James_inthe_box

Real Thin Client yara

Nov 10th, 2019
830
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.56 KB | None | 0 0
  1. rule Real_thin_client_bin_mem
  2. {
  3. meta:
  4. description = "Real Thin Client"
  5. author = "James_inthe_box"
  6. reference = "614772bdee2983b11b3569e22afa3449c0d1f54031896af9504959b473fedb36"
  7. date = "2019/11"
  8. maltype = "RAT"
  9.  
  10. strings:
  11. $string1 = "$CLI-CRYPT$" wide ascii
  12. $string2 = "$CLI-OBJM$" wide ascii
  13. $string3 = "CLIMOD.CALL$" wide ascii
  14. $string4 = "CLIMOD.LOGIN$" wide ascii
  15. $string5 = "RTC Client" wide ascii
  16.  
  17. condition:
  18. all of ($string*) and filesize > 800KB
  19. }
Advertisement
Add Comment
Please, Sign In to add comment