rule win_amadey_a9f4 {

    meta:
        author                    = "Johannes Bader"
        date                      = "2022-11-17"
        description               = "matches unpacked Amadey samples"
        hash_md5                  = "25cfcfdb6d73d9cfd88a5247d4038727"
        hash_sha1                 = "912d1ef61750bc622ee069cdeed2adbfe208c54d"
        hash_sha256               = "03effd3f94517b08061db014de12f8bf01166a04e93adc2f240a6616bb3bd29a"
        malpedia_family           = "win.amadey"
        tlp                       = "TLP:WHITE"
        version                   = "v1.0"
        yarahub_author_email      = "[email protected]"
        yarahub_author_twitter    = "@viql"
        yarahub_license           = "CC BY-SA 4.0"
        yarahub_reference_md5     = "25cfcfdb6d73d9cfd88a5247d4038727"
        yarahub_rule_matching_tlp = "TLP:WHITE"
        yarahub_rule_sharing_tlp  = "TLP:WHITE"
        yarahub_uuid              = "a9f41cd4-3f67-42fc-b310-e9b251c95fe4"

    strings:
        $pdb  = "\\Amadey\\Release\\Amadey.pdb"
        /*  Amadey uses multiple hex strings to decrypt the strings, C2 traffic
            and as identification. The preceeding string 'stoi ...' is added to
            improve performance.
        */
        $keys = /stoi argument out of range\x00\x00[a-f0-9]{32}\x00{1,16}[a-f0-9]{32}\x00{1,4}[a-f0-9]{6}\x00{1,4}[a-f0-9]{32}\x00/

    condition:
        uint16(0) == 0x5A4D and
        (
            $pdb or $keys
        )
}

rule win_amadey_auto {

meta:
author = "Felix Bilstein - yara-signator at cocacoding dot com"
date = "2023-07-11"
version = "1"
description = "Detects win.amadey."
info = "autogenerated rule brought to you by yara-signator"
tool = "yara-signator v0.6.0"
signator_config = "callsandjumps;datarefs;binvalue"
malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey"
malpedia_rule_date = "20230705"
malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
malpedia_version = "20230715"
malpedia_license = "CC BY-SA 4.0"
malpedia_sharing = "TLP:WHITE"

/* DISCLAIMER
* The strings used in this rule have been automatically selected from the
* disassembly of memory dumps and unpacked files, using YARA-Signator.
* The code and documentation is published here:
* https://github.com/fxb-cocacoding/yara-signator
* As Malpedia is used as data source, please note that for a given
* number of families, only single samples are documented.
* This likely impacts the degree of generalization these rules will offer.
* Take the described generation method also into consideration when you
* apply the rules in your use cases and assign them confidence levels.
*/

strings:
$sequence_0 = { 8945f4 837df408 744f 8d85e8fdffff 890424 e8???????? c70424???????? }
// n = 7, score = 700
//   8945f4               | mov                 dword ptr [ebp - 0xc], eax
//   837df408             | cmp                 dword ptr [ebp - 0xc], 8
//   744f                 | je                  0x51
//   8d85e8fdffff         | lea                 eax, [ebp - 0x218]
//   890424               | mov                 dword ptr [esp], eax
//   e8????????           |                     
//   c70424????????       |                     

$sequence_1 = { c745fc00000000 e8???????? 84c0 750c c7042401000000 e8???????? e8???????? }
// n = 7, score = 700
//   c745fc00000000       | mov                 dword ptr [ebp - 4], 0
//   e8????????           |                     
//   84c0                 | test                al, al
//   750c                 | jne                 0xe
//   c7042401000000       | mov                 dword ptr [esp], 1
//   e8????????           |                     
//   e8????????           |                     

