著名アプリを装った脅威 RomCom でウクライナ軍を狙う。正体不明の脅威アクターの攻撃手口徹底究明

ハッシュ（SHA-256）

3e3a7116eeadf99963077dc87680952cca87ff4fe60a552041a2def6b45cbeea

983833334d168cd4274467f48171489e019b86b51e687738565a93dd3f58d0aa

05681ff7cae6b28f5714628a269caa5115da49c94737ce82ec09b4312e40fd26

59f0c3b7890f11217ad37764f225cd1c9d27747495d80dadde40b78edfbfa21e

e80d80521238008bf6f429e072eaf6030c06e2d3123d03ea9b36f5a232a1ec90

61e349518ca3f10d1e7aae0be95bc43dc23843c8acf177831cdfd48f26a07c72

a2511c5c2839bfbdf9c0f84f415d5eae168456e5d3f77f1becdbcd69fba4daa4

56a6fb2e2b6a801351175f2aa30a63d44e9ba69f177f6fe20dad348b4d6fb0d1

9f61259c966f34d89b70af92b430ae40dd5f1314ee6640d16e0b7b0f4f385738

c116a0aafdc2765e38b4f5efdf89960997abf0db81daa8f5380ce3c893e9af96

4fc9202ff84ef84b8c5e6140b66ac3d04570daf886a7f1ae31661ade882f963e

494b43198db467f506e9857f39ebe8f8bf6d871776eba092a7e2f2140046e16d

068117b406940ac510ed59efd1d7c7651f645a31bd70db6de16aba12c055aae6

80d78703de91d292c031275b4493966e363f5fa065edd79e0fd63aa2573b44a4

C2

CombinedResidency[.]org

optasko[.]com

4qzm[.]com

notfiled[.]com

import "pe"
import "math"

rule targeted_RomComRat : RomCom deployed via trojanized legitimate apps
{
    meta:
        description = "Rule detecting RomCom RAT used to attack Military Institutions from Ukraine"
        author = " The BlackBerry Research & Intelligence team"
        date = "2022-18-10"
        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to the BlackBerry Research & Intelligence Team"
        hash = "9f61259c966f34d89b70af92b430ae40dd5f1314ee6640d16e0b7b0f4f385738"

      strings:
        //comDll.dll
        $x0 = {636f6d446c6c2e646c6c}
        //combase32.dll
        $x1 = {63006f006d006200610073006500330032002e0064006c006c00}         

    condition:
    uint16(0) == 0x5a4d and
    pe.number_of_sections == 7 and
    pe.sections[0].name == ".text" and
    math.entropy(pe.sections[0].raw_data_offset, pe.sections[0].raw_data_size) >= 6.5 and
    pe.sections[1].name == ".rdata" and
    math.entropy(pe.sections[1].raw_data_offset, pe.sections[1].raw_data_size) >= 5.2 and
    pe.sections[2].name == ".data" and
    pe.sections[3].name == ".pdata" and
    math.entropy(pe.sections[3].raw_data_offset, pe.sections[3].raw_data_size) >= 5.5 and
    pe.sections[4].name == "_RDATA" and
    math.entropy(pe.sections[4].raw_data_offset, pe.sections[4].raw_data_size) >= 2.4 and
    pe.sections[5].name == ".rsrc" and
    math.entropy(pe.sections[5].raw_data_offset, pe.sections[5].raw_data_size) >= 2.85 and
    pe.sections[6].name == ".reloc" and
    math.entropy(pe.sections[6].raw_data_offset, pe.sections[6].raw_data_size) >= 5.3 and
    pe.number_of_resources == 2 and
    pe.exports("startFile") and
    pe.exports("startInet") and
    all of ($x*)
}