100DaysofYARA_2023_Blog3_TigerRAT.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# TigerRAT and TigerLoader Time! \n",
    "\n",
    "A number of entities have observed the use of TigerRAT and its loader since at least 2020. Some great reporting has come out of: \n",
    " - [ThreatRay](https://threatray.com/blog/establishing-the-tigerrat-and-tigerdownloader-malware-families/)\n",
    " - [Kaspersky](https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/)\n",
    " - [MalwareBytes](https://blog.malwarebytes.com/threat-intelligence/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat/)\n",
    " - [KrCERT](https://www.krcert.or.kr/filedownload.do?attach_file_seq=3277&attach_file_id=EpF3277.pdf)\n",
    " \n",
    "\n",
    "What most interested me from a YARA perspective was the payload storage in the loader. Storing the payload in different portions of the PE was neat to observe, and provided a lot of samples for us to tinker with\n",
    "\n",
    "![](https://threatray.com/wp-content/uploads/2021/12/figure6-1-1030x436.png)\n",
    "\n",
    "Effectively the embedded payload is stored unto itself in either the last section, a resource, or the overlay. They follow the same structure (sorry you're not getting C Structs cause I don't know em well enough to not butcher them!): \n",
    " - Length of the payload\n",
    " - 16 byte XOR key\n",
    " - null byte\n",
    " - base64-encoded payload\n",
    "![](https://threatray.com/wp-content/uploads/2021/12/figure7-1-1030x400.png)\n",
    "\n",
    "As usual Seongsu Park has some great images to highlight this (note there is a similar structure used by the second stage and third stages to load the next payload)\n",
    "\n",
    "![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/06/15095212/Andariel_delivered_ransomware_03.png)\n",
    "\n",
    "Lets take a gander at one of these samples! "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\r\n",
      "    \"Header\": {\r\n",
      "        \"Machine\": \"AMD64\",\r\n",
      "        \"Subsystem\": \"Windows GUI\",\r\n",
      "        \"MinimumOS\": \"Windows Vista\",\r\n",
      "        \"RICH\": [\r\n",
      "            {\r\n",
      "                \"Counter\": 127,\r\n",
      "                \"Encoded\": \"00e05146\",\r\n",
      "                \"Library\": \"UTC1800_C\",\r\n",
      "                \"Product\": \"Visual Studio 2013 12.0\"\r\n",
      "            },\r\n",
      "            {\r\n",
      "                \"Counter\": 12,\r\n",
      "                \"Encoded\": \"00df5146\",\r\n",
      "                \"Library\": \"MASM1200\",\r\n",
      "                \"Product\": \"Visual Studio 2013 12.0\"\r\n",
      "            },\r\n",
      "            {\r\n",
      "                \"Counter\": 47,\r\n",
      "                \"Encoded\": \"00e15146\",\r\n",
      "                \"Library\": \"UTC1800_CPP\",\r\n",
      "                \"Product\": \"Visual Studio 2013 12.0\"\r\n",
      "            },\r\n",
      "            {\r\n",
      "                \"Counter\": 9,\r\n",
      "                \"Encoded\": \"00cbffdd\",\r\n",
      "                \"Library\": \"IMPLIB1100\",\r\n",
      "                \"Product\": \"Visual Studio 2012 11.0\"\r\n",
      "            },\r\n",
      "            {\r\n",
      "                \"Counter\": 162,\r\n",
      "                \"Encoded\": \"00010000\",\r\n",
      "                \"Library\": \"IMPORT\",\r\n",
      "                \"Product\": \"Visual Studio\"\r\n",
      "            },\r\n",
      "            {\r\n",
      "                \"Counter\": 11,\r\n",
      "                \"Encoded\": \"00e5520d\",\r\n",
      "                \"Library\": \"UTC1800_LTCG_CPP\",\r\n",
      "                \"Product\": \"Visual Studio 2013 12.0 RTM\"\r\n",
      "            },\r\n",
      "            {\r\n",
      "                \"Counter\": 1,\r\n",
      "                \"Encoded\": \"00df520d\",\r\n",
      "                \"Library\": \"MASM1200\",\r\n",
      "                \"Product\": \"Visual Studio 2013 12.0 RTM\"\r\n",
      "            },\r\n",
      "            {\r\n",
      "                \"Counter\": 1,\r\n",
      "                \"Encoded\": \"00de520d\",\r\n",
      "                \"Library\": \"LINKER1200\",\r\n",
      "                \"Product\": \"Visual Studio 2013 12.0 RTM\"\r\n",
      "            }\r\n",
      "        ],\r\n",
      "        \"Type\": \"EXE\",\r\n",
      "        \"Bits\": 64,\r\n",
      "        \"ImageBase\": \"0x0000000140000000\",\r\n",
      "        \"ImageSize\": 467968\r\n",
      "    },\r\n",
      "    \"Version\": {\r\n",
      "        \"FileVersion\": \"0.78.0.2\",\r\n",
      "        \"ProductVersion\": \"1.78.0.2\",\r\n",
      "        \"OriginalFilename\": \"firefox.exe\",\r\n",
      "        \"InternalName\": \"Firefox\",\r\n",
      "        \"FileDescription\": \"Firefox\",\r\n",
      "        \"CompanyName\": \"Mozilla Corporation\",\r\n",
      "        \"LegalCopyright\": \"Microsoft Coperation All right reserved\",\r\n",
      "        \"ProductName\": \"Firefox\",\r\n",
      "        \"LangID\": \"000004B0\",\r\n",
      "        \"Charset\": \"Unicode\",\r\n",
      "        \"Language\": \"Language Neutral\"\r\n",
      "    },\r\n",
      "    \"TimeStamp\": {\r\n",
      "        \"Linker\": \"1997-09-29 22:48:22\"\r\n",
      "    }\r\n",
      "}\r\n"
     ]
    }
   ],
   "source": [
    "!emit /Users/glesnewich/Projects/Malware/TA430/tiger_rat_packed.bin | pemeta"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      ".text\r\n",
      ".rdata\r\n",
      ".data\r\n",
      ".pdata\r\n",
      ".rsrc\r\n",
      ".reloc\r\n",
      "data\r\n"
     ]
    }
   ],
   "source": [
    "!emit /Users/glesnewich/Projects/Malware/TA430/tiger_rat_packed.bin | vsect -l"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "That last section, `data` looks sus - lets crack that section open"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-------------------------------------------------------------------------------\r\n",
      "00.337 MB; 73.58% entropy; data\r\n",
      "  offset = 0x20000\r\n",
      "    path = data\r\n",
      "-------------------------------------------------------------------------------\r\n",
      "00000000: \u001b[91mAC \u001b[0m22 \u001b[91m05 \u001b[90m00 \u001b[0m21 78 6B 24 63 29 46 23 34 40 32 67 38\u001b[0m  \u001b[91m.\u001b[0m\"\u001b[91m.\u001b[90m.\u001b[0m!xk$c)F#4@2g8\u001b[0m\r\n",
      "00000011: 64 4F 63 62 43 4C 37 4A 47 41 70 52 69 4D 77 51 44\u001b[0m  dOcbCL7JGApRiMwQD\u001b[0m\r\n",
      "00000022: 4A 6E 78 35 74 50 49 63 42 72 4A 47 4D 70 52 69 4D\u001b[0m  Jnx5tPIcBrJGMpRiM\u001b[0m\r\n",
      "00000033: 30 41 44 4A 6E 4F 47 52 50 49 58 68 72 4A 47 4D 70\u001b[0m  0ADJnOGRPIXhrJGMp\u001b[0m\r\n",
      "00000044: 52 69 4D 30 51 44 4A 6E 4F 47 52 50 49 58 68 72 4A\u001b[0m  RiM0QDJnOGRPIXhrJ\u001b[0m\r\n",
      "00000055: 47 4D 70 52 69 4D 30 51 44 4A 6E 4F 47 52 50 32 58\u001b[0m  GMpRiM0QDJnOGRP2X\u001b[0m\r\n",
      "00000066: 68 72 4A 47 30 32 2F 43 30 30 39 44 75 71 47 64 78\u001b[0m  hrJG02/C009DuqGdx\u001b[0m\r\n",
      "00000077: 4F 62 62 56 4B 63 41 74 41 4E 51 4E 45 4D 6C 30 41\u001b[0m  ObbVKcAtANQNEMl0A\u001b[0m\r\n",
      "00000088: 53 67 55 69 41 52 73 4B 53 67 31 47 4D 67 4E 57 4A\u001b[0m  SgUiARsKSg1GMgNWJ\u001b[0m\r\n",
      "00000099: 52 49 56 54 51 70 76 53 42 5A 4C 59 43 78 36 5A 6B\u001b[0m  RIVTQpvSBZLYCx6Zk\u001b[0m\r\n",
      "-------------------------------------------------------------------------------\r\n",
      "��\u0019����\u001a��\u0001\r\n"
     ]
    }
   ],
   "source": [
    "!emit /Users/glesnewich/Projects/Malware/TA430/tiger_rat_packed.bin | vsect [ | sorted size | pick 0:1 | peek"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Ah ha! jackpot! Lets decode it to make sure I'm not off the mark here"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-------------------------------------------------------------------------------\r\n",
      "00.252 MB; 97.33% entropy; MS-DOS executable, MZ for MS-DOS\r\n",
      "     key = !xk$c)F#4@2g8dOc\r\n",
      "  offset = 0x20000\r\n",
      "    path = data\r\n",
      "-------------------------------------------------------------------------------\r\n",
      "00000000: 4D 5A \u001b[91m90 \u001b[90m00 \u001b[91m03 \u001b[90m00 00 00 \u001b[91m04 \u001b[90m00 00 00 \u001b[91mFF FF \u001b[90m00 \u001b[0m42 \u001b[91mE1\u001b[0m  MZ\u001b[91m.\u001b[90m.\u001b[91m.\u001b[90m...\u001b[91m.\u001b[90m...\u001b[91m..\u001b[90m.\u001b[0mB\u001b[91m.\u001b[0m\r\n",
      "00000011: \u001b[91m13 \u001b[0m4F 47 4A 6F 65 \u001b[91m17 \u001b[0m34 72 55 5F 5C 2B 6E \u001b[91m1B \u001b[0m4A 5C\u001b[0m  \u001b[91m.\u001b[0mOGJoe\u001b[91m.\u001b[0m4rU_\\+n\u001b[91m.\u001b[0mJ\\\u001b[0m\r\n",
