MalwarePublished 19 Feb 2024

OSINT - Backmydata Ransomware Indicators of Compromise (IOCs) - alerts - dnsc.ro

Source CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

Impact

European organizations, especially in the healthcare sector, face significant risks from Backmydata ransomware due to the critical nature of healthcare services and the sensitivity of patient data. Successful exploitation can lead to data encryption, operational downtime, and potential data breaches, impacting patient care and regulatory compliance under GDPR. The disruption of healthcare services can have life-threatening consequences and cause reputational damage. Additionally, ransom payments and recovery costs can be substantial. Organizations with exposed RDP services or insufficiently secured public-facing applications are particularly vulnerable. The threat also poses risks to business continuity and may trigger regulatory scrutiny and financial penalties. The medium severity indicates that while exploitation requires some level of access or misconfiguration, the consequences of a successful attack are severe enough to warrant urgent attention. The lack of a patch means organizations must rely on defensive controls and monitoring to mitigate risk.

Defensive guidance

1. Immediately audit and restrict all public-facing RDP and remote access services; disable RDP if not absolutely necessary. 2. Implement multi-factor authentication (MFA) on all remote access points to prevent unauthorized access. 3. Employ network segmentation to isolate critical healthcare systems from general IT infrastructure and internet-facing services. 4. Use VPNs or secure gateways to control and encrypt remote connections rather than exposing RDP directly to the internet. 5. Continuously monitor logs and network traffic for unusual access patterns or indicators of compromise related to Backmydata or Phobos ransomware. 6. Regularly update and patch all public-facing applications and systems to reduce the attack surface, even though no specific patch exists for this ransomware. 7. Conduct regular backups of critical data, ensuring backups are offline or immutable to prevent ransomware encryption. 8. Train staff on phishing and social engineering tactics, as initial access may also involve credential compromise. 9. Subscribe to threat intelligence feeds such as CIRCL OSINT to stay updated on emerging IOCs and tactics. 10. Develop and test incident response plans tailored to ransomware scenarios, focusing on rapid containment and recovery.

Indicators of compromise

Hashes 22

31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc
a6527183e3cbf81602de16f3448a8754f6cecd05dc3568fa2795de534b366da4
59756c8f4c760f1b29311a5732cb3fdd41d4b5bc9c88cd77c560e27b6e59780c
b42725211240828ccc505d193d8ea5915e395c9f43e71496ff0ece4f72e3e4ab
7a313840d25adf94c7bf1d17393f5b991ba8baf50b8cacb7ce0420189c177e26
6a87226ed5cca8e072507d6c24289c57757dd96177f329a00b00e40427a1d473
de374c1b9a05c2203e66917202c42d11eac4368f635ccaaadf02346035e82562
91041b616969e1526ee6dce23f8d18afdd353786ac6afa0b6611903263ee6f63
8e4b218bdbd8e098fff749fe5e5bbf00275d21f398b34216a573224e192094b8
04cc60eba7041e0cef2deb1bec9a087432344737dd2e5141c9cda981506ca1a5

Text 104

During the night of 11 to 12 February 2024 there was a ransomware cyber-attack on the Romanian Soft Company (RSC) www.rsc.ro, which develops, manages and markets the Hippocrates computer system (a.k.a. HIS). According to DNSC data, the attack disrupted the activity of 26 Romanian hospitals using the Hippocrates IT system. The malware used in the attack is Backmydata ransomware application that is part of the Phobos malware family, known for propagating through Remote Desktop Protocol (RDP) connections. Backmydata is designed to encrypt target files using a complex algorithm. Encrypted files are renamed with .backmydata extension. After encryption, the malware provides two ransom notes (info.hta and info.txt), with details of the steps to be taken for contacting the attackers and how to pay the ransom. The Directorate recommends to all healthcare entities, whether or not they have been affected by the Backmydata ransomware attack, to scan their IT &C infrastructure using the YARA scanning script.
Alert
all
Phobos_CrypterBinary
all
Phobos_kprocesshacker
all
Phobos_mimikatz_drv
all
Phobos_mimikatz_drv_32

