NyanW0rm snort suricata yara

yara

rule NyanW0rm_bin
{
    meta:
        description = "NyanW0rm"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/1cb6ca71-f3d6-432b-a0c2-7be930826229/"
        date = "2019/08"
        maltype = "Bot"

    strings:
        $string1 = "BotSocket"
        $string2 = "|NW|" wide

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 200KB
}

rule NyanW0rm_mem
{
    meta:
        description = "NyanW0rm"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/1cb6ca71-f3d6-432b-a0c2-7be930826229/"
        date = "2019/08"
        maltype = "Bot"

    strings:
        $string1 = "BotSocket"
        $string2 = "|NW|" wide

    condition:
        all of ($string*) and filesize > 200KB
}

snort / suricata
alert tcp any any -> any !$HTTP_PORTS (msg:"NyanW0rm Bot Detected"; flow:established,to_server; content:"|00 00 00|"; within:4; reference:url,https://app.any.run/tasks/1cb6ca71-f3d6-432b-a0c2-7be930826229/; classtype:trojan-activity; sid:20166300; rev:1; metadata:created_at 2019_08_06;)