$sequence_2 = { 89442404 891424 e8???????? 85c0 7510 8b45fc 40 }
// n = 7, score = 700
//   89442404             | mov                 dword ptr [esp + 4], eax
//   891424               | mov                 dword ptr [esp], edx
//   e8????????           |                     
//   85c0                 | test                eax, eax
//   7510                 | jne                 0x12
//   8b45fc               | mov                 eax, dword ptr [ebp - 4]
//   40                   | inc                 eax

$sequence_3 = { 890424 e8???????? c7042400000000 e8???????? 81c424040000 }
// n = 5, score = 700
//   890424               | mov                 dword ptr [esp], eax
//   e8????????           |                     
//   c7042400000000       | mov                 dword ptr [esp], 0
//   e8????????           |                     
//   81c424040000         | add                 esp, 0x424

$sequence_4 = { e8???????? 8945f4 837df40a 0f842e010000 }
            // n = 4, score = 700
            //   e8????????           |                     
            //   8945f4               | mov                 dword ptr [ebp - 0xc], eax
            //   837df40a             | cmp                 dword ptr [ebp - 0xc], 0xa
            //   0f842e010000         | je                  0x134

        $sequence_5 = { e8???????? c7442404???????? 8b4508 890424 e8???????? 85c0 7e75 }
            // n = 7, score = 700
            //   e8????????           |                     
            //   c7442404????????     |                     
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7e75                 | jle                 0x77

        $sequence_6 = { 890424 e8???????? c7042401000000 e8???????? 89442404 8d85e8fbffff 890424 }
            // n = 7, score = 700
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   c7042401000000       | mov                 dword ptr [esp], 1
            //   e8????????           |                     
            //   89442404             | mov                 dword ptr [esp + 4], eax
            //   8d85e8fbffff         | lea                 eax, [ebp - 0x418]
            //   890424               | mov                 dword ptr [esp], eax

        $sequence_7 = { e8???????? 8b4508 c60000 c9 }
            // n = 4, score = 700
            //   e8????????           |                     
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   c60000               | mov                 byte ptr [eax], 0
            //   c9                   | leave               

        $sequence_8 = { 68???????? e8???????? 8d4dcc e8???????? 83c418 }
            // n = 5, score = 500
            //   68????????           |                     
            //   e8????????           |                     
            //   8d4dcc               | lea                 ecx, [ebp - 0x34]
            //   e8????????           |                     
            //   83c418               | add                 esp, 0x18

        $sequence_9 = { 83fa10 722f 8b8d78feffff 42 8bc1 81fa00100000 7214 }
            // n = 7, score = 500
            //   83fa10               | cmp                 edx, 0x10
            //   722f                 | jb                  0x31
            //   8b8d78feffff         | mov                 ecx, dword ptr [ebp - 0x188]
            //   42                   | inc                 edx
            //   8bc1                 | mov                 eax, ecx
            //   81fa00100000         | cmp                 edx, 0x1000
            //   7214                 | jb                  0x16

        $sequence_10 = { 52 51 e8???????? 83c408 8b955cfeffff }
            // n = 5, score = 400
            //   52                   | push                edx
            //   51                   | push                ecx
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   8b955cfeffff         | mov                 edx, dword ptr [ebp - 0x1a4]

        $sequence_11 = { 50 68???????? 83ec18 8bcc 68???????? }
            // n = 5, score = 400
            //   50                   | push                eax
            //   68????????           |                     
            //   83ec18               | sub                 esp, 0x18
            //   8bcc                 | mov                 ecx, esp
            //   68????????           |                     

        $sequence_12 = { 8b7dfc 8d4201 3bcb 7ccb 837e1410 }
            // n = 5, score = 400
            //   8b7dfc               | mov                 edi, dword ptr [ebp - 4]
            //   8d4201               | lea                 eax, [edx + 1]
            //   3bcb                 | cmp                 ecx, ebx
            //   7ccb                 | jl                  0xffffffcd
            //   837e1410             | cmp                 dword ptr [esi + 0x14], 0x10
-- contd--

