File Decryption Using Gpg4win

 1title: File Decryption Using Gpg4win
 2id: 037dcd71-33a8-4392-bb01-293c94663e5a
 3status: experimental
 4description: Detects usage of Gpg4win to decrypt files
 5references:
 6    - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
 7    - https://www.gpg4win.de/documentation.html
 8    - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/
 9author: Nasreddine Bencherchali (Nextron Systems)
10date: 2023/08/09
11tags:
12    - attack.execution
13logsource:
14    category: process_creation
15    product: windows
16detection:
17    selection_metadata:
18        - Image|endswith:
19              - '\gpg.exe'
20              - '\gpg2.exe'
21        - Description: 'GnuPG’s OpenPGP tool'
22    selection_cli:
23        CommandLine|contains|all:
24            - ' -d '
25            - 'passphrase'
26    condition: all of selection_*
27falsepositives:
28    - Unknown
29level: medium

References

• BATLOADER: The Evasive Downloader Malware

  

  We explore the Batloader malware, its history, attributes, how it is delivered, the infection chain, and Carbon Black’s detection capabilities.

  
  Read More

• Gpg4win - Documentation

  Documentation The Gpg4win Compendium is an old style documentation to get into the world of cryptography. Using the example of Gpg4win, you learn step by step the secure use of Kleopatra, GpgEX and...

  
  Read More

• Zloader Installs Remote Access Backdoors and Delivers Cobalt Strike

  

  Zloader is a banking trojan with historical ties to the Zeus malware.  Recently, Egregor and Ryuk ransomware affiliates used Zloader for the initial point of entry. Zloader featured VNC remote acce…

  
  Read More

Related rules

• Abusable DLL Potential Sideloading From Suspicious Location
• Adwind RAT / JRAT
• Adwind RAT / JRAT File Artifact
• Antivirus Hacktool Detection
• Azure Kubernetes CronJob