SHARE
TWEET

uPELoader yara

James_inthe_box Jan 27th, 2019 340 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. rule uPELoader_bin
  2. {
  3.     meta:
  4.         description = "uPELoader"
  5.         author = "James_inthe_box"
  6.         reference = "ad83235d5eb8802283d0e7a10ddf0733dc3d5356d3f96eee42c1289d862c378c"
  7.         date = "2019/01"
  8.         maltype = "Loader"
  9.        
  10.     strings:
  11.         $mz = { 4d 5a }
  12.         $string1 = "z_stream"
  13.         $string2 = "Win_Set_Info_Gad"
  14.         $string3 = "Win_Run_Map_Gad"
  15.         $string4 = ";uPELoader"
  16.         $string5 = "SSEncrypt"
  17.  
  18.     condition:
  19.         ($mz at 0) and (all of ($string*)) and filesize < 400KB
  20. }
  21.  
  22. rule uPELoader_mem
  23. {
  24.     meta:
  25.         description = "uPELoader"
  26.         author = "James_inthe_box"
  27.         reference = "ad83235d5eb8802283d0e7a10ddf0733dc3d5356d3f96eee42c1289d862c378c"
  28.         date = "2019/01"
  29.         maltype = "Loader"
  30.  
  31.     strings:
  32.         $string1 = "z_stream"
  33.         $string2 = "Win_Set_Info_Gad"
  34.         $string3 = "Win_Run_Map_Gad"
  35.         $string4 = ";uPELoader"
  36.         $string5 = "SSEncrypt"
  37.  
  38.     condition:
  39.         all of ($string*) and filesize > 400KB
  40. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!
 
Top