daily pastebin goal
26%
SHARE
TWEET

ServSelper

James_inthe_box Dec 26th, 2018 (edited) 470 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. rule Servhelper_comms_mem
  2. {
  3.     meta:
  4.         description = "ServSelper"
  5.         author = " James_inthe_box"
  6.         reference = "https://app.any.run/tasks/78d05d2e-368d-4849-88b3-f71254d37fc5"
  7.         date = "2018/12"
  8.         maltype = "RAT"
  9.  
  10.     strings:
  11.         $string1 = "key"
  12.         $string2 = "&sysid="
  13.         $string3 = "&resp="
  14.  
  15.     condition:
  16.         all of ($string*)
  17. }
  18.  
  19. rule Servhelper_mem
  20. {
  21.     meta:
  22.         description = "ServSelper"
  23.         author = " James_inthe_box"
  24.         reference = "https://app.any.run/tasks/78d05d2e-368d-4849-88b3-f71254d37fc5"
  25.         date = "2018/12"
  26.         maltype = "RAT"
  27.  
  28.     strings:
  29.         $string1 = "/c ping localhost -n 30 > nul & del" wide
  30.         $string2 = "System.Net.HttpClient.THTTPClient"
  31.         $string3 = "cmd.exe" wide
  32.         $string4 = "selfkill" wide
  33.         $string5 = "key=" wide
  34.         $string6 = "sysid=" wide
  35.         $string7 = "resp=" wide
  36.         $string8 = "username" wide
  37.  
  38.     condition:
  39.         all of ($string*)
  40. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top