SYMBOLCOMMON_NAMEaka. SYNONYMS
win.powershellrunner (Back to overview)

PowerShellRunner

Actor(s): Turla Group


There is no description at this point.

References
2019-05-29ESET ResearchMatthieu Faou, Romain Dumont
@online{faou:20190529:dive:3afd32e, author = {Matthieu Faou and Romain Dumont}, title = {{A dive into Turla PowerShell usage}}, date = {2019-05-29}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/}, language = {English}, urldate = {2019-11-14} } A dive into Turla PowerShell usage
PowerShellRunner TurlaRPC
2019-04-13GitHubVitali Kremez
@online{kremez:20190413:decoded:c9b46a9, author = {Vitali Kremez}, title = {{Decoded Turla Powershell Implant}}, date = {2019-04-13}, organization = {GitHub}, url = {https://raw.githubusercontent.com/k-vitali/Malware-Misc-RE/master/2019-04-13-Possible-Turla-PowerShell-Implant.ps1}, language = {English}, urldate = {2019-07-11} } Decoded Turla Powershell Implant
PowerShellRunner
Yara Rules
[TLP:WHITE] win_powershellrunner_auto (20210616 | Detects win.powershellrunner.)
rule win_powershellrunner_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-06-10"
        version = "1"
        description = "Detects win.powershellrunner."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powershellrunner"
        malpedia_rule_date = "20210604"
        malpedia_hash = "be09d5d71e77373c0f538068be31a2ad4c69cfbd"
        malpedia_version = "20210616"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 3bc2 0f87cf000000 8b8c8690da0100 4803ce ffe1 }
            // n = 5, score = 200
            //   3bc2                 | mov                 byte ptr [esp + 0x9a], 0x26
            //   0f87cf000000         | mov                 byte ptr [esp + 0x9b], 0x39
            //   8b8c8690da0100       | mov                 byte ptr [esp + 0x9c], 0x30
            //   4803ce               | mov                 byte ptr [esp + 0x9d], 0x3b
            //   ffe1                 | mov                 byte ptr [esp + 0x9a], 0x6c

        $sequence_1 = { b853000000 66898424f6000000 33c0 66898424f8000000 4883bc243001000000 }
            // n = 5, score = 200
            //   b853000000           | xor                 eax, eax
            //   66898424f6000000     | mov                 ecx, 0x18
            //   33c0                 | rep stosb           byte ptr es:[edi], al
            //   66898424f8000000     | dec                 eax
            //   4883bc243001000000     | lea    eax, dword ptr [eax + ecx*4 - 4]

        $sequence_2 = { c68424c700000055 c684249800000022 c684249900000036 c684249a00000026 c684249b00000039 c684249c00000030 c684249d0000003b }
            // n = 7, score = 200
            //   c68424c700000055     | dec                 eax
            //   c684249800000022     | mov                 dword ptr [edx + 8], ecx
            //   c684249900000036     | dec                 eax
            //   c684249a00000026     | lea                 ecx, dword ptr [eax + 8]
            //   c684249b00000039     | dec                 eax
            //   c684249c00000030     | lea                 ecx, dword ptr [0xb473]
            //   c684249d0000003b     | dec                 eax

        $sequence_3 = { 4c8d0505300100 488d1506300100 e8???????? 8bcb 4885c0 740c }
            // n = 6, score = 200
            //   4c8d0505300100       | mov                 dword ptr [ecx + 0x150], eax
            //   488d1506300100       | dec                 eax
            //   e8????????           |                     
            //   8bcb                 | mov                 dword ptr [ecx + 0x150], eax
            //   4885c0               | dec                 eax
            //   740c                 | lea                 edx, dword ptr [esp + 0xc8]

        $sequence_4 = { 4889442448 e9???????? 8b442434 ffc0 4898 48d1e0 488bd0 }
            // n = 7, score = 200
            //   4889442448           | mov                 byte ptr [esp + 0x188], 0x3e
            //   e9????????           |                     
            //   8b442434             | mov                 byte ptr [esp + 0x189], 0x30
            //   ffc0                 | mov                 byte ptr [esp + 0x18a], 0x27
            //   4898                 | mov                 byte ptr [esp + 0x220], 0x21
            //   48d1e0               | mov                 byte ptr [esp + 0x221], 0x13
            //   488bd0               | mov                 byte ptr [esp + 0x222], 0x3c

        $sequence_5 = { 488d8c24a0000000 e8???????? 488b442430 488bc8 e8???????? 4c8d442440 488bd0 }
            // n = 7, score = 200
            //   488d8c24a0000000     | mov                 dword ptr [esp + 0x28], ebx
            //   e8????????           |                     
            //   488b442430           | dec                 eax
            //   488bc8               | lea                 ecx, dword ptr [0x9d1b]
            //   e8????????           |                     
            //   4c8d442440           | xor                 ebx, ebx
            //   488bd0               | dec                 eax

        $sequence_6 = { 4883bc243003000000 0f84e5050000 488d9424e8000000 488b4c2428 ff942428030000 488b8c2430030000 48894108 }
            // n = 7, score = 200
            //   4883bc243003000000     | mov    word ptr [esp + 0x19e], ax
            //   0f84e5050000         | mov                 eax, 0x61
            //   488d9424e8000000     | mov                 word ptr [esp + 0x1a0], ax
            //   488b4c2428           | mov                 eax, 0x72
            //   ff942428030000       | mov                 word ptr [esp + 0x1a2], ax
            //   488b8c2430030000     | mov                 eax, 0x50
            //   48894108             | mov                 word ptr [esp + 0xf4], ax

        $sequence_7 = { c644245e75 c644245f73 c644246000 488d4c2468 ff15???????? 4889442420 }
            // n = 6, score = 200
            //   c644245e75           | dec                 eax
            //   c644245f73           | lea                 ecx, dword ptr [esp + 0x40]
            //   c644246000           | nop                 
            //   488d4c2468           | dec                 eax
            //   ff15????????         |                     
            //   4889442420           | mov                 dword ptr [esp + 0x30], 0

        $sequence_8 = { 0f84a6000000 452be5 488d15d445feff 4489642434 0f853ffcffff 8b442438 }
            // n = 6, score = 200
            //   0f84a6000000         | mov                 eax, 0x53
            //   452be5               | mov                 eax, 0x65
            //   488d15d445feff       | mov                 word ptr [esp + 0x88], ax
            //   4489642434           | mov                 eax, 0x5c
            //   0f853ffcffff         | mov                 word ptr [esp + 0x8a], ax
            //   8b442438             | mov                 eax, 0x70

        $sequence_9 = { 7502 eb7a 488b8c2490000000 e8???????? 488b00 488b8c2498000000 }
            // n = 6, score = 200
            //   7502                 | lea                 edx, dword ptr [esp + 0x70]
            //   eb7a                 | dec                 eax
            //   488b8c2490000000     | mov                 dword ptr [esp + 0x30], edx
            //   e8????????           |                     
            //   488b00               | dec                 eax
            //   488b8c2498000000     | mov                 edx, dword ptr [esp + 0x60]

    condition:
        7 of them and filesize < 458752
}
Download all Yara Rules