SHARE
TWEET

Revcode RAT yara

James_inthe_box Feb 4th, 2020 853 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. rule revcode_bin
  2. {
  3.     meta:
  4.         description = "Revcode RAT"
  5.         author = "James_inthe_box"
  6.         reference = "ee1b9659f2193896ce3469b5f90b82af3caffcba428e8524be5a9fdf391d8dd8"
  7.         date = "2020/02"
  8.         maltype = "RAT"
  9.  
  10.     strings:
  11.         $string1 = "SCREEN_STREAM_START"
  12.         $string2 = "CLIPBOARD_SET"
  13.         $string3 = "SERVICES_RESUME"
  14.         $string4 = "KEYLOG:"
  15.         $string5 = "WEBCAM_DRIVERS"
  16.         $string6 = "image.bmp" wide
  17.         $string7 = "APPACTIVATE" wide
  18.  
  19.     condition:
  20.         uint16(0) == 0x5A4D and all of ($string*) and filesize < 1800KB
  21. }
  22.  
  23. rule revcode_mem
  24. {
  25.     meta:
  26.         description = "Revcode RAT"
  27.         author = "James_inthe_box"
  28.         reference = "ee1b9659f2193896ce3469b5f90b82af3caffcba428e8524be5a9fdf391d8dd8"
  29.         date = "2020/02"
  30.         maltype = "RAT"
  31.  
  32.     strings:
  33.         $string1 = "SCREEN_STREAM_START"
  34.         $string2 = "CLIPBOARD_SET"
  35.         $string3 = "SERVICES_RESUME"
  36.         $string4 = "KEYLOG:"
  37.         $string5 = "WEBCAM_DRIVERS"
  38.         $string6 = "image.bmp" wide
  39.         $string7 = "APPACTIVATE" wide
  40.  
  41.     condition:
  42.         all of ($string*) and filesize > 1800KB
  43. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Top