27 lines
12 KiB
Plaintext
27 lines
12 KiB
Plaintext
rule vbs_mykings_botnet {
|
|
meta:
|
|
description = "Detect the risk of Botnet Malware Mykings Rule 1"
|
|
strings:
|
|
$s1 = "fso.DeleteFile(WScript.ScriptFullName)" fullword ascii
|
|
$s2 = "Set ws = CreateObject(\"Wscript.Shell\")" fullword ascii
|
|
$s3 = "Set fso = CreateObject(\"Scripting.Filesystemobject\")" fullword ascii
|
|
$r = /Windows\\ime|web|inf|\\c[0-9].bat/
|
|
condition:
|
|
uint16(0) == 0x6553 and
|
|
filesize < 1KB
|
|
and any of ($s*) and
|
|
$r
|
|
}
|
|
|
|
rule shellcode_mykins_botnet
|
|
{
|
|
meta:
|
|
description = "Detect the risk of Botnet Malware Mykings Rule 1"
|
|
strings:
|
|
$a = { 4883EC28E847000000488D0DF0FFFFFF488D1539000000482BCA4803C14883C428C3CCCC488D05D5FFFFFF482BC8488BC1C3CCCC4883EC28E83F0D000033C04883C428C3CCCCCCCCCCCCCCCCCCCCCCCCE8000000005848B95510004001000000482BC148B950100040010000004803C1C3CCCCCC48897C24084C8BC94D85C0740C488BF9480FBEC2498BC8F3AA488B7C2408498BC1C3CCCC40534883EC20488BD9E85AFFFFFF488D0D53FFFFFF482BD94803C34883C4205BC3CCCCCC33D28BC2EB06FFC04883C10266391175F5F3C3CC668339004C8BC1740B4983C002664183380075F54C2BC20FB70266418904104883C2026685C075EF488BC1C34C8BC14C2BC20FB70266418904104883C2026685C075EF488BC1C3CC4C8BC14C2BC28A024188041048FFC284C075F3488BC1C3CC8039004C8BC1740949FFC04180380075F74C2BC28A024188041048FFC284C075F3488BC1C3CCCCCC48895C24084533D2458BCA4585C07E320FB702663901741A0FB719440FB7D88BC3412BC383F8207409442BDB4183FB20751041FFC14883C1024883C202453BC87CCE488B5C2408453BC8410F95C2418BC2C3CCCC4533C948895108458BC16644390A740D41FFC04963C06644390C4275F3664503C066448901664183C0026644894102C34883EC3833C04C8BD233D248895424228954242A668954242E66894424204885C9741A4D85D27415488BD1488D4C2420E89BFFFFFF488D4C242041FFD24883C438C3CCCC4883EC284863C14C8BCA4C8D44243833D233C94869C0F0D8FFFF488944243841FFD14883C428C3CC48895C241048897C241855488BEC4883EC604883651000488365C800488365D800488365E000488365F000488365F800498BD9498BF848894DC0488BC24C8D4DC04C8D45D0488D4D10BAFFFF1F00C745D030000000C745E840020000FFD0488B4D104885C9740DBA01000000FFD7488B4D10FFD34C8D5C2460498B5B18498B7B20498BE35DC3CCCC488BC44889580848896810565741544883EC308360D80083601800498BF18BEA4C8BE1498BD833FF4C8D4818488D50D88D4F054533C0FFD3894424208B44246085C0750733C0E9C20000008D14004533C033C9FFD6448B4424604C8D4C2460488BD0B9050000004503C0488BF0FFD38944242085C0740B33D2488BCEFF542470EBC28B4C246048B81986611886611886488BDE48F7E1482BCA48D1E94803CA48C1E908894C2460488B4B404885C9742E0FB743383BC57C262BC5992BC2D1F84C63C8781A8BC54A8D0C49992BC2498BD4D1F8448BC0E8AEFDFFFF85C0740B393B740B8B034803D8EBBE488B7B50488B4424784885C0740A4885FF7405488918EB0933D2488BCEFF542470488BC7488B5C2450488B6C24584883C430415C5F5EC3C20000CC4585C07410482BCA8A0288041148FFC241FFC875F3F3C3CC40534883EC20488BD9E8E6FBFFFF488D0DDFFBFFFF482BD94803C34883C4205BC3CCCCCC48895C2408488974241048897C24185541544155488BEC4883EC404863413C4C8BC1B90B020000488BF2C745E04D6D4765C745E474537973C745E874656D52C745EC6F757469C745F06E654164C745F46472657366C745F873006642394C00180F8584000000428B8400880000004533D24903C08B50208B58248B781C448B68184903D04903D84903F84585ED745B8B024533C94903C044380874234C8D5DE0488BC84C2BD8458A240B4584E47410443821750B48FFC149FFC180390075E741803C0100750842807C0DE000740E41FFC24883C204453BD57310EBB3420FB70C538B048F4903C0488906488B1E4885DB750883C8FFE9E1020000488D0D47340000E8D6FEFFFF488BD3488BC8E89BFCFFFF488D0D5034000048898690000000E8B8FEFFFF488B16488BC8E87DFCFFFF488D0D5A34000048898698000000E89AFEFFFF488B16488BC8E85FFCFFFF488D0D6C34000048894608E87FFEFFFF488B16488BC8E844FCFFFF488D0D8934000048894610E864FEFFFF488B16488BC8E829FCFFFF488D0D9E34000048894618E849FEFFFF488B16488BC8E80EFCFFFF488D0DAB34000048894620E82EFEFFFF488B16488BC8E8F3FBFFFF488D0DC834000048894628E813FEFFFF488B16488BC8E8D8FBFFFF488D0DE534000048894630E8F8FDFFFF488B16488BC8E8BDFBFFFF488D0D0235000048894638E8DDFDFFFF488B16488BC8E8A2FBFFFF488D0DF734000048894640E8C2FDFFFF488B16488BC8E887FBFFFF488D0DFC34000048894648E8A7FDFFFF488B16488BC8E86CFBFFFF488D0D0935000048894650E88CFDFFFF488B16488BC8E851FBFFFF488D0D0E35000048894658E871FDFFFF488BC8488B16E836FBFFFF488D0D2B35000048894660E856FDFFFF488B16488BC8E81BFBFFFF488D0D5035000048894668E83BFDFFFF488B16488BC8E800FBFFFF488D0D5D35000048894670E820FDFFFF488B16488BC8E8E5FAFFFF488D0D7235000048894678E805FDFFFF488B16488BC8E8CAFAFFFF488D0D8735000048898680000000E8E7FCFFFF488B16488BC8E8ACFAFFFF488D0D8935000048898688000000E8C9FCFFFF488B16488BC8E88EFAFFFF488D0D8B350000488986A0000000E8ABFCFFFF488B16488BC8E870FAFFFF488D0D95350000488986A8000000E88DFCFFFF488B16488BC8E852FAFFFF488D0DA7350000488986B0000000E86FFCFFFF488B16488BC8E834FAFFFF488D0DA1350000488986B8000000E851FCFFFF488B16488BC8E816FAFFFF488D0DA3350000488986C0000000E833FCFFFF488B16488BC8E8F8F9FFFF488D0DA5350000488986C8000000E815FCFFFF488B16488BC8E8DAF9FFFF488986D000000033C0488B5C2460488B742468488B7C24704883C440415D415C5DC348895C24085556574154415541564157488DAC2410FEFFFF4881ECF00200004533FF488BD9498BF8488BF2488D8DE100000041B80301000033D24C897C24504C897C24604C897C24704C897C24684C89BD480200004488BDE0000000E8EFF7FFFF488D4DC0C745C01C010000FF9688000000837DC40675488B45C885C0752780BDDA00000001754D83C8FF488B9C24300300004881C4F0020000415F415E415D415C5F5E5DC383F801742A83F802740583F80375D380BDDA000000017517EBC8837DC40A75C244397DC875BC80BDDA0000000175B3488BD7488BCBFF56384C393F74A541BD300000004C897C243041BE000000084C8D8D380200004C8D442478488D4C2460418D55DEBB00020000448974242848C785380200004729000044896C24784C897D80895D904C897D884C897D984C897DA0C744242040000000FF96900000004C397C24607509418D45CEE937FFFFFF895D90BB040000004C897C24304C8D8D380200004C8D442478488D4C24708D530241BC1F4C1000448974242844896C24784C897D804C897D884C89A5380200004C897D984C897DA0895C2420FF9690000000488B0F4C8D7708498BD64C8975B0FF5678488B4C2460C74424484000000044897C2440C744243802000000488D44245048894424304C8D85480200004533C94883CAFF4C897C242848C744242000200000FF9698000000488B4C2470895C244844897C2440C744243802000000488D44245048894424304C8D4424684533C94883CAFF4C897C24284C897C24504C89642420 }
|
|
|
|
