Merge pull request #377 from baderj/asyncrat

new yara rule for AsyncRAT

malware/RAT_Asyncrat.yar

+/*
+   This Yara ruleset is under the GNU-GPLv2 license 
+   (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or 
+   organization, as long as you use it under this license.
+*/
+
+rule win_asyncrat_j1 {
+
+    meta:
+        author      = "Johannes Bader @viql"
+        date        = "2020-04-26"
+        description = "detects AsyncRAT"
+        references  = "https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp"
+        tlp         = "white"
+
+    strings:
+        $str_anti_1 = "VIRTUAL" wide
+        $str_anti_2 = "vmware" wide
+        $str_anti_3 = "VirtualBox" wide
+        $str_anti_4 = "SbieDll.dll" wide
+
+        $str_miner_1 = "--donate-level=" wide
+
+        $str_b_rev_run    = "\\nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" wide
+        $str_b_msg_pack_1 = "(ext8,ext16,ex32) type $c7,$c8,$c9" wide
+        $str_b_msg_pack_2 = "(never used) type $c1" wide
+        $str_b_schtask_1  = "/create /f /sc ONLOGON /RL HIGHEST /tn \"'" wide
+        $str_b_schtask_2  = "\"' /tr \"'" wide
+
+        $str_config_1 = "Antivirus" wide
+        $str_config_2 = "Pastebin" wide
+        $str_config_3 = "HWID" wide
+        $str_config_4 = "Installed" wide
+        $str_config_5 = "Pong" wide
+        $str_config_6 = "Performance" wide
+
+    condition:
+        all of ($str_anti_*)  and 
+        4 of ($str_config_*) and ( 
+            all of ($str_miner_*) or 
+            3 of ($str_b_*)
+        )
+        
+}
+