View difference between Paste ID: ezGhRbsm and 0ZEWvjsC

-/* Scroll down to find a YARA rule set to detect Regin Backdoor samples
+/* These rules match on all stage 1 samples from the Symantec report. Tested on Windows 7 x64, Windows 2003 and Windows 2008 R2 - known to generate False Positives on Windows XP. Please check out this URL for a report with Yara rules for the other stages: https://securelist.com/files/2014/11/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf */
 
-Update 11.03.15 17:15
+
-New False Positive:
+
-54263888c64a7f010d3b5e399369b0f3ff3af0a0de8adb502b98277533e4d45f - Windows Serial Driver
+
 		author = "@Malwrsignatures - included in APT Scanner THOR"
-Update 12.01.15 11:30
+
-New False Positive:
+
-519a0d7ebc75dcf65c80d61f952768e49c33c5c7c320a4cc4b4a12a0e9f3337d - SP1.CAB MSDN Disc 3498 (Microsoft)
+
 		hash3 = "d240f06e98c8d3e647cbf4d442d79475"
-Update 09.01.15 16:15
+
-New False Positive:
+
-9009ca5c5f6e2c7a776896e406805bc4c627028ce90d8fe566a6b2190c7e0106 - Windows Media Connect, code_page: Korean
+
 
-Update 01.01.15 22:11
+
-New False Positive:
+
-581730d7cce49af90efad5f904ce205ee7123e6c0d206867fb8ad22559fa0556 - Windows Media Component Setup Application
+
 		$s4 = "\\system32" fullword ascii
-Update 29.12.14 11:35
+
-New False Positive:
+
-b04a85ef2edbc5ac7b312e9d57b533d9d355d0c7cbbd24a8085c6873baf9411f - Windows SCSI Driver
+
 		$s8 = "windows" fullword ascii
-Update 23.12.14 15:50
+
-New False Positive:
+
-0099940a366b401f30faaf820f4815083778383a2b1e9fab58e16d10b8965e3f - USB Scanner Driver
+
 	condition:
-Update 15.12.14 11:15
+
-Updated ReginScanner on Github (0.7: Filtered False Positive Hashes)
+
-https://github.com/Neo23x0/ReginScanner
+
 
-Update 06.12.14 11:00
+
-New False Positives SHA256s and Updated Yara rule "Regin_Sample_1"
+
-a26db2eb9f3e2509b4eba949db97595cc32332d9321df68283bfc102e66d766f - Windows Serial Driver
+
-18cd54d163c9c5f16e824d13c411e21fd7616d34e9f1cf2adcbf869ed6aeeed4 - CD Tower Web Client
+
 		date = "23.11.14"
-Update 03.12.14 18:10
+
-Updated false positives
+
 		hash3 = "b29ca4f22ae7b7b25f79c1d4a421139d"
-Update 02.12.14 09:15
+
-Added new and yet unknown Regin sample found via Virustotal with SHA256
+
-627dc5599c28de3c494496399b39f3aac7049586e72cbdb08bea01bf40166c23
+
 		hash7 = "187044596bc1328efa0ed636d8aa4a5c"
-Update 28.11.14 14:00
+
-False Positive detected. Microsoft XP USB Scanner Driver. See false positive hash list below.
+
-Updated rule "Regin_APT_KernelDriver_Generic_B" to exclude string that appears in Windows XP usb scanner driver.
+
 		hash11 = "ba7bb65634ce1e30c1e5415be3d1db1d"
-Update 28.11.14 09:00
+
-Check out ReginScanner to scan for multiple IOCs at once. It does not ship with the Kaspersky Yara rules. You should include them manually. (see the link below)
+
-https://github.com/Neo23x0/ReginScanner
+
 		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }
-Update 27.11.14
+
-I added a new signature set targeting new samples or samples that were not detected by the generic rules.
+
 		$s3 = "INIT" fullword ascii
-Tested on:
+
-- Windows 7 x64
+
-- Windows 2003
+
-- Windows 2008 R2
+
 		$v3 = "KeServiceDescriptorTable" fullword ascii
-False Positives:
+
-The signatures are known to generate False Positives on certain Windows XP USB scanner drivers. (see list below for hashes)
+
 		$w2 = "\\SystemRoot" fullword ascii
-Please check back with an MD5/SHA1/SHA256 hash if you found a sample that has Antivirus hits and is not in this list.
+
 
