The Lazarus Constellation - A study on North-Korean malware
Contents
White Paper
The
Lazarus
Constellation
A study on North Korean malware
19/02/2020
TABLE OF CONTENTS
I.
Rise of Lazarus......................................................................................................................................... 5
Introducing the Lazarus APT group ..........................................5
Attribution: Links with North Korea ........................................5
Targets & Capabilities .................................................................6
Clarifying links with other attacker groups ............................7
Main Operations (2007 - 2015) ..................................................8
II.
Lazarus’ New Motives (2016 - 2019)................................................................................... 9
Fighting sanctions in cyber space ............................................9
Banks & ATM ................................................................................10
Targeting cryptocurrency business .........................................11
New toolset ..................................................................................11
III. Technical analysis of key Lazarus attacks.................................................................. 13
Lazarus TTP ..................................................................................13
MITRE ATT&CK Matrix .................................................................19
IV. Incident Response: how to uncover an ongoing Lazarus attack......... 21
Context .........................................................................................21
First assessment .........................................................................21
Attributing the attack .................................................................22
Uncovering attackers’ activities ...............................................23
Payload analysis ..........................................................................25
V.
Classifying North Korean malware and interpreting links....................... 29
Dataset .........................................................................................29
Methodology ...............................................................................30
Visualization ................................................................................32
Reviewing results ........................................................................32
Working hours and days of the Lazarus developers ..............38
Conclusion ....................................................................................39
VI. Detection & Mitigation ................................................................................................................... 41
Vulnerability used ......................................................................41
Detecting Lazarus activities ......................................................42
Recommendations ......................................................................44
VII. Appendices..................................................................................................................................................... 45
Appendix A: Abbreviations ........................................................45
Appendix B: List of studied samples .........................................45
Appendix C: SMB Bruteforce password list .............................49
References................................................................................................................................................................. 51
Contact ........................................................................................................................................................................ 53
White Paper
04
The Lazarus Constellation
I. RISE OF
LAZARUS
INTRODUCING THE …
The
Lazarus
Constellation
A study on North Korean malware
19/02/2020
TABLE OF CONTENTS
I.
Rise of Lazarus......................................................................................................................................... 5
Introducing the Lazarus APT group ..........................................5
Attribution: Links with North Korea ........................................5
Targets & Capabilities .................................................................6
Clarifying links with other attacker groups ............................7
Main Operations (2007 - 2015) ..................................................8
II.
Lazarus’ New Motives (2016 - 2019)................................................................................... 9
Fighting sanctions in cyber space ............................................9
Banks & ATM ................................................................................10
Targeting cryptocurrency business .........................................11
New toolset ..................................................................................11
III. Technical analysis of key Lazarus attacks.................................................................. 13
Lazarus TTP ..................................................................................13
MITRE ATT&CK Matrix .................................................................19
IV. Incident Response: how to uncover an ongoing Lazarus attack......... 21
Context .........................................................................................21
First assessment .........................................................................21
Attributing the attack .................................................................22
Uncovering attackers’ activities ...............................................23
Payload analysis ..........................................................................25
V.
Classifying North Korean malware and interpreting links....................... 29
Dataset .........................................................................................29
Methodology ...............................................................................30
Visualization ................................................................................32
Reviewing results ........................................................................32
Working hours and days of the Lazarus developers ..............38
Conclusion ....................................................................................39
VI. Detection & Mitigation ................................................................................................................... 41
Vulnerability used ......................................................................41
Detecting Lazarus activities ......................................................42
Recommendations ......................................................................44
VII. Appendices..................................................................................................................................................... 45
Appendix A: Abbreviations ........................................................45
Appendix B: List of studied samples .........................................45
Appendix C: SMB Bruteforce password list .............................49
References................................................................................................................................................................. 51
Contact ........................................................................................................................................................................ 53
White Paper
04
The Lazarus Constellation
I. RISE OF
LAZARUS
INTRODUCING THE …
IoC
0237b186086fa4d13e8c854dcf2d0f8a19fcbe62a58a415e9a5a933f1154e7d8
032ccd6ae0a6e49ac93b7bd10c7d249f853fff3f5771a1fe3797f733f09db5a0
059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0
05a567fe3f7c22a0ef78cc39dcf2d9ff283580c82bdbe880af9549e7014becfc
05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461
0608e411348905145a267a9beaf5cd3527f11f95c4afde4c45998f066f418571
0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5
077d9e0e12357d27f7f0c336239e961a7049971446f7a3f10268d9439ef67885
07D2B057D2385A4CDF413E8D342305DF
07d2b057d2385a4cdf413e8d342305df
084b21bc32ee19af98f85aee8204a148032ce7eabef668481b919195dd62b319
0852f2c5741997d8899a34bb95c349d7a9fb7277cd0910656c3ce37a6f11cb88
0A8032CD6B4A710B1771A080FA09FB87
0a812976b9412ed28aee3ac3de57873fafe1ddfa0e6b9026078017b810d1b24e
0af925cd9d9a417f47882391555fa207398bfb87c3c6edc65f2ea42843cbdc3d
0b269bdd4c2d11ce0cd050bddf8f6ff618126c2b531e8ad3ab36ecc1a88d8162
0b6056e7ce278fb31bf644ef41e9532009e5dfbc33849b29f59c77ec993a8f46
0c06e129902925c7ebd70e93d4d09707add781d8bd89cd557cda023045f3853e
0ca12b78644f7e4141083dbb850acbacbebfd3cfa17a4849db844e3f7ef1bee5
0d99b59ee6427f62596dbd7d016cc9ad5b365da152806703dbc5a5225164bbd5
0efd49bfbdc8655e5db47d45b6ce4c2c64d6152665f45ef7ac57f04459369487
111ab6aa14ef1f8359c59b43778b76c7be5ca72dc1372a3603cd5814bfb2850d
11a38a9d23193d9582d02ab0eae767c3933066ec
163571bd56001963c4dcb0650bb17fa23ba23a5237c21f2401f4e894dfe4f50d
16c3a7f143e831dd0481d2d57aae885090e22ec55cc8282009f641755d423fcd
16db0063e4aa666d94752414549fa09fb33142481d894b01a0fae45b339a09fb
16fe4de2235850a7d947e4517a667a9bfcca3aee17b5022b02c68cc584aa6548
175.45.178.222
180.235.132.206
1a01b8a4c505db70f9e199337ce7f497b3dd42f25ad06487e29385580bca3676
1a8655886ea6be9ae0a71e845b5a334b476494b3aad7bfe6510218059eba5788
1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42
1b8d3e69fc214cb7a08bef3c00124717f4b4d7fd6be65f2829e9fd337fc7c03c
1be0b96d502c268cb40da97a16952d89674a9329cb60bac81a96e01cf7356830
1d0999ba3217cbdb0cc85403ef75587f747556a97dee7c2616e28866db932a0d
1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46
1e4d34fe08da837f16d1c04c313c3b2e46a09bf55376d4573ae1ebff1fae53f4
1ec2e4d02a89277afc0ee35d2d72009a5dbe96f88e1bc70bbfb3a9224478b7d5
1fbecec5da37b9a6e6dd63add4988fe7e2c4249aada883f58bcb794020455b77
1fe1fa6b01166c373de68c029d8cdda60cb1599053f935e580f3f40aaf106345
2011b9aa61d280ca9397398434af94ec26ddb6ab51f5db269f1799b46cf65a76
201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9
210.52.109.22
2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525
216d262e614e0bacff4e23077492ab9711b68b7ba2fbc17609ee1052093f59fc
2223a93521b261715767f00f0d1ae4e692bd593202be40f3508cb4fd5e21712b
2230edace3f42a5750f738f28814759b670922f16aa778e97d039d10fe9bab02
239ed753232d3cc0e75323d16d359150937934d30da022628e575997c8dd60a2
24bce152c7f884a923b29a4130931c63cd3f9c0ab08a28a79c7995356a146131
2573d0ad00f4ba8ee86d7fce7454d963
25ea7f67638e7e7b8706566788aa25a7d91843232ece85592b6bfe1eb4cd317a
26a2fa7b45a455c311fd57875d8231c853ea4399be7b9344f2136030b2edc4aa
276af9add9b6d8d96a950525b647d1eed247b3f63101bd942bd9816d0f8f9a6b
28006dc505920fc3589933fda216052abc09d4a007bc76ba2542f7876ebd299b
283d1d2efa36d31fc00425cc88dab82e426c1c51d1b4da7925c91aef56d817a3
29431dc086499c7ee64236a365615be5e5c861452f047ffac5656120ece59266
2981e1a1b3c395cee6e4b9e6c46d062cf6130546b04401d724750e4c8382c863
2a791769aa73ac757f210f8546125b57
2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850
2cab9946741fc4cddefcec2104d4fe6d76390868f60f3207e9cb0e210bbe8db0
2db6f93e99e55ef46c5b3ca52a52e34f088b7c1cd3835938557842b71b24ef56
2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10
2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4
2e373e199d2b6dea0241c672bbcbccedac86cba2ed2fdefc84a5d8187acb896f
2e7c052fbc08473f60d5365157b1a0952e2dddee630fe4abe827382dade23a76
2e835c7496fb4fc1c53665ef89fffdcbcc8dc49bea0baecc5b8496006ea601bb
2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e
302e75fe7e40e1637512e1c439d6fb3913945007428ed5d1a9bd198f08f38292
315c06bd8c75f99722fd014b4fb4bd8934049cde09afead9b46bddf4cdd63171
32e98f39bcde86885c527ddcf68fad67d0a7e6c23877672ebfd4c2a6a3f545e5
32ec329301aa4547b4ef4800159940feb950785f1ab68d85a14d363e0ff2bc11
32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf
34E56056E5741F33D823859E77235ED9
34ad7b845707674e5f4f52e7bc60148a0971ec2f375d80ec3dc48387848973ba
357b5b8ba2dd4fb3196ba5ad45b7162d8115186bac3eb33b87f2942491656f8b
36f43755e5e5988d112f28fbc1dcd9bdee4a31fb7004b52db26dacdbfe7cb72f
373938e958030f1764b4db71df953df5c460a30e895583b7901da5c6954b0739
37b04dcdcfdcaa885df0f392524db7ae7b73806ad8a8e76fbc6a2df4db064e71
37f652e2060066a1c2c317195573a334416f5a9b9933cfb1ece55bea8048d80f
38fc56965dccd18f39f8a945f6ebc439
39cbad3b2aac6298537a85f0463453d54ab2660c913f4f35ba98fffeb0b15655
3EDCE4D49A2F31B8BA9BAD0B8EF54963
3a0c617d17e7f819775e48f7edefe9af84a1446b
3c0d740347b0362331c882c2dee96dbf
3c1e4c334629b20e21b8ab08b8aa19db738f2ed761290ffdd26665cd61cb7807
3cc9d9a12f3b884582e5c4daf7d83c4a510172a836de90b87439388e3cde3682
3e6de9e2baacf930949647c399818e7a2caea2626df6a468407854aaa515eed9
422c767682bee719d85298554af5c59cf7e48cf57daaf1c5bdd87c5d1aab40cc
44884565800eebf41185861133710b4a42a99d80b6a74436bf788c0e210b9f50
45bfa1327c2c0118c152c7192ada429c6d4ae03b8164ebe36ab5ba9a84f5d7aa
45e68dce0f75353c448865b9abafbef5d4ed6492cd7058f65bf6aac182a9176a
4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a
480b0eb4636d6a78b62e7b52b773ec0a4e92fe4a748f9f9e8bd463a3b8dd0d83
48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205
496841be8fb9d0042180a2bccf205e1e0bd0b41c537798265da7ad8f85cc35a2
49757cf85657757704656c079785c072bbc233cab942418d99d1f63d43f28359
49a63ae5e65bf75777d49d37eb1d23fd3f2f584ae57758e3016a312d9716fa9f
4a740227eeb82c20286d9c112ef95f0c1380d0e90ffb39fc75c8456db4f60756
4a84452752cf8e493ae820871096044edd9f6453366842927148e7d8e218dc87
4b3416fb6d1ed1f762772b4dd4f4f652e63ba41f7809b25c5fa0ee9010f7dae7
4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c
4cf164497c275ae0f86c28d7847b10f5bd302ba12b995646c32cb53d03b7e6b5
4d37f80da97845129debf3244e1f731d2c93a02519f9fdaa059f5f124cf7c26f
4d4b17ddbcf4ce397f76cf0a2e230c9d513b23065f746a5ee2de74f447be39b9
4e1c5141652acf8ea66b7d6dbb3fcdd96353e7d27c9e5698792c199aaf3f05c4
4e8c10a7fa51a3ab089b284e86a7daaca779ed82ba1750607fc3bfa91681f9b1
4f06eaed3dd67ce31e7c8258741cf727964bd271c3590ded828ad7ba8d04ee57
4f58e6a7a04be2b2ecbcdcbae6f281778fdbd9f9
50E03200C3A0BECBF33B3788DAC8CD46
510f83af3c41f9892040a8a80b4f3a4736eebee2ec4a7d4bfee63dbe44d7ecff
53e9bca505652ef23477e105e6985102a45d9a14e5316d140752df6f3ef43d2d
5FCD6E1DACE6B0599429D913850F0364
5b7c970fee7ebe08d50665f278d47d0e34c04acc19a91838de6a3fc63a8e5630
5c0c1b4c3b1cfd455ac05ace994aed4b
5cbc07895d099ce39a3142025c557b7fac41d79914535ab7ffc2094809f12a4b
5d25465ec4d51c6b61947990fb148d0b1ee8a344069d5ac956ef4ea6a61af879
6323816c6476cb3d9c28461c5c45c858087f1eefed96e3f83843f5bcc299219e
636844ce36f41641d854a1b239df91da3103873d3dfec0c25087582eec064e4d
63d49254ee2d07ce08bd981743c17f3d5a3242478cea883332e0cc1ae43c0fe6
6a9c46d96f001a1a3cc47d166d6c0aabc26a5cf25610cef51d2b834526c6b596
6b90e2a3f0ad8819b5afe67bf13451c9782af26a9f2bdac3a0e042569054e5fd
6c627a4be54b6377af9f73ab0923aeebcccbb57ec94e995a2171deb69d61af9d
6cec00f9d3b7a34c899b1b0cdb69eb5356fa33b80144a10499b7ec905b12e903
6dae368eecbcc10266bba32776c40d9ffa5b50d7f6199a9b6c31d40dfe7877d1
6f37b758a7a015c2abdab7941b416deb508f2ab9143a64f9a8188ed0d0db3d14
6f474f2af52961e9d7bbd467d98fb7886579932e2fe9567c28c8be3ab845dc5d
6f76a8e16908ba2d576cf0e8cdb70114dcb70e0f7223be10aab3a728dc65c41c
70034b33f59c6698403293cdc28676c7daa8c49031089efa6eefce41e22dccb3
707e37e085014d2a8e6b0596322ac8f13664666c0d44f7963d2174dc4dc37ef6
70b494b0a8fdf054926829dcb3235fc7bd0346b6a19faf2a57891c71043b3b38
7334209ace81d67babbbb37f5a0d2af24160f637a8559483e14685927df6b7fa
73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33
7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd
7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be
766d7d591b9ec1204518723a1e5940fd6ac777f606ed64e731fd91b0b4c3d9fc
7a57d3b9da733bf66894341e70ba5a0059f1046576d9f8ae07b7a48945bdda66
7aa99ebc49a130f07304ed25655862a04cc20cb59d129e1416a7dfa04f7d3e51
7af070db3f5a3a08eeb5439039c1eee30f10c637b1c0d88e723104d422048863
7c73619ff8d5e4ed3b29b7ae71a69602df4071fd8c1029f9674e9978cdc03de9
7cf5d86cc75cd8f0e22e35213a9c051b740bd4667d9879a446f06277782bffd1
7f000893320d77e012686e20e1212e297408d5684335f7f24e40889401e24dff
7f4e7618af45a61003c74b373095b206a885b26079830f7ee0dada28f8429623
80b5cc9feb10fac41ee2958ab0f751bf807126e34dcb5435d2869ef1cf7abc41
820ca1903a30516263d630c7c08f2b95f7b65dffceb21129c51c9e21cf9551c6
82645e88736e11321774db7a7b28bd62d4ab133f859ecd35a4b2fa1d471412b7
838286ef99986dbb65cf0b939e6c70a7fb7a47f79198b75c3c45a54a3c8666b6
84edc9b828de54d4bd00959fabf583a1392cb4c3eab3498c52818c96dc554b90
851032eb03bc8ee05c381f7614a0cbf13b9a13293dfe5e4d4b7cd230970105e3
8FBC1F3048263AA0D4F56D119198ED04
8a1d57ee05d29a730864299376b830a7e127f089e500e148d96d0868b7c5b520
8a81a1d0fae933862b51f63064069aa5af3854763f5edc29c997964de5e284e5
8dcca8c720fdb9833455427cd9b2146e2e9581e3bc595e8d97e562854133542b
8fcd303e22b84d7d61768d4efa5308577a09cc45697f7f54be4e528bbb39435b
9097b372f7f844c430aa8c1b217a50754b28434172d5af5d992bfcbce9dfeb4f
90abfe3e4f21b5a16cd1ff3c485f079f73f5e7bbaca816917204858bb08007fc
90eba6416f5e1b35c9bf41b4a25ac880c491dd2f10d993d8a65091f1adf68ee8
9263E40D9823AECF9388B64DE34EAE54
929dc09a8bd8491b77f050a2736d39c30597ec7090d8f081eeb6179b6f8ab033
94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579
95c2186be69601ae37f8269cb487f8f19d495b9f811908f90ec97bae9333db20
95c8ffe03547bcb0afd4d025fb14908f5230c6dc6fdd16686609681c7f40aca2
9661f70ead79a1ff35282bf2d061acb2733900eea87e2233ac7b8f8d3a80ad75
98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a
99017270f0af0e499cfeb19409020bfa0c2de741e5b32b9f6a01c34fe13fda7d
9a50be3def3681242f35d3c0911e2e70
9a776b895e93926e2a758c09e341accb9333edc1243d216a5e53f47c6043c852
9b383ebc1c592d5556fec9d513223d4f99a5061591671db560faf742dd68493f
9b86a50b36aea5cc4cb60573a3660cf799a9ec1f69a3d4572d3dc277361a0ad2
9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641
9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8
9f177a6fb4ea5af876ef8a0bf954e37544917d9aaba04680a29303f24ca5c72c
DB4BBDC36A78A8807AD9B15A562515C4
E4F66C3CD27B97649976F6F0DAAD9032
F0E045210E3258DAD91D7B6B4D64E7F3
F315BE41D9765D69AD60F0B4D29E4300
a1260fd3e9221d1bc5b9ece6e7a5a98669c79e124453f2ac58625085759ed3bb
a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717
a29b07a6fe5d7ce3147dd7ef1d7d18df16e347f37282c43139d53cce25ae7037
a4a2e47161bbf5f6c1d5b1b3fba26a19dbfcdcf4eb575b56bde05c674089ae95
a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6
a917c1cc198cf36c0f2f6c24652e5c2e94e28d963b128d54f00144d216b2d118
a9bc09a17d55fc790568ac864e3885434a43c33834551e027adb1896a463aafc
adafcdf7196a73a24b1e6e523b0a3dd4c62886702b45a9b29021bc961f0d5ea4
ae086350239380f56470c19d6a200f7d251c7422c7bc5ce74730ee8bab8e6283
ae1b32aac4d8a35e2c62e334b794373c7457ebfaaab5e5e8e46f3928af07cde4
ae65288f5c96b4656402853b14acd1d060b2a6303d833df5b1f10cc7a34b0025
ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85
aff73144a359020abbb4bde3f80858d822b840dd7171ba7946b77ba9b3487831
b05aae59b3c1d024b19c88448811debef1eada2f51761a5c41e70da3db7615a9
b3de3f9309b2f320738772353eb724a0782a1fc2c912483c036c303389307e2e
b5838ecaad041a033ad16ddd6644d502546bc4916cbd10636c27b3eed3214578
b66624ab8591c2b10730b7138cbf44703abec62bfc7774d626191468869bf21c
b783a2a69591cc1509acd0d3b33bdf69c87908669741f03a06f7d152cbe2923e
b9a26a569257fbe02c10d3735587f10ee58e4281dba43474dbdef4ace8ea7101
bd6efb16527b025a5fd256bb357a91b4ff92aff599105252e50b87f1335db9e1
bf21667e4b48b8857020ba455531c9c4f2560740
bf2534b2f059547967bb453d67909921a41c10cdd19c1ec346a193060b094e2e
bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364
c0e22e80ea020ca8f71f58a8b53855293abdf8d4e0b34a69068004abaac60f42
c4a07bfc37a44dc85df2c63f369abb530dc2193ab1be506fc5dd45d56a44ca76
c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82
c66ef8652e15b579b409170658c95d35cfd6231c7ce030b172692f911e7dcff8
c6930e298bba86c01d0fe2c8262c46b4fce97c6c5037a193904cfc634246fbec
c6a78c2c4d5078a1a769bdfb071311eb3bb01750e8bf1010261028a1db68671b
c6c332ae1ccb580ac621d3cf667ce9c017be41f8ad04a94c0c0ea37c4789dd14
c9209951f7866849c9b1e5375bfb511b368394e52f6a276e86fdd542a79c2cd5
ca70aa2f89bee0c22ebc18bd5569e542f09d3c4a060b094ec6abeeeb4768a143
ccafbcff1596e3dfd28dcb97a5ba85e6845e69464742edfe136fe09bbec86ba1
cf065e50a5bef24099599af6a60a78c1607a04b21d3573a25ab26bf044a119d6
[email protected]
d060123c21869b765b22b712a8ca47266a33464095411e2b7bdf7e327d23ed07
d1515a888defff96f724d49fe05bace85066f6eeafd81cd0d9c4c27fdebc9cbb
d246669cf1e25860f8601e456edd7156aa7304026ff4eadac18a2a82a18fabbf
d2da675a8adfef9d0c146154084fff62
d4616f9706403a0d5a2f9a8726230a4693e4c95c58df5c753ccc684f1d3542e2
d62bf83fb5a7b148f326908051b149b77663149d47426ce749e944f7abf5d304
d7a71f83d576fdf75e7978539bac04ad8b6605207b29379b89c24c0d0f31da61
d8a9879a99ac7b12e63e6bcae7f965fbf1b63d892a8649ab1d6b08ce711f7127
d8af45210bf931bc5b03215ed30fb731e067e91f25eda02a404bd55169e3e3c3
d9757441e40d05a863d8dcfedab684d6644061231341c4106a3721436bc034ea
db350bb43179f2a43a1330d82f3afeb900db5ff5094c2364d0767a3e6b97c854
dbae68e4cab678f2678da7c48d579868e35100f3596bf3fa792ee000c952c0ed
dc827f7a1e5ee4600697d7d3efdeb8401b7a9af3d704d0462e7d3e0804a9069d
dcccd8859e532cc54f66f54e88fbe6eb52b3d5175233da65233bfddf49c165b4
de4ff8901766e8fc89e8443f8732394618bf925ce29b6a8aafe1d60f496e7f0e
dee482e5f461a8e531a6a7ea4728535aafdc4941a8939bc3c55f6cb28c46ad3d
deefab8ee3d082119cc69c5dbdaf5faddeae36fbbd2345b1dc0463d07b65f13b
dfa984f8d6bfc4ae3920954ec8b768e3d5a9cc4349966a9d16f8bef658f83fcd
e0257d187be69b9bee0a731437bf050d56d213b50a6fd29dd6664e7969f286ef
e08fc761cc22953de7fcc1684b7424755fa52f361dd5c6605b1469a80cb858bb
e0b1ed0f1fb8648ccdbb8a844fef5cf9b3b9eb46902289122c508bbf7d2e8d6e
e0cd4eb8108dab716f3c2e94e6c0079051bfe9c7c2ed4fcbfdd16b4dd1c18d4d
e23900b00ffd67cd8dfa3283d9ced691566df6d63d1d46c95b22569b49011f09
e40a46e95ef792cf20d5c14a9ad0b3a95c6252f96654f392b4bc6180565b7b11
e68f43ecb03330ff0420047b61933583b4144585
e69d6c2d3e9c4beebee7f3a4a3892e5fdc601beda7c3ec735f0dfba2b29418a7
e79bbb45421320be05211a94ed507430cc9f6cf80d607d61a317af255733fcf2
e7a542312ec718300ed9f229aaa60e5e2ec11aaa99387b76ed2e377bfad8b86e
e7b9c37be0ffca97002294f5813405855731b37b3b4ad2f4d73d1da9b7c535e5
e9f3f6e286f5d06addb82a2fc4b3bcdf1142570183c5cac8e8156b2f1c26b74f
ebba2aa065059f1f841a86100905310d11e1b8d7a0f8e89bc1227b19ab69e9af
ec254c40abff00b104a949f07b7b64235fc395ecb9311eb4020c1c4da0e6b5c4
ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9
eceb01a902c2b7ccd580dd639ae5a1dc366e73cc8a27230557bb2237bd20e452
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
ee7a9a7589cbbcac8b6bf1a3d9c5d1c1ada98e68ac2f43ff93f768661b7e4a85
eebc86e67a4a88f8cd5022adaa15b33a21ee609947dfcff75345f63d577bcd98
ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2
efd470cfa90b918e5d558e5c8c3821343af06eedfd484dfeb20c4605f9bdc30e
eff3e37d0406c818e3430068d90e7ed2f594faa6bb146ab0a1c00a2f4a4809a5
f12db45c32bda3108adb8ae7363c342fdd5f10342945b115d830701f95c54fa9
f31bee70fd10f6846890f42947de40061bacb24fb51f43ef6c75325ec9b95de8
f3ca8f15ca582dd486bd78fd57c2f4d7b958163542561606bebd250c827022de
f4e0f145830ec7a9dace5a4b7d5af5f1e93662edcad40c08d57dc825d316174d
f51336e862b891f78f2682505c3d38ea7de5b0673d6ef7a3b0907c0996887c22
f895757608b7725674628d731ec9fe90fd310eb65e7041bc6617ba0b831649b4
f8967b814c814c36559987a5baec67ebc44e9e1031600e1cf4e0c2bdaf8c6497
f8f7720785f7e75bd6407ac2acd63f90ab6c2907d3619162dc41a8ffa40a5d03
f9686467a99cdb3928ccf40042d3e18451a9db97ef60f098656725a9fc3d9025
fa405cd8cd8565301d138e3826bd121cc8691731b889a7503132bda6c57f4691
fb94a5e30de7afd1d9072ccedd90a249374f687f16170e1986d6fd43c143fb3a
fd5a7e54cfdd3b3f32b44d8fdd845e62d6b86c0ddb550c544d659588d06ceaee
fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5
fe51590db6f835a3a210eba178d78d5eeafe8a47bf4ca44b3a6b3dfb599f1702
fe696f8fb3f927bfbc9dbdcb067f87f3ada1afa8a76385f16e5b3dd70adf5ca2
fee0081df5ca6a21953f3a633f2f64b7c0701977623d3a4ec36fff282ffe73b9
ff2eb800ff16745fc13c216ff6d5cc2de99466244393f67ab6ea6f8189ae01dd
ffa97eb4875129646376bc88e9ff99ffeff2c6bba3a06f6727d5f343fc7f6b51
rule lazarus_capture
{ strings:
$s2 = “[ENTER]” wide fullword
$s3 = “SpliceImages: CreateCompatibleBitmap failed”
fullword condition:
(2 of ($s*))
}
rule lazarus_forward_libcurl { strings:
$s1 = “7.49.1” fullword
$s2 = “x86_64-pc-win32” fullword
$s3 = “libcurl/7.49.1” fullword condition:
(3 of ($s*))
}
rule lazarus_forward_tcp
{ strings:
$s1 = {b0 00 b0 00 b0 00 b0 00 b0 00 b0 00 e9 00}
condition:
(1 of ($s*))
}
rule lazarus_injector
{ strings:
$s1 = “finding target project”
$s2 = “delete
ddd” condition:
(2 of ($s*))
}
rule lazarus_rc4
{ strings:
$s1 = {4E 38 1F A7 7F 08 CC AA 0D 56 ED EF F9 ED 08 EF}
$s2 = {11 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
$s3 = {53 87 F2 11 30 3D B5 52 AD C8 28 09 E0 52 60 D0 6C C5 68 E2 70 77 3C 8F 12 C0 7B
13 D7 B3 9F
7C}
}
$s4 = {85 C0 7C 17 8B 4D F4 8B 76 20 33 C0 3B C8 77 0B}
condition:
(1 of ($s*))
rule lazarus_svcbat
{ strings:
$s1 = “sc create sqcsvc”
$s2 = “sc start
sqcsvc” condition:
(1 of ($s*))
}
rule lazarus_sqcsvc
{ strings:
$s1 = “7.49.1” fullword
$s2 = “x86_64-pc-win32” fullword
$s3 = “libcurl/7.49.1” fullword
$s4 = “sock_64.dll” fullword condition:
(4 of ($s*))
}
rule themida_virtualizer
{ strings:
$s1 = “v-lizer” fullword condition:
(uint16(0) == 0x5a4d and filesize < 5MB and 1 of ($s*))
}
rule yara_apt38_rc4 { strings:
$s1 = { 8A 90 01 01 00 00 // mov dl, byte [eax + 0x101]
8A 88 00 01 00 00 // mov cl, byte [eax + 0x100] 8A 14 02 // mov dl, byte [edx + eax]
8A 1C 01
// mov bl, byte [ecx + eax]
02 D3
// add dl, bl
8A 1C 2E
// mov bl, byte [esi + ebp]
81 E2 FF 00 00 00 // and edx, 0xff
8A 0C 02
// mov cl, byte [edx + eax]
32 CB }
// xor cl, bl
condition:
uint16(0) == 0x5a4d and any of ($s*)
}
032ccd6ae0a6e49ac93b7bd10c7d249f853fff3f5771a1fe3797f733f09db5a0
059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0
05a567fe3f7c22a0ef78cc39dcf2d9ff283580c82bdbe880af9549e7014becfc
05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461
0608e411348905145a267a9beaf5cd3527f11f95c4afde4c45998f066f418571
0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5
077d9e0e12357d27f7f0c336239e961a7049971446f7a3f10268d9439ef67885
07D2B057D2385A4CDF413E8D342305DF
07d2b057d2385a4cdf413e8d342305df
084b21bc32ee19af98f85aee8204a148032ce7eabef668481b919195dd62b319
0852f2c5741997d8899a34bb95c349d7a9fb7277cd0910656c3ce37a6f11cb88
0A8032CD6B4A710B1771A080FA09FB87
0a812976b9412ed28aee3ac3de57873fafe1ddfa0e6b9026078017b810d1b24e
0af925cd9d9a417f47882391555fa207398bfb87c3c6edc65f2ea42843cbdc3d
0b269bdd4c2d11ce0cd050bddf8f6ff618126c2b531e8ad3ab36ecc1a88d8162
0b6056e7ce278fb31bf644ef41e9532009e5dfbc33849b29f59c77ec993a8f46
0c06e129902925c7ebd70e93d4d09707add781d8bd89cd557cda023045f3853e
0ca12b78644f7e4141083dbb850acbacbebfd3cfa17a4849db844e3f7ef1bee5
0d99b59ee6427f62596dbd7d016cc9ad5b365da152806703dbc5a5225164bbd5
0efd49bfbdc8655e5db47d45b6ce4c2c64d6152665f45ef7ac57f04459369487
111ab6aa14ef1f8359c59b43778b76c7be5ca72dc1372a3603cd5814bfb2850d
11a38a9d23193d9582d02ab0eae767c3933066ec
163571bd56001963c4dcb0650bb17fa23ba23a5237c21f2401f4e894dfe4f50d
16c3a7f143e831dd0481d2d57aae885090e22ec55cc8282009f641755d423fcd
16db0063e4aa666d94752414549fa09fb33142481d894b01a0fae45b339a09fb
16fe4de2235850a7d947e4517a667a9bfcca3aee17b5022b02c68cc584aa6548
