Create MALW_Emotet.yar

malware/MALW_Emotet.yar

+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+
+rule Emotets{
+meta:
+  author = "pekeinfo"
+  date = "2017-10-18"
+  description = "Emotets"
+strings:
+  $mz = { 4d 5a }
+  $cmovnz={ 0f 45 fb 0f 45 de }
+  $mov_esp_0={ C7 04 24 00 00 00 00 89 44 24 0? }
+  $_eax={ 89 E? 8D ?? 24 ?? 89 ?? FF D0 83 EC 04 }
+condition:
+  ($mz at 0 and $_eax in( 0x2854..0x4000)) and ($cmovnz or $mov_esp_0)
+}