SYMBOLCOMMON_NAMEaka. SYNONYMS
win.winnti (Back to overview)

Winnti

aka: BleDoor, JUMPALL, RbDoor, Pasteboy

Actor(s): APT17

VTCollection    

There is no description at this point.

References
2024-03-01HarfangLabHarfangLab CTI
A Comprehensive Analysis of i-SOON’s Commercial Offering
ShadowPad Winnti
2023-01-14YouTube (CODE BLUE)Takahiro Haruyama
[CB22]Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning
ShadowPad Winnti
2022-10-25VMware Threat Analysis UnitTakahiro Haruyama
Tracking the entire iceberg: long-term APT malware C2 protocol emulation and scanning
ShadowPad Winnti
2022-09-26Youtube (Virus Bulletin)Takahiro Haruyama
Tracking the entire iceberg long term APT malware C2 protocol emulation and scanning
ShadowPad Winnti
2022-09-19Virus BulletinTakahiro Haruyama
Tracking the entire iceberg - long-term APT malware C2 protocol emulation and scanning
ShadowPad Winnti
2022-05-12TEAMT5Leon Chang, Silvia Yeh
The Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT (slides)
KEYPLUG Cobalt Strike CROSSWALK FunnySwitch PlugX ShadowPad Winnti SLIME29 TianWu
2022-05-04CybereasonAkihiro Tomita, Assaf Dahan, Chen Erlich, Daniel Frank, Fusao Tanida, Niv Yona, Ofir Ozer
Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques
PRIVATELOG Spyder STASHLOG Winnti
2022-05-04CybereasonAkihiro Tomita, Assaf Dahan, Chen Erlich, Daniel Frank, Fusao Tanida, Niv Yona, Ofir Ozer
Operation CuckooBees: A Winnti Malware Arsenal Deep-Dive
PRIVATELOG Spyder STASHLOG Winnti
2022-05-01BushidoTokenBushidoToken
Gamer Cheater Hacker Spy
Egregor HelloKitty NetfilterRootkit RagnarLocker Winnti
2022-03-31Recorded FutureInsikt Group
China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware
Winnti TAG-28
2022-01-17Trend MicroCedric Pernet, Daniel Lunghi, Gloria Chen, Jaromír Hořejší, Joseph Chen, Kenney Lu
Delving Deep: An Analysis of Earth Lusca’s Operations
BIOPASS Cobalt Strike FunnySwitch JuicyPotato ShadowPad Winnti Earth Lusca
2021-11-16vmwareTakahiro Haruyama
Monitoring Winnti 4.0 C2 Servers for Two Years
Winnti
2021-09-28Recorded FutureInsikt Group®
4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan
PlugX Winnti
2021-09-21Recorded FutureInsikt Group®
China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware
Winnti
2021-09-14McAfeeChristiaan Beek
Operation ‘Harvest’: A Deep Dive into a Long-term Campaign
MimiKatz PlugX Winnti
2021-07-08Recorded FutureInsikt Group®
Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling
ShadowPad Spyder Winnti
2021-07-08PTSecurityDenis Kuvshinov
How winnti APT grouping works
Korlia ShadowPad Winnti
2021-07-08YouTube (PT Product Update)Denis Kuvshinov
How winnti APT grouping works
Korlia ShadowPad Winnti
2021-06-05PrevailionDanny Adamitis
The Gh0st remain the same
Winnti
2021-04-29NTTThreat Detection NTT Ltd.
The Operations of Winnti group
Cobalt Strike ShadowPad Spyder Winnti Earth Lusca
2021-03-10ESET ResearchMathieu Tartare, Matthieu Faou, Thomas Dupuy
Exchange servers under siege from at least 10 APT groups
Microcin MimiKatz PlugX Winnti APT27 APT41 Calypso Tick ToddyCat Tonto Team Vicious Panda
2021-02-28PWC UKPWC UK
Cyber Threats 2020: A Year in Retrospect
