Dragonfly_APT_malware_1

YARA detection rule by DHS | NCCIC Code Analysis Team · GPL-2.0

inveigh pen testing tools & related artifacts

rule Dragonfly_APT_malware_1 {
  meta:
    description = "inveigh pen testing tools & related artifacts"

    author = "DHS | NCCIC Code Analysis Team"

    date = "2017/07/17"

    hash0 = "61C909D2F625223DB2FB858BBDF42A76"

    hash1 = "A07AA521E7CAFB360294E56969EDA5D6"

    hash2 = "BA756DD64C1147515BA2298B6A760260"

    hash3 = "8943E71A8C73B5E343AA9D2E19002373"

    hash4 = "04738CA02F59A5CD394998A99FCD9613"

    hash5 = "038A97B4E2F37F34B255F0643E49FC9D"

    hash6 = "65A1A73253F04354886F375B59550B46"

    hash7 = "AA905A3508D9309A93AD5C0EC26EBC9B"

    hash8 = "5DBEF7BDDAF50624E840CCBCE2816594"

    hash9 = "722154A36F32BA10E98020A8AD758A7A"

    hash10 = "4595DBE00A538DF127E0079294C87DA0"

  strings:
    $s0 = "file://"

    $s1 = "/ame_icon.png"

    $s2 = "184.154.150.66"

    $s3 = { 87 D0 81 F6 0C 67 F5 08 6A 00 33 15 D4 9A 40 00 F7 D6 E8 EB 12 00 00 81 F7 F0 1B DD 21 F7 DE }

    $s4 = { 33 C4 2B CB 33 3D C0 AD 40 00 43 C1 C6 1A 33 C3 F7 DE 33 F0 42 C7 05 B5 AC 40 00 26 AF 21 02 }

    $s5 = "(g.charCodeAt(c)^l[(l[b]+l[e])%256])"

    $s6 = "for(b=0;256>b;b++)k[b]=b;for(b=0;256>b;b++)"

    $s7 = "VXNESWJfSjY3grKEkEkRuZeSvkE="

    $s8 = "NlZzSZk="

    $s9 = "WlJTb1q5kaxqZaRnser3sw=="

    $s10 = "for(b=0;256>b;b++)k[b]=b;for(b=0;256>b;b++)"

    $s11 = "fromCharCode(d.charCodeAt(e)^k[(k[b]+k[h])%256])"

    $s12 = "ps.exe -accepteula \\%ws% -u %user% -p %pass% -s cmd /c netstat"

    $s13 = "\"Tokens=1 delims=\\\\\" %%I IN (list.txt)"

    $s14 = "hell.exe -noexit -executionpolicy bypass -command \". .\\Inveigh.p"

    $s15 = "Go build ID: \"fbd3797b1c14e0e1"

    
    $s16 = "$inveigh.status_queue.Add(\"Press any key to stop real time"

    
    $s17 = { 2F 73 65 74 74 69 6E 67 73 2E 78 6D 6C B4 56 61 6F DB 36 13 FE FE 02 EF 7F 10 F4 79 8E 64 C5 4D 06 A1 4E D1 25 F1 9A 22 5E 87 C9 FD 01 94 48 5B }

    $s18 = { 6C 73 2F 73 65 74 74 69 6E 67 73 2E 78 6D 6C 2E 72 65 6C 73 55 54 05 00 01 00 76 A4 12 75 78 0B 00 01 04 00 00 00 00 04 00 00 00 00 8D 90 B9 4E 03 31 10 86 EB F0 14 D6 F4 D8 7B 48 21 44 71 D2 }

    $s19 = { 8D 90 B9 4E 03 31 10 86 EB F0 14 D6 F4 D8 7B 48 21 44 71 D2 10 A4 14 50 A0 E5 01 46 EB D9 43 F8 92 3D 41 C9 DB E3 A5 4A 24 0A CA 39 4A 24 0A CA 39 }

    $s20 = { 8C 90 CD 4E EB 30 10 85 D7 BD 4F 61 CD FE DA 09 21 50 A1 BA DD 00 52 17 B0 40 E1 01 46 F1 24 B1 F0 9F EC 01 B5 6F 8F C3 AA 95 58 B0 B4 }

    $s21 = { 8C 90 CD 4E EB 30 10 85 D7 BD 4F 61 CD FE DA 09 21 50 A1 BA DD 00 52 17 B0 40 E1 01 46 F1 24 B1 F0 9F EC 01 B5 6F 8F C3 AA 95 58 B0 B4 }

    $s22 = "5.153.58.45"

    $s23 = "62.8.193.206"

    $s24 = "/1/ree_stat/p"

    $s25 = "/icon.png"

    $s26 = "/pshare1/icon"

    $s27 = "/notepad.png"

    $s28 = "/pic.png"

    $s29 = "http://bit.ly/2m0x8IH"

  condition:
    ($s0 and $s1 or $s2) or ($s3 or $s4) or ($s5 and $s6 or $s7 and $s8 and $s9) or ($s10 and $s11) or ($s12 and $s13) or ($s14) or ($s15) or ($s16) or ($s17) or ($s18) or ($s19) or ($s20) or ($s21) or ($s0 and $s22 or $s24) or ($s0 and $s22 or $s25) or ($s0 and $s23 or $s26) or ($s0 and $s22 or $s27) or ($s0 and $s23 or $s28) or ($s29)

}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

00f1a186-1767-4550-9941-d5fb044d98a1

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion