Create TreasureHunt.yar

af4a2007 · mmorenog · 2b255e3c · af4a2007
Commit af4a2007 authored May 19, 2016 by mmorenog
Hide whitespace changes
Inline Side-by-side

Showing with 18 additions and 0 deletions

TreasureHunt.yar malware/TreasureHunt.yar +18 -0

No files found.
--- a/malware/TreasureHunt.yar
+++ b/malware/TreasureHunt.yar
+rule TreasureHunt
+  {
+    meta:
+      author = "Minerva Labs"
+      ref ="http://www.minerva-labs.com/#!Cybercriminals-Adopt-the-Mossad-Emblem/c7a5/573da2d60cf2f90ca6f6e3ed"
+      date = "2016/06"
+      maltype = "Point of Sale (POS) Malware"
+      filetype = "exe"
+
+    strings:
+      $a = "treasureHunter.pdb"
+      $b = "jucheck"
+      $c = "cmdLineDecrypted"
+
+    condition:
+      all of them
+}
+