$b = { E800000000582D051040000500104000C3558BEC8B45082D001040005DC20400558BECFF7508E80A0A000033C05DC20400558BEC8B4D1085C9741F0FB6450C69C0010101018BD153578B7D08C1E902F3AB8BCA83E103F3AA5F5B8B45085DC3558BECE899FFFFFF8B4D0881E90010400003C15DC20400558BEC8B4D0833C066390174084066833C410075F85DC20400558BEC8B450866833800568BF0740983C60266833E0075F78B4D0C2BF10FB7116689140E83C1026685D275F15E5DC20800558BEC8B55088B450C2BD00FB70866890C0283C0026685C975F18B45085DC20800558BEC8B55088B450C2BD08A08880C024084C975F68B45085DC20800558BEC8B4508803800568BF0740646803E0075FA8B4D0C2BF18A1188140E4184D275F65E5DC20800558BEC5633F63975107E2D8B45088B4D0C0FB704700FB70C71663BC174148BD08BC18BCA2BC883F92074072BC283F8207506463B75107CD333C03B75105E0F95C05DC20C00558BEC8B450C8B550850894204E8FAFEFFFF03C066890283C002668942025DC20800558BEC51515733C0668945F88D7DFAAB33C966AB5F394D08741A394D0C7415FF75088D45F850E8B3FFFFFF8D45F850FF550C8BC88BC1C9C20800558BEC51518B45086AFF9968F0D8FFFF5250E8730A00008945F88D45F8506A006A008955FCFF550CC9C20800558BEC83EC248B4508568945F48D45F4508D45DC5033F668FFFF1F008D45FC508975FC8975F8C745DC180000008975E0C745E8400200008975E48975EC8975F0FF550C3975FC5E740E6A01FF75FCFF5510FF75FCFF5514C9C21000558BEC83EC0C538D45FC5033DB538D45F8506A05895DF8895DFCFF55108945F88B45FC3BC3750733C0E99E000000565303C05053FF55148BF08D45FC508B45FC03C050566A05897514FF55108945F83BC374095356FF551833C0EB6F8B45FC33D2B9F8000000F7F1578945FC8B7E3C3BFB742E0FB746383B450C7C252B450C992BC28BC8D1F978198B450C992BC2D1F850FF75088D044F50E83BFEFFFF85C0740A8B063BC3740903F0EBC18B7E44EB028BFB8B451C3BC374083BFB74048930EB0753FF7514FF55188BC75F5E5BC9C21800C21400558BEC837D100074178B4D088B450C2BC88A10FF4D1088140140837D100075F15DC20C00558BECE8B3FCFFFF8B4D0881E90010400003C15DC20400558BEC83EC2C538B5D088B433CB90B010000568B750CC745D44D6D4765C745D874537973C745DC74656D52C745E06F757469C745E46E654164C745E86472657366C745EC730066394C18180F858F0000008B44187803C38B501C8B482003D3578B78248B40188955F033D203CB03FB8955FC8945F485C07466EB038B5D088B149183650C0003D3803A0074238D5DD42BDA8BC2895DF8EB038B5DF88A1C0384DB740D38187509FF450C4080380075E98B450C803C10007507807C05D400740E8B55FC428955FC3B55F472B0EB128B45FC0FB704478B4DF08B048103450889065F8B0685C0750883C8FFE9230200005068D0414000E8F0FEFFFF50E831FDFFFFFF3689464868F0414000E8DBFEFFFF50E81CFDFFFFFF3689464C6818424000E8C6FEFFFF50E807FDFFFFFF368946046844424000E8B1FEFFFF50E8F2FCFFFFFF368946086878424000E89CFEFFFF50E8DDFCFFFFFF3689460C68A8424000E887FEFFFF50E8C8FCFFFFFF3689461068CC424000E872FEFFFF50E8B3FCFFFFFF368946146800434000E85DFEFFFF50E89EFCFFFFFF368946186834434000E848FEFFFF50E889FCFFFFFF3689461C686C434000E833FEFFFF50E874FCFFFFFF36894620687C434000E81EFEFFFF50E85FFCFFFFFF36894624689C434000E809FEFFFF50E84AFCFFFFFF3689462868C0434000E8F4FDFFFF50E835FCFFFFFF3689462C68DC434000E8DFFDFFFF50E820FCFFFFFF368946306810444000E8CAFDFFFF50E80BFCFFFFFF36894634684C444000E8B5FDFFFF50E8F6FBFFFFFF368946386874444000E8A0FDFFFF50E8E1FBFFFFFF3689463C68A0444000E88BFDFFFF50E8CCFBFFFFFF3689464068D0444000E876FDFFFF50E8B7FBFFFFFF3689