SYMBOLCOMMON_NAMEaka. SYNONYMS
win.sedreco (Back to overview)

Sedreco

aka: azzy, eviltoss

Actor(s): Sofacy


There is no description at this point.

References
2020SecureworksSecureWorks
@online{secureworks:2020:iron:48c68a0, author = {SecureWorks}, title = {{IRON TWILIGHT}}, date = {2020}, organization = {Secureworks}, url = {https://www.secureworks.com/research/threat-profiles/iron-twilight}, language = {English}, urldate = {2020-05-23} } IRON TWILIGHT
X-Agent X-Agent X-Agent Computrace HideDRV Sedreco Seduploader X-Agent XTunnel Zebrocy Zebrocy (AutoIT)
2017-02-20Contagio DumpMila Parkour
@online{parkour:20170220:part:c54b5de, author = {Mila Parkour}, title = {{Part I. Russian APT - APT28 collection of samples including OSX XAgent}}, date = {2017-02-20}, organization = {Contagio Dump}, url = {https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html}, language = {English}, urldate = {2019-11-26} } Part I. Russian APT - APT28 collection of samples including OSX XAgent
X-Agent Komplex Coreshell Downdelph HideDRV SEADADDY Sedreco Seduploader X-Agent XTunnel
2016-10-20ESET ResearchESET Research
@techreport{research:20161020:en:e2e6603, author = {ESET Research}, title = {{En Route with Sednit Part 2: Observing the Comings and Goings}}, date = {2016-10-20}, institution = {ESET Research}, url = {http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf}, language = {English}, urldate = {2019-10-25} } En Route with Sednit Part 2: Observing the Comings and Goings
X-Agent Sedreco X-Agent XTunnel
2015-12-04Kaspersky LabsGReAT
@online{great:20151204:sofacy:664b5a8, author = {GReAT}, title = {{Sofacy APT hits high profile targets with updated toolset}}, date = {2015-12-04}, organization = {Kaspersky Labs}, url = {https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/}, language = {English}, urldate = {2019-12-20} } Sofacy APT hits high profile targets with updated toolset
Sedreco
2015-12-04Kaspersky LabsGReAT
@online{great:20151204:sofacy:b437b35, author = {GReAT}, title = {{Sofacy APT hits high profile targets with updated toolset}}, date = {2015-12-04}, organization = {Kaspersky Labs}, url = {https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/}, language = {English}, urldate = {2020-08-30} } Sofacy APT hits high profile targets with updated toolset
Coreshell Sedreco Seduploader X-Agent Sofacy
2014-10-27Trend MicroLoucif Kharouni, Feike Hacquebord, Numaan Huq, Jim Gogolinski, Fernando Mercês, Alfred Remorin, Douglas Otis
@techreport{kharouni:20141027:operation:1b13f15, author = {Loucif Kharouni and Feike Hacquebord and Numaan Huq and Jim Gogolinski and Fernando Mercês and Alfred Remorin and Douglas Otis}, title = {{Operation Pawn Storm: Using Decoys to Evade Detection}}, date = {2014-10-27}, institution = {Trend Micro}, url = {https://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-pawn-storm.pdf}, language = {English}, urldate = {2020-09-15} } Operation Pawn Storm: Using Decoys to Evade Detection
Sedreco Seduploader Sofacy
2014FireEyeFireEye
@techreport{fireeye:2014:apt28:27799d1, author = {FireEye}, title = {{APT28}}, date = {2014}, institution = {FireEye}, url = {http://www2.fireeye.com/rs/fireye/images/rpt-apt28.pdf}, language = {English}, urldate = {2020-01-08} } APT28
Coreshell Sedreco X-Agent
2012-12-15R136a1
@online{r136a1:20121215:disclosure:fdfe8f2, author = {R136a1}, title = {{Disclosure of another 0day malware - Analysis of 2nd Dropper and 3rd Dropper (Part 2)}}, date = {2012-12-15}, url = {http://www.malware-reversing.com/2012/12/3-disclosure-of-another-0day-malware_15.html}, language = {English}, urldate = {2019-12-31} } Disclosure of another 0day malware - Analysis of 2nd Dropper and 3rd Dropper (Part 2)
Sedreco
Yara Rules
[TLP:WHITE] win_sedreco_auto (20210616 | Detects win.sedreco.)
rule win_sedreco_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-06-10"
        version = "1"
        description = "Detects win.sedreco."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sedreco"
        malpedia_rule_date = "20210604"
        malpedia_hash = "be09d5d71e77373c0f538068be31a2ad4c69cfbd"
        malpedia_version = "20210616"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b750c 56 e8???????? 6a08 }
            // n = 4, score = 2600
            //   8b750c               | mov                 esi, dword ptr [ebp + 0xc]
            //   56                   | push                esi
            //   e8????????           |                     
            //   6a08                 | push                8

