/* These rules match on all stage 1 samples from the Symantec report. Tested on Windows 7 x64, Windows 2003 and Windows 2008 R2 - known to generate False Positives on Windows XP. Please check out this URL for a report with Yara rules for the other stages: https://securelist.com/files/2014/11/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf */

rule Regin_APT_KernelDriver_Generic_A {
    meta:
        description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
        author = "@Malwrsignatures - included in APT Scanner THOR"
        date = "23.11.14"
        hash1 = "187044596bc1328efa0ed636d8aa4a5c"
        hash2 = "06665b96e293b23acc80451abb413e50"
        hash3 = "d240f06e98c8d3e647cbf4d442d79475"
    strings:
        $m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }
        $m1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }

        $s0 = "atapi.sys" fullword wide
        $s1 = "disk.sys" fullword wide
        $s3 = "h.data" fullword ascii
        $s4 = "\\system32" fullword ascii
        $s5 = "\\SystemRoot" fullword ascii
        $s6 = "system" fullword ascii
        $s7 = "temp" fullword ascii
        $s8 = "windows" fullword ascii

        $x1 = "LRich6" fullword ascii
        $x2 = "KeServiceDescriptorTable" fullword ascii
    condition:
        $m0 at 0 and $m1 and
        all of ($s*) and 1 of ($x*)
}

rule Regin_APT_KernelDriver_Generic_B {
    meta:
        description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
        author = "@Malwrsignatures - included in APT Scanner THOR"
        date = "23.11.14"
        hash1 = "ffb0b9b5b610191051a7bdf0806e1e47"
        hash2 = "bfbe8c3ee78750c3a520480700e440f8"
        hash3 = "b29ca4f22ae7b7b25f79c1d4a421139d"
        hash4 = "06665b96e293b23acc80451abb413e50"
        hash5 = "2c8b9d2885543d7ade3cae98225e263b"
        hash6 = "4b6b86c7fec1c574706cecedf44abded"
        hash7 = "187044596bc1328efa0ed636d8aa4a5c"
        hash8 = "d240f06e98c8d3e647cbf4d442d79475"
        hash9 = "6662c390b2bbbd291ec7987388fc75d7"
        hash10 = "1c024e599ac055312a4ab75b3950040a"
        hash11 = "ba7bb65634ce1e30c1e5415be3d1db1d"
        hash12 = "b505d65721bb2453d5039a389113b566"
        hash13 = "b269894f434657db2b15949641a67532"
    strings:
        $m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }
        $s1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
        $s2 = "H.data" fullword ascii nocase
        $s3 = "INIT" fullword ascii
        $s4 = "ntoskrnl.exe" fullword ascii

        $v1 = "\\system32" fullword ascii
        $v2 = "\\SystemRoot" fullword ascii
        $v3 = "KeServiceDescriptorTable" fullword ascii

        $w1 = "\\system32" fullword ascii
        $w2 = "\\SystemRoot" fullword ascii
        $w3 = "LRich6" fullword ascii

        $x1 = "_snprintf" fullword ascii
        $x2 = "_except_handler3" fullword ascii

        $y1 = "mbstowcs" fullword ascii
        $y2 = "wcstombs" fullword ascii
        $y3 = "KeGetCurrentIrql" fullword ascii

        $z1 = "wcscpy" fullword ascii
        $z2 = "ZwCreateFile" fullword ascii
        $z3 = "ZwQueryInformationFile" fullword ascii
        $z4 = "wcslen" fullword ascii
        $z5 = "atoi" fullword ascii
    condition:
        $m0 at 0 and all of ($s*) and
        ( all of ($v*) or all of ($w*) or all of ($x*) or all of ($y*) or all of ($z*) )
        and filesize < 20KB
}

rule Regin_APT_KernelDriver_Generic_C {
    meta:
        description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
        author = "@Malwrsignatures - included in APT Scanner THOR"
        date = "23.11.14"
        hash1 = "e0895336617e0b45b312383814ec6783556d7635"
        hash2 = "732298fa025ed48179a3a2555b45be96f7079712"
    strings:
        $m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }

        $s0 = "KeGetCurrentIrql" fullword ascii
        $s1 = "5.2.3790.0 (srv03_rtm.030324-2048)" fullword wide
        $s2 = "usbclass" fullword wide

        $x1 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ascii
        $x2 = "Universal Serial Bus Class Driver" fullword wide
        $x3 = "5.2.3790.0" fullword wide

        $y1 = "LSA Shell" fullword wide
        $y2 = "0Richw" fullword ascii
    condition:
        $m0 at 0 and all of ($s*) and
        ( all of ($x*) or all of ($y*) )
        and filesize < 20KB
}

rule Regin_sig_svcsstat {
    meta:
        description = "Detects svcstat from Regin report - file svcsstat.exe_sample"
        author = "@Malwrsignatures"
        date = "25.11.14"
        score = 70
        hash = "5164edc1d54f10b7cb00a266a1b52c623ab005e2"
    strings:
        $s0 = "Service Control Manager" fullword ascii
        $s1 = "_vsnwprintf" fullword ascii
        $s2 = "Root Agency" fullword ascii
        $s3 = "Root Agency0" fullword ascii
        $s4 = "StartServiceCtrlDispatcherA" fullword ascii
        $s5 = "\\\\?\\UNC" fullword ascii
        $s6 = "%ls%ls" fullword wide
    condition:
        all of them and filesize < 15KB and filesize > 10KB
}