From ecc32ca18df8cd7f885916d1f616d8dc0841b87b Mon Sep 17 00:00:00 2001 From: PYDT <85057800+87owo@users.noreply.github.com> Date: Mon, 25 Mar 2024 14:25:40 +0800 Subject: [PATCH] Add files via upload --- PYAS.py | 57 ++++++++++---- PYAS_Rules.py | 211 ++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 254 insertions(+), 14 deletions(-) create mode 100644 PYAS_Rules.py diff --git a/PYAS.py b/PYAS.py index ffb5c5c..ba65fec 100644 --- a/PYAS.py +++ b/PYAS.py @@ -4,6 +4,7 @@ import xml.etree.ElementTree as xmlet import requests, pyperclip, win32file import win32gui, win32api, win32con from PYAS_Engine import ListSimHash +from PYAS_Rules import pyasrule_dict from PYAS_Extension import slist, alist from PYAS_Language import translate_dict from PYAS_Interface import Ui_MainWindow @@ -841,21 +842,25 @@ class MainWindow_Controller(QMainWindow): try: label, level = self.api_scan(file) if file != self.pyas and level > 50: - return f"{label}" + return f"{label}/Cloud.{level}" elif file != self.pyas and level > 10: - label_2, level_2 = self.pe_scan(file) - #print(label_2, level_2, file) - if "White" not in label_2 and "Unknown" not in label_2: - return f"{label_2}" - elif "Unknown" in label_2 and self.json["high_sensitive"]: - return f"{label_2}" + label_2, level_2 = self.rule_scan(file) + if label_2 and level_2: + return f"{label_2}/Rules.{level_2}" + label_3, level_3 = self.pe_scan(file) + if "White" not in label_3 and "Unknown" not in label_3: + return f"{label_3}/Pefile.{level_3}" + elif "Unknown" in label_3 and self.json["high_sensitive"]: + return f"{label_3}/Pefile.{level_3}" elif file != self.pyas and not level: - label_2, level_2 = self.pe_scan(file) - #print(label_2, level_2, file) - if "White" not in label_2 and "Unknown" not in label_2: - return f"{label_2}" - elif "Unknown" in label_2 and self.json["high_sensitive"]: - return f"{label_2}" + label_2, level_2 = self.rule_scan(file) + if label_2 and level_2: + return f"{label_2}/Rules.{level_2}" + label_3, level_3 = self.pe_scan(file) + if "White" not in label_3 and "Unknown" not in label_3: + return f"{label_3}/Pefile.{level_3}" + elif "Unknown" in label_3 and self.json["high_sensitive"]: + return f"{label_3}/Pefile.{level_3}" return False except: return False @@ -888,7 +893,8 @@ class MainWindow_Controller(QMainWindow): except: pass QApplication.processEvents() - return self.pe.predict(fn) + label, level = self.pe.predict(fn) + return label, int(level*100) except: return False, False @@ -899,6 +905,29 @@ class MainWindow_Controller(QMainWindow): except: return True + def rule_scan(self, file): + try: + ftype = str(f".{file.split('.')[-1]}").lower() + with open(file, 'r', encoding="iso-8859-1") as f: + content = f.read().lower() + for rule, value in pyasrule_dict.items(): + QApplication.processEvents() + if ftype in value["settings"]["types"]: + for match, matchs in value["matchs"].items(): + counts = 0 + for string in matchs: + text = value["strings"][string] + if value["settings"]["nocase"]: + text = text.lower() + if text in content: + counts += 1 + if counts >= value["settings"]["count"]: + label = value["abouts"]["label"] + return label, rule + return False, False + except: + return False, False + def proc_scan(self, p): try: if isinstance(p, str) and os.path.exists(p): diff --git a/PYAS_Rules.py b/PYAS_Rules.py new file mode 100644 index 0000000..c82fa0d --- /dev/null +++ b/PYAS_Rules.py @@ -0,0 +1,211 @@ +pyasrule_dict = { + "A": { # 規則項目名稱 Rules_1 + "abouts": { + "author": "PYAS Security", # 作者 PYAS Security + "version": "1.0.0", # 版本 1.0.0 + "label": "Trojan", # 類別資訊 + "description": "Malware pattern"}, # 說明 Malware pattern + "strings": { + 1: "physicaldrive0", # 所有包含匹配字串 1 + 2: "512", # 所有包含匹配字串 2 + 3: "MBR", # 所有包含匹配字串 3 + 4: "x55", # 所有包含匹配字串 4 + 5: "pyi-runtime-tmpdir"}, # 所有包含匹配字串 5 + "settings": { + "count": 4, # 最低匹配數量 4 + "nocase": True, # 不分大寫小寫 True + "types": [".exe", ".dll", ".sys"]}, # 匹配文件類別 . + "matchs": { + "match1": list(range(1, 5)), # 局部匹配範圍 1 (1~4) + "match2": list(range(2, 6))}}, # 局部匹配範圍 2 (2~5) + + "B": { + "abouts": { + "author": "PYAS Security", + "version": "1.0.0", + "label": "Trojan", + "description": "Malware pattern"}, + "strings": { + 1: "%0|%0", + 2: "ExclusionPath", + 3: "cmdkey", + 4: "eiculwo"}, + "settings": { + "count": 1, + "nocase": True, + "types": [".bat", ".cmd", ".ps1", ".js", ".vbs"]}, + "matchs": { + "match1": list(range(1, 5))}}, + + "C": { + "abouts": { + "author": "PYAS Security", + "version": "1.0.0", + "label": "Trojan", + "description": "Malware pattern"}, + "strings": { + 1: "ProcessHacker", + 2: "MpCmdRun", + 3: "ConfigSecurityPolicy", + 4: "Client", + 5: "procexp", + 6: "MSASCui", + 7: "MsMpEng", + 8: "MpUXSrv", + 9: "CloseMutex", + 10: "NisSrv", + 11: "Regedit", + 12: "PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY", + 13: "dwProcessHandle", + 14: "Anti_Process", + 15: "MutexControl", + 16: "MSConfig"}, + "settings": { + "count": 6, + "nocase": True, + "types": [".exe", ".dll", ".sys"]}, + "matchs": { + "match1": list(range(1, 17))}}, + + "D": { + "abouts": { + "author": "PYAS Security", + "version": "1.0.0", + "label": "Trojan", + "description": "Malware pattern"}, + "strings": { + 1: "shell\\open", + 2: "exefile", + 3: "batfile", + 4: "comfile", + 5: "regfile", + 6: "mscfile", + 7: "cmdfile", + 8: "Image File Execution Options", + 9: "CurrentVersion"}, + "settings": { + "count": 3, + "nocase": True, + "types": [".exe", ".dll", ".sys"]}, + "matchs": { + "match1": list(range(1, 10))}}, + + "E": { + "abouts": { + "author": "PYAS Security", + "version": "1.0.0", + "label": "Trojan", + "description": "Malware pattern"}, + "strings": { + 1: "kill", + 2: "PYAS", + 3: "lsass", + 4: "csrss", + 5: "smss", + 6: "taskmgr", + 7: "svchost"}, + "settings": { + "count": 3, + "nocase": True, + "types": [".exe", ".dll", ".sys"]}, + "matchs": { + "match1": list(range(1, 8))}}, + + "F": { + "abouts": { + "author": "PYAS Security", + "version": "1.0.0", + "label": "Trojan", + "description": "Malware pattern"}, + "strings": { + 1: "NoControlPanel", + 2: "NoFileMenu", + 3: "NoFind", + 4: "NoRealMode", + 5: "NoRecentDocsMenu", + 6: "NoSetFolders", + 7: "NoSetFolderOptions", + 8: "NoViewOnDrive", + 9: "NoDesktop", + 10: "NoAddingComponents", + 11: "NoLogOff", + 12: "NoFolderOptions", + 13: "DisableCMD", + 14: "NoViewContexMenu", + 15: "HideClock", + 16: "Wallpaper", + 17: "NoStartMenuMorePrograms", + 18: "NoStartMenuMyGames", + 19: "NoStartMenuMyMusic", + 20: "NoStartMenuNetworkPlaces", + 21: "NoStartMenuPinnedList", + 22: "NoActiveDesktop", + 23: "NoSetActiveDesktop", + 24: "NoActiveDesktopChanges", + 25: "NoChangeStartMenu", + 26: "ClearRecentDocsOnExit", + 27: "NoFavoritesMenu", + 28: "DisableLockWorkstation", + 29: "NoSetTaskbar", + 30: "NoSMHelp", + 31: "NoTrayContextMenu", + 32: "NoViewContextMenu", + 33: "NoWindowsUpdate", + 34: "NoComponents", + 35: "NoWinKeys", + 36: "StartMenuLogOff", + 37: "NoSimpleNetlDList", + 38: "NoLowDiskSpaceChecks", + 39: "Restrict_Run", + 40: "NoManageMyComputerVerb", + 41: "DisableTaskMgr", + 42: "DisableRegistryTools", + 43: "DisableChangePassword"}, + "settings": { + "count": 2, + "nocase": True, + "types": [".exe", ".dll", ".sys"]}, + "matchs": { + "match1": list(range(1, 44))}}, + + "G": { + "abouts": { + "author": "PYAS Security", + "version": "1.0.0", + "label": "Ransom", + "description": "Malware pattern"}, + "strings": { + 1: "certutil", + 2: "encode", + 3: "decode", + 4: "random"}, + "settings": { + "count": 4, + "nocase": True, + "types": [".bat", ".cmd", ".ps1", ".js", ".vbs"]}, + "matchs": { + "match1": list(range(1, 5))}}, + + "H": { + "abouts": { + "author": "PYAS Security", + "version": "1.0.0", + "label": "Trojan", + "description": "Malware pattern"}, + "strings": { + 1: "%userprofile%", + 2: "C:\\Windows", + 3: "%SYSTEMROOT%", + 4: "%WINDIR%", + 5: "%SYSTEMDRIVE%", + 6: "%TEMP%", + 7: "%TMP%", + 8: "del"}, + "settings": { + "count": 4, + "nocase": True, + "types": [".bat", ".cmd", ".ps1", ".js", ".vbs"]}, + "matchs": { + "match1": list(range(1, 9))}}, + +}