SYMBOLCOMMON_NAMEaka. SYNONYMS
win.powershellrunner (Back to overview)

PowerShellRunner

Actor(s): Turla Group


There is no description at this point.

References
2019-05-29ESET ResearchMatthieu Faou, Romain Dumont
@online{faou:20190529:dive:3afd32e, author = {Matthieu Faou and Romain Dumont}, title = {{A dive into Turla PowerShell usage}}, date = {2019-05-29}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/}, language = {English}, urldate = {2019-11-14} } A dive into Turla PowerShell usage
PowerShellRunner TurlaRPC
2019-04-13GitHubVitali Kremez
@online{kremez:20190413:decoded:c9b46a9, author = {Vitali Kremez}, title = {{Decoded Turla Powershell Implant}}, date = {2019-04-13}, organization = {GitHub}, url = {https://raw.githubusercontent.com/k-vitali/Malware-Misc-RE/master/2019-04-13-Possible-Turla-PowerShell-Implant.ps1}, language = {English}, urldate = {2019-07-11} } Decoded Turla Powershell Implant
PowerShellRunner
Yara Rules
[TLP:WHITE] win_powershellrunner_auto (20220411 | Detects win.powershellrunner.)
rule win_powershellrunner_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-04-08"
        version = "1"
        description = "Detects win.powershellrunner."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powershellrunner"
        malpedia_rule_date = "20220405"
        malpedia_hash = "ecd38294bd47d5589be5cd5490dc8bb4804afc2a"
        malpedia_version = "20220411"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 488b542438 488bc8 e8???????? 4889442428 488b442428 }
            // n = 6, score = 200
            //   e8????????           |                     
            //   488b542438           | mov                 edx, dword ptr [esp + 0x40]
            //   488bc8               | dec                 eax
            //   e8????????           |                     
            //   4889442428           | mov                 ecx, dword ptr [esp + 0x68]
            //   488b442428           | dec                 eax

        $sequence_1 = { 488b442420 488bc8 e8???????? 4c8d442428 488bd0 488b4c2430 e8???????? }
            // n = 7, score = 200
            //   488b442420           | mov                 byte ptr [esp + 0x1ad], 0x26
            //   488bc8               | mov                 byte ptr [esp + 0x1ae], 0x21
            //   e8????????           |                     
            //   4c8d442428           | mov                 byte ptr [esp + 0x1af], 0x10
            //   488bd0               | mov                 byte ptr [esp + 0x2aa], 0x3b
            //   488b4c2430           | mov                 byte ptr [esp + 0x2ab], 0x27
            //   e8????????           |                     

        $sequence_2 = { b83d000000 668984243e010000 b85b000000 6689842440010000 b843000000 6689842442010000 }
            // n = 6, score = 200
            //   b83d000000           | lea                 edx, dword ptr [esp + 0xc0]
            //   668984243e010000     | dec                 eax
            //   b85b000000           | mov                 ecx, dword ptr [esp + 0x28]
            //   6689842440010000     | call                dword ptr [esp + 0x328]
            //   b843000000           | dec                 eax
            //   6689842442010000     | mov                 ecx, dword ptr [esp + 0x330]

        $sequence_3 = { 4883f9ff 7406 ff15???????? 48832300 4883c308 488d0515130200 483bd8 }
            // n = 7, score = 200
            //   4883f9ff             | mov                 word ptr [esp + 0x8a], ax
            //   7406                 | mov                 eax, 0x70
            //   ff15????????         |                     
            //   48832300             | mov                 word ptr [esp + 0x8c], ax
            //   4883c308             | mov                 eax, 0x65
            //   488d0515130200       | mov                 word ptr [esp + 0x8a], ax
            //   483bd8               | mov                 eax, 0x72

        $sequence_4 = { b872000000 668984248c000000 b82e000000 668984248e000000 b86c000000 6689842490000000 b86f000000 }
            // n = 7, score = 200
            //   b872000000           | dec                 eax
            //   668984248c000000     | mov                 ecx, dword ptr [esp + 0x68]
            //   b82e000000           | dec                 eax
            //   668984248e000000     | mov                 dword ptr [esp + 0x28], eax
            //   b86c000000           | dec                 eax
            //   6689842490000000     | mov                 ecx, dword ptr [esp + 0x60]
            //   b86f000000           | dec                 eax

        $sequence_5 = { c684249102000007 c684249202000030 c684249302000032 c68424940200003c c684249502000026 c684249602000021 }
            // n = 6, score = 200
            //   c684249102000007     | dec                 eax
            //   c684249202000030     | lea                 ecx, dword ptr [esp + 0x60]
            //   c684249302000032     | dec                 eax
            //   c68424940200003c     | mov                 dword ptr [esp + 0x30], eax
            //   c684249502000026     | dec                 eax
            //   c684249602000021     | lea                 ecx, dword ptr [esp + 0x58]

        $sequence_6 = { 488d4c2450 e8???????? 488d4c2450 e8???????? 4889442428 488d4c2458 e8???????? }
            // n = 7, score = 200
            //   488d4c2450           | jne                 0xadd
            //   e8????????           |                     
            //   488d4c2450           | dec                 eax
            //   e8????????           |                     
            //   4889442428           | mov                 ecx, dword ptr [esp + 0x48]
            //   488d4c2458           | inc                 ebp
            //   e8????????           |                     

        $sequence_7 = { 4c8d0d2ff50000 498bd1 448d4008 3b0a 742b ffc0 }
            // n = 6, score = 200
            //   4c8d0d2ff50000       | dec                 eax
            //   498bd1               | cmp                 dword ptr [esp + 0x48], eax
            //   448d4008             | je                  0xeae
            //   3b0a                 | dec                 eax
            //   742b                 | mov                 eax, dword ptr [esp + 0x48]
            //   ffc0                 | dec                 eax

        $sequence_8 = { 83e03f 2bc8 48d3cf 4933fa 4b87bcfef0140300 33c0 488b5c2450 }
            // n = 7, score = 200
            //   83e03f               | dec                 eax
            //   2bc8                 | mov                 ecx, dword ptr [esp + 0x40]
            //   48d3cf               | dec                 eax
            //   4933fa               | mov                 dword ptr [esp + 0x28], eax
            //   4b87bcfef0140300     | dec                 eax
            //   33c0                 | mov                 eax, dword ptr [esp + 0x28]
            //   488b5c2450           | dec                 eax

        $sequence_9 = { 7502 eb7a 488b8c2490000000 e8???????? 488b00 488b8c2498000000 }
            // n = 6, score = 200
            //   7502                 | dec                 eax
            //   eb7a                 | mov                 ecx, eax
            //   488b8c2490000000     | dec                 eax
            //   e8????????           |                     
            //   488b00               | mov                 ecx, dword ptr [esp + 0x30]
            //   488b8c2498000000     | mov                 word ptr [ecx], ax

    condition:
        7 of them and filesize < 458752
}
Download all Yara Rules