admin/ditekshen-detection
1
0
Fork 0
mirror of https://github.com/ditekshen/detection synced 2026-06-08 13:49:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update Fiber of other variants

Browse Source
This commit is contained in:
ditekshen
2023-08-11 12:51:24 +03:00
parent c5edde1e74
commit acbc315234
1 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
yara/malware.yar
+15 -1
View File
@@ -10808,6 +10808,20 @@ rule MALWARE_Win_Fiber {
$i6 = "MSBuild.exe" fullword wide
$i7 = "RegAsm.exe" fullword wide
$i8 = "RegSvcs.exe" fullword wide
$v1 = "is tampered" wide
$v2 = "Debugger Detected" wide
$v3 = "RepositoryUrl" ascii
$v4 = { 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00
74 00 75 00 61 00 6c 00 20 00 00 0b 41 00 6c 00
6c 00 6f 00 63 00 00 0d 57 00 72 00 69 00 74 00
65 00 20 00 00 11 50 00 72 00 6f 00 63 00 65 00
73 00 73 00 20 00 00 0d 4d 00 65 00 6d 00 6f 00
72 00 79 00 00 0f 50 00 72 00 6f 00 74 00 65 00
63 00 74 00 00 0b 4f 00 70 00 65 00 6e 00 20 00
00 0f 50 00 72 00 6f 00 63 00 65 00 73 00 73 00
00 0d 43 00 6c 00 6f 00 73 00 65 00 20 00 00 0d
48 00 61 00 6e 00 64 00 6c 00 65 00 00 0f 6b 00
65 00 72 00 6e 00 65 00 6c }
condition:
uint16(0) == 0x5a4d and ((1 of ($x*) and 3 of ($s*) and 2 of ($i*)) or (4 of ($s*) and 4 of ($i*)) or (2 of ($s*) and 6 of ($i*)))
uint16(0) == 0x5a4d and ((1 of ($x*) and 3 of ($s*) and 2 of ($i*)) or (4 of ($s*) and 4 of ($i*)) or (2 of ($s*) and 6 of ($i*)) or (1 of ($x*) and 3 of ($v*)) or (all of ($v*)))
}