deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_MAL_NK_3CX_Malicious_Samples_Mar23_2
Repository: Neo23x0/signature-base
Detects: Detects malicious DLLs related to 3CX compromise (decrypted payload)
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/dan__mayer/status/[PII_REDACTED]94672128?s=20

Pattern signatures:
$s1 = "raw.githubusercontent.com/IconStorages/images/main/icon%d.ico" wide fullword
      $s2 = "https://raw.githubusercontent.com/IconStorages" wide fullword
      $s3 = "icon%d.ico" wide fullword
      $s4 = "__tutmc" ascii fullword

      $op1 = { 2d ee a1 00 00 c5 fa e6 f5 e9 40 fe ff ff 0f 1f 44 00 00 75 2e c5 fb 10 0d 46 a0 00 00 44 8b 05 7f a2 00 00 e8 0a 0e 00 00 }
      $op4 = { 4c 8d 5c 24 71 0f 57 c0 48 89 44 24 60 89 44 24 68 41 b9 15 cd 5b 07 0f 11 44 24 70 b8 b1 68 de 3a 41 ba a4 7b 93 02 }
      $op5 = { f7 f3 03 d5 69 ca e8 03 00 00 ff 15 c9 0a 02 00 48 8d 44 24 30 45 33 c0 4c 8d 4c 24 38 48 89 44 24 20 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 900KB and 3 of them
      or 5 of them

Full rule:
rule APT_MAL_NK_3CX_Malicious_Samples_Mar23_2 {
   meta:
      description = "Detects malicious DLLs related to 3CX compromise (decrypted payload)"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/dan__mayer/status/[PII_REDACTED]94672128?s=20"
      date = "2023-03-29"
      score = 80
      hash1 = "aa4e398b3bd8645016d8090ffc77d15f926a8e[PII_REDACTED]1deb4e68688ff973"
      id = "bf3597ff-d62b-5d21-9c9b-e46e685284cf"
   strings:
      $s1 = "raw.githubusercontent.com/IconStorages/images/main/icon%d.ico" wide fullword
      $s2 = "https://raw.githubusercontent.com/IconStorages" wide fullword
      $s3 = "icon%d.ico" wide fullword
      $s4 = "__tutmc" ascii fullword

      $op1 = { 2d ee a1 00 00 c5 fa e6 f5 e9 40 fe ff ff 0f 1f 44 00 00 75 2e c5 fb 10 0d 46 a0 00 00 44 8b 05 7f a2 00 00 e8 0a 0e 00 00 }
      $op4 = { 4c 8d 5c 24 71 0f 57 c0 48 89 44 24 60 89 44 24 68 41 b9 15 cd 5b 07 0f 11 44 24 70 b8 b1 68 de 3a 41 ba a4 7b 93 02 }
      $op5 = { f7 f3 03 d5 69 ca e8 03 00 00 ff 15 c9 0a 02 00 48 8d 44 24 30 45 33 c0 4c 8d 4c 24 38 48 89 44 24 20 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 900KB and 3 of them
      or 5 of them
}
YARA Detection Rule: SUSP_APT_MAL_NK_3CX_Malicious_Samples_Mar23_1
Repository: Neo23x0/signature-base
Detects: Detects marker found in malicious DLLs related to 3CX compromise
Author: X__Junior, Florian Roth (Nextron Systems)
Reference: https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/

Pattern signatures:
$opx1 = { 41 80 7C 00 FD FE 75 ?? 41 80 7C 00 FE ED 75 ?? 41 80 7C 00 FF FA 75 ?? 41 80 3C 00 CE } /* marker */
      $opx2 = { 80 78 ?? FE 75 ?? 80 78 ?? ED 75 ?? 80 38 FA 75 ?? 80 78 ?? CE } /* marker */

