-
Notifications
You must be signed in to change notification settings - Fork 159
/
encrypt-data-using-tea.yml
executable file
·47 lines (47 loc) · 1.53 KB
/
encrypt-data-using-tea.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
rule:
meta:
name: encrypt data using TEA
namespace: data-manipulation/encryption/tea
authors:
- william.ballenthin@mandiant.com
- raymond.leong@mandiant.com
scopes:
static: function
dynamic: unsupported # requires operand[1].number, characteristic, mnemonic, Not features
att&ck:
- Defense Evasion::Obfuscated Files or Information [T1027]
mbc:
- Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]
references:
- https://en.wikipedia.org/wiki/Tiny_Encryption_Algorithm
examples:
- 44461306A604D2CD9883C2BB623AF276:0x10004810
features:
- and:
- basic block:
- and:
- instruction:
- mnemonic: shr
- operand[1].number: 0x5
- instruction:
- mnemonic: shl
- operand[1].number: 0x4
- count(mnemonic(shr)): 0x2
- characteristic: nzxor
- or:
- operand[1].number: 0x9E3779B9 = key schedule constant
- operand[1].number: 0x61C88647 = key schedule constant two's complement
- not:
- or:
- number: 0xC6EF3720 = sum, only used in decryption
- basic block:
- and:
- description: q setup only in XXTEA
- instruction:
- mnemonic: mov
- operand[1].number: 0x34
- instruction:
- mnemonic: add
- operand[1].number: 0x6
- instruction:
- mnemonic: idiv