Actor(s): Mirage
RoyalDNS is a DNS based backdoor used by APT15 that persistences on a system through a service called 'Nwsapagent'.
rule win_royal_dns_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-04-08" version = "1" description = "Detects win.royal_dns." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.royal_dns" malpedia_rule_date = "20220405" malpedia_hash = "ecd38294bd47d5589be5cd5490dc8bb4804afc2a" malpedia_version = "20220411" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 80e101 0ad9 32c0 68ff000000 02db 24f5 } // n = 6, score = 100 // 80e101 | and cl, 1 // 0ad9 | or bl, cl // 32c0 | xor al, al // 68ff000000 | push 0xff // 02db | add bl, bl // 24f5 | and al, 0xf5 $sequence_1 = { fe06 8a1401 881437 47 eb0a 03f7 } // n = 6, score = 100 // fe06 | inc byte ptr [esi] // 8a1401 | mov dl, byte ptr [ecx + eax] // 881437 | mov byte ptr [edi + esi], dl // 47 | inc edi // eb0a | jmp 0xc // 03f7 | add esi, edi $sequence_2 = { 83ee02 7417 4e 7520 8bc1 c1e810 } // n = 6, score = 100 // 83ee02 | sub esi, 2 // 7417 | je 0x19 // 4e | dec esi // 7520 | jne 0x22 // 8bc1 | mov eax, ecx // c1e810 | shr eax, 0x10 $sequence_3 = { 4a 759a 8b55fc 85ff 7468 0fb606 c1e802 } // n = 7, score = 100 // 4a | dec edx // 759a | jne 0xffffff9c // 8b55fc | mov edx, dword ptr [ebp - 4] // 85ff | test edi, edi // 7468 | je 0x6a // 0fb606 | movzx eax, byte ptr [esi] // c1e802 | shr eax, 2 $sequence_4 = { 83ec20 a1???????? 33c5 8945fc 8b4508 33c9 8d55e0 } // n = 7, score = 100 // 83ec20 | sub esp, 0x20 // a1???????? | // 33c5 | xor eax, ebp // 8945fc | mov dword ptr [ebp - 4], eax // 8b4508 | mov eax, dword ptr [ebp + 8] // 33c9 | xor ecx, ecx // 8d55e0 | lea edx, dword ptr [ebp - 0x20] $sequence_5 = { 8a08 80e104 0fb6c9 4e 33d2 f7d9 1bc9 } // n = 7, score = 100 // 8a08 | mov cl, byte ptr [eax] // 80e104 | and cl, 4 // 0fb6c9 | movzx ecx, cl // 4e | dec esi // 33d2 | xor edx, edx // f7d9 | neg ecx // 1bc9 | sbb ecx, ecx $sequence_6 = { 8b0f 6683790600 0f86e7000000 680a010000 } // n = 4, score = 100 // 8b0f | mov ecx, dword ptr [edi] // 6683790600 | cmp word ptr [ecx + 6], 0 // 0f86e7000000 | jbe 0xed // 680a010000 | push 0x10a $sequence_7 = { 8985b4fcffff 8bf8 6a08 e8???????? } // n = 4, score = 100 // 8985b4fcffff | mov dword ptr [ebp - 0x34c], eax // 8bf8 | mov edi, eax // 6a08 | push 8 // e8???????? | $sequence_8 = { 83c40c 68fd000000 8995d0faffff 8d95d7faffff 6a00 } // n = 5, score = 100 // 83c40c | add esp, 0xc // 68fd000000 | push 0xfd // 8995d0faffff | mov dword ptr [ebp - 0x530], edx // 8d95d7faffff | lea edx, dword ptr [ebp - 0x529] // 6a00 | push 0 $sequence_9 = { c0e205 0ac2 8a55f7 885dec } // n = 4, score = 100 // c0e205 | shl dl, 5 // 0ac2 | or al, dl // 8a55f7 | mov dl, byte ptr [ebp - 9] // 885dec | mov byte ptr [ebp - 0x14], bl condition: 7 of them and filesize < 204800 }
import "pe" rule win_royal_dns_w0 { meta: author = "Florian Roth" description = "Detects malware from APT 15 report by NCC Group" reference = "https://goo.gl/HZ5XMN" date = "2018-03-10" hash = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.royal_dns" malpedia_version = "20180312" malpedia_license = "CC BY-NC-SA 4.0" malpedia_sharing = "TLP:WHITE" strings: $x1 = "del c:\\windows\\temp\\r.exe /f /q" fullword ascii $x2 = "%s\\r.exe" fullword ascii $s1 = "rights.dll" fullword ascii $s2 = "\"%s\">>\"%s\"\\s.txt" fullword ascii $s3 = "Nwsapagent" fullword ascii $s4 = "%s\\r.bat" fullword ascii $s5 = "%s\\s.txt" fullword ascii $s6 = "runexe" fullword ascii condition: 1 of ($x*) or 2 of them }
rule win_royal_dns_w1 { meta: author = "David Cannings" description = "DLL implant, originally rights.dll and runs as a service" hash = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.royal_dns" malpedia_version = "20180312" malpedia_license = "CC BY-NC-SA 4.0" malpedia_sharing = "TLP:WHITE" strings: /* 56 push esi B8 A7 C6 67 4E mov eax, 4E67C6A7h 83 C1 02 add ecx, 2 BA 04 00 00 00 mov edx, 4 57 push edi 90 nop */ // JSHash implementation (Justin Sobel's hash algorithm) $opcodes_jshash = { B8 A7 C6 67 4E 83 C1 02 BA 04 00 00 00 57 90 } /* 0F B6 1C 03 movzx ebx, byte ptr [ebx+eax] 8B 55 08 mov edx, [ebp+arg_0] 30 1C 17 xor [edi+edx], bl 47 inc edi 3B 7D 0C cmp edi, [ebp+arg_4] 72 A4 jb short loc_10003F31 */ // Encode loop, used to "encrypt" data before DNS request $opcodes_encode = { 0F B6 1C 03 8B 55 08 30 1C 17 47 3B 7D 0C } /* 68 88 13 00 00 push 5000 # Also seen 3000, included below FF D6 call esi ; Sleep 4F dec edi 75 F6 jnz short loc_10001554 */ // Sleep loop $opcodes_sleep_loop = { 68 (88|B8) (13|0B) 00 00 FF D6 4F 75 F6 } // Generic strings $ = "Nwsapagent" fullword $ = "\"%s\">>\"%s\"\\s.txt" $ = "myWObject" fullword $ = "del c:\\windows\\temp\\r.exe /f /q" $ = "del c:\\windows\\temp\\r.ini /f /q" condition: 3 of them }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY