daily pastebin goal
16%
SHARE
TWEET

Kewgad yara sig

James_inthe_box Jan 27th, 2019 (edited) 352 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. rule phantom_nugget_bin
  2. {
  3.     meta:
  4.     description = "Unknown"
  5.         author = "James_inthe_box"
  6.         reference = "https://app.any.run/tasks/172f39cc-4ae1-4e66-97da-f631ce45dc87"
  7.         date = "2019/01"
  8.         maltype = "Unknown"
  9.        
  10.     strings:
  11.     $mz = { 4d 5a }
  12.         $string1 = "@TaskGuid"
  13.         $string2 = "@ExecSign"
  14.         $string3 = "@TaskSign"
  15.         $string4 = "@NameID@"
  16.         $string5 = "@DefGad@"
  17.         $string6 = "@NetKey@"
  18.         $string7 = "@SerUrlJM@"
  19.         $string8 = "@SerNewIP@"
  20.  
  21.     condition:
  22.     ($mz at 0) and (all of ($string*)) and filesize < 400KB
  23. }
  24.  
  25. rule phantom_nugget_mem
  26. {
  27.     meta:
  28.         description = "Unknown"
  29.         author = "James_inthe_box"
  30.         reference = "https://app.any.run/tasks/172f39cc-4ae1-4e66-97da-f631ce45dc87"
  31.         date = "2019/01"
  32.         maltype = "Unknown"
  33.  
  34.     strings:
  35.         $string1 = "@TaskGuid"
  36.         $string2 = "@ExecSign"
  37.         $string3 = "@TaskSign"
  38.         $string4 = "@NameID@"
  39.         $string5 = "@DefGad@"
  40.         $string6 = "@NetKey@"
  41.         $string7 = "@SerUrlJM@"
  42.         $string8 = "@SerNewIP@"
  43.  
  44.     condition:
  45.         all of ($string*) and filesize > 400KB
  46. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top