YARA Detection Rule: Regin_APT_KernelDriver_Generic_B
Repository: Yara-Rules/rules
Detects: Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2
Author: @Malwrsignatures - included in APT Scanner THOR

Pattern signatures:
$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 } 
        $s1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
        $s2 = "H.data" fullword ascii nocase
        $s3 = "INIT" fullword ascii
        $s4 = "ntoskrnl.exe" fullword ascii
        $v1 = "\\system32" fullword ascii
        $v2 = "\\SystemRoot" fullword ascii
        $v3 = "KeServiceDescriptorTable" fullword ascii 
        $w1 = "\\system32" fullword ascii
        $w2 = "\\SystemRoot" fullword ascii     
        $w3 = "LRich6" fullword ascii        
        $x1 = "_snprintf" fullword ascii
        $x2 = "_except_handler3" fullword ascii
        $y1 = "mbstowcs" fullword ascii
        $y2 = "wcstombs" fullword ascii
        $y3 = "KeGetCurrentIrql" fullword ascii
        $z1 = "wcscpy" fullword ascii
        $z2 = "ZwCreateFile" fullword ascii
        $z3 = "ZwQueryInformationFile" fullword ascii
   

Detection condition:
$m0 at 0 and all of ($s*) and ( all of ($v*) or all of ($w*) or all of ($x*) or all of ($y*) or all of ($z*) ) and filesize < 20KB

Full rule:
rule Regin_APT_KernelDriver_Generic_B 
{

    meta:
        description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
        author = "@Malwrsignatures - included in APT Scanner THOR"
        date = "23.11.14"
        hash1 = "ffb0b9b5b610191051a7bdf0806e1e47"
        hash2 = "bfbe8c3ee78750c3a520480700e440f8"
        hash3 = "b29ca4f22ae7b7b25f79c1d4a421139d"
        hash4 = "06665b96e293b23acc80451abb413e50"
        hash5 = "2c8b9d2885543d7ade3cae98225e263b"
        hash6 = "4b6b86c7fec1c574706cecedf44abded"
        hash7 = "187044596bc1328efa0ed636d8aa4a5c"
        hash8 = "d240f06e98c8d3e647cbf4d442d79475"
        hash9 = "6662c390b2bbbd291ec7987388fc75d7"
        hash10 = "1c024e599ac055312a4ab75b3950040a"
        hash11 = "ba7bb65634ce1e30c1e5415be3d1db1d"
        hash12 = "b505d65721bb2453d5039a389113b566"
        hash13 = "b269894f434657db2b15949641a67532"

    strings:
        $m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 } 
        $s1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
        $s2 = "H.data" fullword ascii nocase
        $s3 = "INIT" fullword ascii
        $s4 = "ntoskrnl.exe" fullword ascii
        $v1 = "\\system32" fullword ascii
        $v2 = "\\SystemRoot" fullword ascii
        $v3 = "KeServiceDescriptorTable" fullword ascii 
        $w1 = "\\system32" fullword ascii
        $w2 = "\\SystemRoot" fullword ascii     
        $w3 = "LRich6" fullword ascii        
        $x1 = "_snprintf" fullword ascii
        $x2 = "_except_handler3" fullword ascii
        $y1 = "mbstowcs" fullword ascii
        $y2 = "wcstombs" fullword ascii
        $y3 = "KeGetCurrentIrql" fullword ascii
        $z1 = "wcscpy" fullword ascii
        $z2 = "ZwCreateFile" fullword ascii
        $z3 = "ZwQueryInformationFile" fullword ascii
        $z4 = "wcslen" fullword ascii
        $z5 = "atoi" ful