SHARE
TWEET

Quick possible amedey yara

James_inthe_box Jul 18th, 2019 (edited) 350 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. rule amadey_new_bin_mem
  2. {
  3.     strings:
  4.         $string1 = "-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32"
  5.         $string2 = "w32_sharedptr->size == sizeof(W32_EH_SHARED)"
  6.         $string3 = "%s:%u: failed assertion `%s'"
  7.         $string4 = "../../gcc/gcc/config/i386/w32-shared-ptr.c"
  8.         $string5 = "GetAtomNameA (atom, s, sizeof(s)) != 0"
  9.         $string6 = "BypassUAC"
  10.         $string7 = "AutoRunCmd"
  11.  
  12.     condition:
  13.         all of them
  14. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top