admin/roadwy-DefenderYara
1
0
Fork 0
mirror of https://github.com/roadwy/DefenderYara synced 2026-06-21 14:08:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

update 20250709

Browse Source
This commit is contained in:
roadwy
2025-08-11 11:04:57 +08:00
parent 63fedb45b4
commit 95d7a68c35
3661 changed files with 109947 additions and 40653 deletions
Download Patch File Download Diff File Expand all files Collapse all files
#PUA/Block/_#PUA_Block_InstallCore.yar
+19 -6
View File
@@ -20,6 +20,19 @@ rule _#PUA_Block_InstallCore_2{
}
rule _#PUA_Block_InstallCore_3{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 "
strings :
$a_80_0 = {72 70 2e 44 61 64 61 66 61 72 61 64 61 2e 63 6f 6d } //rp.Dadafarada.com 2
$a_80_1 = {53 4b 49 50 5f 4f 46 46 45 52 } //SKIP_OFFER 1
$a_80_2 = {6f 66 66 65 72 5f 68 74 6d 6c 2e 68 74 6d 6c } //offer_html.html 1
$a_80_3 = {77 77 77 2e 78 73 34 61 6c 6c 2e 6e 6c } //www.xs4all.nl 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5
}
rule _#PUA_Block_InstallCore_4{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 "
@@ -31,7 +44,7 @@ rule _#PUA_Block_InstallCore_3{
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=3
}
rule _#PUA_Block_InstallCore_4{
rule _#PUA_Block_InstallCore_5{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -45,7 +58,7 @@ rule _#PUA_Block_InstallCore_4{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_InstallCore_5{
rule _#PUA_Block_InstallCore_6{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
@@ -58,7 +71,7 @@ rule _#PUA_Block_InstallCore_5{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_InstallCore_6{
rule _#PUA_Block_InstallCore_7{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -72,7 +85,7 @@ rule _#PUA_Block_InstallCore_6{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_InstallCore_7{
rule _#PUA_Block_InstallCore_8{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 "
@@ -87,7 +100,7 @@ rule _#PUA_Block_InstallCore_7{
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=5
}
rule _#PUA_Block_InstallCore_8{
rule _#PUA_Block_InstallCore_9{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 "
@@ -103,7 +116,7 @@ rule _#PUA_Block_InstallCore_8{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*-100+(#a_80_6 & 1)*-100) >=5
}
rule _#PUA_Block_InstallCore_9{
rule _#PUA_Block_InstallCore_10{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 "
#PUA/Block/_#PUA_Block_KuaiZip.yar
+66 -29
View File
@@ -11,6 +11,19 @@ rule _#PUA_Block_KuaiZip{
}
rule _#PUA_Block_KuaiZip_2{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 "
strings :
$a_80_0 = {6d 65 64 69 61 76 2e 73 68 7a 68 61 6e 6d 65 6e 67 2e 63 6f 6d } //mediav.shzhanmeng.com 2
$a_80_1 = {31 32 2e 67 69 66 } //12.gif 1
$a_80_2 = {75 70 5f 75 72 6c 73 2e 69 6e 69 } //up_urls.ini 1
$a_80_3 = {55 72 6c 52 65 70 6f 72 } //UrlRepor 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_3{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 "
@@ -23,7 +36,19 @@ rule _#PUA_Block_KuaiZip_2{
((#a_80_0 & 1)*1+(#a_00_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=3
}
rule _#PUA_Block_KuaiZip_3{
rule _#PUA_Block_KuaiZip_4{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 "
strings :
$a_80_0 = {68 6f 74 6e 65 77 73 2e 64 66 74 6f 75 74 69 61 6f 2e 63 6f 6d } //hotnews.dftoutiao.com 2
$a_80_1 = {6b 75 61 69 7a 69 70 72 65 70 6f 72 74 2f 6d 69 6e 69 6e 65 77 73 } //kuaizipreport/mininews 1
$a_80_2 = {74 69 61 6e 71 69 2e 65 61 73 74 64 61 79 2e 63 6f 6d } //tianqi.eastday.com 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_5{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 00 "
@@ -37,7 +62,7 @@ rule _#PUA_Block_KuaiZip_3{
((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=7
}
rule _#PUA_Block_KuaiZip_4{
rule _#PUA_Block_KuaiZip_6{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
@@ -50,7 +75,7 @@ rule _#PUA_Block_KuaiZip_4{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_5{
rule _#PUA_Block_KuaiZip_7{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -64,7 +89,7 @@ rule _#PUA_Block_KuaiZip_5{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_6{
rule _#PUA_Block_KuaiZip_8{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -78,7 +103,7 @@ rule _#PUA_Block_KuaiZip_6{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_7{
rule _#PUA_Block_KuaiZip_9{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
@@ -93,7 +118,19 @@ rule _#PUA_Block_KuaiZip_7{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6
}
rule _#PUA_Block_KuaiZip_8{
rule _#PUA_Block_KuaiZip_10{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 "
strings :
$a_80_0 = {44 3a 5c 77 6f 72 6b 73 70 61 63 65 5c 73 76 6e 5c 70 68 6f 74 6f 76 69 65 77 65 72 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 72 65 63 65 6e 74 76 69 65 77 2e 70 64 62 } //D:\workspace\svn\photoviewer\bin\Release\recentview.pdb 2
$a_80_1 = {53 6f 66 74 77 61 72 65 5c 50 68 6f 74 6f 56 69 65 77 65 72 5c 55 70 64 61 74 65 43 68 65 63 6b 65 72 } //Software\PhotoViewer\UpdateChecker 1
$a_80_2 = {73 6b 69 6e 33 2e 6a 70 67 } //skin3.jpg 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_11{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -107,7 +144,7 @@ rule _#PUA_Block_KuaiZip_8{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_9{
rule _#PUA_Block_KuaiZip_12{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
@@ -123,7 +160,7 @@ rule _#PUA_Block_KuaiZip_9{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_KuaiZip_10{
rule _#PUA_Block_KuaiZip_13{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -137,7 +174,7 @@ rule _#PUA_Block_KuaiZip_10{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_11{
rule _#PUA_Block_KuaiZip_14{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
@@ -150,7 +187,7 @@ rule _#PUA_Block_KuaiZip_11{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_12{
rule _#PUA_Block_KuaiZip_15{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 "
@@ -163,7 +200,7 @@ rule _#PUA_Block_KuaiZip_12{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=3
}
rule _#PUA_Block_KuaiZip_13{
rule _#PUA_Block_KuaiZip_16{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -177,7 +214,7 @@ rule _#PUA_Block_KuaiZip_13{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_14{
rule _#PUA_Block_KuaiZip_17{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
@@ -190,7 +227,7 @@ rule _#PUA_Block_KuaiZip_14{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_15{
rule _#PUA_Block_KuaiZip_18{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
@@ -205,7 +242,7 @@ rule _#PUA_Block_KuaiZip_15{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6
}
rule _#PUA_Block_KuaiZip_16{
rule _#PUA_Block_KuaiZip_19{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
@@ -218,7 +255,7 @@ rule _#PUA_Block_KuaiZip_16{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_17{
rule _#PUA_Block_KuaiZip_20{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -232,7 +269,7 @@ rule _#PUA_Block_KuaiZip_17{
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_18{
rule _#PUA_Block_KuaiZip_21{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 00 "
@@ -251,7 +288,7 @@ rule _#PUA_Block_KuaiZip_18{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_80_8 & 1)*-100+(#a_80_9 & 1)*-100) >=8
}
rule _#PUA_Block_KuaiZip_19{
rule _#PUA_Block_KuaiZip_22{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -265,7 +302,7 @@ rule _#PUA_Block_KuaiZip_19{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_20{
rule _#PUA_Block_KuaiZip_23{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 00 "
@@ -281,7 +318,7 @@ rule _#PUA_Block_KuaiZip_20{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1) >=6
}
rule _#PUA_Block_KuaiZip_21{
rule _#PUA_Block_KuaiZip_24{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 "
@@ -297,7 +334,7 @@ rule _#PUA_Block_KuaiZip_21{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*-100+(#a_80_6 & 1)*-100) >=5
}
rule _#PUA_Block_KuaiZip_22{
rule _#PUA_Block_KuaiZip_25{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
@@ -313,7 +350,7 @@ rule _#PUA_Block_KuaiZip_22{
((#a_80_0 & 1)*1+(#a_00_1 & 1)*1+(#a_80_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_KuaiZip_23{
rule _#PUA_Block_KuaiZip_26{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -327,7 +364,7 @@ rule _#PUA_Block_KuaiZip_23{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_24{
rule _#PUA_Block_KuaiZip_27{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 00 "
@@ -345,7 +382,7 @@ rule _#PUA_Block_KuaiZip_24{
((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_00_7 & 1)*2+(#a_80_8 & 1)*2) >=4
}
rule _#PUA_Block_KuaiZip_25{
rule _#PUA_Block_KuaiZip_28{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 00 "
@@ -364,7 +401,7 @@ rule _#PUA_Block_KuaiZip_25{
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*-100+(#a_80_8 & 1)*-100+(#a_80_9 & 1)*-100) >=6
}
rule _#PUA_Block_KuaiZip_26{
rule _#PUA_Block_KuaiZip_29{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 00 "
@@ -379,7 +416,7 @@ rule _#PUA_Block_KuaiZip_26{
((#a_80_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_27{
rule _#PUA_Block_KuaiZip_30{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 00 "
@@ -394,7 +431,7 @@ rule _#PUA_Block_KuaiZip_27{
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_28{
rule _#PUA_Block_KuaiZip_31{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 00 "
@@ -408,7 +445,7 @@ rule _#PUA_Block_KuaiZip_28{
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_29{
rule _#PUA_Block_KuaiZip_32{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,03 00 03 00 02 00 00 "
@@ -419,7 +456,7 @@ rule _#PUA_Block_KuaiZip_29{
((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3
}
rule _#PUA_Block_KuaiZip_30{
rule _#PUA_Block_KuaiZip_33{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,07 00 07 00 06 00 00 "
@@ -434,7 +471,7 @@ rule _#PUA_Block_KuaiZip_30{
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=7
}
rule _#PUA_Block_KuaiZip_31{
rule _#PUA_Block_KuaiZip_34{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 00 "
#PUA/Block/_#PUA_Block_OfferCore.yar
+22 -10
View File
@@ -1,5 +1,17 @@
rule _#PUA_Block_OfferCore{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_80_0 = {70 61 72 74 6e 65 72 73 2d 6f 66 66 61 70 69 2e 6e 65 74 2f 61 70 69 42 75 6e 64 6c 65 } //partners-offapi.net/apiBundle 2
$a_80_1 = {6f 66 66 65 72 69 6e 67 } //offering 1
$a_80_2 = {59 61 6e 64 65 78 49 6e 73 74 61 6c 6c 65 72 2e 70 64 62 } //YandexInstaller.pdb 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=3
}
rule _#PUA_Block_OfferCore_2{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 "
@@ -12,7 +24,7 @@ rule _#PUA_Block_OfferCore{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5
}
rule _#PUA_Block_OfferCore_2{
rule _#PUA_Block_OfferCore_3{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
@@ -25,7 +37,7 @@ rule _#PUA_Block_OfferCore_2{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_OfferCore_3{
rule _#PUA_Block_OfferCore_4{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 00 "
@@ -40,7 +52,7 @@ rule _#PUA_Block_OfferCore_3{
((#a_80_0 & 1)*5+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*5) >=12
}
rule _#PUA_Block_OfferCore_4{
rule _#PUA_Block_OfferCore_5{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
@@ -55,7 +67,7 @@ rule _#PUA_Block_OfferCore_4{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6
}
rule _#PUA_Block_OfferCore_5{
rule _#PUA_Block_OfferCore_6{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
@@ -71,7 +83,7 @@ rule _#PUA_Block_OfferCore_5{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_OfferCore_6{
rule _#PUA_Block_OfferCore_7{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
@@ -87,7 +99,7 @@ rule _#PUA_Block_OfferCore_6{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_OfferCore_7{
rule _#PUA_Block_OfferCore_8{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
@@ -103,7 +115,7 @@ rule _#PUA_Block_OfferCore_7{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_OfferCore_8{
rule _#PUA_Block_OfferCore_9{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 00 "
@@ -121,7 +133,7 @@ rule _#PUA_Block_OfferCore_8{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=7
}
rule _#PUA_Block_OfferCore_9{
rule _#PUA_Block_OfferCore_10{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 00 "
@@ -139,7 +151,7 @@ rule _#PUA_Block_OfferCore_9{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=7
}
rule _#PUA_Block_OfferCore_10{
rule _#PUA_Block_OfferCore_11{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 00 "
@@ -158,7 +170,7 @@ rule _#PUA_Block_OfferCore_10{
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1) >=9
}
rule _#PUA_Block_OfferCore_11{
rule _#PUA_Block_OfferCore_12{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 00 "
#PUA/Block/_#PUA_Block_Softcnapp.yar
+104 -30
View File
@@ -1,5 +1,29 @@
rule _#PUA_Block_Softcnapp{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 "
strings :
$a_80_0 = {35 35 6b 61 6e 74 75 2e 63 6f 6d } //55kantu.com 2
$a_80_1 = {57 69 6e 49 6e 74 65 72 63 65 70 74 2e 65 78 65 } //WinIntercept.exe 1
$a_80_2 = {50 6f 70 42 6c 6f 63 6b 2e 70 64 62 } //PopBlock.pdb 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_2{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 "
strings :
$a_80_0 = {70 64 66 2e 6b 66 6f 6c 6c 6f 77 2e 63 6f 6d } //pdf.kfollow.com 2
$a_80_1 = {79 6a 79 6e 7a 2e 6b 66 6f 6c 6c 6f 77 2e 63 6f 6d } //yjynz.kfollow.com 1
$a_80_2 = {42 4b 50 44 46 52 65 61 64 65 72 2e 69 6e 69 } //BKPDFReader.ini 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_3{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
@@ -12,7 +36,7 @@ rule _#PUA_Block_Softcnapp{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_2{
rule _#PUA_Block_Softcnapp_4{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
@@ -25,7 +49,57 @@ rule _#PUA_Block_Softcnapp_2{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_3{
rule _#PUA_Block_Softcnapp_5{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 "
strings :
$a_80_0 = {6e 6a 6d 79 79 2e 6a 69 75 7a 68 61 6f 72 65 6e 2e 74 6f 70 } //njmyy.jiuzhaoren.top 2
