Skip to content

R
rules
Commit 39f96de1 by mmorenog
Options

Update cert_wiper.yara

parent a48b43c7
Showing with 2 additions and 3 deletions
malware/Operation_Blockbuster/cert_wiper.yara
...@@ -250,7 +250,7 @@ rule Malwareusedbycyberthreatactor1 ...@@ -250,7 +250,7 @@ rule Malwareusedbycyberthreatactor1
81 9E B0 14 13 81 97 5F 26 A0 A5 35 0E 8? ?? ?0 00 08 3C 40 C8 3F 80 27 41 D8 3F 81 9E B0 14 13 81 97 5F 26 A0 A5 35 0E 8? ?? ?0 00 08 3C 40 C8 3F 80 27 41 D8 3F
80 37 41 88 3F 80 17 41 38 D4 5F C5 0E 89 8F EF FF F8 07 DF C0 65 91 BC 08 3C 00 80 37 41 88 3F 80 17 41 38 D4 5F C5 0E 89 8F EF FF F8 07 DF C0 65 91 BC 08 3C 00
35 BC 9C3} 35 BC 9C3}
*/
// vvv---- this sig hits on a legit CRT function it seems. // vvv---- this sig hits on a legit CRT function it seems.
$getMajorMinorLinker = {568B7424086A00832600FF15???????06681384D5A75148B483C85C9740D03C18A481A880E8A401B8846015EC3} $getMajorMinorLinker = {568B7424086A00832600FF15???????06681384D5A75148B483C85C9740D03C18A481A880E8A401B8846015EC3}
...@@ -286,4 +286,4 @@ rule Malwareusedbycyberthreatactor3 ...@@ -286,4 +286,4 @@ rule Malwareusedbycyberthreatactor3
condition: condition:
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
} }
\ No newline at end of file
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment