SYMBOLCOMMON_NAMEaka. SYNONYMS
win.agent_btz (Back to overview)

Agent.BTZ

aka: ComRAT, Minit, Sun rootkit

Actor(s): Turla

VTCollection    

There is no description at this point.

References
2023-05-09CISACISA
Hunting Russian Intelligence “Snake” Malware
Agent.BTZ Cobra Carbon System Uroburos
2022-05-02cocomelonccocomelonc
Malware development: persistence - part 3. COM DLL hijack. Simple C++ example
Agent.BTZ Ave Maria Konni Mosquito TurlaRPC
2021-12-01ESET ResearchAlexis Dorais-Joncas, Facundo Muñoz
Jumping the air gap: 15 years of nation‑state effort
Agent.BTZ Fanny Flame Gauss PlugX Ramsay Retro Stuxnet USBCulprit USBferry
2021-09-27Medium ryancorRyan Cornateanu
Deobfuscating PowerShell Malware Droppers
Agent.BTZ
2021-02-28PWC UKPWC UK
Cyber Threats 2020: A Year in Retrospect
elf.wellmess FlowerPower PowGoop 8.t Dropper Agent.BTZ Agent Tesla Appleseed Ave Maria Bankshot BazarBackdoor BLINDINGCAN Chinoxy Conti Cotx RAT Crimson RAT DUSTMAN Emotet FriedEx FunnyDream Hakbit Mailto Maze METALJACK Nefilim Oblique RAT Pay2Key PlugX QakBot REvil Ryuk StoneDrill StrongPity SUNBURST SUPERNOVA TrickBot TurlaRPC Turla SilentMoon WastedLocker WellMess Winnti ZeroCleare APT10 APT23 APT27 APT31 APT41 BlackTech BRONZE EDGEWOOD Inception Framework MUSTANG PANDA Red Charon Red Nue Sea Turtle Tonto Team
2021-02-19Palo Alto Networks Unit 42Dominik Reichel
IronNetInjector: Turla’s New Malware Loading Tool
Agent.BTZ IronNetInjector TurlaRPC
2021-02-16US Department of DefenseUS Department of Defense
The creation of the 2020 ComRATv4 illustration
Agent.BTZ
2020-12-21IronNetAdam Hlavek, Kimberly Ortiz
Russian cyber attack campaigns and actors
WellMail elf.wellmess Agent.BTZ BlackEnergy EternalPetya Havex RAT Industroyer Ryuk Triton WellMess
2020-10-29US-CERTUS-CERT
Malware Analysis Report (AR20-303A): PowerShell Script: ComRAT
Agent.BTZ
2020-09-01Möbius Strip Reverse EngineeringRolf Rolles
An Exhaustively-Analyzed IDB for ComRAT v4
Agent.BTZ
2020-07-29ESET Researchwelivesecurity
THREAT REPORT Q2 2020
DEFENSOR ID HiddenAd Bundlore Pirrit Agent.BTZ Cerber ClipBanker CROSSWALK Cryptowall CTB Locker DanaBot Dharma Formbook Gandcrab Grandoreiro Houdini ISFB LockBit Locky Mailto Maze Microcin Nemty NjRAT Phobos PlugX Pony REvil Socelars STOP Tinba TrickBot WannaCryptor
2020-05-26ESET ResearchMatthieu Faou
From Agent.BTZ to ComRAT v4: A ten‑year journey
Agent.BTZ
2020-05-26ESET ResearchMatthieu Faou
From Agent.BTZ to ComRAT v4: A ten‑year journey (White Paper)
Agent.BTZ
2020-02-13QianxinQi Anxin Threat Intelligence Center
APT Report 2019
Chrysaor Exodus Dacls VPNFilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy
2020-01-01SecureworksSecureWorks
IRON HUNTER
Agent.BTZ Cobra Carbon System LightNeuron Mosquito Nautilus Neuron Skipper Uroburos Turla
2018-10-04Kaspersky LabsGReAT
Shedding Skin – Turla’s Fresh Faces
KopiLuwak Agent.BTZ Cobra Carbon System Gazer Meterpreter Mosquito Skipper
2018-03-01CrySyS LabBoldizsar Bencsath
Territorial Dispute – NSA’s perspective on APT landscape
9002 RAT Agent.BTZ DuQu EYService Flame FlowerShop Stuxnet Uroburos
2017-09-13IntezerOmri Ben Bassat
New Variants of Agent.BTZ/ComRAT Found: The Threat That Hit The Pentagon In 2008 Still Evolving; Part 2/2
Agent.BTZ
2017-08-07IntezerOmri Ben Bassat
New Variants of Agent.BTZ/ComRAT Found: The Threat That Hit The Pentagon In 2008 Still Evolving; Part 1/2
Agent.BTZ
2016-01-14SymantecSecurity Response
The Waterbug attack group
Agent.BTZ Wipbot
2016-01-14SymantecSecurity Response
The Waterbug attack group
Agent.BTZ Cobra Carbon System Wipbot Turla
2015-01-15G DataG Data
Weiterentwicklung anspruchsvoller Spyware: von Agent.BTZ zu ComRAT
Agent.BTZ
2014-11-11G DataG Data
The Uroburos case: new sophisticated RAT identified
Agent.BTZ Uroburos
2014-03-17BAE SystemsBAE Systems Applied Intelligence
Snake Campaign & Espionage Toolkit
Agent.BTZ Uroburos
2014-03-12Kaspersky LabsAlexander Gostev
Agent.btz: a Source of Inspiration?
Agent.BTZ
2008-11-30ThreatExpertSergei Shevchenko
Agent.btz - A Threat That Hit Pentagon
Agent.BTZ
Yara Rules
[TLP:WHITE] win_agent_btz_auto (20230808 | Detects win.agent_btz.)
rule win_agent_btz_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.agent_btz."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_btz"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c74608ffffffff f644240801 7409 56 e8???????? 83c404 8bc6 }
            // n = 7, score = 2500
            //   c74608ffffffff       | mov                 dword ptr [esi + 8], 0xffffffff
            //   f644240801           | test                byte ptr [esp + 8], 1
            //   7409                 | je                  0xb
            //   56                   | push                esi
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   8bc6                 | mov                 eax, esi

        $sequence_1 = { ffd6 8d54240c 52 ffd7 }
            // n = 4, score = 2500
            //   ffd6                 | call                esi
            //   8d54240c             | lea                 edx, [esp + 0xc]
            //   52                   | push                edx
            //   ffd7                 | call                edi

        $sequence_2 = { ffd3 85c0 75d8 5f 5e 5b }
            // n = 6, score = 2500
            //   ffd3                 | call                ebx
            //   85c0                 | test                eax, eax
            //   75d8                 | jne                 0xffffffda
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx

        $sequence_3 = { ff15???????? b800000f00 8b4df4 64890d00000000 }
            // n = 4, score = 2400
            //   ff15????????         |                     
            //   b800000f00           | mov                 eax, 0xf0000
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   64890d00000000       | mov                 dword ptr fs:[0], ecx

        $sequence_4 = { c706???????? c7460c00000000 895e08 895e04 }
            // n = 4, score = 2400
            //   c706????????         |                     
            //   c7460c00000000       | mov                 dword ptr [esi + 0xc], 0
            //   895e08               | mov                 dword ptr [esi + 8], ebx
            //   895e04               | mov                 dword ptr [esi + 4], ebx

        $sequence_5 = { b805000f00 8b4df4 64890d00000000 5f 5e }
            // n = 5, score = 2400
            //   b805000f00           | mov                 eax, 0xf0005
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   64890d00000000       | mov                 dword ptr fs:[0], ecx
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi

        $sequence_6 = { 895e08 895e04 c7461000000000 895e14 }
            // n = 4, score = 2400
            //   895e08               | mov                 dword ptr [esi + 8], ebx
            //   895e04               | mov                 dword ptr [esi + 4], ebx
            //   c7461000000000       | mov                 dword ptr [esi + 0x10], 0
            //   895e14               | mov                 dword ptr [esi + 0x14], ebx

        $sequence_7 = { 56 6a00 68???????? 8935???????? }
            // n = 4, score = 2300
            //   56                   | push                esi
            //   6a00                 | push                0
            //   68????????           |                     
            //   8935????????         |                     

