YARA · ESET malware-ioc

ESET_IIS_Group09

Detects Group 9 native IIS malware family

MalwareESET malware-iocBSD 2-Clause LicenseCompila con YARA-X (con avisos)

Autor: ESET Research
Fecha: 2021-08-04
Puntuación / Calidad: 75 / 76

Qué detecta esta regla

Detects Group 9 native IIS malware family

Define 31 patrones (30 de texto, 1 hex, 0 regex). Módulos YARA usados: pe.

YARA-X dice: warning[text_as_hex]: hex pattern could be written as text literal

Resumen generado a partir de los metadatos y la condición de la regla.

Código de la regla

Descargar .yar

Incluye los imports y 1 regla(s) de las que depende necesarios para compilarla por sí sola.

iis-group09.yarBSD 2-Clause License

import "pe"

private rule ESET_IIS_Native_Module_PRIVATE : FILE
{
	meta:
		description = "Signature to match an IIS native module (clean or malicious)"
		author = "ESET Research"
		id = "e3bacdc8-fde1-5e83-ac94-79fc345e888d"
		date = "2021-08-04"
		modified = "2021-08-04"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/badiis/badiis.yar#L34-L92"
		license_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/LICENSE"
		logic_hash = "5a388dc3253df606e2648d1f9c018e6dde373bbddce66dba69b7aecdd95bac18"
		score = 75
		quality = 55
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"

	strings:
		$e1 = "This module subscribed to event"
		$e2 = "CHttpModule::OnBeginRequest"
		$e3 = "CHttpModule::OnPostBeginRequest"
		$e4 = "CHttpModule::OnAuthenticateRequest"
		$e5 = "CHttpModule::OnPostAuthenticateRequest"
		$e6 = "CHttpModule::OnAuthorizeRequest"
		$e7 = "CHttpModule::OnPostAuthorizeRequest"
		$e8 = "CHttpModule::OnResolveRequestCache"
		$e9 = "CHttpModule::OnPostResolveRequestCache"
		$e10 = "CHttpModule::OnMapRequestHandler"
		$e11 = "CHttpModule::OnPostMapRequestHandler"
		$e12 = "CHttpModule::OnAcquireRequestState"
		$e13 = "CHttpModule::OnPostAcquireRequestState"
		$e14 = "CHttpModule::OnPreExecuteRequestHandler"
		$e15 = "CHttpModule::OnPostPreExecuteRequestHandler"
		$e16 = "CHttpModule::OnExecuteRequestHandler"
		$e17 = "CHttpModule::OnPostExecuteRequestHandler"
		$e18 = "CHttpModule::OnReleaseRequestState"
		$e19 = "CHttpModule::OnPostReleaseRequestState"
		$e20 = "CHttpModule::OnUpdateRequestCache"
		$e21 = "CHttpModule::OnPostUpdateRequestCache"
		$e22 = "CHttpModule::OnLogRequest"
		$e23 = "CHttpModule::OnPostLogRequest"
		$e24 = "CHttpModule::OnEndRequest"
		$e25 = "CHttpModule::OnPostEndRequest"
		$e26 = "CHttpModule::OnSendResponse"
		$e27 = "CHttpModule::OnMapPath"
		$e28 = "CHttpModule::OnReadEntity"
		$e29 = "CHttpModule::OnCustomRequestNotification"
		$e30 = "CHttpModule::OnAsyncCompletion"
		$e31 = "CGlobalModule::OnGlobalStopListening"
		$e32 = "CGlobalModule::OnGlobalCacheCleanup"
		$e33 = "CGlobalModule::OnGlobalCacheOperation"
		$e34 = "CGlobalModule::OnGlobalHealthCheck"
		$e35 = "CGlobalModule::OnGlobalConfigurationChange"
		$e36 = "CGlobalModule::OnGlobalFileChange"
		$e37 = "CGlobalModule::OnGlobalApplicationStart"
		$e38 = "CGlobalModule::OnGlobalApplicationResolveModules"
		$e39 = "CGlobalModule::OnGlobalApplicationStop"
		$e40 = "CGlobalModule::OnGlobalRSCAQuery"
		$e41 = "CGlobalModule::OnGlobalTraceEvent"
		$e42 = "CGlobalModule::OnGlobalCustomNotification"
		$e43 = "CGlobalModule::OnGlobalThreadCleanup"
		$e44 = "CGlobalModule::OnGlobalApplicationPreload"

	condition:
		uint16( 0 ) == 0x5A4D and pe.exports ( "RegisterModule" ) and any of ( $e* )
}

rule ESET_IIS_Group09
{
	meta:
		description = "Detects Group 9 native IIS malware family"
		author = "ESET Research"
		id = "69d176bc-73b1-5c4d-bb7e-463d26e8e6a9"
		date = "2021-08-04"
		modified = "2021-08-04"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/badiis/badiis.yar#L339-L387"
		license_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/LICENSE"
		logic_hash = "5f89f9488221b8db8d493b3c23b7f5edd957c15511148eca890558886c128192"
		score = 75
		quality = 76
		tags = ""
		license = "BSD 2-Clause"
		version = "1"

	strings:
		$i1 = "FliterSecurity.dll"
		$i2 = {56565656565656565656565656565656}
		$i3 = "app|hot|alp|svf|fkj|mry|poc|doc|20" xor
		$i4 = "yisouspider|yisou|soso|sogou|m.sogou|sogo|sogou|so.com|baidu|bing|360" xor
		$i5 = "baidu|m.baidu|soso|sogou|m.sogou|sogo|sogou|so.com|google|youdao" xor
		$i6 = "118|abc|1go|evk" xor
		$s1 = "AVCFuckHttpModuleFactory"
		$s2 = "X-Forward"
		$s3 = "fuck32.dat"
		$s4 = "fuck64.dat"
		$s5 = "&ipzz1="
		$s6 = "&ipzz2="
		$s7 = "&uuu="
		$s8 = "http://20.3323sf.c" xor
		$s9 = "http://bj.whtjz.c" xor
		$s10 = "http://bj2.wzrpx.c" xor
		$s11 = "http://cs.whtjz.c" xor
		$s12 = "http://df.e652.c" xor
		$s13 = "http://dfcp.yyphw.c" xor
		$s14 = "http://es.csdsx.c" xor
		$s15 = "http://hz.wzrpx.c" xor
		$s16 = "http://id.3323sf.c" xor
		$s17 = "http://qp.008php.c" xor
		$s18 = "http://qp.nmnsw.c" xor
		$s19 = "http://sc.300bt.c" xor
		$s20 = "http://sc.wzrpx.c" xor
		$s21 = "http://sf2223.c" xor
		$s22 = "http://sx.cmdxb.c" xor
		$s23 = "http://sz.ycfhx.c" xor
		$s24 = "http://xpq.0660sf.c" xor
		$s25 = "http://xsc.b1174.c" xor

	condition:
		ESET_IIS_Native_Module_PRIVATE and any of ( $i* ) and 3 of ( $s* )
}

Cadenas (31 patrones)

Identificador	Tipo	Valor	Modificadores
$i1	texto	"FliterSecurity.dll"
$i2	hex	{56565656565656565656565656565656}
$i3	texto	"app\|hot\|alp\|svf\|fkj\|mry\|poc\|doc\|20"	xor
$i4	texto	"yisouspider\|yisou\|soso\|sogou\|m.sogou\|sogo\|sogou\|so.com\|baidu\|bing\|360"	xor
$i5	texto	"baidu\|m.baidu\|soso\|sogou\|m.sogou\|sogo\|sogou\|so.com\|google\|youdao"	xor
$i6	texto	"118\|abc\|1go\|evk"	xor
$s1	texto	"AVCFuckHttpModuleFactory"
$s2	texto	"X-Forward"
$s3	texto	"fuck32.dat"
$s4	texto	"fuck64.dat"
$s5	texto	"&ipzz1="
$s6	texto	"&ipzz2="
$s7	texto	"&uuu="
$s8	texto	"http://20.3323sf.c"	xor
$s9	texto	"http://bj.whtjz.c"	xor
$s10	texto	"http://bj2.wzrpx.c"	xor
$s11	texto	"http://cs.whtjz.c"	xor
$s12	texto	"http://df.e652.c"	xor
$s13	texto	"http://dfcp.yyphw.c"	xor
$s14	texto	"http://es.csdsx.c"	xor
$s15	texto	"http://hz.wzrpx.c"	xor
$s16	texto	"http://id.3323sf.c"	xor
$s17	texto	"http://qp.008php.c"	xor
$s18	texto	"http://qp.nmnsw.c"	xor
$s19	texto	"http://sc.300bt.c"	xor
$s20	texto	"http://sc.wzrpx.c"	xor
$s21	texto	"http://sf2223.c"	xor
$s22	texto	"http://sx.cmdxb.c"	xor
$s23	texto	"http://sz.ycfhx.c"	xor
$s24	texto	"http://xpq.0660sf.c"	xor
$s25	texto	"http://xsc.b1174.c"	xor

Condición

ESET_IIS_Native_Module_PRIVATE and any of ( $i* ) and 3 of ( $s* )

En palabras sencillas (Heurística)

Debe coincidir al menos un patrón de ( $i* ).
Deben coincidir al menos 3 patrones de ( $s* ).
Depende de la regla ESET_IIS_Native_Module_PRIVATE.

Prueba esta regla en tu navegador

Arrastra un archivo para escanearlo con esta regla usando YARA-X compilado a WebAssembly. No se sube nada.

Arrastra un archivo aquí o haz clic para elegirSe escanea en local con YARA-X. Archivos de hasta 200 MB.

Abrir en el editor

Referencias

https://github.com/eset/malware-ioc/

Licencia y atribución

Autor: ESET Research

Repositorio de origen: ESET malware-ioc @ 17baf44964

Licencia: BSD 2-Clause License (indicada en los metadatos de la regla)

“BSD 2-Clause”

Regla original

Obtenida a través de YARA Forge 20260927, que añade a los nombres el prefijo de la fuente y campos meta normalizados.

Id de la regla: 69d176bc-73b1-5c4d-bb7e-463d26e8e6a9

Metadatos

version	1

ESET_Richheaders_Lazarus_Nukesped_Iconicpayloads_3CX_Q12023
MalwareESET malware-ioc· ESET Research· 2023-03-31
ESET_Cw_Windows_Redline_Panel_Distinctive_Strings
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Cw_Windows_Redline_Panel_Prompts
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Cw_Windows_Redline_Panel_Status_Message_Strings
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Cw_Windows_Redline_Panel_Tab_Headers
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_IIS_Group04_Rgdoor
MalwareESET malware-ioc· ESET Research· 2021-08-04
ESET_IIS_Group07_Iispy
MalwareESET malware-ioc· ESET Research· 2021-08-04
ESET_Invisimole_Blob_PRIVATE
MalwareESET malware-ioc· ESET Research· 2021-05-17