Sneed-Reactivity/yara/trojan/Win32.Trojan.TrickBot.yara
Sam Sneed 79804435aa add yara functionality
See LICENSE-YARA-RULES for the license
2024-07-24 17:45:31 -05:00

46 lines
No EOL
1.7 KiB
Text

rule Win32_Trojan_TrickBot : tc_detection malicious
{
meta:
author = "ReversingLabs"
source = "ReversingLabs"
status = "RELEASED"
sharing = "TLP:WHITE"
category = "MALWARE"
malware = "TRICKBOT"
description = "Yara rule that detects TrickBot trojan."
tc_detection_type = "Trojan"
tc_detection_name = "TrickBot"
tc_detection_factor = 5
strings:
$entry_setup = {
58 (68 | 8B) [6-8] 59 [1-3] E2 ?? 57 8B (C7 | EC) 8B (C7 | EC) 05 ?? ?? ?? ?? 68 [4-5]
89 45 [1-2] 8B D7 [3-4] 8B C1 66 AD 85 C0 74 ?? 3B (C1 | C8) (72 | 77) ?? 2B C1 (C1 | D1)
[2-4] 8B CF 03 C8 81 C1 ?? ?? ?? ?? 8B 01 59 03 D0 52 EB ?? 89 45 ?? 8B C5 B9 ?? ??
?? ?? C1 E1 ?? 2B C1 8B 00 89 45 ?? 6A ?? 8B D0 59 FF D2 89 68 ?? 6A ?? 8B D0 FF D2
}
$decrypt_function_snippet = {
58 8B C8 75 ?? 58 2B F0 50 8B D8 49 75 ?? 59 58 59 5E 5F 5B C3
}
$decrypt_function_snippet_wrapper = {
55 BD ?? ?? ?? ?? 50 51 52 6A ?? FF 45 ?? 8B 45 ?? 59 F7 E1 8D 8D ?? ?? ?? ?? 03 C8
89 4D ?? 8F 41 ?? 8F 41 ?? 8F 41 ?? 8F 41 ?? 8F 01 89 79 ?? 89 71 ?? 8B D1 59 89 4A
?? 55 2B C0 8B C8 8B 02 8B F8 58 41 41 41 41 50 2B C1 8B 00 3B C7 72 ?? 58 C1 E9 ??
49 89 4A ?? E3 ?? FF 55 ?? 8B 55 ?? 8B 4A ?? FF 55 ?? 50 51 50 6A ?? 59 FF 55 ?? FF
D0
}
condition:
uint16(0) == 0x5A4D and
$entry_setup and
(
$decrypt_function_snippet or
$decrypt_function_snippet_wrapper
)
}