464468EC444000E861FDFFFF50E8A2FBFFFFFF368946506808454000E84CFDFFFF50E88DFBFFFFFF368946546830454000E837FDFFFF50E878FBFFFFFF36894658685C454000E822FDFFFF50E863FBFFFFFF3689465C6870454000E80DFDFFFF50E84EFBFFFFFF368946606890454000E8F8FCFFFF50E839FBFFFFFF3689466468AC454000E8E3FCFFFF50E824FBFFFF89466833C05E5BC9C20800558BEC81EC5C020000535633DB5768030100008D85A5FDFFFF5350895DF8895DE8895DDC895DF4895DFC889DA4FDFFFFE889F9FFFF8B7D0C83C40C8D85A8FEFFFF50C785A8FEFFFF1C010000FF574483BDACFEFFFF05751283BDB0FEFFFF02743983BDB0FEFFFF01EB2E83BDACFEFFFF06750E399DB0FEFFFF7510807DC201751983C8FF5F5E5BC9C20C0083BDB0FEFFFF0175ED807DC20175E78B751056FF7508FF571C391E74D95368000000086A408D45EC508D45C4506A0E8D45E850C745EC47250000895DF0C745C418000000895DC8C745D000020000895DCC895DD4895DD8FF5748395DE875056AFE58EB955368000000086A048D45EC508D45C4506A068D45DCBE0B4C1000508975EC895DF0C745C418000000895DC8C745D000020000895DCC895DD4895DD8FF57488B45108D480451FF30894DE0FF573C6A40536A028D45F850536800200000538D45FC506AFFFF75E8FF574C6A04536A028D45F8505356538D45F4506AFFFF75DC895DF88975EC895DF0FF574C395DFC0F84330200008B75F43BF30F8428020000895E048B85B4FEFFFF8946108B85ACFEFFFF8946088B85B0FEFFFF89460C6A0C5889462C8946308B4510C7060C3C1000C7462830000000C746342C000000C7463818000000C7463CA80100008B401C894618895D0C6840464000E800F8FFFF8BC88B450C8A0C0180F10D888C05A4FDFFFF4089450C3D040100007CD98D8DA4FDFFFF8D46405150E855F8FFFF6844474000E8C9F7FFFF508D464050E85DF8FFFF8B45108B40283BC3742C8B4E1883F902750A8B40200504020000EB0D83F90375158B40200500010000508D860001000050E80BF8FFFFE825F7FFFFB9881C400081E90010400003C189450C33C9EB038B450C8A04088B55FC88040A4181F94825000072EB535353680C3C100056FF572C8BF03BF37460536A0156FF57386A1053536A015356FF57348B75108946203BC37447C680040200004E8B4620C68005020000538B4620C680060200002E8B4620C68007020000658B4620C68008020000788B4620C68009020000658B462088980A020000EB038B75108B46243BC30F8497000000895D083958040F868B000000895D0C8B46248B4D0C8B8401DC0000008D4D105150895D10FF5714395D107455FF7510FF57683B06754B536A3053FF57048945E43BC3743DE833F6FFFF53B91E13400081E90010400003C18B4DFC6A0183C12051535053FF7510FF75E4FF57245353FF75F4FF75E4FF5728FF770C6A01E8C1F7FFFFFF45088B46248B4D0883450C403B48040F8278FFFFFFFF75E0FF574033C0E9CFFCFFFFFF75E0FF57406AFDE92AFDFFFF558BEC81EC0C020000565733F66A688D8540FFFFFF565089B53CFFFFFFE8DAF5FFFF83C40C6A0A5933C06A0A8975A88D7DACF3AB5989B510FFFFFF8DBD14FFFFFFF3AB8D45A8898538FFFFFF8D853CFFFFFF50FF7508C745C401000000C7852CFFFFFF02000000E8BBF8FFFF85C00F8582010000538D85F4FDFFFF50C785F4FDFFFF1C010000FF5580BBEC45400083BDF8FDFFFF05750353EB0568D0454000E86CF8FFFF8D4DCC51FFB54CFFFFFFFFB540FFFFFFFFB544FFFFFF6A1850E856F7FFFFFFB548FFFFFF8BF83BFE750C68D0070000E8B9F6FFFFEBB46888130000E8ADF6FFFF8D45A8508D853CFFFFFF5057E849FBFFFF85C00F85F8000000EB10FFB548FFFFFF68D0070000E882F6FFFF8B45C883781C0175E783BDF8FDFFFF05750E6808464000E8E5F7FFFF6A16EB0C68D0454000E8D7F7FFFF6A18598D9534FFFFFF52FFB54CFFFFFFFFB540FFFFFFFFB544FFFFFF5150E8BCF6FFFF }
|
|
condition:
|
|
filesize < 1KB and
|
|
any of them
|
|
} |