Create general_cloaking.yar

malware/general_cloaking.yar

+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+
+rule EXE_cloaked_as_TXT {
+	meta:
+		description = "Executable with TXT extension"
+		author = "Florian Roth"
+	condition:
+		uint16(0) == 0x5a4d 					// Executable
+		and filename matches /\.txt$/is   // TXT extension (case insensitive)
+}
+
+rule EXE_extension_cloaking {
+	meta:
+		description = "Executable showing different extension (Windows default 'hide known extension')"
+		author = "Florian Roth"
+	condition:
+		filename matches /\.txt\.exe$/is or	// Special file extensions
+		filename matches /\.pdf\.exe$/is		// Special file extensions
+}
+
+rule Cloaked_RAR_File {
+	meta:
+		description = "RAR file cloaked by a different extension"
+		author = "Florian Roth"
+	condition:
+		uint32be(0) == 0x52617221							// RAR File Magic Header
+		and not filename matches /(rarnew.dat|\.rar)$/is	// not the .RAR extension
+		and not filepath contains "Recycle" 				// not a deleted RAR file in recycler
+}
+
+rule Base64_encoded_Executable {
+	meta:
+		description = "Detects an base64 encoded executable (often embedded)"
+		author = "Florian Roth"
+		date = "2015-05-28"
+		score = 40
+	strings:
+		$s1 = "TVpTAQEAAAAEAAAA//8AALgAAAA" // 14 samples in goodware archive
+		$s2 = "TVoAAAAAAAAAAAAAAAAAAAAAAAA" // 26 samples in goodware archive
+		$s3 = "TVqAAAEAAAAEABAAAAAAAAAAAAA" // 75 samples in goodware archive
+		$s4 = "TVpQAAIAAAAEAA8A//8AALgAAAA" // 168 samples in goodware archive
+		$s5 = "TVqQAAMAAAAEAAAA//8AALgAAAA" // 28,529 samples in goodware archive
+	condition:
+		1 of them and not filepath contains "Thunderbird"
+}
+
+rule Binary_Drop_Certutil {
+	meta:
+		description = "Drop binary as base64 encoded cert trick"
+		author = "Florian Roth"
+		reference = "https://goo.gl/9DNn8q"
+		date = "2015-07-15"
+		score = 70
+	strings:
+		$s0 = "echo -----BEGIN CERTIFICATE----- >" ascii
+		$s1 = "echo -----END CERTIFICATE----- >>" ascii
+		$s2 = "certutil -decode " ascii
+	condition:
+		filesize < 10KB and all of them
+}