$a_80_1 = {41 4a 69 4a 69 61 6e 55 72 63 6d 76 6e 2e 65 78 65 } //AJiJianUrcmvn.exe 1
$a_80_2 = {4a 69 4a 69 61 6e 53 79 73 52 65 73 65 74 2e 69 6e 69 } //JiJianSysReset.ini 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_6{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 "
strings :
$a_80_0 = {74 6a 74 76 33 2e 77 6e 35 31 2e 63 6f 6d } //tjtv3.wn51.com 2
$a_80_1 = {77 77 77 2e 77 6e 77 62 2e 63 6f 6d } //www.wnwb.com 1
$a_80_2 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_80_3 = {57 6e 55 74 69 6c 69 74 79 2e 65 78 65 } //WnUtility.exe 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_7{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 "
strings :
$a_80_0 = {58 69 61 5a 61 69 51 69 5c 50 72 6f 6a 65 63 74 43 6f 70 79 5c 4d 69 78 65 64 5c 70 64 62 6d 61 70 5c 57 61 6e 4e 65 6e 67 5c } //XiaZaiQi\ProjectCopy\Mixed\pdbmap\WanNeng\ 2
$a_80_1 = {49 6e 73 74 61 6c 6c 2e 70 64 62 } //Install.pdb 1
$a_80_2 = {68 61 78 78 2e 73 65 } //haxx.se 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_8{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 "
strings :
$a_80_0 = {74 6a 74 76 33 2e 77 6e 35 31 2e 63 6f 6d } //tjtv3.wn51.com 2
$a_80_1 = {77 77 77 2e 77 6e 77 62 2e 63 6f 6d } //www.wnwb.com 1
$a_80_2 = {57 61 6e 4e 65 6e 67 57 42 49 6e 66 6f 2e 69 6e 69 } //WanNengWBInfo.ini 1
$a_80_3 = {57 6e 49 6d 65 4d 61 6e 61 67 65 72 2e 65 78 65 } //WnImeManager.exe 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_9{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 "
@@ -38,7 +112,7 @@ rule _#PUA_Block_Softcnapp_3{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*-10) >=3
}
rule _#PUA_Block_Softcnapp_4{
rule _#PUA_Block_Softcnapp_10{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 "
@@ -51,7 +125,7 @@ rule _#PUA_Block_Softcnapp_4{
((#a_02_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*-5) >=3
}
rule _#PUA_Block_Softcnapp_5{
rule _#PUA_Block_Softcnapp_11{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -65,7 +139,7 @@ rule _#PUA_Block_Softcnapp_5{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_6{
rule _#PUA_Block_Softcnapp_12{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -79,7 +153,7 @@ rule _#PUA_Block_Softcnapp_6{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_7{
rule _#PUA_Block_Softcnapp_13{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -93,7 +167,7 @@ rule _#PUA_Block_Softcnapp_7{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_8{
rule _#PUA_Block_Softcnapp_14{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 "
@@ -106,7 +180,7 @@ rule _#PUA_Block_Softcnapp_8{
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_9{
rule _#PUA_Block_Softcnapp_15{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -120,7 +194,7 @@ rule _#PUA_Block_Softcnapp_9{
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_10{
rule _#PUA_Block_Softcnapp_16{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -134,7 +208,7 @@ rule _#PUA_Block_Softcnapp_10{
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_11{
rule _#PUA_Block_Softcnapp_17{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 "
@@ -148,7 +222,7 @@ rule _#PUA_Block_Softcnapp_11{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-5) >=4
}
rule _#PUA_Block_Softcnapp_12{
rule _#PUA_Block_Softcnapp_18{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 "
@@ -163,7 +237,7 @@ rule _#PUA_Block_Softcnapp_12{
((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-100+(#a_80_5 & 1)*-100) >=5
}
rule _#PUA_Block_Softcnapp_13{
rule _#PUA_Block_Softcnapp_19{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 "
@@ -177,7 +251,7 @@ rule _#PUA_Block_Softcnapp_13{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_00_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-5) >=4
}
rule _#PUA_Block_Softcnapp_14{
rule _#PUA_Block_Softcnapp_20{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -191,7 +265,7 @@ rule _#PUA_Block_Softcnapp_14{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_15{
rule _#PUA_Block_Softcnapp_21{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 00 "
@@ -206,7 +280,7 @@ rule _#PUA_Block_Softcnapp_15{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-100+(#a_80_5 & 1)*-100) >=4
}
rule _#PUA_Block_Softcnapp_16{
rule _#PUA_Block_Softcnapp_22{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 00 "
@@ -223,7 +297,7 @@ rule _#PUA_Block_Softcnapp_16{
((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_80_5 & 1)*-100+(#a_80_6 & 1)*-100+(#a_80_7 & 1)*-100) >=5
}
rule _#PUA_Block_Softcnapp_17{
rule _#PUA_Block_Softcnapp_23{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
@@ -236,7 +310,7 @@ rule _#PUA_Block_Softcnapp_17{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_18{
rule _#PUA_Block_Softcnapp_24{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
@@ -250,7 +324,7 @@ rule _#PUA_Block_Softcnapp_18{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_19{
rule _#PUA_Block_Softcnapp_25{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 00 "
@@ -268,7 +342,7 @@ rule _#PUA_Block_Softcnapp_19{
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*-100+(#a_80_7 & 1)*-100+(#a_80_8 & 1)*-100) >=6
}
rule _#PUA_Block_Softcnapp_20{
rule _#PUA_Block_Softcnapp_26{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
@@ -283,7 +357,7 @@ rule _#PUA_Block_Softcnapp_20{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6
}
rule _#PUA_Block_Softcnapp_21{
rule _#PUA_Block_Softcnapp_27{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
@@ -299,7 +373,7 @@ rule _#PUA_Block_Softcnapp_21{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_Softcnapp_22{
rule _#PUA_Block_Softcnapp_28{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 00 "
@@ -317,7 +391,7 @@ rule _#PUA_Block_Softcnapp_22{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*-100+(#a_80_8 & 1)*-100) >=7
}
rule _#PUA_Block_Softcnapp_23{
rule _#PUA_Block_Softcnapp_29{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0b 00 00 "
@@ -337,7 +411,7 @@ rule _#PUA_Block_Softcnapp_23{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*-5) >=3
}
rule _#PUA_Block_Softcnapp_24{
rule _#PUA_Block_Softcnapp_30{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0c 00 00 "
@@ -358,7 +432,7 @@ rule _#PUA_Block_Softcnapp_24{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_00_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*-5) >=3
}
rule _#PUA_Block_Softcnapp_25{
rule _#PUA_Block_Softcnapp_31{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
@@ -373,7 +447,7 @@ rule _#PUA_Block_Softcnapp_25{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6
}
rule _#PUA_Block_Softcnapp_26{
rule _#PUA_Block_Softcnapp_32{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 00 "
@@ -388,7 +462,7 @@ rule _#PUA_Block_Softcnapp_26{
((#a_80_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_80_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_27{
rule _#PUA_Block_Softcnapp_33{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 "
@@ -404,7 +478,7 @@ rule _#PUA_Block_Softcnapp_27{
((#a_80_0 & 1)*2+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_02_3 & 1)*2+(#a_02_4 & 1)*2+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_28{
rule _#PUA_Block_Softcnapp_34{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 00 "
@@ -415,7 +489,7 @@ rule _#PUA_Block_Softcnapp_28{
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=1
}
rule _#PUA_Block_Softcnapp_29{
rule _#PUA_Block_Softcnapp_35{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 "
@@ -427,7 +501,7 @@ rule _#PUA_Block_Softcnapp_29{
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
}
rule _#PUA_Block_Softcnapp_30{
rule _#PUA_Block_Softcnapp_36{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 00 "
@@ -441,7 +515,7 @@ rule _#PUA_Block_Softcnapp_30{
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_31{
rule _#PUA_Block_Softcnapp_37{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 "
Adware/AndroidOS/BrowserAd/Adware_AndroidOS_BrowserAd_A_MTB.yar
+13
View File
@@ -0,0 +1,13 @@
rule Adware_AndroidOS_BrowserAd_A_MTB{
meta:
description = "Adware:AndroidOS/BrowserAd.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {6f 70 65 6e 4f 6e 63 6c 69 63 6b 4c 69 6e 6b } //1 openOnclickLink
$a_01_1 = {64 65 76 2f 61 70 70 6c 61 62 7a 2f 61 64 2f 61 63 74 69 76 69 74 79 2f 54 72 61 6e 73 70 61 72 65 6e 74 43 6c 69 63 6b 65 72 } //1 dev/applabz/ad/activity/TransparentClicker
$a_01_2 = {22 00 92 24 1a 01 20 b5 70 20 f9 df 10 00 60 01 dc bd 54 d1 dd bd 54 12 9e 76 6e 20 04 e0 20 00 6e 10 13 e0 00 00 0c 00 6e 10 9a 08 01 00 0c 02 1a 03 07 8d 71 20 bb e5 32 00 60 03 44 10 13 04 00 20 12 05 12 16 1a 07 4c df 13 08 1d 00 1a 09 c4 b6 12 0a } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AF_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Adware_AndroidOS_Mobidash_AF_MTB{
meta:
description = "Adware:AndroidOS/Mobidash.AF!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 6d 6f 62 61 70 70 73 62 61 6b 65 72 2f 75 61 65 6f 66 66 65 72 73 } //1 com/mobappsbaker/uaeoffers
$a_03_1 = {6e 10 b4 01 01 00 62 01 ?? 24 6e 10 b4 01 01 00 22 01 c4 00 54 02 } //1
condition:
((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=2
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AG_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Adware_AndroidOS_Mobidash_AG_MTB{
meta:
description = "Adware:AndroidOS/Mobidash.AG!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_03_0 = {65 00 14 06 1c 00 0d 7f 6e 20 ?? 11 65 00 6e 10 ?? 15 05 00 0c 06 5b 56 } //1
$a_03_1 = {96 14 06 b8 00 0a 7f 6e 20 ?? 11 65 00 0c 06 5b 56 ?? 96 14 06 9d 02 0a 7f 6e 20 } //1
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AI_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Adware_AndroidOS_Mobidash_AI_MTB{
meta:
description = "Adware:AndroidOS/Mobidash.AI!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_03_0 = {43 54 00 0c 04 21 45 01 26 35 56 11 00 46 07 04 06 6e 10 ?? 43 07 00 1a 08 } //1
$a_03_1 = {12 00 6e 20 50 01 03 00 0c 00 1a 01 ?? 7e 1a 02 00 00 72 30 73 03 10 02 0c 00 1a 01 } //1
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AJ_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Adware_AndroidOS_Mobidash_AJ_MTB{
meta:
description = "Adware:AndroidOS/Mobidash.AJ!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_00_0 = {63 6f 6d 2f 64 65 78 74 72 61 64 65 2f 61 6e 64 72 6f 69 64 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 } //1 com/dextrade/android/MainActivity
$a_03_1 = {32 04 00 6e 10 ?? 3d 04 00 0c 00 72 10 ?? 55 00 00 0c 00 54 41 ?? 21 38 01 0c 00 22 02 19 00 12 03 70 30 62 00 42 03 6e 30 ?? 9f 10 02 0e 00 } //1
condition:
((#a_00_0 & 1)*1+(#a_03_1 & 1)*1) >=2
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AK_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Adware_AndroidOS_Mobidash_AK_MTB{
meta:
description = "Adware:AndroidOS/Mobidash.AK!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 65 78 70 72 65 73 73 65 78 70 65 6e 73 65 2f 62 6c 75 65 74 6f 6f 74 68 2f 70 72 69 6e 74 2f 4d 61 69 6e 5f 41 63 74 69 76 69 74 79 } //1 com/expressexpense/bluetooth/print/Main_Activity
$a_03_1 = {5d 01 00 54 30 ?? 48 14 01 0c 00 01 7f 14 02 0d 00 01 7f 6e 30 ?? 5d 10 02 54 30 } //1
condition:
((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=2
}
Adware/MacOS/Adload/Adware_MacOS_Adload_R_MTB.yar
+3 -3
View File
@@ -4,9 +4,9 @@ rule Adware_MacOS_Adload_R_MTB{
description = "Adware:MacOS/Adload.R!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_03_0 = {8b 18 f7 c3 80 80 80 80 0f 85 ?? ?? ?? ?? 88 1a 8a 48 01 88 4a 01 8a 48 02 88 4a 02 8a 48 03 88 4a 03 48 83 c2 04 48 83 c0 04 49 83 c4 fc 49 83 fc 03 } //1
$a_03_1 = {bb ff 07 00 00 b8 01 00 00 00 41 8a 0c 1c 80 e1 c0 80 f9 80 75 ?? 48 ff c0 48 ff cb 48 83 f8 04 76 ?? bb 00 08 00 00 4c 89 ff 4c 89 e6 48 89 da e8 3f f9 ff ff 49 01 dc 49 29 de } //1
$a_01_0 = {4c 01 f2 c6 02 26 49 8b 86 08 28 00 00 41 c6 44 06 01 71 49 8b 86 08 28 00 00 41 c6 44 06 02 75 49 8b 86 08 28 00 00 41 c6 44 06 03 6f 49 8b 86 08 28 00 00 41 c6 44 06 04 74 49 8b 86 08 28 00 00 41 c6 44 06 05 3b 49 83 86 08 28 00 00 06 8a 0b 49 89 dc 4c 89 e6 84 c9 } //1
$a_01_1 = {31 c0 48 89 43 28 48 89 43 30 48 89 43 38 31 c0 80 bb 92 01 00 00 00 0f 94 c0 b9 68 00 00 00 ba 40 00 00 00 48 0f 44 d1 48 c1 e0 04 48 8b 0c 13 48 8b 74 03 60 48 01 ce 48 89 4b 10 4c 8d 7b 18 48 89 73 18 48 89 73 20 c7 83 8c 01 00 00 08 00 00 00 b0 01 } //1
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Adware/MacOS/NewTab/Adware_MacOS_NewTab_B.yar
-16
View File
@@ -1,16 +0,0 @@
rule Adware_MacOS_NewTab_B{
meta:
description = "Adware:MacOS/NewTab.B,SIGNATURE_TYPE_MACHOHSTR_EXT,0d 00 0d 00 06 00 00 "
strings :
$a_01_0 = {67 65 74 78 61 74 74 72 } //1 getxattr
$a_02_1 = {43 6f 6e 74 65 6e 74 73 2f 4c 69 62 72 61 72 79 2f 4c 6f 67 69 6e 49 74 65 6d 73 2f [0-40] 2e 61 70 70 } //3
$a_01_2 = {63 6f 6d 2e 61 70 70 6c 65 2e 53 61 66 61 72 69 } //1 com.apple.Safari
$a_01_3 = {63 6f 6e 74 65 6e 74 73 50 72 6f 76 69 64 65 72 } //3 contentsProvider
$a_01_4 = {73 65 74 43 75 72 72 65 6e 74 54 61 62 3a } //2 setCurrentTab:
$a_01_5 = {6f 70 65 72 61 74 69 6e 67 53 79 73 74 65 6d 56 65 72 73 69 6f 6e } //3 operatingSystemVersion
condition:
((#a_01_0 & 1)*1+(#a_02_1 & 1)*3+(#a_01_2 & 1)*1+(#a_01_3 & 1)*3+(#a_01_4 & 1)*2+(#a_01_5 & 1)*3) >=13
}
Adware/MacOS/Pirrit/Adware_MacOS_Pirrit_W_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Adware_MacOS_Pirrit_W_MTB{
meta:
description = "Adware:MacOS/Pirrit.W!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {8a 05 42 29 02 00 8d 0c 00 80 e1 a8 04 54 0f b6 15 32 29 02 00 66 0f 6e ca 0f b6 c0 66 0f 3a 20 c8 01 66 0f 6e 05 21 29 02 00 66 0f 6f d1 66 0f 3a 20 15 11 29 02 00 02 66 0f 3a 20 15 08 29 02 00 03 66 0f 62 d0 0f b6 c1 66 0f 6f 05 dc a7 00 00 66 0f ef d0 66 0f 3a 20 c0 01 66 0f f8 c8 0f 28 05 c7 40 00 00 66 0f 38 10 ca 66 0f d6 0d e2 28 02 00 0f b7 05 df 25 02 00 66 0f 6e c8 66 0f 6e 05 d6 25 02 00 8a 05 d4 25 02 00 89 c1 f6 d1 0c 1b 66 0f 3a 20 0d bf 25 02 00 02 80 c9 e4 66 0f 60 c1 66 0f 38 00 05 31 40 00 00 20 c1 } //1
$a_01_1 = {66 0f 3a 20 c1 03 80 e2 64 0f b6 c0 66 0f 3a 20 c0 04 0f b6 c2 66 0f 3a 20 c0 05 66 0f f8 c8 0f 28 05 0b 7f 03 00 66 0f 38 10 ca 66 0f d6 0d e3 78 04 00 8a 05 c5 78 04 00 34 6c 88 05 dd 78 04 00 8a 05 b8 78 04 00 34 9e 88 05 d0 78 04 00 8a 05 ab 78 04 00 34 c0 88 05 c3 78 04 00 8a 05 9e 78 04 00 8d 0c 00 80 e1 8e 28 c8 04 c7 88 05 ae 78 04 00 66 0f 6e 0d b7 78 04 00 8a 15 b5 78 04 00 8d 04 12 80 c2 73 f3 0f 7e 05 aa 78 04 00 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Adware/MacOS/Pirrit/Adware_MacOS_Pirrit_Y_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Adware_MacOS_Pirrit_Y_MTB{
meta:
description = "Adware:MacOS/Pirrit.Y!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {9c d4 00 00 34 60 88 05 9a d4 00 00 8a 05 8f d4 00 00 8d 0c 00 80 e1 6a 28 c8 04 35 88 05 85 d4 00 00 8a 05 7a d4 00 00 34 ec 88 05 78 d4 00 00 8a 05 6d d4 00 00 89 c1 f6 d1 80 c9 21 0c de 20 c8 88 05 62 d4 00 00 8a 05 5d d4 00 00 34 2b } //1
$a_01_1 = {80 e1 58 28 c8 04 2c 88 05 f9 d0 00 00 8a 05 e8 d0 00 00 34 6e 88 05 ec d0 00 00 b8 3b d4 82 1b 33 05 e2 d0 00 00 89 05 ec d0 00 00 8a 05 da d0 00 00 34 09 88 05 e2 d0 00 00 8a 05 cd d0 00 00 34 91 88 05 d5 d0 00 00 8a 05 c0 d0 00 00 88 05 ca d0 00 00 8a 05 b5 d0 00 00 34 d3 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Adware/Win32/AdRotator/Adware_Win32_AdRotator.yar
+6 -5
View File
@@ -589,12 +589,13 @@ rule Adware_Win32_AdRotator_36{
$a_01_53 = {83 ef 28 b8 67 66 66 66 f7 ef c1 fa 04 8b c2 c1 e8 1f 03 c2 83 c4 08 83 ee 28 83 f8 01 } //1
$a_01_54 = {89 55 08 83 65 fc 00 8b 4d 0c 8b 39 89 3a 83 21 00 83 4d fc ff } //1
$a_03_55 = {8a 14 1a 8a c2 02 c0 02 d0 c0 e2 ?? 80 fa ?? 7d } //1
$a_10_56 = {00 00 e6 49 f8 07 33 da e1 fe 39 ca b5 e4 00 04 00 80 80 10 00 00 1b 8c 77 12 57 d0 9a 83 ec 0f 7c a9 30 04 00 80 80 10 00 00 ff 53 0d 1b 60 93 84 fb 37 d2 fe 7f 00 04 00 80 80 10 00 00 8c b4 5a 2f dc 72 d7 a2 b5 f1 dd f4 00 10 00 80 80 10 00 00 ad ab 04 3a 63 34 6f c9 ed e9 10 79 00 10 00 80 80 10 00 00 6c 99 0d 52 a0 27 79 5f 04 c1 49 1d 00 10 00 80 80 10 00 00 a0 3d 6a 6a ec 2e } //0
$a_56_57 = {8d 00 04 00 80 80 10 00 00 dc 1e 8f 6b 91 1c 2c bb 54 cd a2 1b 00 04 00 80 80 10 00 00 1f 1a c7 85 1f 9c 2a a2 39 bd 7f ae 00 04 00 80 80 10 00 00 f3 f9 4c 90 8c 7b 56 b7 b0 be d5 f1 00 04 00 80 80 10 00 00 f3 f9 4c 90 8c 7b 56 b7 f2 4d d1 72 00 04 00 80 80 10 00 00 3e 78 ea a3 fc e6 e1 68 36 93 81 ad 00 04 00 80 80 10 00 00 d0 6f 08 bc 6f 6c 94 50 62 b7 b9 5a 00 10 00 80 80 10 00 00 26 81 e5 be ec 2f 8b 68 93 c9 b3 e8 00 20 00 00 80 10 00 00 3f 17 7f c6 1f 4a 60 f5 98 e8 5b 97 00 20 00 00 80 10 00 00 a8 76 8a cd 3b f1 cc 5b f8 f1 2d 7c 00 10 00 80 80 10 00 00 c5 c4 e4 d4 6b 09 92 5f 4c aa 16 99 00 04 00 80 80 10 00 00 dd 07 b8 e9 73 ca ce 62 54 69 4a a4 00 04 00 80 } //17418
$a_ef_59 = {0b ee 71 6f 1d d0 c5 00 10 00 80 80 10 00 00 1e fe 7c f6 21 ed 48 88 54 24 ca 00 00 20 00 00 80 10 00 00 db dc b1 fc ca aa c7 fc 9f fd aa d2 20 04 00 80 87 10 00 00 a4 11 d7 2f 34 21 df b8 8b 3e 35 1f 3f e6 01 00 87 10 00 00 db 48 ae 35 18 99 ac 41 e7 d3 d9 fb 3a a5 02 00 87 10 00 00 91 fe 42 3a fc 8c 0e 5a 73 73 48 17 b9 f7 14 00 87 10 00 00 5c 2f 2d 48 52 39 86 f5 70 3b a7 26 e2 bb 04 00 87 10 } //-14232
$a_ca_60 = {4b e7 f0 a4 74 } //0
$a_15_56 = {00 e2 38 4d 24 2c d4 3a 03 d3 75 85 b8 72 35 f2 42 90 0f cf 4c cf 80 10 00 00 e6 49 f8 07 33 da e1 fe 39 ca b5 e4 00 04 00 80 80 10 00 00 1b 8c 77 12 57 d0 9a 83 ec 0f 7c a9 30 04 00 80 80 10 00 00 ff 53 0d 1b 60 93 84 fb 37 d2 fe 7f 00 04 00 80 80 10 00 00 8c b4 5a 2f dc 72 d7 a2 b5 f1 dd f4 00 10 00 80 80 10 00 00 ad ab 04 3a 63 34 6f c9 ed e9 10 79 00 10 00 80 80 10 00 00 } //0
$a_52_57 = {27 79 5f 04 c1 49 1d 00 10 00 80 80 10 } //-26260
$a_3d_58 = {6a ec 2e 0a 44 e1 56 a6 8d 00 04 00 80 80 10 00 00 dc 1e 8f 6b 91 1c 2c bb 54 cd a2 1b 00 04 00 80 80 10 00 00 1f 1a c7 85 1f 9c 2a a2 39 bd 7f ae 00 04 00 80 80 10 00 00 f3 f9 4c 90 8c 7b 56 b7 b0 be d5 f1 00 04 00 80 80 10 00 00 f3 f9 4c 90 8c 7b 56 b7 f2 4d d1 72 00 04 00 80 80 10 00 00 3e 78 ea a3 fc e6 e1 68 36 93 81 ad 00 04 00 80 80 10 00 00 d0 6f 08 bc 6f 6c 94 50 62 b7 b9 5a 00 10 00 80 80 10 00 00 26 81 e5 be ec 2f 8b 68 93 c9 b3 e8 00 20 00 00 80 10 00 00 3f 17 7f } //0
$a_60_59 = {98 e8 5b 97 00 20 00 00 80 10 00 00 a8 76 8a cd 3b f1 cc 5b f8 f1 2d 7c 00 10 00 80 80 10 00 00 c5 c4 e4 d4 6b 09 92 5f 4c aa 16 99 00 04 00 80 80 10 00 00 dd 07 b8 e9 73 ca ce 62 54 69 4a a4 00 04 00 80 80 10 00 00 68 c8 } //8134
$a_0b_60 = {ee 71 6f 1d d0 c5 00 10 00 80 80 10 00 00 1e fe 7c f6 21 ed 48 88 54 24 ca 00 00 20 00 00 80 10 00 00 db dc b1 fc ca aa c7 fc 9f fd aa d2 20 04 00 80 87 10 00 00 a4 11 d7 2f 34 21 df b8 8b 3e 35 1f 3f e6 01 00 87 10 00 00 db 48 ae 35 18 99 ac 41 e7 d3 d9 fb 3a a5 02 00 87 10 00 00 91 fe 42 3a fc 8c 0e 5a 73 73 48 17 b9 f7 14 00 87 10 00 00 5c 2f 2d 48 52 39 86 f5 70 3b a7 26 e2 bb 04 00 87 10 00 00 05 ca a8 4b e7 f0 a4 74 12 86 49 21 7f cc 01 00 87 10 00 00 53 8e 68 cf 86 b4 92 c0 53 fd 41 47 e2 cd 05 00 87 10 00 00 54 0b c1 f8 1f 6f e0 17 d5 b7 63 4b 82 d3 05 00 5f 0c 00 00 25 00 5c 6d 77 73 76 6d 2e 62 69 6e 5f 0c 00 00 25 00 5c 6d 77 73 76 6d 2e 65 78 65 5f 0c 00 00 25 00 5c 6d 77 73 76 6d 2e 6f 63 78 5f 14 00 00 25 00 5c 64 72 } //-4219
condition:
((#a_11_0 & 1)*800+(#a_63_1 & 1)*3584+(#a_00_3 & 1)*111+(#a_00_5 & 1)*110+(#a_61_6 & 1)*6144+(#a_11_8 & 1)*30+(#a_62_9 & 1)*6144+(#a_11_11 & 1)*30+(#a_62_12 & 1)*8192+(#a_00_14 & 1)*111+(#a_00_15 & 1)*100+(#a_00_17 & 1)*101+(#a_00_18 & 1)*121+(#a_00_20 & 1)*101+(#a_00_21 & 1)*101+(#a_65_22 & 1)*18262+(#a_67_23 & 1)*24936+(#a_6f_24 & 1)*28532+(#a_2e_25 & 1)*3584+(#a_6b_26 & 1)*17494+(#a_71_27 & 1)*16726+(#a_00_28 & 1)*32+(#a_00_30 & 1)*118+(#a_00_32 & 1)*115+(#a_00_34 & 1)*47+(#a_00_35 & 1)*110+(#a_1a_36 & 1)*-30719+(#a_8b_37 & 1)*13059+(#a_00_39 & 1)*101+(#a_00_41 & 1)*116+(#a_00_43 & 1)*114+(#a_00_44 & 1)*108+(#a_76_45 & 1)*6656+(#a_00_47 & 1)*108+(#a_00_48 & 1)*105+(#a_00_49 & 1)*278+(#a_70_50 & 1)*19286+(#a_56_51 & 1)*16174+(#a_40_52 & 1)*5256+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_03_55 & 1)*1+(#a_10_56 & 1)*0+(#a_56_57 & 1)*17418+(#a_ef_59 & 1)*-14232+(#a_ca_60 & 1)*0) >=832
((#a_11_0 & 1)*800+(#a_63_1 & 1)*3584+(#a_00_3 & 1)*111+(#a_00_5 & 1)*110+(#a_61_6 & 1)*6144+(#a_11_8 & 1)*30+(#a_62_9 & 1)*6144+(#a_11_11 & 1)*30+(#a_62_12 & 1)*8192+(#a_00_14 & 1)*111+(#a_00_15 & 1)*100+(#a_00_17 & 1)*101+(#a_00_18 & 1)*121+(#a_00_20 & 1)*101+(#a_00_21 & 1)*101+(#a_65_22 & 1)*18262+(#a_67_23 & 1)*24936+(#a_6f_24 & 1)*28532+(#a_2e_25 & 1)*3584+(#a_6b_26 & 1)*17494+(#a_71_27 & 1)*16726+(#a_00_28 & 1)*32+(#a_00_30 & 1)*118+(#a_00_32 & 1)*115+(#a_00_34 & 1)*47+(#a_00_35 & 1)*110+(#a_1a_36 & 1)*-30719+(#a_8b_37 & 1)*13059+(#a_00_39 & 1)*101+(#a_00_41 & 1)*116+(#a_00_43 & 1)*114+(#a_00_44 & 1)*108+(#a_76_45 & 1)*6656+(#a_00_47 & 1)*108+(#a_00_48 & 1)*105+(#a_00_49 & 1)*278+(#a_70_50 & 1)*19286+(#a_56_51 & 1)*16174+(#a_40_52 & 1)*5256+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_03_55 & 1)*1+(#a_15_56 & 1)*0+(#a_52_57 & 1)*-26260+(#a_3d_58 & 1)*0+(#a_60_59 & 1)*8134+(#a_0b_60 & 1)*-4219) >=832
}
rule Adware_Win32_AdRotator_37{
Adware/Win32/Kraddare/Adware_Win32_Kraddare.yar
+24
View File
@@ -1,5 +1,29 @@
rule Adware_Win32_Kraddare{
meta:
description = "Adware:Win32/Kraddare,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 "
strings :
$a_80_0 = {77 77 77 2e 6d 75 75 6b 2e 63 6f 2e 6b 72 } //www.muuk.co.kr 2
$a_80_1 = {77 69 6e 64 6f 77 73 74 61 62 2e 65 78 65 } //windowstab.exe 1
$a_80_2 = {77 69 6e 64 6f 77 73 74 61 62 2e 70 68 70 } //windowstab.php 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4
}
rule Adware_Win32_Kraddare_2{
meta:
description = "Adware:Win32/Kraddare,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 "
strings :
$a_80_0 = {77 77 77 2e 6d 75 75 6b 2e 63 6f 2e 6b 72 2f 61 70 70 2f 77 69 6e 64 6f 77 73 74 61 62 } //www.muuk.co.kr/app/windowstab 2
$a_80_1 = {77 69 6e 64 6f 77 73 74 61 62 2e 70 68 70 } //windowstab.php 1
$a_80_2 = {4e 65 74 58 74 72 65 6d 65 } //NetXtreme 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4
}
rule Adware_Win32_Kraddare_3{
meta:
description = "Adware:Win32/Kraddare,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 "
Backdoor/BAT/Androm/Backdoor_BAT_Androm_AGQA_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Backdoor_BAT_Androm_AGQA_MTB{
meta:
description = "Backdoor:BAT/Androm.AGQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 "
strings :
$a_03_0 = {06 17 9a 6f ?? 00 00 0a 1e 09 5a 59 13 04 11 04 16 fe 04 13 05 11 05 2c 0a 00 1e 11 04 58 0c 16 13 04 00 7e ?? 00 00 04 07 09 59 06 17 9a 11 04 08 6f ?? 00 00 0a 18 28 ?? 00 00 0a 9c 00 09 17 58 0d 09 07 fe 02 16 fe 01 13 06 11 06 2d b0 } //5
$a_03_1 = {0f 00 08 20 00 04 00 00 58 28 ?? 00 00 2b 00 07 02 08 20 00 04 00 00 6f ?? 00 00 0a 0d 08 09 58 0c 09 20 00 04 00 00 fe 04 13 04 11 04 2c 0c 00 0f 00 08 28 ?? 00 00 2b 00 2b 06 00 17 13 05 2b be } //2
condition:
((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7
}
Backdoor/BAT/AsyncRAT/Backdoor_BAT_AsyncRAT_PAGL_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Backdoor_BAT_AsyncRAT_PAGL_MTB{
meta:
description = "Backdoor:BAT/AsyncRAT.PAGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 "
strings :
$a_01_0 = {0b 17 8d 09 00 00 01 13 05 11 05 16 72 01 00 00 70 a2 11 05 0c 07 08 16 } //2
$a_00_1 = {5b 00 30 00 32 00 34 00 35 00 37 00 38 00 39 00 37 00 34 00 61 00 73 00 66 00 36 00 38 00 34 00 33 00 73 00 72 00 36 00 67 00 38 00 37 00 67 00 36 00 37 00 5d 00 } //2 [024578974asf6843sr6g87g67]
condition:
((#a_01_0 & 1)*2+(#a_00_1 & 1)*2) >=4
}
Backdoor/BAT/Bladabindi/Backdoor_BAT_Bladabindi_SV_MTB.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_BAT_Bladabindi_SV_MTB{
meta:
description = "Backdoor:BAT/Bladabindi.SV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 "
strings :
$a_01_0 = {07 09 08 09 1e d8 1e 6f 26 00 00 0a 18 28 27 00 00 0a 9c 09 17 d6 0d 09 11 04 13 05 11 05 31 e0 } //2
condition:
((#a_01_0 & 1)*2) >=2
}
Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_ADRA_MTB.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_BAT_Crysan_ADRA_MTB{
meta:
description = "Backdoor:BAT/Crysan.ADRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 "
strings :
$a_03_0 = {01 0b 06 07 16 1a 6f ?? 00 00 0a 26 07 16 28 ?? 00 00 0a 0c 06 16 73 ?? 00 00 0a 0d 08 8d ?? 00 00 01 13 04 16 13 05 38 1e 00 00 00 09 11 04 11 05 08 11 05 59 6f ?? 00 00 0a 13 06 11 06 39 0c 00 00 00 11 05 11 06 58 13 05 11 05 08 32 dd } //5
condition:
((#a_03_0 & 1)*5) >=5
}
Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_ARWA_MTB.yar
+13
View File
@@ -0,0 +1,13 @@
rule Backdoor_BAT_Crysan_ARWA_MTB{
meta:
description = "Backdoor:BAT/Crysan.ARWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 "
strings :
$a_03_0 = {0a 13 06 28 ?? 00 00 0a 0a 06 20 00 01 00 00 6f ?? 00 00 0a 06 11 05 6f ?? 00 00 0a 06 11 06 6f ?? 00 00 0a 06 6f ?? 00 00 0a 0b 02 73 ?? 00 00 0a 0d 09 07 16 73 ?? 00 00 0a 13 04 73 ?? 00 00 0a 0c 11 04 08 6f ?? 00 00 0a 08 6f ?? 00 00 0a 13 07 de 2a } //5
$a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String
$a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor
condition:
((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7
}
Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_AYWA_MTB.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_BAT_Crysan_AYWA_MTB{
meta:
description = "Backdoor:BAT/Crysan.AYWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 "
strings :
$a_03_0 = {11 02 11 03 11 04 11 03 91 11 01 11 03 11 01 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d2 9c 20 } //5
condition:
((#a_03_0 & 1)*5) >=5
}
Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_NIT_MTB.yar
+13
View File
@@ -0,0 +1,13 @@
rule Backdoor_BAT_Crysan_NIT_MTB{
meta:
description = "Backdoor:BAT/Crysan.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 "
strings :
$a_03_0 = {02 7b 01 00 00 04 6f ?? 00 00 0a 0a 06 8e 69 18 3c 01 00 00 00 2a 06 16 9a 75 03 00 00 01 0b 07 14 28 ?? 00 00 0a 39 01 00 00 00 2a 07 6f ?? 00 00 0a 7e 03 00 00 04 25 3a 17 00 00 00 26 7e 02 00 00 04 fe 06 0b 00 00 06 73 06 00 00 0a 25 80 03 00 00 04 28 ?? 00 00 2b 0c 08 14 28 ?? 00 00 0a 39 0c 00 00 00 02 7b 01 00 00 04 08 6f ?? 00 00 0a 2a } //2
$a_01_1 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor
$a_01_2 = {43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 } //1 CreateEncryptor
condition:
((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4
}
Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_SN_MTB.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_BAT_Crysan_SN_MTB{
meta:
description = "Backdoor:BAT/Crysan.SN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 "
strings :
$a_01_0 = {08 6f 0a 00 00 0a 0d 09 02 16 02 8e 69 6f 0b 00 00 0a 13 04 dd 1a 00 00 00 } //2
condition:
((#a_01_0 & 1)*2) >=2
}
Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_SO_MTB.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_BAT_Crysan_SO_MTB{
meta:
description = "Backdoor:BAT/Crysan.SO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 "
strings :
$a_01_0 = {00 28 35 00 00 06 0a dd 09 00 00 00 26 dd 00 00 00 00 06 2c eb } //2
condition:
((#a_01_0 & 1)*2) >=2
}
Backdoor/BAT/DCRat/Backdoor_BAT_DCRat_BAA_MTB.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_BAT_DCRat_BAA_MTB{
meta:
description = "Backdoor:BAT/DCRat.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 "
strings :
$a_03_0 = {11 05 02 16 02 8e 69 ?? ?? 00 00 0a 11 05 ?? ?? 00 00 0a 11 04 ?? ?? 00 00 0a 0b dd 1e 00 00 00 11 05 39 07 00 00 00 11 05 ?? ?? 00 00 0a dc 11 04 39 07 00 00 00 11 04 ?? ?? 00 00 0a dc 09 ?? ?? 00 00 0a dd 0d 00 00 00 } //2
condition:
((#a_03_0 & 1)*2) >=2
}
Backdoor/BAT/DCRat/Backdoor_BAT_DCRat_GZZ_MTB.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_BAT_DCRat_GZZ_MTB{
meta:
description = "Backdoor:BAT/DCRat.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 "
strings :
$a_03_0 = {01 25 16 72 ?? 00 00 70 72 ?? 00 00 70 72 ?? 00 00 70 28 ?? 00 00 0a a2 25 17 72 ?? 00 00 70 72 ?? 00 00 70 72 ?? 00 00 70 28 ?? 00 00 0a a2 25 18 72 ?? 00 00 70 72 ?? 00 00 70 72 ?? 01 00 70 28 ?? 00 00 0a a2 25 19 72 ?? 01 00 70 72 ?? 00 00 70 72 ?? 01 00 70 28 ?? 00 00 0a a2 25 1a 72 ?? 01 00 70 72 ?? 00 00 70 72 ?? 01 00 70 28 ?? 00 00 0a a2 25 1b 72 ?? 01 00 70 72 ?? 00 00 70 72 ?? 01 00 70 28 ?? 00 00 0a a2 7e } //10
condition:
((#a_03_0 & 1)*10) >=10
}
Backdoor/BAT/DCRat/Backdoor_BAT_DcRat_SM_MTB.yar
+13
View File
@@ -0,0 +1,13 @@
rule Backdoor_BAT_DcRat_SM_MTB{
meta:
description = "Backdoor:BAT/DcRat.SM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 "
strings :
$a_01_0 = {00 06 07 09 58 91 02 7b 0b 00 00 04 09 91 fe 01 13 05 11 05 2d 05 00 16 0c 2b 16 00 09 17 58 0d 09 02 7b 0b 00 00 04 8e 69 fe 04 13 05 11 05 2d cf } //2
$a_81_1 = {53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 45 78 70 6c 6f 72 65 72 5c 41 64 76 61 6e 63 65 64 } //2 Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
$a_81_2 = {53 68 6f 77 53 75 70 65 72 48 69 64 64 65 6e } //2 ShowSuperHidden
condition:
((#a_01_0 & 1)*2+(#a_81_1 & 1)*2+(#a_81_2 & 1)*2) >=6
}
Backdoor/BAT/DCRat/Backdoor_BAT_DcRat_SN_MTB.yar
+13
View File
@@ -0,0 +1,13 @@
rule Backdoor_BAT_DcRat_SN_MTB{
meta:
description = "Backdoor:BAT/DcRat.SN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 "
strings :
$a_81_0 = {24 32 66 39 32 66 32 66 39 2d 64 66 65 66 2d 34 32 35 39 2d 62 66 32 61 2d 39 64 62 39 65 63 35 64 38 35 35 63 } //2 $2f92f2f9-dfef-4259-bf2a-9db9ec5d855c
$a_81_1 = {42 58 43 4a 44 46 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //2 BXCJDF.Properties.Resources
$a_81_2 = {42 58 43 4a 44 46 2e 65 78 65 } //2 BXCJDF.exe
condition:
((#a_81_0 & 1)*2+(#a_81_1 & 1)*2+(#a_81_2 & 1)*2) >=6
}
Backdoor/BAT/NetFleek/Backdoor_BAT_NetFleek_A_dha.yar
+17
View File
@@ -0,0 +1,17 @@
rule Backdoor_BAT_NetFleek_A_dha{
meta:
description = "Backdoor:BAT/NetFleek.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_01_0 = {4c 6f 61 64 50 6c 75 67 69 6e 73 } //1 LoadPlugins
$a_01_1 = {47 65 74 50 6c 75 67 69 6e 73 } //1 GetPlugins
$a_01_2 = {45 78 65 63 75 74 65 50 6c 75 67 69 6e 73 } //1 ExecutePlugins
$a_01_3 = {75 70 64 4c 6f 63 61 74 69 6f 6e } //1 updLocation
$a_01_4 = {2e 00 75 00 73 00 62 00 } //1 .usb
$a_01_5 = {2e 00 73 00 63 00 72 00 6e 00 } //1 .scrn
$a_01_6 = {2e 00 73 00 6f 00 63 00 } //1 .soc
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7
}
Backdoor/BAT/NetFleek/Backdoor_BAT_NetFleek_B_dha.yar
+13
View File
@@ -0,0 +1,13 @@
rule Backdoor_BAT_NetFleek_B_dha{
meta:
description = "Backdoor:BAT/NetFleek.B!dha,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_81_0 = {46 69 72 6d 61 63 68 41 67 65 6e 74 } //1 FirmachAgent
$a_01_1 = {74 00 61 00 73 00 6b 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 } //1 task/upload
$a_01_2 = {74 00 61 00 73 00 6b 00 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 } //1 task/download
condition:
((#a_81_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
}
Backdoor/BAT/NetFleek/Backdoor_BAT_NetFleek_C_dha.yar
+16
View File
@@ -0,0 +1,16 @@
rule Backdoor_BAT_NetFleek_C_dha{
meta:
description = "Backdoor:BAT/NetFleek.C!dha,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 "
strings :
$a_01_0 = {72 00 6f 00 62 00 6f 00 63 00 6f 00 70 00 79 00 2e 00 65 00 78 00 65 00 } //1 robocopy.exe
$a_01_1 = {2f 00 6d 00 69 00 72 00 20 00 2f 00 72 00 3a 00 31 00 20 00 2f 00 77 00 3a 00 31 00 20 00 2f 00 6e 00 70 00 20 00 2f 00 78 00 6a 00 20 00 2f 00 73 00 6c 00 } //1 /mir /r:1 /w:1 /np /xj /sl
$a_01_2 = {2a 00 2e 00 73 00 74 00 65 00 70 00 20 00 2a 00 2e 00 73 00 6c 00 64 00 64 00 72 00 77 00 20 00 2a 00 2e 00 73 00 6c 00 64 00 70 00 72 00 74 00 20 00 2a 00 2e 00 73 00 6c 00 64 00 61 00 73 00 6d 00 20 00 2a 00 2e 00 73 00 74 00 70 00 20 00 2a 00 2e 00 78 00 5f 00 74 00 } //1 *.step *.slddrw *.sldprt *.sldasm *.stp *.x_t
$a_01_3 = {2f 00 52 00 3a 00 33 00 20 00 2f 00 57 00 3a 00 35 00 20 00 2f 00 58 00 4f 00 } //1 /R:3 /W:5 /XO
$a_01_4 = {54 00 65 00 6d 00 70 00 45 00 6d 00 70 00 74 00 79 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 2d 00 } //1 TempEmptyDirectory-
$a_01_5 = {5c 00 2e 00 66 00 73 00 5c 00 } //1 \.fs\
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5
}
Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_AROA_MTB.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_BAT_Remcos_AROA_MTB{
meta:
description = "Backdoor:BAT/Remcos.AROA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 "
strings :
$a_03_0 = {09 11 05 03 11 05 91 08 61 06 11 04 91 61 b4 9c 11 04 7e ?? 01 00 04 02 28 ?? 01 00 06 17 da 33 05 16 13 04 2b 06 11 04 17 d6 13 04 11 05 17 d6 13 05 11 05 11 06 31 c8 7e ?? 02 00 04 09 74 ?? 00 00 01 03 8e b7 18 da 17 d6 8d ?? 00 00 01 28 ?? 02 00 06 74 ?? 00 00 1b 0d 09 13 07 de 65 } //5
condition:
((#a_03_0 & 1)*5) >=5
}
Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_SRK_MTB.yar
+13
View File
@@ -0,0 +1,13 @@
rule Backdoor_BAT_Remcos_SRK_MTB{
meta:
description = "Backdoor:BAT/Remcos.SRK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 "
strings :
$a_01_0 = {07 11 10 11 05 91 6f f2 00 00 0a 11 05 17 58 13 05 11 05 11 06 fe 04 13 11 11 11 2d e3 } //2
$a_01_1 = {24 36 34 39 36 30 37 65 34 2d 38 64 33 33 2d 34 32 36 63 2d 62 33 62 61 2d 36 37 34 35 36 30 32 62 39 66 33 62 } //2 $649607e4-8d33-426c-b3ba-6745602b9f3b
$a_01_2 = {42 6f 6f 6b 5f 4d 67 74 5f 53 79 73 74 65 6d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 Book_Mgt_System.Properties.Resources.resources
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=6
}
Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_SSK_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Backdoor_BAT_Remcos_SSK_MTB{
meta:
description = "Backdoor:BAT/Remcos.SSK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 "
strings :
$a_01_0 = {11 0a 11 0b 58 11 0c 58 6c 17 06 19 5a 28 5d 00 00 0a 6c 5b 26 06 1f 2a 5a 20 e8 03 00 00 5d 26 11 17 17 58 13 17 } //2
$a_01_1 = {53 74 6f 72 6d 43 61 73 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 StormCast.Properties.Resources.resources
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4
}
Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_STK_MTB.yar
+23
View File
@@ -0,0 +1,23 @@
rule Backdoor_BAT_Remcos_STK_MTB{
meta:
description = "Backdoor:BAT/Remcos.STK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 "
strings :
$a_01_0 = {06 07 08 18 6f 07 00 00 0a 1f 10 28 08 00 00 0a 6f 09 00 00 0a 08 18 58 0c 08 07 6f 0a 00 00 0a 3f db ff ff ff } //2
condition:
((#a_01_0 & 1)*2) >=2
}
rule Backdoor_BAT_Remcos_STK_MTB_2{
meta:
description = "Backdoor:BAT/Remcos.STK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 "
strings :
$a_81_0 = {53 6c 69 63 69 6e 67 44 69 63 65 20 4c 4c 43 } //2 SlicingDice LLC
$a_81_1 = {24 39 64 61 65 66 66 63 61 2d 39 66 38 39 2d 34 65 30 39 2d 39 31 32 39 2d 34 32 34 38 61 66 61 33 35 33 65 61 } //2 $9daeffca-9f89-4e09-9129-4248afa353ea
$a_81_2 = {53 6c 69 63 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 Slicer.Properties.Resources.resources
condition:
((#a_81_0 & 1)*2+(#a_81_1 & 1)*2+(#a_81_2 & 1)*2) >=6
}
Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_SUK_MTB.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_BAT_Remcos_SUK_MTB{
meta:
description = "Backdoor:BAT/Remcos.SUK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 "
strings :
$a_01_0 = {11 04 1f 0a fe 02 13 06 11 06 2c 0c 07 08 66 5f 07 66 08 5f 60 0d 2b 13 00 11 05 17 1f 14 6f 29 01 00 0a 13 04 00 17 13 07 2b d5 } //2
condition:
((#a_01_0 & 1)*2) >=2
}
Backdoor/BAT/VenomRat/Backdoor_BAT_VenomRat_AXPA_MTB.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_BAT_VenomRat_AXPA_MTB{
meta:
description = "Backdoor:BAT/VenomRat.AXPA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 "
strings :
$a_03_0 = {2b 1b 2b 1c 2b 21 73 ?? ?? 00 0a 25 72 ?? ?? 00 70 2b 17 2b 1c 2b 1d 2b 22 2b 27 de 2d 02 2b e2 28 ?? ?? 00 06 2b dd 0a 2b dc 28 ?? ?? 00 0a 2b e2 06 2b e1 28 ?? ?? 00 06 2b dc 6f ?? ?? 00 0a 2b d7 0b 2b d6 } //5
condition:
((#a_03_0 & 1)*5) >=5
}
Backdoor/BAT/WebShell/Backdoor_BAT_WebShell_GTB_MTB.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_BAT_WebShell_GTB_MTB{
meta:
description = "Backdoor:BAT/WebShell.GTB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 "
strings :
$a_03_0 = {26 11 07 6f ?? 00 00 0a 13 08 11 07 6f ?? 00 00 0a 00 02 6f ?? 00 00 0a 6f ?? 00 00 0a 73 ?? 00 00 0a 08 08 6f ?? 00 00 0a 11 08 16 11 08 8e 69 6f ?? 00 00 0a 6f ?? 00 00 0a 00 00 00 de 05 26 00 00 de 00 00 2a } //10
condition:
((#a_03_0 & 1)*10) >=10
}
Backdoor/BAT/WebShell/Backdoor_BAT_WebShell_GTQ_MTB.yar
+13
View File
@@ -0,0 +1,13 @@
rule Backdoor_BAT_WebShell_GTQ_MTB{
meta:
description = "Backdoor:BAT/WebShell.GTQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 "
strings :
$a_03_0 = {0a 0c 02 6f ?? 00 00 0a 6f ?? 00 00 0a 07 6f ?? 00 00 0a 28 ?? 00 00 0a 0d d0 ?? 00 00 01 28 ?? 00 00 0a 72 } //10
$a_03_1 = {41 70 70 5f 57 65 62 5f [0-16] 2e 64 6c 6c } //1
$a_01_2 = {52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 } //1 RijndaelManaged
condition:
((#a_03_0 & 1)*10+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1) >=12
}
Backdoor/BAT/XWorm/Backdoor_BAT_XWorm_AQRA_MTB.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_BAT_XWorm_AQRA_MTB{
meta:
description = "Backdoor:BAT/XWorm.AQRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 "
strings :
$a_01_0 = {59 1c 58 1b 59 91 61 06 09 20 0f 02 00 00 58 20 0e 02 00 00 59 18 59 18 58 06 8e 69 5d 1f 09 58 1f 0b 58 1f 14 59 91 59 20 fb 00 00 00 58 1a 58 17 58 20 00 01 00 00 5d d2 9c 09 17 58 0d } //5
condition:
((#a_01_0 & 1)*5) >=5
}
Backdoor/Linux/BPFDoor/Backdoor_Linux_BPFDoor_G_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Backdoor_Linux_BPFDoor_G_MTB{
meta:
description = "Backdoor:Linux/BPFDoor.G!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {0f b6 45 ff 83 c0 01 88 45 ff 0f b6 55 ff 48 8b 45 f0 48 01 d0 0f b6 00 00 45 fe 0f b6 55 fe 48 8b 45 f0 48 01 c2 0f b6 4d ff 48 8b 45 f0 48 01 c8 48 89 d6 48 89 c7 e8 7c fe ff ff } //1
$a_01_1 = {48 8b 45 f0 48 01 d0 0f b6 10 0f b6 4d fe 48 8b 45 f0 48 01 c8 0f b6 00 01 d0 88 45 ef 8b 45 f8 48 63 d0 48 8b 45 d8 48 01 c2 8b 45 f8 48 63 c8 48 8b 45 d8 48 01 c8 0f b6 08 0f b6 75 ef 48 8b 45 f0 48 01 f0 0f b6 00 31 c8 88 02 83 45 f8 01 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Backdoor/Linux/BPFDoor/Backdoor_Linux_BPFDoor_I_MTB.yar
+13
View File
@@ -0,0 +1,13 @@
rule Backdoor_Linux_BPFDoor_I_MTB{
meta:
description = "Backdoor:Linux/BPFDoor.I!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 03 00 00 "
strings :
$a_01_0 = {2f 62 69 6e 2f 72 6d 20 2d 66 20 2f 64 65 76 2f 73 68 6d 2f 25 73 3b 2f 62 69 6e 2f 63 70 20 25 73 20 2f 64 65 76 2f 73 68 6d 2f 25 73 20 26 26 20 2f 62 69 6e 2f 63 68 6d 6f 64 20 37 35 35 20 2f 64 65 76 2f 73 68 6d 2f 25 73 20 26 26 20 2f 64 65 76 2f 73 68 6d 2f 25 73 20 2d 2d 69 6e 69 74 20 26 26 20 2f 62 69 6e 2f 72 6d 20 2d 66 20 2f 64 65 76 2f 73 68 6d 2f 25 73 } //1 /bin/rm -f /dev/shm/%s;/bin/cp %s /dev/shm/%s && /bin/chmod 755 /dev/shm/%s && /dev/shm/%s --init && /bin/rm -f /dev/shm/%s
$a_01_1 = {2f 73 62 69 6e 2f 69 70 74 61 62 6c 65 73 20 2d 74 20 6e 61 74 20 2d 41 20 50 52 45 52 4f 55 54 49 4e 47 20 2d 70 20 74 63 70 20 2d 73 20 25 73 20 2d 2d 64 70 6f 72 74 20 25 64 20 2d 6a 20 52 45 44 49 52 45 43 54 20 2d 2d 74 6f 2d 70 6f 72 74 73 20 25 64 } //1 /sbin/iptables -t nat -A PREROUTING -p tcp -s %s --dport %d -j REDIRECT --to-ports %d
$a_01_2 = {45 0f b6 d8 49 01 c3 45 8a 33 44 88 36 41 88 13 02 16 0f b6 d2 8a 14 10 41 30 14 3a } //2
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*2) >=4
}
Backdoor/Linux/BPFDoor/Backdoor_Linux_BPFDoor_J_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Backdoor_Linux_BPFDoor_J_MTB{
meta:
description = "Backdoor:Linux/BPFDoor.J!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 02 00 00 "
strings :
$a_01_0 = {88 45 ff 8b 45 f8 48 98 48 03 45 d8 8b 55 f8 48 63 d2 48 03 55 d8 0f b6 0a 0f b6 55 ff 48 03 55 e8 0f b6 12 31 ca 88 10 83 45 f8 01 } //2
$a_01_1 = {5b 2b 5d 20 20 20 53 70 61 77 6e 20 73 68 65 6c 6c 20 6f 6b 2e } //1 [+] Spawn shell ok.
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3
}
Backdoor/Linux/Gafgyt/Backdoor_Linux_Gafgyt_AU_MTB.yar
+14
View File
@@ -0,0 +1,14 @@
rule Backdoor_Linux_Gafgyt_AU_MTB{
meta:
description = "Backdoor:Linux/Gafgyt.AU!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {67 72 65 5f 61 74 74 61 63 6b 2e 63 } //1 gre_attack.c
$a_01_1 = {75 64 70 70 6c 61 69 6e 5f 61 74 74 61 63 6b } //1 udpplain_attack
$a_01_2 = {2f 74 6d 70 2f 2e 62 6f 74 5f 6c 6f 63 6b } //1 /tmp/.bot_lock
$a_01_3 = {69 63 6d 70 5f 61 74 74 61 63 6b 2e 63 } //1 icmp_attack.c
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Backdoor/Linux/Gafgyt/Backdoor_Linux_Gafgyt_BA_xp.yar
+3 -2
View File
@@ -1,14 +1,15 @@
rule Backdoor_Linux_Gafgyt_BA_xp{
meta:
description = "Backdoor:Linux/Gafgyt.BA!xp,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 04 00 00 "
description = "Backdoor:Linux/Gafgyt.BA!xp,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 05 00 00 "
strings :
$a_01_0 = {64 72 65 61 6d 62 6f 78 } //2 dreambox
$a_01_1 = {78 6d 68 64 69 70 63 } //2 xmhdipc
$a_01_2 = {61 64 6d 69 6e 31 32 33 34 } //1 admin1234
$a_01_3 = {6b 6c 76 31 32 33 } //1 klv123
$a_01_4 = {63 6f 6d 2e 62 69 74 64 65 66 65 6e 64 65 72 } //-1 com.bitdefender
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=6
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*-1) >=6
}
Backdoor/Linux/Gafgyt/Backdoor_Linux_Gafgyt_DF_MTB.yar
+15
View File
@@ -11,4 +11,19 @@ rule Backdoor_Linux_Gafgyt_DF_MTB{
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
rule Backdoor_Linux_Gafgyt_DF_MTB_2{
meta:
description = "Backdoor:Linux/Gafgyt.DF!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 06 00 00 "
strings :
$a_01_0 = {2e 73 68 3b 20 63 75 72 6c 20 2d 4f 20 68 74 74 70 3a 2f 2f 25 73 2f 63 61 74 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 63 61 74 2e 73 68 3b 20 73 68 20 63 61 74 2e 73 68 3b } //2 .sh; curl -O http://%s/cat.sh; chmod 777 cat.sh; sh cat.sh;
$a_01_1 = {39 32 2e 31 31 33 2e 32 39 2e 32 33 32 3a 38 31 } //2 92.113.29.232:81
$a_01_2 = {5b 30 6d 57 72 6f 6e 67 20 70 61 73 73 77 6f 72 64 21 } //1 [0mWrong password!
