%s| %s" fullword wide
- $s19 = "WAppData" fullword wide
- $s20 = "WinPos%dx%d(%d).%s" fullword wide
-
- $op0 = { 55 8b ec 51 56 33 f6 66 89 33 8a 07 eb 29 34 42 }
- $op1 = { 39 74 24 34 89 74 24 0c 0f 8e 9e }
- $op2 = { 3b 48 34 0f 82 f2 fe ff ff 39 5d 0c 0f 84 88 01 }
- condition:
- uint16(0) == 0x5a4d and filesize < 400KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_537 {
- meta:
- description = "Windows_537"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db"
- strings:
- $x1 = "rundll32 C:\\Users\\Administrator\\Desktop\\LBB_Rundll32_pass.dll,sdll -pass %s" fullword ascii
- $x2 = "rundll32 C:\\Users\\Administrator\\Desktop\\LBB_Rundll32_pass.dll,gdll -pass %s" fullword ascii
- $x3 = "encryptor3dll.dll" fullword ascii
- $s4 = "powershell Get-ADComputer -filter * -Searchbase '%s' | Foreach-Object { Invoke-GPUpdate -computer $_.name -force -RandomDelayInM" wide
- $s5 = "LBB_pass.exe -path C:\\ -pass %s" fullword ascii
- $s6 = "LBB_pass.exe -path C:\\folder -pass %s" fullword ascii
- $s7 = "LBB_pass.exe -path C:\\file -pass %s" fullword ascii
- $s8 = "Password_dll.txt" fullword wide
- $s9 = "Don't leak files and passwords to run, this will help bypass anti-viruses for as long as possible." fullword ascii
- $s10 = "Encryptor Creation Error [BuildDll #1]" fullword wide
- $s11 = "Encryptor Creation Error [BuildDll #2]" fullword wide
- $s12 = "Encryptor Creation Error [BuildDll #3]" fullword wide
- $s13 = "When using self-spread and impersonation, the files should be run with at least local administrator privileges on any computer o" ascii
- $s14 = "Password_exe.txt" fullword wide
- $s15 = "LBB_pass.exe -path \\\\?\\Volume{11111111-2222-3333-4444-555555555555}\\ -pass %s" fullword ascii
- $s16 = "LBB_pass.exe -safe -pass %s" fullword ascii
- $s17 = "LBB_pass.exe -pass %s" fullword ascii
- $s18 = "### Target Mode:" fullword ascii
- $s19 = "Resource Compression Error [BuildDll]" fullword wide
- $s20 = "Encryptor Creation Error [BuildRef]" fullword wide
-
- $op0 = { 50 e8 8f ff ff ff 89 45 fc 83 7d fc 00 74 0e ff }
- $op1 = { 50 e8 38 ff ff ff 8b f0 85 f6 74 1c c7 06 5c 00 }
- $op2 = { b0 34 aa fe c0 e2 fb b9 03 }
- condition:
- uint16(0) == 0x5a4d and filesize < 1000KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_538 {
- meta:
- description = "Windows_538"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "575f1eab81c3fb5bf8e2694935e4bab50eca349d6700ac097f691827ee395e44"
- strings:
- $x1 = "jSystem.CodeDom.MemberAttributes, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089fSystem.Drawing.Size," ascii
- $s2 = " System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3amSystem.Globalization.CultureInfo, mscorlib, V" ascii
- $s3 = "Zbgmwjbuq.exe" fullword wide
- $s4 = "LoginGetter" fullword ascii
- $s5 = "AgentProcessStatus" fullword ascii
- $s6 = "ProcessorGetter" fullword ascii
- $s7 = "processGetter" fullword ascii
- $s8 = "LoginConfiguration" fullword ascii
- $s9 = "LoginService" fullword ascii
- $s10 = "ProcessTokenQueue" fullword ascii
- $s11 = "LoginProxy" fullword ascii
- $s12 = "m_ProcessError" fullword ascii
- $s13 = "ComputeProcessor" fullword ascii
- $s14 = "processorError" fullword ascii
- $s15 = "_ProcessorToken" fullword ascii
- $s16 = "m_ProcessToken" fullword ascii
- $s17 = "ersion=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089PADPADP" fullword ascii
- $s18 = "ListSystem" fullword ascii /* base64 encoded string '.+-K+-z' */
- $s19 = "Not an AIFF file - no AIFF/AIFC header." fullword wide
- $s20 = "ManageTemplate" fullword ascii
- condition:
- uint16(0) == 0x5a4d and filesize < 10000KB and
- 1 of ($x*) and 4 of them
-}
-
-rule Windows_539 {
- meta:
- description = "Windows_539"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "03e649c10b7695e2884b7a356f96953e94814d2a77a678ac714a82bbbed70647"
- strings:
- $s1 = " " fullword wide
- $s2 = " = connection.execute(" fullword wide
- $s3 = "Invalid parameter list passed to CreateAdditionalEXEAssociations - expected Name/Text/Command" fullword wide
- $s4 = "C:\\Windows\\SysWow64\\MSVBVM60.DLL\\3" fullword ascii
- $s5 = "http://ww1.realftp.com/pbtools/feedback.asp?fname=" fullword wide
- $s6 = ".execute(" fullword wide
- $s7 = "\\Active Server Pages\\File system\\Show Directory Contents.txt" fullword wide
- $s8 = "\\shell\\print\\command" fullword wide
- $s9 = "\\shell\\add\\command" fullword wide
- $s10 = "\\shell\\new\\command" fullword wide
- $s11 = "Error - attempt to create additional associations before class defined." fullword wide
- $s12 = "C:\\WINDOWS\\Desktop\\Copy of New Folder\\exe\\newdoc.txt" fullword wide
- $s13 = "email@address.com" fullword ascii
- $s14 = "" fullword wide
- $s15 = "M*\\AC:\\porana\\klshaam\\192-aspediter\\pbaspedit.vbp" fullword wide
- $s16 = "\\c.exe -o " fullword wide
- $s17 = "\\MSINFO32.EXE" fullword wide
- $s18 = "C:\\Inetpub\\wwwroot" fullword ascii
- $s19 = "mmuvbcommands" fullword ascii
- $s20 = "ch.exe" fullword wide
-
- $op0 = { 5f 5f 76 62 61 52 34 53 74 72 }
- $op1 = { 5f 5f 76 62 61 52 34 56 61 72 00 00 5f 5f 76 62 }
- $op2 = { 5f 5f 76 62 61 52 34 56 61 72 }
- condition:
- uint16(0) == 0x5a4d and filesize < 3000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_540 {
- meta:
- description = "Windows_540"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "d1349e9e3adac85b864ee624ed1c84d68e78d095572b26c2679d13061978927c"
- strings:
- $s1 = "hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD$(" fullword ascii
- $s2 = "OpenFTP.EventLogger" fullword ascii
- $s3 = "iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAYAAADDPmHLAAAVWklEQVR4Xu1dCXgUVbb+T/WapLujPhAcxUHSuBEVWURcRnwIg/vyQJlx8CmGdNjcF8YN1NEZFHTcIM2i" wide
- $s4 = "L54k.exe" fullword wide
- $s5 = "LoggerTraceListener" fullword ascii
- $s6 = "OpenFTP.Utils.CRC" fullword ascii
- $s7 = "OpenFTP.TraceListener" fullword ascii
- $s8 = "OpenFTP.Utils.ProgressReporter" fullword ascii
- $s9 = "[START NEW LOGGING PROCESS: " fullword wide
- $s10 = "loggerOwner" fullword ascii
- $s11 = "LoggerType" fullword ascii
- $s12 = "LoggerEventArgs" fullword ascii
- $s13 = "OpenFTP.Utils.FTPUtils" fullword ascii
- $s14 = "GetSslErrorsString" fullword ascii
- $s15 = "OpenFTP.Properties" fullword ascii
- $s16 = "OpenFTP.Enumerations" fullword ascii
- $s17 = "OpenFTP.Utils" fullword ascii
- $s18 = "OpenFTP.Properties.Resources" fullword wide
- $s19 = "OpenFTP.frmMain.resources" fullword ascii
- $s20 = "OpenFTP.Properties.Resources.resources" fullword ascii
-
- $op0 = { ae 46 01 00 ae 40 39 66 53 4b 6b 6a 53 34 30 65 }
- $op1 = { 70 34 00 00 38 79 00 00 23 55 53 00 a8 ad 00 00 }
- $op2 = { 49 00 4e 13 00 00 34 00 66 00 09 01 10 00 08 10 }
- condition:
- uint16(0) == 0x5a4d and filesize < 1000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_541 {
- meta:
- description = "Windows_541"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "497eebb26dbf500508b344dec05bbadb1e0421d77be6defc150bce9f88ea37b9"
- strings:
- $x1 = "C:\\Users\\911\\Desktop\\CronosVir.pdb" fullword ascii
- $s2 = "G*\\AC:\\Users\\911\\Desktop\\Enhanced V270409272001\\Metre.vbp" fullword wide
- $s3 = "FC:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VBA6.dll" fullword ascii
- $s4 = "oleaut32.DLL" fullword ascii
- $s5 = "C:\\Windows\\SysWOW64\\msvbvm60.dll\\3" fullword ascii
- $s6 = "CronosVir.exe" fullword wide
- $s7 = "mdEdgeTop" fullword ascii /* base64 encoded string 'tG`y:)' */
- $s8 = "vb5.exe" fullword wide
- $s9 = "pShellCode" fullword ascii
- $s10 = "FromCurrentProcess" fullword ascii
- $s11 = "sGetSystemCommandName" fullword ascii
- $s12 = "UNKNOWN SYSTEM COMMAND : " fullword wide
- $s13 = "HOOKPROCCBTSYSCOMMAND" fullword ascii
- $s14 = "HOOKPROCKEYBOARDLL" fullword ascii
- $s15 = "lblEvents" fullword ascii /* base64 encoded string 'nQ/z{l' */
- $s16 = "Attempt to read bad string pointer: " fullword wide
- $s17 = "WM_CHOOSEFONT_GETLOGFONT" fullword wide
- $s18 = "WM_DDE_EXECUTE" fullword wide
- $s19 = "MSCOMCTL.OCX" fullword ascii
- $s20 = "6C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\ieframe.oca" fullword ascii
-
- $op0 = { 1e 3b 45 00 25 3b 45 00 34 3b 45 00 41 3b 45 00 }
- $op1 = { 03 00 08 00 34 6a 46 00 39 6a 46 }
- $op2 = { 41 ab 46 00 05 00 08 00 34 ac 46 }
- condition:
- uint16(0) == 0x5a4d and filesize < 2000KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_542 {
- meta:
- description = "Windows_542"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "34df4fec6798befd9aa30d72fe35f258f36e70e787cc1a8554de86ba8632a312"
- strings:
- $x1 = "C:\\Users\\911\\Desktop\\CronosVir.pdb" fullword ascii
- $s2 = "G*\\AC:\\Users\\911\\Desktop\\Enhanced V270409272001\\Metre.vbp" fullword wide
- $s3 = "FC:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VBA6.dll" fullword ascii
- $s4 = "oleaut32.DLL" fullword ascii
- $s5 = "C:\\Windows\\SysWOW64\\msvbvm60.dll\\3" fullword ascii
- $s6 = "CronosVir.exe" fullword wide
- $s7 = "mdEdgeTop" fullword ascii /* base64 encoded string 'tG`y:)' */
- $s8 = "vb5.exe" fullword wide
- $s9 = "pShellCode" fullword ascii
- $s10 = "FromCurrentProcess" fullword ascii
- $s11 = "sGetSystemCommandName" fullword ascii
- $s12 = "UNKNOWN SYSTEM COMMAND : " fullword wide
- $s13 = "HOOKPROCCBTSYSCOMMAND" fullword ascii
- $s14 = "HOOKPROCKEYBOARDLL" fullword ascii
- $s15 = "lblEvents" fullword ascii /* base64 encoded string 'nQ/z{l' */
- $s16 = "Attempt to read bad string pointer: " fullword wide
- $s17 = "WM_CHOOSEFONT_GETLOGFONT" fullword wide
- $s18 = "WM_DDE_EXECUTE" fullword wide
- $s19 = "MSCOMCTL.OCX" fullword ascii
- $s20 = "6C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\ieframe.oca" fullword ascii
-
- $op0 = { 1e 3b 45 00 25 3b 45 00 34 3b 45 00 41 3b 45 00 }
- $op1 = { 03 00 08 00 34 6a 46 00 39 6a 46 }
- $op2 = { 41 ab 46 00 05 00 08 00 34 ac 46 }
- condition:
- uint16(0) == 0x5a4d and filesize < 2000KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_543 {
- meta:
