Skip to content

Instantly share code, notes, and snippets.

View andretavare5's full-sized avatar

andretavare5

View GitHub Profile
@andretavare5
andretavare5 / win_colibriloader.yara
Last active January 12, 2024 11:18
Yara rule to detect ColibriLoader malware.
rule win_colibriloader
{
meta:
author = "andretavare5"
description = "Detects ColibriLoader malware."
org = "BitSight"
date = "2022-11-22"
md5 = "f1bbf3a0c6c52953803e5804f4e37b15"
reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.colibri"
license = "CC BY-NC-SA 4.0"
@andretavare5
andretavare5 / win_colibriloader_packed.yara
Last active January 12, 2024 11:13
Yara rule to detect packed ColibriLoader malware.
rule win_packed_colibriloader : packed loader
{
meta:
author = "andretavare5"
description = "Detects packed ColibriLoader malware"
org = "BitSight"
date = "2022-09-21"
md5 = "e0a68b98992c1699876f818a22b5b907"
reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.colibri"
license = "CC BY-NC-SA 4.0"
@andretavare5
andretavare5 / privateloader_str_decrypt.py
Last active February 14, 2024 08:03
Script that decrypts most of PrivateLoader stack strings - https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service/
import pefile
import struct
from capstone import *
def extract_var(op):
if ']' in op:
op = ''.join(op.split(' ')[-1])[:-1].replace('[', '')
return op
def search(instructions, var):
@andretavare5
andretavare5 / win_privateloader.yara
Last active January 12, 2024 11:27
Yara rule to detect PrivateLoader malware.
rule win_privateloader
{
meta:
author = "andretavare5"
description = "Detects PrivateLoader malware."
org = "Bitsight"
date = "2024-01-11"
sample = "6f7f9de3238003897f35b86caf942f088f14e88ecb1a5a1329ef5a7d421f7008"
reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader"
license = "CC BY-NC-SA 4.0"