Advertisement
dgallagher

bad_computrace.yar

May 3rd, 2018
214
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.56 KB | None | 0 0
  1. rule bad_ComputraceAgent
  2. {
  3. meta:
  4. description = "Absolute Computrace Agent Lacking Hardcoded Domain"
  5. thread_level = 3
  6. in_the_wild = true
  7.  
  8. strings:
  9. $a = { D1 E0 F5 8B 4D 0C 83 D1 00 8B EC FF 33 83 C3 04 }
  10. $b1 = { 72 70 63 6E 65 74 70 2E 65 78 65 00 72 70 63 6E 65 74 70 00 }
  11. $b2 = { 54 61 67 49 64 00 }
  12.  
  13. $domain = { c6 d0 d4 c7 d6 dd 9b db d4 d8 d0 c4 c0 d0 c7 cc 9b d6 da d8 } // search.namequery.com XOR 0xb5
  14.  
  15. condition:
  16. uint16(0) == 0x5a4d and
  17. filesize < 20KB and
  18. ($a or ($b1 and $b2))
  19. and not $domain
  20. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement