Skip to content

Instantly share code, notes, and snippets.

@herrcore

herrcore/karama.yara

Created November 22, 2021 18:16
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save herrcore/94fc677238db8b402d100e8003605773 to your computer and use it in GitHub Desktop.
Save herrcore/94fc677238db8b402d100e8003605773 to your computer and use it in GitHub Desktop.
Download ZIP
Yara rule generated with Binlex from our live stream https://youtu.be/hgz5gZB3DxE
Raw
karama.yara
rule malware_karama_0 {
meta:
descrption = "Karma Ransomware"
strings:
$name = "KARMA" ascii wide nocase
$trait_0 = {33 f6 0f b7 41 ?? 83 c1 02 8b d0 66 85 c0 75 da}
$trait_1 = {0f b7 d0 66 83 fa 5c 74 10}
condition:
uint16(0) == 0x5a4d and
uint32(uint32(0x3c)) == 0x00004550 and
filesize < 146KB and
$name and
1 of ($trait_*)
}
@evandrix
Copy link

evandrix commented Nov 23, 2021 •
edited

https://gist.github.com/herrcore/94fc677238db8b402d100e8003605773#file-karama-yara-L3
descrption description

karama karma

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment