JohnGalt14

Five Eyes QUERTY Malware Yara Rules

Jan 18th, 2015
1,137
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. rule FiveEyes_QUERTY_Malwareqwerty_20121 {
  2.     meta:
  3.         description = "FiveEyes QUERTY Malware - file 20121.xml"
  4.         author = "Florian Roth"
  5.         reference = "http://www.spiegel.de/media/media-35668.pdf"
  6.         date = "2015/01/18"
  7.         hash = "8263fb58350f3b1d3c4220a602421232d5e40726"
  8.     strings:
  9.         $s0 = "<configFileName>20121_cmdDef.xml</configFileName>" fullword ascii
  10.         $s1 = "<name>20121.dll</name>" fullword ascii
  11.         $s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
  12.         $s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
  13.         $s4 = "<platform type=\"1\">" fullword ascii
  14.         $s5 = "</plugin>" fullword ascii
  15.         $s6 = "</pluginConfig>" fullword ascii
  16.         $s7 = "<pluginConfig>" fullword ascii
  17.         $s8 = "</platform>" fullword ascii
  18.         $s9 = "</lpConfig>" fullword ascii
  19.         $s10 = "<lpConfig>" fullword ascii
  20.     condition:
  21.         9 of them
  22. }
  23.  
  24. rule FiveEyes_QUERTY_Malwaresig_20123_sys {
  25.     meta:
  26.         description = "FiveEyes QUERTY Malware - file 20123.sys.bin"
  27.         author = "Florian Roth"
  28.         reference = "http://www.spiegel.de/media/media-35668.pdf"
  29.         date = "2015/01/18"
  30.         hash = "a0f0087bd1f8234d5e847363d7e15be8a3e6f099"
  31.     strings:
  32.         $s0 = "20123.dll" fullword ascii
  33.         $s1 = "kbdclass.sys" fullword wide
  34.         $s2 = "IoFreeMdl" fullword ascii
  35.         $s3 = "ntoskrnl.exe" fullword ascii
  36.         $s4 = "KfReleaseSpinLock" fullword ascii
  37.     condition:
  38.         all of them
  39. }
  40.  
  41. rule FiveEyes_QUERTY_Malwaresig_20123_cmdDef {
  42.     meta:
  43.         description = "FiveEyes QUERTY Malware - file 20123_cmdDef.xml"
  44.         author = "Florian Roth"
  45.         reference = "http://www.spiegel.de/media/media-35668.pdf"
  46.         date = "2015/01/18"
  47.         hash = "7b08fc77629f6caaf8cc4bb5f91be6b53e19a3cd"
  48.     strings:
  49.         $s0 = "<shortDescription>Keystroke Collector</shortDescription>" fullword ascii
  50.         $s1 = "This plugin is the E_Qwerty Kernel Mode driver for logging keys.</description>" fullword ascii
  51.         $s2 = "<commands/>" fullword ascii
  52.         $s3 = "</version>" fullword ascii
  53.         $s4 = "<associatedImplantId>20121</associatedImplantId>" fullword ascii
  54.         $s5 = "<rightsRequired>System or Administrator (if Administrator, I think the DriverIns" ascii
  55.         $s6 = "<platforms>Windows NT, Windows 2000, Windows XP (32/64 bit), Windows 2003 (32/64" ascii
  56.         $s7 = "<projectpath>plugin/Collection</projectpath>" fullword ascii
  57.         $s8 = "<dllDepend>None</dllDepend>" fullword ascii
  58.         $s9 = "<minorType>0</minorType>" fullword ascii
  59.         $s10 = "<pluginname>E_QwertyKM</pluginname>" fullword ascii
  60.         $s11 = "</comments>" fullword ascii
  61.         $s12 = "<comments>" fullword ascii
  62.         $s13 = "<majorType>1</majorType>" fullword ascii
  63.         $s14 = "<files>None</files>" fullword ascii
  64.         $s15 = "<poc>Erebus</poc>" fullword ascii
  65.         $s16 = "</plugin>" fullword ascii
  66.         $s17 = "<team>None</team>" fullword ascii
  67.         $s18 = "<?xml-stylesheet type=\"text/xsl\" href=\"../XSLT/pluginHTML.xsl\"?>" fullword ascii
  68.         $s19 = "<pluginsDepend>U_HookManager v1.0, Kernel Covert Store v1.0</pluginsDepend>" fullword ascii
  69.         $s20 = "<plugin id=\"20123\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi" ascii
  70.     condition:
  71.         14 of them
  72. }
  73.  
