JohnGalt14

Microsoft Identifier used in EquationDrug Platform

Mar 11th, 2015
461
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. YARA ---------------------------------------------------------------------------------------
  2.  
  3. import "pe"
  4.  
  5. rule EquationDrug_MS_Identifier {
  6.     meta:
  7.         description = "Microsoft Identifier used in EquationDrug Platform"
  8.         author = "Florian Roth @4nc4p"
  9.         date = "2015/03/11"
  10.     strings:
  11.         $s1 = "Microsoft(R) Windows (TM) Operating System" fullword wide
  12.     condition:
  13.         // Epoch for 01.01.2000
  14.         $s1 and pe.timestamp > 946684800
  15. }
  16.  
  17. -------------------------------------------------------------------------------------------
  18.  
  19. Comment:
  20. Seems to be a Product string used in Windows NT (please confirm). Compile dates of the samples listed below range from 2001 to 2009. This product string should not appear in system files of newer Windows versions (2000+).
  21.  
  22. Tested against:
  23. Windows 2003
  24. Windows 2008
  25. Windows XP
  26. Windows 7
  27.  
  28. Google Search:
  29. https://www.google.de/search?q=%22Microsoft(R)+Windows+(TM)+Operating+System%22+inurl:virustotal.com
  30.  
  31. Matches from the EquationDrug Report:
  32. 74de13b5ea68b3da24addc009f84baee - Compiled 2001-2007
  33. 8d87a1845122bf090b3d8656dc9d60a8 - Compiled 2008-2009
  34. 20506375665a6a62f7d9dd22d1cc9870 - Compiled 2003-2006
  35. c4f8671c1f00dab30f5f88d684af1927 - Compiled 2008
  36. 5767b9d851d0c24e13eca1bfd16ea424 - Compiled 2008
  37.  
  38. Source: (Awesome work by Kaspersky)
  39. http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/
  40.  
  41. Advice:
  42. Do not use the "pe" module in productive environments yet.
RAW Paste Data