12 lines
587 B
Text
12 lines
587 B
Text
rule banswift :banswift {
|
|
meta:
|
|
description = “Yara rule to detect samples that share wiping function with banswift”
|
|
reference = "https://www.blueliv.com/research/recap-of-cyber-attacks-targeting-swift/"
|
|
threat_level = 10
|
|
|
|
strings:
|
|
$snippet1 = {88 44 24 0D B9 FF 03 00 00 33 C0 8D 7C 24 2D C6 44 24 2C 5F 33 DB F3 AB 66 AB 53 68 80 00 00 00 6A 03 53 AA 8B 84 24 40 10 00 00 53 68 00 00 00 40 50 C6 44 24 2A FF 88 5C 24 2B C6 44 24 2C 7E C6 44 24 2D E7}
|
|
$snippet2 = {25 FF 00 00 00 B9 00 04 00 00 8A D0 8D 7C 24 30 8A F2 8B C2 C1 E0 10 66 8B C2 F3 AB}
|
|
condition:
|
|
all of ($snippet*)
|
|
}
|