Update APT_Emissary.yar

Fixed syntax rule

Update APT_Emissary.yar
Fixed syntax rule
8da187d5 · Marc Rivero López · GitHub · f55bcd25 · 8da187d5
Commit 8da187d5 authored Jan 21, 2017 by Marc Rivero López Committed by GitHub Jan 21, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 37 additions and 33 deletions

APT_Emissary.yar malware/APT_Emissary.yar +37 -33

No files found.
--- a/malware/APT_Emissary.yar
+++ b/malware/APT_Emissary.yar
@@ -9,37 +9,41 @@
 	Identifier: Emissary Malware
 */
-rule Emissary_APT_Malware_1 {
+rule Emissary_APT_Malware_1 
-	meta:
+{
-		description = "Detect Emissary Malware - from samples A08E81B411.DAT, ishelp.dll"
-		author = "Florian Roth"
+    meta:
-		reference = "http://goo.gl/V0epcf"
+        description = "Detect Emissary Malware - from samples A08E81B411.DAT, ishelp.dll"
-		date = "2016-01-02"
+        author = "Florian Roth"
-		score = 75
+        reference = "http://goo.gl/V0epcf"
-		hash1 = "9420017390c598ee535c24f7bcbd39f40eca699d6c94dc35bcf59ddf918c59ab"
+        date = "2016-01-02"
-		hash2 = "70561f58c9e5868f44169854bcc906001947d98d15e9b4d2fbabd1262d938629"
+        score = 75
-		hash3 = "0e64e68f6f88b25530699a1cd12f6f2790ea98e6e8fa3b4bc279f8e5c09d7290"
+        hash1 = "9420017390c598ee535c24f7bcbd39f40eca699d6c94dc35bcf59ddf918c59ab"
-		hash4 = "69caa2a4070559d4cafdf79020c4356c721088eb22398a8740dea8d21ae6e664"
+        hash2 = "70561f58c9e5868f44169854bcc906001947d98d15e9b4d2fbabd1262d938629"
-		hash5 = "675869fac21a94c8f470765bc6dd15b17cc4492dd639b878f241a45b2c3890fc"
+        hash3 = "0e64e68f6f88b25530699a1cd12f6f2790ea98e6e8fa3b4bc279f8e5c09d7290"
-		hash6 = "e817610b62ccd00bdfc9129f947ac7d078d97525e9628a3aa61027396dba419b"
+        hash4 = "69caa2a4070559d4cafdf79020c4356c721088eb22398a8740dea8d21ae6e664"
-		hash7 = "a8b0d084949c4f289beb4950f801bf99588d1b05f68587b245a31e8e82f7a1b8"
+        hash5 = "675869fac21a94c8f470765bc6dd15b17cc4492dd639b878f241a45b2c3890fc"
-		hash8 = "acf7dc5a10b00f0aac102ecd9d87cd94f08a37b2726cb1e16948875751d04cc9"
+        hash6 = "e817610b62ccd00bdfc9129f947ac7d078d97525e9628a3aa61027396dba419b"
-		hash9 = "e21b47dfa9e250f49a3ab327b7444902e545bed3c4dcfa5e2e990af20593af6d"
+        hash7 = "a8b0d084949c4f289beb4950f801bf99588d1b05f68587b245a31e8e82f7a1b8"
-		hash10 = "e369417a7623d73346f6dff729e68f7e057f7f6dae7bb03d56a7510cb3bfe538"
+        hash8 = "acf7dc5a10b00f0aac102ecd9d87cd94f08a37b2726cb1e16948875751d04cc9"
-		hash11 = "29d8dc863427c8e37b75eb738069c2172e79607acc7b65de6f8086ba36abf051"
+        hash9 = "e21b47dfa9e250f49a3ab327b7444902e545bed3c4dcfa5e2e990af20593af6d"
-		hash12 = "98fb1d2975babc18624e3922406545458642e01360746870deee397df93f50e0"
+        hash10 = "e369417a7623d73346f6dff729e68f7e057f7f6dae7bb03d56a7510cb3bfe538"
-		hash13 = "fbcb401cf06326ab4bb53fb9f01f1ca647f16f926811ea66984f1a1b8cf2f7bb"
+        hash11 = "29d8dc863427c8e37b75eb738069c2172e79607acc7b65de6f8086ba36abf051"
-	strings:
+        hash12 = "98fb1d2975babc18624e3922406545458642e01360746870deee397df93f50e0"
-		$s1 = "cmd.exe /c %s > %s" fullword ascii
+        hash13 = "fbcb401cf06326ab4bb53fb9f01f1ca647f16f926811ea66984f1a1b8cf2f7bb"
-		$s2 = "execute cmd timeout." fullword ascii
-		$s3 = "rundll32.exe \"%s\",Setting" fullword ascii
+    strings:
-		$s4 = "DownloadFile - exception:%s." fullword ascii
+        $s1 = "cmd.exe /c %s > %s" fullword ascii
-		$s5 = "CDllApp::InitInstance() - Evnet create successful." fullword ascii
+        $s2 = "execute cmd timeout." fullword ascii
-		$s6 = "UploadFile - EncryptBuffer Error" fullword ascii
+        $s3 = "rundll32.exe \"%s\",Setting" fullword ascii
-		$s7 = "WinDLL.dll" fullword wide
+        $s4 = "DownloadFile - exception:%s." fullword ascii
-		$s8 = "DownloadFile - exception:%s,code:0x%08x." fullword ascii
+        $s5 = "CDllApp::InitInstance() - Evnet create successful." fullword ascii
-		$s9 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" fullword ascii
+        $s6 = "UploadFile - EncryptBuffer Error" fullword ascii
-		$s10 = "CDllApp::InitInstance() - Evnet already exists." fullword ascii
+        $s7 = "WinDLL.dll" fullword wide
-	condition:
+        $s8 = "DownloadFile - exception:%s,code:0x%08x." fullword ascii
-		uint16(0) == 0x5a4d and filesize < 250KB and 3 of them
+        $s9 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" fullword ascii
+        $s10 = "CDllApp::InitInstance() - Evnet already exists." fullword ascii
+    condition:
+        uint16(0) == 0x5a4d and filesize < 250KB and 3 of them
 }