YARA Detection Rule: APT_NK_Scarcruft_RUBY_Shellcode_XOR_Routine
Repository: Neo23x0/signature-base
Detects: Detects Ruby ShellCode XOR routine used by ScarCruft APT group
Author: S2WLAB_TALON_JACK2
Reference: https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48

Pattern signatures:
/*
         8B 4C 18 08             mov     ecx, [eax+ebx+8]
         C1 C7 0D                rol     edi, 0Dh
         40                      inc     eax
         F6 C7 01                test    bh, 1
         74 06                   jz      short loc_D0
         81 F7 97 EA AE 78       xor     edi, 78AEEA97h
         */
         $hex1   = {C1 C7 0D 40 F6 C7 01 74 ?? 81 F7}
         /*
         41 C1 C2 0D             rol     r10d, 0Dh
         41 8B C2                mov     eax, r10d
         44 8B CA                mov     r9d, edx
         41 8B CA                mov     ecx, r10d
         41 81 F2 97 EA AE 78    xor     r10d, 78AEEA97h
         */
         $hex2   = {41 C1 C2 0D 41 8B C2 44 8B CA 41 8B CA 41 81 F2}

Detection condition:
1 of them
 }

rule APT_NK_Scarcruft_evolved_ROKRAT {
    meta:
        author        = "S2WLAB_TALON_JACK2"
        description   = "Detects RokRAT malware used by ScarCruft APT group"
        type          = "APT"
        version       = "0.1"
        date          = "2021-07-09"
        reference 

Full rule:
rule APT_NK_Scarcruft_RUBY_Shellcode_XOR_Routine {
     meta:
       author        = "S2WLAB_TALON_JACK2"
       description   = "Detects Ruby ShellCode XOR routine used by ScarCruft APT group"
       type          = "APT"
       version       = "0.1"
       date          = "2021-05-20"
       reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
       id = "c393f2db-8ade-5083-9cec-f62f23056f8b"
     strings:
         /*
         8B 4C 18 08             mov     ecx, [eax+ebx+8]
         C1 C7 0D                rol     edi, 0Dh
         40                      inc     eax
         F6 C7 01                test    bh, 1
         74 06                   jz      short loc_D0
         81 F7 97 EA AE 78       xor     edi, 78AEEA97h
         */
         $hex1   = {C1 C7 0D 40 F6 C7 01 74 ?? 81 F7}
         /*
         41 C1 C2 0D             rol     r10d, 0Dh
         41 8B C2                mov     eax, r10d
         44 8B CA                mov     r9d, edx
         41 8B CA                mov     ecx, r10d
         41 81 F2 97 EA AE 78    xor     r10d, 78AEEA97h
         */
         $hex2   = {41 C1 C2 0D 41 8B C2 44 8B CA 41 8B CA 41 81 F2}
     condition:
         1 of them
 }

rule APT_NK_Scarcruft_evolved_ROKRAT {
    meta:
        author        = "S2WLAB_TALON_JACK2"
        description   = "Detects RokRAT malware used by ScarCruft APT group"
        type          = "APT"
        version       = "0.1"
        date          = "2021-07-09"
        reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
        id = "53cabf41-0154-5372-b667-60d8a7cb9806"
    strings:
/*
0x140130f25 C[PII_REDACTED]11223              mov dword ptr [rsp + 0x20], 0x23123132
0x140130f2d C[PII_REDACTED]55667              mov dword ptr [rsp + 0x24], 0x67564534
0x140130f35 C[PII_REDACTED]99AAB              mov dword ptr [rsp + 0x28], 0xab9a8978
0x140130f3d C744242C0CBDCEDF              mov dword ptr [rsp + 0x2c], 0xdfceb