- description = "Windows_543"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "839fed416da07d973bd32504c2d27f69abf4a559d168393564fe2a39385f734f"
- strings:
- $x1 = "C:\\Users\\911\\Desktop\\CronosVir.pdb" fullword ascii
- $s2 = "G*\\AC:\\Users\\911\\Desktop\\Enhanced V270409272001\\Metre.vbp" fullword wide
- $s3 = "FC:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VBA6.dll" fullword ascii
- $s4 = "oleaut32.DLL" fullword ascii
- $s5 = "C:\\Windows\\SysWOW64\\msvbvm60.dll\\3" fullword ascii
- $s6 = "CronosVir.exe" fullword wide
- $s7 = "mdEdgeTop" fullword ascii /* base64 encoded string 'tG`y:)' */
- $s8 = "vb5.exe" fullword wide
- $s9 = "pShellCode" fullword ascii
- $s10 = "FromCurrentProcess" fullword ascii
- $s11 = "sGetSystemCommandName" fullword ascii
- $s12 = "UNKNOWN SYSTEM COMMAND : " fullword wide
- $s13 = "HOOKPROCCBTSYSCOMMAND" fullword ascii
- $s14 = "HOOKPROCKEYBOARDLL" fullword ascii
- $s15 = "lblEvents" fullword ascii /* base64 encoded string 'nQ/z{l' */
- $s16 = "Attempt to read bad string pointer: " fullword wide
- $s17 = "WM_CHOOSEFONT_GETLOGFONT" fullword wide
- $s18 = "WM_DDE_EXECUTE" fullword wide
- $s19 = "MSCOMCTL.OCX" fullword ascii
- $s20 = "6C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\ieframe.oca" fullword ascii
-
- $op0 = { 1e 3b 45 00 25 3b 45 00 34 3b 45 00 41 3b 45 00 }
- $op1 = { 03 00 08 00 34 6a 46 00 39 6a 46 }
- $op2 = { 41 ab 46 00 05 00 08 00 34 ac 46 }
- condition:
- uint16(0) == 0x5a4d and filesize < 2000KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_544 {
- meta:
- description = "Windows_544"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "c2d499169a652c5c86ef28b7dca25f23e986bdd93b23fe02115923f698d61b58"
- strings:
- $x1 = "C:\\Users\\911\\Desktop\\CronosVir.pdb" fullword ascii
- $s2 = "G*\\AC:\\Users\\911\\Desktop\\Enhanced V270409272001\\Metre.vbp" fullword wide
- $s3 = "FC:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VBA6.dll" fullword ascii
- $s4 = "oleaut32.DLL" fullword ascii
- $s5 = "C:\\Windows\\SysWOW64\\msvbvm60.dll\\3" fullword ascii
- $s6 = "CronosVir.exe" fullword wide
- $s7 = "mdEdgeTop" fullword ascii /* base64 encoded string 'tG`y:)' */
- $s8 = "vb5.exe" fullword wide
- $s9 = "pShellCode" fullword ascii
- $s10 = "FromCurrentProcess" fullword ascii
- $s11 = "sGetSystemCommandName" fullword ascii
- $s12 = "UNKNOWN SYSTEM COMMAND : " fullword wide
- $s13 = "HOOKPROCCBTSYSCOMMAND" fullword ascii
- $s14 = "HOOKPROCKEYBOARDLL" fullword ascii
- $s15 = "lblEvents" fullword ascii /* base64 encoded string 'nQ/z{l' */
- $s16 = "Attempt to read bad string pointer: " fullword wide
- $s17 = "WM_CHOOSEFONT_GETLOGFONT" fullword wide
- $s18 = "WM_DDE_EXECUTE" fullword wide
- $s19 = "MSCOMCTL.OCX" fullword ascii
- $s20 = "6C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\ieframe.oca" fullword ascii
-
- $op0 = { 1e 3b 45 00 25 3b 45 00 34 3b 45 00 41 3b 45 00 }
- $op1 = { 03 00 08 00 34 6a 46 00 39 6a 46 }
- $op2 = { 41 ab 46 00 05 00 08 00 34 ac 46 }
- condition:
- uint16(0) == 0x5a4d and filesize < 2000KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_545 {
- meta:
- description = "Windows_545"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "f1d84b97fe9d73ede6bb035ecca36acc039f353bedddcd1ed0d90656ea214794"
- strings:
- $s1 = "GetCurrentProcessId" fullword wide
- $s2 = "GetTempPathA" fullword wide
- $s3 = "OpenMutexA" fullword wide
