Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs
This commit is contained in:
42
data/ioc/yara/malware_families/xtreme.yara
Normal file
42
data/ioc/yara/malware_families/xtreme.yara
Normal file
@@ -0,0 +1,42 @@
|
||||
private rule XtremeRATCode : XtremeRAT Family
|
||||
{
|
||||
meta:
|
||||
description = "XtremeRAT code features"
|
||||
author = "Seth Hardy"
|
||||
last_modified = "2014-07-09"
|
||||
|
||||
strings:
|
||||
// call; fstp st
|
||||
$ = { E8 ?? ?? ?? ?? DD D8 }
|
||||
// hiding string
|
||||
$ = { C6 85 ?? ?? ?? ?? 4D C6 85 ?? ?? ?? ?? 70 C6 85 ?? ?? ?? ?? 64 C6 85 ?? ?? ?? ?? 62 C6 85 ?? ?? ?? ?? 6D }
|
||||
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
|
||||
private rule XtremeRATStrings : XtremeRAT Family
|
||||
{
|
||||
meta:
|
||||
description = "XtremeRAT Identifying Strings"
|
||||
author = "Seth Hardy"
|
||||
last_modified = "2014-07-09"
|
||||
|
||||
strings:
|
||||
$ = "dqsaazere"
|
||||
$ = "-GCCLIBCYGMING-EH-TDM1-SJLJ-GTHR-MINGW32"
|
||||
|
||||
condition:
|
||||
any of them
|
||||
}
|
||||
|
||||
rule XtremeRAT : Family
|
||||
{
|
||||
meta:
|
||||
description = "XtremeRAT"
|
||||
author = "Seth Hardy"
|
||||
last_modified = "2014-07-09"
|
||||
|
||||
condition:
|
||||
XtremeRATCode or XtremeRATStrings
|
||||
}
|
||||
Reference in New Issue
Block a user