daily pastebin goal
51%
SHARE
TWEET

LockerGoga Yara

a guest Mar 22nd, 2019 283 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. rule LockerGoga_Payload_v1 {  
  2.    
  3.    meta:
  4.    
  5.       description = "LockerGoga HR from @88d149f3e47dc337695d76da52b25660e3a454768af0d7e59c913995af496a0f golden hash"
  6.         tlp = "white"
  7.  
  8.    strings:
  9.      
  10.     $h1 = { 55 8bec 57 8b???? 85?? 74?? 8b?? 56 6a??  }
  11.       $h2 = { 55 8bec 53 8b???? 56 57 83???? 0f 84 86?? }
  12.       $h3 = { 55 8bec 56 8b?? 8b?? ff?????????? 8b??    }
  13.       $h4 = { 55 8bec 51 53 8b?? 57 89???? 8b???? ff 70 }
  14.       $h5 = { 55 8bec 80?????? 53 8b?? 74?? 56 57 8b bb }
  15.      
  16.    condition:
  17.       (uint16(0) == 0x5a4d and filesize > 1000KB and 5 of ($h*))
  18. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top