Create MALW_XHide.yar

5f193eef · wolfvan · GitHub · 6caded71 · 5f193eef
Unverified Commit 5f193eef authored Nov 30, 2017 by wolfvan Committed by GitHub Nov 30, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 15 additions and 0 deletions

MALW_XHide.yar malware/MALW_XHide.yar +15 -0

No files found.
--- a/malware/MALW_XHide.yar
+++ b/malware/MALW_XHide.yar
+rule XHide: MALW
+{
+	meta:
+		description = "XHide - Process Faker"
+		author = "Joan Soriano / @w0lfvan"
+		date = "2017-12-01"
+		version = "1.0"
+		MD5 = "c644c04bce21dacdeb1e6c14c081e359"
+		SHA256 = "59f5b21ef8a570c02453b5edb0e750a42a1382f6"
+	strings:
+		$a = "XHide - Process Faker"
+		$b = "Fakename: %s PidNum: %d"
+	condition:
+		all of them
+}