Lab Instructions

For this exercise, examine the provided sample of the Uroburos malware, examine the PE export features, and compose and test rules for it. Try to create more than one rule that detects the malware based on its PE features, but make these rules across a spectrum of precision or fidelity, from most specific to least specific.


Compose one rule that is specific or precise, with a lot of high-quality, unique PE export features that will catch this exact sample.
Compose another rule that is “broader” or “looser” or less specific, that will catch this and other samples of the same malware.
Try to identify anything unusual or atypical about how this malware implements its exports and try to invent a third rule that detects a PE export “anomaly”.

Sha256 of sample: d597e4a61d94180044dfb616701e5e539f27eeecfae827fb024c114e30c54914


Zip of sample: mal-uroburos-d597e4.zip
https://drive.google.com/file/d/1mFwDkI5XrANk9eDhVkoV8PUvew63mYRZ/view?usp=share_link

Zip password: infected


Attempt this lab on your own first, and then review my walkthrough video below to see how I approached it.


Lab Solutions & Walkthrough


Full Rule Solutions

import "pe"
import "hash"
import "console"
rule turla_uroboros_exports_hifi {
	condition:
		pe.export_timestamp == 1359984004
		and pe.number_of_exports > 30
		and pe.dll_name icontains "inj_snake_Win32.dll"
}
rule turla_uroboros_exports_hifi_alt {
	meta:
		md5 = "a762d2c56999eda5316d0f94aba940cb"
		sha256 = "d597e4a61d94180044dfb616701e5e539f27eeecfae827fb024c114e30c54914"
	condition:
		pe.number_of_exports != 0
		and
		for 2 thing in pe.export_details:
			(
			thing.name startswith "snake_"
			)
		and
		for 40 thing in pe.export_details:
			(
			thing.name matches /^[a-z]{2}_/
			)
}
rule TTP_Export_Number_Unsigned_High_Exports_Timestamp_Oddity {
	meta:
		desc = "Anomaly rule looking for PEs with a large number of exported functions"
	condition:
		pe.number_of_signatures == 0
		and
		pe.number_of_exports > 60
		and
		pe.timestamp < pe.export_timestamp
		and
		filesize < 1MB
}

