Merge pull request #382 from elastic/issue-380

Issue 380

Author: peasead

blog/climbing-the-pyramid-with-celestial-themed-malware/README.MD

@@ -0,0 +1,17 @@
+# Climbing the Pyramid with Celestial-themed Malware
+
+## Abstract
+The Deimos trojan (AKA Jupyter Infostealer, SolarMarker) is a malware tool first reported in 2020, but has been in active development and employs advanced defensive countermeasures used to frustrate analysis. This post details the campaign TTPs through the malware indicators.
+
+## URL
+
+## Artifacts
+Artifacts and code snippets from the blog post.
+
+| Artifact | Description | Note |  
+| - | - | - |
+| f268491d2f7e9ab562a239ec56c4b38d669a7bd88181efb0bd89e450c68dd421 | Lure file | - |  
+| af1e952b5b02ca06497e2050bd1ce8d17b9793fdb791473bdae5d994056cb21f | Malware installer | - |  
+| d6e1c6a30356009c62bc2aa24f49674a7f492e5a34403344bfdd248656e20a54 | .NET DLL file | - |  
+| 216[.]230[.]232[.]134 | Command and control | - |  
+| [Deimos YARA Rule](windows_trojan_deimos.yar) | YARA rule to identify the Deimos DLL file. | - |  

blog/climbing-the-pyramid-with-celestial-themed-malware/windows_trojan_deimos.yar

@@ -0,0 +1,23 @@
+rule Windows_Trojan_Deimos_DLL {
+    meta:
+        author = "Elastic Security"
+        creation_date = "2021-09-18"
+        last_modified = "2021-09-18"
+        os = "Windows"
+        arch = "x86"
+        category_type = "Trojan"
+        family = "Deimos"
+        threat_name = "Windows.Trojan.Deimos"
+        description = "Detects the presence of the Deimos trojan DLL file."
+        reference = ""
+        reference_sample = "2c1941847f660a99bbc6de16b00e563f70d900f9dbc40c6734871993961d3d3e"
+
+    strings:
+        $a1 = "\\APPDATA\\ROAMING" wide fullword
+        $a2 = "{\"action\":\"ping\",\"" wide fullword
+        $a3 = "Deimos" ascii fullword
+        $b1 = { 00 57 00 58 00 59 00 5A 00 5F 00 00 17 75 00 73 00 65 00 72 00 }
+        $b2 = { 0C 08 16 1F 68 9D 08 17 1F 77 9D 08 18 1F 69 9D 08 19 1F 64 9D }
+    condition:
+        all of ($a*) or 1 of ($b*)
+}