/*
BlackEnergy2 Yara Rule
v1.0 19.02.15
Tested on sample provided by @PhysicalDrive0:
https://malwr.com/analysis/N2YxOGJkNTk5NjcwNDM1MDkxN2EwZWMzYjE2NWQ4MTU/
Also integrated in IOC Scanner Loki
https://github.com/Neo23x0/Loki
Please report back false positives (via Issues on LOKI´s Github page)
*/
rule BlackEnergy_BE_2 {
meta:
description = "Detects BlackEnergy 2 Malware"
author = "Florian Roth"
reference = "http://goo.gl/DThzLz"
date = "2015/02/19"
hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77"
strings:
$mz = { 4d 5a }
$s0 = "<description> Windows system utility service </description>" fullword ascii
$s1 = "WindowsSysUtility - Unicode" fullword wide
$s2 = "msiexec.exe" fullword wide
$s3 = "WinHelpW" fullword ascii
$s4 = "ReadProcessMemory" fullword ascii
condition:
( $mz at 0 ) and filesize < 250KB and all of ($s*)
}
Comments
0 B
|👍
/👎
0 B
|👍
/👎