Last active
April 12, 2018 02:34
-
-
Save jermdw/49fa25d51e78b3898d7176a8c5661ede to your computer and use it in GitHub Desktop.
Yara GoTrojan
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rule Carbanak_Go_Trojan | |
{ | |
meta: | |
author = “RSA FW” | |
strings: | |
$mz = { 4D 5A } | |
$build_id = “Go build ID: | |
\”33ee104ab2c9fc37c067a26623e7fddd3bb76302\”” | |
$string = “xname.txt” | |
$sgc = “2.16.840.1.113730.4.1” | |
$msc = “1.3.6.1.4.1.311.10.3.3” | |
condition: | |
$mz at 0 and ($build_id or ($string and #sgc and $msc)) | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment