Mailerbot

yara sig:

rule Mailerbot_bin
{
    meta:
        description = "Mailerbot"
        author = "James_inthe_box"
        reference = "868995c7bd95bb0f7c1e1123130abc72388cbe3fccdc57120f6b90f54ffd04fe"
        date = "2019/12"
        maltype = "Mailer"

    strings:
        $string1 = "spam" wide ascii
        $string2 = "banned" wide ascii
        $string3 = "blacklist" wide ascii
        $string4 = "blocked" wide ascii
        $string5 = "listed as poor" wide ascii
        $string6 = "poor reputation" wide ascii
        $string7 = "ip is filtered" wide ascii
        $string8 = "rbl restriction" wide ascii
        $string9 = "in an rbl" wide ascii
        $string10 = "from that country" wide ascii
        $string11 = "too many connections" wide ascii
        $string12 = "too many concurrent" wide ascii
        $string13 = "try later" wide ascii
        $string14 = "server" wide ascii
        $string15 = "relay" wide ascii
        $string16 = "this connect" wide ascii
        $string17 = "ip is rejected" wide ascii

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 800KB
}

rule Mailerbot_mem
{
    meta:
        description = "Mailerbot"
        author = "James_inthe_box"
        reference = "868995c7bd95bb0f7c1e1123130abc72388cbe3fccdc57120f6b90f54ffd04fe"
        date = "2019/12"
        maltype = "Mailer"

    strings:
        $string1 = "spam" wide ascii
        $string2 = "banned" wide ascii
        $string3 = "blacklist" wide ascii
        $string4 = "blocked" wide ascii
        $string5 = "listed as poor" wide ascii
        $string6 = "poor reputation" wide ascii
        $string7 = "ip is filtered" wide ascii
        $string8 = "rbl restriction" wide ascii
        $string9 = "in an rbl" wide ascii
        $string10 = "from that country" wide ascii
        $string11 = "too many connections" wide ascii
        $string12 = "too many concurrent" wide ascii
        $string13 = "try later" wide ascii
        $string14 = "server" wide ascii
        $string15 = "relay" wide ascii
        $string16 = "this connect" wide ascii
        $string17 = "ip is rejected" wide ascii

    condition:
        all of ($string*) and filesize > 800KB
}

snort/suricata rule:

alert tcp any any -> any $HTTP_PORTS (msg:"MailerBot no job Checkin Detected"; flow:to_server,established; content:"POST"; http_method; content:"status=0"; fast_pattern; http_client_body; within:15; content:"Content-Type|3a 20|application/"; reference:md5,56adac876acc29dd49f20e58c902c156; classtype:trojan-activity; sid:20166309; rev:1; metadata:created_at 2019_12_18;

alert tcp any any -> any $HTTP_PORTS (msg:"MailerBot job Checkin Detected"; flow:to_server,established; content:"POST"; http_method; content:"status="; fast_pattern; http_client_body; within:15; content:"&task="; http_client_body; content:"&set="; http_client_body; content:"&start="; http_client_body; content:"&count="; http_client_body; content:"&ok="; http_client_body; content:"&failed="; http_client_body; content:"Content-Type|3a 20|application/"; reference:md5,56adac876acc29dd49f20e58c902c156; classtype:trojan-activity; sid:20166310; rev:1; metadata:created_at 2019_12_18;