SYMBOLCOMMON_NAMEaka. SYNONYMS
win.hardrain (Back to overview)

HARDRAIN

Actor(s): Lazarus Group

VTCollection    

There is no description at this point.

References
2020-02-19LexfoLexfo
The Lazarus Constellation A study on North Korean malware
FastCash AppleJeus BADCALL Bankshot Brambul Dtrack Duuzer DYEPACK ELECTRICFISH HARDRAIN Hermes HOPLIGHT Joanap KEYMARBLE Kimsuky MimiKatz MyDoom NACHOCHEESE NavRAT PowerRatankba RokRAT Sierra(Alfa,Bravo, ...) Volgmer WannaCryptor
2018-02-05US-CERTUnknown Unknown
HIDDEN COBRA - North Korean Malicious Cyber Activity
HARDRAIN HARDRAIN
Yara Rules
[TLP:WHITE] win_hardrain_auto (20230808 | Detects win.hardrain.)
rule win_hardrain_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.hardrain."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hardrain"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 66c74424380000 f3ab 66ab b981000000 33c0 }
            // n = 5, score = 200
            //   66c74424380000       | mov                 word ptr [esp + 0x38], 0
            //   f3ab                 | rep stosd           dword ptr es:[edi], eax
            //   66ab                 | stosw               word ptr es:[edi], ax
            //   b981000000           | mov                 ecx, 0x81
            //   33c0                 | xor                 eax, eax

        $sequence_1 = { 51 56 89542414 8944241c e8???????? 83c410 85c0 }
            // n = 7, score = 200
            //   51                   | push                ecx
            //   56                   | push                esi
            //   89542414             | mov                 dword ptr [esp + 0x14], edx
            //   8944241c             | mov                 dword ptr [esp + 0x1c], eax
            //   e8????????           |                     
            //   83c410               | add                 esp, 0x10
            //   85c0                 | test                eax, eax

        $sequence_2 = { 8b7c241c 6685ff 7509 5f 83c8ff 5e 83c410 }
            // n = 7, score = 200
            //   8b7c241c             | mov                 edi, dword ptr [esp + 0x1c]
            //   6685ff               | test                di, di
            //   7509                 | jne                 0xb
            //   5f                   | pop                 edi
            //   83c8ff               | or                  eax, 0xffffffff
            //   5e                   | pop                 esi
            //   83c410               | add                 esp, 0x10

        $sequence_3 = { ff15???????? 85c0 7eca 8d442430 }
            // n = 4, score = 200
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   7eca                 | jle                 0xffffffcc
            //   8d442430             | lea                 eax, [esp + 0x30]

        $sequence_4 = { 51 8bce e8???????? 85c0 7427 6a14 }
            // n = 6, score = 200
            //   51                   | push                ecx
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7427                 | je                  0x29
            //   6a14                 | push                0x14

        $sequence_5 = { 68b4000000 52 50 e8???????? }
            // n = 4, score = 200
            //   68b4000000           | push                0xb4
            //   52                   | push                edx
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_6 = { 8d842484000000 68???????? 50 e8???????? 8d8c248c000000 6800040000 8d942490040000 }
            // n = 7, score = 200
            //   8d842484000000       | lea                 eax, [esp + 0x84]
            //   68????????           |                     
            //   50                   | push                eax
            //   e8????????           |                     
            //   8d8c248c000000       | lea                 ecx, [esp + 0x8c]
            //   6800040000           | push                0x400
            //   8d942490040000       | lea                 edx, [esp + 0x490]

        $sequence_7 = { 83c418 c3 33c0 33c9 68b4000000 89442408 }
            // n = 6, score = 200
            //   83c418               | add                 esp, 0x18
            //   c3                   | ret                 
            //   33c0                 | xor                 eax, eax
            //   33c9                 | xor                 ecx, ecx
            //   68b4000000           | push                0xb4
            //   89442408             | mov                 dword ptr [esp + 8], eax

        $sequence_8 = { ff15???????? 8b0e 85c9 7406 8b11 6a01 ff12 }
            // n = 7, score = 200
            //   ff15????????         |                     
            //   8b0e                 | mov                 ecx, dword ptr [esi]
            //   85c9                 | test                ecx, ecx
            //   7406                 | je                  8
            //   8b11                 | mov                 edx, dword ptr [ecx]
            //   6a01                 | push                1
            //   ff12                 | call                dword ptr [edx]

        $sequence_9 = { 81ec0c010000 8b842414010000 8b942418010000 57 89442404 b942000000 }
            // n = 6, score = 200
            //   81ec0c010000         | sub                 esp, 0x10c
            //   8b842414010000       | mov                 eax, dword ptr [esp + 0x114]
            //   8b942418010000       | mov                 edx, dword ptr [esp + 0x118]
            //   57                   | push                edi
            //   89442404             | mov                 dword ptr [esp + 4], eax
            //   b942000000           | mov                 ecx, 0x42

    condition:
        7 of them and filesize < 368640
}
Download all Yara Rules