        $sequence_8 = { 8b4608 c706???????? 85c0 7413 }
            // n = 4, score = 2200
            //   8b4608               | mov                 eax, dword ptr [esi + 8]
            //   c706????????         |                     
            //   85c0                 | test                eax, eax
            //   7413                 | je                  0x15

        $sequence_9 = { 83f8ff 740e 50 ff15???????? c74608ffffffff f644240801 }
            // n = 6, score = 2200
            //   83f8ff               | cmp                 eax, -1
            //   740e                 | je                  0x10
            //   50                   | push                eax
            //   ff15????????         |                     
            //   c74608ffffffff       | mov                 dword ptr [esi + 8], 0xffffffff
            //   f644240801           | test                byte ptr [esp + 8], 1

        $sequence_10 = { 8d542408 52 c744240c30000000 c744241003000000 }
            // n = 4, score = 2200
            //   8d542408             | lea                 edx, [esp + 8]
            //   52                   | push                edx
            //   c744240c30000000     | mov                 dword ptr [esp + 0xc], 0x30
            //   c744241003000000     | mov                 dword ptr [esp + 0x10], 3

        $sequence_11 = { 6801010000 ff15???????? 85c0 7415 }
            // n = 4, score = 1900
            //   6801010000           | push                0x101
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   7415                 | je                  0x17

        $sequence_12 = { 51 6a00 6819000200 6a00 68???????? }
            // n = 5, score = 1400
            //   51                   | push                ecx
            //   6a00                 | push                0
            //   6819000200           | push                0x20019
            //   6a00                 | push                0
            //   68????????           |                     

        $sequence_13 = { 6a0a 68???????? 6a01 6a00 }
            // n = 4, score = 1400
            //   6a0a                 | push                0xa
            //   68????????           |                     
            //   6a01                 | push                1
            //   6a00                 | push                0

        $sequence_14 = { 50 68???????? 6a01 68???????? e8???????? 83c410 }
            // n = 6, score = 1200
            //   50                   | push                eax
            //   68????????           |                     
            //   6a01                 | push                1
            //   68????????           |                     
            //   e8????????           |                     
            //   83c410               | add                 esp, 0x10

        $sequence_15 = { 6a01 6a04 6a01 68???????? }
            // n = 4, score = 1100
            //   6a01                 | push                1
            //   6a04                 | push                4
            //   6a01                 | push                1
            //   68????????           |                     

        $sequence_16 = { 68???????? 6a01 e8???????? 50 e8???????? 83c41c }
            // n = 6, score = 1000
            //   68????????           |                     
            //   6a01                 | mov                 eax, 0xf0000
            //   e8????????           |                     
            //   50                   | mov                 ecx, dword ptr [ebp - 0xc]
            //   e8????????           |                     
            //   83c41c               | mov                 dword ptr fs:[0], ecx

        $sequence_17 = { 89461c 3dea000000 740b 3de5030000 }
            // n = 4, score = 1000
            //   89461c               | mov                 ebx, eax
            //   3dea000000           | call                dword ptr [edx + 0x1e8]
            //   740b                 | dec                 eax
            //   3de5030000           | mov                 ebp, dword ptr [esp + 0x58]

        $sequence_18 = { 7511 e8???????? 83c020 50 e8???????? }
            // n = 5, score = 1000
            //   7511                 | push                0
            //   e8????????           |                     
            //   83c020               | push                eax
            //   50                   | mov                 dword ptr [esi + 0x14], eax
            //   e8????????           |                     

        $sequence_19 = { 6a01 68???????? e8???????? 83c414 5f 5e }
            // n = 6, score = 1000
            //   6a01                 | push                1
            //   68????????           |                     
            //   e8????????           |                     
            //   83c414               | add                 esp, 0x14
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi

        $sequence_20 = { 50 e8???????? 83c408 6800010000 e8???????? }
            // n = 5, score = 1000
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   6800010000           | push                0x100
            //   e8????????           |                     

        $sequence_21 = { 0fb605???????? 66890d???????? 0fb60d???????? 660fafca 6603c8 }
            // n = 5, score = 1000
            //   0fb605????????       |                     
            //   66890d????????       |                     
            //   0fb60d????????       |                     
            //   660fafca             | imul                cx, dx
            //   6603c8               | add                 cx, ax

        $sequence_22 = { 59 6a69 66894de8 59 }
            // n = 4, score = 900
            //   59                   | mov                 ebx, dword ptr [esp + 0x50]
            //   6a69                 | xor                 edx, edx
            //   66894de8             | dec                 eax
            //   59                   | mov                 ecx, esi

        $sequence_23 = { 5e 8bc3 5b c9 c3 83c8ff eb11 }
            // n = 7, score = 900
            //   5e                   | call                dword ptr [edx + 0x1e8]
            //   8bc3                 | dec                 eax
            //   5b                   | mov                 ebp, dword ptr [esp + 0x58]
            //   c9                   | mov                 eax, ebx
            //   c3                   | dec                 eax
            //   83c8ff               | mov                 edx, dword ptr [edi + 0x38]
            //   eb11                 | dec                 eax

        $sequence_24 = { c684248d00000065 c684248e00000050 c684248f00000072 c68424900000006f c684249100000063 c684249200000065 }
            // n = 6, score = 900
            //   c684248d00000065     | mov                 byte ptr [esp + 0x8d], 0x65
            //   c684248e00000050     | mov                 byte ptr [esp + 0x8e], 0x50
            //   c684248f00000072     | mov                 byte ptr [esp + 0x8f], 0x72
            //   c68424900000006f     | mov                 byte ptr [esp + 0x90], 0x6f
            //   c684249100000063     | mov                 byte ptr [esp + 0x91], 0x63
            //   c684249200000065     | mov                 byte ptr [esp + 0x92], 0x65

        $sequence_25 = { c68424900000006f c684249100000063 c684249200000065 c684249300000073 c684249400000073 c684249500000057 c684249600000000 }
            // n = 7, score = 900
            //   c68424900000006f     | mov                 byte ptr [esp + 0x90], 0x6f
            //   c684249100000063     | mov                 byte ptr [esp + 0x91], 0x63
            //   c684249200000065     | mov                 byte ptr [esp + 0x92], 0x65
            //   c684249300000073     | mov                 byte ptr [esp + 0x93], 0x73
            //   c684249400000073     | mov                 byte ptr [esp + 0x94], 0x73
            //   c684249500000057     | mov                 byte ptr [esp + 0x95], 0x57
            //   c684249600000000     | mov                 byte ptr [esp + 0x96], 0

        $sequence_26 = { c684248800000043 c684248900000072 c684248a00000065 c684248b00000061 c684248c00000074 c684248d00000065 c684248e00000050 }
            // n = 7, score = 900
            //   c684248800000043     | mov                 byte ptr [esp + 0x88], 0x43
            //   c684248900000072     | mov                 byte ptr [esp + 0x89], 0x72
            //   c684248a00000065     | mov                 byte ptr [esp + 0x8a], 0x65
            //   c684248b00000061     | mov                 byte ptr [esp + 0x8b], 0x61
            //   c684248c00000074     | mov                 byte ptr [esp + 0x8c], 0x74
            //   c684248d00000065     | mov                 byte ptr [esp + 0x8d], 0x65
            //   c684248e00000050     | mov                 byte ptr [esp + 0x8e], 0x50

        $sequence_27 = { 57 53 897dfc 897e1c }
            // n = 4, score = 900
            //   57                   | mov                 edx, dword ptr [edi + 0x38]
            //   53                   | dec                 eax
            //   897dfc               | mov                 ecx, esi
            //   897e1c               | mov                 ebx, eax

        $sequence_28 = { 59 6a65 668945f0 66894dec 59 6a25 58 }
            // n = 7, score = 900
            //   59                   | mov                 ecx, esi
            //   6a65                 | mov                 ebx, eax
            //   668945f0             | call                dword ptr [edx + 0x1e8]
            //   66894dec             | dec                 eax
            //   59                   | mov                 ebp, dword ptr [esp + 0x58]
            //   6a25                 | mov                 eax, ebx
            //   58                   | dec                 eax

        $sequence_29 = { 59 6a70 66894dea 59 }
            // n = 4, score = 900
            //   59                   | test                eax, eax
            //   6a70                 | dec                 eax
            //   66894dea             | mov                 ecx, esi
            //   59                   | mov                 ebx, eax

