From a2bf7b60c2d1bc1d34531d33f191f34773cbdb95 Mon Sep 17 00:00:00 2001
From: mmorenog <mmorenog@users.noreply.github.com>
Date: Thu, 9 Jun 2016 09:52:55 +0200
Subject: [PATCH] Create APT_Win_Pipcreat.yar

---
 malware/APT_Win_Pipcreat.yar | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 malware/APT_Win_Pipcreat.yar

diff --git a/malware/APT_Win_Pipcreat.yar b/malware/APT_Win_Pipcreat.yar
new file mode 100644
index 0000000..5a662d8
--- /dev/null
+++ b/malware/APT_Win_Pipcreat.yar
@@ -0,0 +1,25 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+
+rule APT_Win_Pipcreat { 
+  meta: 
+    author = "chort (@chort0)"
+    description = "APT backdoor Pipcreat"
+    filetype = "pe,dll" 
+    date = "2013-03"
+    MD5 = "f09d832bea93cf320986b53fce4b8397" // (incorrectly?) identified as Hupigon by many AV on VT 
+    Reference = "http://www.cyberengineeringservices.com/login-exe-analysis-trojan-pipcreat/"
+    version = "1.0"
+  strings: 
+    $strA = "pip creat failed" wide fullword 
+    $strB = "CraatePipe" ascii fullword 
+    $strC = "are you there? " wide fullword 
+    $strD = "success kill process ok" wide fullword 
+    $strE = "Vista|08|Win7" wide fullword 
+    $rut = "are you there!@#$%^&*()_+" ascii fullword 
+    
+  condition: 
+    $rut or (2 of ($str*)) 
+  }