 ---contd----
        $sequence_13 = { 83c408 8b554c c7453000000000 c745340f000000 c6452000 83fa10 0f8204ffffff }
            // n = 7, score = 400
            //   83c408               | add                 esp, 8
            //   8b554c               | mov                 edx, dword ptr [ebp + 0x4c]
            //   c7453000000000       | mov                 dword ptr [ebp + 0x30], 0
            //   c745340f000000       | mov                 dword ptr [ebp + 0x34], 0xf
            //   c6452000             | mov                 byte ptr [ebp + 0x20], 0
            //   83fa10               | cmp                 edx, 0x10
            //   0f8204ffffff         | jb                  0xffffff0a

        $sequence_14 = { 68e8030000 ff15???????? 8b551c 83fa10 7228 8b4d08 }
            // n = 6, score = 400
            //   68e8030000           | push                0x3e8
            //   ff15????????         |                     
            //   8b551c               | mov                 edx, dword ptr [ebp + 0x1c]
            //   83fa10               | cmp                 edx, 0x10
            //   7228                 | jb                  0x2a
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]

        $sequence_15 = { 83fa10 722f 8b8d60feffff 42 }
            // n = 4, score = 400
            //   83fa10               | cmp                 edx, 0x10
            //   722f                 | jb                  0x31
            //   8b8d60feffff         | mov                 ecx, dword ptr [ebp - 0x1a0]
            //   42                   | inc                 edx

        $sequence_16 = { 68???????? e8???????? 8d4db4 e8???????? 83c418 }
            // n = 5, score = 400
            //   68????????           |                     
            //   e8????????           |                     
            //   8d4db4               | lea                 ecx, [ebp - 0x4c]
            //   e8????????           |                     
            //   83c418               | add                 esp, 0x18

        $sequence_17 = { c78514feffff0f000000 c68500feffff00 83fa10 722f 8b8de8fdffff 42 }
            // n = 6, score = 300
            //   c78514feffff0f000000     | mov    dword ptr [ebp - 0x1ec], 0xf
            //   c68500feffff00       | mov                 byte ptr [ebp - 0x200], 0
            //   83fa10               | cmp                 edx, 0x10
            //   722f                 | jb                  0x31
            //   8b8de8fdffff         | mov                 ecx, dword ptr [ebp - 0x218]
            //   42                   | inc                 edx

        $sequence_18 = { 83c408 8b95fcfdffff c78510feffff00000000 c78514feffff0f000000 c68500feffff00 83fa10 }
            // n = 6, score = 300
            //   83c408               | add                 esp, 8
            //   8b95fcfdffff         | mov                 edx, dword ptr [ebp - 0x204]
            //   c78510feffff00000000     | mov    dword ptr [ebp - 0x1f0], 0
            //   c78514feffff0f000000     | mov    dword ptr [ebp - 0x1ec], 0xf
            //   c68500feffff00       | mov                 byte ptr [ebp - 0x200], 0
            //   83fa10               | cmp                 edx, 0x10

    condition:
        7 of them and filesize < 520192
}

}

rule detect_Redline_Stealer {
     meta:
        date = "2023-06-06"
        author ="Varp0s"
        yarahub_reference_md5     = "554d25724c8f6f53af8721d0ef6b6f42"
        yarahub_uuid = "671d6f32-8236-46b5-80e3-057192936607"
        yarahub_license =  "CC0 1.0"
        yarahub_rule_matching_tlp =  "TLP:WHITE"
        yarahub_rule_sharing_tlp =  "TLP:WHITE"
        tlp = "WHITE"

    strings:

