rule Turla_APT_Malware_Gen1 {
meta:
description = "Detects Turla malware (based on sample used in the RUAG APT case)"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
family = "Turla"
reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
date = "2016-06-09"
hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
hash5 = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
hash6 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
hash7 = "8f2ea0f916fda1dfb771f5441e919c561da5b6334b9f2fffcbf53db14063b24a"
hash8 = "8dddc744bbfcf215346c812aa569e49523996f73a1f22fe4e688084ce1225b98"
hash9 = "0c69258adcc97632b729e55664c22cd942812336d41e8ea0cff9ddcafaded20f"
hash10 = "2b4fba1ef06f85d1395945db40a9f2c3b3ed81b56fb9c2d5e5bb693c230215e2"
id = "7ead2da1-3544-5a26-8767-6d3f29de8b96"
strings:
$x1 = "too long data for this type of transport" fullword ascii
$x2 = "not enough server resources to complete operation" fullword ascii
$x3 = "Task not execute. Arg file failed." fullword ascii
$x4 = "Global\\MSCTF.Shared.MUTEX.ZRX" fullword ascii
$s1 = "peer has closed the connection" fullword ascii
$s2 = "tcpdump.exe" fullword ascii
$s3 = "windump.exe" fullword ascii
$s4 = "dsniff.exe" fullword ascii
$s5 = "wireshark.exe" fullword ascii
$s6 = "ethereal.exe" fullword ascii
$s7 = "snoop.exe" fullword ascii
$s8 = "ettercap.exe" fullword ascii
$s9 = "miniport.dat" fullword ascii
$s10 = "net_password=%s" fullword ascii
condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and ( 2 of ($x*) or 8 of ($s*) ) )
or ( 12 of them )
}