-Known sample list - SHA256:
+
-20831e820af5f41353b5afab659f2ad42ec6df5d9692448872f3ed8bbb40ab92
+
-225e9596de85ca7b1025d6e444f6a01aa6507feef213f4d2e20da9e7d5d8e430
+
-392f32241cd3448c7a435935f2ff0d2cdc609dda81dd4946b1c977d25134e96e
+
-40c46bcab9acc0d6d235491c01a66d4c6f35d884c19c6f410901af6d1e33513b
+
-4139149552b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be
+
-4e39bc95e35323ab586d740725a1c8cbcde01fe453f7c4cac7cced9a26e42cc9
+
-5001793790939009355ba841610412e0f8d60ef5461f2ea272ccf4fd4c83b823
+
-5c81cf8262f9a8b0e100d2a220f7119e54edfc10c4fb906ab7848a015cd12d90
+
-627dc5599c28de3c494496399b39f3aac7049586e72cbdb08bea01bf40166c23
+
-7553d4a5914af58b23a9e0ce6a262cd230ed8bb2c30da3d42d26b295f9144ab7
+
-7d38eb24cf5644e090e45d5efa923aff0e69a600fb0ab627e8929bb485243926
+
-8098938987e2f29e3ee416b71b932651f6430d15d885f2e1056d41163ae57c13
+
-8389b0d3fb28a5f525742ca2bf80a81cf264c806f99ef684052439d6856bc7e7
+
-8d7be9ed64811ea7986d788a75cbc4ca166702c6ff68c33873270d7c6597f5db
+
-9cd5127ef31da0e8a4e36292f2af5a9ec1de3b294da367d7c05786fe2d5de44f
+
-9ddbe7e77cb5616025b92814d68adfc9c3e076dddbe29de6eb73701a172c3379
+
-a0d82c3730bc41e267711480c8009883d1412b68977ab175421eabc34e4ef355
+
-a0e3c52a2c99c39b70155a9115a6c74ea79f8a68111190faa45a8fd1e50f8880
+
-a6603f27c42648a857b8a1cbf301ed4f0877be75627f6bbe99c0bfd9dc4adb35
+
-a7493fac96345a989b1a03772444075754a2ef11daa22a7600466adc1f69a669
+
-a7e3ad8ea7edf1ca10b0e5b0d976675c3016e5933219f97e94900dea0d470abe
+
-a7e3ad8ea7edf1ca10b0e5b0d976675c3016e5933219f97e94900dea0d470abe
+
-b12c7d57507286bbbe36d7acf9b34c22c96606ffd904e3c23008399a4a50c047
+
-b755ed82c908d92043d4ec3723611c6c5a7c162e78ac8065eb77993447368fce
+
-c0cf8e008fbfa0cb2c61d968057b4a077d62f64d7320769982d28107db370513
+
-cca1850725f278587845cd19cbdf3dceb6f65790d11df950f17c5ff6beb18601
+
-df77132b5c192bd8d2d26b1ebb19853cf03b01d38afd5d382ce77e0d7219c18c
+
-e1ba03a10a40aab909b2ba58dcdfd378b4d264f1f4a554b669797bbb8c8ac902
+
-e420d0cf7a7983f78f5a15e6cb460e93c7603683ae6c41b27bf7f2fa34b2d935
+
-ecd7de3387b64b7dab9a7fb52e8aa65cb7ec9193f8eac6a7d79407a6a932ef69
+
-f1d903251db466d35533c28e3c032b7212aa43c8d64ddf8c5521b43031e69e1e
+
-f89549fc84a8d0f8617841c6aa4bb1678ea2b6081c1f7f74ab1aebd4db4176e4
+
-fd92fd7d0f925ccc0b4cbb6b402e8b99b64fa6a4636d985d78e5507bd4cfecef
+
-fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129
+
 
-Heavily encrypted - use Hash instead of a Yara rule to detect these samples:
+
-d42300fea6eddcb2f65ffec9e179e46d87d91affad55510279ecbb0250d7fdff
+
 	condition:
-Known False Positives:
+
-6e5ebbc8b70c1d593634daf0c190deadfda18c3cbc8f552a76f156f3869ef05b - Microsoft USB Scanner Driver
+
-7565e7de9532c75b3a16e3ed0103bc092dbca63c6bdc19053dfef01250029e59 - NSRL listed
+
-a26db2eb9f3e2509b4eba949db97595cc32332d9321df68283bfc102e66d766f - Windows Serial Driver
+
-18cd54d163c9c5f16e824d13c411e21fd7616d34e9f1cf2adcbf869ed6aeeed4 - CD Tower Web Client
+
-0099940a366b401f30faaf820f4815083778383a2b1e9fab58e16d10b8965e3f - USB Scanner Driver
+
-b04a85ef2edbc5ac7b312e9d57b533d9d355d0c7cbbd24a8085c6873baf9411f - SCSI Driver Windows
+
-581730d7cce49af90efad5f904ce205ee7123e6c0d206867fb8ad22559fa0556 - Windows Media Component Setup Application
+
-519a0d7ebc75dcf65c80d61f952768e49c33c5c7c320a4cc4b4a12a0e9f3337d - SP1.CAB MSDN Disc 3498 (Microsoft)
+
-54263888c64a7f010d3b5e399369b0f3ff3af0a0de8adb502b98277533e4d45f - Windows Serial Driver
+		date = "25.11.14"
 		score = 70
-Please check out this URL for the Kaspersky report with more specific Yara rules:
+
-https://securelist.com/files/2014/11/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf
+
-*/
+
 		$s1 = "_vsnwprintf" fullword ascii
 		$s2 = "Root Agency" fullword ascii
 		$s3 = "Root Agency0" fullword ascii
 		$s4 = "StartServiceCtrlDispatcherA" fullword ascii
 		$s5 = "\\\\?\\UNC" fullword ascii
 		$s6 = "%ls%ls" fullword wide
 	condition:
 		all of them and filesize < 15KB and filesize > 10KB
 }