  74. rule FiveEyes_QUERTY_Malwaresig_20121_dll {
  75.     meta:
  76.         description = "FiveEyes QUERTY Malware - file 20121.dll.bin"
  77.         author = "Florian Roth"
  78.         reference = "http://www.spiegel.de/media/media-35668.pdf"
  79.         date = "2015/01/18"
  80.         hash = "89504d91c5539a366e153894c1bc17277116342b"
  81.     strings:
  82.         $s0 = "WarriorPride\\production2.0\\package\\E_Wzowski" ascii
  83.         $s1 = "20121.dll" fullword ascii
  84.     condition:
  85.         all of them
  86. }
  87. rule FiveEyes_QUERTY_Malwareqwerty_20123 {
  88.     meta:
  89.         description = "FiveEyes QUERTY Malware - file 20123.xml"
  90.         author = "Florian Roth"
  91.         reference = "http://www.spiegel.de/media/media-35668.pdf"
  92.         date = "2015/01/18"
  93.         hash = "edc7228b2e27df9e7ff9286bddbf4e46adb51ed9"
  94.     strings:
  95.         $s0 = "<!-- edited with XMLSPY v5 rel. 4 U (http://www.xmlspy.com) by TEAM (RENEGADE) -" ascii
  96.         $s1 = "<configFileName>20123_cmdDef.xml</configFileName>" fullword ascii
  97.         $s2 = "<name>20123.sys</name>" fullword ascii
  98.         $s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
  99.         $s4 = "<codebase>/bin/i686-pc-win32/debug</codebase>" fullword ascii
  100.         $s5 = "<platform type=\"1\">" fullword ascii
  101.         $s6 = "</plugin>" fullword ascii
  102.         $s7 = "</pluginConfig>" fullword ascii
  103.         $s8 = "<pluginConfig>" fullword ascii
  104.         $s9 = "</platform>" fullword ascii
  105.         $s10 = "</lpConfig>" fullword ascii
  106.         $s11 = "<lpConfig>" fullword ascii
  107.     condition:
  108.         9 of them
  109. }
  110.  
  111. rule FiveEyes_QUERTY_Malwaresig_20120_dll {
  112.     meta:
  113.         description = "FiveEyes QUERTY Malware - file 20120.dll.bin"
  114.         author = "Florian Roth"
  115.         reference = "http://www.spiegel.de/media/media-35668.pdf"
  116.         date = "2015/01/18"
  117.         hash = "6811bfa3b8cda5147440918f83c40237183dbd25"
  118.     strings:
  119.         $s0 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.txt" fullword wide
  120.         $s1 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.xml" fullword wide
  121.         $s2 = "Failed to send the EQwerty_driverStatusCommand to the implant." fullword ascii
  122.         $s3 = "- Log Used (number of windows) - %d" fullword wide
  123.         $s4 = "- Log Limit (number of windows) - %d" fullword wide
  124.         $s5 = "Process or User Default Language" fullword wide
  125.         $s6 = "Windows 98/Me, Windows NT 4.0 and later: Vietnamese" fullword wide
  126.         $s7 = "- Logging of keystrokes is switched ON" fullword wide
  127.         $s8 = "- Logging of keystrokes is switched OFF" fullword wide
  128.         $s9 = "Qwerty is currently logging active windows with titles containing the fo" wide
  129.         $s10 = "Windows 95, Windows NT 4.0 only: Korean (Johab)" fullword wide
  130.         $s11 = "FAILED to get Qwerty Status" fullword wide
  131.         $s12 = "- Successfully retrieved Log from Implant." fullword wide
  132.         $s13 = "- Logging of all Windows is toggled ON" fullword wide
  133.         $s14 = "- Logging of all Windows is toggled OFF" fullword wide
  134.         $s15 = "Qwerty FAILED to retrieve window list." fullword wide
  135.         $s16 = "- UNSUCCESSFUL Log Retrieval from Implant." fullword wide
  136.         $s17 = "The implant failed to return a valid status" fullword ascii
  137.         $s18 = "- Log files were NOT generated!" fullword wide
  138.         $s19 = "Windows 2000/XP: Armenian. This is Unicode only." fullword wide
  139.         $s20 = "- This machine is using a PS/2 Keyboard - Continue on using QWERTY" fullword wide
  140.     condition:
  141.         10 of them
  142. }
  143.  
