Backdoor Batel

Detect backdoor batel

malware/MALW_Batel.yar

+*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
+
+*/
+
+import "pe"
+
+rule Batel_export_function : backdoor batel {
+        meta:
+                author = "@j0sm1"
+                date = "2016/10/15"
+                description = "Batel backdoor"
+                reference = "https://www.symantec.com/security_response/writeup.jsp?docid=2016-091923-4146-99"
+                filetype = "binary"
+
+        condition:
+                pe.exports("run_shell") and pe.imports("kernel32.dll","GetTickCount") and pe.imports("kernel32.dll","IsDebuggerPresent") and pe.imports("msvcr100.dll","_crt_debugger_hook") and pe.imports("kernel32.dll","TerminateProcess") and pe.imports("kernel32.dll","UnhandledExceptionFilter")
+}
\ No newline at end of file