1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
/*
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as
long as you use it under this license.
*/
rule ChickenDOS{
meta:
author = "Jason Jones <jasonjones@arbor.net>"
description = "Win32-variant of Chicken ident for both dropper and dropped file"
source = "https://github.com/arbor/yara/blob/master/chicken.yara"
strings:
$pdb1 = "\\Chicken\\Release\\svchost.pdb"
$pdb2 = "\\IntergrateCHK\\Release\\IntergrateCHK.pdb"
$str2 = "fake.cf"
$str3 = "8.8.8.8"
$str4 = "Processor(%d)\\"
$str5 = "DbProtectSupport"
$str1 = "dm1712/`jvpnpkte/bpl"
$str6 = "InstallService NPF %d"
$str7 = "68961"
$str8 = "InstallService DbProtectSupport %d"
$str9 = "C:\\Program Files\\DbProtectSupport\\npf.sys"
condition:
($pdb1 or $pdb2) and 5 of ($str*)
}
rule ChickenDOS_Linux {
meta:
author = "Jason Jones <jasonjones@arbor.net>"
description = "Linux-variant of Chicken ident for both dropper and dropped file"
source = "https://github.com/arbor/yara/blob/master/chicken.yara"
strings:
$cfg = "fake.cfg"
$file1 = "ThreadAttack.cpp"
$file2 = "Fake.cpp"
$str1 = "dns_array"
$str2 = "DomainRandEx"
$str3 = "cpu %llu %llu %llu %llu"
$str4 = "[ %02d.%02d %02d:%02d:%02d.%03ld ] [%lu] [%s] %s" ascii
condition:
$cfg and all of ($file*) and 3 of ($str*)
}