Skip to content

R
rules
Commit 0e3ac178 by Jose Vila
Options

Removed duplicates

parent ec77c4b5
Showing with 8 additions and 17 deletions
malware/THOR_HackTools.yar
...@@ -1524,7 +1524,7 @@ rule aspfile1 { ...@@ -1524,7 +1524,7 @@ rule aspfile1 {
3 of them 3 of them
} }
rule EditServer { rule EditServer_HackTool {
meta: meta:
description = "Disclosed hacktool set (old stuff) - file EditServer.exe" description = "Disclosed hacktool set (old stuff) - file EditServer.exe"
author = "Florian Roth" author = "Florian Roth"
...@@ -2782,6 +2782,7 @@ rule CN_Toolset__XScanLib_XScanLib_XScanLib { ...@@ -2782,6 +2782,7 @@ rule CN_Toolset__XScanLib_XScanLib_XScanLib {
description = "Detects a Chinese hacktool from a disclosed toolset - from files XScanLib.dll, XScanLib.dll, XScanLib.dll" description = "Detects a Chinese hacktool from a disclosed toolset - from files XScanLib.dll, XScanLib.dll, XScanLib.dll"
author = "Florian Roth" author = "Florian Roth"
reference = "http://qiannao.com/ls/905300366/33834c0c/" reference = "http://qiannao.com/ls/905300366/33834c0c/"
reference2 = "https://raw.githubusercontent.com/Neo23x0/Loki/master/signatures/thor-hacktools.yar"
date = "2015/03/30" date = "2015/03/30"
score = 70 score = 70
super_rule = 1 super_rule = 1
...@@ -2803,6 +2804,7 @@ rule CN_Toolset_NTscan_PipeCmd { ...@@ -2803,6 +2804,7 @@ rule CN_Toolset_NTscan_PipeCmd {
description = "Detects a Chinese hacktool from a disclosed toolset - file PipeCmd.exe" description = "Detects a Chinese hacktool from a disclosed toolset - file PipeCmd.exe"
author = "Florian Roth" author = "Florian Roth"
reference = "http://qiannao.com/ls/905300366/33834c0c/" reference = "http://qiannao.com/ls/905300366/33834c0c/"
reference2 = "https://raw.githubusercontent.com/Neo23x0/Loki/master/signatures/thor-hacktools.yar"
date = "2015/03/30" date = "2015/03/30"
score = 70 score = 70
hash = "a931d65de66e1468fe2362f7f2e0ee546f225c4e" hash = "a931d65de66e1468fe2362f7f2e0ee546f225c4e"
...@@ -2827,6 +2829,7 @@ rule CN_Toolset_LScanPortss_2 { ...@@ -2827,6 +2829,7 @@ rule CN_Toolset_LScanPortss_2 {
description = "Detects a Chinese hacktool from a disclosed toolset - file LScanPortss.exe" description = "Detects a Chinese hacktool from a disclosed toolset - file LScanPortss.exe"
author = "Florian Roth" author = "Florian Roth"
reference = "http://qiannao.com/ls/905300366/33834c0c/" reference = "http://qiannao.com/ls/905300366/33834c0c/"
reference2 = "https://raw.githubusercontent.com/Neo23x0/Loki/master/signatures/thor-hacktools.yar"
date = "2015/03/30" date = "2015/03/30"
score = 70 score = 70
hash = "4631ec57756466072d83d49fbc14105e230631a0" hash = "4631ec57756466072d83d49fbc14105e230631a0"
...@@ -2847,6 +2850,7 @@ rule CN_Toolset_sig_1433_135_sqlr { ...@@ -2847,6 +2850,7 @@ rule CN_Toolset_sig_1433_135_sqlr {
description = "Detects a Chinese hacktool from a disclosed toolset - file sqlr.exe" description = "Detects a Chinese hacktool from a disclosed toolset - file sqlr.exe"
author = "Florian Roth" author = "Florian Roth"
reference = "http://qiannao.com/ls/905300366/33834c0c/" reference = "http://qiannao.com/ls/905300366/33834c0c/"
reference2 = "https://raw.githubusercontent.com/Neo23x0/Loki/master/signatures/thor-hacktools.yar"
date = "2015/03/30" date = "2015/03/30"
score = 70 score = 70
hash = "8542c7fb8291b02db54d2dc58cd608e612bfdc57" hash = "8542c7fb8291b02db54d2dc58cd608e612bfdc57"
...@@ -2859,20 +2863,6 @@ rule CN_Toolset_sig_1433_135_sqlr { ...@@ -2859,20 +2863,6 @@ rule CN_Toolset_sig_1433_135_sqlr {
all of them all of them
} }
rule DarkComet_Keylogger_File
{
meta:
author = "Florian Roth"
description = "Looks like a keylogger file created by DarkComet Malware"
date = "25.07.14"
score = 50
strings:
$magic = "::"
$entry = /\n:: [A-Z]/
$timestamp = /\([0-9]?[0-9]:[0-9][0-9]:[0-9][0-9] [AP]M\)/
condition:
($magic at 0) and #entry > 10 and #timestamp > 10
}
/* Mimikatz */ /* Mimikatz */
...@@ -3013,6 +3003,7 @@ rule Mimikatz_Logfile ...@@ -3013,6 +3003,7 @@ rule Mimikatz_Logfile
author = "Florian Roth" author = "Florian Roth"
score = 80 score = 80
date = "2015/03/31" date = "2015/03/31"
reference = "https://github.com/Neo23x0/Loki/blob/master/signatures/thor-hacktools.yar"
strings: strings:
$s1 = "SID :" ascii fullword $s1 = "SID :" ascii fullword
$s2 = "* NTLM :" ascii fullword $s2 = "* NTLM :" ascii fullword
......
malware/THOR_Webshells.yar
...@@ -6643,7 +6643,7 @@ rule DarkSpy105 { ...@@ -6643,7 +6643,7 @@ rule DarkSpy105 {
condition: condition:
all of them all of them
} }
rule EditServer { rule EditServer_Webshell {
meta: meta:
description = "Webshells Auto-generated - file EditServer.exe" description = "Webshells Auto-generated - file EditServer.exe"
author = "Yara Bulk Rule Generator by Florian Roth" author = "Yara Bulk Rule Generator by Florian Roth"
...@@ -7623,7 +7623,7 @@ rule xssshell_default { ...@@ -7623,7 +7623,7 @@ rule xssshell_default {
condition: condition:
all of them all of them
} }
rule EditServer_2 { rule EditServer_Webshell_2 {
meta: meta:
description = "Webshells Auto-generated - file EditServer.exe" description = "Webshells Auto-generated - file EditServer.exe"
author = "Yara Bulk Rule Generator by Florian Roth" author = "Yara Bulk Rule Generator by Florian Roth"
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment