SHARE
TWEET

Evilgup banload

James_inthe_box Feb 9th, 2019 807 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. rule Evilgup_banload_bin
  2. {
  3.     meta:
  4.         description = "Banload"
  5.         author = "James_inthe_box"
  6.         reference = "https://app.any.run/tasks/d85e1606-3796-472f-8848-e96e094ea4d8"
  7.         date = "2019/02"
  8.         maltype = "Banker"
  9.        
  10.     strings:
  11.         $mz = { 4d 5a }
  12.         $string1 = "msdownld.tmp"
  13.         $string2 = "AdvancedINF"
  14.         $string3 = "VERCHECK"
  15.         $string4 = "rundll32.exe %sadvpack.dll,DelNodeRunDLL32"
  16.         $string5 = "TMP"
  17.         $string6 = "DosDateTimeToFileTime"
  18.         $string7 = "Reboot"
  19.         $string8 = "Command.com /c %s"
  20.         $string9 = "IXP%03d.TMP"
  21.         $string10 = "libcurl.dll"
  22.         $string11 = "gup.xml"
  23.  
  24.     condition:
  25.         ($mz at 0) and (all of ($string*)) and filesize < 2MB
  26. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top