        $sequence_30 = { c684241601000074 c684241701000045 c684241801000072 c684241901000072 c684241a0100006f c684241b01000072 }
            // n = 6, score = 900
            //   c684241601000074     | mov                 byte ptr [esp + 0x116], 0x74
            //   c684241701000045     | mov                 byte ptr [esp + 0x117], 0x45
            //   c684241801000072     | mov                 byte ptr [esp + 0x118], 0x72
            //   c684241901000072     | mov                 byte ptr [esp + 0x119], 0x72
            //   c684241a0100006f     | mov                 byte ptr [esp + 0x11a], 0x6f
            //   c684241b01000072     | mov                 byte ptr [esp + 0x11b], 0x72

        $sequence_31 = { ebd2 c78424a000000068000000 c78424dc00000001000000 33c0 66898424e0000000 }
            // n = 5, score = 900
            //   ebd2                 | jmp                 0xffffffd4
            //   c78424a000000068000000     | mov    dword ptr [esp + 0xa0], 0x68
            //   c78424dc00000001000000     | mov    dword ptr [esp + 0xdc], 1
            //   33c0                 | xor                 eax, eax
            //   66898424e0000000     | mov                 word ptr [esp + 0xe0], ax

        $sequence_32 = { c684249600000000 c684241001000047 c684241101000065 c684241201000074 c68424130100004c c684241401000061 }
            // n = 6, score = 900
            //   c684249600000000     | mov                 byte ptr [esp + 0x96], 0
            //   c684241001000047     | mov                 byte ptr [esp + 0x110], 0x47
            //   c684241101000065     | mov                 byte ptr [esp + 0x111], 0x65
            //   c684241201000074     | mov                 byte ptr [esp + 0x112], 0x74
            //   c68424130100004c     | mov                 byte ptr [esp + 0x113], 0x4c
            //   c684241401000061     | mov                 byte ptr [esp + 0x114], 0x61

        $sequence_33 = { 59 6a70 66894de4 8bc8 }
            // n = 4, score = 900
            //   59                   | xor                 edx, edx
            //   6a70                 | dec                 eax
            //   66894de4             | mov                 ecx, esi
            //   8bc8                 | inc                 esp

        $sequence_34 = { 51 6a05 ff75fc 897df0 }
            // n = 4, score = 900
            //   51                   | mov                 eax, ebx
            //   6a05                 | dec                 eax
            //   ff75fc               | mov                 ebx, dword ptr [esp + 0x50]
            //   897df0               | dec                 eax

        $sequence_35 = { c684241201000074 c68424130100004c c684241401000061 c684241501000073 c684241601000074 c684241701000045 c684241801000072 }
            // n = 7, score = 900
            //   c684241201000074     | mov                 byte ptr [esp + 0x112], 0x74
            //   c68424130100004c     | mov                 byte ptr [esp + 0x113], 0x4c
            //   c684241401000061     | mov                 byte ptr [esp + 0x114], 0x61
            //   c684241501000073     | mov                 byte ptr [esp + 0x115], 0x73
            //   c684241601000074     | mov                 byte ptr [esp + 0x116], 0x74
            //   c684241701000045     | mov                 byte ptr [esp + 0x117], 0x45
            //   c684241801000072     | mov                 byte ptr [esp + 0x118], 0x72

        $sequence_36 = { 6a00 6a27 6a02 6a00 6a01 }
            // n = 5, score = 800
            //   6a00                 | push                0
            //   6a27                 | push                0x27
            //   6a02                 | push                2
            //   6a00                 | push                0
            //   6a01                 | push                1

        $sequence_37 = { 8d8505feffff 50 e8???????? 83c40c }
            // n = 4, score = 700
            //   8d8505feffff         | lea                 eax, [ebp - 0x1fb]
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc

        $sequence_38 = { c645d316 c645d43a c645d53b c645d63b }
            // n = 4, score = 700
            //   c645d316             | push                1
            //   c645d43a             | push                eax
            //   c645d53b             | add                 esp, 0x18
            //   c645d63b             | push                1

        $sequence_39 = { c645cb30 c645cc27 c645cd3b c645ce30 }
            // n = 4, score = 700
            //   c645cb30             | push                eax
            //   c645cc27             | add                 esp, 0x10
            //   c645cd3b             | push                1
            //   c645ce30             | push                eax

        $sequence_40 = { 488b4338 33d2 488bce 448d4220 }
            // n = 4, score = 600
            //   488b4338             | dec                 eax
            //   33d2                 | mov                 eax, dword ptr [ebx + 0x38]
            //   488bce               | xor                 edx, edx
            //   448d4220             | dec                 eax

        $sequence_41 = { 488b4608 488b0e 48894628 488b4638 4c8d4c2450 448bc3 488bd7 }
            // n = 7, score = 500
            //   488b4608             | mov                 ecx, esi
            //   488b0e               | inc                 esp
            //   48894628             | lea                 eax, [edx + 0x20]
            //   488b4638             | dec                 eax
            //   4c8d4c2450           | mov                 eax, dword ptr [esi + 8]
            //   448bc3               | dec                 eax
            //   488bd7               | mov                 ecx, dword ptr [esi]

        $sequence_42 = { 4533c9 488bd6 ff90c8010000 8bf8 85c0 }
            // n = 5, score = 500
            //   4533c9               | dec                 eax
            //   488bd6               | mov                 eax, dword ptr [esi + 0x38]
            //   ff90c8010000         | dec                 esp
            //   8bf8                 | lea                 ecx, [esp + 0x50]
            //   85c0                 | inc                 esp

        $sequence_43 = { 488b4638 488b0e 4c8d442450 4533c9 }
            // n = 4, score = 500
            //   488b4638             | dec                 esp
            //   488b0e               | lea                 ecx, [esp + 0x50]
            //   4c8d442450           | inc                 esp
            //   4533c9               | mov                 eax, ebx

        $sequence_44 = { 488bf0 c70005000000 85db 7415 4c8b4f38 }
            // n = 5, score = 500
            //   488bf0               | dec                 eax
            //   c70005000000         | mov                 dword ptr [esi + 0x28], eax
            //   85db                 | dec                 eax
            //   7415                 | mov                 eax, dword ptr [esi + 0x38]
            //   4c8b4f38             | dec                 esp

        $sequence_45 = { 488b0f 48894108 488b0f 488b4108 48894128 488b0f }
            // n = 6, score = 500
            //   488b0f               | dec                 eax
            //   48894108             | mov                 eax, dword ptr [esi + 8]
            //   488b0f               | dec                 eax
            //   488b4108             | mov                 ecx, dword ptr [esi]
            //   48894128             | dec                 eax
            //   488b0f               | mov                 dword ptr [esi + 0x28], eax

        $sequence_46 = { 83c904 c1e803 448bc9 440fafc8 }
            // n = 4, score = 500
            //   83c904               | dec                 eax
            //   c1e803               | mov                 eax, dword ptr [esi + 0x38]
            //   448bc9               | dec                 eax
            //   440fafc8             | mov                 ecx, dword ptr [esi]

        $sequence_47 = { 488bcf c744242088130000 e8???????? 488b5738 }
            // n = 4, score = 500
            //   488bcf               | dec                 esp
            //   c744242088130000     | lea                 ecx, [esp + 0x50]
            //   e8????????           |                     
            //   488b5738             | dec                 eax

        $sequence_48 = { 488b0f 488901 488b07 488338ff }
            // n = 4, score = 500
            //   488b0f               | dec                 esp
            //   488901               | lea                 ecx, [esp + 0x50]
            //   488b07               | inc                 esp
            //   488338ff             | mov                 eax, ebx

        $sequence_49 = { 488bce 8bd8 ff92e8010000 488b6c2458 8bc3 488b5c2450 }
            // n = 6, score = 500
            //   488bce               | dec                 eax
            //   8bd8                 | mov                 eax, dword ptr [esi + 0x38]
            //   ff92e8010000         | dec                 esp
            //   488b6c2458           | lea                 ecx, [esp + 0x50]
            //   8bc3                 | inc                 esp
            //   488b5c2450           | mov                 eax, ebx

