Skip to content

R
rules
Commit 9e912d75 by Marc Rivero López Committed by GitHub
Options

Update MALW_Buzus_Softpulse.yar

parent 0ece5ec4
Showing with 20 additions and 21 deletions
malware/MALW_Buzus_Softpulse.yar
...@@ -3,26 +3,25 @@ ...@@ -3,26 +3,25 @@
*/ */
rule Win32_Buzus_Softpulse : win32 { rule Win32_Buzus_Softpulse
meta: {
description = "Trojan Buzus / Softpulse"
author = "Florian Roth"
date = "2015-05-13"
hash = "2f6df200e63a86768471399a74180466d2e99ea9"
score = 75
strings:
$x1 = "pi4izd6vp0.com" fullword ascii
$s1 = "SELECT * FROM Win32_Process" fullword wide meta:
$s4 = "CurrentVersion\\Uninstall\\avast" fullword wide description = "Trojan Buzus / Softpulse"
$s5 = "Find_RepeatProcess" fullword ascii author = "Florian Roth"
$s6 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\" fullword wide date = "2015-05-13"
$s7 = "myapp.exe" fullword ascii hash = "2f6df200e63a86768471399a74180466d2e99ea9"
$s14 = "/c ping -n 1 www.google" wide score = 75
condition:
uint16(0) == 0x5a4d and strings:
( $x1 = "pi4izd6vp0.com" fullword ascii
( $x1 and 2 of ($s*) ) or $s1 = "SELECT * FROM Win32_Process" fullword wide
all of ($s*) $s4 = "CurrentVersion\\Uninstall\\avast" fullword wide
) $s5 = "Find_RepeatProcess" fullword ascii
$s6 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\" fullword wide
$s7 = "myapp.exe" fullword ascii
$s14 = "/c ping -n 1 www.google" wide
condition:
uint16(0) == 0x5a4d and ( ( $x1 and 2 of ($s*) ) or all of ($s*) )
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment