andretavare5

rule win_colibriloader : loader
{
  meta:
    author      = "andretavare5"
    description = "ColibriLoader malware"
    org         = "BitSight"
    date        = "2022-11-22"
    md5         = "f1bbf3a0c6c52953803e5804f4e37b15"
    reference   = "https://malpedia.caad.fkie.fraunhofer.de/details/win.colibri"
    license     = "CC BY-NC-SA 4.0"

andretavare5

rule win_packed_colibriloader : packed loader
{
  meta:
    author      = "andretavare5"
    description = "Packed ColibriLoader malware"
    org         = "BitSight"
    date        = "2022-09-21"
    md5         = "e0a68b98992c1699876f818a22b5b907"
    reference   = "https://malpedia.caad.fkie.fraunhofer.de/details/win.colibri"
    license     = "CC BY-NC-SA 4.0"

andretavare5

import "pe"

rule win_matanbuchus : loader 
{
  meta:
    author      = "andretavare5"
    description = "Detects Matanbuchus MaaS loader and core"
    org         = "BitSight"
    date        = "2022-07-07"
    md5         = "8fc15b030254c0d49f18d06c696d6986"

andretavare5

import pefile
import struct
from capstone import *

def extract_var(op):
    if ']' in op:
        op = ''.join(op.split(' ')[-1])[:-1].replace('[', '')
    return op

def search(instructions, var):

andretavare5

rule win_privateloader : loader 
{
  meta:
    author    = "andretavare5"
    org       = "BitSight"
    date      = "2022-06-06"
    md5       = "8f70a0f45532261cb4df2800b141551d"
    reference = "https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service"
    license   = "CC BY-NC-SA 4.0"