        $sequence_50 = { 488b0f 894130 eb06 488b07 896830 }
            // n = 5, score = 500
            //   488b0f               | mov                 eax, dword ptr [esi + 0x38]
            //   894130               | dec                 esp
            //   eb06                 | lea                 ecx, [esp + 0x50]
            //   488b07               | inc                 esp
            //   896830               | mov                 eax, ebx

        $sequence_51 = { 488b07 896830 33c0 488b5c2458 }
            // n = 4, score = 500
            //   488b07               | dec                 esp
            //   896830               | lea                 ecx, [esp + 0x50]
            //   33c0                 | dec                 eax
            //   488b5c2458           | mov                 eax, dword ptr [esi + 0x38]

        $sequence_52 = { 8d8594faffff 50 68???????? ff15???????? }
            // n = 4, score = 200
            //   8d8594faffff         | lea                 eax, [ebp - 0x56c]
            //   50                   | push                eax
            //   68????????           |                     
            //   ff15????????         |                     

        $sequence_53 = { 013d???????? 8b04b5100b4200 0500080000 3bc8 }
            // n = 4, score = 100
            //   013d????????         |                     
            //   8b04b5100b4200       | mov                 eax, dword ptr [esi*4 + 0x420b10]
            //   0500080000           | add                 eax, 0x800
            //   3bc8                 | cmp                 ecx, eax

        $sequence_54 = { 0304b5100b4200 59 5e eb05 }
            // n = 4, score = 100
            //   0304b5100b4200       | add                 eax, dword ptr [esi*4 + 0x420b10]
            //   59                   | pop                 ecx
            //   5e                   | pop                 esi
            //   eb05                 | jmp                 7

        $sequence_55 = { 001cbe 40 0023 d18a0688078a 46 }
            // n = 5, score = 100
            //   001cbe               | add                 byte ptr [esi + edi*4], bl
            //   40                   | inc                 eax
            //   0023                 | add                 byte ptr [ebx], ah
            //   d18a0688078a         | ror                 dword ptr [edx - 0x75f877fa], 1
            //   46                   | inc                 esi

        $sequence_56 = { 030c85100b4200 eb02 8bcb f6412480 }
            // n = 4, score = 100
            //   030c85100b4200       | add                 ecx, dword ptr [eax*4 + 0x420b10]
            //   eb02                 | jmp                 4
            //   8bcb                 | mov                 ecx, ebx
            //   f6412480             | test                byte ptr [ecx + 0x24], 0x80

        $sequence_57 = { 0304b5100b4200 59 eb02 8bc3 }
            // n = 4, score = 100
            //   0304b5100b4200       | add                 eax, dword ptr [esi*4 + 0x420b10]
            //   59                   | pop                 ecx
            //   eb02                 | jmp                 4
            //   8bc3                 | mov                 eax, ebx

        $sequence_58 = { 0304b5100b4200 59 eb05 b8???????? }
            // n = 4, score = 100
            //   0304b5100b4200       | add                 eax, dword ptr [esi*4 + 0x420b10]
            //   59                   | pop                 ecx
            //   eb05                 | jmp                 7
            //   b8????????           |                     

        $sequence_59 = { 0304b5100b4200 beffff0000 59 59 }
            // n = 4, score = 100
            //   0304b5100b4200       | add                 eax, dword ptr [esi*4 + 0x420b10]
            //   beffff0000           | mov                 esi, 0xffff
            //   59                   | pop                 ecx
            //   59                   | pop                 ecx

    condition:
        7 of them and filesize < 5577728
}
[TLP:WHITE] win_agent_btz_w0   (20171113 | No description)
rule win_agent_btz_w0 {
    meta:
        author = "Symantec"
        source = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
        contribution = "pnx - removed FPs"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_btz"
        malpedia_version = "20171113"
        malpedia_sharing = "TLP:WHITE"
        malpedia_license = ""
    strings:
        $b = {C645????}
        $c = {C685??FEFFFF??}
        $d = {FFA0??0?0000}
        $e = {89A8??00000068??00000056FFD78B}
        $f = {00004889????030000488B}
        $tmp_fn = "FA.tmp"
    condition:
        ((#c > 200 and #b > 200 ) or (#d > 40) and (#e > 15 or #f > 30)) and $tmp_fn
}
Download all Yara Rules