5 ms·
As an aside, for those looking to understand YARA rules, [1] provides a brief introduction and [2] introduces how to write them. I needed to look it up myself,
by altendo 10y ago
As an aside, for those looking to understand YARA rules, [1] provides a brief introduction and [2] introduces how to write them. I needed to look it up myself, but seems relatively straightforward if you have a programming background.
tl;dr: YARA rules are a method of categorizing malware based on their characteristics. So the PDF here released a YARA rule to determine a specific piece of malware used in the hack (it's not clear to me what it identifies, other than a PHP script).
For convenience, here's the YARA rule presented in the PDF formatted to be more readable:
rule PAS_TOOL_PHP_WEB_KIT
{
meta:
description = "PAS TOOL PHP WEB KIT FOUND"
strings:
$php = "<?php"
$base64decode = /\='base'\.\(\d+\*\d+\)\.'_de'\.'code'/
$strreplace = "(str_replace("
$md5 = ".substr(md5(strrev("
$gzinflate = "gzinflate"
$cookie = "_COOKIE"
$isset = "isset"
condition:
(filesize > 20KB and filesize < 22KB) and
#cookie == 2 and
#isset == 3 and
all of them
}
[1] https://securityintelligence.com/signature-based-detection-with-yara/ https://securityintelligence.com/signature-based-detection-w...
[2] http://yara.readthedocs.io/en/v3.5.0/writingrules.html http://yara.readthedocs.io/en/v3.5.0/writingrules.html
EDIT: formatting
- codedokode 10y agoThis rule is pretty useless. It requires file to be of a specific size and it requires function names not to be obfuscated. One could simply add a space between 'md5' and 'strrev' to bypass this rule. And they replaced digits in 'base64_decode' with regexp as if there were other similar functions.
- _cereal 10y ago> (it's not clear to me what it identifies, other than a PHP script) It seems obfuscated code. The $base64decode string seems a regular expression to generate the PHP `base64_decode()` function. At some point the script would read a base64 string, which would be an encoded PHP script retrieved from remote or included in the script. The output is then executed through the `eval()` function. Like in this example: http://ideone.com/awhqOg http://ideone.com/awhqOg
- eropple 10y agoThis is a pretty common PHP payload idiom, yup yup. (It also is common with proprietary PHP applications, CMS extensions, etc. that are happy to burn your system performance to "protect their IP". I've been unwinding them since I was twelve.)
- jamoes 10y agoA file with the following text would activate the rule: <?php ='base'.(16*4).'_de'.'code' (str_replace( .substr(md5(strrev( gzinflate _COOKIE _COOKIE isset isset isset (additional text, such that the total filesize is between 20kb and 22kb) Basically, in the filesize must be between 20bk and 22kb, all of the defined strings must be found, and the cookie and isset strings must occur exactly 2 and 3 times respectively.
- wongarsu 10y agoI have found some code that matches that ruleset perfectly (see my other comment: [1]). It was surprisingly easy to find, a github search for .substr(md5(strrev( is all it takes to find this top-secret payload. Note how the base64decode regex doesn't actually match base64_decode, but it matches $l___l_='base'.(32*2).'_de'.'code'; which is the first statement in the github code I found. 1: https://news.ycombinator.com/item?id=13281008 https://news.ycombinator.com/item?id=13281008