Detection condition:
1 of them

Full rule:
rule SUSP_APT_MAL_NK_3CX_Malicious_Samples_Mar23_1 {
   meta:
      description = "Detects marker found in malicious DLLs related to 3CX compromise"
      author = "X__Junior, Florian Roth (Nextron Systems)"
      reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
      date = "2023-03-29"
      modified = "2023-04-20"
      score = 75
      hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
      hash2 = "c485674ee63ec8d4e8fde[PII_REDACTED]a8b02d3f9416d0e763360fff7f8eb4e02"
      hash3 = "cc4eedb7b1f77f02b962f4b05278fa7f8082708b5a12cacf[PII_REDACTED]62b5e2"
      id = "9fc6eb94-d02f-5bcd-9f55-b6c6a8301b4f"
   strings:
      $opx1 = { 41 80 7C 00 FD FE 75 ?? 41 80 7C 00 FE ED 75 ?? 41 80 7C 00 FF FA 75 ?? 41 80 3C 00 CE } /* marker */
      $opx2 = { 80 78 ?? FE 75 ?? 80 78 ?? ED 75 ?? 80 38 FA 75 ?? 80 78 ?? CE } /* marker */
   condition:
      1 of them
}
YARA Detection Rule: APT_SUSP_NK_3CX_RC4_Key_Mar23_1
Repository: Neo23x0/signature-base
Detects: Detects RC4 key used in 3CX binaries known to be malicious
Author: Florian Roth (Nextron Systems)
Reference: https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/

Pattern signatures:
$x1 = "3jB(2bsG#@c7"

Detection condition:
( uint16(0) == 0xcfd0 or uint16(0) == 0x5a4d )
      and $x1

Full rule:
rule APT_SUSP_NK_3CX_RC4_Key_Mar23_1 {
   meta:
      description = "Detects RC4 key used in 3CX binaries known to be malicious"
      author = "Florian Roth (Nextron Systems)"
      date = "2023-03-29"
      reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
      score = 70
      hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
      hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
      hash3 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
      hash4 = "c485674ee63ec8d4e8fde[PII_REDACTED]a8b02d3f9416d0e763360fff7f8eb4e02"
      id = "18ea2185-11a1-51ad-a51a-df9e6357bb58"
   strings:
      $x1 = "3jB(2bsG#@c7"
   condition:
      ( uint16(0) == 0xcfd0 or uint16(0) == 0x5a4d )
      and $x1
}
YARA Detection Rule: SUSP_3CX_App_Signed_Binary_Mar23_1
Repository: Neo23x0/signature-base
Detects: Detects 3CX application binaries signed with a certificate and created in a time frame in which other known malicious binaries have been created
Author: Florian Roth (Nextron Systems)
Reference: https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/

Pattern signatures:
$sa1 = "3CX Ltd1"
      $sa2 = "3CX Desktop App" wide
      $sc1 = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 } // Known compromised cert

Detection condition:
uint16(0) == 0x5a4d
      and pe.timestamp >[PII_REDACTED] // 29.11.2022 earliest known malicious sample 
      and pe.timestamp <[PII_REDACTED] // 29.03.2023 date of the report
      and all of ($sa*)
      and $sc1 // serial number of known compromised certificate

Full rule:
rule SUSP_3CX_App_Signed_Binary_Mar23_1 {
   meta:
      description = "Detects 3CX application binaries signed with a certificate and created in a time frame in which other known malicious binaries have been created"
      author = "Florian Roth (Nextron Systems)"
      date = "2023-03-29"
      reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
      score = 65
      hash1 = "fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405"
      hash2 = "dde[PII_REDACTED][PII_REDACTED]dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc"
      id = "b6ce4c1d-1b7b-5e0c-af4c-05cb3ad0a4e0"
   strings:
      $sa1 = "3CX Ltd1"
      $sa2 = "3CX Desktop App" wide
      $sc1 = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 } // Known compromised cert
   condition:
      uint16(0) == 0x5a4d
      and pe.timestamp >[PII_REDACTED] // 29.11.2022 earliest known malicious sample 
      and pe.timestamp <[PII_REDACTED] // 29.03.2023 date of the report
      and all of ($sa*)
      and $sc1 // serial number of known compromised certificate
}
YARA Detection Rule: SUSP_3CX_MSI_Signed_Binary_Mar23_1
Repository: Neo23x0/signature-base
Detects: Detects 3CX MSI installers signed with a known compromised certificate and signed in a time frame in which other known malicious binaries have been signed
Author: Florian Roth (Nextron Systems)
Reference: https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/