- $s4 = "CreateMutexA" fullword wide
- $s5 = "GetCommandLineA" fullword wide
- $s6 = "GetComputerNameA" fullword wide
- $s7 = "GetCurrentThreadId" fullword wide
- $s8 = "GetSystemDirectoryA" fullword wide
- $s9 = "GetVersionExA" fullword wide
- $s10 = "GetThreadDesktop" fullword wide
- $s11 = "k{Sy:\\Iq+gUhf*Z4g*" fullword ascii
- $s12 = "GetFileSize" fullword wide
- $s13 = "GetModuleFileNameA" fullword wide
- $s14 = "GetModuleHandleA" fullword wide
- $s15 = "GetWindowsDirectoryA" fullword wide
- $s16 = "GetWindowTextA" fullword wide
- $s17 = "GetForegroundWindow" fullword wide
- $s18 = "GetMessageA" fullword wide
- $s19 = "GetWindowLongA" fullword wide
- $s20 = "PostQuitMessage" fullword wide
-
- $op0 = { 90 90 90 60 90 90 b8 00 10 40 00 90 bb cc 8e 40 }
- $op1 = { 50 90 90 90 90 90 90 90 90 89 c8 90 90 90 90 90 }
- condition:
- uint16(0) == 0x5a4d and filesize < 1000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_546 {
- meta:
- description = "Windows_546"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "e3a2d9d8eef268fafbeaeaf36b05c94ce9a4cf725c77dcf49d8c42d0fe012014"
- strings:
- $s1 = "DERXSDSD.dll" fullword ascii
- $s2 = "AJXKLIEJDkernel32.DLL" fullword ascii
- $s3 = "Spaltemenu3.exe" fullword wide
- $s4 = "ADVISERNE" fullword ascii /* base64 encoded string ' 5HHDM' */
- $s5 = "!!!!!!!!!3333" fullword ascii /* hex encoded string '33' */
- $s6 = "\\Scores.dat" fullword wide
- $s7 = "SAMANTHA" fullword ascii
- $s8 = "2?!!!!!!!!!!!J!!!!!" fullword ascii
- $s9 = "-!!!!!" fullword ascii
- $s10 = "NNTDLL" fullword ascii
- $s11 = "uansvarlige" fullword ascii
- $s12 = "prkedes" fullword ascii
- $s13 = "dehydrer" fullword ascii
- $s14 = "akademikermangel" fullword ascii
- $s15 = "polygami" fullword ascii
- $s16 = "krnedes" fullword wide
- $s17 = "knallertkrer" fullword ascii
- $s18 = "salpingopalatine" fullword ascii
- $s19 = "Underaccommodated8" fullword ascii
- $s20 = "\\Tetris.bmp" fullword wide
-
- $op0 = { ff ff ff 00 8e ba 00 00 0c a4 00 00 4e a4 00 00 }
- $op1 = { 04 33 40 00 fe f9 f7 01 20 ff ff ff 08 }
- $op2 = { ec 00 4a 00 ff ff ff ff }
- condition:
- uint16(0) == 0x5a4d and filesize < 2000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_547 {
- meta:
- description = "Windows_547"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "064fe665dce5b2cf6d824290c2fdebea593f26b0c4b05efbdd3e300ab926900f"
- strings:
- $x1 = "*\\AC:\\Users\\PC\\Pictures\\Shadow\\PrivateClinic\\rc.vbp" fullword wide
- $s2 = "\\data\\KIHd.mdb;Mode=Share Deny None;Extended Properties=\"\";Jet OLEDB:System database=\"\";Jet OLEDB:Registry Path=\"\";Jet O" wide
- $s3 = "C:\\Windows\\SysWow64\\MSDBRPTR.DLL" fullword ascii
- $s4 = "\\LoggerTemp\\Logger.mdb" fullword wide
- $s5 = "\\loggertemp\\logger.mdb" fullword wide
- $s6 = "C:\\Windows\\SysWOW64\\msvbvm60.dll\\3" fullword ascii
- $s7 = "\\LoggerTemp" fullword wide
- $s8 = "logger.mdb" fullword wide
- $s9 = "Logger.mdb" fullword wide
- $s10 = "C:\\Program Files (x86)\\Common Files\\System\\ado\\msado25.tlb" fullword ascii
- $s11 = "\\Logger.mdb;" fullword wide
- $s12 = "\\c.exe -o " fullword wide
- $s13 = "MSDataReportRuntimeLib.DataReport" fullword ascii
- $s14 = "ch.exe" fullword wide
- $s15 = " services.Charges, Company.CompName" fullword wide
- $s16 = " and menutab.menutype='C' and menutab.command='" fullword wide
- $s17 = "imgLogin" fullword ascii
- $s18 = "Commandb" fullword ascii
- $s19 = "]eteleD[" fullword wide /* reversed goodware string '[Delete]' */
- $s20 = "MSDataListLib.DataCombo" fullword ascii
-
- $op0 = { 44 ff 02 00 34 ff 02 00 00 02 00 05 4b ff ff 00 }
- $op1 = { c8 21 40 00 ff ff ff ff }
- $op2 = { 16 00 14 01 00 00 01 00 94 00 04 34 14 00 0a 20 }
- condition:
- uint16(0) == 0x5a4d and filesize < 4000KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_548 {
- meta:
- description = "Windows_548"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "d0a39c49fcadaf01abbc6b1eb7c3d43b099099460eb599fa060f3e15183f3c34"
- strings:
- $s1 = "Tictactoe.exe" fullword wide
- $s2 = "gdi32.DLL" fullword ascii
- $s3 = "A*\\AC:\\ai_ttt\\Tictactoe.vbp" fullword wide
- $s4 = "\\MSINFO32.EXE" fullword wide
- $s5 = "Notepad.exe " fullword wide
- $s6 = "1999 - Paradigm International Limited." fullword ascii
- $s7 = "PiYears.txt" fullword wide
- $s8 = "temp\\filter.bmp" fullword wide
- $s9 = "Command6" fullword ascii
- $s10 = "Command9" fullword ascii
- $s11 = "Command7" fullword ascii
- $s12 = " 1999 - Paradigm Internatioal Ltd." fullword wide
- $s13 = "compurandom" fullword ascii
- $s14 = "Computer vs Computer" fullword ascii
- $s15 = "Human vs Computer" fullword ascii
- $s16 = "GetZoomFactor" fullword wide
- $s17 = "CmdDropDown" fullword wide
- $s18 = "GetSelectedColor" fullword wide
- $s19 = "DrawCircle" fullword wide
- $s20 = "ATTACKER1" fullword ascii
-
- $op0 = { ff ff f8 0d d0 50 ff ff ff ff }
- $op1 = { f7 ff ff ff 00 8f f7 ff ff ff }
- $op2 = { ff ff ff ff 7f ff ff ff ff ff }
- condition:
- uint16(0) == 0x5a4d and filesize < 1000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_549 {
- meta:
- description = "Windows_549"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "cb663a4fa79cb0fcb52c3049b65b1a012c45e72badc13c931fc2c72a8a94dcca"
- strings:
- $x1 = "<" ascii
- $s6 = "AU3_Spy.exe" fullword wide
- $s7 = "\\AutoHotkey.exe" fullword wide
- $s8 = "RunAs: Missing advapi32.dll." fullword wide
- $s9 = "{Blind}%s%s{%s DownTemp}" fullword wide
- $s10 = "command option was not enabled in the original script." fullword wide
- $s11 = "WCreateProcessWithLogonW." fullword wide
- $s12 = "AGEAcwB0AGUALgBlAGUALwByAC8AdwBXAHYAQQBJACcAKQAuAHIAZQBwAGwAYQBjAGUAKAAnACQAJAAnACwAJwAwAHgAJwApAHwASQBFAFgAOwBbAGsALgBIAGEAYwBr" ascii /* base64 encoded string ' a s t e . e e / r / w W v A I ' ) . r e p l a c e ( ' $ $ ' , ' 0 x ' ) | I E X ; [ k . H a c k' */
- $s13 = "AC4AZQBlAC8AcgAvAHgAbQA4AGMAZAAnACkALgBSAGUAcABsAGEAYwBlACgAIgBAAEAAIgAsACAAIgA0ADQAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAIQAiACwAIAAi" ascii /* base64 encoded string ' . e e / r / x m 8 c d ' ) . R e p l a c e ( " @ @ " , " 4 4 " ) . R e p l a c e ( " ! " , "' */
- $s14 = "ADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAJwAgACsAIABbAEMAaABhAHIAXQA1ADgAIAArACAAJwAvAC8AcABhAHMAdABl" ascii /* base64 encoded string ' : : M e t h o d , ' h t t ' + [ C h a r ] 8 0 + ' ' + [ C h a r ] 5 8 + ' / / p a s t e' */
- $s15 = "AGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABmAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0" ascii /* base64 encoded string ' i s u a l B a s i c ' ) ; $ f j = [ M i c r o s o f t . V i s u a l B a s i c . I n t e r a c t' */
