YARA Detection Rule: MAL_APT_NK_WIN_Tiger_RAT_Auto
Repository: Neo23x0/signature-base
Detects: Detects the Tiger RAT variant used by Andariel
Author: CISA.gov
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$sequence_0 = { 33 c0 89 44 24 38 89 44 24 30 44 8b cf 45 33 c0 }
      // n = 5, score = 200
      //   33c0                 | jmp                 5
      //   89442438             | dec                 eax
      //   89442430             | mov                 eax, ecx
      //   448bcf               | movzx               eax, byte ptr [eax]
      //   4533c0               | dec                 eax

      $sequence_1 = { 41 b9 01 00 00 00 48 8b d6 48 8b cb e8 ?? ?? ?? ?? }
      // n = 4, score = 200
      //   41b901000000         | dec                 eax
      //   488bd6                | mov                 eax, dword ptr [ecx]
      //   488bcb               | jmp                 8
      //   e8????????           |                     

      $sequence_2 = { 48 81 ec 90 05 00 00 8b 01 89 85 c8 04 00 00 8b 41 04 }
      // n = 4, score = 200
      //   4881ec90050000       | test                eax, eax
      //   8b01                 | jns                 0x16
      //   8985c804

Detection condition:
filesize < 600KB and 7 of them

Full rule:
rule MAL_APT_NK_WIN_Tiger_RAT_Auto {
   meta:
      author = "CISA.gov"
      description = "Detects the Tiger RAT variant used by Andariel"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      score = 75
      id = "4579af62-52be-5f5f-a577-16ec50297c05"
   strings:
      $sequence_0 = { 33 c0 89 44 24 38 89 44 24 30 44 8b cf 45 33 c0 }
      // n = 5, score = 200
      //   33c0                 | jmp                 5
      //   89442438             | dec                 eax
      //   89442430             | mov                 eax, ecx
      //   448bcf               | movzx               eax, byte ptr [eax]
      //   4533c0               | dec                 eax

      $sequence_1 = { 41 b9 01 00 00 00 48 8b d6 48 8b cb e8 ?? ?? ?? ?? }
      // n = 4, score = 200
      //   41b901000000         | dec                 eax
      //   488bd6                | mov                 eax, dword ptr [ecx]
      //   488bcb               | jmp                 8
      //   e8????????           |                     

      $sequence_2 = { 48 81 ec 90 05 00 00 8b 01 89 85 c8 04 00 00 8b 41 04 }
      // n = 4, score = 200
      //   4881ec90050000       | test                eax, eax
      //   8b01                 | jns                 0x16
      //   8985c8040000         | dec                 eax
      //   8b4104               | mov                 eax, dword ptr [ecx]

      $sequence_3 = { 48 8b 01 ff 10 48 8b 4f 08 4c 8d 4c 24 30 }
      // n = 4, score = 200
      //   488b01               | mov                 edx, esi
      //   ff10                 | dec                 eax
      //   488b4f08             | mov                 ecx, ebx
      //   4c8d4c2430           | inc                 ecx

      $sequence_4 = { 48 8b 01 ff 10 48 8b 4e 18 48 8b 01 }
      // n = 4, score = 200
      //   488b01               | dec                 eax
      //   ff10                 | cmp                 dword pt