SYMBOLCOMMON_NAMEaka. SYNONYMS
win.regin (Back to overview)

Regin


Regin is a sophisticated malware and hacking toolkit attributed to United States' National Security Agency (NSA) for government spying operations. It was first publicly revealed by Kaspersky Lab, Symantec, and The Intercept in November 2014. Regin malware targeted victims in a range of industries, telecom, government, and financial institutions. It was engineered to be modular and over time dozens of modules have been found and attributed to this family. Symantec observed around 100 infections in 10 different countries across a variety of organisations including private companies, government entities, and research institutes.

References
2021-02-05EpicTurlaJuan Andrés Guerrero-Saade
@online{guerrerosaade:20210205:voltron:953cec2, author = {Juan Andrés Guerrero-Saade}, title = {{Voltron STA The curious case of 0xFancyFilter}}, date = {2021-02-05}, organization = {EpicTurla}, url = {https://www.epicturla.com/previous-works/hitb2020-voltron-sta}, language = {English}, urldate = {2021-02-06} } Voltron STA The curious case of 0xFancyFilter
fancyfilter MISTYVEAL Regin
2020-06-09Kaspersky LabsCostin Raiu
@online{raiu:20200609:looking:3038dce, author = {Costin Raiu}, title = {{Looking at Big Threats Using Code Similarity. Part 1}}, date = {2020-06-09}, organization = {Kaspersky Labs}, url = {https://securelist.com/big-threats-using-code-similarity-part-1/97239/}, language = {English}, urldate = {2020-08-18} } Looking at Big Threats Using Code Similarity. Part 1
Penquin Turla CCleaner Backdoor EternalPetya Regin WannaCryptor XTunnel
2018-06-15Youtube (defconswitzerland)Costin Raiu
@online{raiu:20180615:area41:6009950, author = {Costin Raiu}, title = {{Area41 Keynote}}, date = {2018-06-15}, organization = {Youtube (defconswitzerland)}, url = {https://www.youtube.com/watch?v=jeLd-gw2bWo}, language = {English}, urldate = {2020-01-09} } Area41 Keynote
Lambert Regin
2016-08-08SymantecA L Johnson
@online{johnson:20160808:strider:49d9d44, author = {A L Johnson}, title = {{Strider: Cyberespionage group turns eye of Sauron on targets}}, date = {2016-08-08}, organization = {Symantec}, url = {https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=ce2df4da-afe9-4a24-b28c-0fb3ba671d95&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments}, language = {English}, urldate = {2020-04-21} } Strider: Cyberespionage group turns eye of Sauron on targets
Flame Regin Remsec ProjectSauron
2015-08-27SymantecSymantec Security Response
@techreport{response:20150827:regin:5a5257b, author = {Symantec Security Response}, title = {{Regin: Top-tier espionage tool enables stealthy surveillance}}, date = {2015-08-27}, institution = {Symantec}, url = {https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/regin-top-tier-espionage-tool-15-en.pdf}, language = {English}, urldate = {2020-01-20} } Regin: Top-tier espionage tool enables stealthy surveillance
Regin
2014-11-25Kaspersky LabsBrain Donohue
@online{donohue:20141125:regin:15d544f, author = {Brain Donohue}, title = {{Regin APT Attacks Among the Most Sophisticated Ever Analyzed}}, date = {2014-11-25}, organization = {Kaspersky Labs}, url = {https://www.kaspersky.com/blog/regin-apt-most-sophisticated/6852/}, language = {English}, urldate = {2019-12-17} } Regin APT Attacks Among the Most Sophisticated Ever Analyzed
Regin
2014-11-24KasperskyGReAT
@online{great:20141124:regin:281a556, author = {GReAT}, title = {{Regin: nation-state ownage of GSM networks}}, date = {2014-11-24}, organization = {Kaspersky}, url = {https://securelist.com/regin-nation-state-ownage-of-gsm-networks/67741/}, language = {English}, urldate = {2022-03-22} } Regin: nation-state ownage of GSM networks
Regin
2014-11-24KasperskyKaspersky Lab
@techreport{lab:20141124:regin:b19cdc4, author = {Kaspersky Lab}, title = {{The Regin Platform Nation-State Ownage Of GSM Networks}}, date = {2014-11-24}, institution = {Kaspersky}, url = {https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070305/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf}, language = {English}, urldate = {2022-03-22} } The Regin Platform Nation-State Ownage Of GSM Networks
Regin
Yara Rules
[TLP:WHITE] win_regin_auto (20220516 | Detects win.regin.)
rule win_regin_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-05-16"
        version = "1"
        description = "Detects win.regin."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.regin"
        malpedia_rule_date = "20220513"
        malpedia_hash = "7f4b2229e6ae614d86d74917f6d5b41890e62a26"
        malpedia_version = "20220516"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8bce e8???????? 40 0fb6cf }
            // n = 4, score = 100
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     
            //   40                   | inc                 eax
            //   0fb6cf               | movzx               ecx, bh

        $sequence_1 = { 41 b801000000 48 3bca }
            // n = 4, score = 100
            //   41                   | inc                 ecx
            //   b801000000           | mov                 eax, 1
            //   48                   | dec                 eax
            //   3bca                 | cmp                 ecx, edx

        $sequence_2 = { 8b05???????? 39442460 7405 bb01000000 85db 0f8530010000 }
            // n = 6, score = 100
            //   8b05????????         |                     
            //   39442460             | cmp                 dword ptr [esp + 0x60], eax
            //   7405                 | je                  7
            //   bb01000000           | mov                 ebx, 1
            //   85db                 | test                ebx, ebx
            //   0f8530010000         | jne                 0x136

        $sequence_3 = { 85c0 7413 49 8bf8 33c0 48 8bca }
            // n = 7, score = 100
            //   85c0                 | test                eax, eax
            //   7413                 | je                  0x15
            //   49                   | dec                 ecx
            //   8bf8                 | mov                 edi, eax
            //   33c0                 | xor                 eax, eax
            //   48                   | dec                 eax
            //   8bca                 | mov                 ecx, edx

        $sequence_4 = { 8b0b ff15???????? 3bc7 740d 33c0 48 }
            // n = 6, score = 100
            //   8b0b                 | mov                 ecx, dword ptr [ebx]
            //   ff15????????         |                     
            //   3bc7                 | cmp                 eax, edi
            //   740d                 | je                  0xf
            //   33c0                 | xor                 eax, eax
            //   48                   | dec                 eax

        $sequence_5 = { 44 8bcb 48 8bcf 89442420 c744244018000000 }
            // n = 6, score = 100
            //   44                   | inc                 esp
            //   8bcb                 | mov                 ecx, ebx
            //   48                   | dec                 eax
            //   8bcf                 | mov                 ecx, edi
            //   89442420             | mov                 dword ptr [esp + 0x20], eax
            //   c744244018000000     | mov                 dword ptr [esp + 0x40], 0x18

        $sequence_6 = { 8943d8 48 8d0581ffffff 49 8d4bd8 }
            // n = 5, score = 100
            //   8943d8               | mov                 dword ptr [ebx - 0x28], eax
            //   48                   | dec                 eax
            //   8d0581ffffff         | lea                 eax, [0xffffff81]
            //   49                   | dec                 ecx
            //   8d4bd8               | lea                 ecx, [ebx - 0x28]

        $sequence_7 = { 894500 8bd8 e8???????? 49 890424 48 85c0 }
            // n = 7, score = 100
            //   894500               | mov                 dword ptr [ebp], eax
            //   8bd8                 | mov                 ebx, eax
            //   e8????????           |                     
            //   49                   | dec                 ecx
            //   890424               | mov                 dword ptr [esp], eax
            //   48                   | dec                 eax
            //   85c0                 | test                eax, eax

        $sequence_8 = { 41 ffc0 48 8d4c2470 }
            // n = 4, score = 100
            //   41                   | inc                 ecx
            //   ffc0                 | inc                 eax
            //   48                   | dec                 eax
            //   8d4c2470             | lea                 ecx, [esp + 0x70]

        $sequence_9 = { 8bd3 ff15???????? 48 8905???????? }
            // n = 4, score = 100
            //   8bd3                 | mov                 edx, ebx
            //   ff15????????         |                     
            //   48                   | dec                 eax
            //   8905????????         |                     

    condition:
        7 of them and filesize < 49152
}
Download all Yara Rules