24 lines
1,022 B
Text
24 lines
1,022 B
Text
|
rule Windealer_executable{
|
||
|
|
meta:
|
||
|
|
description = "Detects WinDealer Executable"
|
||
|
|
reference = "https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malwareZ"
|
||
|
|
author = "BlackBerry Threat Research Team"
|
||
|
|
date = "2022-06-14"
|
||
|
|
license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
|
||
|
|
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$s1 = "28e4-20a6acec"
|
||
|
|
$s2 = "5a7e-42ccdb67"
|
||
|
|
$s3 = "632c-0ef22957"
|
||
|
|
$s4 = "63ae-a20cf808"
|
||
|
|
$s5 = "65ce-731bffbb"
|
||
|
|
$a1 = "remoteip"
|
||
|
|
$a2 = "sessionid"
|
||
|
|
$a3 = "remotedomain"
|
||
|
|
$a4 = "remark"
|
||
|
|
|
||
|
|
condition:
|
||
|
|
uint16(0) == 0x5a4d and 2 of ($s*) and 1 of ($a*)
|
||
|
|
}
|