Skip to content

Instantly share code, notes, and snippets.

@MrThreat
Created October 18, 2017 07:14
Show Gist options
  • Save MrThreat/a290fcc262f81832ade4fe3cf93a7f2c to your computer and use it in GitHub Desktop.
Save MrThreat/a290fcc262f81832ade4fe3cf93a7f2c to your computer and use it in GitHub Desktop.
roddenexe yara
rule Rodden
{
meta:
author = "Grotez"
date = "2017-10-18"
description = "datenight"
hash0 = "e523f6c34f9cb9a3652d1fad38b2329b"
sample_filetype = "exe"
yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
$string0 = ",w7jZI"
$string1 = "ProductName" wide
$string2 = "b,DTDD,ggfg"
$string3 = "tVB__cH"
$string4 = "()rr)/"
$string5 = "u)oS7S9"
$string6 = "NbBB(((("
$string7 = "E<mW'5_"
$string8 = "9,--ZW"
$string9 = "Roddenberry"
$string10 = "Recalls0" wide
$string11 = "T;hO3t"
$string12 = "0UWW@ij"
$string13 = "(--Dyzyyv"
$string14 = "ZFffDDDD"
$string15 = "EI)<y69"
$string16 = "Translation" wide
$string17 = "m)((9@2"
$string18 = "LNDD@ggg"
condition:
18 of them
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment