SYMBOLCOMMON_NAMEaka. SYNONYMS
win.hermes (Back to overview)

Hermes

Actor(s): Lazarus Group

URLhaus    

There is no description at this point.

References
2020-12-09CrowdStrikeJosh Burgess, Jason Rivera
@techreport{burgess:20201209:from:1811e9c, author = {Josh Burgess and Jason Rivera}, title = {{From Zero to SixtyThe Story of North Korea’s Rapid Ascent to Becoming a Global Cyber Superpower}}, date = {2020-12-09}, institution = {CrowdStrike}, url = {https://i.blackhat.com/eu-20/Wednesday/eu-20-Rivera-From-Zero-To-Sixty-The-Story-Of-North-Koreas-Rapid-Ascent-To-Becoming-A-Global-Cyber-Superpower.pdf}, language = {English}, urldate = {2020-12-11} } From Zero to SixtyThe Story of North Korea’s Rapid Ascent to Becoming a Global Cyber Superpower
FastCash Hermes WannaCryptor
2020-11-14Medium 0xastrovaxastrovax
@online{astrovax:20201114:deep:b50ae08, author = {astrovax}, title = {{Deep Dive Into Ryuk Ransomware}}, date = {2020-11-14}, organization = {Medium 0xastrovax}, url = {https://medium.com/ax1al/reversing-ryuk-eef8ffd55f12}, language = {English}, urldate = {2021-01-25} } Deep Dive Into Ryuk Ransomware
Hermes Ryuk
2020-03-05MicrosoftMicrosoft Threat Protection Intelligence Team
@online{team:20200305:humanoperated:d90a28e, author = {Microsoft Threat Protection Intelligence Team}, title = {{Human-operated ransomware attacks: A preventable disaster}}, date = {2020-03-05}, organization = {Microsoft}, url = {https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/}, language = {English}, urldate = {2020-03-06} } Human-operated ransomware attacks: A preventable disaster
Dharma DoppelPaymer Dridex EternalPetya Gandcrab Hermes LockerGoga MegaCortex MimiKatz REvil RobinHood Ryuk SamSam TrickBot WannaCryptor
2020-02-19LexfoLexfo
@techreport{lexfo:20200219:lazarus:f293c37, author = {Lexfo}, title = {{The Lazarus Constellation A study on North Korean malware}}, date = {2020-02-19}, institution = {Lexfo}, url = {https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf}, language = {English}, urldate = {2020-03-11} } The Lazarus Constellation A study on North Korean malware
FastCash AppleJeus BADCALL Bankshot Brambul Dtrack Duuzer DYEPACK ELECTRICFISH HARDRAIN Hermes HOPLIGHT Joanap KEYMARBLE Kimsuky MimiKatz MyDoom NACHOCHEESE NavRAT PowerRatankba RokRAT Sierra(Alfa,Bravo, ...) Volgmer WannaCryptor
2018-07-30ProofpointProofpoint Staff
@online{staff:20180730:new:07c5e76, author = {Proofpoint Staff}, title = {{New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign}}, date = {2018-07-30}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside}, language = {English}, urldate = {2019-12-20} } New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign
Azorult Hermes Hermes Ransomware
2017-10-16Sergei Shevchenko, Hirman Muhammad bin Abu Bakar, James Wong
@online{shevchenko:20171016:taiwan:081b125, author = {Sergei Shevchenko and Hirman Muhammad bin Abu Bakar and James Wong}, title = {{Taiwan Heist: Lazarus Tools and Ransomware}}, date = {2017-10-16}, url = {http://baesystemsai.blogspot.de/2017/10/taiwan-heist-lazarus-tools.html}, language = {English}, urldate = {2020-01-07} } Taiwan Heist: Lazarus Tools and Ransomware
Bitsran Hermes
Yara Rules
[TLP:WHITE] win_hermes_auto (20211008 | Detects win.hermes.)
rule win_hermes_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.hermes."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermes"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 56 e8???????? 59 59 8d45fc c745fc32000000 50 }
            // n = 7, score = 100
            //   56                   | push                esi
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   59                   | pop                 ecx
            //   8d45fc               | lea                 eax, dword ptr [ebp - 4]
            //   c745fc32000000       | mov                 dword ptr [ebp - 4], 0x32
            //   50                   | push                eax

