ch0ic3/CyberThreatIntel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update Yara_Patchwork_July_2020_1.yar

Browse Source
This commit is contained in:
StrangerealIntel 2020-08-29 16:49:31 +02:00 committed by GitHub
parent b438ede754
commit 27931064c0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Indian/APT/Patchwork/2020-07-23/Yara/Yara_Patchwork_July_2020_1.yar
View File

@ -30,7 +30,7 @@ rule Mal_BozokRAT_July_2020_1 {
$s20 = "https://google.com-" fullword ascii /* legit site used as test for connectivity*/
$s21 = "--*****-------" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 50KB and ( pe.imphash() == "75b883fc692473a6eb7f309e3f1a432d" or 15 of them )
uint16(0) == 0x5a4d and filesize > 50KB and ( pe.imphash() == "75b883fc692473a6eb7f309e3f1a432d" or 15 of them )
}
rule Mal_BadNews_2016_OPChina_1 {
@ -56,7 +56,7 @@ rule Mal_BadNews_2016_OPChina_1 {
$s13 = "image/jpeg" fullword wide
$s14 = "https://en.wikipnet/search.php" fullword ascii /* legit site used as test for connectivity*/
condition:
uint16(0) == 0x5a4d and filesize < 70KB and ( pe.imphash() == "c71a34b50e03311fe548bb5a730e97ac" and ( pe.exports("JLI_AcceptableRelease") and pe.exports("JLI_ExactVersionId") and pe.exports("JLI_FreeManifest") and pe.exports("JLI_JarUnpackFile") and pe.exports("JLI_MemFree") and pe.exports("JLI_MemRealloc") ) and 12 of them
uint16(0) == 0x5a4d and filesize > 70KB and ( pe.imphash() == "c71a34b50e03311fe548bb5a730e97ac" and ( pe.exports("JLI_AcceptableRelease") and pe.exports("JLI_ExactVersionId") and pe.exports("JLI_FreeManifest") and pe.exports("JLI_JarUnpackFile") and pe.exports("JLI_MemFree") and pe.exports("JLI_MemRealloc") ) and 12 of them
}
rule Mal_BozokRAT_July2020_2 {
@ -82,5 +82,5 @@ rule Mal_BozokRAT_July2020_2 {
$s13 = "--*****------" fullword ascii
$s14 = "https://en.wikipedia.org/wiki/Main_Page" fullword ascii /* legit site used as test for connectivity*/
condition:
uint16(0) == 0x5a4d and filesize < 130KB and ( pe.imphash() == "79cf8ca8dd4dad9d47e49beb5c9bbd50" or 11 of them )
uint16(0) == 0x5a4d and filesize > 130KB and ( pe.imphash() == "79cf8ca8dd4dad9d47e49beb5c9bbd50" or 11 of them )
}