JohnGalt14

CN GUI Scanner Tool Yara Rule

Oct 4th, 2014
531
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. rule CN_GUI_Scanner {
  2.     meta:
  3.         description = "Detects an unknown GUI scanner tool - CN background"
  4.         author = "Florian Roth"
  5.         hash = "3c67bbb1911cdaef5e675c56145e1112"
  6.         score = 65
  7.         date = "04.10.2014"
  8.     strings:
  9.         $s1 = "good.txt" fullword ascii
  10.         $s2 = "IP.txt" fullword ascii
  11.         $s3 = "xiaoyuer" fullword ascii
  12.         $s0w = "ssh(" fullword wide
  13.         $s1w = ").exe" fullword wide
  14.     condition:
  15.         all of them
  16. }
RAW Paste Data