SYMBOLCOMMON_NAMEaka. SYNONYMS
win.tarsip (Back to overview)

Tarsip

Actor(s): Comment Crew


There is no description at this point.

References
2018MandiantMandiant
@techreport{mandiant:2018:apt1:b76cc4d, author = {Mandiant}, title = {{APT1}}, date = {2018}, institution = {Mandiant}, url = {https://github.com/securitykitten/malware_references/blob/master/Appendix%20C%20(Digital)%20-%20The%20Malware%20Arsenal.pdf}, language = {English}, urldate = {2020-01-13} } APT1
Auriga Biscuit Bouncer Combos CookieBag Dairy GetMail GlooxMail Goggles Hacksfase Helauto Kurton ManItsMe MAPIget MiniASP NewsReels SeaSalt StarsyPound Sword TabMsgSQL Tarsip WebC2-AdSpace WebC2-Ausov WebC2-Bolid WebC2-Cson WebC2-DIV WebC2-GreenCat WebC2-Head WebC2-Kt3 WebC2-Qbp WebC2-Rave WebC2-Table WebC2-UGX WebC2-Yahoo
Yara Rules
[TLP:WHITE] win_tarsip_auto (20211008 | Detects win.tarsip.)
rule win_tarsip_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.tarsip."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tarsip"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 750d a1???????? 57 50 ff15???????? 893d???????? }
            // n = 6, score = 100
            //   750d                 | jne                 0xf
            //   a1????????           |                     
            //   57                   | push                edi
            //   50                   | push                eax
            //   ff15????????         |                     
            //   893d????????         |                     

        $sequence_1 = { e8???????? 33ed 6808020000 896c2420 e8???????? 8b1d???????? 83c404 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   33ed                 | xor                 ebp, ebp
            //   6808020000           | push                0x208
            //   896c2420             | mov                 dword ptr [esp + 0x20], ebp
            //   e8????????           |                     
            //   8b1d????????         |                     
            //   83c404               | add                 esp, 4

        $sequence_2 = { ffd7 c7861842010000000000 8b8614420100 85c0 740d 50 ffd7 }
            // n = 7, score = 100
            //   ffd7                 | call                edi
            //   c7861842010000000000     | mov    dword ptr [esi + 0x14218], 0
            //   8b8614420100         | mov                 eax, dword ptr [esi + 0x14214]
            //   85c0                 | test                eax, eax
            //   740d                 | je                  0xf
            //   50                   | push                eax
            //   ffd7                 | call                edi

        $sequence_3 = { 33c0 40 e9???????? 8365d800 c745dc09c54100 a1???????? 8d4dd8 }
            // n = 7, score = 100
            //   33c0                 | xor                 eax, eax
            //   40                   | inc                 eax
            //   e9????????           |                     
            //   8365d800             | and                 dword ptr [ebp - 0x28], 0
            //   c745dc09c54100       | mov                 dword ptr [ebp - 0x24], 0x41c509
            //   a1????????           |                     
            //   8d4dd8               | lea                 ecx, dword ptr [ebp - 0x28]

        $sequence_4 = { 85f6 7e0a 807404389d 40 3bc6 7cf6 8d7c2438 }
            // n = 7, score = 100
            //   85f6                 | test                esi, esi
            //   7e0a                 | jle                 0xc
            //   807404389d           | xor                 byte ptr [esp + eax + 0x38], 0x9d
            //   40                   | inc                 eax
            //   3bc6                 | cmp                 eax, esi
            //   7cf6                 | jl                  0xfffffff8
            //   8d7c2438             | lea                 edi, dword ptr [esp + 0x38]

        $sequence_5 = { 50 81ecbc070000 a1???????? 33c4 898424b8070000 53 55 }
            // n = 7, score = 100
            //   50                   | push                eax
            //   81ecbc070000         | sub                 esp, 0x7bc
            //   a1????????           |                     
            //   33c4                 | xor                 eax, esp
            //   898424b8070000       | mov                 dword ptr [esp + 0x7b8], eax
            //   53                   | push                ebx
            //   55                   | push                ebp

        $sequence_6 = { e8???????? 6a04 68???????? 8d442428 e8???????? 837c243400 7410 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   6a04                 | push                4
            //   68????????           |                     
            //   8d442428             | lea                 eax, dword ptr [esp + 0x28]
            //   e8????????           |                     
            //   837c243400           | cmp                 dword ptr [esp + 0x34], 0
            //   7410                 | je                  0x12

        $sequence_7 = { 3bf2 0f82d1fcffff 6a03 68???????? 8d8c24e0000000 c78424f80000000f000000 }
            // n = 6, score = 100
            //   3bf2                 | cmp                 esi, edx
            //   0f82d1fcffff         | jb                  0xfffffcd7
            //   6a03                 | push                3
            //   68????????           |                     
            //   8d8c24e0000000       | lea                 ecx, dword ptr [esp + 0xe0]
            //   c78424f80000000f000000     | mov    dword ptr [esp + 0xf8], 0xf

        $sequence_8 = { 8d44242c 50 8d4c242c 51 8d542424 52 ffd6 }
            // n = 7, score = 100
            //   8d44242c             | lea                 eax, dword ptr [esp + 0x2c]
            //   50                   | push                eax
            //   8d4c242c             | lea                 ecx, dword ptr [esp + 0x2c]
            //   51                   | push                ecx
            //   8d542424             | lea                 edx, dword ptr [esp + 0x24]
            //   52                   | push                edx
            //   ffd6                 | call                esi

        $sequence_9 = { 90 8a01 8a51ff 02c0 024101 02d2 025104 }
            // n = 7, score = 100
            //   90                   | nop                 
            //   8a01                 | mov                 al, byte ptr [ecx]
            //   8a51ff               | mov                 dl, byte ptr [ecx - 1]
            //   02c0                 | add                 al, al
            //   024101               | add                 al, byte ptr [ecx + 1]
            //   02d2                 | add                 dl, dl
            //   025104               | add                 dl, byte ptr [ecx + 4]

    condition:
        7 of them and filesize < 360448
}
Download all Yara Rules