daily pastebin goal
1%
SHARE
TWEET

IModuleGetter snort suricata yara

James_inthe_box Mar 24th, 2019 429 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. alert tcp $HOME_NET any -> $EXTERNAL_NET !$HTTP_PORTS (msg:"IModuleGetter Loader Detected"; flow:established,to_server; content:"net|2e|tcp"; fast_pattern; content:"IModuleGetter"; reference:url,https://app.any.run/tasks/f435d89d-30a5-465b-8a8d-b7a042665e0e; classtype:trojan-activity; sid:20166290; rev:1; metadata:created_at 2019_03_24;)
  2.  
  3. rule IModuleGetter_bin
  4. {
  5.     meta:
  6.         description = "IModuleGetter loader"
  7.         author = "James_inthe_box"
  8.         reference = "https://app.any.run/tasks/f435d89d-30a5-465b-8a8d-b7a042665e0e"
  9.         date = "2019/03"
  10.         maltype = "Loader"
  11.  
  12.     strings:
  13.         $string1 = "System.Xml"
  14.         $string2 = "IModuleGetter"
  15.         $string3 = "XmlDictionaryReaderQuotas"
  16.         $string4 = "%USERPROFILE%\\AppData\\Local\\Temp\\NetPlatform" wide
  17.         $string5 = "_settings" wide
  18.         $string6 = "net.tcp://{0}:23566/IModuleGetter" wide
  19.  
  20.     condition:
  21.         uint16(0) == 0x5A4D and all of ($string*) and filesize < 100KB
  22. }
  23.  
  24. rule IModuleGetter_mem
  25. {
  26.     meta:
  27.         description = "IModuleGetter loader"
  28.         author = "James_inthe_box"
  29.         reference = "https://app.any.run/tasks/f435d89d-30a5-465b-8a8d-b7a042665e0e"
  30.         date = "2019/03"
  31.         maltype = "Loader"
  32.  
  33.     strings:
  34.         $string1 = "System.Xml"
  35.         $string2 = "IModuleGetter"
  36.         $string3 = "XmlDictionaryReaderQuotas"
  37.         $string4 = "%USERPROFILE%\\AppData\\Local\\Temp\\NetPlatform" wide
  38.         $string5 = "_settings" wide
  39.         $string6 = "net.tcp://{0}:23566/IModuleGetter" wide
  40.  
  41.     condition:
  42.         all of ($string*) and filesize > 100KB
  43. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top