SYMBOLCOMMON_NAMEaka. SYNONYMS
win.spectre (Back to overview)

Spectre Rat


Mixed RAT and Botnet malware sold in underground forums. In march 2021 it was advertised with the Spectre 2.0, it reached version 3 in June 2021 and then quickly version 4. This crimeware tool was being abused in malicious campaigns targeting European users in September 2021.

References
2021-10YoroiLuigi Martire, Carmelo Ragusa, Luca Mella
@online{martire:202110:spectre:d4c34d7, author = {Luigi Martire and Carmelo Ragusa and Luca Mella}, title = {{Spectre v4.0: the speed of malware threats after the pandemics}}, date = {2021-10}, organization = {Yoroi}, url = {https://yoroi.company/research/spectre-v4-0-the-speed-of-malware-threats-after-the-pandemics/}, language = {English}, urldate = {2021-10-22} } Spectre v4.0: the speed of malware threats after the pandemics
Spectre Rat
Yara Rules
[TLP:WHITE] win_spectre_auto (20220411 | Detects win.spectre.)
rule win_spectre_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-04-08"
        version = "1"
        description = "Detects win.spectre."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spectre"
        malpedia_rule_date = "20220405"
        malpedia_hash = "ecd38294bd47d5589be5cd5490dc8bb4804afc2a"
        malpedia_version = "20220411"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 84db 7443 8b7718 85f6 7522 6a20 e8???????? }
            // n = 7, score = 100
            //   84db                 | test                bl, bl
            //   7443                 | je                  0x45
            //   8b7718               | mov                 esi, dword ptr [edi + 0x18]
            //   85f6                 | test                esi, esi
            //   7522                 | jne                 0x24
            //   6a20                 | push                0x20
            //   e8????????           |                     

        $sequence_1 = { 8bcf e8???????? 84c0 7528 83ec18 8d45e4 8bcc }
            // n = 7, score = 100
            //   8bcf                 | mov                 ecx, edi
            //   e8????????           |                     
            //   84c0                 | test                al, al
            //   7528                 | jne                 0x2a
            //   83ec18               | sub                 esp, 0x18
            //   8d45e4               | lea                 eax, dword ptr [ebp - 0x1c]
            //   8bcc                 | mov                 ecx, esp

        $sequence_2 = { 03f5 3bf3 75f3 bd00100000 8b442410 2bc7 897c2414 }
            // n = 7, score = 100
            //   03f5                 | add                 esi, ebp
            //   3bf3                 | cmp                 esi, ebx
            //   75f3                 | jne                 0xfffffff5
            //   bd00100000           | mov                 ebp, 0x1000
            //   8b442410             | mov                 eax, dword ptr [esp + 0x10]
            //   2bc7                 | sub                 eax, edi
            //   897c2414             | mov                 dword ptr [esp + 0x14], edi

        $sequence_3 = { eb29 6a0b 68???????? eba5 6a04 68???????? eb9c }
            // n = 7, score = 100
            //   eb29                 | jmp                 0x2b
            //   6a0b                 | push                0xb
            //   68????????           |                     
            //   eba5                 | jmp                 0xffffffa7
            //   6a04                 | push                4
            //   68????????           |                     
            //   eb9c                 | jmp                 0xffffff9e

        $sequence_4 = { 83c40c 0fb608 83e901 7432 83e901 7408 837e1000 }
            // n = 7, score = 100
            //   83c40c               | add                 esp, 0xc
            //   0fb608               | movzx               ecx, byte ptr [eax]
            //   83e901               | sub                 ecx, 1
            //   7432                 | je                  0x34
            //   83e901               | sub                 ecx, 1
            //   7408                 | je                  0xa
            //   837e1000             | cmp                 dword ptr [esi + 0x10], 0

        $sequence_5 = { 8d04f8 5f 894608 5e c20400 e8???????? cc }
            // n = 7, score = 100
            //   8d04f8               | lea                 eax, dword ptr [eax + edi*8]
            //   5f                   | pop                 edi
            //   894608               | mov                 dword ptr [esi + 8], eax
            //   5e                   | pop                 esi
            //   c20400               | ret                 4
            //   e8????????           |                     
            //   cc                   | int3                

        $sequence_6 = { 8b08 ff7010 51 b9???????? e8???????? 8d4c2438 e8???????? }
            // n = 7, score = 100
            //   8b08                 | mov                 ecx, dword ptr [eax]
            //   ff7010               | push                dword ptr [eax + 0x10]
            //   51                   | push                ecx
            //   b9????????           |                     
            //   e8????????           |                     
            //   8d4c2438             | lea                 ecx, dword ptr [esp + 0x38]
            //   e8????????           |                     

        $sequence_7 = { 8d45cc 50 e8???????? 83c40c 8d4de4 e8???????? 8d4d9c }
            // n = 7, score = 100
            //   8d45cc               | lea                 eax, dword ptr [ebp - 0x34]
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   8d4de4               | lea                 ecx, dword ptr [ebp - 0x1c]
            //   e8????????           |                     
            //   8d4d9c               | lea                 ecx, dword ptr [ebp - 0x64]

        $sequence_8 = { ff35???????? e8???????? a1???????? 8d4c2430 83c40c a3???????? 8d442434 }
            // n = 7, score = 100
            //   ff35????????         |                     
            //   e8????????           |                     
            //   a1????????           |                     
            //   8d4c2430             | lea                 ecx, dword ptr [esp + 0x30]
            //   83c40c               | add                 esp, 0xc
            //   a3????????           |                     
            //   8d442434             | lea                 eax, dword ptr [esp + 0x34]

        $sequence_9 = { e8???????? 59 8bf0 ff15???????? 50 ff15???????? 56 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   8bf0                 | mov                 esi, eax
            //   ff15????????         |                     
            //   50                   | push                eax
            //   ff15????????         |                     
            //   56                   | push                esi

    condition:
        7 of them and filesize < 990208
}
[TLP:WHITE] win_spectre_w0   (20211022 | Yara Rule for Spectre RAT, versions 2,3,4)
rule win_spectre_w0 {  
    meta:  
        author = "Yoroi Malware Zlab"  
        description = "Yara Rule for Spectre RAT, versions 2,3,4"  
        last_updated = "2021_10_08"  
        tlp = "white" 
        category = "informational"  

        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spectre"
        malpedia_version = "20211022"
        malpedia_hash = ""
        malpedia_rule_date = "20211022"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:  
        $main = {FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 3D B7 00 00 00 75 06 57 E8 ?? 7? 00 00 E8 }  
        $c2_send_request = {ff 15 ?? ?? ?? ?? 85 c0 0f 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8d 4f 04 c7 07 01 00 00 00 e8 ?? ?? ?? ?? 8b [0-6] 00 10 00 00 83 f8 08 72 ?? 8b 4? [0-2] 8d 04 45 02 00 00 00 89 4?}  

    condition:  
        all of them and uint16(0) == 0x5A4D  
}
Download all Yara Rules