- $s16 = "AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBw" ascii /* base64 encoded string ' p e ] : : M e t h o d , ' h t t ' + [ C h a r ] 8 0 + ' s ' + [ C h a r ] 5 8 + ' / / p' */
- $s17 = "AHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBW" ascii /* base64 encoded string ' t i o n . A s s e m b l y ] : : L o a d W i t h P a r t i a l N a m e ( ' M i c r o s o f t . V' */
- $s18 = "ADcAOAAiACkAfABJAEUAWAA7AFsAQgB5AHQAZQBbAF0AXQAkAGYAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQBy" ascii /* base64 encoded string ' 7 8 " ) | I E X ; [ B y t e [ ] ] $ f = [ M i c r o s o f t . V i s u a l B a s i c . I n t e r' */
- $s19 = "Script lines most recently executed (oldest first). Press [F5] to refresh. The seconds elapsed between a line and the one afte" wide
- $s20 = "UUUUUUS" fullword ascii /* reversed goodware string 'SUUUUUU' */
-
- $op0 = { e9 99 fb ff ff ff d3 80 7c 24 58 00 0f 85 e6 14 }
- $op1 = { 8b 14 b9 8d 44 24 34 50 8b 42 04 50 ff 15 ac e5 }
- $op2 = { 3b fa 7c b8 8b 5c 24 34 8b 74 24 3c 8b 44 24 38 }
- condition:
- uint16(0) == 0x5a4d and filesize < 2000KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_550 {
- meta:
- description = "Windows_550"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "eecf5fa7aabf91128e8b3d5a6b6541ccc4e379c18cfe1d35f2473740a192e8d1"
- strings:
- $s1 = "AU3_Spy.exe" fullword wide
- $s2 = "\\AutoHotkey.exe" fullword wide
- $s3 = "RunAs: Missing advapi32.dll." fullword wide
- $s4 = "{Blind}%s%s{%s DownTemp}" fullword wide
- $s5 = "command option was not enabled in the original script." fullword wide
- $s6 = "WCreateProcessWithLogonW." fullword wide
- $s7 = "Script lines most recently executed (oldest first). Press [F5] to refresh. The seconds elapsed between a line and the one afte" wide
- $s8 = "UUUUUUS" fullword ascii /* reversed goodware string 'SUUUUUU' */
- $s9 = "The oldest are listed first. VK=Virtual Key, SC=Scan Code, Elapsed=Seconds since the previous event. Types: h=Hook Hotkey, s=S" wide
- $s10 = "http://ahkscript.org" fullword wide
- $s11 = "Could not open URL http://ahkscript.org in default browser." fullword wide
- $s12 = "comspec" fullword wide
- $s13 = "Compile error %d at offset %d: %hs" fullword wide
- $s14 = "if not GetKeyState(\"%s\")" fullword wide
- $s15 = "Target label does not exist." fullword wide
- $s16 = "Interrupted threads: %d%s" fullword wide
- $s17 = "Failed attempt to launch program or document:" fullword wide
- $s18 = "&Lines most recently executed" fullword wide
- $s19 = "Warning: The keyboard and/or mouse hook could not be activated; some parts of the script will not function." fullword wide
- $s20 = "NOTE: Only the script's own keyboard events are shown" fullword wide
-
- $op0 = { e9 99 fb ff ff ff d3 80 7c 24 58 00 0f 85 e6 14 }
- $op1 = { 8b 14 b9 8d 44 24 34 50 8b 42 04 50 ff 15 ac e5 }
- $op2 = { 3b fa 7c b8 8b 5c 24 34 8b 74 24 3c 8b 44 24 38 }
- condition:
- uint16(0) == 0x5a4d and filesize < 2000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_551 {
- meta:
- description = "Windows_551"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "c6d5e1fdae2634a3a2a29a8c5de69f725ebceefba86d3700bc922aac7f55a1f7"
- strings:
- $x1 = "<" ascii
- $s6 = "AU3_Spy.exe" fullword wide
- $s7 = "\\AutoHotkey.exe" fullword wide
- $s8 = "RunAs: Missing advapi32.dll." fullword wide