Pattern signatures:
$a1 = { 84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46 } // MSI marker

      $sc1 = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 } // Known compromised cert

      $s1 = "3CX Ltd1"
      $s2 = "202303" // in

Detection condition:
uint16(0) == 0xcfd0
      and $a1 
      and $sc1 
      and (
         $s1 in (filesize-20000..filesize)
         and $s2 in (filesize-20000..filesize)
      )

Full rule:
rule SUSP_3CX_MSI_Signed_Binary_Mar23_1 {
   meta:
      description = "Detects 3CX MSI installers signed with a known compromised certificate and signed in a time frame in which other known malicious binaries have been signed"
      author = "Florian Roth (Nextron Systems)"
      date = "2023-03-29"
      reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
      score = 60
      hash1 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
      hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
      id = "15d6d8ca-6982-5095-9879-ce97269a71c6"
   strings:
      $a1 = { 84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46 } // MSI marker

      $sc1 = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 } // Known compromised cert

      $s1 = "3CX Ltd1"
      $s2 = "202303" // in 
   condition:
      uint16(0) == 0xcfd0
      and $a1 
      and $sc1 
      and (
         $s1 in (filesize-20000..filesize)
         and $s2 in (filesize-20000..filesize)
      )
}
YARA Detection Rule: APT_MAL_macOS_NK_3CX_Malicious_Samples_Mar23_1
Repository: Neo23x0/signature-base
Detects: Detects malicious macOS application related to 3CX compromise (decrypted payload)
Author: Florian Roth (Nextron Systems)
Reference: https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/

Pattern signatures:
$s1 = "[PII_REDACTED]4152Z0"
      $s2 = "Developer ID Application: 3CX (33CF4654HL)"

Detection condition:
( uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca ) and all of them

Full rule:
rule APT_MAL_macOS_NK_3CX_Malicious_Samples_Mar23_1 {
   meta:
      description = "Detects malicious macOS application related to 3CX compromise (decrypted payload)"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
      date = "2023-03-30"
      score = 80
      hash1 = "b86c[PII_REDACTED]83fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb"
      hash2 = "ac99602999bf9823f221372378f95baa4fc68929bac3a10e8d9a107ec8074eca"
      hash3 = "51079c7e549cbad25429ff98b6d6ca02dc9234e466dd9b75a5e05b9d7b95af72"
      id = "ff39e577-7063-5025-bead-68394a86c87c"
    strings:
      $s1 = "[PII_REDACTED]4152Z0"
      $s2 = "Developer ID Application: 3CX (33CF4654HL)"
    condition:
      ( uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca ) and all of them
}
YARA Detection Rule: APT_MAL_MacOS_NK_3CX_DYLIB_Mar23_1
Repository: Neo23x0/signature-base
Detects: Detects malicious DYLIB files related to 3CX compromise
Author: Florian Roth (Nextron Systems)
Reference: https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/