File 2

DNSC ALERT v2024.02.16 Backmydata Ransomware Attack IOCs UPDATE ENG.pdf
yara-scan-dnsc-v101.zip

Yara 50

rule Phobos_CrypterBinary { meta: description = "Phobos Ransomware Crypter Binary" author = "Directoratul National de Securitate Cibernetica (DNSC)" date = "2024-02-12" hash1 = "396a2f2dd09c936e93d250e8467ac7a9c0a923ea7f9a395e63c375b877a399a6" strings: $s1 = "\\.#* 0_" fullword ascii $s2 = "9F:b:{:" fullword ascii $s3 = "D$(Y_^[" fullword ascii $s4 = "tEWVVVV" fullword ascii $s5 = "YSVWj(j" fullword ascii $s6 = "^yMQb O8y" fullword ascii $s7 = "tjWWVhKE@" fullword ascii $s8 = "D$LPVVVWVVV" fullword ascii $s9 = "D$PPSj" fullword ascii $s10 = "YY9\\$0t" fullword ascii $s11 = "8$8/8|8" fullword ascii $s12 = "SVWj23" fullword ascii $s13 = "\\\\?\\X:" fullword wide $s14 = "\\\\?\\ :" fullword wide $s15 = "\\\\?\\UNC\\\\\\e-" fullword wide $s16 = "D$HY_^[" fullword ascii $s17 = "L{gYm+" fullword ascii $s18 = "2*262H2Q2^2j2" fullword ascii $s19 = "9\\$Pt." fullword ascii $s20 = "Y9\\$4t&9\\$Xt " fullword ascii $op0 = { 53 e8 34 7d 00 00 59 89 45 dc 8d 45 cc 50 68 06 } $op1 = { 39 5c 24 34 74 0a 39 5c 24 44 0f 84 af } $op2 = { 6a 18 c7 46 34 00 00 01 00 c7 46 30 00 00 10 00 } $ap0 = "MPR.dll" fullword ascii $ap1 = "WS2_32.dll" fullword ascii $ap2 = "WINHTTP.dll" fullword ascii $ap3 = "KERNEL32.dll" fullword ascii $ap4 = "USER32.dll" fullword ascii $ap5 = "ADVAPI32.dll" fullword ascii $ap6 = "SHELL32.dll" fullword ascii $ap7 = "ole32.dll" fullword ascii $ap8 = "GetTickCount" fullword ascii $ap9 = "GetIpAddrTable" fullword ascii condition: uint16(0) == 0x5a4d and filesize < 200KB and ( 8 of them and all of ($op*) and all of ($ap*) ) }
rule Phobos_kprocesshacker { meta: description = "Phobos kprocesshacker.sys" author = "Directoratul National de Securitate Cibernetica (DNSC)" date = "2024-02-14" hash1 = "70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4" strings: $x1 = "d:\\projects\\processhacker2\\kprocesshacker\\bin\\amd64\\kprocesshacker.pdb" fullword ascii $x2 = "kprocesshacker.sys" fullword wide $s3 = ":http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0O" fullword ascii $s4 = ":http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@" fullword ascii $s5 = "\\Device\\KProcessHacker3" fullword wide $s6 = "KProcessHacker" fullword wide $s7 = "www.digicert.com1503" fullword ascii $s8 = "http://ocsp.digicert.com0R" fullword ascii $s9 = "Fhttp://cacerts.digicert.com/DigiCertSHA2HighAssuranceCodeSigningCA.crt0" fullword ascii $s10 = "*http://crl3.digicert.com/sha2-ha-cs-g1.crl00" fullword ascii $s11 = "*http://crl4.digicert.com/sha2-ha-cs-g1.crl0L" fullword ascii $s12 = "DynamicConfiguration" fullword wide $s13 = "Sydney1" fullword ascii $s14 = "\\CDvQbX/0" fullword ascii $s15 = " Microsoft Code Verification Root0" fullword ascii $s16 = "SHA256" fullword wide /* Goodware String - occured 507 times */ $s17 = "New South Wales1" fullword ascii /* Goodware String - occured 1 times */ $s18 = "CIQh't%" fullword ascii $s19 = "DigiCert, Inc.1*0(" fullword ascii $s20 = "Licensed under the GNU GPL, v3." fullword wide $op0 = { 8c 99 00 00 58 20 00 00 c0 90 } $ap0 = "PsGetCurrentProcessId" fullword ascii $ap1 = "SePrivilegeCheck" fullword ascii $ap2 = "PsInitialSystemProcess" fullword ascii $ap3 = "ZwQuerySystemInformation" fullword ascii condition: uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) and 4 of them and all of ($op*) and all of ($ap*)) }
rule Phobos_mimikatz_drv { meta: description = "mimidrv.sys" author = "Directoratul National de Securitate Cibernetica (DNSC)" date = "2024-02-15" hash1 = "d43520128871c83b904f3136542ea46644ac81a62d51ae9d3c3a3f32405aad96" strings: $s1 = "powershell.exe" fullword ascii $s2 = "$http://blog.gentilkiwi.com/mimikatz 0" fullword ascii $s3 = "mimikatz.exe" fullword ascii $s4 = "c:\\security\\mimikatz\\mimidrv\\objfre_wnet_amd64\\amd64\\mimidrv.pdb" fullword ascii $s5 = "mimidrv.sys" fullword wide $s6 = "!http://ocsp.globalsign.com/rootr103" fullword ascii $s7 = "\"http://crl.globalsign.com/root.crl0c" fullword ascii $s8 = " ! ZwSetInformationProcess 0x%08x for %u/%-14S" fullword wide $s9 = "MmProbeAndLockProcessPages" fullword wide $s10 = "PsSetCreateProcessNotifyRoutine" fullword wide $s11 = "PostOperation : " fullword wide $s12 = "KeServiceDescriptorTable : 0x%p (%u)" fullword wide $s13 = "Raw command (not implemented yet) : %s" fullword wide $s14 = "* Callback [type %u] - Handle 0x%p (@ 0x%p)" fullword wide $s15 = "SeRegisterLogonSessionTerminatedRoutineEx" fullword wide $s16 = "RtlGetSystemBootStatus" fullword wide $s17 = "Copyright (c) 2007 - 2020 gentilkiwi (Benjamin DELPY)" fullword wide $s18 = "*mimikatz driver 2.2." fullword wide $s19 = "\\DosDevices\\mimidrv" fullword wide $s20 = "ObReferenceSecurityDescriptor" fullword wide $op0 = { f8 b4 00 00 30 50 00 00 c0 b0 } $op1 = { 61 01 49 6f 44 65 6c 65 74 65 53 79 6d 62 6f 6c } condition: uint16(0) == 0x5a4d and filesize < 100KB and ( 8 of them and all of ($op*) ) }
rule Phobos_mimikatz_drv_32 { meta: description = "mimidrv_32.sys" author = "Directoratul National de Securitate Cibernetica (DNSC)" date = "2024-02-15" hash1 = "d032001eab6cad4fbef19aab418650ded00152143bd14507e17d62748297c23f" strings: $s1 = "powershell.exe" fullword ascii $s2 = "$http://blog.gentilkiwi.com/mimikatz 0" fullword ascii $s3 = "mimikatz.exe" fullword ascii $s4 = "c:\\security\\mimikatz\\mimidrv\\objfre_wnet_x86\\i386\\mimidrv.pdb" fullword ascii $s5 = "mimidrv.sys" fullword wide $s6 = "PsCreateSystemProcess" fullword wide $s7 = "!http://ocsp.globalsign.com/rootr103" fullword ascii $s8 = "\"http://crl.globalsign.com/root.crl0c" fullword ascii $s9 = " ! ZwSetInformationProcess 0x%08x for %u/%-14S" fullword wide $s10 = "PsSetCreateProcessNotifyRoutine" fullword wide $s11 = "PsGetThreadSessionId" fullword wide $s12 = "NtSetInformationProcess" fullword wide $s13 = "PostOperation : " fullword wide $s14 = "KeServiceDescriptorTable : 0x%p (%u)" fullword wide $s15 = "Raw command (not implemented yet) : %s" fullword wide $s16 = "* Callback [type %u] - Handle 0x%p (@ 0x%p)" fullword wide $s17 = "Copyright (c) 2007 - 2020 gentilkiwi (Benjamin DELPY)" fullword wide $s18 = "*mimikatz driver 2.2." fullword wide $s19 = "\\DosDevices\\mimidrv" fullword wide $s20 = "CREATE_NAMED_PIPE" fullword wide $op0 = { a1 88 64 01 00 b9 4e e6 40 bb 85 c0 74 04 3b c1 } $op1 = { 3c 84 00 00 18 40 00 00 8c 80 } $op2 = { 96 84 00 00 7e 84 00 00 62 84 00 00 4a 84 00 00 } condition: uint16(0) == 0x5a4d and filesize < 90KB and ( 8 of them and all of ($op*) ) }
rule Phobos_BulletsPassView64 { meta: description = "BulletsPassView64.exe" author = "Directoratul National de Securitate Cibernetica (DNSC)" date = "2024-02-15" hash1 = "e71cda5e7c018f18aefcdfbce171cfeee7b8d556e5036d8b8f0864efc5f2156b" strings: $s1 = " <assemblyIdentity type=\"Win32\" name=\"Microsoft.Windows.Common-Controls\" version=\"6.0.0.0\" processorArchitecture=\"am" ascii $s2 = "BulletsPassView.exe" fullword wide $s3 = "<br><h4>%s <a href=\"http://www.nirsoft.net/\" target=\"newwin\">%s</a></h4><p>" fullword wide $s4 = "c:\\Projects\\VS2005\\BulletsPassView\\x64\\Release\\BulletsPassView.pdb" fullword ascii $s5 = " <assemblyIdentity type=\"Win32\" name=\"Microsoft.Windows.Common-Controls\" version=\"6.0.0.0\" processorArchitecture=\"am" ascii $s6 = "Process Description" fullword wide $s7 = "<meta http-equiv='content-type' content='text/html;charset=%s'>" fullword wide $s8 = "Process Path" fullword wide $s9 = "ScanIEPasswords" fullword wide $s10 = "ScanWindowsPasswords" fullword wide $s11 = "Scan Internet Explorer Passwords" fullword wide $s12 = "Scan Standard Password Text-Boxes" fullword wide $s13 = "AddExportHeaderLine" fullword wide $s14 = "<html><head>%s<title>%s</title></head>" fullword wide $s15 = "UnmaskPasswordBox" fullword wide $s16 = "BeepOnNewPassword" fullword wide $s17 = "&Clear Passwords List" fullword wide $s18 = "Copy Selected &Password" fullword wide $s19 = "&Unmask Password Text Box" fullword wide $s20 = "Beep On New Password" fullword wide $op0 = { 48 8b 08 66 44 89 34 91 66 85 ff 0f 85 f9 01 00 } $op1 = { 48 c7 c6 ff ff ff ff 89 0d 06 04 01 00 c7 05 00 } $op2 = { 48 8b d8 74 34 48 83 25 e6 fb } condition: uint16(0) == 0x5a4d and filesize < 300KB and ( 8 of them and all of ($op*) ) }
rule Phobos_SniffPass64 { meta: description = "SniffPass64.exe" author = "Directoratul National de Securitate Cibernetica (DNSC)" date = "2024-02-15" hash1 = "c92580318be4effdb37aa67145748826f6a9e285bc2426410dc280e61e3c7620" strings: $x1 = "Win32\" name=\"Microsoft.Windows.Common-Controls\" version=\"6.0.0.0\" processorArchitecture=\"amd64\" publicKeyToken=\"6595b641" ascii $x2 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><dependency><dependentAssembly><assemblyIdentity ty" ascii $s3 = "c:\\Projects\\VS2005\\SniffPass\\x64\\Release\\SniffPass.pdb" fullword ascii $s4 = "npptools.dll" fullword ascii $s5 = "NmApi.dll" fullword ascii $s6 = "<br><h4>%s <a href=\"http://www.nirsoft.net/\" target=\"newwin\">%s</a></h4><p>" fullword ascii $s7 = "nmwifi.exe" fullword ascii $s8 = "Pwpcap.dll" fullword ascii $s9 = "Sniffed PasswordsCFailed to start capturing packets from the current network adapter.9Do you want to stop the capture and exit f" wide $s10 = "<meta http-equiv='content-type' content='text/html;charset=%s'>" fullword ascii $s11 = "login " fullword ascii $s12 = "AddExportHeaderLine" fullword ascii $s13 = "NirSoft SniffPass" fullword ascii $s14 = "NmGetFrame" fullword ascii $s15 = "NmGetRawFrame" fullword ascii $s16 = "NmGetFrameCount" fullword ascii $s17 = "NmGetRawFrameLength" fullword ascii $s18 = "Software\\NirSoft\\SniffPass" fullword ascii $s19 = "BeepOnNewPassword" fullword ascii $s20 = "<html><head>%s<title>%s</title></head>" fullword ascii $op0 = { 48 8b 08 66 44 89 34 91 66 85 ff 0f 85 f9 01 00 } $op1 = { 48 8d 4c 24 20 41 83 c8 ff c7 44 24 34 00 01 00 } $op2 = { 48 8d 91 24 01 00 00 4c 8d 0d 34 00 01 00 45 33 } condition: uint16(0) == 0x5a4d and filesize < 300KB and ( 1 of ($x*) and 4 of them and all of ($op*) ) }
rule Phobos_mimikatz { meta: description = "mimik.exe" author = "Directoratul National de Securitate Cibernetica (DNSC)" date = "2024-02-15" hash1 = "31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc" strings: $x1 = "ERROR kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x%08x)" fullword wide $x2 = "ERROR kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx user (%s)" fullword wide $x3 = "ERROR kuhl_m_lsadump_update_dc_password ; A /target argument is needed" fullword wide $x4 = "ERROR kuhl_m_lsadump_getComputerAndSyskey ; kull_m_registry_RegOpenKeyEx LSA KO" fullword wide $x5 = "ERROR kuhl_m_lsadump_getUsersAndSamKey ; kuhl_m_lsadump_getSamKey KO" fullword wide $x6 = "ERROR kuhl_m_lsadump_lsa ; kull_m_process_getVeryBasicModuleInformationsForName (0x%08x)" fullword wide $x7 = "ERROR kuhl_m_lsadump_lsa_getHandle ; OpenProcess (0x%08x)" fullword wide $x8 = "ERROR kuhl_m_lsadump_trust ; kull_m_process_getVeryBasicModuleInformationsForName (0x%08x)" fullword wide $x9 = "ERROR kuhl_m_lsadump_dcsync ; kull_m_rpc_drsr_ProcessGetNCChangesReply" fullword wide $x10 = "ERROR kuhl_m_dpapi_chrome ; Input 'Login Data' file needed (/in:\"%%localappdata%%\\Google\\Chrome\\User Data\\Default\\Login Da" wide $x11 = "ERROR kuhl_m_kernel_processProtect ; Argument /process:program.exe or /pid:processid needed" fullword wide $x12 = "ERROR kuhl_m_lsadump_netsync ; I_NetServerTrustPasswordsGet (0x%08x)" fullword wide $x13 = "ERROR kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt ; Checksums don't match (C:0x%08x - R:0x%08x)" fullword wide $x14 = "ERROR kuhl_m_lsadump_sam ; kull_m_registry_RegOpenKeyEx (SAM) (0x%08x)" fullword wide $x15 = "ERROR kuhl_m_lsadump_getHash ; Unknow SAM_HASH revision (%hu)" fullword wide $x16 = "ERROR kuhl_m_lsadump_changentlm ; Argument /oldpassword: or /oldntlm: is needed" fullword wide $x17 = "ERROR kuhl_m_lsadump_enumdomains_users ; /user or /rid is needed" fullword wide $x18 = "ERROR kuhl_m_lsadump_zerologon ; Missing /account argument, usually a DC$ account" fullword wide $x19 = "ERROR kuhl_m_lsadump_update_dc_password ; A /account argument is needed" fullword wide $x20 = "livessp.dll" fullword wide /* reversed goodware string 'lld.pssevil' */ $op0 = { 45 3b c8 72 34 4c 8d 4c 24 30 48 8b d7 4c 89 7c } $op1 = { e8 1b 18 0c 00 8b 4b 30 4c 8d 5f 34 4c 89 5b 34 } $op2 = { 48 89 44 24 28 4c 89 64 24 20 ff 15 34 6b 0c 00 } condition: uint16(0) == 0x5a4d and filesize < 4000KB and ( 1 of ($x*) and all of ($op*) ) }
rule Phobos_mimikatzlib { meta: description = "mimilib.dll" author = "Directoratul National de Securitate Cibernetica (DNSC)" date = "2024-02-15" hash1 = "59756c8f4c760f1b29311a5732cb3fdd41d4b5bc9c88cd77c560e27b6e59780c" strings: $x1 = "0: kd> !process 0 0 lsass.exe" fullword ascii $s2 = "$http://blog.gentilkiwi.com/mimikatz 0" fullword ascii $s3 = "0: kd> .process /r /p <EPROCESS address>" fullword ascii $s4 = "mimilib.dll" fullword wide $s5 = "# Search for LSASS process" fullword ascii $s6 = " '## v ##' https://blog.gentilkiwi.com/mimikatz (oe.eo)" fullword ascii $s7 = "%p - lsasrv!LogonSessionList" fullword ascii $s8 = "%p - lsasrv!LogonSessionListCount" fullword ascii $s9 = "kiwidns.log" fullword wide $s10 = "kiwifilter.log" fullword wide $s11 = "kiwinp.log" fullword wide $s12 = "kiwissp.log" fullword wide $s13 = "kiwisub.log" fullword wide $s14 = "masterkey" fullword ascii $s15 = " * Password : " fullword ascii $s16 = "%p - lsasrv!h3DesKey" fullword ascii $s17 = "Unknown version in Kerberos credentials structure" fullword ascii $s18 = "lsasrv!g_fSystemCredsInitialized" fullword ascii $s19 = "dpapisrv!g_fSystemCredsInitialized" fullword ascii $s20 = "%p - lsasrv!hAesKey" fullword ascii $op0 = { b8 79 ff ff ff 3b c8 7f 5e 74 54 81 f9 6b ff ff } $op1 = { 4c 3b f3 48 8d 3d 34 5c 00 00 48 8d 05 b5 3f 00 } $op2 = { 8b 4d 28 e8 a0 fc ff ff 89 45 34 eb 07 c7 45 34 } condition: uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) and 4 of them and all of ($op*) ) }
rule Phobos_WirelessKeyView64 { meta: description = "WirelessKeyView64.exe" author = "Directoratul National de Securitate Cibernetica (DNSC)" date = "2024-02-15" hash1 = "48b77c1efbc3197128391a35d0e1ed0b5cc3a05b96dd12c98ac73ffc6a886fc8" strings: $x1 = "Win32\" name=\"Microsoft.Windows.Common-Controls\" version=\"6.0.0.0\" processorArchitecture=\"amd64\" publicKeyToken=\"6595b641" ascii $x2 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><dependency><dependentAssembly><assemblyIdentity ty" ascii $x3 = "Windows Protect folder for getting the encryption keys, For example: G:\\windows\\system32\\Microsoft\\Protect" fullword wide $s4 = "<br><h4>%s <a href=\"http://www.nirsoft.net/\" target=\"newwin\">%s</a></h4><p>" fullword ascii $s5 = "Windows Registry hives folder, for example: k:\\windows\\system32\\config" fullword wide $s6 = "SYSTEM\\%s\\Control\\Network\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\%s\\Connection" fullword ascii $s7 = "<meta http-equiv='content-type' content='text/html;charset=%s'>" fullword ascii $s8 = "system32\\config\\Software" fullword ascii $s9 = "system32\\config" fullword ascii $s10 = "Load the wireless keys of the current logged-on user" fullword wide $s11 = "/Running WirelessKeyView as SYSTEM user (Faster)%Directly