OpHoneybee_Malware_1

Description

Detects malware from Operation Honeybee

Query · yara

strings:
      $x1 = "cmd /c taskkill /im cliconfg.exe /f /t && del /f /q" fullword ascii
      $x2 = "\\FTPCom_vs10\\Release\\Engine.pdb" ascii
      $x3 = "KXU/yP=B29tLzidqNRuf-SbVInw0oCrmWZk6OpFc7A5GTD1QxaJ3H8h4jMeEsYglv" fullword ascii
      $x4 = "D:\\Task\\MiMul\\" ascii

      $s1 = "[DLL_PROCESS_ATTACH]" fullword ascii
      $s2 = "cmd /c systeminfo >%s" fullword ascii
      $s3 = "post.txt" fullword ascii
      $s4 = "\\temp.ini" ascii
      $s5 = "[GetFTPAccountInfo_10001712]" fullword ascii
      $s6 = "ComSysAppMutex" fullword ascii
      $s7 = "From %s (%02d-%02d %02d-%02d-%02d).txt" fullword ascii
      $s8 = "%s %s %c%s%c" fullword ascii
      $s9 = "TO EVERYONE" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (
        pe.imphash() == "e14b59a79999cc0bc589a4cb5994692a" or
        pe.imphash() == "64400f452e2f60305c341e08f217b02c" or
        1 of ($x*) or
        3 of them
      )
Raw source OpHoneybee_Malware_1 · YARA
Esc
Published by Neo23x0/signature-base ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
rule OpHoneybee_Malware_1 {
   meta:
      description = "Detects malware from Operation Honeybee"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/JAHZVL"
      date = "2018-03-03"
      hash1 = "d31fe5cfa884e04ee26f323b8d104dcaa91146f5c7c216212fd3053afaade80f"
      hash2 = "fc2bcd38659ae83fd25b4f7091412ae9ba011612fa4dcc3ef665b2cae2a1d74f"
      hash3 = "2c5e5c86ca4fa172341c6bcbaa50984fb168d650ae9a33f2c6e6dccc1d57b369"
      hash4 = "439c305cd408dbb508e153caab29d17021a7430f1dbaec0c90ac750ba2136f5f"
      id = "5f48434e-efe6-5cd8-85e2-eabf528e6c58"
   strings:
      $x1 = "cmd /c taskkill /im cliconfg.exe /f /t && del /f /q" fullword ascii
      $x2 = "\\FTPCom_vs10\\Release\\Engine.pdb" ascii
      $x3 = "KXU/yP=B29tLzidqNRuf-SbVInw0oCrmWZk6OpFc7A5GTD1QxaJ3H8h4jMeEsYglv" fullword ascii
      $x4 = "D:\\Task\\MiMul\\" ascii

      $s1 = "[DLL_PROCESS_ATTACH]" fullword ascii
      $s2 = "cmd /c systeminfo >%s" fullword ascii
      $s3 = "post.txt" fullword ascii
      $s4 = "\\temp.ini" ascii
      $s5 = "[GetFTPAccountInfo_10001712]" fullword ascii
      $s6 = "ComSysAppMutex" fullword ascii
      $s7 = "From %s (%02d-%02d %02d-%02d-%02d).txt" fullword ascii
      $s8 = "%s %s %c%s%c" fullword ascii
      $s9 = "TO EVERYONE" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (
        pe.imphash() == "e14b59a79999cc0bc589a4cb5994692a" or
        pe.imphash() == "64400f452e2f60305c341e08f217b02c" or
        1 of ($x*) or
        3 of them
      )
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.