Pattern signatures:
/* XORed UA 0x7a */
      $xc1 = { 37 15 00 13 16 16 1B 55 4F 54 4A 5A 52 2D 13 14 
               1E 15 0D 09 5A 34 2E 5A 4B 4A 54 4A 41 5A 2D 13
               14 4C 4E 41 5A 02 4C 4E 53 5A 3B 0A 0A 16 1F 2D
               1F 18 31 13 0E 55 4F 49 4D 54 49 4C 5A 52 31 32
               2E 37 36 56 5A 16 13 11 1F 5A 3D 1F 19 11 15 53
               5A 39 12 08 15 17 1F 55 4B 4A 42 54 4A 54 4F 49
               4F 43 54 4B 48 42 5A 29 1B 1C 1B 08 13 55 4F 49
               4D 54 49 4C 7A }
      /* /;3cx_auth_token_content=%s;__tutma= */
      $xc2 = { 41 49 19 02 25 1b 0f 0e 12 25 0e 15 11 1f 14 25 19 15 14 0e 1f 14 0e 47 5f 09 41 25 25 0e 0f 0e 17 1b 47 }
      /* /System/Library/CoreServices/SystemVersion.plist */
      $xc3 = { 55 29 03 09 0e 1f 17 55 36 13 18 08 1b 08 03 55 39 15 08 1f 29 1f 08 0c 13 19 1f 09 55 29 03 09 0e 1f 17 2c 1f 08 09 13 15 14 54 0a 16 13 09 0e }

Detection condition:
1 of them

Full rule:
rule APT_MAL_MacOS_NK_3CX_DYLIB_Mar23_1 {
   meta:
      description = "Detects malicious DYLIB files related to 3CX compromise"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/"
      date = "2023-03-30"
      score = 80
      hash1 = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
      hash2 = "fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7"
      id = "a19904d3-9b2d-561f-b734-20bf09584fa7"
   strings:
      /* XORed UA 0x7a */
      $xc1 = { 37 15 00 13 16 16 1B 55 4F 54 4A 5A 52 2D 13 14 
               1E 15 0D 09 5A 34 2E 5A 4B 4A 54 4A 41 5A 2D 13
               14 4C 4E 41 5A 02 4C 4E 53 5A 3B 0A 0A 16 1F 2D
               1F 18 31 13 0E 55 4F 49 4D 54 49 4C 5A 52 31 32
               2E 37 36 56 5A 16 13 11 1F 5A 3D 1F 19 11 15 53
               5A 39 12 08 15 17 1F 55 4B 4A 42 54 4A 54 4F 49
               4F 43 54 4B 48 42 5A 29 1B 1C 1B 08 13 55 4F 49
               4D 54 49 4C 7A }
      /* /;3cx_auth_token_content=%s;__tutma= */
      $xc2 = { 41 49 19 02 25 1b 0f 0e 12 25 0e 15 11 1f 14 25 19 15 14 0e 1f 14 0e 47 5f 09 41 25 25 0e 0f 0e 17 1b 47 }
      /* /System/Library/CoreServices/SystemVersion.plist */
      $xc3 = { 55 29 03 09 0e 1f 17 55 36 13 18 08 1b 08 03 55 39 15 08 1f 29 1f 08 0c 13 19 1f 09 55 29 03 09 0e 1f 17 2c 1f 08 09 13 15 14 54 0a 16 13 09 0e }
   condition:
      1 of them
}
YARA Detection Rule: APT_SUSP_NK_3CX_Malicious_Samples_Mar23_1
Repository: Neo23x0/signature-base
Detects: Detects indicator (event name) found in samples related to 3CX compromise
Author: Florian Roth (Nextron Systems)
Reference: https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/

Pattern signatures:
$a1 = "AVMonitorRefreshEvent" wide fullword

Detection condition:
1 of them

Full rule:
rule APT_SUSP_NK_3CX_Malicious_Samples_Mar23_1 {
   meta:
      description = "Detects indicator (event name) found in samples related to 3CX compromise"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/"
      date = "2023-03-30"
      score = 70
      hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
      hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
      hash3 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
      hash4 = "c485674ee63ec8d4e8fde[PII_REDACTED]a8b02d3f9416d0e763360fff7f8eb4e02"
      id = "b233846a-19df-579b-a674-233d66824008"
   strings:
      $a1 = "AVMonitorRefreshEvent" wide fullword
   condition:
      1 of them
}
YARA Detection Rule: APT_MAL_NK_3CX_Malicious_Samples_Mar23_4
Repository: Neo23x0/signature-base
Detects: Detects decrypted payload loaded inside 3CXDesktopApp.exe which downloads info stealer
Author: MalGamy (Nextron Systems)
Reference: https://twitter.com/WhichbufferArda/status/[PII_REDACTED]23688964?s=20

Pattern signatures:
$op1 = {41 69 D0 [4] 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 81 C2 [4] 33 C1 43 8D 0C 02 02 C8 49 C1 EA ?? 41 88 0B 8B C8 C1 E1 ?? 33 C1 44 69 C2 [4] 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 41 81 C0 [4] 33 C1 4C 0F AF CF 4D 03 CA 45 8B D1 4C 0F AF D7 41 8D 0C 11 49 C1 E9 ?? 02 C8} // // xor with mul operation
        $op2 = {4D 0F AF CC 44 69 C2 [4] 4C 03 C9 45 8B D1 4D 0F AF D4 41 8D 0C 11 41 81 C0 [4] 02 C8 49 C1 E9 ?? 41 88 4B ?? 4D 03 D1 8B C8 45 8B CA C1 E1 ?? 33 C1} // xor with mul operation
        $op3 = {33 C1 4C 0F AF C7 8B C8 C1 E1 ?? 4D 03 C2 33 C1} // shift operation

Detection condition:
2 of them

Full rule:
rule APT_MAL_NK_3CX_Malicious_Samples_Mar23_4 {
    meta:
        author = "MalGamy (Nextron Systems)"
        reference = "https://twitter.com/WhichbufferArda/status/[PII_REDACTED]23688964?s=20"
        description = "Detects decrypted payload loaded inside 3CXDesktopApp.exe which downloads info stealer"
        date = "2023-03-29"
        hash = "851c2c99ebafd4e5e9e140cfe3f2d03533846ca16f8151ae8ee0e83c692884b7" 
        score = 80
        id = "d11170df-570c-510c-80ec-39048acd0fbd"
    strings:
        $op1 = {41 69 D0 [4] 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 81 C2 [4] 33 C1 43 8D 0C 02 02 C8 49 C1 EA ?? 41 88 0B 8B C8 C1 E1 ?? 33 C1 44 69 C2 [4] 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 41 81 C0 [4] 33 C1 4C 0F AF CF 4D 03 CA 45 8B D1 4C 0F AF D7 41 8D 0C 11 49 C1 E9 ?? 02 C8} // // xor with mul operation
        $op2 = {4D 0F AF CC 44 69 C2 [4] 4C 03 C9 45 8B D1 4D 0F AF D4 41 8D 0C 11 41 81 C0 [4] 02 C8 49 C1 E9 ?? 41 88 4B ?? 4D 03 D1 8B C8 45 8B CA C1 E1 ?? 33 C1} // xor with mul operation
        $op3 = {33 C1 4C 0F AF C7 8B C8 C1 E1 ?? 4D 03 C2 33 C1} // shift operation
    condition: 
        2 of them
}
YARA Detection Rule: MAL_3CXDesktopApp_MacOS_Backdoor_Mar23
Repository: Neo23x0/signature-base
Detects: Detects 3CXDesktopApp MacOS Backdoor component
Author: X__Junior (Nextron Systems)
Reference: https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/

Pattern signatures:
$sa1 = "%s/.main_storage" ascii fullword
        $sa2 = "%s/UpdateAgent" ascii fullword

        $op1 = { 31 C0 41 80 34 06 ?? 48 FF C0 48 83 F8 ?? 75 ?? BE ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 89 F7 48 89 D9 E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89 F7 5B 41 5E 41 5F E9 ?? ?? ?? ?? 5B 41 5E 41 5F C3} /* string decryption */
        $op2 = { 0F 11 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 31 C0 80 B4 04 ?? ?? ?? ?? ?? 48 FF C0} /* string decryption */

