Multiple signatures 025

[Y M via Snort-sigs <snort-sigs () lists snort org>]

Hi,

This is a short one with only Remcos and Tefosteal. As usual, PCAPs and Yara/ClamAV signatures are available.

Thank you.
YM

# --------------------
# Title: Remcos 2.3.0 Pro RAT with AgentTesla (ZincVZ?)
# Reference: Research
# Tests: pcaps
# Yara:
#   - MALWARE_Win_Trojan_Remcos
# ClamAV:
#   - MALWARE_Win.Trojan.Remcos
# Hashes:
#   - 70831ec3a25ad0ed98cc867d4a23432cad9ecb96c59b82065ec9f936ff9cdd43
# Notes:
#   - Not encrypting C&C traffic?
#   - Existing Yara/ClamAV rule MALWARE_Win_Keylogger_AgentTesla_RAW
#     is still valid for this case. Yara rule has been modified to
#     operate with memory scan, ex.: volatility.

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Remcos initial outbound connection attempt"; 
flow:to_server,established; content:"[DataStart]"; fast_pattern:only; content:"RemoteHost|7C|cmd|7C|"; distance:8; 
metadata:ruleset community; classtype:trojan-activity; sid:8000558; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Remcos inbound connection attempt"; 
flow:to_client,established; dsize:<85; content:"[DataStart]"; fast_pattern:only; content:"|7C|cmd|7C|"; distance:9; 
metadata:ruleset community; classtype:trojan-activity; sid:8000559; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Remcos outbound connection attempt"; 
flow:to_server,established; content:"[DataStart]"; fast_pattern:only; 
content:"|7C|cmd|7C|C|00|o|00|m|00|p|00|u|00|t|00|e|00|r|00 7C|cmd|7C|"; distance:9; metadata:ruleset community; 
classtype:trojan-activity; sid:8000560; rev:1;)

# --------------------
# Title: Win.Trojan.Tefosteal
# Reference: Windows Defender Security Intelligence
#   https://twitter.com/WDSecurity/status/1105990737961742336

# Tests: pcaps
# Yara:
#   - MALWARE_Win_Trojan_Remcos
# ClamAV:
#   - MALWARE_Win.Trojan.Remcos
# Hashes:
#   - 6e6a81c711f60ccc868a9a731c4cee5c4c3cdf336f0e006647ae9cb9de144ae2 (upx-packed)
#   - 73a4afdf76d5fd896932a15c4a5616a168f69e44bfdea151d2521c567a08fcbf
#   - a2f5817d17ced1e6a61b2f836a8ae9e1919cd7a9a26030e061aef98e00af0596
#   - f967c96185e534a195f30876ee74526013842f7bcdaa16f3d799e428e9a7da0a (upx-unpacked)
# Notes:
#   - Both rules below can be merged into one while
#     removing the second http_client_body content
#     match.
#   - Existing Yara rule INDICATOR_Binary_References_Many_Browsers
#     is valid for these.

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tefosteal outbound connection"; 
flow:to_server,established; urilen:18; content:"/google_status.php"; fast_pattern:only; http_uri; content:"|3B| 
name=|22|files|22 3B|"; http_client_body; content:"Browsers/"; http_client_body; metadata:ruleset community, service 
http; classtype:trojan-activity; sid:8000561; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tefosteal outbound connection"; 
flow:to_server,established; urilen:18; content:"/google_status.php"; fast_pattern:only; http_uri; content:"|3B| 
name=|22|files|22 3B|"; http_client_body; content:"InfoPC/"; http_client_body; metadata:ruleset community, service 
http; classtype:trojan-activity; sid:8000562; rev:1;)

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!