Skip to content

R
rules
Commit 2752849c by Marc Rivero López Committed by GitHub
Options

Update APT_Snowglobe_Babar.yar

parent b64d3767
Showing with 28 additions and 30 deletions
malware/APT_Snowglobe_Babar.yar
...@@ -5,36 +5,34 @@ ...@@ -5,36 +5,34 @@
import "pe" import "pe"
rule SNOWGLOBE_Babar_Malware { rule SNOWGLOBE_Babar_Malware
meta: {
description = "Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe"
author = "Florian Roth"
reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
date = "2015/02/18"
hash = "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
score = 80
strings:
$mz = { 4d 5a }
$z0 = "admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper" ascii fullword
$z1 = "User-Agent: Mozilla/4.0 (compatible; MSI 6.0;" ascii fullword
$z2 = "ExecQueryFailled!" fullword ascii
$z3 = "NBOT_COMMAND_LINE" fullword
$z4 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]" fullword
$s1 = "/s /n %s \"%s\"" fullword ascii meta:
$s2 = "%%WINDIR%%\\%s\\%s" fullword ascii description = "Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe"
$s3 = "/c start /wait " fullword ascii author = "Florian Roth"
$s4 = "(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)" ascii reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
date = "2015/02/18"
hash = "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
score = 80
$x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" fullword ascii strings:
$x2 = "%COMMON_APPDATA%" fullword ascii $mz = { 4d 5a }
$x4 = "CONOUT$" fullword ascii $z0 = "admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper" ascii fullword
$x5 = "cmd.exe" fullword ascii $z1 = "User-Agent: Mozilla/4.0 (compatible; MSI 6.0;" ascii fullword
$x6 = "DLLPATH" fullword ascii $z2 = "ExecQueryFailled!" fullword ascii
condition: $z3 = "NBOT_COMMAND_LINE" fullword
( $mz at 0 ) and filesize < 1MB and $z4 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]" fullword
( $s1 = "/s /n %s \"%s\"" fullword ascii
( 1 of ($z*) and 1 of ($x*) ) or $s2 = "%%WINDIR%%\\%s\\%s" fullword ascii
( 3 of ($s*) and 4 of ($x*) ) $s3 = "/c start /wait " fullword ascii
) $s4 = "(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)" ascii
$x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" fullword ascii
$x2 = "%COMMON_APPDATA%" fullword ascii
$x4 = "CONOUT$" fullword ascii
$x5 = "cmd.exe" fullword ascii
$x6 = "DLLPATH" fullword ascii
condition:
( $mz at 0 ) and filesize < 1MB and (( 1 of ($z*) and 1 of ($x*) ) or ( 3 of ($s*) and 4 of ($x*) ) )
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment