Chinotto_PowerShell_Variant { meta: id = "fa42b225-58fe-4e00-b84b-df37491d8fdd" version = "1.0" malware = "Chinotto" intrusion_set = "Reaper" description = "Detects Reaper Chinotto Powershell Variant" source = "SEKOIA.IO" creation_date = "2023-03-06" classification = "TLP:WHITE" strings: $ = "$env:COMPUTERNAME + '-' + $env:USERNAME;" ascii wide $ = "while($true -eq $true)" ascii wide $ = "Start-Sleep -Seconds" ascii wide $ = " -ne 'null' -and $" ascii wide $ = "= 'R=' + [System.Convert]::" ascii wide $ = "[string]$([char]0x0D) + [string]$([char]0x0A);" ascii wide condition: 4 of them }
rule apt_Reaper_MFC42_Loader { meta: id = "23a3eaff-2813-48a2-91c6-c5bc1c0873ac" version = "1.0" intrusion_set = "Reaper" description = "Detects MFC42 loaders (Reaper)" source = "SEKOIA.IO" creation_date = "2023-03-09" classification = "TLP:WHITE" strings: $ = {50 68 01 00 00 00 B8 4D 3C 2B 1A FF D0} condition: uint16be(0) == 0x4d5a and filesize < 2MB and all of them }