From 52e256a4525b29b97b4e11c72700a902edd90bc9 Mon Sep 17 00:00:00 2001
From: Simon Sigre <simon.sigre@gmail.com>
Date: Fri, 26 Jan 2018 12:00:51 +1100
Subject: [PATCH] Create RAT_CrossRAT.yar

---
 malware/RAT_CrossRAT.yar | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 malware/RAT_CrossRAT.yar

diff --git a/malware/RAT_CrossRAT.yar b/malware/RAT_CrossRAT.yar
new file mode 100644
index 0000000..be5a9e3
--- /dev/null
+++ b/malware/RAT_CrossRAT.yar
@@ -0,0 +1,27 @@
+import "hash" 
+
+global private rule javaarchive
+{
+    strings:
+        $magic = { 50 4b 03 04 ( 14 | 0a ) 00 }
+        $string_1 = "META-INF/"
+        $string_2 = ".class" nocase
+
+	condition:
+	    filesize < 400KB and
+        $magic at 0 and 1 of ($string_*)
+}
+
+rule CrossRAT: RAT
+{
+    meta:
+        description = "Detects CrossRAT known hash"
+        author = "Simon Sigre (simon.sigre@gmail.com)"
+        date = "26/01/2018"
+        ref = "https://simonsigre.com"
+        ref= "https://objective-see.com/blog/blog_0x28.html"
+
+    condition:
+        filesize < 400KB and
+        hash.md5(0, filesize) == "85b794e080d83a91e904b97769e1e770"
+}