SYMBOLCOMMON_NAMEaka. SYNONYMS
win.regin (Back to overview)

Regin


Regin is a sophisticated malware and hacking toolkit attributed to United States' National Security Agency (NSA) for government spying operations. It was first publicly revealed by Kaspersky Lab, Symantec, and The Intercept in November 2014. Regin malware targeted victims in a range of industries, telecom, government, and financial institutions. It was engineered to be modular and over time dozens of modules have been found and attributed to this family. Symantec observed around 100 infections in 10 different countries across a variety of organisations including private companies, government entities, and research institutes.

References
2021-02-05EpicTurlaJuan Andrés Guerrero-Saade
@online{guerrerosaade:20210205:voltron:953cec2, author = {Juan Andrés Guerrero-Saade}, title = {{Voltron STA The curious case of 0xFancyFilter}}, date = {2021-02-05}, organization = {EpicTurla}, url = {https://www.epicturla.com/previous-works/hitb2020-voltron-sta}, language = {English}, urldate = {2021-02-06} } Voltron STA The curious case of 0xFancyFilter
fancyfilter MISTYVEAL Regin
2020-06-09Kaspersky LabsCostin Raiu
@online{raiu:20200609:looking:3038dce, author = {Costin Raiu}, title = {{Looking at Big Threats Using Code Similarity. Part 1}}, date = {2020-06-09}, organization = {Kaspersky Labs}, url = {https://securelist.com/big-threats-using-code-similarity-part-1/97239/}, language = {English}, urldate = {2020-08-18} } Looking at Big Threats Using Code Similarity. Part 1
Penquin Turla CCleaner Backdoor EternalPetya Regin WannaCryptor XTunnel
2018-06-15Youtube (defconswitzerland)Costin Raiu
@online{raiu:20180615:area41:6009950, author = {Costin Raiu}, title = {{Area41 Keynote}}, date = {2018-06-15}, organization = {Youtube (defconswitzerland)}, url = {https://www.youtube.com/watch?v=jeLd-gw2bWo}, language = {English}, urldate = {2020-01-09} } Area41 Keynote
Lambert Regin
2016-08-08SymantecA L Johnson
@online{johnson:20160808:strider:49d9d44, author = {A L Johnson}, title = {{Strider: Cyberespionage group turns eye of Sauron on targets}}, date = {2016-08-08}, organization = {Symantec}, url = {https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=ce2df4da-afe9-4a24-b28c-0fb3ba671d95&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments}, language = {English}, urldate = {2020-04-21} } Strider: Cyberespionage group turns eye of Sauron on targets
Flame Regin Remsec ProjectSauron
2015-08-27SymantecSymantec Security Response
@techreport{response:20150827:regin:5a5257b, author = {Symantec Security Response}, title = {{Regin: Top-tier espionage tool enables stealthy surveillance}}, date = {2015-08-27}, institution = {Symantec}, url = {https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/regin-top-tier-espionage-tool-15-en.pdf}, language = {English}, urldate = {2020-01-20} } Regin: Top-tier espionage tool enables stealthy surveillance
Regin
2014-11-25Kaspersky LabsBrain Donohue
@online{donohue:20141125:regin:15d544f, author = {Brain Donohue}, title = {{Regin APT Attacks Among the Most Sophisticated Ever Analyzed}}, date = {2014-11-25}, organization = {Kaspersky Labs}, url = {https://www.kaspersky.com/blog/regin-apt-most-sophisticated/6852/}, language = {English}, urldate = {2019-12-17} } Regin APT Attacks Among the Most Sophisticated Ever Analyzed
Regin
Yara Rules
[TLP:WHITE] win_regin_auto (20201023 | autogenerated rule brought to you by yara-signator)
rule win_regin_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-12-22"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.regin"
        malpedia_rule_date = "20201222"
        malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130"
        malpedia_version = "20201023"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { eb04 8b5c2448 48 8b6c2450 48 8b742458 8bc3 }
            // n = 7, score = 100
            //   eb04                 | jmp                 6
            //   8b5c2448             | mov                 ebx, dword ptr [esp + 0x48]
            //   48                   | dec                 eax
            //   8b6c2450             | mov                 ebp, dword ptr [esp + 0x50]
            //   48                   | dec                 eax
            //   8b742458             | mov                 esi, dword ptr [esp + 0x58]
            //   8bc3                 | mov                 eax, ebx

