14 lines
633 B
Text
14 lines
633 B
Text
rule metaStealer_memory {
|
|
meta:
|
|
description = "MetaStealer Memory"
|
|
reference = "https://research.nccgroup.com/2022/05/20/metastealer-filling-the-racoon-void/"
|
|
author = "Peter Gurney"
|
|
date = "2022-04-29"
|
|
strings:
|
|
$str_c2_parse = {B8 56 55 55 55 F7 6D C4 8B C2 C1 E8 1F 03 C2 8B 55 C0 8D 04 40 2B 45 C4}
|
|
$str_filename = ".xyz -newname hyper-v.exe" fullword wide
|
|
$str_stackstring = {FF FF FF C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F EF}
|
|
condition:
|
|
uint16(0) == 0x5a4d and
|
|
2 of ($str_*)
|
|
}
|