23 lines
928 B
Text
23 lines
928 B
Text
|
rule malware_windows_apt_whitebear_binary_loader_1
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "The WhiteBear loader contains a set of messaging and injection components that support continued presence on victim hosts"
|
||
|
|
reference = "https://securelist.com/introducing-whitebear/81638/"
|
||
|
|
author = "@fusionrace"
|
||
|
|
md5 = "b099b82acb860d9a9a571515024b35f0"
|
||
|
|
strings:
|
||
|
|
// Output messages
|
||
|
|
$a1 = "### PE STORAGE ###" wide ascii
|
||
|
|
$a2 = "### CRYPTO 0 ###" wide ascii
|
||
|
|
$a3 = "### EXTERNAL STORAGE ###" wide ascii
|
||
|
|
$a4 = "### CRYPTO 1 ###" wide ascii
|
||
|
|
$a5 = "### QUEUES ###" wide ascii
|
||
|
|
$a6 = "### TRANSPORT ###" wide ascii
|
||
|
|
$a7 = "### EXECUTION SUBSYSTEM ###" wide ascii
|
||
|
|
$a8 = "### AUTORUN MANAGER ###" wide ascii
|
||
|
|
$a9 = "### INJECT MANAGER ###" wide ascii
|
||
|
|
$a10 = "### LOCAL TRANSPORT MANAGER ###" wide ascii
|
||
|
|
condition:
|
||
|
|
6 of ($a*)
|
||
|
|
}
|