Detections

Analysis of KongTuke FileFix Leads to New Interlock RAT Variant

KongTuke FileFix Execution and Interlock RAT Persistence

sigma · generated; parse required before publication

title: KongTuke FileFix Execution and Interlock RAT Persistence
description: Detects KongTuke utility abusing scheduled tasks to establish Interlock
  RAT persistence.
logsource:
  product: windows
  service: security
detection:
  selection:
    ParentImage: '*\powershell.exe'
    CommandLine: '*schtasks*/create*/tn*Interlock*'
  condition: selection
level: medium
tags: []
references: []

MAL_RAT_Interlock_KongTuke

yara · compile required before publication

rule MAL_RAT_Interlock_KongTuke {
  strings:
    $s1 = "KongTuke_FileFix_Init" ascii wide nocase
    $s2 = "Interlock_RAT_Channel_V3" ascii wide nocase
    $s3 = "AES_CBC_DecKey_Session" ascii wide nocase
  condition:
    any of them
}