THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER

ule DarkSeoul_Obf_Caracachs : Backdoor
{
meta:
author = "Blue Coat Systems, Inc."
info = "Obfuscation method used by the DarkSeoul group"
strings:
$a1={F3EEAEFFFBB821BF9AE3D820FDC0}
condition:
any of them
}
rule DarkSeoul_Keystrings : Backdoor
{
meta:
author = "Blue Coat Systems, Inc."
info = "Encryption keys used by the DarkSeoul group"
strings:
$a1 = "Bb102@jH4$t3hg%6&G1s*2J3gCNwVr*UeI!Dr3hytg^CHGf%ion"
$a2 = "BAISEO%$2fas9vQsfvx%$"
$a3 = "A39405WKELsdfirpsdLDPskDORkbLRTP12330@3$223%!"
condition:
any of them
}
rule Joanap :
{
meta:
}
author = "Blue Coat Systems, Inc."
info = "SMB worm family used by the DarkSeoul group"
strings:
$a1="NTLMSSP"
$a2="MiniDumpWriteDump"
$a3="password