        $sequence_1 = { 55 8bec 51 836d0804 53 }
            // n = 5, score = 2600
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   51                   | push                ecx
            //   836d0804             | sub                 dword ptr [ebp + 8], 4
            //   53                   | push                ebx

        $sequence_2 = { c645ff30 e8???????? 85c0 7505 e8???????? }
            // n = 5, score = 2600
            //   c645ff30             | mov                 byte ptr [ebp - 1], 0x30
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7505                 | jne                 7
            //   e8????????           |                     

        $sequence_3 = { e8???????? 89450c 56 85c0 }
            // n = 4, score = 2600
            //   e8????????           |                     
            //   89450c               | mov                 dword ptr [ebp + 0xc], eax
            //   56                   | push                esi
            //   85c0                 | test                eax, eax

        $sequence_4 = { 836d0804 53 56 8b750c }
            // n = 4, score = 2600
            //   836d0804             | sub                 dword ptr [ebp + 8], 4
            //   53                   | push                ebx
            //   56                   | push                esi
            //   8b750c               | mov                 esi, dword ptr [ebp + 0xc]

        $sequence_5 = { 50 68???????? 6a0d 68???????? }
            // n = 4, score = 2500
            //   50                   | push                eax
            //   68????????           |                     
            //   6a0d                 | push                0xd
            //   68????????           |                     

        $sequence_6 = { 51 6802020000 68???????? 50 }
            // n = 4, score = 2400
            //   51                   | push                ecx
            //   6802020000           | sub                 dword ptr [ebp + 8], 4
            //   68????????           |                     
            //   50                   | push                ebx

        $sequence_7 = { 7411 6a04 68???????? 68???????? e8???????? }
            // n = 5, score = 2400
            //   7411                 | je                  0x13
            //   6a04                 | push                4
            //   68????????           |                     
            //   68????????           |                     
            //   e8????????           |                     

        $sequence_8 = { 7ce0 a1???????? 5e 85c0 }
            // n = 4, score = 2400
            //   7ce0                 | jl                  0xffffffe2
            //   a1????????           |                     
            //   5e                   | pop                 esi
            //   85c0                 | test                eax, eax

        $sequence_9 = { ffd6 8b0d???????? 894138 85c0 }
            // n = 4, score = 2200
            //   ffd6                 | mov                 ebp, esp
            //   8b0d????????         |                     
            //   894138               | push                ecx
            //   85c0                 | sub                 dword ptr [ebp + 8], 4

        $sequence_10 = { 57 8b3d???????? 56 683f000f00 6a00 }
            // n = 5, score = 2200
            //   57                   | push                ecx
            //   8b3d????????         |                     
            //   56                   | sub                 dword ptr [ebp + 8], 4
            //   683f000f00           | push                ebx
            //   6a00                 | push                ebp

        $sequence_11 = { ffd6 8b0d???????? 898150010000 85c0 }
            // n = 4, score = 2200
            //   ffd6                 | test                eax, eax
            //   8b0d????????         |                     
            //   898150010000         | jne                 0xd
            //   85c0                 | push                ebp

        $sequence_12 = { ffd6 8b0d???????? 894118 85c0 }
            // n = 4, score = 2200
            //   ffd6                 | push                ecx
            //   8b0d????????         |                     
            //   894118               | sub                 dword ptr [ebp + 8], 4
            //   85c0                 | push                ebx

