yara-rules

최근 악성코드 연구에서 수집한 YARA 시그니처 모음

규칙 모음

Dacls Trojan

• 규칙: Dacls_Linux.yara
• 규칙: Dacls_Windows.yara
• 참조: https://blog.netlab.360.com/dacls-the-dual-platform-rat/

APT32 KerrDown

• 규칙: APT32_KerrDown.yara
• 참조: https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/

---

ACBackdoor - Linux 빌드

• 규칙: ACBackdoor_Linux.rule
• 참조: Intezer

---

이름 없는 Linux Golang 랜섬웨어

• 규칙: Linux_Golang_Ransomware.rule
• 참조: Fortinet Blog

---

KPOT v2

• 규칙: KPOT_v2.yara
• 참조: (ProofPoint Threat Insight)[https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal]

---

WatchBog Linux 봇넷

• 규칙: WatchBog_Linux.yara
• 참조:
  • https://twitter.com/polarply/status/1153232987762376704
  • https://www.alibabacloud.com/blog/return-of-watchbog-exploiting-jenkins-cve-2018-1000861_594798

---

EvilGnome Linux 악성코드

• 규칙: EvilGnome_Linux.yara
• 참조: Intezer

---

APT34 PICKPOCKET

• 규칙: APT34_PICKPOCKET.yara
• 참조: FireEye Threat Reseearch

---

APT34 LONGWATCH

• 규칙: APT34_LONGWATCH.yara
• 참조: FireEye Threat Reseearch

---

APT34 VALUEVAULT

• 규칙: APT34_VALUEVAULT.yara
• 참조: FireEye Threat Reseearch

---

RedGhost Linux 도구

• 규칙: RedGhost_Linux
• 참조: RedGhost Gitub repo

---

SilentTrinity

• 규칙: SilentTrinity_Payload.rule
• 규칙: SilentTrinity_Delivery.rule
• 참조: Countercept

---

DNSpionage

• 규칙: DNSpionage.yara
• 참조: Talos Intelligence, Talos Intelligence #2

---

TA505 FlowerPippi

• 규칙: TA505_FlowerPippi.yara
• 참조: https://blog.trendmicro.com/trendlabs-security-intelligence/latest-spam-campaigns-from-ta505-now-using-new-malware-tools-gelup-and-flowerpippi/

---

REMCOS RAT

• 규칙: REMCOS_RAT_2019.yara
• 참조: https://exchange.xforce.ibmcloud.com/collection/Remcos-Rat-Delivered-via-Email-Campaign-056f98e4fc97bd142337d6b2271aeaa7

---

GodLua Linux 백도어

• 규칙: godlua_linux.yara
• 참조: https://blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/

---

APT32 Ratsnif

• 규칙: apt32-ratsnif.yara
• 참조: https://threatvector.cylance.com/en_us/home/threat-spotlight-ratsnif-new-network-vermin-from-oceanlotus.html

---

OSX/CrescentCore

• 규칙: crescentcore_dmg.yara
• 참조: https://www.intego.com/mac-security-blog/osx-crescentcore-mac-malware-designed-to-evade-antivirus/

참고: 언제쯤 우리 모두 mac 시그니처 이름을 macOS/<악성코드>로 변경하기로 합의할까요? 제 생각엔 이미 때가 지났습니다.

---

WarZone RAT (Ave Maria Stealer)

• 규칙: avemaria_warzone.yara
• 참조: http://blog.morphisec.com/threat-alert-ave-maria-infostealer-on-the-rise-with-new-stealthier-delivery

---

Winnti Linux

• 규칙: winnti_linux.yara
• 참조: https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a