      "00000022: \u001b[91m08 \u001b[93m0D \u001b[0m25 \u001b[93m0A \u001b[0m72 63 \u001b[91m06 \u001b[0m27 \u001b[93m0A \u001b[91m03 \u001b[0m77 45 37 \u001b[91m08 05 1B \u001b[0m42\u001b[0m  \u001b[91m.\u001b[93m.\u001b[0m%\u001b[93m.\u001b[0mrc\u001b[91m.\u001b[0m'\u001b[93m.\u001b[91m.\u001b[0mwE7\u001b[91m...\u001b[0mB\u001b[0m\r\n",
      "00000033: 62 40 \u001b[91m1D 06 11 \u001b[0m53 78 56 28 \u001b[91mE1 1C \u001b[0m24 47 4C 4E \u001b[91m97 \u001b[93m09\u001b[0m  b@\u001b[91m...\u001b[0mSxV(\u001b[91m..\u001b[0m$GLN\u001b[91m.\u001b[93m.\u001b[0m\r\n",
      "00000044: 57 \u001b[91mDD \u001b[0m7D \u001b[91m89 \u001b[0m2D \u001b[91m9C \u001b[0m7C \u001b[93m0A \u001b[91m8D \u001b[0m2E 3F 68 61 4D 68 60 51\u001b[0m  W\u001b[91m.\u001b[0m}\u001b[91m.\u001b[0m-\u001b[91m.\u001b[0m|\u001b[93m.\u001b[91m.\u001b[0m.?haMh`Q\u001b[0m\r\n",
      "00000055: 74 46 69 31 62 33 7C 32 2E 42 25 \u001b[91m13 \u001b[0m7B 3D \u001b[91m01 \u001b[0m71 3C\u001b[0m  tFi1b3|2.B%\u001b[91m.\u001b[0m{=\u001b[91m.\u001b[0mq<\u001b[0m\r\n",
      "00000066: \u001b[93m0B \u001b[0m29 5B \u001b[91m08 \u001b[0m24 2C 58 48 35 \u001b[91m05 \u001b[0m6F 23 4F 73 2A \u001b[91m1C \u001b[0m2F\u001b[0m  \u001b[93m.\u001b[0m)[\u001b[91m.\u001b[0m$,XH5\u001b[91m.\u001b[0mo#Os*\u001b[91m.\u001b[0m/\u001b[0m\r\n",
      "00000077: 66 31 38 59 43 5B 4D \u001b[93m09 \u001b[0m40 \u001b[91m1C \u001b[0m45 \u001b[91mCB 9F 16 \u001b[0m51 \u001b[91mF5 8D\u001b[0m  f18YC[M\u001b[93m.\u001b[0m@\u001b[91m.\u001b[0mE\u001b[91m...\u001b[0mQ\u001b[91m..\u001b[0m\r\n",
      "00000088: \u001b[91m01 \u001b[0m37 \u001b[91mEA 8B \u001b[0m5C 3E \u001b[91m90 D8 F1 A9 \u001b[0m21 \u001b[91m93 \u001b[0m4B 7A \u001b[91m9B D4 8C\u001b[0m  \u001b[91m.\u001b[0m7\u001b[91m..\u001b[0m\\>\u001b[91m....\u001b[0m!\u001b[91m.\u001b[0mKz\u001b[91m...\u001b[0m\r\n",
      "00000099: \u001b[91mD8 \u001b[0m6A \u001b[91mC1 \u001b[0m31 5B \u001b[91m87 AC 18 \u001b[0m52 4F \u001b[91mCF EB 14 C2 C7 1B \u001b[0m6E\u001b[0m  \u001b[91m.\u001b[0mj\u001b[91m.\u001b[0m1[\u001b[91m...\u001b[0mRO\u001b[91m......\u001b[0mn\u001b[0m\r\n",
      "-------------------------------------------------------------------------------\r\n",
      "��\u0019����\u001a��\u0001\r\n"
     ]
    }
   ],
   "source": [
    "!emit /Users/glesnewich/Projects/Malware/TA430/tiger_rat_packed.bin| vsect [ | sorted size \\\n",
    "   | pick 0:1 | snip 4: \\\n",
    "   | put key x::16 | b64 | xor key | peek"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Okay there's at least the makings of an MZ header in there. This is very likely user error for not fully decoding properly :) \n",
    "\n",
    "Helpfully, ThreatRay published a series of helper scripts, including an [unpacker](https://github.com/threatray/tigerrat/blob/main/scripts/tigerlib/unpacker.py) which I tried to mimick in the above scenario. But thats just for the last section - what about overlays or resources? "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 33.25% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 54 \u001b[90m00 \u001b[0m75 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m53 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[0m70 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00\u001b[0m  T\u001b[90m.\u001b[0mu\u001b[90m.\u001b[0me\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mS\u001b[90m.\u001b[0me\u001b[90m.\u001b[0mp\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m\n",
      "0012: 32 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m39 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m35 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m35 \u001b[90m00\u001b[0m  2\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m9\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m5\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m5\u001b[90m.\u001b[0m\n",
      "0024: 36 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00\u001b[0m                    6\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 35.43% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 54 \u001b[90m00 \u001b[0m75 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m4A \u001b[90m00 \u001b[0m61 \u001b[90m00 \u001b[0m6E \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00\u001b[0m  T\u001b[90m.\u001b[0mu\u001b[90m.\u001b[0me\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mJ\u001b[90m.\u001b[0ma\u001b[90m.\u001b[0mn\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m\n",
      "0012: 39 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00 \u001b[0m35 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m31 \u001b[90m00 \u001b[0m35 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m34 \u001b[90m00\u001b[0m  9\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m5\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m5\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m4\u001b[90m.\u001b[0m\n",
      "0024: 37 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m31 \u001b[90m00\u001b[0m                    7\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 33.77% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 54 \u001b[90m00 \u001b[0m75 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m53 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[0m70 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00\u001b[0m  T\u001b[90m.\u001b[0mu\u001b[90m.\u001b[0me\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mS\u001b[90m.\u001b[0me\u001b[90m.\u001b[0mp\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m\n",
      "0012: 32 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00 \u001b[0m36 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m34 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m30 \u001b[90m00\u001b[0m  2\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m6\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m4\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m\n",
      "0024: 37 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00\u001b[0m                    7\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 34.39% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 57 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[0m64 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m53 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[0m70 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00\u001b[0m  W\u001b[90m.\u001b[0me\u001b[90m.\u001b[0md\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mS\u001b[90m.\u001b[0me\u001b[90m.\u001b[0mp\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m\n",
      "0012: 33 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00 \u001b[0m36 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m33 \u001b[90m00 \u001b[0m36 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m32 \u001b[90m00\u001b[0m  3\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m6\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m3\u001b[90m.\u001b[0m6\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m\n",
      "0024: 37 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00\u001b[0m                    7\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 35.03% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 4D \u001b[90m00 \u001b[0m6F \u001b[90m00 \u001b[0m6E \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m4F \u001b[90m00 \u001b[0m63 \u001b[90m00 \u001b[0m74 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00\u001b[0m  M\u001b[90m.\u001b[0mo\u001b[90m.\u001b[0mn\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mO\u001b[90m.\u001b[0mc\u001b[90m.\u001b[0mt\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m\n",
      "0012: 39 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m39 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m33 \u001b[90m00 \u001b[0m39 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m34 \u001b[90m00\u001b[0m  9\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m9\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m3\u001b[90m.\u001b[0m9\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m4\u001b[90m.\u001b[0m\n",
      "0024: 31 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00\u001b[0m                    1\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.002 kB; 12.50% entropy; ASCII text, with no line terminators\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 31 30\u001b[0m                                                  10\u001b[0m            \n",
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 33.97% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 54 \u001b[90m00 \u001b[0m75 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m53 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[0m70 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00\u001b[0m  T\u001b[90m.\u001b[0mu\u001b[90m.\u001b[0me\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mS\u001b[90m.\u001b[0me\u001b[90m.\u001b[0mp\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m\n",
      "0012: 32 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00 \u001b[0m36 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m31 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m35 \u001b[90m00\u001b[0m  2\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m6\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m5\u001b[90m.\u001b[0m\n",
      "0024: 34 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00\u001b[0m                    4\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 35.03% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 4D \u001b[90m00 \u001b[0m6F \u001b[90m00 \u001b[0m6E \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m53 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[0m70 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00\u001b[0m  M\u001b[90m.\u001b[0mo\u001b[90m.\u001b[0mn\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mS\u001b[90m.\u001b[0me\u001b[90m.\u001b[0mp\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m\n",
      "0012: 31 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00 \u001b[0m39 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m33 \u001b[90m00 \u001b[0m33 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m31 \u001b[90m00\u001b[0m  1\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m9\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m3\u001b[90m.\u001b[0m3\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m\n",
      "0024: 37 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00\u001b[0m                    7\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 35.75% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 54 \u001b[90m00 \u001b[0m75 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m4A \u001b[90m00 \u001b[0m61 \u001b[90m00 \u001b[0m6E \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00\u001b[0m  T\u001b[90m.\u001b[0mu\u001b[90m.\u001b[0me\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mJ\u001b[90m.\u001b[0ma\u001b[90m.\u001b[0mn\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m\n",
      "0012: 39 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00 \u001b[0m35 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m34 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m34 \u001b[90m00\u001b[0m  9\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m5\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m4\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m4\u001b[90m.\u001b[0m\n",
      "0024: 38 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m31 \u001b[90m00\u001b[0m                    8\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 35.43% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 54 \u001b[90m00 \u001b[0m75 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m4A \u001b[90m00 \u001b[0m61 \u001b[90m00 \u001b[0m6E \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00\u001b[0m  T\u001b[90m.\u001b[0mu\u001b[90m.\u001b[0me\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mJ\u001b[90m.\u001b[0ma\u001b[90m.\u001b[0mn\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m\n",
      "0012: 39 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00 \u001b[0m35 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m31 \u001b[90m00 \u001b[0m35 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m34 \u001b[90m00\u001b[0m  9\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m5\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m5\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m4\u001b[90m.\u001b[0m\n",
      "0024: 37 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m31 \u001b[90m00\u001b[0m                    7\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 31.68% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 54 \u001b[90m00 \u001b[0m75 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m53 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[0m70 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00\u001b[0m  T\u001b[90m.\u001b[0mu\u001b[90m.\u001b[0me\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mS\u001b[90m.\u001b[0me\u001b[90m.\u001b[0mp\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m\n",
      "0012: 32 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m33 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m31 \u001b[90m00\u001b[0m  2\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m3\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m\n",
      "0024: 32 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00\u001b[0m                    2\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.252 MB; 93.04% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "00000000: \u001b[90m00 \u001b[91mDA 03 \u001b[90m00 \u001b[0m77 4E 6D 48 4B 33 4A 39 32 45 5E 4B 45\u001b[0m  \u001b[90m.\u001b[91m..\u001b[90m.\u001b[0mwNmHK3J92E^KE\u001b[0m\n",
      "00000011: 34 79 6A \u001b[90m00 \u001b[0m3A \u001b[91m14 FD \u001b[0m48 48 33 4A 39 36 45 5E 4B \u001b[91mBA\u001b[0m  4yj\u001b[90m.\u001b[0m:\u001b[91m..\u001b[0mHH3J96E^K\u001b[91m.\u001b[0m\n",
      "00000022: \u001b[91mCB \u001b[0m79 77 \u001b[91mF6 \u001b[0m6D 48 4B 33 4A 39 32 \u001b[91m05 \u001b[0m5E 4B 45 34 79\u001b[0m  \u001b[91m.\u001b[0myw\u001b[91m.\u001b[0mmHK3J92\u001b[91m.\u001b[0m^KE4y\u001b[0m\n",
      "00000033: 77 4E 6D 48 4B 33 4A 39 32 45 5E 4B 45 34 79 77 4E\u001b[0m  wNmHK3J92E^KE4ywN\u001b[0m\n",
      "00000044: 6D 48 4B 33 4A 39 32 45 5E 4B 45 34 79 \u001b[91m8F \u001b[0m4E 6D 48\u001b[0m  mHK3J92E^KE4y\u001b[91m.\u001b[0mNmH\u001b[0m\n",
      "00000055: 45 2C \u001b[91mF0 \u001b[0m37 32 \u001b[91mF1 \u001b[0m57 \u001b[91m86 \u001b[0m64 \u001b[91m8C \u001b[0m78 3B \u001b[91m83 \u001b[0m4C \u001b[91m1C \u001b[0m23 5A\u001b[0m  E,\u001b[91m.\u001b[0m72\u001b[91m.\u001b[0mW\u001b[91m.\u001b[0md\u001b[91m.\u001b[0mx;\u001b[91m.\u001b[0mL\u001b[91m.\u001b[0m#Z\u001b[0m\n",
      "00000066: 39 \u001b[91m19 \u001b[0m42 37 31 2C 37 55 \u001b[91m14 \u001b[0m57 2D \u001b[93m0C \u001b[0m26 25 5C 3E \u001b[91m19\u001b[0m  9\u001b[91m.\u001b[0mB71,7U\u001b[91m.\u001b[0mW-\u001b[93m.\u001b[0m&%\\>\u001b[91m.\u001b[0m\n",
      "00000077: 50 \u001b[93m20 \u001b[0m7E 39 30 5A 59 \u001b[91m1E \u001b[93m20 \u001b[0m4D \u001b[93m0C \u001b[91m04 \u001b[0m60 6A 54 5D 21\u001b[0m  P\u001b[93m.\u001b[0m~90ZY\u001b[91m.\u001b[93m.\u001b[0mM\u001b[93m.\u001b[91m.\u001b[0m`jT]!\u001b[0m\n",
      "00000088: 3B 65 48 39 73 53 4E 6D 48 4B 33 4A 39 3B 38 \u001b[91mCC 97\u001b[0m  ;eH9sSNmHK3J9;8\u001b[91m..\u001b[0m\n",
      "00000099: \u001b[91m08 \u001b[0m28 \u001b[91m85 F8 03 \u001b[0m71 \u001b[91mB4 C4 \u001b[0m7E 56 \u001b[91mC5 BD D5 BD \u001b[0m66 \u001b[91mCA \u001b[0m78\u001b[0m  \u001b[91m.\u001b[0m(\u001b[91m...\u001b[0mq\u001b[91m..\u001b[0m~V\u001b[91m....\u001b[0mf\u001b[91m.\u001b[0mx\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 34.19% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 54 \u001b[90m00 \u001b[0m75 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m4A \u001b[90m00 \u001b[0m61 \u001b[90m00 \u001b[0m6E \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00\u001b[0m  T\u001b[90m.\u001b[0mu\u001b[90m.\u001b[0me\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mJ\u001b[90m.\u001b[0ma\u001b[90m.\u001b[0mn\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m\n",
      "0012: 39 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m39 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m39 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m32 \u001b[90m00\u001b[0m  9\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m9\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m9\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m\n",
      "0024: 34 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m31 \u001b[90m00\u001b[0m                    4\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m\n",
      "(12:04:32) failure in peoverlay: exception of type PEFormatError; 'DOS Header magic not found.'\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-------------------------------------------------------------------------------\n",
      "00.337 MB; 72.88% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "00000000: 58 25 \u001b[91m05 \u001b[90m00 \u001b[0m77 4E 6D 48 4B 33 4A 39 32 45 5E 4B 45\u001b[0m  X%\u001b[91m.\u001b[90m.\u001b[0mwNmHK3J92E^KE\u001b[0m\n",
      "00000011: 34 79 6A \u001b[90m00 \u001b[0m4F 68 54 39 53 45 67 7A 53 6A 6B 32 52\u001b[0m  4yj\u001b[90m.\u001b[0mOhT9SEgzSjk2R\u001b[0m\n",
      "00000022: 56 35 4C 75 73 74 35 64 2F 5A 74 53 45 73 7A 53 6A\u001b[0m  V5Lust5d/ZtSEszSj\u001b[0m\n",
