YARA Detection Rule: APT_FIN7_Sample_Aug18_1
Repository: Neo23x0/signature-base
Detects: Detects FIN7 samples mentioned in FireEye report
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

Pattern signatures:
$s1 = "\\par var console=\\{\\};console.log=function()\\{\\};" ascii
      $s2 = "616e64792d7063" ascii /* hex encoded string 'andy-pc' */

      $x1 = "0043003a005c[PII_REDACTED][PII_REDACTED]005c0061006e[PII_REDACTED]5c[PII_REDACTED]73006b0074006f0070005c0075006e[PII_REDACTED]6f[PII_REDACTED]630074" ascii /* hex encoded string 'C:\Users\andy\Desktop\unprotect' */
      $x2 = "[PII_REDACTED][PII_REDACTED][PII_REDACTED]004f006e[PII_REDACTED]720072006f[PII_REDACTED][PII_REDACTED]0075006d[PII_REDACTED]4e[PII_REDACTED]74003a[PII_REDACTED]" ascii /* hex encoded string 'xecute("On Error Resume Next:se' */
      $x3 = "\\par \\tab \\tab \\tab sh.Run \"powershell.exe -NoE -NoP -NonI -ExecutionPolicy Bypass -w Hidden -File \" & pToPSCb, 0, False" fullword ascii
      $x4 = "002e006c006e006b002d[PII_REDACTED]3a005c[PII_REDACTED][PII_REDACTED]005c[PII_REDACTED][PII_REDACTED]0064006d0069006e002e[PII_REDACTED]530054005c0044" ascii /* hex encoded string '.lnk-C:\Users\testadmin.TEST\D' */
      $x5 = "005c[PII_REDACTED][PII_REDACTED]005c[PII_REDACTED][PII_REDACTED]0044007e0031002e[PII_REDACTED]53005c

Detection condition:
uint16(0) == 0x5c7b and filesize < 3000KB and ( 1 of ($x*) or 2 of them )

Full rule:
rule APT_FIN7_Sample_Aug18_1 {
   meta:
      description = "Detects FIN7 samples mentioned in FireEye report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
      date = "2018-08-01"
      hash1 = "a1e95ac1bb684186e9fb5c67f75c7c26ddc8b18ebfdaf061742ddf1675e17d55"
      hash2 = "dc645aae5d283fa175cf463a19615ed4d16b1d[PII_REDACTED]574d8a6a8b0fc8fa"
      hash3 = "eebbce171dab636c5ac0bf0fd14da0e216758b19c0ce2e5c572d7e6642d36d3d"
      id = "0fdd98e8-7536-5159-8085-da7388e5fff2"
   strings:
      $s1 = "\\par var console=\\{\\};console.log=function()\\{\\};" ascii
      $s2 = "616e64792d7063" ascii /* hex encoded string 'andy-pc' */

      $x1 = "0043003a005c[PII_REDACTED][PII_REDACTED]005c0061006e[PII_REDACTED]5c[PII_REDACTED]73006b0074006f0070005c0075006e[PII_REDACTED]6f[PII_REDACTED]630074" ascii /* hex encoded string 'C:\Users\andy\Desktop\unprotect' */
      $x2 = "[PII_REDACTED][PII_REDACTED][PII_REDACTED]004f006e[PII_REDACTED]720072006f[PII_REDACTED][PII_REDACTED]0075006d[PII_REDACTED]4e[PII_REDACTED]74003a[PII_REDACTED]" ascii /* hex encoded string 'xecute("On Error Resume Next:se' */
      $x3 = "\\par \\tab \\tab \\tab sh.Run \"powershell.exe -NoE -NoP -NonI -ExecutionPolicy Bypass -w Hidden -File \" & pToPSCb, 0, False" fullword ascii
      $x4 = "002e006c006e006b002d[PII_REDACTED]3a005c[PII_REDACTED][PII_REDACTED]005c[PII_REDACTED][PII_REDACTED]0064006d0069006e002e[PII_REDACTED]530054005c0044" ascii /* hex encoded string '.lnk-C:\Users\testadmin.TEST\D' */
      $x5 = "005c[PII_REDACTED][PII_REDACTED]005c[PII_REDACTED][PII_REDACTED]0044007e0031002e[PII_REDACTED]53005c[PII_REDACTED][PII_REDACTED][PII_REDACTED]5c004c006f0063" ascii /* hex encoded string '\Users\TESTAD~1.TES\AppData\Loc' */
      $x6 = "6c[PII_REDACTED][PII_REDACTED]006f006e[PII_REDACTED]29003a[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0072006f[PII_REDACTED]630074002e[PII_REDACTED]" asci