YARA Detection Rule: APT_IN_TA397_wmRAT
Repository: Neo23x0/signature-base
Detects: track wmRAT based on socket usage, odd error handling, and reused strings
Author: Proofpoint
Reference: https://www.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats

Pattern signatures:
$code_sleep_loop = {
            6a 64              // push    0x64
            ff d6              // call    esi
            6a 01              // push    0x1
            e8 ?? ?? ?? ??     // call    operator new
            83 c4 04           // add     esp, 0x4
            3b c7              // cmp     eax, edi

        }
        $code_error_handling = {
            88 19           // mov     byte [ecx], bl
            4a              // dec     edx
            41              // inc     ecx
            47              // inc     edi
            4e              // dec     esi
            85 d2           // test    edx, edx
            ?? ??           // jne     0x401070
            5f              // pop     edi {__saved_edi}
            49              // dec     ecx
            5e              // pop     esi {__saved_esi}
            b8 7a 00 07 80  // mov     eax, 0x8007007a

        }
        $code_socket_recv_parsing = {
            // 8b 15 20 55 41 00   mov     edx, dword [d

Detection condition:
uint16be(0x0) == 0x4d5a and
          (2 of ($code*) or 10 of ($str*))

Full rule:
rule APT_IN_TA397_wmRAT {
    meta:
        author = "Proofpoint"
        description = "track wmRAT based on socket usage, odd error handling, and reused strings"
        date = "2024-11-20"
        category = "hunting"
        malfamily = "wmRAT"
        version = "1.0"
        score = 75
        reference = "https://www.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats"
        hash = "3bf4bbd5564f4381820fb8da5810bd4d9718b5c80a7e8f055961007c6f30da2b"
        hash = "3e9a08972b8ec9c2e64eeb46ce1db92ae3c40bc8de48d278ba4d436fc3c8b3a4"
        hash = "40ddb4463be9d8131f363fd78e21d9de5d838a3ec4044526aea45a473d6ddd61"
        hash = "4836cb7eed0b20da50acb26472f918b180917101c026ce36074e0e879b604308"
        hash = "4e3e4d476810c95c34b6f2aa9c735f8e57e85e3b7a97c709adc5d6ee4a5f6ccc"
        hash = "5ab76cf85ade810b7ae449e3dff8a19a018174ced45d37062c86568d9b7633f9"
        hash = "811741d9df51a9f16272a64ec7eb8ff12f8f26794368b1ff4ad5d30a1f4bb42a"
        hash = "b588a423b826b57dce72c9ab58f89be2ddc710a0367ed0eed001c047d8bef32a"
        hash = "caf871247b[PII_REDACTED]816e9c5461d64b6bdb68a15ff9f8742ca31dc00865f8"
        id = "c5855b30-3e75-570f-b327-498dfc382159"
    strings:
        $code_sleep_loop = {
            6a 64              // push    0x64
            ff d6              // call    esi
            6a 01              // push    0x1
            e8 ?? ?? ?? ??     // call    operator new
            83 c4 04           // add     esp, 0x4
            3b c7              // cmp     eax, edi

        }
        $code_error_handling = {
            88 19           // mov     byte [ecx], bl
            4a              // dec     edx
            41              // inc     ecx
            47              // inc     edi
            4e              // dec     esi
            85 d2           // test    edx, edx
            ?? ??           // jne     0x401070
            5f              // pop     edi {__saved_edi}
            49