Update TOOLKIT_Mandibule.yar

malware/TOOLKIT_Mandibule.yar

@@ -20,7 +20,7 @@ private rule is__str_mandibule_gen1 {
                 4 of them
 }
 
-private rule is__hex_top_mandibule {
+private rule is__hex_top_mandibule64 {
 	meta:
 		author = "unixfreaxjp"
 		date = "2018-05-31"
@@ -31,6 +31,20 @@ private rule is__hex_top_mandibule {
 		$hex04 = { 53 48 81 EC 70 01 01 00 48 89 7C 24 08 48 8D 44 24 20 48 05 00 00 } // ld
 	condition:
                 3 of them 
+
+private rule is__hex_mid_mandibule32 {
+	meta:
+		author = "unixfreaxjp"
+		date = "2018-06-01"
+	strings:
+		$hex05 = { E8 09 07 00 00 81 C1 FC 1F 00 00 8D 81 26 E1 FF FF } // st
+		$hex06 = { 56 53 83 EC 24 E8 E1 05 00 00 81 C3 D0 1E 00 00 8B 44 24 30} // mn
+		$hex07 = { 81 C3 E8 29 00 00 C7 44 24 0C } // pt
+		$hex08 = { E8 C6 D5 FF FF 83 C4 0C 68 00 01 00 00 } // ld
+	condition:
+                3 of them 
+
+
 }
 
 private rule is__elf {
@@ -48,9 +62,10 @@ rule TOOLKIT_Mandibule {
 		reference = "https://imgur.com/a/MuHSZtC"
 		author = "unixfreaxjp"
 		org = "MalwareMustDie"
-		date = "2018-05-31"
+		date = "2018-06-01"
 	condition:
-		((is__str_mandibule_gen1) and  (is__hex_top_mandibule))
+		((is__str_mandibule_gen1) or (is__hex_mid_mandibule32))
+		or ((is__str_mandibule_gen1) or (is__hex_top_mandibule64))
 		and is__elf
 		and filesize < 30KB 
 }