Detection condition:
( ( uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca ) and filesize < 6MB
         and
         (
            ( 1 of ($sa*) and 1 of ($op* ) )
            or all of ($sa*)
         )
      )
      or ( all of ($op*) )

Full rule:
rule MAL_3CXDesktopApp_MacOS_Backdoor_Mar23 {
    meta:
      author = "X__Junior (Nextron Systems)"
        reference = "https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/"
        description = "Detects 3CXDesktopApp MacOS Backdoor component"
        date = "2023-03-30"
        hash = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
        score = 80
      id = "80046c8e-0c2a-5885-b140-a6084f48160d"
    strings:
        $sa1 = "%s/.main_storage" ascii fullword
        $sa2 = "%s/UpdateAgent" ascii fullword

        $op1 = { 31 C0 41 80 34 06 ?? 48 FF C0 48 83 F8 ?? 75 ?? BE ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 89 F7 48 89 D9 E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89 F7 5B 41 5E 41 5F E9 ?? ?? ?? ?? 5B 41 5E 41 5F C3} /* string decryption */
        $op2 = { 0F 11 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 31 C0 80 B4 04 ?? ?? ?? ?? ?? 48 FF C0} /* string decryption */
    condition:
      ( ( uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca ) and filesize < 6MB
         and
         (
            ( 1 of ($sa*) and 1 of ($op* ) )
            or all of ($sa*)
         )
      )
      or ( all of ($op*) )
}
YARA Detection Rule: APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1
Repository: Neo23x0/signature-base
Detects: Detects ICONIC stealer payload used in the 3CX incident
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/volexity/threat-intel/blob/main/2023/2023-03-30%203CX/attachments/iconicstealer.7z

Pattern signatures:
$s1 = "{\"HostName\": \"%s\", \"DomainName\": \"%s\", \"OsVersion\": \"%d.%d.%d\"}" wide fullword
      $s2 = "******************************** %s ******************************" wide fullword
      $s3 = "AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data" wide fullword
      $s4 = "AppData\\Roaming\\Mozilla\\Firefox\\Profiles" wide fullword
      $s5 = "SELECT url, title FROM urls ORDER BY id DESC LIMIT 500" wide fullword
      $s6 = "TEXT value in %s.%s" ascii fullword

      $op1 = { 48 63 d1 48 63 ce 49 03 d1 49 03 cd 4c 63 c7 e8 87 1f 09 00 8b 45 d0 44 8d 04 37 }
      $op2 = { 48 8b c8 8b 56 f0 48 89 46 d8 e8 78 8f f8 ff e9 ec 13 00 00 c7 46 20 ff ff ff ff e9 e0 13 00 00 33 ff }

Detection condition:
uint16(0) == 0x5a4d
      and filesize < 4000KB 
      and 4 of them
      or 6 of them

Full rule:
rule APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1 {
   meta:
      description = "Detects ICONIC stealer payload used in the 3CX incident"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/volexity/threat-intel/blob/main/2023/2023-03-30%203CX/attachments/iconicstealer.7z"
      date = "2023-03-31"
      score = 80
      hash1 = "8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423"
      id = "e92b5b90-1146-5235-9711-a4d42689c49b"
   strings:
      
      $s1 = "{\"HostName\": \"%s\", \"DomainName\": \"%s\", \"OsVersion\": \"%d.%d.%d\"}" wide fullword
      $s2 = "******************************** %s ******************************" wide fullword
      $s3 = "AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data" wide fullword
      $s4 = "AppData\\Roaming\\Mozilla\\Firefox\\Profiles" wide fullword
      $s5 = "SELECT url, title FROM urls ORDER BY id DESC LIMIT 500" wide fullword
      $s6 = "TEXT value in %s.%s" ascii fullword

