/*
 
  BlackEnergy2 Yara Rule
  v1.0 19.02.15
 
  Tested on sample provided by @PhysicalDrive0:
  https://malwr.com/analysis/N2YxOGJkNTk5NjcwNDM1MDkxN2EwZWMzYjE2NWQ4MTU/
 
  Also integrated in IOC Scanner Loki
  https://github.com/Neo23x0/Loki
 
  Please report back false positives (via Issues on LOKI´s Github page)
 
*/

rule BlackEnergy_BE_2 {
	meta:
		description = "Detects BlackEnergy 2 Malware"
		author = "Florian Roth"
		reference = "http://goo.gl/DThzLz"
		date = "2015/02/19"
		hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77"
	strings:
		$mz = { 4d 5a }
		$s0 = "<description> Windows system utility service  </description>" fullword ascii
		$s1 = "WindowsSysUtility - Unicode" fullword wide
		$s2 = "msiexec.exe" fullword wide
		$s3 = "WinHelpW" fullword ascii
		$s4 = "ReadProcessMemory" fullword ascii
	condition:
		( $mz at 0 ) and filesize < 250KB and all of ($s*)
}