        $sequence_1 = { 48 85c9 7412 4d 85c0 740d 4c }
            // n = 7, score = 100
            //   48                   | dec                 eax
            //   85c9                 | test                ecx, ecx
            //   7412                 | je                  0x14
            //   4d                   | dec                 ebp
            //   85c0                 | test                eax, eax
            //   740d                 | je                  0xf
            //   4c                   | dec                 esp

        $sequence_2 = { 33ff e8???????? 40 3ac7 }
            // n = 4, score = 100
            //   33ff                 | xor                 edi, edi
            //   e8????????           |                     
            //   40                   | inc                 eax
            //   3ac7                 | cmp                 al, bh

        $sequence_3 = { 83ec20 4c 8bc1 48 8bf9 33c0 48 }
            // n = 7, score = 100
            //   83ec20               | sub                 esp, 0x20
            //   4c                   | dec                 esp
            //   8bc1                 | mov                 eax, ecx
            //   48                   | dec                 eax
            //   8bf9                 | mov                 edi, ecx
            //   33c0                 | xor                 eax, eax
            //   48                   | dec                 eax

        $sequence_4 = { 85c9 742f 49 8bd4 44 }
            // n = 5, score = 100
            //   85c9                 | test                ecx, ecx
            //   742f                 | je                  0x31
            //   49                   | dec                 ecx
            //   8bd4                 | mov                 edx, esp
            //   44                   | inc                 esp

        $sequence_5 = { c1e802 41 ffc0 48 8d4c2470 41 b904000000 }
            // n = 7, score = 100
            //   c1e802               | shr                 eax, 2
            //   41                   | inc                 ecx
            //   ffc0                 | inc                 eax
            //   48                   | dec                 eax
            //   8d4c2470             | lea                 ecx, [esp + 0x70]
            //   41                   | inc                 ecx
            //   b904000000           | mov                 ecx, 4

        $sequence_6 = { 49 03d4 48 8364242000 4c 8d4c2468 }
            // n = 6, score = 100
            //   49                   | dec                 ecx
            //   03d4                 | add                 edx, esp
            //   48                   | dec                 eax
            //   8364242000           | and                 dword ptr [esp + 0x20], 0
            //   4c                   | dec                 esp
            //   8d4c2468             | lea                 ecx, [esp + 0x68]

        $sequence_7 = { 7566 48 8d351c070000 48 8bcb 40 b701 }
            // n = 7, score = 100
            //   7566                 | jne                 0x68
            //   48                   | dec                 eax
            //   8d351c070000         | lea                 esi, [0x71c]
            //   48                   | dec                 eax
            //   8bcb                 | mov                 ecx, ebx
            //   40                   | inc                 eax
            //   b701                 | mov                 bh, 1

        $sequence_8 = { 4c 89742420 e8???????? 83f8ff }
            // n = 4, score = 100
            //   4c                   | dec                 esp
            //   89742420             | mov                 dword ptr [esp + 0x20], esi
            //   e8????????           |                     
            //   83f8ff               | cmp                 eax, -1

        $sequence_9 = { 41 894500 8bd8 e8???????? 49 890424 }
            // n = 6, score = 100
            //   41                   | inc                 ecx
            //   894500               | mov                 dword ptr [ebp], eax
            //   8bd8                 | mov                 ebx, eax
            //   e8????????           |                     
            //   49                   | dec                 ecx
            //   890424               | mov                 dword ptr [esp], eax

    condition:
        7 of them and filesize < 49152
}
Download all Yara Rules