SYMBOLCOMMON_NAMEaka. SYNONYMS
win.keymarble (Back to overview)

KEYMARBLE

Actor(s): Lazarus Group


There is no description at this point.

References
2020-02-19LexfoLexfo
@techreport{lexfo:20200219:lazarus:f293c37, author = {Lexfo}, title = {{The Lazarus Constellation A study on North Korean malware}}, date = {2020-02-19}, institution = {Lexfo}, url = {https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf}, language = {English}, urldate = {2020-03-11} } The Lazarus Constellation A study on North Korean malware
FastCash AppleJeus BADCALL Bankshot Brambul Dtrack Duuzer DYEPACK ELECTRICFISH HARDRAIN Hermes HOPLIGHT Joanap KEYMARBLE Kimsuky MimiKatz MyDoom NACHOCHEESE NavRAT PowerRatankba RokRAT Sierra(Alfa,Bravo, ...) Volgmer WannaCryptor
2020-02-13QianxinQi Anxin Threat Intelligence Center
@techreport{center:20200213:report:146d333, author = {Qi Anxin Threat Intelligence Center}, title = {{APT Report 2019}}, date = {2020-02-13}, institution = {Qianxin}, url = {https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf}, language = {English}, urldate = {2020-02-27} } APT Report 2019
Chrysaor Exodus Dacls VPNFilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy
2019-02-19Check Point ResearchCheck Point
@online{point:20190219:north:2d1cfbe, author = {Check Point}, title = {{North Korea Turns Against New Targets?!}}, date = {2019-02-19}, organization = {Check Point Research}, url = {https://research.checkpoint.com/north-korea-turns-against-russian-targets/}, language = {English}, urldate = {2019-10-21} } North Korea Turns Against New Targets?!
KEYMARBLE
2018-08-09CISACISA
@online{cisa:20180809:malware:71c0559, author = {CISA}, title = {{Malware Analysis Report (AR18-221A)}}, date = {2018-08-09}, organization = {CISA}, url = {https://www.us-cert.gov/ncas/analysis-reports/AR18-221A}, language = {English}, urldate = {2020-01-07} } Malware Analysis Report (AR18-221A)
KEYMARBLE
Yara Rules
[TLP:WHITE] win_keymarble_auto (20230715 | Detects win.keymarble.)
rule win_keymarble_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.keymarble."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keymarble"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 83c404 56 6a40 ff15???????? }
            // n = 5, score = 200
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   56                   | push                esi
            //   6a40                 | push                0x40
            //   ff15????????         |                     

        $sequence_1 = { 50 e8???????? 83c404 56 6a40 ff15???????? }
            // n = 6, score = 200
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   56                   | push                esi
            //   6a40                 | push                0x40
            //   ff15????????         |                     

        $sequence_2 = { ffd7 50 e8???????? 83c404 e8???????? 8d3470 81e6ffffff7f }
            // n = 7, score = 200
            //   ffd7                 | call                edi
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   e8????????           |                     
            //   8d3470               | lea                 esi, [eax + esi*2]
            //   81e6ffffff7f         | and                 esi, 0x7fffffff

        $sequence_3 = { e9???????? 50 6a00 6810040000 ff15???????? }
            // n = 5, score = 200
            //   e9????????           |                     
            //   50                   | push                eax
            //   6a00                 | push                0
            //   6810040000           | push                0x410
            //   ff15????????         |                     

        $sequence_4 = { 83c408 85c0 7407 bb7a452301 }
            // n = 4, score = 200
            //   83c408               | add                 esp, 8
            //   85c0                 | test                eax, eax
            //   7407                 | je                  9
            //   bb7a452301           | mov                 ebx, 0x123457a

        $sequence_5 = { e8???????? 83c408 85c0 7407 bb7a452301 }
            // n = 5, score = 200
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   85c0                 | test                eax, eax
            //   7407                 | je                  9
            //   bb7a452301           | mov                 ebx, 0x123457a

        $sequence_6 = { ff15???????? 50 ff15???????? 68???????? 6a40 }
            // n = 5, score = 200
            //   ff15????????         |                     
            //   50                   | push                eax
            //   ff15????????         |                     
            //   68????????           |                     
            //   6a40                 | push                0x40

        $sequence_7 = { 6a00 6a00 6a10 50 6aff }
            // n = 5, score = 200
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6a10                 | push                0x10
            //   50                   | push                eax
            //   6aff                 | push                -1

        $sequence_8 = { ff15???????? 50 e8???????? 83c404 56 6a40 ff15???????? }
            // n = 7, score = 200
            //   ff15????????         |                     
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   56                   | push                esi
            //   6a40                 | push                0x40
            //   ff15????????         |                     

        $sequence_9 = { 50 e8???????? 83c404 e8???????? 8d3470 81e6ffffff7f }
            // n = 6, score = 200
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   e8????????           |                     
            //   8d3470               | lea                 esi, [eax + esi*2]
            //   81e6ffffff7f         | and                 esi, 0x7fffffff

    condition:
        7 of them and filesize < 1146880
}
Download all Yara Rules