Gholee Yara

rule gholee : v1
{
meta:
    author = “@GelosSnake”
    description = "http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html"
    date = “2014-08″
    maltype = “Remote Access Trojan”
    sample_filetype = “dll”
    hash0 = "48573a150562c57742230583456b4c02"

strings:
    $a = “sandbox_avg10_vc9_SP1_2011″
    $b = “gholee”

condition:
    all of them
}

rule gholee : v2
{
meta:
	author = "@GelosSnake"
	date = "2015-02-12"
	description = "http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html"
	hash0 = "05523761ca296ec09afdf79477e5f18d"
	hash1 = "08e424ac42e6efa361eccefdf3c13b21"
	hash2 = "5730f925145f1a1cd8380197e01d9e06"
	hash3 = "73461c8578dd9ab86d42984f30c04610"
	sample_filetype = "dll"
strings:
	$string0 = "RichHa"
	$string1 = "         (((((                  H" wide
	$string2 = "1$1,141<1D1L1T1\\1d1l1t1"
	$string3 = "<8;$O' "
	$string4 = "@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]"
	$string5 = "jYPQTVTSkllZTTXRTUiHceWda/"
	$string6 = "urn:schemas-microsoft-com:asm.v1"
	$string7 = "8.848H8O8i8s8y8"
	$string8 = "wrapper3" wide
	$string9 = "pwwwwwwww"
	$string10 = "Sunday"
	$string11 = "YYuTVWh"
	$string12 = "DDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDIN"
	$string13 = "ytMMMMMMUbbrrrrrxxxxxxxxrriUMMMMMMMMMUuzt"
	$string15 = "wrapper3 Version 1.0" wide
	$string16 = "77A779"
	$string17 = "<C<G<M<R<X<"
	$string18 = "9 9-9N9X9s9"
condition:
	18 of them
}