SHARE
TWEET

Peppy yara rule

James_inthe_box Jan 21st, 2019 265 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. rule Peppy_bin
  2. {
  3.     meta:
  4.         description = "Peppy bot"
  5.         author = "James_inthe_box"
  6.         reference = "https://app.any.run/tasks/85174c03-a296-404a-801b-426dc22538ba"
  7.         date = "2019/01"
  8.         maltype = "Bot"
  9.  
  10.     strings:
  11.         $mz = { 4d 5a }
  12.         $string1 = "edward"
  13.         $string2 = "PingServer"
  14.         $string3 = "tcpclient"
  15.         $string4 = "ServerTCP2URL"
  16.         $string5 = "2BFDE77CF6E9EFCD3C43D8CDBDBF020C266EDD68"
  17.         $string6 = "ServerTASK2URL"
  18.         $string7 = "ambh!p1and#-)"
  19.         $string8 = "tiktiktuktuk" wide
  20.         $string9 = "Hash Code:" wide
  21.  
  22.     condition:
  23.         ($mz at 0) and (all of ($string*)) and filesize < 100KB
  24. }
  25.  
  26. rule Peppy_mem
  27. {
  28.     meta:
  29.         description = "Peppy bot"
  30.         author = "James_inthe_box"
  31.         reference = "https://app.any.run/tasks/85174c03-a296-404a-801b-426dc22538ba"
  32.         date = "2019/01"
  33.         maltype = "Bot"
  34.  
  35.     strings:
  36.         $string1 = "edward"
  37.         $string2 = "PingServer"
  38.         $string3 = "tcpclient"
  39.         $string4 = "ServerTCP2URL"
  40.         $string5 = "2BFDE77CF6E9EFCD3C43D8CDBDBF020C266EDD68"
  41.         $string6 = "ServerTASK2URL"
  42.         $string7 = "ambh!p1and#-)"
  43.         $string8 = "tiktiktuktuk" wide
  44.         $string9 = "Hash Code:" wide
  45.  
  46.     condition:
  47.         all of ($string*)
  48. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top