      "00000033: 6B 79 42 56 35 4C 52 54 52 35 64 30 35 74 53 45 73\u001b[0m  kyBV5LRTR5d05tSEs\u001b[0m\n",
      "00000044: 7A 53 6A 6B 79 52 56 35 4C 52 54 52 35 64 30 35 74\u001b[0m  zSjkyRV5LRTR5d05t\u001b[0m\n",
      "00000055: 53 45 73 7A 53 6A 6B 79 52 56 35 4C 52 54 52 35 6E\u001b[0m  SEszSjkyRV5LRTR5n\u001b[0m\n",
      "00000066: 30 35 74 53 45 55 73 38 44 63 79 38 56 65 47 5A 49\u001b[0m  05tSEUs8Dcy8VeGZI\u001b[0m\n",
      "00000077: 78 34 4F 34 4E 4D 48 43 4E 61 4F 52 6C 43 4E 7A 45\u001b[0m  x4O4NMHCNaORlCNzE\u001b[0m\n",
      "00000088: 73 4E 31 55 55 56 79 30 4D 4A 69 56 63 50 68 6C 51\u001b[0m  sN1UUVy0MJiVcPhlQ\u001b[0m\n",
      "00000099: 49 48 34 35 4D 46 70 5A 48 69 42 4E 44 41 52 67 61\u001b[0m  IH45MFpZHiBNDARga\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 33.25% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 54 \u001b[90m00 \u001b[0m75 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m53 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[0m70 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00\u001b[0m  T\u001b[90m.\u001b[0mu\u001b[90m.\u001b[0me\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mS\u001b[90m.\u001b[0me\u001b[90m.\u001b[0mp\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m\n",
      "0012: 32 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m33 \u001b[90m00 \u001b[0m35 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m33 \u001b[90m00\u001b[0m  2\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m3\u001b[90m.\u001b[0m5\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m3\u001b[90m.\u001b[0m\n",
      "0024: 31 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00\u001b[0m                    1\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 35.75% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 57 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[0m64 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m53 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[0m70 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00\u001b[0m  W\u001b[90m.\u001b[0me\u001b[90m.\u001b[0md\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mS\u001b[90m.\u001b[0me\u001b[90m.\u001b[0mp\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m\n",
      "0012: 33 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00 \u001b[0m35 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m33 \u001b[90m00 \u001b[0m37 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m34 \u001b[90m00\u001b[0m  3\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m5\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m3\u001b[90m.\u001b[0m7\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m4\u001b[90m.\u001b[0m\n",
      "0024: 38 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00\u001b[0m                    8\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.197 MB; 73.42% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "00000000: \u001b[91mAC 02 03 \u001b[90m00 \u001b[0m62 79 37 6D 4A 53 4F 6B 56 44 61 57 67\u001b[0m  \u001b[91m...\u001b[90m.\u001b[0mby7mJSOkVDaWg\u001b[0m\n",
      "00000011: 2A 55 62 \u001b[90m00 \u001b[0m4C 79 4F 6E 62 55 6C 54 54 32 74 53 52\u001b[0m  *Ub\u001b[90m.\u001b[0mLyOnbUlTT2tSR\u001b[0m\n",
      "00000022: 47 46 58 6D 4E 56 56 59 73 45 33 62 55 70 54 54 32\u001b[0m  GFXmNVVYsE3bUpTT2\u001b[0m\n",
      "00000033: 74 57 42 47 46 58 5A 79 70 56 59 6E 6B 33 62 55 70\u001b[0m  tWBGFXZypVYnk3bUp\u001b[0m\n",
      "00000044: 54 54 32 74 57 52 47 46 58 5A 79 70 56 59 6E 6B 33\u001b[0m  TT2tWRGFXZypVYnk3\u001b[0m\n",
      "00000055: 62 55 70 54 54 32 74 57 52 47 46 58 5A 79 70 56 6B\u001b[0m  bUpTT2tWRGFXZypVk\u001b[0m\n",
      "00000066: 6E 6B 33 62 55 52 4D 39 57 56 57 38 47 69 61 52 70\u001b[0m  nk3bURM9WVW8GiaRp\u001b[0m\n",
      "00000077: 4A 55 4C 72 51 57 4F 53 49 36 50 45 73 6D 4E 67 34\u001b[0m  JULrQWOSI6PEsmNg4\u001b[0m\n",
      "00000088: 77 46 55 73 34 51 68 70 57 41 79 51 38 4F 30 73 30\u001b[0m  wFUs4QhpWAyQ8O0s0\u001b[0m\n",
      "00000099: 49 55 45 6C 45 6B 52 31 43 78 63 58 4B 51 55 41 62\u001b[0m  IUElEkR1CxcXKQUAb\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 33.77% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 46 \u001b[90m00 \u001b[0m72 \u001b[90m00 \u001b[0m69 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m4A \u001b[90m00 \u001b[0m61 \u001b[90m00 \u001b[0m6E \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00\u001b[0m  F\u001b[90m.\u001b[0mr\u001b[90m.\u001b[0mi\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mJ\u001b[90m.\u001b[0ma\u001b[90m.\u001b[0mn\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m\n",
      "0012: 35 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m31 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m33 \u001b[90m00\u001b[0m  5\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m3\u001b[90m.\u001b[0m\n",
      "0024: 31 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m31 \u001b[90m00\u001b[0m                    1\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 36.47% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 4D \u001b[90m00 \u001b[0m6F \u001b[90m00 \u001b[0m6E \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m41 \u001b[90m00 \u001b[0m70 \u001b[90m00 \u001b[0m72 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m31 \u001b[90m00\u001b[0m  M\u001b[90m.\u001b[0mo\u001b[90m.\u001b[0mn\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mA\u001b[90m.\u001b[0mp\u001b[90m.\u001b[0mr\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m\n",
      "0012: 39 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m38 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m34 \u001b[90m00 \u001b[0m36 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m35 \u001b[90m00\u001b[0m  9\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m8\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m4\u001b[90m.\u001b[0m6\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m5\u001b[90m.\u001b[0m\n",
      "0024: 38 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m31 \u001b[90m00\u001b[0m                    8\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "00.048 kB; 34.19% entropy; data\n",
      "-------------------------------------------------------------------------------\n",
      "0000: 57 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[0m64 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m53 \u001b[90m00 \u001b[0m65 \u001b[90m00 \u001b[0m70 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00\u001b[0m  W\u001b[90m.\u001b[0me\u001b[90m.\u001b[0md\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0mS\u001b[90m.\u001b[0me\u001b[90m.\u001b[0mp\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m\n",
      "0012: 33 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m31 \u001b[90m00 \u001b[0m38 \u001b[90m00 \u001b[0m3A \u001b[90m00 \u001b[0m33 \u001b[90m00\u001b[0m  3\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m1\u001b[90m.\u001b[0m8\u001b[90m.\u001b[0m:\u001b[90m.\u001b[0m3\u001b[90m.\u001b[0m\n",
      "0024: 39 \u001b[90m00 \u001b[93m20 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00 \u001b[0m32 \u001b[90m00 \u001b[0m30 \u001b[90m00\u001b[0m                    9\u001b[90m.\u001b[93m.\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m2\u001b[90m.\u001b[0m0\u001b[90m.\u001b[0m\n",
      "-------------------------------------------------------------------------------\n",
      "��\u0019����\u001a��\u0001\n"
     ]
    }
   ],
   "source": [
    "!emit /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed/* [ | peoverlay | peek "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-------------------------------------------------------------------------------\r\n",
      "00.391 kB; 17.54% entropy; ASCII text, with no line terminators\r\n",
      "  offset = 0x20000\r\n",
      "    path = data\r\n",
      "-------------------------------------------------------------------------------\r\n",
      "0000: 47 4D 70 52 69 4D 30 51 44 4A 6E 4F 47 52 50 49 58 68\u001b[0m  GMpRiM0QDJnOGRPIXh\u001b[0m\r\n",
      "0012: 72 4A 47 4D 70 52 69 4D 30 51 44 4A 6E 4F 47 52 50 49\u001b[0m  rJGMpRiM0QDJnOGRPI\u001b[0m\r\n",
      "0024: 58 68 72 4A 47 4D 70 52 69 4D 30 51 44 4A 6E 4F 47 52\u001b[0m  XhrJGMpRiM0QDJnOGR\u001b[0m\r\n",
      "0036: 50 49 58 68 72 4A 47 4D 70 52 69 4D 30 51 44 49 3D \u001b[90m00\u001b[0m  PIXhrJGMpRiM0QDI=\u001b[90m.\u001b[0m\r\n",
      "0048: \u001b[90m00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\u001b[0m  \u001b[90m..................\u001b[0m\r\n",
      "....: \u001b[90m///////////////// repeats 14 times //////////////////  //////////////////\u001b[0m\r\n",
      "0156: \u001b[90m00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\u001b[0m  \u001b[90m..................\u001b[0m\r\n",
