Rubella Macro Kit: Indicators of Compromise (IOCs)
Analysis Provided by Vitali Kremez, Paul Burbage, and Amina Bashir
April 2018
Rubella Macro Payload SHA-256: 001dbf0b6016bfef9c7502bbd995088e15b32acdc6b328dfc88986917485694e 048bf371df0ecf333520a45da0a051145bf7e7b08c43037ed3412634fc25ba4e 0d3d27926b8357a591fc7431c22a16f93c5b42c043f144e26d477f03c62a726b 172207ebc9802e2c54d88d437731de1d5250d87f0f8b2dd27755023e99b03684 19dfc8c4ef9d76ae08511a3eb825bcde5332c616e31afc1ccbb2be0c86ca355a 22deeb5131e7cbe2ae1a8acbcff777acecfc4b308575a856a3efa7574b0bffbd 2662fa08be07f8bdf4a601bcacecd94dda0dd58ebb8778ad67f09060c8680cc5 37843c36dc5b4cbb1bd6f0ff26e0c1b0331222b57b5b246eb64e6fed8a963c37 3d34bbfc607e27fc050333b9918ec41524c985ce37994e2d2402588003ff23e9 3db2157c8df42ba7a67721d739bc35af6b39680ccc4c37ab235d938053bbc1ea 42595c9314f45b688b2f659cf4d303d82bf38bba8b7ddb5d64bc5b67529620b6 47e6dcea610c2da55f5c2fe7d9359352b14651a9db2273a5989b42af9cd6cb8a 4b26d86f1d071665a41935c7bf6cf1b23a2a46318e8036d5660baa1a052c9310 4db009870840f894a0f2fa3e65d632c607c4281159d2d4712e88f8b29758b98e 5e4b74a279fcf9d13a450390491d1b7b3b91732dc847eee3629f970a05c985f5 62f5258b885d6207bc8635147ae81437278a550e1a06838389e1978e4c99106d 71ce7315d302a7d3ec6fac6534f262de213be59a19f84182c94b182cbe277f14 8003d950167438cec910c5850db60da8229113d249d24a626a9a82901322ec22 8938f65a4e027500fa15ab3d89eb22f395e2fc39d1664f5483c5870a4ebe1ae2 8c83d431c8a5fa1d1c29651fcc20fcc10671e16376896725595177a8840e4079 90137c0ae218681d43e1fc150e2a6de6a5001ae3788fc38d7b7f6c05a7e7b591 9264de713fe47d9f08998d056b7f0c4abdce4d0314e516105508921ab2d29199 96daec47247509e61578c90927efe00bdf0b55e2b8d94429cbf529b4c0618c55 9c4d374be9bf39bbfe0a71ca8f58986986da616170b3c9951808e13acffbca18 9dc62b34a5c6e838866162241fca0feecaaae2279754a467c735a69ffd1ec5e1 aaf8c619cf7ce84483a4fc388f9b99dff0eae747a78781cd16c8c5c7ec29895f bccaf29ca221eca3768a0bbb3541c554844bca51498c27bedd145097c34f793e
cc7db4408c4a91cd6ec8cbfad76d7ab1f2b4b6b30a519c026ec38e23405bd594 ef92e425aaa72604f34d5c444baf5688b5ee6e09a681be0627b2a60262d99020 efd037368402cb85c1db5289f7606302ce23242ac54613d6e16765734055d16b f43c812880be3582ef239bc294a8dcd7807558707afd820873bfdd3b17d89ed
Panda Banker Download URL:
hxxp://www[.]senescence[.]info/download/Loader[.]exe
Panda Banker SHA-256:
0c3dc58144b854493098c226abb4355dfb52d780c6422266c1c14ebbebc41836
Panda Banker Config Domain:
hxxps://I9I6m1w6[.]top
Gootkit Banker Download URL:
hxxp://5.9.178[.]94/dIutBvNbct.exe
Gootkit Banker SHA-256:
6e721500dfe50e4521ca8608bcf48a9af84c019ec3d741faae0499261553fb22
Gootkit Banker Domain:
safenetssl[.]com
securesslweb[.]com
Additional 2nd Stage Payload URLs:
hxxp://185.120.144[.]154/plus.exe
hxxp://185.82.202[.]149/license.exe
hxxp://5.9.178[.]94/documents.php
hxxp://doda[.]ch/xss/01101.exe
hxxp://www.rogeland[.]se/loges/kjflth.exe
hxxps://cargofast[.]net/sf/fb.exe
Yara Signature:
rule crime_maldoc_rubella_builder
{
meta:
description = "“Detects Rubella builder maldocs”
author = “Flashpoint”
date = "2018-04-20”
strings:
$magic = { D0 CF 11 E0 A1 B1 1A E1 }
$s1 = “AutoOpen” ascii fullword
$s2 = “Macros” wide fullword
$s3 = “1UserForm1” wide fullword
$s4 = “_VBA_PROJECT” wide fullword
$s5 = “BaseClass=UserForm1” ascii fullword
$s6 = “Optional:” ascii fullword
$s7 = “(1Normal.ThisDocument” wide fullword
$s8 = “CompObj” wide fullword
condition:
$magic at 0 and all of ($s*)
}
https://www.flashpoint-intel.com/wp-content/uploads/2018/04/Rubella-Macro-Builder-IoCs.pdf