$a_01_3 = {5b 30 6d 4e 6f 20 73 68 65 6c 6c 20 61 76 61 69 6c 61 62 6c 65 } //1 [0mNo shell available
$a_01_4 = {74 65 6c 65 63 6f 6d 61 64 6d 69 6e } //1 telecomadmin
$a_01_5 = {6b 6c 76 31 32 33 34 } //1 klv1234
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=7
}
Backdoor/Linux/HailBot/Backdoor_Linux_HailBot_A_MTB.yar
+14
View File
@@ -0,0 +1,14 @@
rule Backdoor_Linux_HailBot_A_MTB{
meta:
description = "Backdoor:Linux/HailBot.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 00 "
strings :
$a_01_0 = {0c 03 b9 8f 00 00 00 00 09 f8 20 03 00 00 00 00 18 00 bc 8f 06 00 40 14 21 90 40 00 21 c8 c0 03 09 f8 20 03 21 20 20 02 18 00 bc 8f 21 90 22 02 } //1
$a_01_1 = {23 80 51 02 00 00 70 a2 21 28 20 02 21 20 a0 02 21 c8 e0 02 09 f8 20 03 21 30 00 02 00 00 43 82 01 00 c2 26 18 00 bc 8f 21 b0 50 00 07 00 60 10 21 98 b0 02 01 00 51 26 } //1
$a_01_2 = {f0 02 a3 8f 10 00 02 24 f4 02 a5 8f c0 02 a6 8f f8 02 b9 8f 14 00 a2 af 10 00 a3 af 21 20 20 02 09 f8 20 03 21 38 00 00 18 00 bc 8f 29 00 40 04 ff ff 72 26 05 00 02 24 fc 02 b0 8f 24 00 a2 af } //1
$a_01_3 = {f4 02 a2 8f 00 00 00 ae 04 00 10 26 fc ff 02 16 21 20 c0 02 1c 00 a2 8e 04 03 a3 8f 25 10 57 00 fc 02 a5 8f 1c 00 a2 ae 28 00 a0 af 10 00 a3 af 21 30 00 00 21 c8 c0 03 09 f8 20 03 21 38 00 00 21 18 40 00 ff ff 02 24 18 00 bc 8f } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3
}
Backdoor/Linux/KtlvDoor/Backdoor_Linux_KtlvDoor_A_MTB.yar
+17
View File
@@ -0,0 +1,17 @@
rule Backdoor_Linux_KtlvDoor_A_MTB{
meta:
description = "Backdoor:Linux/KtlvDoor.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_01_0 = {74 6f 6f 6c 73 2f 63 6d 64 2f 61 63 63 2f 61 67 65 6e 74 5f 61 63 63 2f 68 61 6e 64 6c 65 72 2f 70 6f 72 74 73 63 61 6e 2f 74 65 6d 70 6c 61 74 65 2e 53 63 61 6e 46 75 6e 63 52 65 67 69 73 74 65 72 } //1 tools/cmd/acc/agent_acc/handler/portscan/template.ScanFuncRegister
$a_01_1 = {2f 61 67 65 6e 74 5f 61 63 63 2f 63 6f 6e 66 2e 67 65 74 4d 61 63 68 69 6e 65 46 65 61 74 75 72 65 2e 66 75 6e 63 } //1 /agent_acc/conf.getMachineFeature.func
$a_01_2 = {2f 61 67 65 6e 74 5f 61 63 63 2f 63 6f 6e 66 2e 55 70 64 61 74 65 48 6f 73 74 49 6e 66 6f 2e 66 75 6e 63 } //1 /agent_acc/conf.UpdateHostInfo.func
$a_01_3 = {2f 4a 4b 6d 65 2f 67 6f 2d 6e 74 6c 6d 73 73 70 2e 43 68 61 6c 6c 65 6e 67 65 4d 73 67 2e 54 61 72 67 65 74 49 6e 66 6f } //1 /JKme/go-ntlmssp.ChallengeMsg.TargetInfo
$a_01_4 = {2f 68 61 6e 64 6c 65 72 2f 70 6f 72 74 73 63 61 6e 2f 70 73 5f 70 6c 75 67 69 6e 73 2e 53 63 61 6e 57 65 62 2e 66 75 6e 63 } //1 /handler/portscan/ps_plugins.ScanWeb.func
$a_01_5 = {74 6f 6f 6c 73 2f 69 6e 74 65 72 6e 61 6c 2f 75 74 69 6c 73 2f 73 68 65 6c 6c 71 75 6f 74 65 2e 67 6c 6f 62 2e 2e 66 75 6e 63 } //1 tools/internal/utils/shellquote.glob..func
$a_01_6 = {74 6f 6f 6c 73 2f 70 6b 67 2f 63 72 79 70 74 6f 2e 58 6f 72 } //1 tools/pkg/crypto.Xor
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7
}
Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KC_MTB.yar
+3 -2
View File
@@ -1,12 +1,13 @@
rule Backdoor_Linux_Mirai_KC_MTB{
meta:
description = "Backdoor:Linux/Mirai.KC!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 "
description = "Backdoor:Linux/Mirai.KC!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 00 "
strings :
$a_03_0 = {00 00 85 8c 74 01 b9 8f 21 20 40 02 09 f8 20 03 24 00 a6 27 21 88 40 00 ff ff 02 24 18 00 bc 8f cd ?? ?? ?? 21 10 51 02 21 80 40 02 0b 00 13 24 } //1
$a_03_1 = {64 01 b9 8f 21 28 80 00 09 f8 20 03 24 00 a7 27 21 88 40 00 ff ff 02 24 18 00 bc 8f 6b 00 22 16 21 80 00 00 d8 ?? ?? ?? ff ff 17 24 } //1
$a_01_2 = {80 00 c3 8f 00 00 35 8e 44 00 d9 8f 18 00 75 00 00 00 e2 8e 64 00 34 8f 48 00 c5 8f 4c 00 d9 8f 12 80 00 00 21 80 70 02 00 19 10 00 80 80 10 00 21 80 03 02 09 f8 20 03 21 80 02 02 21 18 40 00 10 00 dc 8f 00 00 02 ae 34 00 c2 8f 00 00 00 00 0c 00 40 10 c0 10 15 00 08 00 89 26 21 48 22 01 00 00 26 8d 04 00 27 8d 21 10 c3 00 21 28 00 00 2b 40 46 00 21 18 e5 00 21 18 03 01 00 00 22 ad 04 00 23 ad } //-5
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_01_2 & 1)*-5) >=2
}
Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KV_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Backdoor_Linux_Mirai_KV_MTB{
meta:
description = "Backdoor:Linux/Mirai.KV!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {00 00 44 82 21 c8 c0 02 09 f8 20 03 01 00 73 26 01 00 44 82 21 c8 c0 02 09 f8 20 03 80 84 02 00 03 00 44 82 00 13 02 00 21 c8 c0 02 09 f8 20 03 25 80 02 02 02 00 51 82 21 c8 c0 02 21 20 20 02 09 f8 20 03 25 80 02 02 80 11 02 00 25 80 02 02 03 14 10 00 3d 00 05 24 10 00 bc 8f 21 20 93 02 03 1a 10 00 03 00 25 12 00 00 e2 a2 00 00 83 a0 01 00 73 26 } //1
$a_01_1 = {21 10 0b 01 24 18 4f 00 06 00 61 04 21 58 60 00 ff ff 63 24 00 ff 02 24 25 18 62 00 01 00 63 24 21 58 60 00 21 18 83 00 00 00 62 90 00 00 00 00 00 00 22 a1 00 00 68 a0 00 00 22 91 00 00 a3 91 21 10 48 00 ff 00 42 30 21 10 82 00 00 00 42 90 00 00 00 00 26 10 43 00 00 00 c2 a1 01 00 82 25 ff 00 4c 30 2a 10 47 01 21 68 aa 00 21 70 ca 00 21 48 8c 00 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KY_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Backdoor_Linux_Mirai_KY_MTB{
meta:
description = "Backdoor:Linux/Mirai.KY!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {8f 99 83 6c 27 a4 00 18 24 05 00 01 12 00 00 08 02 40 30 21 03 20 f8 09 00 00 00 00 24 03 00 01 8f bc 00 10 10 43 ff f6 26 10 ff ff 26 10 00 01 02 30 10 23 8f bf 00 2c 8f b2 00 28 8f b1 00 24 8f b0 00 20 03 e0 00 08 27 bd 00 30 } //1
$a_01_1 = {82 03 00 00 00 00 00 00 10 60 00 03 24 02 00 25 14 62 ff fa 00 00 00 00 12 04 00 0c 02 04 88 23 1e 20 00 03 02 20 28 21 10 00 00 06 00 00 10 21 8f 99 83 6c 00 00 00 00 03 20 f8 09 02 c0 30 21 8f bc 00 18 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KZ_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Backdoor_Linux_Mirai_KZ_MTB{
meta:
description = "Backdoor:Linux/Mirai.KZ!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {01 30 8c e2 c3 2f a0 e1 22 2c a0 e1 02 30 83 e0 ff 30 03 e2 03 c0 62 e0 b5 2f 8d e2 0c 00 82 e0 c0 32 50 e5 03 30 8e e0 c3 1f a0 e1 21 1c a0 e1 01 30 83 e0 ff 30 03 e2 03 e0 61 e0 0e 30 d7 e7 0c 20 d7 e7 03 20 22 e0 0c 20 c7 e7 0e 30 d7 e7 03 20 22 e0 0e 20 c7 e7 0c 30 d7 e7 } //1
$a_01_1 = {0e 20 c7 e7 0c 30 d7 e7 03 20 22 e0 0c 20 c7 e7 b5 3f 8d e2 0e 10 83 e0 c0 22 51 e5 c0 32 50 e5 02 30 83 e0 ff 30 03 e2 b5 1f 8d e2 03 20 81 e0 c0 12 52 e5 05 30 d4 e7 01 30 23 e0 05 30 c4 e7 01 40 84 e2 04 00 56 e1 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LA_MTB.yar
+15
View File
@@ -0,0 +1,15 @@
rule Backdoor_Linux_Mirai_LA_MTB{
meta:
description = "Backdoor:Linux/Mirai.LA!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {41 74 74 61 63 6b 41 64 64 48 6f 73 74 } //1 AttackAddHost
$a_01_1 = {4b 69 6c 6c 65 72 53 63 61 6e 50 69 64 73 } //1 KillerScanPids
$a_01_2 = {41 74 74 61 63 6b 54 63 70 48 61 6e 64 73 68 61 6b 65 } //1 AttackTcpHandshake
$a_01_3 = {41 74 74 61 63 6b 54 63 70 41 63 6b } //1 AttackTcpAck
$a_01_4 = {41 74 74 61 63 6b 47 72 65 45 74 68 47 62 70 73 } //1 AttackGreEthGbps
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_GH_MTB.yar → Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LE_MTB.yar
+2 -2
View File
@@ -1,7 +1,7 @@
rule Backdoor_Linux_Mirai_GH_MTB{
rule Backdoor_Linux_Mirai_LE_MTB{
meta:
description = "Backdoor:Linux/Mirai.GH!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 "
description = "Backdoor:Linux/Mirai.LE!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {58 82 99 8f 00 00 a0 a0 09 f8 20 03 21 20 c0 02 18 00 bc 8f 21 20 c0 02 58 82 99 8f 2c 00 a0 af 30 00 a0 af 34 00 a0 af 38 00 a0 af 09 f8 20 03 21 88 c2 02 18 00 bc 8f 11 00 42 24 } //1
Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LF_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Backdoor_Linux_Mirai_LF_MTB{
meta:
description = "Backdoor:Linux/Mirai.LF!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {8b 44 24 04 8b 14 24 89 10 c7 40 04 00 00 00 00 8b 54 24 40 8b 43 04 89 02 c7 42 08 02 00 00 00 c7 42 0c 04 00 00 00 8b 44 24 04 eb 2c 8b 54 24 0c 8b 44 24 08 89 02 c7 42 04 00 00 00 00 8b 54 24 40 8b 43 04 89 02 c7 42 08 0a 00 00 00 c7 42 0c 10 00 00 00 8b 44 24 0c } //1
$a_01_1 = {0f b6 03 0f b6 53 01 c1 e0 08 09 d0 89 45 04 0f b6 43 02 0f b6 53 03 c1 e0 08 09 d0 89 45 08 0f b6 53 04 0f b6 46 01 c1 e2 18 c1 e0 10 0f b6 4e 02 c1 e1 08 09 c2 0f b6 46 03 09 c2 09 d1 89 4d 0c 0f b6 53 08 0f b6 43 09 c1 e2 08 83 c3 0a 09 c2 89 5d 14 89 55 10 8b 44 24 14 83 c4 10 83 c0 0a 89 45 18 39 54 24 08 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LG_MTB.yar
+13
View File
@@ -0,0 +1,13 @@
rule Backdoor_Linux_Mirai_LG_MTB{
meta:
description = "Backdoor:Linux/Mirai.LG!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {53 65 72 76 65 72 3a 20 44 4f 53 61 72 72 65 73 74 } //1 Server: DOSarrest
$a_01_1 = {74 6d 70 2f 2e 69 6e 73 74 61 6e 63 65 5f 6c 6f 63 6b } //1 tmp/.instance_lock
$a_01_2 = {66 74 70 67 65 74 20 2d 76 20 2d 75 20 61 6e 6f 6e 79 6d 6f 75 73 } //1 ftpget -v -u anonymous
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
}
Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LH_MTB.yar
+14
View File
@@ -0,0 +1,14 @@
rule Backdoor_Linux_Mirai_LH_MTB{
meta:
description = "Backdoor:Linux/Mirai.LH!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {64 64 6f 73 5f 74 63 70 5f 66 6c 6f 6f 64 } //1 ddos_tcp_flood
$a_01_1 = {63 6f 6e 6e 2e 6d 61 67 69 63 70 61 63 6b 65 74 6c 65 61 73 65 2e 6f 72 67 } //1 conn.magicpacketlease.org
$a_01_2 = {64 64 6f 73 5f 75 64 70 5f 62 79 70 61 73 73 5f 66 6c 6f 6f 64 } //1 ddos_udp_bypass_flood
$a_01_3 = {68 61 72 74 62 65 61 74 5f 73 65 6e 64 5f 73 68 75 74 64 6f 77 6e } //1 hartbeat_send_shutdown
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LK_MTB.yar
+14
View File
@@ -0,0 +1,14 @@
rule Backdoor_Linux_Mirai_LK_MTB{
meta:
description = "Backdoor:Linux/Mirai.LK!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {6b 69 6c 6c 65 72 5f 77 69 70 65 5f 73 74 72 69 6e 67 73 } //1 killer_wipe_strings
$a_01_1 = {61 74 74 61 63 6b 5f 67 72 65 2e 63 } //1 attack_gre.c
$a_01_2 = {6e 65 77 62 6f 74 5f 76 31 } //1 newbot_v1
$a_01_3 = {61 74 74 61 63 6b 5f 72 65 61 70 5f 64 65 61 64 } //1 attack_reap_dead
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Backdoor/Linux/Prometei/Backdoor_Linux_Prometei_B_MTB.yar
+13
View File
@@ -0,0 +1,13 @@
rule Backdoor_Linux_Prometei_B_MTB{
meta:
description = "Backdoor:Linux/Prometei.B!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {47 74 76 52 73 64 43 37 59 71 49 45 58 4b 66 73 49 43 56 73 4b 61 6b 50 2d 30 33 6a 39 2f 56 6c 65 4c 65 62 45 63 32 62 54 59 47 6d 64 69 58 49 54 62 79 78 77 7a 2d 50 62 4f 74 45 75 4d 4e 32 32 72 39 68 77 66 64 48 56 61 6f 6a 65 65 4d 68 33 67 55 70 61 2f 2d 46 71 54 46 41 71 2f 46 72 77 70 58 79 53 45 33 6c 71 32 7a 33 37 58 33 5a 6d 75 34 6a 56 78 53 6a 37 78 74 78 4c 74 50 2d 31 2f 4d 7a 2f 76 2d 66 48 62 68 4f 6a 39 61 78 4c 59 59 67 37 55 78 55 63 39 79 53 53 79 69 49 61 4b 57 43 34 53 32 70 47 52 6f 5f 00 } //1
$a_01_1 = {58 33 5a 6d 75 34 6a 56 78 53 6a 37 78 74 78 4c 74 50 2d 31 2f 4d 7a 2f 76 2d 66 48 62 68 4f 6a 39 61 78 4c 59 59 67 37 55 78 55 63 39 79 53 53 79 69 49 61 4b 57 43 34 53 32 70 47 52 6f 5f } //1 X3Zmu4jVxSj7xtxLtP-1/Mz/v-fHbhOj9axLYYg7UxUc9ySSyiIaKWC4S2pGRo_
$a_01_2 = {00 2f 65 74 63 2f 6f 73 2d 72 65 6c 65 61 73 65 00 63 61 74 20 2f 65 74 63 2f 6f 73 2d 72 65 6c 65 61 73 65 00 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
}
Backdoor/Linux/SAgnt/Backdoor_Linux_SAgnt_F_MTB.yar
+14
View File
@@ -0,0 +1,14 @@
rule Backdoor_Linux_SAgnt_F_MTB{
meta:
description = "Backdoor:Linux/SAgnt.F!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {2f 68 6f 6d 65 2f 75 73 65 72 2f 6f 73 73 6c 5f 62 61 63 6b 64 6f 6f 72 2f 62 61 63 6b 64 6f 6f 72 2e 63 } //1 /home/user/ossl_backdoor/backdoor.c
$a_01_1 = {2f 68 6f 6d 65 2f 75 73 65 72 2f 6f 73 73 6c 5f 62 61 63 6b 64 6f 6f 72 2f 6f 70 65 6e 73 73 6c 2f 64 69 67 65 73 74 63 6f 6d 6d 6f 6e 2e 63 } //1 /home/user/ossl_backdoor/openssl/digestcommon.c
$a_01_2 = {70 72 6f 76 69 64 65 72 3d 6e 6f 74 5f 61 5f 62 61 63 6b 64 6f 6f 72 } //1 provider=not_a_backdoor
$a_01_3 = {41 56 49 89 f6 41 55 49 89 d5 41 54 49 89 cc 55 48 89 fd bf 10 00 00 00 53 e8 de fb ff ff 48 89 c3 48 85 c0 74 3d 4c 89 f6 48 89 ef e8 fb fb ff ff 48 89 43 08 48 85 c0 74 22 48 8d 05 cb 25 00 00 49 89 1c 24 48 89 2b 49 89 45 00 b8 01 00 00 00 5b 5d 41 5c 41 5d 41 5e } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Backdoor/Linux/SAgnt/Backdoor_Linux_SAgnt_L_MTB.yar
-11
View File
@@ -1,11 +0,0 @@
rule Backdoor_Linux_SAgnt_L_MTB{
meta:
description = "Backdoor:Linux/SAgnt.L!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_00_0 = {83 90 12 00 28 00 b3 af 20 00 b1 af 1c 00 b0 af 2c 00 bf af 10 00 bc af 21 88 40 00 ff ff 52 26 21 98 60 00 42 00 10 3c } //1
condition:
((#a_00_0 & 1)*1) >=1
}
Backdoor/Linux/TinyShell/Backdoor_Linux_TinyShell_A_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Backdoor_Linux_TinyShell_A_MTB{
meta:
description = "Backdoor:Linux/TinyShell.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 02 00 00 "
strings :
$a_01_0 = {8b 45 f8 8b 4d 08 01 c1 8b 45 f8 8b 55 08 01 c2 8a 45 ff 32 02 88 01 8d 45 f8 ff 00 } //2
$a_01_1 = {69 63 6d 70 5b 34 3a 32 5d 20 3d 3d 20 30 78 61 61 35 36 } //1 icmp[4:2] == 0xaa56
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3
}
Backdoor/MacOS/NimDoor/Backdoor_MacOS_NimDoor_A_MTB.yar
+13
View File
@@ -0,0 +1,13 @@
rule Backdoor_MacOS_NimDoor_A_MTB{
meta:
description = "Backdoor:MacOS/NimDoor.A!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {48 89 fe 48 c1 ee 03 83 e6 38 48 8b 44 30 10 48 0f a3 f8 73 0c 48 8b 02 83 e0 01 48 09 c8 48 89 02 } //1
$a_01_1 = {4d 89 77 08 4c 89 e3 48 c1 fb 0c 4c 89 e7 48 c1 ff 15 e8 f8 f5 ff ff 48 89 da 48 c1 ea 03 be 01 00 00 00 89 d9 48 d3 e6 83 e2 38 48 09 74 10 10 4b 8b 54 37 08 31 c9 81 fa 00 01 00 00 0f 93 c1 48 c1 e1 03 31 c0 81 fa 00 00 00 01 0f 93 c0 81 fa 00 00 01 00 48 8d 04 c5 10 00 00 00 48 0f 42 c1 89 d6 89 c1 48 d3 ee } //1
$a_01_2 = {48 89 f2 48 c1 ea 03 83 e2 38 48 8b 44 10 10 48 0f a3 f0 73 15 49 39 4c 24 08 75 0e 49 8b 07 83 e0 01 48 09 c8 49 89 07 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
}
Backdoor/Script/RogueSpy/Backdoor_Script_RogueSpy_E_dha.yar
+18
View File
@@ -0,0 +1,18 @@
rule Backdoor_Script_RogueSpy_E_dha{
meta:
description = "Backdoor:Script/RogueSpy.E!dha,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 08 00 00 "
strings :
$a_00_0 = {76 00 7a 00 35 00 6d 00 68 00 65 00 37 00 6a 00 6d 00 6a 00 74 00 37 00 72 00 67 00 69 00 71 00 37 00 75 00 68 00 67 00 6d 00 65 00 6d 00 74 00 73 00 7a 00 66 00 65 00 68 00 6c 00 6d 00 6a 00 68 00 68 00 63 00 75 00 65 00 35 00 7a 00 7a 00 33 00 6f 00 6e 00 68 00 74 00 6c 00 76 00 33 00 6d 00 66 00 6c 00 68 00 77 00 76 00 69 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 vz5mhe7jmjt7rgiq7uhgmemtszfehlmjhhcue5zz3onhtlv3mflhwvid.onion
$a_00_1 = {61 00 63 00 66 00 6e 00 63 00 7a 00 68 00 79 00 7a 00 6c 00 68 00 76 00 66 00 6b 00 35 00 62 00 68 00 79 00 75 00 75 00 71 00 79 00 6d 00 6d 00 76 00 35 00 76 00 61 00 6b 00 34 00 78 00 71 00 78 00 71 00 70 00 67 00 61 00 6d 00 72 00 6a 00 65 00 68 00 32 00 77 00 78 00 78 00 69 00 61 00 37 00 6d 00 6f 00 76 00 62 00 7a 00 79 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 acfnczhyzlhvfk5bhyuuqymmv5vak4xqxqpgamrjeh2wxxia7movbzyd.onion
$a_00_2 = {32 00 7a 00 69 00 6c 00 6d 00 69 00 79 00 73 00 74 00 66 00 62 00 6a 00 69 00 62 00 32 00 6b 00 34 00 68 00 76 00 68 00 70 00 6e 00 76 00 32 00 75 00 68 00 6e 00 69 00 34 00 61 00 78 00 35 00 63 00 65 00 34 00 78 00 6c 00 70 00 62 00 37 00 73 00 77 00 6b 00 6a 00 69 00 6d 00 66 00 6e 00 73 00 7a 00 78 00 62 00 6b 00 61 00 69 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 2zilmiystfbjib2k4hvhpnv2uhni4ax5ce4xlpb7swkjimfnszxbkaid.onion
$a_00_3 = {69 00 32 00 72 00 67 00 63 00 76 00 6f 00 67 00 36 00 63 00 79 00 70 00 6a 00 6f 00 68 00 66 00 7a 00 66 00 7a 00 77 00 33 00 64 00 35 00 6b 00 71 00 67 00 6f 00 6f 00 62 00 6b 00 7a 00 6c 00 62 00 63 00 68 00 73 00 64 00 78 00 78 00 34 00 67 00 6d 00 37 00 6c 00 79 00 61 00 78 00 6e 00 35 00 6e 00 66 00 70 00 36 00 62 00 69 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 i2rgcvog6cypjohfzfzw3d5kqgoobkzlbchsdxx4gm7lyaxn5nfp6bid.onion
$a_00_4 = {7a 00 6b 00 33 00 62 00 34 00 79 00 71 00 36 00 7a 00 61 00 6f 00 37 00 6d 00 68 00 6f 00 79 00 79 00 66 00 65 00 73 00 71 00 32 00 79 00 36 00 6c 00 73 00 32 00 6b 00 36 00 63 00 69 00 61 00 33 00 35 00 6a 00 77 00 6a 00 62 00 69 00 71 00 65 00 36 00 66 00 79 00 64 00 35 00 63 00 6a 00 69 00 35 00 74 00 73 00 77 00 65 00 79 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 zk3b4yq6zao7mhoyyfesq2y6ls2k6cia35jwjbiqe6fyd5cji5tsweyd.onion
$a_00_5 = {6e 00 36 00 62 00 36 00 6a 00 34 00 76 00 6c 00 6b 00 63 00 34 00 61 00 6b 00 33 00 34 00 33 00 6a 00 34 00 66 00 6d 00 75 00 77 00 6d 00 6f 00 73 00 78 00 74 00 77 00 72 00 66 00 74 00 36 00 62 00 70 00 68 00 35 00 73 00 35 00 35 00 36 00 32 00 6c 00 65 00 66 00 6a 00 69 00 34 00 61 00 34 00 37 00 35 00 73 00 6d 00 75 00 61 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 n6b6j4vlkc4ak343j4fmuwmosxtwrft6bph5s5562lefji4a475smuad.onion
$a_00_6 = {71 00 71 00 64 00 64 00 34 00 64 00 72 00 62 00 76 00 6b 00 33 00 79 00 75 00 6f 00 63 00 79 00 73 00 74 00 6e 00 71 00 79 00 6f 00 6e 00 62 00 32 00 36 00 79 00 6f 00 37 00 6b 00 6f 00 73 00 66 00 72 00 61 00 6f 00 74 00 61 00 72 00 74 00 76 00 64 00 63 00 72 00 6f 00 36 00 69 00 35 00 37 00 61 00 75 00 73 00 79 00 6b 00 71 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 qqdd4drbvk3yuocystnqyonb26yo7kosfraotartvdcro6i57ausykqd.onion
$a_00_7 = {34 00 65 00 70 00 76 00 33 00 34 00 78 00 6a 00 75 00 6b 00 72 00 35 00 79 00 32 00 7a 00 68 00 68 00 69 00 7a 00 74 00 73 00 72 00 35 00 66 00 76 00 73 00 68 00 79 00 69 00 67 00 36 00 68 00 77 00 36 00 69 00 77 00 33 00 77 00 33 00 36 00 78 00 77 00 63 00 75 00 61 00 78 00 63 00 6a 00 64 00 75 00 6d 00 79 00 32 00 75 00 69 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 4epv34xjukr5y2zhhiztsr5fvshyig6hw6iw3w36xwcuaxcjdumy2uid.onion
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1) >=1
}
Backdoor/Script/RogueSpy/Backdoor_Script_RogueSpy_F_dha.yar
+13
View File
@@ -0,0 +1,13 @@
rule Backdoor_Script_RogueSpy_F_dha{
meta:
description = "Backdoor:Script/RogueSpy.F!dha,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_00_0 = {63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 78 00 } //1 curl.exe -x
$a_00_1 = {73 00 6f 00 63 00 6b 00 73 00 35 00 68 00 3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 3a 00 39 00 30 00 35 00 30 00 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 } //1 socks5h://127.0.0.1:9050 http://
$a_00_2 = {2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 .onion
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3
}
Backdoor/Win32/DarkKomet/Backdoor_Win32_DarkKomet_MA_MTB.yar
-13
View File
@@ -1,13 +0,0 @@
rule Backdoor_Win32_DarkKomet_MA_MTB{
meta:
description = "Backdoor:Win32/DarkKomet.MA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_03_0 = {8b 5d 08 b8 4d 5a 00 00 66 39 03 74 ?? 33 c0 eb ?? 8b 43 3c 81 3c 18 50 45 00 00 75 ?? 8b 44 18 78 83 65 08 00 56 03 c3 8b 70 20 8b 48 18 57 8b 78 1c 03 f3 03 fb 89 4d fc 85 c9 74 } //1
$a_03_1 = {33 c1 8b c8 c1 e1 18 c1 f9 1f 81 e1 ?? ?? ?? ?? 8b f0 c1 e6 1f c1 fe 1f 81 e6 ?? ?? ?? ?? 33 ce 8b f0 c1 e6 1d c1 fe 1f 81 e6 ?? ?? ?? ?? 33 ce 8b f0 c1 e6 19 c1 fe 1f 81 e6 ?? ?? ?? ?? 33 ce 8b f0 c1 e6 1a c1 fe 1f 81 e6 ?? ?? ?? ?? 33 ce } //1
$a_01_2 = {49 73 50 72 6f 63 65 73 73 6f 72 46 65 61 74 75 72 65 50 72 65 73 65 6e 74 } //1 IsProcessorFeaturePresent
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1) >=3
}
Backdoor/Win32/Dridex/Backdoor_Win32_Dridex_SD_MTB.yar
-13
View File
@@ -1,13 +0,0 @@
rule Backdoor_Win32_Dridex_SD_MTB{
meta:
description = "Backdoor:Win32/Dridex.SD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 00 "
strings :
$a_00_0 = {6a 08 8b c1 5d a8 01 74 09 d1 e8 35 20 83 b8 ed eb 02 d1 e8 83 ed 01 75 ec 89 04 8a 41 81 f9 00 01 00 00 7c db } //1
$a_02_1 = {8b 08 33 d2 03 ce 8a 01 88 44 24 30 84 c0 74 16 8d 44 24 30 2b c8 42 8d 04 11 8a 44 04 30 88 44 14 30 84 c0 75 f0 8d 4c 24 30 e8 [0-06] 39 44 24 28 74 1f 8b 4c 24 18 83 c5 02 8b 44 24 1c 41 83 c0 04 89 4c 24 18 89 44 24 1c 3b 4c 37 18 72 ae } //1
$a_03_2 = {8b 08 33 d2 03 ce 8a 01 88 44 ?? ?? 84 c0 74 16 8d 44 ?? ?? 2b c8 42 8d 04 11 8a 44 ?? ?? 88 44 ?? ?? 84 c0 75 f0 8d 4c ?? ?? e8 ?? ?? ?? ?? 39 44 ?? ?? 74 1f 8b 4c ?? ?? 83 c5 02 8b 44 ?? ?? 41 83 c0 04 89 4c ?? ?? 89 44 ?? ?? 3b 4c ?? ?? 72 } //1
condition:
((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_03_2 & 1)*1) >=2
}
Backdoor/Win32/Farfli/Backdoor_Win32_Farfli_BAA_MTB.yar
+10
View File
@@ -1,5 +1,15 @@
rule Backdoor_Win32_Farfli_BAA_MTB{
meta:
description = "Backdoor:Win32/Farfli.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 "
strings :
$a_03_0 = {33 c9 0f b7 d1 8a 94 55 ?? ?? ?? ?? 30 10 41 40 4e 75 } //2
condition:
((#a_03_0 & 1)*2) >=2
}
rule Backdoor_Win32_Farfli_BAA_MTB_2{
meta:
description = "Backdoor:Win32/Farfli.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 "
Backdoor/Win32/IRCBot/Backdoor_Win32_IRCbot_gen_A.yar
+3 -2
View File
@@ -1,7 +1,7 @@
rule Backdoor_Win32_IRCbot_gen_A{
meta:
description = "Backdoor:Win32/IRCbot.gen!A,SIGNATURE_TYPE_PEHSTR,06 00 06 00 07 00 00 "
description = "Backdoor:Win32/IRCbot.gen!A,SIGNATURE_TYPE_PEHSTR,07 00 07 00 08 00 00 "
strings :
$a_01_0 = {72 6f 6f 74 } //1 root
@@ -11,7 +11,8 @@ rule Backdoor_Win32_IRCbot_gen_A{
$a_01_4 = {25 73 5c 63 24 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d } //1 %s\c$\windows\system
$a_01_5 = {25 73 5c 41 64 6d 69 6e 24 5c 73 79 73 74 65 6d } //1 %s\Admin$\system
$a_01_6 = {25 73 5c 69 70 63 24 } //1 %s\ipc$
$a_01_7 = {50 52 49 56 4d 53 47 20 } //1 PRIVMSG
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=6
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=7
}
Backdoor/Win32/KaziBora/Backdoor_Win32_KaziBora_A_dha.yar
+15
View File
@@ -0,0 +1,15 @@
rule Backdoor_Win32_KaziBora_A_dha{
meta:
description = "Backdoor:Win32/KaziBora.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 06 00 05 00 00 "
strings :
$a_01_0 = {53 79 63 6d 65 6e 74 65 63 } //6 Sycmentec
$a_02_1 = {14 88 77 66 c7 [0-03] 08 02 00 00 } //6
$a_00_2 = {03 77 66 55 } //2 眃啦
$a_00_3 = {01 77 66 55 } //2 省啦
$a_00_4 = {11 88 77 66 } //2
condition:
((#a_01_0 & 1)*6+(#a_02_1 & 1)*6+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2) >=6
}
Backdoor/Win32/Kazuar/Backdoor_Win32_Kazuar_I_dha.yar
+12
View File
@@ -0,0 +1,12 @@
rule Backdoor_Win32_Kazuar_I_dha{
meta:
description = "Backdoor:Win32/Kazuar.I!dha,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {24 00 70 00 61 00 79 00 6c 00 6f 00 61 00 64 00 5f 00 66 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 } //1 $payload_filename
$a_01_1 = {25 00 6c 00 73 00 5c 00 25 00 6c 00 73 00 } //1 %ls\%ls
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Backdoor/Win32/PipeMagic/Backdoor_Win32_PipeMagic_PA_MTB.yar
+13
View File
@@ -0,0 +1,13 @@
rule Backdoor_Win32_PipeMagic_PA_MTB{
meta:
description = "Backdoor:Win32/PipeMagic.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 "
strings :
$a_01_0 = {66 00 75 00 63 00 6b 00 69 00 74 00 } //1 fuckit
$a_01_1 = {5c 5c 2e 5c 70 69 70 65 5c 31 2e 25 73 } //3 \\.\pipe\1.%s
$a_03_2 = {99 b9 ff 00 00 00 f7 f9 88 96 ?? ?? ?? ?? 46 83 fe 10 72 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*3+(#a_03_2 & 1)*1) >=5
}
Backdoor/Win32/Poison/Backdoor_Win32_Poison_GTZ_MTB.yar
+14
View File
@@ -0,0 +1,14 @@
rule Backdoor_Win32_Poison_GTZ_MTB{
meta:
description = "Backdoor:Win32/Poison.GTZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 00 "
strings :
$a_03_0 = {6d 31 00 0d ?? ?? ?? ?? 53 53 59 33 32 00 19 01 00 } //10
$a_80_1 = {73 76 63 68 6f 63 74 2e 65 78 65 } //svchoct.exe 1
$a_80_2 = {74 61 73 6b 6b 69 6c 6c 20 2f 66 20 2f 69 6d 20 20 73 76 63 68 6f 63 74 } //taskkill /f /im svchoct 1
$a_80_3 = {6b 33 79 6c 6f 67 67 65 72 2e 74 78 74 } //k3ylogger.txt 1
condition:
((#a_03_0 & 1)*10+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=13
}
Backdoor/Win32/Prosti/Backdoor_Win32_Prosti_CCJZ_MTB.yar
+18
View File
@@ -0,0 +1,18 @@
rule Backdoor_Win32_Prosti_CCJZ_MTB{
meta:
description = "Backdoor:Win32/Prosti.CCJZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 00 "
strings :
$a_01_0 = {53 74 61 72 74 20 54 6f 20 49 6e 4a 65 63 74 } //2 Start To InJect
$a_01_1 = {44 6c 6c 72 75 6e } //2 Dllrun
$a_01_2 = {42 75 66 5f 43 6f 6f 6c 44 6c 6c } //1 Buf_CoolDll
$a_01_3 = {52 65 61 6c 48 6f 73 74 3a } //1 RealHost:
$a_01_4 = {48 6f 73 74 50 49 44 3a } //1 HostPID:
$a_01_5 = {53 59 53 54 45 4d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 53 65 72 76 69 63 65 73 5c 4e 65 74 44 44 45 5c 53 79 73 44 6c 6c } //1 SYSTEM\CurrentControlSet\Services\NetDDE\SysDll
$a_01_6 = {5c 54 65 6d 70 5c 63 6f 6d 62 2e 64 6c 6c } //1 \Temp\comb.dll