        $sequence_1 = { 6a28 56 68???????? eb29 68???????? 57 53 }
            // n = 7, score = 100
            //   6a28                 | push                0x28
            //   56                   | push                esi
            //   68????????           |                     
            //   eb29                 | jmp                 0x2b
            //   68????????           |                     
            //   57                   | push                edi
            //   53                   | push                ebx

        $sequence_2 = { 894dd8 83f803 7d2d 51 6880000000 6a02 51 }
            // n = 7, score = 100
            //   894dd8               | mov                 dword ptr [ebp - 0x28], ecx
            //   83f803               | cmp                 eax, 3
            //   7d2d                 | jge                 0x2f
            //   51                   | push                ecx
            //   6880000000           | push                0x80
            //   6a02                 | push                2
            //   51                   | push                ecx

        $sequence_3 = { 83c732 81fe10010000 72d2 68???????? }
            // n = 4, score = 100
            //   83c732               | add                 edi, 0x32
            //   81fe10010000         | cmp                 esi, 0x110
            //   72d2                 | jb                  0xffffffd4
            //   68????????           |                     

        $sequence_4 = { 6a02 895df4 ff15???????? 85c0 }
            // n = 4, score = 100
            //   6a02                 | push                2
            //   895df4               | mov                 dword ptr [ebp - 0xc], ebx
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax

        $sequence_5 = { 83c410 8d859cfdffff 50 57 ff15???????? 85c0 }
            // n = 6, score = 100
            //   83c410               | add                 esp, 0x10
            //   8d859cfdffff         | lea                 eax, dword ptr [ebp - 0x264]
            //   50                   | push                eax
            //   57                   | push                edi
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax

        $sequence_6 = { eb05 2bf0 8d1c72 5f 5e }
            // n = 5, score = 100
            //   eb05                 | jmp                 7
            //   2bf0                 | sub                 esi, eax
            //   8d1c72               | lea                 ebx, dword ptr [edx + esi*2]
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi

        $sequence_7 = { 33f6 8b473c 8b443878 03c7 8b4824 8b501c 03cf }
            // n = 7, score = 100
            //   33f6                 | xor                 esi, esi
            //   8b473c               | mov                 eax, dword ptr [edi + 0x3c]
            //   8b443878             | mov                 eax, dword ptr [eax + edi + 0x78]
            //   03c7                 | add                 eax, edi
            //   8b4824               | mov                 ecx, dword ptr [eax + 0x24]
            //   8b501c               | mov                 edx, dword ptr [eax + 0x1c]
            //   03cf                 | add                 ecx, edi

        $sequence_8 = { 56 e8???????? 59 59 bef4010000 }
            // n = 5, score = 100
            //   56                   | push                esi
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   59                   | pop                 ecx
            //   bef4010000           | mov                 esi, 0x1f4

        $sequence_9 = { 0f8585000000 6a10 56 68???????? 8d45c4 }
            // n = 5, score = 100
            //   0f8585000000         | jne                 0x8b
            //   6a10                 | push                0x10
            //   56                   | push                esi
            //   68????????           |                     
            //   8d45c4               | lea                 eax, dword ptr [ebp - 0x3c]

    condition:
        7 of them and filesize < 2113536
}
[TLP:WHITE] win_hermes_w0   (20180301 | No description)
rule win_hermes_w0 {
    meta:
        author = "BAE"
        reference = "https://baesystemsai.blogspot.de/2017/10/taiwan-heist-lazarus-tools.html"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermes"
        malpedia_version = "20180301"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        //in both version 2.1 and sample in Feb
        $s1 = "SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\\"
        $s2 = "0419"
        $s3 = "0422"
        $s4 = "0423"
        //in version 2.1 only
        $S1 = "HERMES"
        $S2 = "vssadminn"
        $S3 = "finish work"
        $S4 = "testlib.dll"
        $S5 = "shadowstorageiet"
        //maybe unique in the file
        $u1 = "ALKnvfoi4tbmiom3t40iomfr0i3t4jmvri3tb4mvi3btv3rgt4t777"
        $u2 = "HERMES 2.1 TEST BUILD, press ok"
        $u3 = "hnKwtMcOadHwnXutKHqPvpgfysFXfAFTcaDHNdCnktA" //RSA Key part
    condition:
        all of ($s*) and 3 of ($S*) and 1 of ($u*)
}
Download all Yara Rules