20 lines
550 B
Text
20 lines
550 B
Text
|
rule CobianRAT {
|
||
|
|
meta:
|
||
|
|
description = "Yara Rule for Cobian RAT in Aggah Wayback campaign"
|
||
|
|
author = "Yoroi Malware Zlab"
|
||
|
|
reference = "https://yoroi.company/research/the-wayback-campaign-a-large-scale-operation-hiding-in-plain-sight/"
|
||
|
|
last_updated = "2021_06_18"
|
||
|
|
tlp = "white"
|
||
|
|
category = "informational"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$s1="bWFzdGVy" wide
|
||
|
|
$s2="Ydmzipw~" wide
|
||
|
|
|
||
|
|
$a1={11 8E B7 16 FE 01 5F 2C 46 1B 8D 1D}
|
||
|
|
$a2={07 17 D6 0B 07 1A 30 20 14 0C 07 B5 1F 64 28 33}
|
||
|
|
|
||
|
|
condition:
|
||
|
|
uint16(0) == 0x5A4D and any of ($s*) and 1 of ($a*)
|
||
|
|
}
|