      "-------------------------------------------------------------------------------\r\n",
      "��\u0019����\u001a��\u0001\r\n"
     ]
    }
   ],
   "source": [
    "!emit /Users/glesnewich/Projects/Malware/TA430/tiger_rat_packed.bin| vsect [ | sorted size \\\n",
    "   | pick 0:1 | snip 0x52279: | peek -l 20\n",
    "                                                                        "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "So can we take that payload length value from the front of the payload, and subtract the length of the key + 4 byte length marker, and find similar payloads? \n",
    "\n",
    "I was hoping to find a nice and tidy way to look for these things, and validate that the first two bytes of the base64 decoded value, xor'd with the first 2 bytes of the key, would be `MZ` but I haven't figured out a nice way in YARA to do that. So hunting for the payload lengths will have to do! \n",
    "\n",
    "Something I learned during this process was the importance of PADDING inside of PE sections, but not individual resources or overlays? Why? Because the PE sections get mapped into memory, and tl;dr, things are made easier if their padding rounds up to the next 0x100 size. So we have to fudge some of our calculations:\n",
    "\n",
    "```\n",
    "import \"pe\"\n",
    "\n",
    "rule APT_NK_TA430_TigerLoader_Payload_LastSection\n",
    "{\n",
    "\n",
    "condition:\n",
    "\tuint32(pe.sections[pe.number_of_sections-1].raw_data_offset) != 0x0 and\n",
    "\tuint32(pe.sections[pe.number_of_sections-1].raw_data_offset) == \n",
    "        (pe.sections[pe.number_of_sections-1].virtual_size - (0x14))\n",
    "}\n",
    "\n",
    "\n",
    "rule APT_NK_TA430_TigerLoader_Payload_Overlay\n",
    "{\n",
    "\n",
    "condition:\n",
    "\tuint32(pe.overlay.offset) == (pe.overlay.size - 0x17) or\n",
    "    uint32(pe.overlay.offset) == (pe.overlay.size - 70 ) or\n",
    "    uint32(pe.overlay.offset) == (pe.overlay.size - 21 )\n",
    "}\n",
    "```\n",
    "\n",
    "So what are we doing here? Well, we're attempting to look for the byte marker at the start of the overlay or the last section as length field, and compare that integer to the integer of the size of the entire chunk we are assessing, minus the set length of the marker + xor key. \n",
    "\n",
    "While this works decently well on the section side, its a nightmare on the Overlay side because sometimes the payload has an extra null byte at the end; sometimes it doesn't; sometimes it has one of those date-time fields appended to the end of them as seen in the output a few cells above. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Okay okay okay maybe I'm drastly over thinking this! Lets try another tactic - using the console module to mine out the import hashes and rich header hashes:\n",
    "\n",
    "```\n",
    "import \"console\"\n",
    "import \"pe\"\n",
    "import \"hash\"\n",
    "\n",
    "rule imphash_printer\n",
    "{\n",
    "\n",
    "\tcondition:\n",
    "\t\t\tconsole.log(\"pe.imphash() == \\\"\\\" \", pe.imphash() )\n",
    "}\n",
    "\n",
    "\n",
    "rule richheader_printer\n",
    "{\n",
    "\tcondition:\n",
    "\t\t\t console.log(\"hash.md5(pe.rich_signature.clear_data) == \", hash.md5(pe.rich_signature.clear_data))\n",
    "}\n",
    "\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "pe.imphash() == \"\" fb892be2f8e28d3a116b556db68cdbb0\r\n",
      "pe.imphash() == \"\" 7d3a5cb7a3140197f0e2e6f87d19764e\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 2cd8928b02b7b03341e893527f303378\r\n",
      "hash.md5(pe.rich_signature.clear_data) == dd3c533b17d82f89a086b99a0a67908c\r\n",
      "pe.imphash() == \"\" fb892be2f8e28d3a116b556db68cdbb0\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//d0fa0bfef8b199a42f4f33145274576e5a7edeb5522fb342af41fdc16e9021e2\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//d0fa0bfef8b199a42f4f33145274576e5a7edeb5522fb342af41fdc16e9021e2\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 2cd8928b02b7b03341e893527f303378\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//9137e886e414b12581852b96a1d90ee875053f16b79be57694df9f93f3ead506\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//9137e886e414b12581852b96a1d90ee875053f16b79be57694df9f93f3ead506\r\n",
      "pe.imphash() == \"\" 7d3a5cb7a3140197f0e2e6f87d19764e\r\n",
      "hash.md5(pe.rich_signature.clear_data) == dd3c533b17d82f89a086b99a0a67908c\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//7d7dc8125a26d9515d90a66bfd20d609820197c879030cb932d39b1c2998e9d4\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//7d7dc8125a26d9515d90a66bfd20d609820197c879030cb932d39b1c2998e9d4\r\n",
      "pe.imphash() == \"\" 4d47c5504937157a74ab6353e761c21c\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 9b9c6f8e3e374c8f712c0eb37cd63e16\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//b0d6aee39e988196fdc821895a1f1aa63d1c032ea880c26a15c857068f34bfd9\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//b0d6aee39e988196fdc821895a1f1aa63d1c032ea880c26a15c857068f34bfd9\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//6310cd9f8b6ae1fdc1b55fe190026a119f7ea526cd3fc22a215bda51c9c28214\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//6310cd9f8b6ae1fdc1b55fe190026a119f7ea526cd3fc22a215bda51c9c28214\r\n",
      "pe.imphash() == \"\" 9d582faf431607b0223b21bb699b5040\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 9b9c6f8e3e374c8f712c0eb37cd63e16\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//da787cf1f4fd829dd4a7637bec392438b793c5f9c920560197545d20b58691af\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//da787cf1f4fd829dd4a7637bec392438b793c5f9c920560197545d20b58691af\r\n",
      "pe.imphash() == \"\" 9c01eaa5f06a9b074cd2776851df5516\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 2f6e21aaed1b65fb56844be3114c0155\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//ab194f2bad37bffd32fae9833dafaa04c79c9e117d86aa46432eadef64a43ad6\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//ab194f2bad37bffd32fae9833dafaa04c79c9e117d86aa46432eadef64a43ad6\r\n",
      "pe.imphash() == \"\" 920a18f4432c5fbd3cef843e34ac3311\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 9b9c6f8e3e374c8f712c0eb37cd63e16\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//ed5fbefd61a72ec9f8a5ebd7fa7bcd632ec55f04bdd4a4e24686edccb0268e05\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//ed5fbefd61a72ec9f8a5ebd7fa7bcd632ec55f04bdd4a4e24686edccb0268e05\r\n",
      "pe.imphash() == \"\" fb892be2f8e28d3a116b556db68cdbb0\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 2cd8928b02b7b03341e893527f303378\r\n",
      "pe.imphash() == \"\" fb892be2f8e28d3a116b556db68cdbb0\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 2cd8928b02b7b03341e893527f303378\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//f62adc678eaadc019277640e6695143a45336c2f91019f5d9308812db1d07285\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//f62adc678eaadc019277640e6695143a45336c2f91019f5d9308812db1d07285\r\n",
      "pe.imphash() == \"\" fb892be2f8e28d3a116b556db68cdbb0\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 2cd8928b02b7b03341e893527f303378\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//87f389d8f3a63f0879aa9d9dfbbd2b2c9cf678b871b704a01b39e1eaa234020c\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//87f389d8f3a63f0879aa9d9dfbbd2b2c9cf678b871b704a01b39e1eaa234020c\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//1892b72c053ab48edae8305ef449f2b5391921efea8b1d7c37d6d29f59edc92e\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//1892b72c053ab48edae8305ef449f2b5391921efea8b1d7c37d6d29f59edc92e\r\n",
      "pe.imphash() == \"\" 8a7c93db0358f54e7797d711119e39a9\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 9b9c6f8e3e374c8f712c0eb37cd63e16\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//b59e8f44822ad6bc3b4067bfdfd1ad286b8ba76c1a3faff82a3feb7bdf96b9c5\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//b59e8f44822ad6bc3b4067bfdfd1ad286b8ba76c1a3faff82a3feb7bdf96b9c5\r\n",
      "pe.imphash() == \"\" 7d3a5cb7a3140197f0e2e6f87d19764e\r\n",
      "hash.md5(pe.rich_signature.clear_data) == dd3c533b17d82f89a086b99a0a67908c\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//0e447797aa20bff416073281adb09b73c15433ab855b5cdb2d883f8c2af9c414\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//0e447797aa20bff416073281adb09b73c15433ab855b5cdb2d883f8c2af9c414\r\n",
      "pe.imphash() == \"\" 0e15d4b92e4de8ce71e3c186bb853030\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 9b9c6f8e3e374c8f712c0eb37cd63e16\r\n",
