Lab Instructions

For this exercise, examine the provided sample of this malware, which is reportedly used by the threat actor Mustang Panda, and used to download and execute the PlugX backdoor. Extract the strings, look at the PE features, and compose and test several rules for it.


For references on how the malware was found or used, check out this blog by the Cisco Talos team: https://blog.talosintelligence.com/mustang-panda-targets-europe/


Compose one rule that is specific or precise, with a lot of high-quality strings that catch this exact sample.
Compose another rule that is “broader” or “looser” or less specific, that will catch this and other samples of the same malware.
Experiment with a third rule that makes use of the PE module to look for unique or interesting features.

Sample Sha256: 1b520e4dea36830a94a0c4ff92568ff8a9f2fbe70a7cedc79e01cea5ba0145b0
Zip of sample: mal-mustangpanda-1b520e.zop
Zip password: infected


Lab Solutions & Walkthrough


Full Rule Solutions

import "pe"
rule MustangPanda_Downloader_Broad_Strings {
	meta:
		desc = "Strings from Mustang Panda downloader, which may lead to PlugX malware"
		hash = "1b520e4dea36830a94a0c4ff92568ff8a9f2fbe70a7cedc79e01cea5ba0145b0"
		author = "smiller"
	strings:
		$a1 = "/c ping 8.8.8.8 -n" wide
		$a2 = "cmd.exe" wide
		$a3 = "https" wide
		$a4 = "200 ok" wide
		$a5 = "200 OK" wide
	condition:
		4 of them
}
rule MustangPanda_Downloader_Strings {
	meta:
		desc = "Strings from Mustang Panda downloader, which may lead to PlugX malware"
		hash = "1b520e4dea36830a94a0c4ff92568ff8a9f2fbe70a7cedc79e01cea5ba0145b0"
		author = "smiller"
	strings:
		$a = "45.154.14.235" wide
		$b1 = "PotPlayer.exe" wide
		$b2 = "PotPlayer.dll" wide
		$b3 = "PotPlayerDB.dat" wide
		$c = "/c ping 8.8.8.8 -n" wide
		$d = "200 ok" wide
	condition:
		uint16be(0) == 0x4d5a // MZ header
		and 2 of ($b*)
		and ($a or $c or $d)
}
rule TTP_PE_Unsigned_Resources_GT20 {
	meta:
		desc = "PE features from Mustang Panda downloader, which may lead to PlugX malware"
		hash = "1b520e4dea36830a94a0c4ff92568ff8a9f2fbe70a7cedc79e01cea5ba0145b0"
		author = "smiller"
	condition:
		pe.number_of_signatures == 0 and
		pe.number_of_resources > 20
}


Complete Step
