SYMBOLCOMMON_NAMEaka. SYNONYMS
win.keymarble (Back to overview)

KEYMARBLE

Actor(s): Lazarus Group


There is no description at this point.

References
2020-02-19LexfoLexfo
@techreport{lexfo:20200219:lazarus:f293c37, author = {Lexfo}, title = {{The Lazarus Constellation A study on North Korean malware}}, date = {2020-02-19}, institution = {Lexfo}, url = {https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf}, language = {English}, urldate = {2020-03-11} } The Lazarus Constellation A study on North Korean malware
FastCash AppleJeus BADCALL Bankshot Brambul Dtrack Duuzer DYEPACK ELECTRICFISH HARDRAIN Hermes HOPLIGHT Joanap KEYMARBLE Kimsuky MimiKatz MyDoom NACHOCHEESE NavRAT PowerRatankba RokRAT Sierra(Alfa,Bravo, ...) Volgmer WannaCryptor
2020-02-13QianxinQi Anxin Threat Intelligence Center
@techreport{center:20200213:report:146d333, author = {Qi Anxin Threat Intelligence Center}, title = {{APT Report 2019}}, date = {2020-02-13}, institution = {Qianxin}, url = {https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf}, language = {English}, urldate = {2020-02-27} } APT Report 2019
Chrysaor Exodus Dacls elf.vpnfilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy
2019-02-19Check Point ResearchCheck Point
@online{point:20190219:north:2d1cfbe, author = {Check Point}, title = {{North Korea Turns Against New Targets?!}}, date = {2019-02-19}, organization = {Check Point Research}, url = {https://research.checkpoint.com/north-korea-turns-against-russian-targets/}, language = {English}, urldate = {2019-10-21} } North Korea Turns Against New Targets?!
KEYMARBLE
2018-08-09CISACISA
@online{cisa:20180809:malware:71c0559, author = {CISA}, title = {{Malware Analysis Report (AR18-221A)}}, date = {2018-08-09}, organization = {CISA}, url = {https://www.us-cert.gov/ncas/analysis-reports/AR18-221A}, language = {English}, urldate = {2020-01-07} } Malware Analysis Report (AR18-221A)
KEYMARBLE
Yara Rules
[TLP:WHITE] win_keymarble_auto (20201014 | autogenerated rule brought to you by yara-signator)
rule win_keymarble_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-10-14"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.5.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keymarble"
        malpedia_rule_date = "20201014"
        malpedia_hash = "a7e3bd57eaf12bf3ea29a863c041091ba3af9ac9"
        malpedia_version = "20201014"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 83c404 56 6a40 ff15???????? }
            // n = 4, score = 200
            //   83c404               | add                 esp, 4
            //   56                   | push                esi
            //   6a40                 | push                0x40
            //   ff15????????         |                     

        $sequence_1 = { ff15???????? e8???????? 99 b907000000 f7f9 }
            // n = 5, score = 200
            //   ff15????????         |                     
            //   e8????????           |                     
            //   99                   | cdq                 
            //   b907000000           | mov                 ecx, 7
            //   f7f9                 | idiv                ecx

        $sequence_2 = { ff15???????? 85db 7407 53 ff15???????? ff15???????? }
            // n = 6, score = 200
            //   ff15????????         |                     
            //   85db                 | test                ebx, ebx
            //   7407                 | je                  9
            //   53                   | push                ebx
            //   ff15????????         |                     
            //   ff15????????         |                     

        $sequence_3 = { e9???????? 50 6a00 6810040000 }
            // n = 4, score = 200
            //   e9????????           |                     
            //   50                   | push                eax
            //   6a00                 | push                0
            //   6810040000           | push                0x410

        $sequence_4 = { 6a03 6800000040 57 ffd6 }
            // n = 4, score = 200
            //   6a03                 | push                3
            //   6800000040           | push                0x40000000
            //   57                   | push                edi
            //   ffd6                 | call                esi

        $sequence_5 = { 50 e8???????? 83c404 e8???????? 8d3470 81e6ffffff7f }
            // n = 6, score = 200
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   e8????????           |                     
            //   8d3470               | lea                 esi, [eax + esi*2]
            //   81e6ffffff7f         | and                 esi, 0x7fffffff

        $sequence_6 = { ffd7 50 e8???????? 83c404 e8???????? 8d3470 81e6ffffff7f }
            // n = 7, score = 200
            //   ffd7                 | call                edi
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   e8????????           |                     
            //   8d3470               | lea                 esi, [eax + esi*2]
            //   81e6ffffff7f         | and                 esi, 0x7fffffff

        $sequence_7 = { e8???????? 83c404 e8???????? 8d3470 81e6ffffff7f }
            // n = 5, score = 200
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   e8????????           |                     
            //   8d3470               | lea                 esi, [eax + esi*2]
            //   81e6ffffff7f         | and                 esi, 0x7fffffff

        $sequence_8 = { ff15???????? 50 ff15???????? 68???????? 6a40 }
            // n = 5, score = 200
            //   ff15????????         |                     
            //   50                   | push                eax
            //   ff15????????         |                     
            //   68????????           |                     
            //   6a40                 | push                0x40

        $sequence_9 = { ff15???????? 50 e8???????? 83c404 56 6a40 ff15???????? }
            // n = 7, score = 200
            //   ff15????????         |                     
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   56                   | push                esi
            //   6a40                 | push                0x40
            //   ff15????????         |                     

    condition:
        7 of them and filesize < 1146880
}
Download all Yara Rules