      "pe.imphash() == \"\" fb892be2f8e28d3a116b556db68cdbb0\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 2cd8928b02b7b03341e893527f303378\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//4da0ac4c3f47f69c992abb5d6e9803348bf9f3c6028a7214dcabec9a2e729b99\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//4da0ac4c3f47f69c992abb5d6e9803348bf9f3c6028a7214dcabec9a2e729b99\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//2f53109e01c431c1c1acec667adee07cf907cdc4d36429022f915654c9b7113b\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//2f53109e01c431c1c1acec667adee07cf907cdc4d36429022f915654c9b7113b\r\n",
      "pe.imphash() == \"\" 47d612847dc9f9ce71631333113d4d39\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 9b9c6f8e3e374c8f712c0eb37cd63e16\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392\r\n",
      "pe.imphash() == \"\" c8f590c6f8162c4e48f2bc8e1dd2e136\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 9b9c6f8e3e374c8f712c0eb37cd63e16\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//d231f3b6d6e4c56cb7f149cbc0178f7b80448c24f14dced5a864015512b0ba1f\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//d231f3b6d6e4c56cb7f149cbc0178f7b80448c24f14dced5a864015512b0ba1f\r\n",
      "pe.imphash() == \"\" 7d3a5cb7a3140197f0e2e6f87d19764e\r\n",
      "hash.md5(pe.rich_signature.clear_data) == dd3c533b17d82f89a086b99a0a67908c\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//d26987b705f537b10a11fb9913d0acc0218a0c0ae5f27e6f821d6d987b1cd4c7\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//d26987b705f537b10a11fb9913d0acc0218a0c0ae5f27e6f821d6d987b1cd4c7\r\n",
      "pe.imphash() == \"\" 7d3a5cb7a3140197f0e2e6f87d19764e\r\n",
      "hash.md5(pe.rich_signature.clear_data) == dd3c533b17d82f89a086b99a0a67908c\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//f13aff9e1192c081c012f974b29bf60487385eed644d506d7f82b3538c2b035f\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//f13aff9e1192c081c012f974b29bf60487385eed644d506d7f82b3538c2b035f\r\n",
      "pe.imphash() == \"\" fb892be2f8e28d3a116b556db68cdbb0\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 2cd8928b02b7b03341e893527f303378\r\n",
      "pe.imphash() == \"\" 0e15d4b92e4de8ce71e3c186bb853030\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 9b9c6f8e3e374c8f712c0eb37cd63e16\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//e83f5e0a51845d7078a3aca8ca7a5b786e8bdf284efd3e08b3472dbf3e098930\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//e83f5e0a51845d7078a3aca8ca7a5b786e8bdf284efd3e08b3472dbf3e098930\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//0996a8e5ec1a41645309e2ca395d3a6b766a7c52784c974c776f258c1b25a76c\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//0996a8e5ec1a41645309e2ca395d3a6b766a7c52784c974c776f258c1b25a76c\r\n",
      "pe.imphash() == \"\" fb892be2f8e28d3a116b556db68cdbb0\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 2cd8928b02b7b03341e893527f303378\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//ebe4befd2a7f941baa65248d5dea09de809e638ec8e8caffae322aa3b6863c1c\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//ebe4befd2a7f941baa65248d5dea09de809e638ec8e8caffae322aa3b6863c1c\r\n",
      "pe.imphash() == \"\" 96f0b475b31660c56e7548fc0e7df612\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 9b9c6f8e3e374c8f712c0eb37cd63e16\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//f4765f7b089d99b1cdcebf3ad7ba7e3e23ce411deab29b7afd782b23352e698f\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//f4765f7b089d99b1cdcebf3ad7ba7e3e23ce411deab29b7afd782b23352e698f\r\n",
      "pe.imphash() == \"\" 5c4172a31d13588c3dca165a8992d5dd\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 9b9c6f8e3e374c8f712c0eb37cd63e16\r\n",
      "pe.imphash() == \"\" f96cc3a121fbe2aadfabf121ee6ddde7\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 9b9c6f8e3e374c8f712c0eb37cd63e16\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//69bac736f42e37302db7eca68b6fc138c3aa9a5c902c149e46cce8b42b172603\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//69bac736f42e37302db7eca68b6fc138c3aa9a5c902c149e46cce8b42b172603\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//4d03a981bed15a3bd91f36972d7391b39791c582bb2959a9be154a74bd64db31\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//4d03a981bed15a3bd91f36972d7391b39791c582bb2959a9be154a74bd64db31\r\n",
      "pe.imphash() == \"\" fb892be2f8e28d3a116b556db68cdbb0\r\n",
      "hash.md5(pe.rich_signature.clear_data) == 2cd8928b02b7b03341e893527f303378\r\n",
      "imphash_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//0dc3f66f4af3250f56a32f8e1b9e772c514f74718358d19c195e3950d370ea01\r\n",
      "richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed//0dc3f66f4af3250f56a32f8e1b9e772c514f74718358d19c195e3950d370ea01\r\n"
     ]
    }
   ],
   "source": [
    "!yara /Users/glesnewich/Desktop/console.yar /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed/ -r "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Quick clean up with sort + uniq "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b7\u001b[?47h\u001b[?1h\u001b=\r",
      "  11 hash.md5(pe.rich_signature.clear_data) == 9b9c6f8e3e374c8f712c0eb37cd63e16\r\n",
      "   9 pe.imphash() == \"\" fb892be2f8e28d3a116b556db68cdbb0\r\n",
      "   9 hash.md5(pe.rich_signature.clear_data) == 2cd8928b02b7b03341e893527f303378\r\n",
      "   5 pe.imphash() == \"\" 7d3a5cb7a3140197f0e2e6f87d19764e\r\n",
      "   5 hash.md5(pe.rich_signature.clear_data) == dd3c533b17d82f89a086b99a0a67908c\r\n",
      "   2 pe.imphash() == \"\" 0e15d4b92e4de8ce71e3c186bb853030\r\n",
      "   1 richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed \b//f62adc678eaadc019277640e6695143a45336c2f91019f5d9308812db1d07285\r\n",
      "   1 richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed \b//f4765f7b089d99b1cdcebf3ad7ba7e3e23ce411deab29b7afd782b23352e698f\r\n",
      "   1 richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed \b//f13aff9e1192c081c012f974b29bf60487385eed644d506d7f82b3538c2b035f\r\n",
      "   1 richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed \b//ed5fbefd61a72ec9f8a5ebd7fa7bcd632ec55f04bdd4a4e24686edccb0268e05\r\n",
      "   1 richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed \b//ebe4befd2a7f941baa65248d5dea09de809e638ec8e8caffae322aa3b6863c1c\r\n",
      "   1 richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed \b//e83f5e0a51845d7078a3aca8ca7a5b786e8bdf284efd3e08b3472dbf3e098930\r\n",
      "   1 richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed \b//da787cf1f4fd829dd4a7637bec392438b793c5f9c920560197545d20b58691af\r\n",
      "   1 richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed \b//d26987b705f537b10a11fb9913d0acc0218a0c0ae5f27e6f821d6d987b1cd4c7\r\n",
      "   1 richheader_printer /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed \b:\u001b[K"
     ]
    }
   ],
   "source": [
    "!yara /Users/glesnewich/Desktop/console.yar /Users/glesnewich/Projects/Malware/TA430/TigerRAT/Packed/ -r  \\\n",
    "| sort | uniq -c | sort -rn | less"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "some pretty common rich headers and import hashes:\n",
    "```\n",
    "     11 hash.md5(pe.rich_signature.clear_data) == 9b9c6f8e3e374c8f712c0eb37cd63e16\n",
    "     9 pe.imphash() == \"\" fb892be2f8e28d3a116b556db68cdbb0\n",
    "     9 hash.md5(pe.rich_signature.clear_data) == 2cd8928b02b7b03341e893527f303378\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "APT_NK_TA430_TigerLoader_ImportHash /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/0dc3f66f4af3250f56a32f8e1b9e772c514f74718358d19c195e3950d370ea01\r\n",
      "APT_NK_TA430_TigerLoader_ImportHash /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/1892b72c053ab48edae8305ef449f2b5391921efea8b1d7c37d6d29f59edc92e\r\n",
      "APT_NK_TA430_TigerLoader_ImportHash /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/2f53109e01c431c1c1acec667adee07cf907cdc4d36429022f915654c9b7113b\r\n",
      "APT_NK_TA430_TigerLoader_ImportHash /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/7d7dc8125a26d9515d90a66bfd20d609820197c879030cb932d39b1c2998e9d4\r\n",
      "APT_NK_TA430_TigerLoader_ImportHash /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/87f389d8f3a63f0879aa9d9dfbbd2b2c9cf678b871b704a01b39e1eaa234020c\r\n",
      "APT_NK_TA430_TigerLoader_ImportHash /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/d0fa0bfef8b199a42f4f33145274576e5a7edeb5522fb342af41fdc16e9021e2\r\n",
      "APT_NK_TA430_TigerLoader_ImportHash /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/e83f5e0a51845d7078a3aca8ca7a5b786e8bdf284efd3e08b3472dbf3e098930\r\n",
      "APT_NK_TA430_TigerLoader_ImportHash /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/ebe4befd2a7f941baa65248d5dea09de809e638ec8e8caffae322aa3b6863c1c\r\n",
