Create APT_Shamoon_StoneDrill.yar

malware/APT_Shamoon_StoneDrill.yar

+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+import "pe"
+import "math"
+rule susp_file_enumerator_with_encrypted_resource_101 {
+  meta:
+    copyright = "Kaspersky Lab"
+    description = "Generic detection for samples that enumerate files with encrypted resource called 101"
+    hash = "2cd0a5f1e9bcce6807e57ec8477d222a"
+    hash = "c843046e54b755ec63ccb09d0a689674"
+    version = "1.4"
+  strings:
+    $mz = "This program cannot be run in DOS mode."
+    $a1 = "FindFirstFile" ascii wide nocase
+    $a2 = "FindNextFile" ascii wide nocase
+    $a3 = "FindResource" ascii wide nocase
+    $a4 = "LoadResource" ascii wide nocase
+condition:
+uint16(0) == 0x5A4D and
+all of them and
+filesize < 700000 and
+pe.number_of_sections > 4 and
+pe.number_of_signatures == 0 and
+pe.number_of_resources > 1 and pe.number_of_resources < 15 and
+for any i in (0..pe.number_of_resources - 1):
+( (math.entropy(pe.resources[i].offset, pe.resources[i].length) > 7.8) and
+pe.resources[i].id == 101 and
+pe.resources[i].length > 20000 and
+pe.resources[i].language == 0 and
+not ($mz in (pe.resources[i].offset..pe.resources[i].offset + pe.resources[i].length))
+)
+}