chrome.exe --load-extension="C:\Users\user\AppData\Local\Temp\HHe2lr" brave.exe --load-

extension="C:\Users\user\AppData\Local\Temp\HHe2lr" msedge.exe --load-

extension="C:\Users\user\AppData\Local\Temp\HHe2lr" opera.exe --load-

extension="C:\Users\user\AppData\Local\Temp\HHe2lr" vivaldi.exe --load-

extension="C:\Users\user\AppData\Local\Temp\HHe2lr"

hxxp://extenision-app[.]com/api/settings

hxxp://extenision-app[.]com/api/machine/

hxxp://extenision-app[.]com/api/machine/init

hxxp://extenision-app[.]com/api/machine/get-urls

• 생성 및 업데이트된 날짜/시간
• 최소 금액을 정의하는 여러 통화 금액(80 EUR, 80 USD 등)
• 텔레그램 채팅 ID 및 토큰

피해자에 대한 세부 정보 목록 반환

• 피해자 IP 주소
• 피해자 국가
• 변형 참조(Google, TradingView 등)
• 추가되었을 때
• C2 서버와 통신하는 것이 마지막으로 관찰되었을 때

hxxps://nch-software[.]info/1/2.exe

hxxps://nch-software[.]info/1/install-win64-11.5.8_en-US.exe

hxxps://panger-top[.]click/1/2.exe

hxxps://panger-top[.]click/1/install-win64-11.5.8_en-US.exe

rule M_Hunting_Embedded_Chromium_CRX_1

{

   meta:

         author = "Mandiant"

         md5 = "f1c21a69ed9f85e12d58ef0f5ac5c9b1"

         description = "Hunting for non-CRX files with extension equities"

   strings:

         $a1 = "_metadata" ascii

         $a2 = "manifest.json" ascii

         $a3 = "verified_contents.json" ascii

         $s1 = "_locales" ascii

         $s2 = "messages.json" ascii

         $f = /[a-z0-9A-Z_-]+\.(html|htm|css|js)/ ascii

         $pk = {50 4B 03 04}

   condition:

         (((uint16(0) == 0x5A4D) and uint32(uint32(0x3C)) == 0x00004550) or (uint32(0) == 0x464c457f) or (uint32(0) == 0xfeedface or uint32(0) == 0xcefaedfe or uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe or uint32(0) == 0xcafebabe or uint32(0) == 0xbebafeca or uint32(0) == 0xcafebabf or uint32(0) == 0xbfbafeca)) and

         (((2 of ($a*)) and $f) or ((1 of ($a*)) and ($f or (1 of ($s*))))) and

         $pk and

         (#pk >1) and

         (for any i in (1..#pk) : ($a2 at @pk[i]+30)) and

         (for any j in (1..#pk) : ($f at @pk[j]+30))

}

rule M_Hunting_Embedded_Chromium_CRXandLNK_1

{

   meta:

         author = "jared.wilson"

         md5 = "f1c21a69ed9f85e12d58ef0f5ac5c9b1"

         description = "Hunting for non-CRX files with extension equities and common strings for Google Chrome LNKs"

   strings:

         $a1 = "_metadata" ascii

         $a2 = "manifest.json" ascii

         $a3 = "verified_contents.json" ascii

         $s1 = "_locales" ascii

         $s2 = "messages.json" ascii

         $f = /[a-z0-9A-Z_-]+\.(html|htm|css|js)/ ascii

         $pk = {50 4B 03 04}

         $load = "--load-extension" ascii wide

         $lnk1 = "Google Chrome.lnk" ascii wide

   condition:

         (((uint16(0) == 0x5A4D) and uint32(uint32(0x3C)) == 0x00004550) or (uint32(0) == 0x464c457f) or (uint32(0) == 0xfeedface or uint32(0) == 0xcefaedfe or uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe or uint32(0) == 0xcafebabe or uint32(0) == 0xbebafeca or uint32(0) == 0xcafebabf or uint32(0) == 0xbfbafeca)) and

         (((2 of ($a*)) and $f) or ((1 of ($a*)) and ($f or (1 of ($s*))))) and

         $pk and

         (#pk >1) and

         (for any i in (1..#pk) : ($a2 at @pk[i]+30)) and

         (for any j in (1..#pk) : ($f at @pk[j]+30)) and

         ($load or $lnk1)

}

rule M_Hunting_AdvancedInstaller_LNK_1

{

   meta:

         author = "Mandiant"

         md5 = "2782af385665c765807ed887d4bacf36"

         description = "Hunting for Advanced Installer files that drop LNKs to known locations."

   strings:

         $a1 = "Advanced Installer" wide

         $a2 = "Advanced Installer" ascii

         $a3 = "https://www.advancedinstaller.com" ascii

         $l1 = "Google Chrome.lnk"

         $l2 = "Brave.lnk"

         $p1 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk"

         $p2 = "\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Brave.lnk"

         $p3 = "\\Microsoft\\Internet Explorer\\Quick Launch\\Brave.lnk"

         $p4 = "\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk"

         $p5 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Brave.lnk"

         $p6 = "\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk"

         $r = /\$[^\.]+\.CreateShortcut\([^\)]+\)/

   condition:

         ((uint16(0) == 0x5A4D) and uint32(uint32(0x3C)) == 0x00004550) and (all of ($a*)) and (1 of ($l*)) and (2 of ($p*)) and $r

}

rule M_Hunting_LNKEngine_LoadExtension_1

{

   meta:

         author = "Mandiant"

         description = "Hunting rule that looks for files containing strings pertaining to execution of Edge, Opera, Brave, Chrome to launch an extension."

         md5 = "30abf9ca1bb792eb5edd8b033c010979"

   strings:

         $r1 = /(chrome|msedge|opera|brave)[^\r\n]+--load-extension=/ ascii nocase wide

         $s1 = "chrome" ascii wide

         $s2 = "--load-extension=" ascii wide

   condition:

         (uint32(0) == 0x0000004c) and filesize < 50KB and all of ($s*) and $r1

}

rule M_Hunting_LNKEngine_LoadExtension_Temp_1

{

    meta:

        author = "Mandiant"

        description = "Hunting rule that looks for files containing strings pertaining to execution of Edge, Opera, Brave, Chrome to launch an extension."

        md5 = "30abf9ca1bb792eb5edd8b033c010979"

    strings:

        $r1 = /(chrome|msedge|opera|brave)[^\r\n]+--load-extension="?[A-Za-z]:\\Users\\[^\\]+\\AppData\\/ ascii nocase wide

        $s2 = "--load-extension=" ascii wide

    condition:

        (uint32(0) == 0x0000004c) and filesize < 50KB and all of them

}

rule M_Hunting_ArchiveEngine_CAB_Extension_1

{

   meta:

         author = "Mandiant"

         description = "Looking for CAB containing what is suspected to be the files that make up an extension"

         md5 = "de283dfb9c88dbb6d455ca4b31c57240"

   strings:

         $f1 = "manifest.json" nocase

         $f2 = ".js" nocase

         $f3 = ".htm" nocase

         $f4 = ".png" nocase

   condition:

         filesize < 1MB and uint32be(0) == 0x4D534346 and ($f1 in (uint32(16) .. uint32(16) + 256)) and ($f2 in (uint32(16) .. uint32(16) + 256)) and ($f3 in (uint32(16) .. uint32(16) + 256)) and ($f4 in (uint32(16) .. uint32(16) + 256))

}

rule M_Hunting_FileWrite_Manifest_Temp_1

{

   meta:

         author = "Mandiant"

         md5 = "f1c21a69ed9f85e12d58ef0f5ac5c9b1"

         description = "Hunting for cases where a process writes a Chrome CRX manifest file to the appdata temp directory."

         severity = "Medium"

   events:

         $e.metadata.event_type = "FILE_CREATION"

         ($e.target.file.names = "manifest.json" OR $e.target.file.full_path = /manifest\.json$/)

$e.target.file.full_path = /[a-zA-Z]{1}:\\Users\\[^\\]+\\AppData\\(Local\\Temp\\|Roaming\\)[^\\]+\\manifest.json/ nocase

   condition:

         $e

}

rule M_Hunting_Process_Chromium_LoadExtension_1

{

   meta:

         author = "Mandiant"

         md5 = "f1c21a69ed9f85e12d58ef0f5ac5c9b1"

         description = "Hunting for cases where Chrome process is startng with the --load-extension parameter with the value in the appdata temp directory."

         severity = "Medium"

events:

$e.metadata.event_type = "PROCESS_OPEN"

$e.target.process.command_line = /(chrome|brave|msedge|opera|vivaldi)\.exe"?\s+\-\-load\-extension="?[A-Za-z]{1}:\\Users\\[^\\]+\\AppData\\(Local\\Temp\\|Roaming\\)[^ ]+/ nocase

$e.target.process.file.full_path = /(chrome|brave|msedge|opera|vivaldi)\.exe$/ nocase

    condition:

$e

}

rule M_Hunting_FileWrite_Chrome_LNK_1

{

   meta:

         author = "Mandiant"

         md5 = "f1c21a69ed9f85e12d58ef0f5ac5c9b1"

         description = "Hunting for cases where the LNK is written to known used locations from a process that is in user directory space."

         severity = "Medium"

   events:

         $e.metadata.event_type = "FILE_CREATION"

         $e.target.file.full_path = /Google Chrome\.lnk$/

         ($e.target.file.full_path = `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk` or $e.target.file.full_path = `C:\Users\Public\Desktop\Google Chrome.lnk` or $e.target.file.full_path = /C:\\Users\\[^\\]+\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk/ or $e.target.file.full_path = /C:\\Users\\[^\\]+\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk/)

         ($e.principal.process.file.full_path = /[a-zA-Z]{1}:\\Users\\[^\\]+/ or $e.src.process.file.full_path = /[a-zA-Z]{1}:\\Users\\[^\\]+/)

   condition:

         $e

}