APT_Tortoiseshell_Syskit

import "pe"

rule syskit {
   
   meta:

      description = "SYSkit backdoor"
      author = "Christiaan | McAfee ATR Team"
      reference = "https://www.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain"
      date = "2019-09-17"
      rule_version = "v1"
      malware_type = "backdoor"
      malware_family = "Backdoor:W32/SysKit"
      actor_type = "Apt"
      actor_group = "Unknown"
      hash = "07d123364d8d04e3fe0bfa4e0e23ddc7050ef039602ecd72baed70e6553c3ae4"

   strings:

      $x1 = "timeout /t 10 & sc stop dllhost & timeout /t 10 & del C:\\Windows\\Temp\\BAK.exe" fullword wide
      $s2 = "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ascii
      $s3 = "C:\\Windows\\Temp\\rconfig.xml" fullword wide
      $s4 = "Add-Type -AssemblyName System.IO.Compression.FileSystem" fullword wide
      $s5 = "serviceProcessInstaller1" fullword ascii
      $s6 = "    [System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $outpath)" fullword wide
      $s7 = "exec_cmd2" fullword ascii
      $s8 = "exec_cmd" fullword ascii
      $s9 = "send_command_result" fullword ascii
      $s10 = "mycontent" fullword ascii
      $s11 = "Diagnostic Server Host" fullword wide
      $s12 = "bytesToBeEncrypted" fullword ascii
      $s13 = "createPostRequest" fullword ascii
      $s14 = "myhash" fullword ascii
      $s15 = "DD5783BCF1E9002BC00AD5B83A95ED6E4EBB4AD5" ascii
      $s16 = "circle_time" fullword ascii
      $s17 = "ServiceStart_AfterInstall" fullword ascii
      $s18 = "serviceInstaller1" fullword ascii
      $s19 = "BAK.ProjectInstaller.resources" fullword ascii
      $s20 = "Dll host" fullword wide

      $op0 = { 96 00 f1 0a 57 02 05 00 34 25 }
      $op1 = { 96 00 83 05 5a 01 0e 00 38 28 }
      $op2 = { 06 00 00 11 28 4d 00 00 0a 02 6f 4e 00 00 0a 28 }

   condition:

      ( uint16(0) == 0x5a4d and 
      filesize < 50KB and 
      pe.imphash() == "f34d5f2d4577ed6d9ceec516c1f5a744" and 
      ( 1 of ($x*) and 
      4 of them ) and 
      all of ($op*)) or 
      ( all of them )
}