Snort mailing list archives
Multiple signatures 025
From: Y M via Snort-sigs <snort-sigs () lists snort org>
Date: Mon, 18 Mar 2019 18:18:33 +0000
Hi, This is a short one with only Remcos and Tefosteal. As usual, PCAPs and Yara/ClamAV signatures are available. Thank you. YM # -------------------- # Title: Remcos 2.3.0 Pro RAT with AgentTesla (ZincVZ?) # Reference: Research # Tests: pcaps # Yara: # - MALWARE_Win_Trojan_Remcos # ClamAV: # - MALWARE_Win.Trojan.Remcos # Hashes: # - 70831ec3a25ad0ed98cc867d4a23432cad9ecb96c59b82065ec9f936ff9cdd43 # Notes: # - Not encrypting C&C traffic? # - Existing Yara/ClamAV rule MALWARE_Win_Keylogger_AgentTesla_RAW # is still valid for this case. Yara rule has been modified to # operate with memory scan, ex.: volatility. alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Remcos initial outbound connection attempt"; flow:to_server,established; content:"[DataStart]"; fast_pattern:only; content:"RemoteHost|7C|cmd|7C|"; distance:8; metadata:ruleset community; classtype:trojan-activity; sid:8000558; rev:1;) alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Remcos inbound connection attempt"; flow:to_client,established; dsize:<85; content:"[DataStart]"; fast_pattern:only; content:"|7C|cmd|7C|"; distance:9; metadata:ruleset community; classtype:trojan-activity; sid:8000559; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Remcos outbound connection attempt"; flow:to_server,established; content:"[DataStart]"; fast_pattern:only; content:"|7C|cmd|7C|C|00|o|00|m|00|p|00|u|00|t|00|e|00|r|00 7C|cmd|7C|"; distance:9; metadata:ruleset community; classtype:trojan-activity; sid:8000560; rev:1;) # -------------------- # Title: Win.Trojan.Tefosteal # Reference: Windows Defender Security Intelligence # https://twitter.com/WDSecurity/status/1105990737961742336 # Tests: pcaps # Yara: # - MALWARE_Win_Trojan_Remcos # ClamAV: # - MALWARE_Win.Trojan.Remcos # Hashes: # - 6e6a81c711f60ccc868a9a731c4cee5c4c3cdf336f0e006647ae9cb9de144ae2 (upx-packed) # - 73a4afdf76d5fd896932a15c4a5616a168f69e44bfdea151d2521c567a08fcbf # - a2f5817d17ced1e6a61b2f836a8ae9e1919cd7a9a26030e061aef98e00af0596 # - f967c96185e534a195f30876ee74526013842f7bcdaa16f3d799e428e9a7da0a (upx-unpacked) # Notes: # - Both rules below can be merged into one while # removing the second http_client_body content # match. # - Existing Yara rule INDICATOR_Binary_References_Many_Browsers # is valid for these. alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tefosteal outbound connection"; flow:to_server,established; urilen:18; content:"/google_status.php"; fast_pattern:only; http_uri; content:"|3B| name=|22|files|22 3B|"; http_client_body; content:"Browsers/"; http_client_body; metadata:ruleset community, service http; classtype:trojan-activity; sid:8000561; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tefosteal outbound connection"; flow:to_server,established; urilen:18; content:"/google_status.php"; fast_pattern:only; http_uri; content:"|3B| name=|22|files|22 3B|"; http_client_body; content:"InfoPC/"; http_client_body; metadata:ruleset community, service http; classtype:trojan-activity; sid:8000562; rev:1;)
_______________________________________________ Snort-sigs mailing list Snort-sigs () lists snort org https://lists.snort.org/mailman/listinfo/snort-sigs Please visit http://blog.snort.org for the latest news about Snort! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
Current thread:
- Multiple signatures 025 Y M via Snort-sigs (Mar 18)
- Re: Multiple signatures 025 Matthew Mickel (Mar 19)