Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
R
rules
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
fact-depend
rules
Commits
a9876ddb
Unverified
Commit
a9876ddb
authored
7 years ago
by
unixfreaxjp
Committed by
GitHub
7 years ago
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Update TOOLKIT_Mandibule.yar
parent
cfcd2034
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
18 additions
and
3 deletions
+18
-3
TOOLKIT_Mandibule.yar
malware/TOOLKIT_Mandibule.yar
+18
-3
No files found.
malware/TOOLKIT_Mandibule.yar
View file @
a9876ddb
...
...
@@ -20,7 +20,7 @@ private rule is__str_mandibule_gen1 {
4 of them
}
private rule is__hex_top_mandibule {
private rule is__hex_top_mandibule
64
{
meta:
author = "unixfreaxjp"
date = "2018-05-31"
...
...
@@ -31,6 +31,20 @@ private rule is__hex_top_mandibule {
$hex04 = { 53 48 81 EC 70 01 01 00 48 89 7C 24 08 48 8D 44 24 20 48 05 00 00 } // ld
condition:
3 of them
private rule is__hex_mid_mandibule32 {
meta:
author = "unixfreaxjp"
date = "2018-06-01"
strings:
$hex05 = { E8 09 07 00 00 81 C1 FC 1F 00 00 8D 81 26 E1 FF FF } // st
$hex06 = { 56 53 83 EC 24 E8 E1 05 00 00 81 C3 D0 1E 00 00 8B 44 24 30} // mn
$hex07 = { 81 C3 E8 29 00 00 C7 44 24 0C } // pt
$hex08 = { E8 C6 D5 FF FF 83 C4 0C 68 00 01 00 00 } // ld
condition:
3 of them
}
private rule is__elf {
...
...
@@ -48,9 +62,10 @@ rule TOOLKIT_Mandibule {
reference = "https://imgur.com/a/MuHSZtC"
author = "unixfreaxjp"
org = "MalwareMustDie"
date = "2018-0
5-3
1"
date = "2018-0
6-0
1"
condition:
((is__str_mandibule_gen1) and (is__hex_top_mandibule))
((is__str_mandibule_gen1) or (is__hex_mid_mandibule32))
or ((is__str_mandibule_gen1) or (is__hex_top_mandibule64))
and is__elf
and filesize < 30KB
}
...
...
This diff is collapsed.
Click to expand it.
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment