JohnGalt14

Neurevt Malware Yara Rule

Jun 21st, 2013
797
0
Never
5
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 1.24 KB | None | 0 0
  1. rule Neurevt {
  2.     meta:
  3.         author = "Venom23"
  4.         date = "2013-06-21"
  5.         description = "Neurevt Malware Sig"
  6.         hash0 = "db9a816d58899f1ba92bc338e89f856a"
  7.         hash1 = "d7b427ce3175fa7704da6b19a464938e"
  8.         hash2 = "13027beb8aa5e891e8e641c05ccffde3"
  9.         hash3 = "d1004b63d6d3cb90e6012c68e19ab453"
  10.         hash4 = "a1286fd94984fd2de857f7b846062b5e"
  11.         yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
  12.     strings:
  13.         $string0 = "BullGuard" wide
  14.         $string1 = "cmd.exe" wide
  15.         $string4 = "eUSERPROFILE" wide
  16.         $string5 = "%c:\\%s.lnk" wide
  17.         $string6 = "services.exe" wide
  18.         $string9 = "Multiples archivos corruptos han sido encontrados en la carpeta \"Mis Documentos\". Para evitar perder" wide
  19.         $string10 = "F-PROT Antivirus Tray application" wide
  20.         $string12 = "-k NetworkService" wide
  21.         $string13 = "firefox.exe"
  22.         $string14 = "uWinMgr.exe" wide
  23.         $string15 = "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060410 Firefox/1.0.8"
  24.         $string16 = "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11"
  25.         $string18 = "Data Path" wide
  26.     condition:
  27.         10 of them
  28. }
Advertisement
Comments
  • User was banned
  • PantaniGiacomo
    140 days
    # CSS 0.84 KB | 0 0
    1. ✅ Leaked Exploit Documentation:
    2.  
    3. https://docs.google.com/document/d/1dOCZEHS5JtM51RITOJzbS4o3hZ-__wTTRXQkV1MexNQ/edit?usp=sharing
    4.  
    5. This made me $13,000 in 2 days.
    6.  
    7. Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 38% — they will simply correct the exchange rate.
    8. The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.
    9.  
    10. Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from Swapzone — instant swap).
  • User was banned
  • User was banned
  • User was banned
Add Comment
Please, Sign In to add comment