SYMBOLCOMMON_NAMEaka. SYNONYMS
win.ismagent (Back to overview)

ISMAgent

Actor(s): Greenbug, APT34


There is no description at this point.

References
2020-05-19SymantecCritical Attack Discovery and Intelligence Team
@online{team:20200519:sophisticated:023b1bd, author = {Critical Attack Discovery and Intelligence Team}, title = {{Sophisticated Espionage Group Turns Attention to Telecom Providers in South Asia}}, date = {2020-05-19}, organization = {Symantec}, url = {https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia}, language = {English}, urldate = {2020-05-20} } Sophisticated Espionage Group Turns Attention to Telecom Providers in South Asia
ISMAgent ISMDoor
2019-04-16Robert Falcone
@online{falcone:20190416:dns:fed953e, author = {Robert Falcone}, title = {{DNS Tunneling in the Wild: Overview of OilRig’s DNS Tunneling}}, date = {2019-04-16}, url = {https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/}, language = {English}, urldate = {2019-12-03} } DNS Tunneling in the Wild: Overview of OilRig’s DNS Tunneling
BONDUPDATER QUADAGENT Alma Communicator Helminth ISMAgent
2017-08-28ClearSkyClearSky Research Team
@online{team:20170828:recent:fab1e53, author = {ClearSky Research Team}, title = {{Recent ISMAgent Samples and Infrastructure by Iranian Threat Group GreenBug}}, date = {2017-08-28}, organization = {ClearSky}, url = {http://www.clearskysec.com/ismagent/}, language = {English}, urldate = {2019-12-19} } Recent ISMAgent Samples and Infrastructure by Iranian Threat Group GreenBug
ISMAgent
Yara Rules
[TLP:WHITE] win_ismagent_auto (20201023 | autogenerated rule brought to you by yara-signator)
rule win_ismagent_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-12-22"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ismagent"
        malpedia_rule_date = "20201222"
        malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130"
        malpedia_version = "20201023"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8955e4 897dfc 8b049548404200 8945e8 894df0 807c082901 7407 }
            // n = 7, score = 200
            //   8955e4               | mov                 dword ptr [ebp - 0x1c], edx
            //   897dfc               | mov                 dword ptr [ebp - 4], edi
            //   8b049548404200       | mov                 eax, dword ptr [edx*4 + 0x424048]
            //   8945e8               | mov                 dword ptr [ebp - 0x18], eax
            //   894df0               | mov                 dword ptr [ebp - 0x10], ecx
            //   807c082901           | cmp                 byte ptr [eax + ecx + 0x29], 1
            //   7407                 | je                  9

        $sequence_1 = { 895dd8 8365fc00 8b45e4 8b048548404200 }
            // n = 4, score = 200
            //   895dd8               | mov                 dword ptr [ebp - 0x28], ebx
            //   8365fc00             | and                 dword ptr [ebp - 4], 0
            //   8b45e4               | mov                 eax, dword ptr [ebp - 0x1c]
            //   8b048548404200       | mov                 eax, dword ptr [eax*4 + 0x424048]

        $sequence_2 = { 8d84243c0f0000 f3a4 50 c7442454e8030000 ff15???????? 85c0 }
            // n = 6, score = 200
            //   8d84243c0f0000       | lea                 eax, [esp + 0xf3c]
            //   f3a4                 | rep movsb           byte ptr es:[edi], byte ptr [esi]
            //   50                   | push                eax
            //   c7442454e8030000     | mov                 dword ptr [esp + 0x54], 0x3e8
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax

        $sequence_3 = { e8???????? 0f1005???????? 8a0d???????? 68e8030000 0f1144246c }
            // n = 5, score = 200
            //   e8????????           |                     
            //   0f1005????????       |                     
            //   8a0d????????         |                     
            //   68e8030000           | push                0x3e8
            //   0f1144246c           | movups              xmmword ptr [esp + 0x6c], xmm0

        $sequence_4 = { 03c6 6a64 50 8d8424f00a0000 50 e8???????? 8b54241c }
            // n = 7, score = 200
            //   03c6                 | add                 eax, esi
            //   6a64                 | push                0x64
            //   50                   | push                eax
            //   8d8424f00a0000       | lea                 eax, [esp + 0xaf0]
            //   50                   | push                eax
            //   e8????????           |                     
            //   8b54241c             | mov                 edx, dword ptr [esp + 0x1c]

        $sequence_5 = { 53 8b5d10 8b048548404200 56 }
            // n = 4, score = 200
            //   53                   | push                ebx
            //   8b5d10               | mov                 ebx, dword ptr [ebp + 0x10]
            //   8b048548404200       | mov                 eax, dword ptr [eax*4 + 0x424048]
            //   56                   | push                esi

        $sequence_6 = { 0fb685d6f3ffff 50 0fb685d5f3ffff 50 0fb685d4f3ffff 50 }
            // n = 6, score = 200
            //   0fb685d6f3ffff       | movzx               eax, byte ptr [ebp - 0xc2a]
            //   50                   | push                eax
            //   0fb685d5f3ffff       | movzx               eax, byte ptr [ebp - 0xc2b]
            //   50                   | push                eax
            //   0fb685d4f3ffff       | movzx               eax, byte ptr [ebp - 0xc2c]
            //   50                   | push                eax

        $sequence_7 = { 7526 8b7df0 8b048d48404200 f644072d02 8b7df8 7412 53 }
            // n = 7, score = 200
            //   7526                 | jne                 0x28
            //   8b7df0               | mov                 edi, dword ptr [ebp - 0x10]
            //   8b048d48404200       | mov                 eax, dword ptr [ecx*4 + 0x424048]
            //   f644072d02           | test                byte ptr [edi + eax + 0x2d], 2
            //   8b7df8               | mov                 edi, dword ptr [ebp - 8]
            //   7412                 | je                  0x14
            //   53                   | push                ebx

    condition:
        7 of them and filesize < 327680
}
Download all Yara Rules