elf.wellmess FlowerPower PowGoop 8.t Dropper Agent.BTZ Agent Tesla Appleseed Ave Maria Bankshot BazarBackdoor BLINDINGCAN Chinoxy Conti Cotx RAT Crimson RAT DUSTMAN Emotet FriedEx FunnyDream Hakbit Mailto Maze METALJACK Nefilim Oblique RAT Pay2Key PlugX QakBot REvil Ryuk StoneDrill StrongPity SUNBURST SUPERNOVA TrickBot TurlaRPC Turla SilentMoon WastedLocker WellMess Winnti ZeroCleare APT10 APT23 APT27 APT31 APT41 BlackTech BRONZE EDGEWOOD Inception Framework MUSTANG PANDA Red Charon Red Nue Sea Turtle Tonto Team
2021-02-23CrowdStrikeCrowdStrike
2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader Evilnum OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER
2021-01-20FireEyeAndrew Davis
Emulation of Kernel Mode Rootkits With Speakeasy
Winnti
2020-12-24IronNetAdam Hlavek
China cyber attacks: the current threat landscape
PLEAD TSCookie FlowCloud Lookback PLEAD PlugX Quasar RAT Winnti
2020-11-03Kaspersky LabsGReAT
APT trends report Q3 2020
WellMail EVILNUM Janicab Poet RAT AsyncRAT Ave Maria Cobalt Strike Crimson RAT CROSSWALK Dtrack LODEINFO MoriAgent Okrum PlugX POISONPLUG Rover ShadowPad SoreFang Winnti
2020-10-30YouTube (Kaspersky Tech)Kris McConkey
Around the world in 80 days 4.2bn packets
Cobalt Strike Derusbi HyperBro Poison Ivy ShadowPad Winnti
2020-10-12Malwarebytes LabsHossein Jazi, Jérôme Segura, Malwarebytes Threat Intelligence Team, Roberto Santos
Winnti APT group docks in Sri Lanka for new campaign
DBoxAgent SerialVlogger Winnti
2020-09-22vmwareOmar Elgebaly, Takahiro Haruyama
Detecting Threats in Real-time With Active C2 Information
Agent.BTZ Cobalt Strike Dacls NetWire RC PoshC2 Winnti
2020-09-18SymantecThreat Hunter Team
APT41: Indictments Put Chinese Espionage Group in the Spotlight
CROSSWALK PlugX POISONPLUG ShadowPad Winnti
2020-08-06WiredAndy Greenberg
Chinese Hackers Have Pillaged Taiwan's Semiconductor Industry
Cobalt Strike MimiKatz Winnti Red Charon
2020-08-04BlackHatChung-Kuan Chen, Inndy Lin, Shang-De Jiang
Operation Chimera - APT Operation Targets Semiconductor Vendors
Cobalt Strike MimiKatz Winnti Red Charon
2020-04-20QuoScientQuoIntelligence
WINNTI GROUP: Insights From the Past
Winnti
2020-03-04CrowdStrikeCrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER
2020-03-03GIthub (superkhung)superkhung
GitHub Repository: winnti-sniff
Winnti
2020-03-03PWC UKPWC UK
Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare APT41 MUSTANG PANDA Sea Turtle
2020-02-20Carbon BlackTakahiro Haruyama
Threat Analysis: Active C2 Discovery Using Protocol Emulation Part2 (Winnti 4.0)
Winnti
2020-01-31TagesschauJan Lukas Strozyk
Deutsches Chemieunternehmen gehackt
Winnti
2020-01-31ESET ResearchMathieu Tartare
Winnti Group targeting universities in Hong Kong
ShadowPad Winnti
2020-01-01SecureworksSecureWorks
BRONZE ATLAS
Speculoos Winnti ACEHASH CCleaner Backdoor CHINACHOPPER Empire Downloader HTran MimiKatz PlugX Winnti APT41
2019-10-01CrowdStrikeKarl Scheuerman, Piotr Wojtyla
Don't miss the forest for the trees gleaning hunting value from too much intrusion data
Winnti
2019-09-30LastlineJason Zhang, Stefano Ortolani
HELO Winnti: Attack or Scan?
Winnti
2019-09-23MITREMITRE ATT&CK
APT41
