YARA Detection Rule: TA17_293A_malware_1
Repository: Neo23x0/signature-base
Detects: inveigh pen testing tools & related artifacts
Author: US-CERT Code Analysis Team (modified by Florian Roth)
Reference: https://www.us-cert.gov/ncas/alerts/TA17-293A

Pattern signatures:
$n1 = "file://"

        $ax1 = "184.154.150.66"
        $ax2 = "5.153.58.45"
        $ax3 = "62.8.193.206"
        $ax4 = "/pshare1/icon"
        $ax5 = "/ame_icon.png"
        $ax6 = "/1/ree_stat/p"

        /* Too many false positives with these strings
        $au1 = "/icon.png"
        $au2 = "/notepad.png"
        $au3 = "/pic.png"
        */

        $s1 = "(g.charCodeAt(c)^l[(l[b]+l[e])%256])"
        $s2 = "for(b=0;256>b;b++)k[b]=b;for(b=0;256>b;b++)"
        $s3 = "VXNESWJfSjY3grKEkEkRuZeSvkE="
        $s4 = "NlZzSZk="
        $s5 = "WlJTb1q5kaxqZaRnser3sw=="

        $x1 = { 87D081F60C67F5086A003315D49A4000F7D6E8EB12000081F7F01BDD21F7DE }
        $x2 = { 33C42BCB333DC0AD400043C1C61A33C3F7DE33F042C705B5AC400026AF2102 }
        $x3 = "fromCharCode(d.charCodeAt(e)^k[(k[b]+k[h])%256])"
        $x4 = "ps.exe -accepteula \\%ws% -u %user% -p %pass% -s cmd /c netstat"
        $x5 = { 22546F6B656E733D312064656C696D733D5C5C[PII_REDACTED]20494E20286C6973742E74787429 }
        $x6 = { 68656

Detection condition:
( $n1 and 1 of ($ax*) ) or
        2 of ($s*) or
        1 of ($x*)

Full rule:
rule TA17_293A_malware_1 {
    meta:
        description = "inveigh pen testing tools & related artifacts"
        author = "US-CERT Code Analysis Team (modified by Florian Roth)"
        reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
        date = "2017/07/17"
        hash0 = "61C909D2F625223DB2FB858BBDF42A76"
        hash1 = "A07AA521E7CAFB360294E56969EDA5D6"
        hash2 = "BA756DD64C1147515BA2298B6A760260"
        hash3 = "8943E71A8C73B5E343AA9D2E19002373"
        hash4 = "04738CA02F59A5CD394998A99FCD9613"
        hash5 = "038A97B4E2F37F34B255F0643E49FC9D"
        hash6 = "65A1A73253F04354886F375B59550B46"
        hash7 = "AA905A3508D9309A93AD5C0EC26EBC9B"
        hash8 = "5DBEF7BDDAF50624E840CCBCE2816594"
        hash9 = "722154A36F32BA10E98020A8AD758A7A"
        hash10 = "4595DBE00A538DF127E0079294C87DA0"
        id = "297611c9-f4b1-5618-bd43-5a[PII_REDACTED]"
    strings:
        $n1 = "file://"

        $ax1 = "184.154.150.66"
        $ax2 = "5.153.58.45"
        $ax3 = "62.8.193.206"
        $ax4 = "/pshare1/icon"
        $ax5 = "/ame_icon.png"
        $ax6 = "/1/ree_stat/p"

        /* Too many false positives with these strings
        $au1 = "/icon.png"
        $au2 = "/notepad.png"
        $au3 = "/pic.png"
        */

        $s1 = "(g.charCodeAt(c)^l[(l[b]+l[e])%256])"
        $s2 = "for(b=0;256>b;b++)k[b]=b;for(b=0;256>b;b++)"
        $s3 = "VXNESWJfSjY3grKEkEkRuZeSvkE="
        $s4 = "NlZzSZk="
        $s5 = "WlJTb1q5kaxqZaRnser3sw=="

        $x1 = { 87D081F60C67F5086A003315D49A4000F7D6E8EB12000081F7F01BDD21F7DE }
        $x2 = { 33C42BCB333DC0AD400043C1C61A33C3F7DE33F042C705B5AC400026AF2102 }
        $x3 = "fromCharCode(d.charCodeAt(e)^k[(k[b]+k[h])%256])"
        $x4 = "ps.exe -accepteula \\%ws% -u %user% -p %pass% -s cmd /c netstat"
        $x5 = { 22546F6B656E733D312064656C696D733D5C5C[PII_REDACTED]20494E20286C6973742E74787429 }
        $x6 = { 68656C6C2E657865202D6E6F[PII_REDACTED]2D[PII_REDACTED]74696F6E706F6C[PII_REDACTED][PII_REDACTED]202D636F6D6D61