admin/ditekshen-detection
1
0
Fork 0
mirror of https://github.com/ditekshen/detection synced 2026-06-08 13:49:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add and update rules

Browse Source
This commit is contained in:
ditekshen
2024-02-22 15:26:54 +03:00
parent 5fc671f9f4
commit a896a95adc
1 changed files with 37 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
yara/indicator_suspicious.yar
+37
View File
@@ -2232,6 +2232,16 @@ rule INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs {
$s93 = "gojhcdgcpbpfigcaejpfhfegekdgiblk" ascii wide nocase // Opera Wallet
$s94 = "djclckkglechooblngghdinmeemkbgci" ascii wide nocase // MetaMask
$s95 = "jnmbobjmhlngoefaiojfljckilhhlhcj" ascii wide nocase // OneKey
$s96 = "jiidiaalihmmhddjgbnbgdfflelocpak" ascii wide nocase // Bitget Wallet
$s97 = "knhkeligkfmclgkeedceenpopaleokfh" ascii wide nocase // Tippin
$s98 = "agoakfejjabomempkjlepdflaleeobhb" ascii wide nocase // Core | Crypto Wallet
$s99 = "lgmpcpglpngdoalbgeoldeajfclnhafa" ascii wide nocase // SafePal
$s100 = "opcgpfmipidbgpenhmajoajpbobppdil" ascii wide nocase // Sui Wallet
$s101 = "nphplpgoakhhjchkkhmiggakijnkhfnd" ascii wide nocase // TON Wallet
$s102 = "bkklifkecemccedpkhcebagjpehhabfb" ascii wide nocase // MetaWallet
$s103 = "eajafomhmkipbjmfmhebemolkcicgfmd" ascii wide nocase // Taho
$s104 = "ebfidpplhabeedpnhjnobghokpiioolj" ascii wide nocase // Fewcha Move Wallet
$s105 = "lccbohhgfkdikahanoclbdmaolidjdfl" ascii wide nocase // Vigvam
condition:
(uint16(0) == 0x5a4d and 6 of them) or (12 of them)
}
@@ -2592,3 +2602,30 @@ rule INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs {
condition:
uint16(0) == 0x5a4d and 10 of them
}
rule INDICATOR_SUSPICIOUS_EXE_Crypto_Wallet_Regex {
meta:
author = "ditekSHen"
description = "Detects executables referencing cryptocurrency wallet regular expressions"
strings:
$s1 = "^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,39}$" ascii wide nocase // Bitcoin (BTC)
$s2 = "(?:^[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}$)" ascii wide nocase // Litecoin (LTC)
$s3 = "(?:^0x[a-fA-F0-9]{40}$)" ascii wide nocase // Ethereum (ETH)
$s4 = "(?:^G[0-9a-zA-Z]{55}$)" ascii wide nocase // Stellar Lumens (XLM)
$s5 = "^4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}$)" ascii wide nocase // Monero (XMR)
$s6 = "(^[1-9A-HJ-NP-Za-km-z]{44}$)" ascii wide nocase // Solana (SOL)
$s7 = "T[A-Za-z1-9]{33}" ascii wide nocase // Tezos (XTZ)
$s8 = "(?:^r[0-9a-zA-Z]{24,34}$)" ascii wide nocase // Ripple (XRP)
$s9 = "^((bitcoincash:)?(q|p)[a-z0-9]{41})" ascii wide nocase // Bitcoin Cash (BCH)
$s10 = "(?:^X[1-9A-HJ-NP-Za-km-z]{33}$)" ascii wide nocase //Dash (DASH)
$s11 = "(?:^A[0-9a-zA-Z]{33}$)" ascii wide nocase // Ontology (ONT)
$s12 = "D{1}[5-9A-HJ-NP-U]{1}[1-9A-HJ-NP-Za-km-z]{32}" ascii wide nocase // Dogecoin (DOGE)
$s13 = "(^0x[A-Za-z0-9]{40,40}?[\\d\\- ])|(^0x[A-Za-z0-9]{40,40})$" ascii wide nocase
$s14 = "(^D[A-Za-z0-9]{32,35}?[\\d\\- ])|(^D[A-Za-z0-9]{32,35})$" ascii wide nocase
$s15 = "^([13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})$" ascii wide nocase
$s16 = "(^X[A-Za-z0-9]{32,34}?[\\d\\- ])|(^X[A-Za-z0-9]{32,34})|(^7[A-Za-z0-9]{32,34})$" ascii wide nocase
$s17 = "(^t[A-Za-z0-9]{32,36})$" ascii wide nocase
$s18 = "(^(GD|GC)[A-Z0-9]{54,56})$" ascii wide nocase
condition:
(uint16(0) == 0x5a4d and 3 of them) or (5 of them)
}