Create MALW_Volgmer.yar

2ebbfd2c · mmorenog · GitHub · be86d299 · 2ebbfd2c
Unverified Commit 2ebbfd2c authored Nov 15, 2017 by mmorenog Committed by GitHub Nov 15, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 10 additions and 0 deletions

MALW_Volgmer.yar malware/MALW_Volgmer.yar +10 -0

No files found.
--- a/malware/MALW_Volgmer.yar
+++ b/malware/MALW_Volgmer.yar
+rule volgmer
+{
+meta:
+    description = "Malformed User Agent"
+    ref = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
+strings:
+    $s = "Mozillar/"
+condition:
+    (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $s
+}