Actor(s): APT34, Turla
There is no description at this point.
rule win_nautilus_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.nautilus." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nautilus" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 834b30ff 488d0551b30600 48894320 488d054eb30600 488b5320 488d4b38 41b83c000000 } // n = 7, score = 100 // 834b30ff | dec eax // 488d0551b30600 | mov ecx, edi // 48894320 | dec eax // 488d054eb30600 | mov ecx, edi // 488b5320 | jbe 0x1691 // 488d4b38 | cmp eax, 1 // 41b83c000000 | jne 0x1686 $sequence_1 = { 7e43 4c8bc0 448bcf 410fb600 3bc2 0f4fd0 3bc1 } // n = 7, score = 100 // 7e43 | add edi, 0x18 // 4c8bc0 | cmp ebx, dword ptr [esi + 0x18] // 448bcf | jl 0x9e1 // 410fb600 | dec eax // 3bc2 | mov ecx, ebp // 0f4fd0 | jmp 0xa4f // 3bc1 | mov edi, esi $sequence_2 = { ff15???????? 4c897c2438 488bce 3d02010000 488d442478 4889442430 488d442470 } // n = 7, score = 100 // ff15???????? | // 4c897c2438 | mov esi, eax // 488bce | dec eax // 3d02010000 | mov esi, edx // 488d442478 | dec eax // 4889442430 | mov ebx, ecx // 488d442470 | dec eax $sequence_3 = { 817b04ffffff7f 7d0b 488b5c2430 4883c420 5f c3 488d1505480600 } // n = 7, score = 100 // 817b04ffffff7f | mov ecx, edi // 7d0b | dec eax // 488b5c2430 | mov edx, eax // 4883c420 | inc esi // 5f | dec eax // c3 | mov ecx, edi // 488d1505480600 | setne cl $sequence_4 = { c1e208 48c1e918 4933c8 418b048e 33c2 898388020000 4188ac1980000000 } // n = 7, score = 100 // c1e208 | dec edx // 48c1e918 | lea ecx, [eax + eax] // 4933c8 | dec ecx // 418b048e | add dword ptr [ebx + 8], ecx // 33c2 | dec ecx // 898388020000 | cmp dword ptr [ebx + 8], ecx // 4188ac1980000000 | dec eax $sequence_5 = { 807c243853 0f85e7000000 488d542438 448bc7 488bcb e8???????? 807c243800 } // n = 7, score = 100 // 807c243853 | mov ebx, dword ptr [esp + 0x40] // 0f85e7000000 | dec eax // 488d542438 | mov ecx, esi // 448bc7 | dec esp // 488bcb | mov ecx, eax // e8???????? | // 807c243800 | dec eax $sequence_6 = { 4c8d159bbdfbff 03f2 4b8b8cead05d0900 428a443108 84c0 0f8937030000 807d6002 } // n = 7, score = 100 // 4c8d159bbdfbff | dec eax // 03f2 | mov dword ptr [esp + 8], ebx // 4b8b8cead05d0900 | dec eax // 428a443108 | mov dword ptr [esp + 0x10], esi // 84c0 | dec eax // 0f8937030000 | mov dword ptr [esp + 0x18], edi // 807d6002 | inc ecx $sequence_7 = { e8???????? 85c0 7522 8d7b01 488d4df8 8bd7 e8???????? } // n = 7, score = 100 // e8???????? | // 85c0 | dec esp // 7522 | mov dword ptr [ecx + 0x90], ebx // 8d7b01 | dec esp // 488d4df8 | mov dword ptr [ecx + 0x80], ebx // 8bd7 | dec eax // e8???????? | $sequence_8 = { e8???????? 85c0 0f85ac000000 8b7d08 83c714 8bcf e8???????? } // n = 7, score = 100 // e8???????? | // 85c0 | dec eax // 0f85ac000000 | lea ecx, [0x226ad] // 8b7d08 | inc ecx // 83c714 | mov eax, 1 // 8bcf | dec esp // e8???????? | $sequence_9 = { e8???????? 3b470c 0f8515ffffff 49893c24 eb0d bb0c000000 488bcf } // n = 7, score = 100 // e8???????? | // 3b470c | dec eax // 0f8515ffffff | mov eax, dword ptr [ebp - 0x31] // 49893c24 | dec esp // eb0d | cmp ebp, eax // bb0c000000 | dec ecx // 488bcf | mov edx, esi condition: 7 of them and filesize < 1302528 }
rule win_nautilus_w0 { meta: description = "Rule for detection of Nautilus based on assembly code for a modified RC4 loop" author = "NCSC UK" hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nautilus" malpedia_version = "20180226" malpedia_license = "CC BY-NC-SA 4.0" malpedia_sharing = "TLP:WHITE" strings: $rc4_loop = {42 0F B6 14 04 41 FF C0 03 D7 0F B6 CA 8A 14 0C 43 32 14 13 41 88 12 49 FF C2 49 FF C9} $rc4_key = {31 42 31 34 34 30 44 39 30 46 43 39 42 43 42 34 36 41 39 41 43 39 36 34 33 38 46 45 45 41 38 42} $string_0 = "nautilus-service.dll" ascii $string_1 = "oxygen.dll" ascii $string_2 = "config_listen.system" ascii $string_3 = "ctx.system" ascii $string_4 = "3FDA3998-BEF5-426D-82D8-1A71F29ADDC3" ascii $string_5 = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{%s}.2.ver0x0000000000000001.db" condition: ($rc4_loop and $rc4_key) or (all of ($string_*)) }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY