Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
R
rules
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
fact-depend
rules
Commits
e55e40ee
Commit
e55e40ee
authored
8 years ago
by
Marc Rivero López
Committed by
GitHub
8 years ago
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Update APT_Mongall.yar
parent
0f236b61
Show whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
11 additions
and
6 deletions
+11
-6
APT_Mongall.yar
malware/APT_Mongall.yar
+11
-6
No files found.
malware/APT_Mongall.yar
View file @
e55e40ee
...
@@ -7,23 +7,26 @@ import "pe"
...
@@ -7,23 +7,26 @@ import "pe"
rule Backdoor_APT_Mongal
rule Backdoor_APT_Mongal
{
{
meta:
meta:
author = "@patrickrolsen"
author = "@patrickrolsen"
maltype = "Backdoor.APT.Mongall"
maltype = "Backdoor.APT.Mongall"
version = "0.1"
version = "0.1"
reference = "fd69a799e21ccb308531ce6056944842"
reference = "fd69a799e21ccb308531ce6056944842"
date = "01/04/2014"
date = "01/04/2014"
strings:
strings:
$author = "author user"
$author = "author user"
$title = "title Vjkygdjdtyuj" nocase
$title = "title Vjkygdjdtyuj" nocase
$comp = "company ooo"
$comp = "company ooo"
$cretime = "creatim\\yr2012\\mo4\\dy19\\hr15\\min10"
$cretime = "creatim\\yr2012\\mo4\\dy19\\hr15\\min10"
$passwd = "password 00000000"
$passwd = "password 00000000"
condition:
condition:
all of them
all of them
}
}
rule MongalCode
: Mongal Family
rule MongalCode
{
{
meta:
meta:
description = "Mongal code features"
description = "Mongal code features"
...
@@ -38,8 +41,9 @@ rule MongalCode : Mongal Family
...
@@ -38,8 +41,9 @@ rule MongalCode : Mongal Family
any of them
any of them
}
}
rule MongalStrings
: Mongal Family
rule MongalStrings
{
{
meta:
meta:
description = "Mongal Identifying Strings"
description = "Mongal Identifying Strings"
author = "Seth Hardy"
author = "Seth Hardy"
...
@@ -54,8 +58,9 @@ rule MongalStrings : Mongal Family
...
@@ -54,8 +58,9 @@ rule MongalStrings : Mongal Family
any of them
any of them
}
}
rule Mongal
: Family
rule Mongal
{
{
meta:
meta:
description = "Mongal"
description = "Mongal"
author = "Seth Hardy"
author = "Seth Hardy"
...
...
This diff is collapsed.
Click to expand it.
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment