New Loader

gistfile1.txt

rule newloader_bin
{
    meta:
        description = "Unknown loader"
        author = "James_inthe_box"
        reference = "5a888d05804d06190f7fc408bede9da0423678c8f6eca37ecce83791de4df83d"
        date = "2020/4"
        maltype = "Poopy"
        
    strings:
        $string1 = ".?AVXDropTarget@COleDropTarget@@" ascii wide
        $string2 = "CLSID\\%1\\AuxUserType\\3" ascii wide 
        $string3 = ".?AV?$CTypedPtrArray@VCObArray@@PEAV?$CTypedPtrArray@VCObArray@@PEAVCGridCellBase@@@@@@" ascii wide
        
    condition:
        all of ($string*) and filesize < 2MB
} 

rule newloader_mem
{
    meta:
        description = "Unknown loader"
        author = "James_inthe_box"
        reference = "5a888d05804d06190f7fc408bede9da0423678c8f6eca37ecce83791de4df83d"
        date = "2020/4"
        maltype = "Poopy"

    strings:
        $string1 = "Message_dy" ascii wide
        $string2 = { 73 74 75 6e ?? 2e 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d } //stun*.l.google.com
        $string3 = /[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:[0-9]{1,5}/ ascii wide
        
    condition:
        all of ($string*) and filesize > 2MB
}