SHARE
TWEET

RAT

James_inthe_box Nov 22nd, 2019 396 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. rule RAT
  2. {
  3.     meta:
  4.         description = "RAT"
  5.         author = "James_inthe_box"
  6.         reference = "https://app.any.run/tasks/1069b823-94b8-48d0-8db4-5bed15fe4b35/"
  7.         date = "2019/11"
  8.         maltype = "RAT"
  9.  
  10.     strings:
  11.         $string1 = "%Y-%m-%d_%H-%M-%S.mp3" wide ascii
  12.         $string2 = "&regkey=" wide ascii
  13.         $string3 = "regname=" wide ascii
  14.         $string4 = "[Rename]" wide ascii
  15.         $string5 = "Screen_" wide ascii
  16.         $string6 = "%Y-%m-%d_%H-%M-%S.jpg" wide ascii
  17.         $string7 = "Webcam_" wide ascii
  18.         $string8 = "App_" wide ascii
  19.         $string9 = "Chat_" wide ascii
  20.         $string10 = "Web_" wide ascii
  21.         $string11 = "Keys_" wide ascii
  22.  
  23.  
  24.     condition:
  25.         all of ($string*)
  26. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top