Derusbi MESSAGETAP Winnti ASPXSpy BLACKCOFFEE CHINACHOPPER Cobalt Strike Derusbi Empire Downloader Ghost RAT MimiKatz NjRAT PlugX ShadowPad Winnti ZXShell APT41
2019-09-04CarbonBlackTakahiro Haruyama
CB TAU Threat Intelligence Notification: Winnti Malware 4.0
Winnti
2019-09-04FireEyeFireEye
APT41: Double Dragon APT41, a dual espionage and cyber crime operation
EASYNIGHT Winnti
2019-08-09FireEyeFireEye
Double Dragon APT41, a dual espionage and cyber crime operation
CLASSFON crackshot CROSSWALK GEARSHIFT HIGHNOON HIGHNOON.BIN JUMPALL POISONPLUG Winnti
2019-07-24Bayerischer RundfunkHakan Tanriverdi, Jan Strozyk, Maximilian Zierer, Rebecca Ciesielski, Svea Eckert
Attacking the Heart of the German Industry
Winnti
2019-07-24Github (br-data)Hakan Tanriverdi, Jan Strozyk, Maximilian Zierer, Rebecca Ciesielski, Svea Eckert
Winnti analysis
Winnti
2019-04-22Trend MicroMohamad Mokbel
C/C++ Runtime Library Code Tampering in Supply Chain
shadowhammer ShadowPad Winnti
2018-10-01Macnica NetworksMacnica Networks
Trends in cyber espionage (targeted attacks) targeting Japan | First half of 2018
Anel Cobalt Strike Datper FlawedAmmyy Quasar RAT RedLeaves taidoor Winnti xxmm
2018-05-22Github (TKCERT)thyssenkrupp CERT
Nmap Script to scan for Winnti infections
Winnti
2018-03-05Github (TKCERT)TKCERT
Suricata rules to detect Winnti communication
Winnti
2017-04-19Trend MicroTrendmicro
Of Pigs and Malware: Examining a Possible Member of the Winnti Group
Winnti
2017-03-22Trend MicroCedric Pernet
Winnti Abuses GitHub for C&C Communications
Winnti
2016-03-06Github (TKCERT)thyssenkrupp CERT
Network detector for Winnti malware
Winnti
2015-06-22Kaspersky LabsDmitry Tarakanov
Games are over: Winnti is now targeting pharmaceutical companies
Winnti APT41
2015-04-06NovettaNovetta
WINNTI ANALYSIS
Winnti
2015-01-01RuxconMatt McCormack
WHY ATTACKER TOOLSETS DO WHAT THEY DO
Winnti
2013-04-01Kaspersky LabsGReAT
Winnti - More than just a game
portless Winnti
Yara Rules
[TLP:WHITE] win_winnti_auto (20241030 | Detects win.winnti.)
rule win_winnti_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2024-10-31"
        version = "1"
        description = "Detects win.winnti."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
        malpedia_rule_date = "20241030"
        malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
        malpedia_version = "20241030"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 83c408 e9???????? 8b44241c 8bce 50 e8???????? }
            // n = 6, score = 200
            //   83c408               | add                 esp, 8
            //   e9????????           |                     
            //   8b44241c             | mov                 eax, dword ptr [esp + 0x1c]
            //   8bce                 | mov                 ecx, esi
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_1 = { 8b0d???????? 85c9 746f 8b0d???????? 85c9 }
            // n = 5, score = 200
            //   8b0d????????         |                     
            //   85c9                 | test                ecx, ecx
            //   746f                 | je                  0x71
            //   8b0d????????         |                     
            //   85c9                 | test                ecx, ecx

        $sequence_2 = { 50 e8???????? 83c404 c7430c00000000 83c8ff }
            // n = 5, score = 200
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   c7430c00000000       | mov                 dword ptr [ebx + 0xc], 0
            //   83c8ff               | or                  eax, 0xffffffff

        $sequence_3 = { f7d1 49 81f904010000 0f83e9010000 53 }
            // n = 5, score = 200
            //   f7d1                 | not                 ecx
            //   49                   | dec                 ecx
            //   81f904010000         | cmp                 ecx, 0x104
            //   0f83e9010000         | jae                 0x1ef
            //   53                   | push                ebx

        $sequence_4 = { 3d10a00000 0f8ff4010000 0f84e2010000 051f60ffff 83f82e 0f8700010000 33d2 }
            // n = 7, score = 200
            //   3d10a00000           | cmp                 eax, 0xa010
            //   0f8ff4010000         | jg                  0x1fa
            //   0f84e2010000         | je                  0x1e8
            //   051f60ffff           | add                 eax, 0xffff601f
            //   83f82e               | cmp                 eax, 0x2e
            //   0f8700010000         | ja                  0x106
            //   33d2                 | xor                 edx, edx

        $sequence_5 = { 8d4c2413 c1e206 51 6a02 }
            // n = 4, score = 200
            //   8d4c2413             | lea                 ecx, [esp + 0x13]
            //   c1e206               | shl                 edx, 6
            //   51                   | push                ecx
            //   6a02                 | push                2

        $sequence_6 = { 3c02 7519 8b4c2430 8b442424 8d53ec }
            // n = 5, score = 200
            //   3c02                 | cmp                 al, 2
            //   7519                 | jne                 0x1b
            //   8b4c2430             | mov                 ecx, dword ptr [esp + 0x30]
            //   8b442424             | mov                 eax, dword ptr [esp + 0x24]
            //   8d53ec               | lea                 edx, [ebx - 0x14]

        $sequence_7 = { e8???????? 85c0 7e24 8b54241c 83c201 83d700 }
            // n = 6, score = 200
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7e24                 | jle                 0x26
            //   8b54241c             | mov                 edx, dword ptr [esp + 0x1c]
            //   83c201               | add                 edx, 1
            //   83d700               | adc                 edi, 0

        $sequence_8 = { 72e2 eb04 8b6c1f02 488b742460 4863cd 8bd7 }
            // n = 6, score = 100
            //   72e2                 | inc                 ecx
            //   eb04                 | pop                 edi
            //   8b6c1f02             | inc                 ebp
            //   488b742460           | xor                 eax, eax
            //   4863cd               | dec                 eax
            //   8bd7                 | mov                 ecx, eax

        $sequence_9 = { 488bc7 4c8d9c24d0000000 498b5b20 498b7328 498be3 415f }
            // n = 6, score = 100
            //   488bc7               | dec                 eax
            //   4c8d9c24d0000000     | mov                 eax, edi
            //   498b5b20             | dec                 esp
            //   498b7328             | lea                 ebx, [esp + 0xd0]
            //   498be3               | dec                 ecx
            //   415f                 | mov                 ebx, dword ptr [ebx + 0x20]

        $sequence_10 = { ff15???????? 488d15af4b0100 488bcb 488905???????? ff15???????? 488d15884b0100 }
            // n = 6, score = 100
            //   ff15????????         |                     
            //   488d15af4b0100       | inc                 esp
            //   488bcb               | mov                 eax, ebx
            //   488905????????       |                     
            //   ff15????????         |                     
            //   488d15884b0100       | xor                 edx, edx

        $sequence_11 = { 488d0d33f1ffff 4885c0 7422 8930 488d7808 }
            // n = 5, score = 100
            //   488d0d33f1ffff       | je                  0xb
            //   4885c0               | nop                 
            //   7422                 | dec                 eax
            //   8930                 | inc                 eax
            //   488d7808             | inc                 eax

        $sequence_12 = { e8???????? 488bd8 488d05d03b0100 4885db 488d4f38 480f44d8 488bd3 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   488bd8               | cmp                 byte ptr [eax], dh
            //   488d05d03b0100       | mov                 ebx, dword ptr [esp + 0x40]
            //   4885db               | dec                 eax
            //   488d4f38             | mov                 ecx, eax
            //   480f44d8             | inc                 ecx
            //   488bd3               | mov                 ecx, 0x3000

        $sequence_13 = { 4533c0 488bc8 488bd3 ff15???????? 4d85ff }
            // n = 5, score = 100
            //   4533c0               | dec                 ecx
            //   488bc8               | mov                 esi, dword ptr [ebx + 0x28]
            //   488bd3               | dec                 ecx
            //   ff15????????         |                     
            //   4d85ff               | mov                 esp, ebx

        $sequence_14 = { eb02 33ff 488bd7 488d4d9f e8???????? }
            // n = 5, score = 100
            //   eb02                 | mov                 esi, eax
            //   33ff                 | jl                  0xffffffe9
            //   488bd7               | pop                 ebp
            //   488d4d9f             | pop                 ebx
            //   e8????????           |                     

        $sequence_15 = { 4533db 488d2d7d1c0000 8b7320 448b7324 }
            // n = 4, score = 100
            //   4533db               | mov                 edx, edi
            //   488d2d7d1c0000       | dec                 eax
            //   8b7320               | mov                 esi, dword ptr [ebp + 0x3c8]
            //   448b7324             | inc                 esp

        $sequence_16 = { 4889842400020000 8b4108 4c8bc2 4533c9 41894004 4889542420 33d2 }
            // n = 7, score = 100
            //   4889842400020000     | dec                 eax
            //   8b4108               | mov                 ecx, ebx
            //   4c8bc2               | dec                 eax
            //   4533c9               | cmp                 dword ptr [ebp + 0xf], 0x10
            //   41894004             | jb                  0x1a
            //   4889542420           | dec                 esp
            //   33d2                 | lea                 esp, [0xf1b6]

        $sequence_17 = { 4c8d25b6f10000 498b0c24 4d8bc5 488bd3 e8???????? }
            // n = 5, score = 100
            //   4c8d25b6f10000       | nop                 
            //   498b0c24             | dec                 eax
            //   4d8bc5               | lea                 ecx, [ebp + 0x80]
            //   488bd3               | nop                 
            //   e8????????           |                     

        $sequence_18 = { 488b8d00010000 ff15???????? 90 488d8d80000000 ff15???????? 90 }
            // n = 6, score = 100
            //   488b8d00010000       | mov                 eax, eax
            //   ff15????????         |                     
            //   90                   | inc                 ebp
            //   488d8d80000000       | test                eax, eax
            //   ff15????????         |                     
            //   90                   | je                  0xd6

        $sequence_19 = { 4c8bc0 488d155d520100 488bcb e8???????? 48837d0f10 7209 }
            // n = 6, score = 100
            //   4c8bc0               | mov                 esi, dword ptr [ebx + 0x20]
            //   488d155d520100       | inc                 esp
            //   488bcb               | mov                 esi, dword ptr [ebx + 0x24]
            //   e8????????           |                     
            //   48837d0f10           | dec                 eax
            //   7209                 | mov                 ecx, dword ptr [ebp + 0x100]

        $sequence_20 = { 41c6400701 eb0f 4080fe05 7509 41800880 41c6400704 410fb64807 }
            // n = 7, score = 100
            //   41c6400701           | jb                  0xffffffe4
            //   eb0f                 | jmp                 8
            //   4080fe05             | mov                 ebp, dword ptr [edi + ebx + 2]
            //   7509                 | dec                 eax
            //   41800880             | mov                 esi, dword ptr [esp + 0x60]
            //   41c6400704           | dec                 eax
            //   410fb64807           | arpl                bp, cx

        $sequence_21 = { 7409 90 48ffc0 403830 }
            // n = 4, score = 100
            //   7409                 | inc                 ecx
            //   90                   | mov                 byte ptr [eax + 7], 1
            //   48ffc0               | jmp                 0x11
            //   403830               | inc                 eax

        $sequence_22 = { 83feff 7423 83fefe 741e 488bce 488bc6 488d15f8ba0a00 }
            // n = 7, score = 100
            //   83feff               | pop                 edi
            //   7423                 | pop                 esi
            //   83fefe               | ret                 
            //   741e                 | dec                 esp
            //   488bce               | mov                 eax, eax
            //   488bc6               | dec                 eax
            //   488d15f8ba0a00       | lea                 edx, [0x1525d]

        $sequence_23 = { 488bb5c8030000 448bc0 4585c0 0f84ca000000 }
            // n = 4, score = 100
            //   488bb5c8030000       | dec                 eax
            //   448bc0               | mov                 edx, ebx
            //   4585c0               | dec                 ebp
            //   0f84ca000000         | test                edi, edi

    condition:
        7 of them and filesize < 1581056
}
[TLP:WHITE] win_winnti_w0   (20190822 | rules used for retrohunting by BR Data.)
rule win_winnti_w0 {
    meta:
        author = "BR Data"
        source = "https://github.com/br-data/2019-winnti-analyse/"
        date = "2019-07-24"
        description = "rules used for retrohunting by BR Data."
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
        malpedia_version = "20190822"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $load_magic = { C7 44 ?? ?? FF D8 FF E0 }
        $iter = { E9 EA EB EC ED EE EF F0 }
        $jpeg = { FF D8 FF E0 00 00 00 00 00 00 }

    condition:
        uint16(0) == 0x5a4d and
        $jpeg and
        ($load_magic or $iter in (@jpeg[1]..@jpeg[1]+200)) and
        for any i in (1..#jpeg): ( uint8(@jpeg[i] + 11) != 0 )
}
[TLP:WHITE] win_winnti_w1   (20190822 | rules used for retrohunting by BR Data.)
rule win_winnti_w1 {
    meta:
        author = "BR Data"
        source = "https://github.com/br-data/2019-winnti-analyse/"
        date = "2019-07-24"
        description = "rules used for retrohunting by BR Data."
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
        malpedia_version = "20190822"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $cooper = "Cooper"
        $pattern = { e9 ea eb ec ed ee ef f0}
    condition:
        uint16(0) == 0x5a4d and $cooper and ($pattern in (@cooper[1]..@cooper[1]+100))
}
[TLP:WHITE] win_winnti_w2   (20191207 | No description)
rule win_winnti_w2 {
    meta:
        author = "Bundesamt fuer Verfassungsschutz"
        source = "https://www.verfassungsschutz.de/download/anlage-2019-12-bfv-cyber-brief-2019-01.txt"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
        malpedia_version = "20191207"
        malpedia_sharing = "TLP:WHITE"
        malpedia_license = ""
    strings:
        $e1 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii nocase
        $e2 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii nocase
        $e3 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii nocase
        $e4 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
        $e5 = "BFE_Notify_Event_{7D00FA3C-FBDC-4A8D-AEEB-3F55A4890D2A}" nocase
    condition:
        (any of ($e*))
}
[TLP:WHITE] win_winnti_w3   (20191207 | No description)
rule win_winnti_w3 {
    meta:
        author = "Bundesamt fuer Verfassungsschutz"
        source = "https://www.verfassungsschutz.de/download/anlage-2019-12-bfv-cyber-brief-2019-01.txt"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
        malpedia_version = "20191207"
        malpedia_sharing = "TLP:WHITE"
        malpedia_license = ""
    strings:
        $a1 = "IPSecMiniPort" wide fullword
        $a2 = "ndis6fw" wide fullword
        $a3 = "TCPIP" wide fullword
        $a4 = "NDIS.SYS" ascii fullword
        $a5 = "ntoskrnl.exe" ascii fullword
        $a6 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
        $a7 = "\\Device\\Null" wide
        $a8 = "\\Device" wide
        $a9 = "\\Driver" wide
        $b1 = { 66 81 7? ?? 70 17 }
        $b2 = { 81 7? ?? 07 E0 15 00 }
        $b3 = { 8B 46 18 3D 03 60 15 00 }
    condition:
        (6 of ($a*)) and (2 of ($b*))
}
Download all Yara Rules