      "APT_NK_TA430_TigerLoader_ImportHash /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/f62adc678eaadc019277640e6695143a45336c2f91019f5d9308812db1d07285\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/0996a8e5ec1a41645309e2ca395d3a6b766a7c52784c974c776f258c1b25a76c\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/0dc3f66f4af3250f56a32f8e1b9e772c514f74718358d19c195e3950d370ea01\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/1892b72c053ab48edae8305ef449f2b5391921efea8b1d7c37d6d29f59edc92e\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/2f53109e01c431c1c1acec667adee07cf907cdc4d36429022f915654c9b7113b\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/4da0ac4c3f47f69c992abb5d6e9803348bf9f3c6028a7214dcabec9a2e729b99\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/6310cd9f8b6ae1fdc1b55fe190026a119f7ea526cd3fc22a215bda51c9c28214\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/7d7dc8125a26d9515d90a66bfd20d609820197c879030cb932d39b1c2998e9d4\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/87f389d8f3a63f0879aa9d9dfbbd2b2c9cf678b871b704a01b39e1eaa234020c\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/b59e8f44822ad6bc3b4067bfdfd1ad286b8ba76c1a3faff82a3feb7bdf96b9c5\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/d0fa0bfef8b199a42f4f33145274576e5a7edeb5522fb342af41fdc16e9021e2\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/e83f5e0a51845d7078a3aca8ca7a5b786e8bdf284efd3e08b3472dbf3e098930\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/ebe4befd2a7f941baa65248d5dea09de809e638ec8e8caffae322aa3b6863c1c\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/f4765f7b089d99b1cdcebf3ad7ba7e3e23ce411deab29b7afd782b23352e698f\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/f62adc678eaadc019277640e6695143a45336c2f91019f5d9308812db1d07285\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/stage2\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/TigerRAT/tigerload.bin\r\n",
      "APT_NK_TA430_TigerLoader_Payload_LastSection /Users/glesnewich/Projects/Malware//TA430/tiger_rat_packed.bin\r\n",
      "APT_NK_TA430_TigerLoader_Payload_Overlay /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/d231f3b6d6e4c56cb7f149cbc0178f7b80448c24f14dced5a864015512b0ba1f\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/0996a8e5ec1a41645309e2ca395d3a6b766a7c52784c974c776f258c1b25a76c\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/0dc3f66f4af3250f56a32f8e1b9e772c514f74718358d19c195e3950d370ea01\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/1892b72c053ab48edae8305ef449f2b5391921efea8b1d7c37d6d29f59edc92e\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/2f53109e01c431c1c1acec667adee07cf907cdc4d36429022f915654c9b7113b\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/4d03a981bed15a3bd91f36972d7391b39791c582bb2959a9be154a74bd64db31\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/4da0ac4c3f47f69c992abb5d6e9803348bf9f3c6028a7214dcabec9a2e729b99\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/6310cd9f8b6ae1fdc1b55fe190026a119f7ea526cd3fc22a215bda51c9c28214\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/69bac736f42e37302db7eca68b6fc138c3aa9a5c902c149e46cce8b42b172603\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/7d7dc8125a26d9515d90a66bfd20d609820197c879030cb932d39b1c2998e9d4\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/87f389d8f3a63f0879aa9d9dfbbd2b2c9cf678b871b704a01b39e1eaa234020c\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/b59e8f44822ad6bc3b4067bfdfd1ad286b8ba76c1a3faff82a3feb7bdf96b9c5\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/d0fa0bfef8b199a42f4f33145274576e5a7edeb5522fb342af41fdc16e9021e2\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/d231f3b6d6e4c56cb7f149cbc0178f7b80448c24f14dced5a864015512b0ba1f\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/da787cf1f4fd829dd4a7637bec392438b793c5f9c920560197545d20b58691af\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/e83f5e0a51845d7078a3aca8ca7a5b786e8bdf284efd3e08b3472dbf3e098930\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/ebe4befd2a7f941baa65248d5dea09de809e638ec8e8caffae322aa3b6863c1c\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/ed5fbefd61a72ec9f8a5ebd7fa7bcd632ec55f04bdd4a4e24686edccb0268e05\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/f4765f7b089d99b1cdcebf3ad7ba7e3e23ce411deab29b7afd782b23352e698f\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/Packed/f62adc678eaadc019277640e6695143a45336c2f91019f5d9308812db1d07285\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/stage2\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/tiger.bin\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/TigerRAT/tigerload.bin\r\n",
      "APT_NK_TA430_TigerLoader_RichHeader /Users/glesnewich/Projects/Malware//TA430/tiger_rat_packed.bin\r\n"
     ]
    }
   ],
   "source": [
    "!yara /Users/glesnewich/Desktop/APT_NK_TA430_Tiger.yar /Users/glesnewich/Projects/Malware/ -r | sort"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "If we wanted to tally the votes, we'll see that the lower hanging fruit of the rich headers catches more true positives (24) than the funky ones looking to use the decoding structure as rule logic. \n",
    "\n",
    "While this was largely an exercise in futility, I hope this highlights that sometimes the more simple the YARA rule, the better! But for the road, there is this strangely common function found at the entry point of both stages of TigerRAT... \n",
    "\n",
    "```\n",
    "\n",
    "\n",
    "rule APT_NK_TA430_TigerLoader_CommonEntryFunc {\n",
    "meta:\n",
    "\tauthor = \"Greg Lesnewich and some secret sauce\"\n",
    "\tdate = \"2023-01-05\"\n",
    "\tversion = \"1.0\"\n",
    "\thash = \"0996a8e5ec1a41645309e2ca395d3a6b766a7c52784c974c776f258c1b25a76c\"\n",
    "\thash = \"0e447797aa20bff416073281adb09b73c15433ab855b5cdb2d883f8c2af9c414\"\n",
    "\thash = \"1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392\"\n",
    "\thash = \"4d03a981bed15a3bd91f36972d7391b39791c582bb2959a9be154a74bd64db31\"\n",
    "\thash = \"4da0ac4c3f47f69c992abb5d6e9803348bf9f3c6028a7214dcabec9a2e729b99\"\n",
    "\thash = \"6310cd9f8b6ae1fdc1b55fe190026a119f7ea526cd3fc22a215bda51c9c28214\"\n",
    "\thash = \"69bac736f42e37302db7eca68b6fc138c3aa9a5c902c149e46cce8b42b172603\"\n",
    "\thash = \"9137e886e414b12581852b96a1d90ee875053f16b79be57694df9f93f3ead506\"\n",
    "\thash = \"b0d6aee39e988196fdc821895a1f1aa63d1c032ea880c26a15c857068f34bfd9\"\n",
    "\thash = \"b59e8f44822ad6bc3b4067bfdfd1ad286b8ba76c1a3faff82a3feb7bdf96b9c5\"\n",
    "\thash = \"d231f3b6d6e4c56cb7f149cbc0178f7b80448c24f14dced5a864015512b0ba1f\"\n",
    "\thash = \"d26987b705f537b10a11fb9913d0acc0218a0c0ae5f27e6f821d6d987b1cd4c7\"\n",
    "\thash = \"da787cf1f4fd829dd4a7637bec392438b793c5f9c920560197545d20b58691af\"\n",
    "\thash = \"ed5fbefd61a72ec9f8a5ebd7fa7bcd632ec55f04bdd4a4e24686edccb0268e05\"\n",
    "\thash = \"f13aff9e1192c081c012f974b29bf60487385eed644d506d7f82b3538c2b035f\"\n",
    "\thash = \"f4765f7b089d99b1cdcebf3ad7ba7e3e23ce411deab29b7afd782b23352e698f\"\n",
    "    reference = \"https://threatray.com/blog/establishing-the-tigerrat-and-tigerdownloader-malware-families/\"\n",
    "\treference = \"https://www.krcert.or.kr/filedownload.do?attach_file_seq=3277&attach_file_id=EpF3277.pdf\"\n",
    "\treference = \"https://blog.malwarebytes.com/threat-intelligence/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat/\"\n",
    "\treference = \"https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/\"\n",
    "\n",
    "strings:\n",
    "$entry = { 48 83 EC 28 E8 ?? ?? ?? ?? 48 83 C4 28 E9 ?? ?? ?? ?? ?? ?? 48 89 5C 24 10 48 89 74 24 18 57 48 83 EC 30 E8 ?? ?? ?? ?? 0F B7 F0 B9 02 ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 66 39 ?? ?? ?? ?? ?? 74 ?? 33 DB EB ?? 48 ?? ?? ?? ?? ?? ?? 48 03 C7 81 38 50 45 ?? ?? 75 ?? B9 ?? ?? ?? ?? 66 39 48 18 75 ?? 33 DB 83 B8 84 ?? ?? ?? 0E 76 ?? 39 98 F8 ?? ?? ?? 0F 95 C3 89 5C 24 40 E8 ?? ?? ?? ?? 85 C0 75 ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 E8 ?? ?? ?? ?? 85 C0 79 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 79 ?? B9 08 ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 79 ?? B9 09 ?? ?? ?? E8 ?? ?? ?? ?? B9 01 ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B C8 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 44 0F B7 CE 4C 8B C0 33 D2 48 8B CF E8 ?? ?? ?? ?? 8B F8 89 44 24 20 85 DB 75 ?? 8B C8 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B C7 48 8B 5C 24 48 48 8B 74 24 50 48 83 C4 30 5F C3 }\n",
    " /*\n",
    "Disassembly take from entry0@0996a8e5ec1a41645309e2ca395d3a6b766a7c52784c974c776f258c1b25a76c\n",
    "\n",
    "┌ entry0 ();\n",
    "│           ; var int64_t var_20h @ rsp+0x20\n",
    "│           ; var int64_t var_40h @ rsp+0x40\n",
    "│           ; var int64_t var_10h @ rsp+0x48\n",
    "│           ; var int64_t var_18h @ rsp+0x50\n",
    "│           0x1400048b0      4883ec28       sub   rsp, 0x28\n",
    "│           0x1400048b4      e83f480000     call  fcn.1400090f8\n",
    "│           0x1400048b9      4883c428       add   rsp, 0x28\n",
    "│       ┌─< 0x1400048bd      e902000000     jmp   0x1400048c4\n",
    "        │   0x1400048c2      cc             int3\n",
    "        │   0x1400048c3      cc             int3\n",
    "│       │   ; CODE XREF from entry0 @ 0x1400048bd\n",
    "│       └─> 0x1400048c4      48895c2410     mov   qword [var_10h], rbx\n",
    "│           0x1400048c9      4889742418     mov   qword [var_18h], rsi\n",
    "│           0x1400048ce      57             push  rdi\n",
    "│           0x1400048cf      4883ec30       sub   rsp, 0x30\n",
    "│           0x1400048d3      e8741b0000     call  fcn.14000644c\n",
    "│           0x1400048d8      0fb7f0         movzx esi, ax\n",
    "│           0x1400048db      b902000000     mov   ecx, 2               ; int64_t arg1\n",
    "│           0x1400048e0      e8cb470000     call  fcn.1400090b0\n",
    "│           0x1400048e5      b84d5a0000     mov   eax, 0x5a4d          ; 'MZ'\n",
    "│           0x1400048ea      488d3d0fb7ff.  lea   rdi, [0x140000000]\n",
    "│           0x1400048f1      66390508b7ff.  cmp   word [0x140000000], ax ; [0x140000000:2]=0xffff\n",
    "│       ┌─< 0x1400048f8      7404           je    0x1400048fe\n",
    "│     ┌┌──> 0x1400048fa      33db           xor   ebx, ebx\n",
    "│    ┌────< 0x1400048fc      eb31           jmp   0x14000492f\n",
    "│    │╎╎└─> 0x1400048fe      48630537b7ff.  movsxd rax, dword [0x14000003c] ; [0x14000003c:4]=-1\n",
    "│    │╎╎    0x140004905      4803c7         add   rax, rdi\n",
    "│    │╎╎    0x140004908      813850450000   cmp   dword [rax], 0x4550\n",
    "│    │└───< 0x14000490e      75ea           jne   0x1400048fa\n",
    "│    │ ╎    0x140004910      b90b020000     mov   ecx, 0x20b           ; 523\n",
    "│    │ ╎    0x140004915      66394818       cmp   word [rax + 0x18], cx\n",
    "│    │ └──< 0x140004919      75df           jne   0x1400048fa\n",
    "│    │      0x14000491b      33db           xor   ebx, ebx\n",
    "│    │      0x14000491d      83b884000000.  cmp   dword [rax + 0x84], 0xe\n",
    "│    │  ┌─< 0x140004924      7609           jbe   0x14000492f\n",
    "│    │  │   0x140004926      3998f8000000   cmp   dword [rax + 0xf8], ebx\n",
    "│    │  │   0x14000492c      0f95c3         setne bl\n",
    "│    │  │   ; CODE XREF from entry0 @ 0x1400048fc\n",
    "│    └──└─> 0x14000492f      895c2440       mov   dword [var_40h], ebx\n",
    "│           0x140004933      e828100000     call  fcn.140005960\n",
    "│           0x140004938      85c0           test  eax, eax\n",
    "│       ┌─< 0x14000493a      7522           jne   0x14000495e\n",
    "│       │   0x14000493c      833de5af0100.  cmp   dword [0x14001f928], 1 ; [0x14001f928:4]=0\n",
    "│      ┌──< 0x140004943      7505           jne   0x14000494a\n",
    "│      ││   0x140004945      e8f21f0000     call  fcn.14000693c\n",
    "│      └──> 0x14000494a      b91c000000     mov   ecx, 0x1c            ; 28 ; int64_t arg1\n",
    "│       │   0x14000494f      e85c200000     call  fcn.1400069b0\n",
    "│       │   0x140004954      b9ff000000     mov   ecx, 0xff            ; 255 ; int64_t arg1\n",
    "│       │   0x140004959      e8aaf6ffff     call  fcn.140004008\n",
    "│       └─> 0x14000495e      e801320000     call  fcn.140007b64\n",
    "│           0x140004963      85c0           test  eax, eax\n",
    "│       ┌─< 0x140004965      7522           jne   0x140004989\n",
    "│       │   0x140004967      833dbaaf0100.  cmp   dword [0x14001f928], 1 ; [0x14001f928:4]=0\n",
    "│      ┌──< 0x14000496e      7505           jne   0x140004975\n",
    "│      ││   0x140004970      e8c71f0000     call  fcn.14000693c\n",
    "│      └──> 0x140004975      b910000000     mov   ecx, 0x10            ; 16 ; int64_t arg1\n",
    "│       │   0x14000497a      e831200000     call  fcn.1400069b0\n",
    "│       │   0x14000497f      b9ff000000     mov   ecx, 0xff            ; 255 ; int64_t arg1\n",
    "│       │   0x140004984      e87ff6ffff     call  fcn.140004008\n",
    "│       └─> 0x140004989      e8f2160000     call  fcn.140006080\n",
    "│           0x14000498e      90             nop\n",
    "│           0x14000498f      e838390000     call  fcn.1400082cc\n",
    "│           0x140004994      85c0           test  eax, eax\n",
    "│       ┌─< 0x140004996      790a           jns   0x1400049a2\n",
    "│       │   0x140004998      b91b000000     mov   ecx, 0x1b            ; 27 ; int64_t arg1\n",
    "│       │   0x14000499d      e8ae000000     call  fcn.140004a50\n",
    "│       └─> 0x1400049a2      ff1590c80000   call  qword [sym.imp.KERNEL32.dll_GetCommandLineA] ; [sym.imp.KERNEL32.dll_GetCommandLineA:8]=0x1befe reloc.KERNEL32.dll_GetCommandLineA ; LPSTR GetCommandLineA(void)\n",
    "│           0x1400049a8      48890599eb01.  mov   qword [0x140023548], rax ; [0x140023548:8]=0\n",
    "│           0x1400049af      e8f0470000     call  fcn.1400091a4\n",
    "│           0x1400049b4      4889051da301.  mov   qword [0x14001ecd8], rax ; [0x14001ecd8:8]=0\n",
    "│           0x1400049bb      e800430000     call  fcn.140008cc0\n",
    "│           0x1400049c0      85c0           test  eax, eax\n",
    "│       ┌─< 0x1400049c2      790a           jns   0x1400049ce\n",
    "│       │   0x1400049c4      b908000000     mov   ecx, 8               ; int64_t arg1\n",
    "│       │   0x1400049c9      e852f6ffff     call  fcn.140004020\n",
    "│       └─> 0x1400049ce      e8a9450000     call  fcn.140008f7c\n",
    "│           0x1400049d3      85c0           test  eax, eax\n",
    "│       ┌─< 0x1400049d5      790a           jns   0x1400049e1\n",
    "│       │   0x1400049d7      b909000000     mov   ecx, 9               ; int64_t arg1\n",
    "│       │   0x1400049dc      e83ff6ffff     call  fcn.140004020\n",
    "│       └─> 0x1400049e1      b901000000     mov   ecx, 1               ; int64_t arg1\n",
    "│           0x1400049e6      e87df6ffff     call  fcn.140004068\n",
    "│           0x1400049eb      85c0           test  eax, eax\n",
    "│       ┌─< 0x1400049ed      7407           je    0x1400049f6\n",
    "│       │   0x1400049ef      8bc8           mov   ecx, eax             ; int64_t arg1\n",
    "│       │   0x1400049f1      e82af6ffff     call  fcn.140004020\n",
    "│       └─> 0x1400049f6      e89d480000     call  fcn.140009298\n",
    "│           0x1400049fb      440fb7ce       movzx r9d, si\n",
    "│           0x1400049ff      4c8bc0         mov   r8, rax\n",
    "│           0x140004a02      33d2           xor   edx, edx\n",
    "│           0x140004a04      488bcf         mov   rcx, rdi             ; int64_t arg3\n",
    "│           0x140004a07      e854d9ffff     call  fcn.140002360\n",
    "│           0x140004a0c      8bf8           mov   edi, eax\n",
    "│           0x140004a0e      89442420       mov   dword [var_20h], eax\n",
    "│           0x140004a12      85db           test  ebx, ebx\n",
    "│       ┌─< 0x140004a14      7507           jne   0x140004a1d\n",
    "│       │   0x140004a16      8bc8           mov   ecx, eax             ; int64_t arg1\n",
    "│       │   0x140004a18      e887f9ffff     call  fcn.1400043a4\n",
    "│       └─> 0x140004a1d      e836f6ffff     call  fcn.140004058\n",
    "│       ┌─< 0x140004a22      eb17           jmp   0x140004a3b\n",
    "        │   0x140004a24      8bf8           mov   edi, eax\n",
    "        │   0x140004a26      837c244000     cmp   dword [rsp + 0x40], 0\n",
    "       ┌──< 0x140004a2b      7508           jne   0x140004a35\n",
    "       ││   0x140004a2d      8bc8           mov   ecx, eax\n",
    "       ││   0x140004a2f      e8ccf6ffff     call  fcn.140004100\n",
    "       ││   0x140004a34      cc             int3\n",
    "       └──> 0x140004a35      e80ef6ffff     call  fcn.140004048\n",
    "        │   0x140004a3a      90             nop\n",
    "│       │   ; CODE XREF from entry0 @ 0x140004a22\n",
    "│       └─> 0x140004a3b      8bc7           mov   eax, edi\n",
    "│           0x140004a3d      488b5c2448     mov   rbx, qword [var_10h]\n",
    "│           0x140004a42      488b742450     mov   rsi, qword [var_18h]\n",
    "│           0x140004a47      4883c430       add   rsp, 0x30\n",
    "│           0x140004a4b      5f             pop   rdi\n",
    "└           0x140004a4c      c3             ret\n",
    "\n",
    " */\n",
    "condition:\n",
    "\t$entry at pe.entry_point\n",
    "}\n",
    "```"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.12"
  },
  "vscode": {
   "interpreter": {
    "hash": "31f2aee4e71d21fbe5cf8b01ff0e069b9275f58929596ceb00d14d90e3e16cd6"
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}