YARA Detection Rule: MAL_Sednit_DelphiDownloader_Apr18_2
Repository: Neo23x0/signature-base
Detects: Detects malware from Sednit Delphi Downloader report
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/

Pattern signatures:
$s1 = "2D444F574E4C4F41445F[PII_REDACTED]2D" ascii /* hex encoded string '-DOWNLOAD_START-' */
      $s2 = "55504C4F41445F414E445F[PII_REDACTED]54455F46494C45" ascii /* hex encoded string 'UPLOAD_AND_EXECUTE_FILE' */
      $s3 = "4D6F7A696C6C612076352E[PII_REDACTED]6E646F7773204E5420362E313B2072763A362E302E[PII_REDACTED]636B6F2F[PII_REDACTED][PII_REDACTED]697265666F782F36" ascii /* hex encoded string 'Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1' */
      $s4 = "41646F[PII_REDACTED]6C[PII_REDACTED]7465" ascii /* hex encoded string 'AdobeDailyUpdate' */
      $s5 = "[PII_REDACTED]4D494E464F[PII_REDACTED]534B4C495354" ascii /* hex encoded string 'SYSTEMINFO & TASKLIST' */
      $s6 = "[PII_REDACTED]632E657865" ascii /* hex encoded string 'csrsvc.exe' */
      $s7 = "536F[PII_REDACTED]655C4D6963726F736F66745C57696E646F77735C[PII_REDACTED]6E[PII_REDACTED]696F6E5C52756E" ascii /* hex encoded string 'Software\Microsoft\Windows\CurrentVersion\Run' */
      $s8 = "5C536F[PII_REDACTED]655C4D6963726F736F66745C57696E646F7773204E545

Detection condition:
filesize < 4000KB and 1 of ($s*) and not 1 of ($fp*)

Full rule:
rule MAL_Sednit_DelphiDownloader_Apr18_2 {
   meta:
      description = "Detects malware from Sednit Delphi Downloader report"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
      date = "2018-04-24"
      hash1 = "53aef1e8b281a00dea41387a[PII_REDACTED]6b58d61d39cfbde7e58d8c2ca3efda"
      hash2 = "657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4"
      hash3 = "5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a[PII_REDACTED]b9739182"
      hash4 = "[PII_REDACTED]575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f"
      hash5 = "72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3"
      id = "6ccd2f21-de44-52fb-912e-d3ecbe57e389"
   strings:
      $s1 = "2D444F574E4C4F41445F[PII_REDACTED]2D" ascii /* hex encoded string '-DOWNLOAD_START-' */
      $s2 = "55504C4F41445F414E445F[PII_REDACTED]54455F46494C45" ascii /* hex encoded string 'UPLOAD_AND_EXECUTE_FILE' */
      $s3 = "4D6F7A696C6C612076352E[PII_REDACTED]6E646F7773204E5420362E313B2072763A362E302E[PII_REDACTED]636B6F2F[PII_REDACTED][PII_REDACTED]697265666F782F36" ascii /* hex encoded string 'Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1' */
      $s4 = "41646F[PII_REDACTED]6C[PII_REDACTED]7465" ascii /* hex encoded string 'AdobeDailyUpdate' */
      $s5 = "[PII_REDACTED]4D494E464F[PII_REDACTED]534B4C495354" ascii /* hex encoded string 'SYSTEMINFO & TASKLIST' */
      $s6 = "[PII_REDACTED]632E657865" ascii /* hex encoded string 'csrsvc.exe' */
      $s7 = "536F[PII_REDACTED]655C4D6963726F736F66745C57696E646F77735C[PII_REDACTED]6E[PII_REDACTED]696F6E5C52756E" ascii /* hex encoded string 'Software\Microsoft\Windows\CurrentVersion\Run' */
      $s8 = "5C536F[PII_REDACTED]655C4D6963726F736F66745C57696E646F7773204E545C[PII_REDACTED]6E[PII_REDACTED]696F6E" ascii /* hex encoded string '\Software\Microsoft\Windows NT\CurrentVersion' */
      $s9 = "5C536F[PII_REDACTED]655C4D6963726F736F66745C57696E646F77735C[PII_REDACTED]6E[PII_REDACTED]696F6E" ascii /* hex encoded st