        $sequence_13 = { ffd6 ffd0 a3???????? 5e 85c0 }
            // n = 5, score = 2200
            //   ffd6                 | push                ecx
            //   ffd0                 | sub                 dword ptr [ebp + 8], 4
            //   a3????????           |                     
            //   5e                   | mov                 byte ptr [ebp - 1], 0x30
            //   85c0                 | test                eax, eax

        $sequence_14 = { ffd6 8b0d???????? 898168010000 85c0 }
            // n = 4, score = 2200
            //   ffd6                 | jne                 9
            //   8b0d????????         |                     
            //   898168010000         | push                ecx
            //   85c0                 | sub                 dword ptr [ebp + 8], 4

        $sequence_15 = { 6a01 68???????? ff35???????? ff15???????? ffd0 }
            // n = 5, score = 1100
            //   6a01                 | push                ebp
            //   68????????           |                     
            //   ff35????????         |                     
            //   ff15????????         |                     
            //   ffd0                 | mov                 ebp, esp

        $sequence_16 = { 33d2 488b0d???????? ff15???????? 90 }
            // n = 4, score = 500
            //   33d2                 | dec                 eax
            //   488b0d????????       |                     
            //   ff15????????         |                     
            //   90                   | add                 esp, 0x28

        $sequence_17 = { 6800010000 6a00 68???????? e8???????? 6800020000 6a00 }
            // n = 6, score = 500
            //   6800010000           | sub                 dword ptr [ebp + 8], 4
            //   6a00                 | jl                  0xffffffe2
            //   68????????           |                     
            //   e8????????           |                     
            //   6800020000           | pop                 esi
            //   6a00                 | test                eax, eax

        $sequence_18 = { 4533c9 4533c0 ba00000080 488b0d???????? 488b05???????? ff5040 }
            // n = 6, score = 500
            //   4533c9               | xor                 edx, edx
            //   4533c0               | dec                 eax
            //   ba00000080           | mov                 ecx, eax
            //   488b0d????????       |                     
            //   488b05????????       |                     
            //   ff5040               | call                dword ptr [eax + 0xe0]

        $sequence_19 = { 488b0d???????? 488b05???????? ff90e8000000 ba10270000 488b0d???????? 488b05???????? }
            // n = 6, score = 500
            //   488b0d????????       |                     
            //   488b05????????       |                     
            //   ff90e8000000         | call                dword ptr [eax + 0x1a8]
            //   ba10270000           | inc                 ebp
            //   488b0d????????       |                     
            //   488b05????????       |                     

        $sequence_20 = { 8b35???????? 83c404 6a00 68???????? 6aff 68???????? }
            // n = 6, score = 500
            //   8b35????????         |                     
            //   83c404               | push                esi
            //   6a00                 | push                8
            //   68????????           |                     
            //   6aff                 | push                ecx
            //   68????????           |                     

        $sequence_21 = { 488b05???????? ff90e0000000 488b0d???????? 488b05???????? ff90a8010000 }
            // n = 5, score = 500
            //   488b05????????       |                     
            //   ff90e0000000         | inc                 ebp
            //   488b0d????????       |                     
            //   488b05????????       |                     
            //   ff90a8010000         | xor                 eax, eax

        $sequence_22 = { 68???????? 6aff 68???????? 6a00 6a00 ffd6 8b4dfc }
            // n = 7, score = 500
            //   68????????           |                     
            //   6aff                 | push                ebx
            //   68????????           |                     
            //   6a00                 | push                esi
            //   6a00                 | mov                 esi, dword ptr [ebp + 0xc]
            //   ffd6                 | mov                 dword ptr [ebp + 0xc], eax
            //   8b4dfc               | push                esi

        $sequence_23 = { 4533c9 4533c0 33d2 488bc8 488b05???????? }
            // n = 5, score = 500
            //   4533c9               | add                 esp, 0x28
            //   4533c0               | ret                 
            //   33d2                 | inc                 ebp
            //   488bc8               | xor                 ecx, ecx
            //   488b05????????       |                     

        $sequence_24 = { 488b442450 4889442420 41b903000000 4533c0 }
            // n = 4, score = 500
            //   488b442450           | ret                 
            //   4889442420           | dec                 eax
            //   41b903000000         | mov                 dword ptr [esp + 8], ebx
            //   4533c0               | push                edi