175.45.178.222
180.235.132.206
1a01b8a4c505db70f9e199337ce7f497b3dd42f25ad06487e29385580bca3676
1a8655886ea6be9ae0a71e845b5a334b476494b3aad7bfe6510218059eba5788
1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42
1b8d3e69fc214cb7a08bef3c00124717f4b4d7fd6be65f2829e9fd337fc7c03c
1be0b96d502c268cb40da97a16952d89674a9329cb60bac81a96e01cf7356830
1d0999ba3217cbdb0cc85403ef75587f747556a97dee7c2616e28866db932a0d
1d24d8268c2f8e82b65d58429c166367eee9683c38a1408910536d8084f4ad46
1e4d34fe08da837f16d1c04c313c3b2e46a09bf55376d4573ae1ebff1fae53f4
1ec2e4d02a89277afc0ee35d2d72009a5dbe96f88e1bc70bbfb3a9224478b7d5
1fbecec5da37b9a6e6dd63add4988fe7e2c4249aada883f58bcb794020455b77
1fe1fa6b01166c373de68c029d8cdda60cb1599053f935e580f3f40aaf106345
2011b9aa61d280ca9397398434af94ec26ddb6ab51f5db269f1799b46cf65a76
201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9
210.52.109.22
2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525
216d262e614e0bacff4e23077492ab9711b68b7ba2fbc17609ee1052093f59fc
2223a93521b261715767f00f0d1ae4e692bd593202be40f3508cb4fd5e21712b
2230edace3f42a5750f738f28814759b670922f16aa778e97d039d10fe9bab02
239ed753232d3cc0e75323d16d359150937934d30da022628e575997c8dd60a2
24bce152c7f884a923b29a4130931c63cd3f9c0ab08a28a79c7995356a146131
2573d0ad00f4ba8ee86d7fce7454d963
25ea7f67638e7e7b8706566788aa25a7d91843232ece85592b6bfe1eb4cd317a
26a2fa7b45a455c311fd57875d8231c853ea4399be7b9344f2136030b2edc4aa
276af9add9b6d8d96a950525b647d1eed247b3f63101bd942bd9816d0f8f9a6b
28006dc505920fc3589933fda216052abc09d4a007bc76ba2542f7876ebd299b
283d1d2efa36d31fc00425cc88dab82e426c1c51d1b4da7925c91aef56d817a3
29431dc086499c7ee64236a365615be5e5c861452f047ffac5656120ece59266
2981e1a1b3c395cee6e4b9e6c46d062cf6130546b04401d724750e4c8382c863
2a791769aa73ac757f210f8546125b57
2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850
2cab9946741fc4cddefcec2104d4fe6d76390868f60f3207e9cb0e210bbe8db0
2db6f93e99e55ef46c5b3ca52a52e34f088b7c1cd3835938557842b71b24ef56
2db8a9c401911c7317e8a89c35d979d0e8e9ba718ae13a0a0cfedd957654ec10
2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4
2e373e199d2b6dea0241c672bbcbccedac86cba2ed2fdefc84a5d8187acb896f
2e7c052fbc08473f60d5365157b1a0952e2dddee630fe4abe827382dade23a76
2e835c7496fb4fc1c53665ef89fffdcbcc8dc49bea0baecc5b8496006ea601bb
2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e
302e75fe7e40e1637512e1c439d6fb3913945007428ed5d1a9bd198f08f38292
315c06bd8c75f99722fd014b4fb4bd8934049cde09afead9b46bddf4cdd63171
32e98f39bcde86885c527ddcf68fad67d0a7e6c23877672ebfd4c2a6a3f545e5
32ec329301aa4547b4ef4800159940feb950785f1ab68d85a14d363e0ff2bc11
32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf
34E56056E5741F33D823859E77235ED9
34ad7b845707674e5f4f52e7bc60148a0971ec2f375d80ec3dc48387848973ba
357b5b8ba2dd4fb3196ba5ad45b7162d8115186bac3eb33b87f2942491656f8b
36f43755e5e5988d112f28fbc1dcd9bdee4a31fb7004b52db26dacdbfe7cb72f
373938e958030f1764b4db71df953df5c460a30e895583b7901da5c6954b0739
37b04dcdcfdcaa885df0f392524db7ae7b73806ad8a8e76fbc6a2df4db064e71
37f652e2060066a1c2c317195573a334416f5a9b9933cfb1ece55bea8048d80f
38fc56965dccd18f39f8a945f6ebc439
39cbad3b2aac6298537a85f0463453d54ab2660c913f4f35ba98fffeb0b15655
3EDCE4D49A2F31B8BA9BAD0B8EF54963
3a0c617d17e7f819775e48f7edefe9af84a1446b
3c0d740347b0362331c882c2dee96dbf
3c1e4c334629b20e21b8ab08b8aa19db738f2ed761290ffdd26665cd61cb7807
3cc9d9a12f3b884582e5c4daf7d83c4a510172a836de90b87439388e3cde3682
3e6de9e2baacf930949647c399818e7a2caea2626df6a468407854aaa515eed9
422c767682bee719d85298554af5c59cf7e48cf57daaf1c5bdd87c5d1aab40cc
44884565800eebf41185861133710b4a42a99d80b6a74436bf788c0e210b9f50
45bfa1327c2c0118c152c7192ada429c6d4ae03b8164ebe36ab5ba9a84f5d7aa
45e68dce0f75353c448865b9abafbef5d4ed6492cd7058f65bf6aac182a9176a
4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a
480b0eb4636d6a78b62e7b52b773ec0a4e92fe4a748f9f9e8bd463a3b8dd0d83
48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205
496841be8fb9d0042180a2bccf205e1e0bd0b41c537798265da7ad8f85cc35a2
49757cf85657757704656c079785c072bbc233cab942418d99d1f63d43f28359
49a63ae5e65bf75777d49d37eb1d23fd3f2f584ae57758e3016a312d9716fa9f
4a740227eeb82c20286d9c112ef95f0c1380d0e90ffb39fc75c8456db4f60756
4a84452752cf8e493ae820871096044edd9f6453366842927148e7d8e218dc87
4b3416fb6d1ed1f762772b4dd4f4f652e63ba41f7809b25c5fa0ee9010f7dae7
4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c
4cf164497c275ae0f86c28d7847b10f5bd302ba12b995646c32cb53d03b7e6b5
4d37f80da97845129debf3244e1f731d2c93a02519f9fdaa059f5f124cf7c26f
4d4b17ddbcf4ce397f76cf0a2e230c9d513b23065f746a5ee2de74f447be39b9
4e1c5141652acf8ea66b7d6dbb3fcdd96353e7d27c9e5698792c199aaf3f05c4
4e8c10a7fa51a3ab089b284e86a7daaca779ed82ba1750607fc3bfa91681f9b1
4f06eaed3dd67ce31e7c8258741cf727964bd271c3590ded828ad7ba8d04ee57
4f58e6a7a04be2b2ecbcdcbae6f281778fdbd9f9
50E03200C3A0BECBF33B3788DAC8CD46
510f83af3c41f9892040a8a80b4f3a4736eebee2ec4a7d4bfee63dbe44d7ecff
53e9bca505652ef23477e105e6985102a45d9a14e5316d140752df6f3ef43d2d
5FCD6E1DACE6B0599429D913850F0364
5b7c970fee7ebe08d50665f278d47d0e34c04acc19a91838de6a3fc63a8e5630
5c0c1b4c3b1cfd455ac05ace994aed4b
5cbc07895d099ce39a3142025c557b7fac41d79914535ab7ffc2094809f12a4b
5d25465ec4d51c6b61947990fb148d0b1ee8a344069d5ac956ef4ea6a61af879
6323816c6476cb3d9c28461c5c45c858087f1eefed96e3f83843f5bcc299219e
636844ce36f41641d854a1b239df91da3103873d3dfec0c25087582eec064e4d
63d49254ee2d07ce08bd981743c17f3d5a3242478cea883332e0cc1ae43c0fe6
6a9c46d96f001a1a3cc47d166d6c0aabc26a5cf25610cef51d2b834526c6b596
6b90e2a3f0ad8819b5afe67bf13451c9782af26a9f2bdac3a0e042569054e5fd
6c627a4be54b6377af9f73ab0923aeebcccbb57ec94e995a2171deb69d61af9d
6cec00f9d3b7a34c899b1b0cdb69eb5356fa33b80144a10499b7ec905b12e903
6dae368eecbcc10266bba32776c40d9ffa5b50d7f6199a9b6c31d40dfe7877d1
6f37b758a7a015c2abdab7941b416deb508f2ab9143a64f9a8188ed0d0db3d14
6f474f2af52961e9d7bbd467d98fb7886579932e2fe9567c28c8be3ab845dc5d
6f76a8e16908ba2d576cf0e8cdb70114dcb70e0f7223be10aab3a728dc65c41c
70034b33f59c6698403293cdc28676c7daa8c49031089efa6eefce41e22dccb3
707e37e085014d2a8e6b0596322ac8f13664666c0d44f7963d2174dc4dc37ef6
70b494b0a8fdf054926829dcb3235fc7bd0346b6a19faf2a57891c71043b3b38
7334209ace81d67babbbb37f5a0d2af24160f637a8559483e14685927df6b7fa
73dcb7639c1f81d3f7c4931d32787bdf07bd98550888c4b29b1058b2d5a7ca33
7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd
7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be
766d7d591b9ec1204518723a1e5940fd6ac777f606ed64e731fd91b0b4c3d9fc
7a57d3b9da733bf66894341e70ba5a0059f1046576d9f8ae07b7a48945bdda66
7aa99ebc49a130f07304ed25655862a04cc20cb59d129e1416a7dfa04f7d3e51
7af070db3f5a3a08eeb5439039c1eee30f10c637b1c0d88e723104d422048863
7c73619ff8d5e4ed3b29b7ae71a69602df4071fd8c1029f9674e9978cdc03de9
7cf5d86cc75cd8f0e22e35213a9c051b740bd4667d9879a446f06277782bffd1
7f000893320d77e012686e20e1212e297408d5684335f7f24e40889401e24dff
7f4e7618af45a61003c74b373095b206a885b26079830f7ee0dada28f8429623
80b5cc9feb10fac41ee2958ab0f751bf807126e34dcb5435d2869ef1cf7abc41
820ca1903a30516263d630c7c08f2b95f7b65dffceb21129c51c9e21cf9551c6
82645e88736e11321774db7a7b28bd62d4ab133f859ecd35a4b2fa1d471412b7
838286ef99986dbb65cf0b939e6c70a7fb7a47f79198b75c3c45a54a3c8666b6
84edc9b828de54d4bd00959fabf583a1392cb4c3eab3498c52818c96dc554b90
851032eb03bc8ee05c381f7614a0cbf13b9a13293dfe5e4d4b7cd230970105e3
8FBC1F3048263AA0D4F56D119198ED04
8a1d57ee05d29a730864299376b830a7e127f089e500e148d96d0868b7c5b520
8a81a1d0fae933862b51f63064069aa5af3854763f5edc29c997964de5e284e5
8dcca8c720fdb9833455427cd9b2146e2e9581e3bc595e8d97e562854133542b
8fcd303e22b84d7d61768d4efa5308577a09cc45697f7f54be4e528bbb39435b
9097b372f7f844c430aa8c1b217a50754b28434172d5af5d992bfcbce9dfeb4f
90abfe3e4f21b5a16cd1ff3c485f079f73f5e7bbaca816917204858bb08007fc
90eba6416f5e1b35c9bf41b4a25ac880c491dd2f10d993d8a65091f1adf68ee8
9263E40D9823AECF9388B64DE34EAE54
929dc09a8bd8491b77f050a2736d39c30597ec7090d8f081eeb6179b6f8ab033
94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579
95c2186be69601ae37f8269cb487f8f19d495b9f811908f90ec97bae9333db20
95c8ffe03547bcb0afd4d025fb14908f5230c6dc6fdd16686609681c7f40aca2
9661f70ead79a1ff35282bf2d061acb2733900eea87e2233ac7b8f8d3a80ad75
98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a
99017270f0af0e499cfeb19409020bfa0c2de741e5b32b9f6a01c34fe13fda7d
9a50be3def3681242f35d3c0911e2e70
9a776b895e93926e2a758c09e341accb9333edc1243d216a5e53f47c6043c852
9b383ebc1c592d5556fec9d513223d4f99a5061591671db560faf742dd68493f
9b86a50b36aea5cc4cb60573a3660cf799a9ec1f69a3d4572d3dc277361a0ad2
9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641
9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8
9f177a6fb4ea5af876ef8a0bf954e37544917d9aaba04680a29303f24ca5c72c
DB4BBDC36A78A8807AD9B15A562515C4
E4F66C3CD27B97649976F6F0DAAD9032
F0E045210E3258DAD91D7B6B4D64E7F3
F315BE41D9765D69AD60F0B4D29E4300
a1260fd3e9221d1bc5b9ece6e7a5a98669c79e124453f2ac58625085759ed3bb
a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717
a29b07a6fe5d7ce3147dd7ef1d7d18df16e347f37282c43139d53cce25ae7037
a4a2e47161bbf5f6c1d5b1b3fba26a19dbfcdcf4eb575b56bde05c674089ae95
a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6
a917c1cc198cf36c0f2f6c24652e5c2e94e28d963b128d54f00144d216b2d118
a9bc09a17d55fc790568ac864e3885434a43c33834551e027adb1896a463aafc
adafcdf7196a73a24b1e6e523b0a3dd4c62886702b45a9b29021bc961f0d5ea4
ae086350239380f56470c19d6a200f7d251c7422c7bc5ce74730ee8bab8e6283
ae1b32aac4d8a35e2c62e334b794373c7457ebfaaab5e5e8e46f3928af07cde4
ae65288f5c96b4656402853b14acd1d060b2a6303d833df5b1f10cc7a34b0025
ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85
aff73144a359020abbb4bde3f80858d822b840dd7171ba7946b77ba9b3487831
b05aae59b3c1d024b19c88448811debef1eada2f51761a5c41e70da3db7615a9
b3de3f9309b2f320738772353eb724a0782a1fc2c912483c036c303389307e2e
b5838ecaad041a033ad16ddd6644d502546bc4916cbd10636c27b3eed3214578
b66624ab8591c2b10730b7138cbf44703abec62bfc7774d626191468869bf21c
b783a2a69591cc1509acd0d3b33bdf69c87908669741f03a06f7d152cbe2923e
b9a26a569257fbe02c10d3735587f10ee58e4281dba43474dbdef4ace8ea7101
bd6efb16527b025a5fd256bb357a91b4ff92aff599105252e50b87f1335db9e1
bf21667e4b48b8857020ba455531c9c4f2560740
bf2534b2f059547967bb453d67909921a41c10cdd19c1ec346a193060b094e2e
bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364
c0e22e80ea020ca8f71f58a8b53855293abdf8d4e0b34a69068004abaac60f42
c4a07bfc37a44dc85df2c63f369abb530dc2193ab1be506fc5dd45d56a44ca76
c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82
c66ef8652e15b579b409170658c95d35cfd6231c7ce030b172692f911e7dcff8
c6930e298bba86c01d0fe2c8262c46b4fce97c6c5037a193904cfc634246fbec
c6a78c2c4d5078a1a769bdfb071311eb3bb01750e8bf1010261028a1db68671b
c6c332ae1ccb580ac621d3cf667ce9c017be41f8ad04a94c0c0ea37c4789dd14
c9209951f7866849c9b1e5375bfb511b368394e52f6a276e86fdd542a79c2cd5
ca70aa2f89bee0c22ebc18bd5569e542f09d3c4a060b094ec6abeeeb4768a143
ccafbcff1596e3dfd28dcb97a5ba85e6845e69464742edfe136fe09bbec86ba1
cf065e50a5bef24099599af6a60a78c1607a04b21d3573a25ab26bf044a119d6
[email protected]
d060123c21869b765b22b712a8ca47266a33464095411e2b7bdf7e327d23ed07
d1515a888defff96f724d49fe05bace85066f6eeafd81cd0d9c4c27fdebc9cbb
d246669cf1e25860f8601e456edd7156aa7304026ff4eadac18a2a82a18fabbf
d2da675a8adfef9d0c146154084fff62
d4616f9706403a0d5a2f9a8726230a4693e4c95c58df5c753ccc684f1d3542e2
d62bf83fb5a7b148f326908051b149b77663149d47426ce749e944f7abf5d304
d7a71f83d576fdf75e7978539bac04ad8b6605207b29379b89c24c0d0f31da61
d8a9879a99ac7b12e63e6bcae7f965fbf1b63d892a8649ab1d6b08ce711f7127
d8af45210bf931bc5b03215ed30fb731e067e91f25eda02a404bd55169e3e3c3
d9757441e40d05a863d8dcfedab684d6644061231341c4106a3721436bc034ea
db350bb43179f2a43a1330d82f3afeb900db5ff5094c2364d0767a3e6b97c854
dbae68e4cab678f2678da7c48d579868e35100f3596bf3fa792ee000c952c0ed
dc827f7a1e5ee4600697d7d3efdeb8401b7a9af3d704d0462e7d3e0804a9069d
dcccd8859e532cc54f66f54e88fbe6eb52b3d5175233da65233bfddf49c165b4
de4ff8901766e8fc89e8443f8732394618bf925ce29b6a8aafe1d60f496e7f0e
dee482e5f461a8e531a6a7ea4728535aafdc4941a8939bc3c55f6cb28c46ad3d
deefab8ee3d082119cc69c5dbdaf5faddeae36fbbd2345b1dc0463d07b65f13b
dfa984f8d6bfc4ae3920954ec8b768e3d5a9cc4349966a9d16f8bef658f83fcd
e0257d187be69b9bee0a731437bf050d56d213b50a6fd29dd6664e7969f286ef
e08fc761cc22953de7fcc1684b7424755fa52f361dd5c6605b1469a80cb858bb
e0b1ed0f1fb8648ccdbb8a844fef5cf9b3b9eb46902289122c508bbf7d2e8d6e
e0cd4eb8108dab716f3c2e94e6c0079051bfe9c7c2ed4fcbfdd16b4dd1c18d4d
e23900b00ffd67cd8dfa3283d9ced691566df6d63d1d46c95b22569b49011f09
e40a46e95ef792cf20d5c14a9ad0b3a95c6252f96654f392b4bc6180565b7b11
e68f43ecb03330ff0420047b61933583b4144585
e69d6c2d3e9c4beebee7f3a4a3892e5fdc601beda7c3ec735f0dfba2b29418a7
e79bbb45421320be05211a94ed507430cc9f6cf80d607d61a317af255733fcf2
e7a542312ec718300ed9f229aaa60e5e2ec11aaa99387b76ed2e377bfad8b86e
e7b9c37be0ffca97002294f5813405855731b37b3b4ad2f4d73d1da9b7c535e5
e9f3f6e286f5d06addb82a2fc4b3bcdf1142570183c5cac8e8156b2f1c26b74f
ebba2aa065059f1f841a86100905310d11e1b8d7a0f8e89bc1227b19ab69e9af
ec254c40abff00b104a949f07b7b64235fc395ecb9311eb4020c1c4da0e6b5c4
ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9
eceb01a902c2b7ccd580dd639ae5a1dc366e73cc8a27230557bb2237bd20e452
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
ee7a9a7589cbbcac8b6bf1a3d9c5d1c1ada98e68ac2f43ff93f768661b7e4a85
eebc86e67a4a88f8cd5022adaa15b33a21ee609947dfcff75345f63d577bcd98
ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2
efd470cfa90b918e5d558e5c8c3821343af06eedfd484dfeb20c4605f9bdc30e
eff3e37d0406c818e3430068d90e7ed2f594faa6bb146ab0a1c00a2f4a4809a5
f12db45c32bda3108adb8ae7363c342fdd5f10342945b115d830701f95c54fa9
f31bee70fd10f6846890f42947de40061bacb24fb51f43ef6c75325ec9b95de8
f3ca8f15ca582dd486bd78fd57c2f4d7b958163542561606bebd250c827022de
f4e0f145830ec7a9dace5a4b7d5af5f1e93662edcad40c08d57dc825d316174d
f51336e862b891f78f2682505c3d38ea7de5b0673d6ef7a3b0907c0996887c22
f895757608b7725674628d731ec9fe90fd310eb65e7041bc6617ba0b831649b4
f8967b814c814c36559987a5baec67ebc44e9e1031600e1cf4e0c2bdaf8c6497
f8f7720785f7e75bd6407ac2acd63f90ab6c2907d3619162dc41a8ffa40a5d03
f9686467a99cdb3928ccf40042d3e18451a9db97ef60f098656725a9fc3d9025
fa405cd8cd8565301d138e3826bd121cc8691731b889a7503132bda6c57f4691
fb94a5e30de7afd1d9072ccedd90a249374f687f16170e1986d6fd43c143fb3a
fd5a7e54cfdd3b3f32b44d8fdd845e62d6b86c0ddb550c544d659588d06ceaee
fe43bc385b30796f5e2d94dfa720903c70e66bc91dfdcfb2f3986a1fea3fe8c5
fe51590db6f835a3a210eba178d78d5eeafe8a47bf4ca44b3a6b3dfb599f1702
fe696f8fb3f927bfbc9dbdcb067f87f3ada1afa8a76385f16e5b3dd70adf5ca2
fee0081df5ca6a21953f3a633f2f64b7c0701977623d3a4ec36fff282ffe73b9
ff2eb800ff16745fc13c216ff6d5cc2de99466244393f67ab6ea6f8189ae01dd
ffa97eb4875129646376bc88e9ff99ffeff2c6bba3a06f6727d5f343fc7f6b51
rule lazarus_capture
{ strings:
$s2 = “[ENTER]” wide fullword
$s3 = “SpliceImages: CreateCompatibleBitmap failed”
fullword condition:
(2 of ($s*))
}
rule lazarus_forward_libcurl { strings:
$s1 = “7.49.1” fullword
$s2 = “x86_64-pc-win32” fullword
$s3 = “libcurl/7.49.1” fullword condition:
(3 of ($s*))
}
rule lazarus_forward_tcp
{ strings:
$s1 = {b0 00 b0 00 b0 00 b0 00 b0 00 b0 00 e9 00}
condition:
(1 of ($s*))
}
rule lazarus_injector
{ strings:
$s1 = “finding target project”
$s2 = “delete
ddd” condition:
(2 of ($s*))
}
rule lazarus_rc4
{ strings:
$s1 = {4E 38 1F A7 7F 08 CC AA 0D 56 ED EF F9 ED 08 EF}
$s2 = {11 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
$s3 = {53 87 F2 11 30 3D B5 52 AD C8 28 09 E0 52 60 D0 6C C5 68 E2 70 77 3C 8F 12 C0 7B
13 D7 B3 9F
7C}
}
$s4 = {85 C0 7C 17 8B 4D F4 8B 76 20 33 C0 3B C8 77 0B}
condition:
(1 of ($s*))
rule lazarus_svcbat
{ strings:
$s1 = “sc create sqcsvc”
$s2 = “sc start
sqcsvc” condition:
(1 of ($s*))
}
rule lazarus_sqcsvc
{ strings:
$s1 = “7.49.1” fullword
$s2 = “x86_64-pc-win32” fullword
$s3 = “libcurl/7.49.1” fullword
$s4 = “sock_64.dll” fullword condition:
(4 of ($s*))
}
rule themida_virtualizer
{ strings:
$s1 = “v-lizer” fullword condition:
(uint16(0) == 0x5a4d and filesize < 5MB and 1 of ($s*))
}
rule yara_apt38_rc4 { strings:
$s1 = { 8A 90 01 01 00 00 // mov dl, byte [eax + 0x101]
8A 88 00 01 00 00 // mov cl, byte [eax + 0x100] 8A 14 02 // mov dl, byte [edx + eax]
8A 1C 01
// mov bl, byte [ecx + eax]
02 D3
// add dl, bl
8A 1C 2E
// mov bl, byte [esi + ebp]
81 E2 FF 00 00 00 // and edx, 0xff
8A 0C 02
// mov cl, byte [edx + eax]
32 CB }
// xor cl, bl
condition:
uint16(0) == 0x5a4d and any of ($s*)
}