      $op1 = { 48 63 d1 48 63 ce 49 03 d1 49 03 cd 4c 63 c7 e8 87 1f 09 00 8b 45 d0 44 8d 04 37 }
      $op2 = { 48 8b c8 8b 56 f0 48 89 46 d8 e8 78 8f f8 ff e9 ec 13 00 00 c7 46 20 ff ff ff ff e9 e0 13 00 00 33 ff }
   condition:
      uint16(0) == 0x5a4d
      and filesize < 4000KB 
      and 4 of them
      or 6 of them
}
YARA Detection Rule: APT_MAL_NK_3CX_macOS_Elextron_App_Mar23_1
Repository: Neo23x0/signature-base
Detects: Detects macOS malware used in the 3CX incident
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$a1 = "com.apple.security.cs.allow-unsigned-executable-memory" ascii
      $a2 = "com.electron.3cx-desktop-app" ascii fullword

      $s1 = "s8T/RXMlALbXfowom9qk15FgtdI=" ascii
      $s2 = "o8NQKPJE6voVZUIGtXihq7lp0cY=" ascii

Detection condition:
uint16(0) == 0xfacf and
      filesize < 400KB and (
         all of ($a*) 
         and 1 of ($s*)
      )

Full rule:
rule APT_MAL_NK_3CX_macOS_Elextron_App_Mar23_1 {
   meta:
      description = "Detects macOS malware used in the 3CX incident"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2023-03-31"
      score = 80
      hash1 = "51079c7e549cbad25429ff98b6d6ca02dc9234e466dd9b75a5e05b9d7b95af72"
      hash2 = "f7ba7f9bf[PII_REDACTED]96cf7314f68b78d2a6df10718c8e0cd64dbe3b86bc730"
      id = "7a3755d4-37e5-5d3b-93aa-34edb557f2d5"
   strings:
      $a1 = "com.apple.security.cs.allow-unsigned-executable-memory" ascii
      $a2 = "com.electron.3cx-desktop-app" ascii fullword

      $s1 = "s8T/RXMlALbXfowom9qk15FgtdI=" ascii
      $s2 = "o8NQKPJE6voVZUIGtXihq7lp0cY=" ascii
   condition:
      uint16(0) == 0xfacf and
      filesize < 400KB and (
         all of ($a*) 
         and 1 of ($s*)
      )
}
YARA Detection Rule: MAL_3CXDesktopApp_MacOS_UpdateAgent_Mar23
Repository: Neo23x0/signature-base
Detects: Detects 3CXDesktopApp MacOS UpdateAgent backdoor component
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/patrickwardle/status/[PII_REDACTED]03515653?s=20

Pattern signatures:
$a1 = "/3CX Desktop App/.main_storage" ascii

      $x1 = ";3cx_auth_token_content=%s;__tutma=true"

      $s1 = "\"url\": \"https://"
      $s3 = "/dev/null"
      $s4 = "\"AccountName\": \""

Detection condition:
uint16(0) == 0xfeca 
      and filesize < 6MB
      and (
         1 of ($x*)
         or ( $a1 and all of ($s*) )
      ) or all of them

Full rule:
rule MAL_3CXDesktopApp_MacOS_UpdateAgent_Mar23 {
   meta:
      description = "Detects 3CXDesktopApp MacOS UpdateAgent backdoor component"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/patrickwardle/status/[PII_REDACTED]03515653?s=20"
      date = "2023-03-30"
      hash = "9e9a5f8d[PII_REDACTED]2cee881c843cde9eaedfb3"
      score = 80
      id = "596eb6d0-f96f-5106-ae67-9372d238e4cf"
   strings:
      $a1 = "/3CX Desktop App/.main_storage" ascii

      $x1 = ";3cx_auth_token_content=%s;__tutma=true"

      $s1 = "\"url\": \"https://"
      $s3 = "/dev/null"
      $s4 = "\"AccountName\": \""
   condition:
      uint16(0) == 0xfeca 
      and filesize < 6MB
      and (
         1 of ($x*)
         or ( $a1 and all of ($s*) )
      ) or all of them
}