Stack String Lab

For this lab there are two samples of malware each containing unique obfuscated strings, some of which may be stack strings. Examine each of the pieces of malware, and see if you can create at least three rules for each sample.


The first rule should look for specific regular strings.
The second should look for specific stack strings.
The third rule should be a TTP or “hunting” type of rule relating to the generic detection of stack . strings

Zip of samples (password is infected): lab-stackstring.zip
https://drive.google.com/file/d/1pFuUZQXZMe7Sj7zSbzUsQNSU0Z_AK2QX/view?usp=share_link

50c86f1de6caeefce7c1d7e2ef39aa79 (Higaisa)
5708e0320879de6f9ac928046b1e4f4e (Keyboy)

Generally a good flow is to begin looking at regular strings with strings.exe, then with tools like FLOSS, then with 010 editor to identify hex structures that may be more interesting candidates for stack strings.


If you run into road blocks and need some some tips, click on the hints below!


After you’re done, submit your rules, and check up on the solutions video to see a walkthrough of some approaches.


Higaisa - Hints
Keyboy - Hints
Lab Solutions & Walkthrough


Full Solution Rules

rule MAL_HIGAISA_Str {
	meta:
		author = "smiller"
		md5_hash = "50c86f1de6caeefce7c1d7e2ef39aa79"
	strings:
		$a1 = "pys.jpg"
		$a2 = "happy.txt"
		$b1 = "WOW64; _OLE2BIND Trident/4.0; 18A0918C SV1)"
		$b2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1;"
		$c1 = "&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz"
		$c2 = "%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz"
	condition:
		uint16be(0) == 0x4d5a
		and 1 of ($a*) and 2 of ($b*) and 1 of ($c*)
}
rule MAL_HIGAISA_Stack_Str_ABCDE012345678 {
	meta:
		author = "smiller"
	strings:
		//1725h: C6 44 24 41 65 C6 44 24 42 74 C6 44 24 43 65 C6 ÆD$AeÆD$BtÆD$CeÆ 
		//1735h: 44 24 44 72 C6 44 24 45 73 88 5C 24 46 C6 44 24 D$DrÆD$Esˆ\$FÆD$ 
		//1745h: 30 53 C6 44 24 31 45 C6 44 24 32 52 C6 44 24 33 0SÆD$1EÆD$2RÆD$3 
		//1755h: 56 C6 44 24 34 49 C6 44 24 35 43 C6 44 24 36 65 VÆD$4IÆD$5CÆD$6e 
		//1765h: C6 44 24 37 ÆD$7
		$a = {c6 44 ?? 41 ?? c6 44 ?? 42 ?? c6 44 ?? 43 ?? c6 44 ?? 44 ?? c6 44 ?? 45 ??}
		$b = {c6 44 ?? 31 ?? c6 44 ?? 32 ?? c6 44 ?? 33 ?? c6 44 ?? 34 ?? c6 44 ?? 35 ??}
	condition:
		uint16be(0) == 0x4d5a
		and all of them
}
rule TTP_Stack_Str_FiveBytePattern {
	meta:
		author = "smiller"
	strings:
		//1725h: C6 44 24 41 65 C6 44 24 42 74 C6 44 24 43 65 C6 ÆD$AeÆD$BtÆD$CeÆ 
		$a = {c6 44 [3] c6 44 [3] c6 44 [3] c6 44 }
		//1C62h: C6 84 24 27 01 00 00 4D C6 84 24 28 01 00 00 6F Æ„$'...MÆ„$(...o 
		$b = {c6 84 [3] c6 84 [3] c6 84 [3] c6 84 }
	condition:
		uint16be(0) == 0x4d5a
		and #a + #b > 10
}
rule MAL_KEYBOY_Str {
	meta:
		author = "smiller"
		ref = "5708e0320879de6f9ac928046b1e4f4e"
	strings:
		$a = "Internet using \\svchost.exe -k -n 3"
		$b = "start stop service:%s"
		$c = "sc create %s binpath= \"%s\" Type= share Start= auto DisplayName= \"%s\""
		$d = "reg add HKLM\\%s\\Parameters /v ServiceDll /t REG_EXPAND_SZ /d \"%s\" /f"
		$e = "Current user is a member of the %s\\%s group"
		$f = "ChangeFileTime %s->%s"
	condition:
		uint16be(0) == 0x4d5a
		and 5 of them
}
rule MAL_KEYBOY_Stack_Str {
	meta:
		author = "smiller"
		ref = "5708e0320879de6f9ac928046b1e4f4e"
	strings:
		//0990h: 53 FF 15 7C 56 02 10 C7 45 EC 50 72 6F 67 8B CB Sÿ.|V..ÇEìProg‹Ë 
		//09A0h: C7 45 F0 72 61 6D 44 C7 45 F4 61 74 61 00 8A 44 ÇEðramDÇEôata.ŠD 
		$s = {c7 45 ?? 50 72 6F 67 ?? ?? c7 45 ?? 72 61 6D 44 c7 45 ?? 61 74 61 00}
	condition:
		any of them
}
rule TTP_Stack_Str_NineBytePattern {
	meta:
		author = "smiller"
		desc = "Stack string pattern, for four byte chunks."
	strings:
		$s = {c7(44|45)?? ?? ?? ?? ?? c7(44|45)}
	condition:
		uint16be(0) == 0x4d5a
		and #s > 20
}



