SHARE
TWEET

Agent.ZSZ yara

James_inthe_box Feb 12th, 2019 319 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. rule AgentZSZ_bin
  2. {
  3.     meta:
  4.         description = "Agent.ZSZ loader"
  5.         author = "James_inthe_box"
  6.         reference = "https://app.any.run/tasks/4852fe8a-a699-4067-b47a-91b98232ee5a"
  7.         date = "2019/02"
  8.         maltype = "Loader"
  9.  
  10.     strings:
  11.         $mz = { 4d 5a }
  12.         $string1 = "POST" wide
  13.         $string2 = "http://" wide
  14.         $string3 = "\\\\.\\PhysicalDrive0" wide
  15.         $string4 = "WinHttpQueryAuthSchemes"
  16.         $string5 = ".?AVlogic_error@std@@"
  17.         $string6 = "InitializeSListHead"
  18.         $string7 = "GetComputerNameExW"
  19.         $string8 = ".gfids$x"
  20.         $string9 = "WinHttpGetIEProxyConfigForCurrentUser"
  21.         $string10 = "GetStartupInfoW"
  22.  
  23.     condition:
  24.         ($mz at 0) and (all of ($string*)) and filesize < 100KB
  25. }
  26.  
  27. rule AgentZSZ_mem
  28. {
  29.     meta:
  30.         description = "Agent.ZSZ loader"
  31.         author = "James_inthe_box"
  32.         reference = "https://app.any.run/tasks/4852fe8a-a699-4067-b47a-91b98232ee5a"
  33.         date = "2019/02"
  34.         maltype = "Loader"
  35.  
  36.     strings:
  37.         $string1 = "POST" wide
  38.         $string2 = "http://" wide
  39.         $string3 = "\\\\.\\PhysicalDrive0" wide
  40.         $string4 = "WinHttpQueryAuthSchemes"
  41.         $string5 = ".?AVlogic_error@std@@"
  42.         $string6 = "InitializeSListHead"
  43.         $string7 = "GetComputerNameExW"
  44.         $string8 = ".gfids$x"
  45.         $string9 = "WinHttpGetIEProxyConfigForCurrentUser"
  46.         $string10 = "GetStartupInfoW"
  47.  
  48.     condition:
  49.         all of ($string*) and filesize > 100KB
  50. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top