admin/Yara-Rules-rules
1
0
Fork 0
mirror of https://github.com/Yara-Rules/rules synced 2026-06-08 12:58:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update MALW_DirtJumper.yar

Browse Source
This commit is contained in:
Marc Rivero López
2017-01-24 14:46:26 +01:00
committed by GitHub
parent d999990aea
commit d767fcc5b9
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
malware/MALW_DirtJumper.yar
+9
View File
@@ -5,11 +5,13 @@
rule DirtJumper_drive
{
meta:
author = "Jason Jones <jasonjones@arbor.net>"
date = "2013-08-26"
description = "Identify first version of drive DDoS malware"
source = "https://github.com/arbor/yara/blob/master/drive.yara"
strings:
$cmd1 = "-get" fullword
$cmd2 = "-ip" fullword
@@ -24,6 +26,7 @@ rule DirtJumper_drive
$str5 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT"
$newver1 = "-icmp"
$newver2 = "<xmp>"
condition:
4 of ($cmd*) and all of ($str*) and not any of ($newver*)
}
@@ -31,11 +34,13 @@ rule DirtJumper_drive
rule DirtJumper_drive2
{
meta:
author = "Jason Jones <jasonjones@arbor.net>"
date = "2013-08-26"
description = "Identify newer version of drive DDoS malware"
source = "https://github.com/arbor/yara/blob/master/drive2.yara"
strings:
$cmd1 = "-get" fullword
$cmd2 = "-ip" fullword
@@ -52,6 +57,7 @@ rule DirtJumper_drive2
$newver2 = "-byte"
$newver3 = "-long"
$newver4 = "<xmp>"
condition:
4 of ($cmd*) and all of ($str*) and all of ($newver*)
}
@@ -59,11 +65,13 @@ rule DirtJumper_drive2
rule DirtJumper_drive3
{
meta:
author = "Jason Jones <jasonjones@arbor.net>"
date = "2014-03-17"
description = "Identify version of Drive DDoS malware using compromised sites"
source = "https://github.com/arbor/yara/blob/master/drive3.yara"
strings:
$cmd1 = "-get" fullword
$cmd2 = "-ip" fullword
@@ -80,6 +88,7 @@ rule DirtJumper_drive3
$newver2 = "-byte"
$newver3 = "-long"
$drive3 = "99=1"
condition:
4 of ($cmd*) and all of ($str*) and all of ($newver*) and $drive3
}