        $req0 = {72 75 6E 64 6C 6C 33 32 2E 65 78 65 20 25 73 61} 
        $req1 = {43 6F 6E 74 72 6F 6C 20 50 61 6E 65 6C 5C 44 65}
        $req2 = {77 65 78 74 72 61 63 74 2E 70 64 62 00} 
        $req3 = {49 58 50 25 30 33 64 2E 54 4D 50 00}
        $req4 = {54 4D 50 34 33 35 31 24 2E 54 4D 50 00}
        $req5 = {43 6F 6D 6D 61 6E 64 2E 63 6F 6D 20 2F 63 20 25} 
        $req6 = {55 50 44 46 49 4C 45 25 6C 75 00}


              
    condition:
        all of them
}  






rule detect_Redline_Stealer_V2 {
     meta:
        date = "2023-06-06"
        author ="Varp0s"
        yarahub_reference_md5     = "554d25724c8f6f53af8921d0ef6b6f42"
        yarahub_uuid = "e20669f7-da89-41f6-abeb-c3b5a770530e"
        yarahub_license =  "CC0 1.0"
        yarahub_rule_matching_tlp =  "TLP:WHITE"
        yarahub_rule_sharing_tlp =  "TLP:WHITE"
        tlp = "WHITE"
    strings:

        $req0 = {41 00 75 00 74 00 68 00 6F 00 72 00 69 00 7A} 
        $req1 = {6E 00 65 00 74 00 2E 00 74 00 63 00 70 00 3A 00}
        $req3 = {44 00 65 00 63 00 63 00 69 00 65 00 00 00}
        $req4 = {61 00 6D 00 6B 00 6D 00 6A 00 6A 00 6D 00 6D 00}
        $req5 = {31 00 36 00 33 00 2E 00 31 00 32 00 33 00 2E 00}
        $req6 = {59 00 61 00 6E 00 64 00 65 00 78 00 5C 00 59 00}
        $req7 = {31 00 2A 00 2E 00 31 00 6C 00 31 00 64 00 31 00}

              
    condition:
        3 of them 
} 

import "pe"

rule detect_Healer_Defender_Disabler {
    meta:
        date = "2023-07-25"
        author = "Mehardeep Singh Sawhney"
        description = "Rule to detect Healer Microsoft Defender disabler"
        tlp = "WHITE"

    strings:
        $string1 = "Program.DisableService(\"WinDefend\");"
        $string2 = "Program.RegistryEdit(\"SOFTWARE\\\\Microsoft\\\\Windows Defender\\\\Features\", \"TamperProtection\", \"0\");"
        $string3 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\", \"DisableAntiSpyware\", \"1\");"
        $string4 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\", \"DisableBehaviorMonitoring\", \"1\");"
        $string5 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\", \"DisableIOAVProtection\", \"1\");"
        $string6 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\", \"DisableOnAccessProtection\", \"1\");"
        $string7 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\", \"DisableRealtimeMonitoring\", \"1\");"
        $string8 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\", \"DisableScanOnRealtimeEnable\", \"1\");"
        $string9 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender Security Center\\\\Notifications\", \"DisableNotifications\", \"1\");"
        $string10 = "Program.DisableService(\"wuauserv\");"
        $string11 = "Program.DisableService(\"WaaSMedicSvc\");"
        $string12 = "Program.DisableService(\"UsoSvc\");"
        $string13 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\\\\AU\", \"AUOptions\", \"2\");"
        $string14 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\\\\AU\", \"AutoInstallMinorUpdates\", \"0\");"
        $string15 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\\\\AU\", \"NoAutoUpdate\", \"1\");"
        $string16 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\\\\AU\", \"NoAutoRebootWithLoggedOnUsers\", \"1\");"
        $string17 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\\\\AU\", \"UseWUServer\", \"1\");"
        $string18 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\", \"DoNotConnectToWindowsUpdateInternetLocations\", \"1\");"
        $string19 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\", \"WUStatusServer\", \"server.wsus\");"
        $string20 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\", \"WUServer\", \"server.wsus\");"
        $string21 = "Program.RegistryEdit(\"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WindowsUpdate\", \"UpdateServiceUrlAlternate\", \"server.wsus\");"

    condition:
        all of them and pe.is_dotnet
}