  144. rule FiveEyes_QUERTY_Malwaresig_20120_cmdDef {
  145.     meta:
  146.         description = "FiveEyes QUERTY Malware - file 20120_cmdDef.xml"
  147.         author = "Florian Roth"
  148.         reference = "http://www.spiegel.de/media/media-35668.pdf"
  149.         date = "2015/01/18"
  150.         hash = "cda9ceaf0a39d6b8211ce96307302a53dfbd71ea"
  151.     strings:
  152.         $s0 = "This PPC gets the current keystroke log." fullword ascii
  153.         $s1 = "This command will add the given WindowTitle to the list of Windows to log keys f" ascii
  154.         $s2 = "This command will remove the WindowTitle corresponding to the given window title" ascii
  155.         $s3 = "This command will return the current status of the Keyboard Logger (Whether it i" ascii
  156.         $s4 = "This command Toggles logging of all Keys. If allkeys is toggled all keystrokes w" ascii
  157.         $s5 = "<definition>Turn logging of all keys on|off</definition>" fullword ascii
  158.         $s6 = "<name>Get Keystroke Log</name>" fullword ascii
  159.         $s7 = "<description>Keystroke Logger Lp Plugin</description>" fullword ascii
  160.         $s8 = "<definition>display help for this function</definition>" fullword ascii
  161.         $s9 = "This command will switch ON Logging of keys. All keys taht are entered to a acti" ascii
  162.         $s10 = "Set the log limit (in number of windows)" fullword ascii
  163.         $s11 = "<example>qwgetlog</example>" fullword ascii
  164.         $s12 = "<aliasName>qwgetlog</aliasName>" fullword ascii
  165.         $s13 = "<definition>The title of the Window whose keys you wish to Log once it becomes a" ascii
  166.         $s14 = "This command will switch OFF Logging of keys. No keystrokes will be captured" fullword ascii
  167.         $s15 = "<definition>The title of the Window whose keys you no longer whish to log</defin" ascii
  168.         $s16 = "<command id=\"32\">" fullword ascii
  169.         $s17 = "<command id=\"3\">" fullword ascii
  170.         $s18 = "<command id=\"7\">" fullword ascii
  171.         $s19 = "<command id=\"1\">" fullword ascii
  172.         $s20 = "<command id=\"4\">" fullword ascii
  173.     condition:
  174.         10 of them
  175. }
  176.  
  177. rule FiveEyes_QUERTY_Malwareqwerty_20120 {
  178.     meta:
  179.         description = "FiveEyes QUERTY Malware - file 20120.xml"
  180.         author = "Florian Roth"
  181.         reference = "http://www.spiegel.de/media/media-35668.pdf"
  182.         date = "2015/01/18"
  183.         hash = "597082f05bfd3225587d480c30f54a7a1326a892"
  184.     strings:
  185.         $s0 = "<configFileName>20120_cmdDef.xml</configFileName>" fullword ascii
  186.         $s1 = "<name>20120.dll</name>" fullword ascii
  187.         $s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
  188.         $s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
  189.         $s4 = "<platform type=\"1\">" fullword ascii
  190.         $s5 = "</plugin>" fullword ascii
  191.         $s6 = "</pluginConfig>" fullword ascii
  192.         $s7 = "<pluginConfig>" fullword ascii
  193.         $s8 = "</platform>" fullword ascii
  194.         $s9 = "</lpConfig>" fullword ascii
  195.         $s10 = "<lpConfig>" fullword ascii
  196.     condition:
  197.         all of them
  198. }
  199.  
  200. rule FiveEyes_QUERTY_Malwaresig_20121_cmdDef {
  201.     meta:
  202.         description = "FiveEyes QUERTY Malware - file 20121_cmdDef.xml"
  203.         author = "Florian Roth"
  204.         reference = "http://www.spiegel.de/media/media-35668.pdf"
  205.         date = "2015/01/18"
  206.         hash = "64ac06aa4e8d93ea6063eade7ce9687b1d035907"
  207.     strings:
  208.         $s0 = "<shortDescription>Keystroke Logger Plugin.</shortDescription>" fullword ascii
  209.         $s1 = "<message>Failed to get File Time</message>" fullword ascii
  210.         $s2 = "<description>Keystroke Logger Plugin.</description>" fullword ascii
  211.         $s3 = "<message>Failed to set File Time</message>" fullword ascii
  212.         $s4 = "</commands>" fullword ascii
  213.         $s5 = "<commands>" fullword ascii
  214.         $s6 = "</version>" fullword ascii
  215.         $s7 = "<associatedImplantId>20120</associatedImplantId>" fullword ascii
  216.         $s8 = "<message>No Comms. with Driver</message>" fullword ascii
  217.         $s9 = "</error>" fullword ascii
  218.         $s10 = "<message>Invalid File Size</message>" fullword ascii
  219.         $s11 = "<platforms>Windows (User/Win32)</platforms>" fullword ascii
  220.         $s12 = "<message>File Size Mismatch</message>" fullword ascii
  221.         $s13 = "<projectpath>plugin/Utility</projectpath>" fullword ascii
  222.         $s14 = "<pluginsDepend>None</pluginsDepend>" fullword ascii
  223.         $s15 = "<dllDepend>None</dllDepend>" fullword ascii
  224.         $s16 = "<pluginname>E_QwertyIM</pluginname>" fullword ascii
  225.         $s17 = "<rightsRequired>None</rightsRequired>" fullword ascii
  226.         $s18 = "<minorType>0</minorType>" fullword ascii
  227.         $s19 = "<code>00001002</code>" fullword ascii
  228.         $s20 = "<code>00001001</code>" fullword ascii
  229.     condition:
  230.         12 of them
  231. }
RAW Paste Data