$a_01_7 = {43 3a 5c 24 52 45 43 59 43 4c 45 2e 42 49 4e } //1 C:\$RECYCLE.BIN
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=10
}
Backdoor/Win32/Remcos/Backdoor_Win32_Remcos_GZZ_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Backdoor_Win32_Remcos_GZZ_MTB{
meta:
description = "Backdoor:Win32/Remcos.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 00 "
strings :
$a_03_0 = {33 d8 33 fa 89 5c 24 ?? 8b cf 8b 74 24 ?? 8b df 8b c6 c1 eb 0f 0f a4 c1 11 33 d2 89 7c 24 ?? c1 e0 ?? 0b d1 0b d8 } //10
$a_03_1 = {f0 64 a1 30 00 00 00 89 78 ?? 8b 42 ?? 03 c7 ff d0 } //5
condition:
((#a_03_0 & 1)*10+(#a_03_1 & 1)*5) >=15
}
Backdoor/Win32/Supper/Backdoor_Win32_Supper_GTB_MTB.yar
+12
View File
@@ -0,0 +1,12 @@
rule Backdoor_Win32_Supper_GTB_MTB{
meta:
description = "Backdoor:Win32/Supper.GTB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 "
strings :
$a_03_0 = {48 8b 04 1f 48 33 45 ?? 48 89 04 1e e8 } //5
$a_03_1 = {48 8b 07 48 89 45 ?? 48 83 c7 ?? 48 31 db e8 } //5
condition:
((#a_03_0 & 1)*5+(#a_03_1 & 1)*5) >=10
}
Backdoor/Win32/Tofsee/Backdoor_Win32_Tofsee_GNQ_MTB.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_Win32_Tofsee_GNQ_MTB{
meta:
description = "Backdoor:Win32/Tofsee.GNQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 "
strings :
$a_03_0 = {d3 ea 89 55 ?? 8b 45 ?? 03 45 ?? 89 45 ?? 8b 4d ?? 33 4d ?? 89 4d ?? 81 3d ?? ?? ?? ?? c1 10 00 00 } //10
condition:
((#a_03_0 & 1)*10) >=10
}
Backdoor/Win32/Tofsee/Backdoor_Win32_Tofsee_GNR_MTB.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_Win32_Tofsee_GNR_MTB{
meta:
description = "Backdoor:Win32/Tofsee.GNR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 "
strings :
$a_03_0 = {00 ff 30 e8 e4 6e 00 00 83 ec ?? c6 04 24 ?? 8d 1d ?? ?? ?? ?? 81 eb ?? ?? ?? ?? 53 8d 15 ?? ?? ?? ?? 81 ea ?? ?? ?? ?? 52 } //10
condition:
((#a_03_0 & 1)*10) >=10
}
Backdoor/Win64/AKDnsClient/Backdoor_Win64_AKDnsClient_A.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_Win64_AKDnsClient_A{
meta:
description = "Backdoor:Win64/AKDnsClient.A,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_03_0 = {72 65 73 75 6c 74 5f 72 65 63 65 69 76 65 64 ?? 56 48 42 44 40 48 00 } //1
condition:
((#a_03_0 & 1)*1) >=1
}
Backdoor/Win64/AKHttpClient/Backdoor_Win64_AKHttpClient_A.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_Win64_AKHttpClient_A{
meta:
description = "Backdoor:Win64/AKHttpClient.A,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_03_0 = {56 48 42 44 40 48 ?? ?? ?? ?? ?? ?? 75 6e 6b 6e 6f 77 6e 2e 6c 6f 63 61 6c 00 00 00 } //1
condition:
((#a_03_0 & 1)*1) >=1
}
Backdoor/Win64/CoinFlip/Backdoor_Win64_CoinFlip_A_dha.yar
+19
View File
@@ -0,0 +1,19 @@
rule Backdoor_Win64_CoinFlip_A_dha{
meta:
description = "Backdoor:Win64/CoinFlip.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 00 "
strings :
$a_01_0 = {73 72 63 5c 63 68 61 6e 67 65 62 61 63 6b 75 70 2e 72 73 } //1 src\changebackup.rs
$a_01_1 = {73 72 63 5c 73 63 72 65 65 6e 73 68 6f 74 2e 72 73 } //1 src\screenshot.rs
$a_01_2 = {73 72 63 5c 74 61 73 6b 6c 69 73 74 2e 72 73 } //1 src\tasklist.rs
$a_01_3 = {73 72 63 5c 75 70 6c 6f 61 64 5f 66 69 6c 65 2e 72 73 } //1 src\upload_file.rs
$a_01_4 = {73 72 63 5c 64 6e 73 68 6f 73 74 6e 61 6d 65 2e 72 73 } //1 src\dnshostname.rs
$a_01_5 = {73 72 63 5c 64 6f 77 6e 6c 6f 61 64 66 69 6c 65 2e 72 73 } //1 src\downloadfile.rs
$a_01_6 = {73 72 63 5c 69 70 63 6f 6e 66 69 67 2e 72 73 } //1 src\ipconfig.rs
$a_01_7 = {73 72 63 5c 6b 69 6c 6c 70 72 6f 67 72 61 6d 2e 72 73 } //1 src\killprogram.rs
$a_01_8 = {73 72 63 5c 72 75 6e 63 6f 6d 6d 61 6e 64 2e 72 73 } //1 src\runcommand.rs
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=5
}
Backdoor/Win64/PipeMagic/Backdoor_Win64_PipeMagic_D_ldr.yar
+12
View File
@@ -0,0 +1,12 @@
rule Backdoor_Win64_PipeMagic_D_ldr{
meta:
description = "Backdoor:Win64/PipeMagic.D!ldr,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {8a 14 08 41 30 14 08 48 8d 51 01 48 89 d1 48 83 fa 10 75 } //1
$a_03_1 = {c1 e6 18 c1 e7 10 41 c1 e3 08 41 09 cb 41 09 fb 48 89 df 41 09 f3 41 8b 48 ?? 0f c9 44 31 d9 } //1
condition:
((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=2
}
Backdoor/Win64/PipeMagic/Backdoor_Win64_PipeMagic_E.yar
+12
View File
@@ -0,0 +1,12 @@
rule Backdoor_Win64_PipeMagic_E{
meta:
description = "Backdoor:Win64/PipeMagic.E,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_03_0 = {41 03 d0 c1 fa 07 8b ca c1 e9 1f 03 d1 69 ca ff 00 00 ?? 44 2b c1 44 88 04 03 48 03 df 48 83 fb 10 } //1
$a_01_1 = {41 0f b6 00 49 ff c0 8b c8 48 c1 e8 04 83 e1 0f 42 8a 04 18 88 02 48 8d 52 02 42 8a 04 19 88 42 ff 41 83 c1 ff } //1
condition:
((#a_03_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Backdoor/Win64/PipeMagic/Backdoor_Win64_PipeMagic_F.yar
+11
View File
@@ -0,0 +1,11 @@
rule Backdoor_Win64_PipeMagic_F{
meta:
description = "Backdoor:Win64/PipeMagic.F,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_03_0 = {52 53 41 20 74 6f 6f 20 73 68 6f 72 74 29 2e 00 00 00 00 00 ?? 00 30 31 32 33 34 35 36 37 38 39 41 42 43 44 45 46 00 00 00 00 34 34 33 00 47 45 54 20 2f 25 73 20 48 54 54 50 2f 31 2e 31 0d 0a 00 00 00 00 00 00 31 32 37 2e 30 2e 30 2e 31 00 00 00 00 00 00 00 48 6f 73 74 3a 20 25 73 0d 0a 00 00 00 00 00 00 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 55 70 67 72 61 64 65 0d 0a 00 00 00 00 00 00 00 00 00 00 00 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 } //1
condition:
((#a_03_0 & 1)*1) >=1
}
Backdoor/Win64/Ruspble/Backdoor_Win64_Ruspble_A.yar
+5 -5
View File
@@ -6,11 +6,11 @@ rule Backdoor_Win64_Ruspble_A{
strings :
$a_41_0 = {8a 0c 00 8d 47 01 41 32 0b 99 41 f7 f9 41 32 ca 41 88 0b 8b fa 49 ff c3 44 8a d1 48 83 eb 01 01 } //1
$a_48_1 = {30 2e 30 2e 30 2e 30 00 01 00 0a 41 48 b8 11 42 08 21 84 10 42 08 01 00 14 43 47 6c 6f 62 90 01 04 61 6c 5c 25 90 01 04 30 38 78 00 90 00 01 00 16 43 8e 4e 0e ec 74 90 01 03 aa fc 0d 7c 74 90 01 } //2560
$a_af_2 = {90 00 01 00 11 01 53 79 73 74 65 6d 46 75 6e 63 74 69 6f 6e 30 33 36 00 00 5d 04 00 00 cc 3a 05 80 5c 27 00 00 d4 3a 05 80 00 00 01 00 08 00 11 00 af 01 46 6f 72 6d 42 6f 6f 6b 2e 42 47 21 4d 54 42 00 00 0a 40 05 82 70 00 04 00 67 16 00 00 d6 b1 dc 00 15 28 ec e6 b3 cb ee 56 00 e2 0b 00 01 20 c4 47 4e c8 67 16 00 00 87 e5 6f 11 f1 bf ba 17 ee b3 a1 1f 00 e4 0d 00 01 20 02 56 af 3b 67 16 00 00 01 45 c8 12 1f db 4a a6 69 10 65 cf 00 08 0c 00 01 20 c7 e4 98 7a 67 16 00 00 60 f0 b1 b7 4e 2f 74 56 af fc f9 0a 1d 8c 0a 00 01 20 ed 28 15 ba 67 16 00 00 8c 82 a0 c3 77 67 93 8b be 0d 3e d9 08 16 0c 00 01 20 } //21507
$a_b0_3 = {16 00 00 f2 3f 38 db 77 67 93 8b 9d 49 36 a3 08 1a 0c 00 01 20 a4 72 bb d2 67 16 00 00 c9 00 6d } //4308
$a_de_4 = {a7 26 6b 12 00 8a 09 00 01 20 b0 0f c7 b0 67 16 00 00 52 6a 9d f3 e8 ba ee 50 58 57 99 a2 d6 7a 0a 00 01 20 a7 a9 bd 04 78 7d 00 00 05 00 05 00 02 00 00 03 00 47 03 16 0b 2b 2d 02 06 07 28 90 01 01 00 00 06 0c 04 03 6f 90 01 01 00 00 0a 59 0d 03 08 09 28 90 01 01 00 00 06 03 08 09 28 90 01 01 00 00 06 03 04 28 90 01 01 00 00 06 07 17 58 0b 07 02 6f 90 01 01 00 00 0a 32 90 00 02 00 25 03 02 03 16 61 04 16 60 6f 90 01 01 00 00 0a 0a 90 02 04 28 90 01 01 00 00 0a 16 61 28 90 01 01 00 00 0a 2a 90 00 00 00 78 2f 01 00 06 00 06 00 06 00 00 01 00 } //-32033
$a_00_5 = {70 00 65 00 6e 00 76 00 70 00 6e 00 31 00 5c 00 6f 00 70 00 65 00 6e 00 76 00 70 00 6e 00 31 00 2e 00 65 00 78 00 65 00 01 00 12 01 68 50 66 64 73 66 68 64 73 64 72 6f 64 73 63 65 73 73 01 00 18 01 6c 70 42 61 73 66 73 64 73 64 66 65 64 64 66 68 73 41 64 64 72 65 73 73 01 00 5e 01 66 00 51 00 55 00 48 00 62 00 58 00 44 00 61 00 6a } //298
$a_af_2 = {90 00 01 00 11 01 53 79 73 74 65 6d 46 75 6e 63 74 69 6f 6e 30 33 36 00 00 5d 04 00 00 cc 3a 05 80 5c 27 00 00 d4 3a 05 80 00 00 01 00 08 00 11 00 af 01 46 6f 72 6d 42 6f 6f 6b 2e 42 47 21 4d 54 42 00 00 05 40 05 82 70 00 04 00 67 16 00 00 01 45 c8 12 1f db 4a a6 69 10 65 cf 00 08 0c 00 01 20 c7 e4 98 7a 67 16 00 00 34 c6 29 76 26 b0 bd e0 f5 e5 52 02 21 8c 0a 00 01 20 a0 7a be fa 67 16 00 00 f2 3f 38 db 77 67 93 8b 9d 49 36 a3 08 1a 0c 00 01 20 a4 72 bb d2 78 7d 00 00 05 00 05 00 02 00 00 03 00 47 03 16 0b 2b 2d 02 06 07 28 90 01 01 00 00 06 0c 04 03 6f 90 01 01 00 00 0a 59 0d 03 08 09 28 90 01 01 } //21507
$a_03_3 = {08 09 28 90 01 01 } //0
$a_03_4 = {04 28 90 01 01 00 } //0
$a_17_5 = {0b 07 02 6f 90 01 01 } //1536
condition:
((#a_41_0 & 1)*1+(#a_48_1 & 1)*2560+(#a_af_2 & 1)*21507+(#a_b0_3 & 1)*4308+(#a_de_4 & 1)*-32033+(#a_00_5 & 1)*298) >=4
((#a_41_0 & 1)*1+(#a_48_1 & 1)*2560+(#a_af_2 & 1)*21507+(#a_03_3 & 1)*0+(#a_03_4 & 1)*0+(#a_17_5 & 1)*1536) >=4
}
BrowserModifier/MSIL/MediaArena/BrowserModifier_MSIL_MediaArena.yar
+22 -4
View File
@@ -15,6 +15,24 @@ rule BrowserModifier_MSIL_MediaArena{
}
rule BrowserModifier_MSIL_MediaArena_2{
meta:
description = "BrowserModifier:MSIL/MediaArena,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 00 "
strings :
$a_80_0 = {67 65 74 5f 41 70 70 4e 61 6d 65 } //get_AppName 1
$a_80_1 = {67 65 74 5f 54 61 72 67 65 74 50 61 74 68 } //get_TargetPath 1
$a_80_2 = {73 65 74 5f 54 61 72 67 65 74 50 61 74 68 } //set_TargetPath 1
$a_80_3 = {67 65 74 5f 55 72 6c } //get_Url 1
$a_80_4 = {67 65 74 5f 44 6f 42 72 6f } //get_DoBro 1
$a_80_5 = {73 65 74 5f 53 6f 75 72 63 65 49 64 65 6e } //set_SourceIden 1
$a_80_6 = {6f 66 66 65 72 5f 69 64 } //offer_id 1
$a_80_7 = {50 44 46 53 6b 69 6c 6c 73 } //PDFSkills 1
$a_80_8 = {66 61 76 69 63 6f 6e } //favicon 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=9
}
rule BrowserModifier_MSIL_MediaArena_3{
meta:
description = "BrowserModifier:MSIL/MediaArena,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 00 "
@@ -33,7 +51,7 @@ rule BrowserModifier_MSIL_MediaArena_2{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1) >=10
}
rule BrowserModifier_MSIL_MediaArena_3{
rule BrowserModifier_MSIL_MediaArena_4{
meta:
description = "BrowserModifier:MSIL/MediaArena,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 "
@@ -50,7 +68,7 @@ rule BrowserModifier_MSIL_MediaArena_3{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1) >=8
}
rule BrowserModifier_MSIL_MediaArena_4{
rule BrowserModifier_MSIL_MediaArena_5{
meta:
description = "BrowserModifier:MSIL/MediaArena,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 00 "
@@ -71,7 +89,7 @@ rule BrowserModifier_MSIL_MediaArena_4{
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1) >=12
}
rule BrowserModifier_MSIL_MediaArena_5{
rule BrowserModifier_MSIL_MediaArena_6{
meta:
description = "BrowserModifier:MSIL/MediaArena,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 00 "
@@ -92,7 +110,7 @@ rule BrowserModifier_MSIL_MediaArena_5{
((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*3+(#a_01_3 & 1)*3+(#a_01_4 & 1)*2+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=12
}
rule BrowserModifier_MSIL_MediaArena_6{
rule BrowserModifier_MSIL_MediaArena_7{
meta:
description = "BrowserModifier:MSIL/MediaArena,SIGNATURE_TYPE_PEHSTR,08 00 08 00 06 00 00 "
DDoS/Linux/Mirai/DDoS_Linux_Mirai_PA_MTB.yar
+3 -2
View File
@@ -1,7 +1,7 @@
rule DDoS_Linux_Mirai_PA_MTB{
meta:
description = "DDoS:Linux/Mirai.PA!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 09 00 00 "
description = "DDoS:Linux/Mirai.PA!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 0a 00 00 "
strings :
$a_00_0 = {6d 69 72 61 69 } //2 mirai
@@ -13,7 +13,8 @@ rule DDoS_Linux_Mirai_PA_MTB{
$a_01_6 = {6b 69 6c 6c 65 72 73 74 6f 72 6d } //1 killerstorm
$a_01_7 = {4b 48 73 65 72 76 65 72 48 41 43 4b 45 52 } //1 KHserverHACKER
$a_01_8 = {68 75 61 77 65 69 73 63 61 6e 6e 65 72 5f 73 63 61 6e 6e 65 72 5f 6b 69 6c 6c } //1 huaweiscanner_scanner_kill
$a_01_9 = {63 6f 6d 2e 62 69 74 64 65 66 65 6e 64 65 72 } //-10 com.bitdefender
condition:
((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=5
((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*-10) >=5
}
DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_A_dha.yar
+15
View File
@@ -0,0 +1,15 @@
rule DoS_Win32_DragoWiper_A_dha{
meta:
description = "DoS:Win32/DragoWiper.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 "
strings :
$a_01_0 = {00 4d 79 41 70 70 6c 69 63 61 74 69 6f 6e 00 } //1
$a_01_1 = {00 6d 79 61 70 70 5f 65 78 65 70 61 74 68 2e 74 78 74 00 } //1
$a_01_2 = {53 00 74 00 61 00 72 00 74 00 69 00 6e 00 67 00 20 00 6e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 73 00 68 00 61 00 72 00 65 00 20 00 65 00 6e 00 75 00 6d 00 65 00 72 00 61 00 74 00 69 00 6f 00 6e 00 2e 00 2e 00 2e 00 } //1 Starting network share enumeration...
$a_01_3 = {00 50 72 6f 63 65 73 73 69 6e 67 20 73 79 73 74 65 6d 20 64 72 69 76 65 3a 20 00 } //1
$a_01_4 = {00 5b 49 4e 46 4f 5d 20 46 69 6c 65 20 64 61 74 61 20 65 6e 63 72 79 70 74 65 64 20 69 6e 20 6d 65 6d 6f 72 79 2e 00 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4
}
DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_B_dha.yar
+14
View File
@@ -0,0 +1,14 @@
rule DoS_Win32_DragoWiper_B_dha{
meta:
description = "DoS:Win32/DragoWiper.B!dha,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 "
strings :
$a_01_0 = {00 4d 79 41 70 70 6c 69 63 61 74 69 6f 6e 00 } //2
$a_01_1 = {5b 00 21 00 5d 00 20 00 4f 00 70 00 65 00 6e 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 54 00 6f 00 6b 00 65 00 6e 00 20 00 66 00 61 00 69 00 6c 00 65 00 64 00 } //2 [!] OpenProcessToken failed
$a_01_2 = {5b 00 2b 00 5d 00 20 00 57 00 69 00 70 00 69 00 6e 00 67 00 20 00 6d 00 65 00 74 00 61 00 64 00 61 00 74 00 61 00 20 00 6f 00 6e 00 } //1 [+] Wiping metadata on
$a_01_3 = {5b 00 2d 00 5d 00 20 00 55 00 6e 00 61 00 62 00 6c 00 65 00 20 00 74 00 6f 00 20 00 6f 00 70 00 65 00 6e 00 20 00 76 00 6f 00 6c 00 75 00 6d 00 65 00 } //1 [-] Unable to open volume
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5
}
DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_C_dha.yar
+15
View File
@@ -0,0 +1,15 @@
rule DoS_Win32_DragoWiper_C_dha{
meta:
description = "DoS:Win32/DragoWiper.C!dha,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 "
strings :
$a_01_0 = {5b 49 4e 46 4f 5d 20 46 69 6c 65 20 64 61 74 61 20 72 65 61 64 20 69 6e 74 6f 20 6d 65 6d 6f 72 79 2e 20 52 65 61 64 20 73 69 7a 65 3a 20 00 } //1
$a_01_1 = {5b 45 52 52 4f 52 5d 20 46 61 69 6c 65 64 20 74 6f 20 77 72 69 74 65 20 65 6e 63 72 79 70 74 65 64 20 64 61 74 61 20 74 6f 20 66 69 6c 65 20 61 74 20 6f 66 66 73 65 74 20 00 } //1
$a_01_2 = {50 72 6f 63 65 73 73 69 6e 67 20 6e 6f 6e 2d 73 79 73 74 65 6d 20 64 72 69 76 65 3a 20 00 } //1
$a_01_3 = {41 6c 6c 20 64 72 69 76 65 73 20 70 72 6f 63 65 73 73 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 21 00 } //1
$a_01_4 = {45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 66 00 69 00 6c 00 65 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 64 00 3a 00 20 00 00 00 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4
}
DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_D_dha.yar
+14
View File
@@ -0,0 +1,14 @@
rule DoS_Win32_DragoWiper_D_dha{
meta:
description = "DoS:Win32/DragoWiper.D!dha,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 "
strings :
$a_01_0 = {4d 79 41 70 70 6c 69 63 61 74 69 6f 6e 00 } //2 祍灁汰捩瑡潩n
$a_01_1 = {5b 00 21 00 5d 00 20 00 4c 00 6f 00 6f 00 6b 00 75 00 70 00 50 00 72 00 69 00 76 00 69 00 6c 00 65 00 67 00 65 00 56 00 61 00 6c 00 75 00 65 00 20 00 66 00 61 00 69 00 6c 00 65 00 64 00 3a 00 } //2 [!] LookupPrivilegeValue failed:
$a_01_2 = {5b 00 21 00 5d 00 20 00 53 00 79 00 73 00 74 00 65 00 6d 00 20 00 64 00 69 00 73 00 6b 00 20 00 77 00 69 00 70 00 65 00 64 00 2e 00 } //1 [!] System disk wiped.
$a_01_3 = {5b 00 2d 00 5d 00 20 00 53 00 6b 00 69 00 70 00 70 00 69 00 6e 00 67 00 20 00 75 00 6e 00 73 00 75 00 70 00 70 00 6f 00 72 00 74 00 65 00 64 00 20 00 66 00 69 00 6c 00 65 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 3a 00 } //1 [-] Skipping unsupported file system:
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5
}
DoS/Win32/GigaWiper/DoS_Win32_GigaWiper_A_dha.yar
+16
View File
@@ -0,0 +1,16 @@
rule DoS_Win32_GigaWiper_A_dha{
meta:
description = "DoS:Win32/GigaWiper.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 "
strings :
$a_01_0 = {25 73 5c 57 69 6e 64 6f 77 73 5c 53 79 73 74 65 6d 33 32 } //1 %s\Windows\System32
$a_01_1 = {66 61 69 6c 65 64 20 74 6f 20 63 6c 65 61 72 20 70 61 72 74 69 74 69 6f 6e 73 3a 20 25 76 } //1 failed to clear partitions: %v
$a_01_2 = {50 61 72 74 69 74 69 6f 6e 73 20 72 65 6d 6f 76 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e } //1 Partitions removed successfully.
$a_01_3 = {53 74 61 72 74 69 6e 67 20 70 61 73 73 20 25 64 2e 2e 2e } //1 Starting pass %d...
$a_01_4 = {66 61 69 6c 65 64 20 74 6f 20 77 72 69 74 65 20 74 6f 20 64 69 73 6b 3a } //1 failed to write to disk:
$a_01_5 = {45 72 72 6f 72 20 6f 6e 20 72 65 62 6f 6f 74 69 6e 67 3a } //1 Error on rebooting:
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5
}
DoS/Win32/GigaWiper/DoS_Win32_GigaWiper_B_dha.yar
+16
View File
@@ -0,0 +1,16 @@
rule DoS_Win32_GigaWiper_B_dha{
meta:
description = "DoS:Win32/GigaWiper.B!dha,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 "
strings :
$a_01_0 = {50 61 73 73 20 54 69 6d 65 20 74 6f 6f 6b 3a 20 25 73 } //1 Pass Time took: %s
$a_01_1 = {46 61 69 6c 65 64 20 74 6f 20 6f 70 65 6e 20 64 72 69 76 65 20 25 73 3a 20 25 76 } //1 Failed to open drive %s: %v
$a_01_2 = {42 79 74 65 73 20 74 6f 20 64 69 73 6b 2e 20 63 6f 75 6e 74 65 72 3a } //1 Bytes to disk. counter:
$a_01_3 = {50 61 73 73 20 25 64 20 63 6f 6d 70 6c 65 74 65 28 52 61 6e 64 6f 6d 29 2e } //1 Pass %d complete(Random).
$a_01_4 = {45 72 72 6f 72 20 64 75 72 69 6e 67 20 77 72 69 74 65 3a 20 25 76 } //1 Error during write: %v
$a_01_5 = {46 61 69 6c 65 64 20 74 6f 20 67 65 74 20 64 69 73 6b 20 73 69 7a 65 3a 20 25 76 } //1 Failed to get disk size: %v
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5
}
DoS/Win32/SleekWiper/DoS_Win32_SleekWiper_A_dha.yar
+18
View File
@@ -0,0 +1,18 @@
rule DoS_Win32_SleekWiper_A_dha{
meta:
description = "DoS:Win32/SleekWiper.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 08 00 00 "
strings :
$a_01_0 = {44 6f 6d 65 73 74 6f 73 2e 65 78 65 } //1 Domestos.exe
$a_01_1 = {56 47 41 75 74 68 53 65 72 76 69 63 65 2e 65 78 65 } //1 VGAuthService.exe
$a_01_2 = {76 6d 33 64 73 65 72 76 69 63 65 2e 65 78 65 } //1 vm3dservice.exe
$a_01_3 = {5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d } //1 [System Process]
$a_01_4 = {2a 2e 6f 6e 65 74 6f 63 32 } //1 *.onetoc2
$a_01_5 = {2a 2e 50 41 51 } //1 *.PAQ
$a_43_6 = {f9 4d 53 44 4f 75 90 01 01 3d 53 35 2e 30 90 00 0a } //10
$a_81_7 = {4e 54 46 53 75 90 01 01 3d 20 20 20 20 90 00 00 00 5d 04 00 00 9a 02 07 80 5c 3a 00 00 9b 02 07 80 00 00 01 00 08 00 24 00 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 46 61 6b 65 43 61 70 74 } //4352
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_43_6 & 1)*10+(#a_81_7 & 1)*4352) >=25
}
DoS/Win64/AshWiper/DoS_Win64_AshWiper_AA_dha.yar
+14
View File
@@ -0,0 +1,14 @@
rule DoS_Win64_AshWiper_AA_dha{
meta:
description = "DoS:Win64/AshWiper.AA!dha,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {6c 69 73 74 5f 64 69 73 6b } //1 list_disk
$a_01_1 = {64 65 73 74 72 6f 79 5f 66 69 6c 65 } //1 destroy_file
$a_01_2 = {6c 69 73 74 46 69 6c 65 73 } //1 listFiles
$a_01_3 = {6d 65 72 73 65 6e 6e 65 5f 74 77 69 73 74 65 72 5f 65 6e 67 69 6e 65 } //1 mersenne_twister_engine
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
DoS/Win64/ElekiWiper/DoS_Win64_ElekiWiper_A_dha.yar
+14
View File
@@ -0,0 +1,14 @@
rule DoS_Win64_ElekiWiper_A_dha{
meta:
description = "DoS:Win64/ElekiWiper.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 "
strings :
$a_01_0 = {00 44 72 69 76 65 57 69 64 65 45 6e 63 72 79 70 74 6f 72 2e 6c 6f 67 00 } //1
$a_01_1 = {5b 00 53 00 54 00 41 00 52 00 54 00 5d 00 20 00 52 00 75 00 6e 00 6e 00 69 00 6e 00 67 00 20 00 44 00 72 00 69 00 76 00 65 00 57 00 69 00 64 00 65 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 6f 00 72 00 } //1 [START] Running DriveWideEncryptor
$a_01_2 = {5b 00 55 00 4e 00 4b 00 4e 00 4f 00 57 00 4e 00 20 00 45 00 58 00 54 00 45 00 4e 00 53 00 49 00 4f 00 4e 00 53 00 5d 00 20 00 46 00 6f 00 75 00 6e 00 64 00 20 00 66 00 69 00 6c 00 65 00 28 00 73 00 29 00 20 00 77 00 69 00 74 00 68 00 20 00 74 00 68 00 65 00 20 00 66 00 6f 00 6c 00 6c 00 6f 00 77 00 69 00 6e 00 67 00 20 00 75 00 6e 00 6b 00 6e 00 6f 00 77 00 6e 00 20 00 65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 73 00 3a 00 } //1 [UNKNOWN EXTENSIONS] Found file(s) with the following unknown extensions:
$a_01_3 = {53 00 6b 00 69 00 70 00 70 00 69 00 6e 00 67 00 20 00 73 00 65 00 6c 00 66 00 20 00 65 00 78 00 65 00 63 00 75 00 74 00 61 00 62 00 6c 00 65 00 3a 00 } //1 Skipping self executable:
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3
}
DoS/Win64/ElekiWiper/DoS_Win64_ElekiWiper_B_dha.yar
+14
View File
@@ -0,0 +1,14 @@
rule DoS_Win64_ElekiWiper_B_dha{
meta:
description = "DoS:Win64/ElekiWiper.B!dha,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 "
strings :
$a_01_0 = {5b 00 49 00 4e 00 46 00 4f 00 5d 00 20 00 53 00 74 00 61 00 72 00 74 00 69 00 6e 00 67 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 6e 00 20 00 00 00 } //1
$a_01_1 = {5b 00 44 00 4f 00 4e 00 45 00 5d 00 20 00 41 00 6c 00 6c 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 65 00 64 00 2e 00 00 00 } //1
$a_01_2 = {43 00 61 00 6e 00 6e 00 6f 00 74 00 20 00 6f 00 70 00 65 00 6e 00 20 00 66 00 69 00 6c 00 65 00 20 00 66 00 6f 00 72 00 20 00 77 00 72 00 69 00 74 00 69 00 6e 00 67 00 3a 00 20 00 00 00 } //1
$a_01_3 = {5b 00 53 00 4b 00 49 00 50 00 5d 00 20 00 4f 00 70 00 74 00 69 00 63 00 61 00 6c 00 20 00 64 00 72 00 69 00 76 00 65 00 20 00 73 00 6b 00 69 00 70 00 70 00 65 00 64 00 3a 00 20 00 00 00 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3
}
Exploit/Linux/CVE-2022-32250/Exploit_Linux_CVE-2022-32250_A_MTB.yar
+14
View File
@@ -0,0 +1,14 @@
rule Exploit_Linux_CVE-2022-32250_A_MTB{
meta:
description = "Exploit:Linux/CVE-2022-32250.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 00 "
strings :
$a_01_0 = {73 70 72 61 79 5f 6b 65 79 72 69 6e 67 5f 6c 69 73 74 5f 6f 76 65 72 77 72 69 74 65 5f 70 75 72 70 6f 73 65 } //1 spray_keyring_list_overwrite_purpose
$a_01_1 = {67 65 74 5f 6b 65 79 72 69 6e 67 5f 6c 65 61 6b } //1 get_keyring_leak
$a_01_2 = {73 70 72 61 79 5f 6d 73 67 5f 6d 73 67 } //1 spray_msg_msg
$a_01_3 = {73 70 72 61 79 5f 6d 71 75 65 75 65 } //1 spray_mqueue
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3
}
Exploit/Linux/FakeJavaDropout/Exploit_Linux_FakeJavaDropout_A.yar
+18
View File
@@ -0,0 +1,18 @@
rule Exploit_Linux_FakeJavaDropout_A{
meta:
description = "Exploit:Linux/FakeJavaDropout.A,SIGNATURE_TYPE_ELFHSTR_EXT,3d 00 3d 00 08 00 00 "
strings :
$a_81_0 = {65 78 65 63 76 65 40 47 4c 49 42 43 } //50 execve@GLIBC
$a_81_1 = {73 79 73 74 65 6d 40 47 4c 49 42 43 } //50 system@GLIBC
$a_81_2 = {67 65 74 75 69 64 40 47 4c 49 42 43 } //10 getuid@GLIBC
$a_81_3 = {6c 6f 67 34 6a } //1 log4j
$a_81_4 = {4c 4f 47 34 4a } //1 LOG4J
$a_81_5 = {73 70 72 69 6e 67 2d 63 6f 72 65 } //1 spring-core
$a_81_6 = {6c 69 62 6a 6c 69 } //-100 libjli
$a_81_7 = {4a 4c 49 5f 49 6e 69 74 41 72 67 50 72 6f 63 65 73 73 69 6e 67 } //-100 JLI_InitArgProcessing
condition:
((#a_81_0 & 1)*50+(#a_81_1 & 1)*50+(#a_81_2 & 1)*10+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*-100+(#a_81_7 & 1)*-100) >=61
}

Some files were not shown because too many files have changed in this diff Show More