Sneed-Reactivity/yara-mikesxrs/kevthehermit/NanoCore.yar

27 lines
581 B
Text
Raw Normal View History

rule NanoCore
{
meta:
author = " Kevin Breen <kevin@techanarchy.net>"
date = "2014/04"
ref = "http://malwareconfig.com/stats/NanoCore"
maltype = "Remote Access Trojan"
filetype = "exe"
strings:
$a = "NanoCore"
$b = "ClientPlugin"
$c = "ProjectData"
$d = "DESCrypto"
$e = "KeepAlive"
$f = "IPNETROW"
$g = "LogClientMessage"
$h = "|ClientHost"
$i = "get_Connected"
$j = "#=q"
$key = {43 6f 24 cb 95 30 38 39}
condition:
6 of them
}