decrypting the wireless keys" fullword wide $s12 = "SYSTEM\\%s\\Enum\\%s" fullword ascii $s13 = "AddExportHeaderLine" fullword ascii $s14 = "<html><head>%s<title>%s</title></head>" fullword ascii $s15 = "/GetKeys" fullword ascii $s16 = "<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s" fullword ascii $s17 = "report.html" fullword ascii $s18 = " Type Descriptor'" fullword ascii $s19 = "Load wireless keys from remote system (Windows Vista or later, requires full admin rights)" fullword wide $s20 = "Windows Directory: (For example: K:\\Windows )" fullword wide $op0 = { 48 8b 08 66 44 89 34 91 66 85 ff 0f 85 f9 01 00 } $op1 = { 48 8d 4c 24 20 41 83 c8 ff c7 44 24 34 00 01 00 } $op2 = { 49 89 83 28 ff ff ff 49 89 83 30 ff ff ff c7 84 } condition: uint16(0) == 0x5a4d and filesize < 700KB and ( 1 of ($x*) and 4 of them and all of ($op*) ) }
rule Phobos_netpass64 { meta: description = "netpass64.exe" author = "Directoratul National de Securitate Cibernetica (DNSC)" date = "2024-02-15" hash1 = "6a87226ed5cca8e072507d6c24289c57757dd96177f329a00b00e40427a1d473" strings: $x1 = "Windows Protect folder for getting the encryption keys, For example: F:\\Users\\Nir\\AppData\\Roaming\\Microsoft\\Protect" fullword wide $x2 = "Win32\" name=\"Microsoft.Windows.Common-Controls\" version=\"6.0.0.0\" processorArchitecture=\"amd64\" publicKeyToken=\"6595b641" ascii $x3 = "Windows Credentials folder: (For exmaple: C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Credentials )" fullword wide $x4 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><dependency><dependentAssembly><assemblyIdentity ty" ascii $s5 = "<br><h4>%s <a href=\"http://www.nirsoft.net/\" target=\"newwin\">%s</a></h4><p>" fullword ascii $s6 = "c:\\Projects\\VS2005\\netpass\\x64\\Release\\netpass.pdb" fullword ascii $s7 = "User Profile Folder: (For example: K:\\users\\admin )" fullword wide $s8 = "Bad file structure !UFailed to decrypt the key file. It's possible that the supplied password is incorrect" fullword wide $s9 = "<meta http-equiv='content-type' content='text/html;charset=%s'>" fullword ascii $s10 = "Failed to load the executable file !" fullword ascii $s11 = "Export Raw Passwords Data" fullword wide $s12 = "Windows Login Password:" fullword wide $s13 = "+Failed to find the encryption key filename.-The structure of the key filename is invalid./The structure of the protected data i" wide $s14 = "AppData\\Roaming" fullword ascii $s15 = "AppData\\Roaming\\Microsoft\\Protect" fullword ascii $s16 = " Network Password Recovery" fullword wide $s17 = " Network Password Recovery" fullword wide $s18 = "AddExportHeaderLine" fullword ascii $s19 = "<html><head>%s<title>%s</title></head>" fullword ascii $s20 = "Domain Password" fullword wide $op0 = { 48 8b 08 66 44 89 34 91 66 85 ff 0f 85 f9 01 00 } $op1 = { 48 8d 4c 24 20 41 83 c8 ff c7 44 24 34 00 01 00 } $op2 = { 04 45 88 ab 21 ff ff ff 45 88 ab 22 ff ff ff 45 } condition: uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) and 4 of them and all of ($op*) ) }

Community reviews

Loading reviews…