Skip to content

R
rules
Commit a1f02d7a by jovimon Committed by GitHub
Options

Create APT_CrashOverride.yar

parent 8518f9bd
Showing with 2 additions and 16 deletions
malware/APT_CrashOverride.yar
......@@ -85,8 +85,8 @@ rule dragos_crashoverride_moduleStrings {
rule dragos_crashoverride_configReader {
meta:
description = "CRASHOVERRIDE v1 Config File Parsing"
author = "Dragos Inc"
description = "CRASHOVERRIDE v1 Config File Parsing"
author = "Dragos Inc"
reference = "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"
strings:
$s0 = { 68 e8 ?? ?? ?? 6a 00 e8 a3 ?? ?? ?? 8b f8 83 c4 ?8 }
......@@ -97,20 +97,6 @@ rule dragos_crashoverride_configReader {
all of them
}
rule dragos_crashoverride_configReader {
meta:
description = "CRASHOVERRIDE v1 Config File Parsing"
author = "Dragos Inc"
reference = "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"
strings:
$s0 = { 68 e8 ?? ?? ?? 6a 00 e8 a3 ?? ?? ?? 8b f8 83 c4 ?8 }
$s1 = { 8a 10 3a 11 75 ?? 84 d2 74 12 }
$s2 = { 33 c0 eb ?? 1b c0 83 c8 ?? }
$s3 = { 85 c0 75 ?? 8d 95 ?? ?? ?? ?? 8b cf ?? ?? }
condition:
all of them
}
rule dragos_crashoverride_weirdMutex {
meta:
description = "Blank mutex creation assoicated with CRASHOVERRIDE"
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment