admin/ditekshen-detection
1
0
Fork 0
mirror of https://github.com/ditekshen/detection synced 2026-06-08 13:49:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix false detection

Browse Source
This commit is contained in:
ditekshen
2023-12-30 21:11:45 +03:00
parent 59bcc4cdd6
commit e6a95b7968
1 changed files with 26 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
yara/malware.yar
+26 -16
View File
@@ -2669,23 +2669,8 @@ rule MALWARE_Win_RedLine {
$v6_4 = "AppData\\Roaming\\ //settString.Replaceing[@name=\\UString.Replacesername\\]/vaString.Replaceluemoz_cookies" wide
$v6_5 = "<GetWindowsVersion>g__HKLM_GetString|11_0" fullword ascii
$v6_6 = "net.tcp://" fullword wide
// variant
$v7_1 = "! #\"'&(&*)>=@?POQOROSOTOUOVOWOXOYOZO[O^]{z|z}z~z" fullword wide
$v7_2 = "{0}{1}{2}" fullword wide
$v7_3 = "localhost" fullword wide
$v7_4 = "\\tdata" fullword wide
$v7_5 = "DecryptBlob" fullword ascii
$v7_6 = "GetMac" fullword ascii
$v7_7 = "GetHdc" fullword ascii
$v7_8 = "FindProc" fullword ascii
$v7_9 = "targetPid" fullword ascii
$v7_10 = "MessageSecurityOverTcp" fullword ascii
$v7_11 = "ListOfProcesses" fullword ascii
$v7_12 = "ListOfPrograms" fullword ascii
$v7_13 = "browserPaths" fullword ascii
$v7_14 = "configs" fullword ascii
condition:
(uint16(0) == 0x5a4d and (all of ($s*) or 2 of ($x*) or 7 of ($u*) or 7 of ($pat*) or (1 of ($x*) and (5 of ($u*) or 2 of ($pat*))) or 5 of ($v2*) or 4 of ($v3*) or (3 of ($v2*) and (2 of ($pat*) or 2 of ($u*)) or (1 of ($vx4*) and 5 of ($v4*)) or 5 of ($v4*) or 6 of ($v5*)) or 5 of ($v6*) or (4 of ($v6*) and 3 of them ) or (7 of ($v7*)))) or ((all of ($x*) and 4 of ($s*)) or (4 of ($v6*) and 4 of them))
(uint16(0) == 0x5a4d and (all of ($s*) or 2 of ($x*) or 7 of ($u*) or 7 of ($pat*) or (1 of ($x*) and (5 of ($u*) or 2 of ($pat*))) or 5 of ($v2*) or 4 of ($v3*) or (3 of ($v2*) and (2 of ($pat*) or 2 of ($u*)) or (1 of ($vx4*) and 5 of ($v4*)) or 5 of ($v4*) or 6 of ($v5*)) or 5 of ($v6*) or (4 of ($v6*) and 3 of them ))) or ((all of ($x*) and 4 of ($s*)) or (4 of ($v6*) and 4 of them))
}
rule MALWARE_Win_Bandook {
@@ -11427,3 +11412,28 @@ rule MALWARE_Win_UmbralStealer {
condition:
uint16(0) == 0x5a4d and (1 of ($x*) or 5 of ($s*) or (3 of ($s*) and 4 of ($c*)))
}
rule MALWARE_Win_MetaStealer {
meta:
author = "ditekSHen"
description = "Detects MetaStealer infostealer"
strings:
$s1 = "! #\"'&(&*)>=@?POQOROSOTOUOVOWOXOYOZO[O^]{z|z}z~z" fullword wide
$s2 = "{0}{1}{2}" fullword wide
$s3 = "localhost" fullword wide
$s4 = "\\tdata" fullword wide
$s5 = "DecryptBlob" fullword ascii
$s6 = "GetMac" fullword ascii
$s7 = "GetHdc" fullword ascii
$s8 = "FindProc" fullword ascii
$s9 = "targetPid" fullword ascii
$s10 = "MessageSecurityOverTcp" fullword ascii
$s11 = "ListOfProcesses" fullword ascii
$s12 = "ListOfPrograms" fullword ascii
$s13 = "browserPaths" fullword ascii
$s14 = "configs" fullword ascii
$s15 = "scanners" fullword ascii
$s16 = "FileScannerRule" fullword ascii
condition:
uint16(0) == 0x5a4d and 7 of ($s*)
}