Sneed-Reactivity/yara-mikesxrs/Dragonthreatlabs/apt_c16_win64_dropper.yar
Sam Sneed 08e8d462fe OMG ISTG PLS WORK
RED PILL 🔴 💊
2024-07-25 12:43:35 -05:00

18 lines
No EOL
596 B
Text

rule apt_c16_win64_dropper : Dropper
{
meta:
author = "@dragonthreatlab"
date = "2015/01/11"
description = "APT malware used to drop PcClient RAT"
reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
strings:
$mz = { 4D 5A }
$str1 = "clbcaiq.dll" ascii
$str2 = "profapi_104" ascii
$str3 = "\\Microsoft\\wuauclt\\wuauclt.dat" ascii
$str4 = { 0F B6 0A 48 FF C2 80 E9 03 80 F1 03 49 FF C8 88 4A FF 75 EC }
condition:
$mz at 0 and all of ($str*)
}