        $sequence_25 = { eb04 4883c010 4883c428 c3 48890d???????? }
            // n = 5, score = 500
            //   eb04                 | jmp                 6
            //   4883c010             | dec                 eax
            //   4883c428             | add                 eax, 0x10
            //   c3                   | dec                 eax
            //   48890d????????       |                     

        $sequence_26 = { 6a00 ffd6 50 68???????? 6aff }
            // n = 5, score = 500
            //   6a00                 | push                eax
            //   ffd6                 | push                -1
            //   50                   | call                esi
            //   68????????           |                     
            //   6aff                 | push                eax

        $sequence_27 = { c705????????01000000 33c0 4883c428 c3 48895c2408 57 4883ec20 }
            // n = 7, score = 500
            //   c705????????01000000     |     
            //   33c0                 | call                dword ptr [eax + 0x40]
            //   4883c428             | dec                 eax
            //   c3                   | add                 esp, 0x28
            //   48895c2408           | ret                 
            //   57                   | ret                 
            //   4883ec20             | dec                 eax

        $sequence_28 = { ff15???????? 6a10 6a01 68???????? 68???????? }
            // n = 5, score = 500
            //   ff15????????         |                     
            //   6a10                 | mov                 byte ptr [ebp - 1], 0x30
            //   6a01                 | test                eax, eax
            //   68????????           |                     
            //   68????????           |                     

        $sequence_29 = { 68???????? e8???????? 8b35???????? 83c404 6a00 }
            // n = 5, score = 500
            //   68????????           |                     
            //   e8????????           |                     
            //   8b35????????         |                     
            //   83c404               | push                0
            //   6a00                 | call                esi

        $sequence_30 = { 7cd5 68???????? e8???????? 8b4dfc }
            // n = 4, score = 400
            //   7cd5                 | push                0x100
            //   68????????           |                     
            //   e8????????           |                     
            //   8b4dfc               | push                0

        $sequence_31 = { 6a00 ffd6 8b4dfc 5f 5e 33cd b8???????? }
            // n = 7, score = 400
            //   6a00                 | push                0
            //   ffd6                 | add                 esp, 4
            //   8b4dfc               | push                0
            //   5f                   | push                -1
            //   5e                   | push                0
            //   33cd                 | push                0
            //   b8????????           |                     

        $sequence_32 = { ff512c 8bce 8bd8 e8???????? 57 ff15???????? }
            // n = 6, score = 200
            //   ff512c               | jmp                 0xf
            //   8bce                 | push                0x493e0
            //   8bd8                 | push                ebx
            //   e8????????           |                     
            //   57                   | push                esi
            //   ff15????????         |                     

        $sequence_33 = { 8d443001 6a00 51 50 56 57 }
            // n = 6, score = 200
            //   8d443001             | call                esi
            //   6a00                 | mov                 dword ptr [ecx + 0x140], eax
            //   51                   | test                eax, eax
            //   50                   | push                6
            //   56                   | push                2
            //   57                   | push                0

        $sequence_34 = { 53 56 57 c785ecfeffff01000000 c785e8feffffe197af54 0f6e85e8feffff 0f72f002 }
            // n = 7, score = 200
            //   53                   | call                esi
            //   56                   | call                eax
            //   57                   | pop                 esi
            //   c785ecfeffff01000000     | test    eax, eax
            //   c785e8feffffe197af54     | call    esi
            //   0f6e85e8feffff       | mov                 dword ptr [ecx + 0x168], eax
            //   0f72f002             | test                eax, eax

        $sequence_35 = { 57 894df0 ff15???????? 8945fc 8b45f0 }
            // n = 5, score = 200
            //   57                   | push                edi
            //   894df0               | push                edi
            //   ff15????????         |                     
            //   8945fc               | push                eax
            //   8b45f0               | call                dword ptr [ecx + 0x2c]

        $sequence_36 = { 6a06 6a02 6a00 6a00 6800000040 68???????? }
            // n = 6, score = 200
            //   6a06                 | push                ecx
            //   6a02                 | sub                 dword ptr [ebp + 8], 4
            //   6a00                 | push                ebx
            //   6a00                 | push                esi
            //   6800000040           | mov                 ebp, esp
            //   68????????           |                     

        $sequence_37 = { 8bec 83ec24 53 56 57 c745dce197af54 }
            // n = 6, score = 200
            //   8bec                 | pslld               mm0, 2
            //   83ec24               | lea                 eax, dword ptr [eax + esi + 1]
            //   53                   | push                0
            //   56                   | push                ecx
            //   57                   | push                eax
            //   c745dce197af54       | push                esi

        $sequence_38 = { 68???????? e8???????? 85c0 7402 eb0d 68e0930400 }
            // n = 6, score = 200
            //   68????????           |                     
            //   e8????????           |                     
            //   85c0                 | mov                 esi, dword ptr [ebp + 0xc]
            //   7402                 | jl                  0xffffffe2
            //   eb0d                 | pop                 esi
            //   68e0930400           | test                eax, eax

        $sequence_39 = { 52 57 50 ff512c 8bce 8bd8 }
            // n = 6, score = 200
            //   52                   | push                ecx
            //   57                   | sub                 dword ptr [ebp + 8], 4
            //   50                   | push                ebx
            //   ff512c               | sub                 dword ptr [ebp + 8], 4
            //   8bce                 | push                ebx
            //   8bd8                 | push                esi

        $sequence_40 = { 5b 83c424 c21000 49 51 }
            // n = 5, score = 100
            //   5b                   | pop                 esi
            //   83c424               | call                esi
            //   c21000               | mov                 ecx, dword ptr [ebp - 4]
            //   49                   | pop                 edi
            //   51                   | pop                 esi

        $sequence_41 = { c6003d 8b4c2420 89742424 c6043100 4f 75b3 }
            // n = 6, score = 100
            //   c6003d               | push                0
            //   8b4c2420             | call                esi
            //   89742424             | mov                 ecx, dword ptr [ebp - 4]
            //   c6043100             | pop                 edi
            //   4f                   | pop                 esi
            //   75b3                 | xor                 ecx, ebp

        $sequence_42 = { 0f84b1000000 8a542413 56 8d4c242c }
            // n = 4, score = 100
            //   0f84b1000000         | push                0
            //   8a542413             | call                esi
            //   56                   | mov                 ecx, dword ptr [ebp - 4]
            //   8d4c242c             | pop                 edi

        $sequence_43 = { c7442414d4522500 51 8d4c2434 ff15???????? 8d542430 }
            // n = 5, score = 100
            //   c7442414d4522500     | push                0x100
            //   51                   | push                0
            //   8d4c2434             | pop                 ebx
            //   ff15????????         |                     
            //   8d542430             | push                0x100

        $sequence_44 = { 895e08 895e0c 68???????? 895c2420 }
            // n = 4, score = 100
            //   895e08               | pop                 ebx
            //   895e0c               | mov                 ecx, dword ptr [ebp - 4]
            //   68????????           |                     
            //   895c2420             | pop                 edi

        $sequence_45 = { 8a18 8b02 8b542424 2bc2 83f801 }
            // n = 5, score = 100
            //   8a18                 | xor                 ecx, ebp
            //   8b02                 | mov                 ecx, dword ptr [ebp - 4]
            //   8b542424             | pop                 edi
            //   2bc2                 | pop                 esi
            //   83f801               | xor                 ecx, ebp

        $sequence_46 = { 897de4 ff15???????? 84c0 7425 8bcf 8b7b04 8bc1 }
            // n = 7, score = 100
            //   897de4               | push                0
            //   ff15????????         |                     
            //   84c0                 | mov                 ecx, dword ptr [ebp - 4]
            //   7425                 | pop                 edi
            //   8bcf                 | pop                 esi
            //   8b7b04               | xor                 ecx, ebp
            //   8bc1                 | push                0

        $sequence_47 = { e8???????? 8a55ef 83ec10 8bf4 }
            // n = 4, score = 100
            //   e8????????           |                     
            //   8a55ef               | pop                 esi
            //   83ec10               | xor                 ecx, ebp
            //   8bf4                 | pop                 ebx

    condition:
        7 of them and filesize < 1586176
}
Download all Yara Rules