YARA Detection Rule: Atmos_Malware
Repository: Yara-Rules/rules
Detects: Generic Spyware.Citadel.Atmos Signature
Author: xylitol@temari.fr
Reference: http://www.xylibox.com/2016/02/citadel-0011-atmos.html

Pattern signatures:
// Check for the presence of MZ and kutuzov license identifier
        $MZ = {4D 5A}
        $LKEY = "533D9226E4C1CE0A9815DBEB19235AE4" wide ascii
        
        // TokenSpy identifiers
        $TS1 = "X-TS-Rule-Name: %s" wide ascii
        $TS2 = "X-TS-Rule-PatternID: %u" wide ascii
        $TS3 = "X-TS-BotID: %s" wide ascii
        $TS4 = "X-TS-Domain: %s" wide ascii
        $TS5 = "X-TS-SessionID: %s" wide ascii
        $TS6 = "X-TS-Header-Cookie: %S" wide ascii
        $TS7 = "X-TS-Header-Referer: %S" wide ascii
        $TS8 = "X-TS-Header-AcceptEncoding: %S" wide ascii
        $TS9 = "X-TS-Header-AcceptLanguage: %S" wide ascii
        $TS10 = "X-TS-Header-UserAgent: %S" wide ascii
        
        // Hidden VNC identifiers
        $VNC1 = "_hvnc_init@4" wide ascii
        $VNC2 = "_hvnc_uninit@0" wide ascii
        $VNC3 = "_hvnc_start@8" wide ascii
        $VNC4 = "_hvnc_stop@0" wide ascii
        $VNC5 = "_hvnc_wait@0" wide ascii
        $VNC6 = "_hvnc_work@0" wide ascii
     

Detection condition:
($MZ at 0 and $LKEY) and ( (5 of ($TS*) and all of ($WB*)) or (3 of ($VNC*) and all of ($WB*)))
    and filesize < 300KB // Standard size (raw from builder) should be arround ~264kb
        // Remove the above line if you want to trig also on memory dumps, etc...

Full rule:
rule Atmos_Malware
{
    
    meta:
        description = "Generic Spyware.Citadel.Atmos Signature"
        author = "xylitol@temari.fr"
        reference = "http://www.xylibox.com/2016/02/citadel-0011-atmos.html"
        date = "20/08/2016"
        // May only the challenge guide you

    strings:
        // Check for the presence of MZ and kutuzov license identifier
        $MZ = {4D 5A}
        $LKEY = "533D9226E4C1CE0A9815DBEB19235AE4" wide ascii
        
        // TokenSpy identifiers
        $TS1 = "X-TS-Rule-Name: %s" wide ascii
        $TS2 = "X-TS-Rule-PatternID: %u" wide ascii
        $TS3 = "X-TS-BotID: %s" wide ascii
        $TS4 = "X-TS-Domain: %s" wide ascii
        $TS5 = "X-TS-SessionID: %s" wide ascii
        $TS6 = "X-TS-Header-Cookie: %S" wide ascii
        $TS7 = "X-TS-Header-Referer: %S" wide ascii
        $TS8 = "X-TS-Header-AcceptEncoding: %S" wide ascii
        $TS9 = "X-TS-Header-AcceptLanguage: %S" wide ascii
        $TS10 = "X-TS-Header-UserAgent: %S" wide ascii
        
        // Hidden VNC identifiers
        $VNC1 = "_hvnc_init@4" wide ascii
        $VNC2 = "_hvnc_uninit@0" wide ascii
        $VNC3 = "_hvnc_start@8" wide ascii
        $VNC4 = "_hvnc_stop@0" wide ascii
        $VNC5 = "_hvnc_wait@0" wide ascii
        $VNC6 = "_hvnc_work@0" wide ascii
        
        // Browsers identifiers
        $WB1 = "nspr4.dll" wide ascii
        $WB2 = "nss3.dll" wide ascii
        $WB3 = "chrome.dll" wide ascii
        $WB4 = "Internet Explorer" wide ascii
        $WB5 = "Firefox" wide ascii
        $WB6 = "Chrome" wide ascii

    condition:
    ($MZ at 0 and $LKEY) and ( (5 of ($TS*) and all of ($WB*)) or (3 of ($VNC*) and all of ($WB*)))
    and filesize < 300KB // Standard size (raw from builder) should be arround ~264kb
        // Remove the above line if you want to trig also on memory dumps, etc...
}