ウクライナの政府機関、非営利団体、IT 組織の機能停止を目的とするワイパー型マルウェア WhisperGate

.HTML .HTM .PHTML .PHP .JSP .ASP .PHPS .PHP5 .ASPX .PHP4 .PHP3 .DOC .DOCX .XLS .XLSX .PPT .PPTX .PST .MSG .EML .TXT .CSV .RTF .WKS .WK1 .PDF .DWG .JPEG .JPG .DOCM .DOT .DOTM .XLSM .XLSB .XLW .XLT .XLM .XLC .XLTX .XLTM .PPTM .POT .PPS .PPSM .PPSX .HWP .SXI .STI .SLDX .SLDM .BMP .PNG .GIF .RAW .TIF .TIFF .PSD .SVG .CLASS .JAR .SCH .VBS .BAT .CMD .ASM .PAS .CPP .SXM .STD .SXD .ODP .WB2 .SLK .DIF .STC .SXC .ODS .3DM .MAX .3DS .STW .SXW .ODT .PEM .P12 .CSR .CRT .KEY .PFX .DER .OGG .JAVA .INC .INI .PPK .LOG .VDI .VMDK .VHD .MDF .MYI .MYD .FRM .SAV .ODB .DBF .MDB .ACCDB .SQL .SQLITEDB .SQLITE3 .LDF .ARC .BAK .TAR .TGZ .RAR .ZIP .BACKUP .ISO .CONFIG

rule Stage_1

{
   meta:
      description = "Detects Stage 1 WhisperGate"
      author = "BlackBerry Threat Research"
      date = "2022-01-17"
      license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

      strings:
         // Regex for ransom note in MBR
         $re1 = /You should pay us \$[0-9]{1,3}k via bitcoin wallet/   

         // MBR signature
         $b1 = {55 AA}
         // Int 13 Bios interrupt
         $b2 = {CD 13}
         // Extended write interrupt code
         $b3 = {B4 43}

         // Strings in MBR replacement data
         $s1 = "Your hard drive has been corrupted."
         $s2 = "tox ID"
         $s3 = "We will contact you to give further instructions."

         // String used in CreateFileW call to open main physical drive
         $s4 = "\\\\.\\PhysicalDrive0" wide

         // The hardcoded data it uses to overwrite the MBR

      condition:
         // MZ header
         uint16(0) == 0x5a4d and

         ((all of ($b*) and 2 of ($s*)) or (all of ($s*) and $re1))
   }

import "pe"

rule Stage2
{
   meta:
      description = "Detects WhisperGate Stage 2"
      author = "BlackBerry Threat Research"
      date = "2022-01-17"
      license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

   strings:
      // Regex for any attachment link coming from the same discord channel
      $re1 = /https:\/\/cdn\.discordapp\.com\/attachments\/928503440139771947\/[0-9]{18}\/[^<>:"\/\|?*]*\b/ wide

      // 3 strings combined to make powershell command that evaluates to "Start-Sleep -s 10"
      $s1 = "powershell" wide
      $s2 = "-enc UwB0AGEAcgB0AC" wide
      $s3 = "0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==" wide

      // The method name being looked for in stage 3
      $s4 = "Ylfwdwgmpilzyaph" wide

      // Used with .Replace("x", "") for reflection on WebClient to get DownloadData method
      $s5 = "DxownxloxadDxatxxax" wide

   condition:
      // MZ header
      uint16(0) == 0x5a4d and
      // is a .NET binary
      pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].size != 0 and

      $re1 and 2 of ($s*)
}

rule Stage3
{
   meta:
      description = "Detects WhisperGate Stage 3"
      author = "BlackBerry Threat Research"
      date = "2022-01-17"
      license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

   strings:
      // The same as a string from stage2, not sure what it is
      $s1 = "Ylfwdwgmpilzyaph"
      // Names of resources
      $s3 = "78c855a088924e92a7f60d661c3d1845"
      $s4 = "7c8cb5598e724d34384cce7402b11f0e"

   condition:
      // MZ header
      uint16(0) == 0x5a4d and
      // is a .NET binary
      pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].size != 0 and

      all of them
}

import "pe"

rule Stage3_reversed
{
   meta:
      description = "Detects WhisperGate Stage 3 Reversed"
      author = "BlackBerry Threat Research"
      date = "2022-01-17"
      license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

   strings:
      // This string was also in stage2 so defo want to look into it
      // but this is the reversed version because Stage3 is backwards
      $s1 = "hpayzlipmgwdwflY"
      // Names of resources backwards
      $s3 = "5481d3c166d06f7a29e429880a558c87"
      $s4 = "e0f11b2047ecc48343d427e8955bc8c7"

   condition:
      // MZ header backwards at the end of the file
      uint16(filesize-2) == 0x4d5a and

      all of them
}

ファイル

a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92 (Stage 1)
dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78 (Stage 2)
923eb77b3c9e11d6c56052318c119c1a22d11ab71675e6b95d05eeb73d1accd6 (Stage 3)
9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d (Stage 3 Reversed)
34ca75a8c190f20b8a7596afeb255f2228cb2467bd210b2637965b61ac7ea907 (File Wiper)
35feefe6bd2b982cb1a5d4c1d094e8665c51752d0a6f7e3cae546d770c280f3a (Decoded Resource)

Bitcoin ウォレットのアドレス

1AVNM68gj6PGPFcJuftKATa4WLnzg8fpfv

ToxID

8BEDC411012A33BA34F49130D0F186993C6A32DAD8976F6A5D82C1ED23054C057ECED5496F65

Discord リンク

https[:]//cdn.discordapp[.]com/attachments/928503440139771947/930108637681184768/Tbopbh.jpg

IP アドレス

162[.]159[.]135[.]233