- $s9 = "{Blind}%s%s{%s DownTemp}" fullword wide
- $s10 = "command option was not enabled in the original script." fullword wide
- $s11 = "WCreateProcessWithLogonW." fullword wide
- $s12 = "ADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAJwAgACsAIABbAEMAaABhAHIAXQA1ADgAIAArACAAJwAvAC8AcABhAHMAdABl" ascii /* base64 encoded string ' : : M e t h o d , ' h t t ' + [ C h a r ] 8 0 + ' ' + [ C h a r ] 5 8 + ' / / p a s t e' */
- $s13 = "AGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABmAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0" ascii /* base64 encoded string ' i s u a l B a s i c ' ) ; $ f j = [ M i c r o s o f t . V i s u a l B a s i c . I n t e r a c t' */
- $s14 = "AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBw" ascii /* base64 encoded string ' p e ] : : M e t h o d , ' h t t ' + [ C h a r ] 8 0 + ' s ' + [ C h a r ] 5 8 + ' / / p' */
- $s15 = "AHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBW" ascii /* base64 encoded string ' t i o n . A s s e m b l y ] : : L o a d W i t h P a r t i a l N a m e ( ' M i c r o s o f t . V' */
- $s16 = "ADcAOAAiACkAfABJAEUAWAA7AFsAQgB5AHQAZQBbAF0AXQAkAGYAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQBy" ascii /* base64 encoded string ' 7 8 " ) | I E X ; [ B y t e [ ] ] $ f = [ M i c r o s o f t . V i s u a l B a s i c . I n t e r' */
- $s17 = "Script lines most recently executed (oldest first). Press [F5] to refresh. The seconds elapsed between a line and the one afte" wide
- $s18 = "AC4AZQBlAC8AcgAvAFcAeQA2AFYAMgAnACkALgBSAGUAcABsAGEAYwBlACgAIgBAAEAAIgAsACAAIgA0ADQAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAIQAiACwAIAAi" ascii /* base64 encoded string ' . e e / r / W y 6 V 2 ' ) . R e p l a c e ( " @ @ " , " 4 4 " ) . R e p l a c e ( " ! " , "' */
- $s19 = "AGEAcwB0AGUALgBlAGUALwByAC8AbQBiAHMAdABnACcAKQAuAHIAZQBwAGwAYQBjAGUAKAAnACQAJAAnACwAJwAwAHgAJwApAHwASQBFAFgAOwBbAGsALgBIAGEAYwBr" ascii /* base64 encoded string ' a s t e . e e / r / m b s t g ' ) . r e p l a c e ( ' $ $ ' , ' 0 x ' ) | I E X ; [ k . H a c k' */
- $s20 = "UUUUUUS" fullword ascii /* reversed goodware string 'SUUUUUU' */
-
- $op0 = { e9 99 fb ff ff ff d3 80 7c 24 58 00 0f 85 e6 14 }
- $op1 = { 8b 14 b9 8d 44 24 34 50 8b 42 04 50 ff 15 ac e5 }
- $op2 = { 3b fa 7c b8 8b 5c 24 34 8b 74 24 3c 8b 44 24 38 }
- condition:
- uint16(0) == 0x5a4d and filesize < 2000KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_552 {
- meta:
- description = "Windows_552"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "65c86813da2eb5bfc495e538fa4e77f8c3a3c03418e655ac8262bc0aa42281ba"
- strings:
- $x1 = "<" ascii
- $s6 = "AU3_Spy.exe" fullword wide
- $s7 = "\\AutoHotkey.exe" fullword wide
- $s8 = "RunAs: Missing advapi32.dll." fullword wide
- $s9 = "{Blind}%s%s{%s DownTemp}" fullword wide
- $s10 = "command option was not enabled in the original script." fullword wide
- $s11 = "WCreateProcessWithLogonW." fullword wide
- $s12 = "ADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAJwAgACsAIABbAEMAaABhAHIAXQA1ADgAIAArACAAJwAvAC8AcABhAHMAdABl" ascii /* base64 encoded string ' : : M e t h o d , ' h t t ' + [ C h a r ] 8 0 + ' ' + [ C h a r ] 5 8 + ' / / p a s t e' */
- $s13 = "AGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABmAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0" ascii /* base64 encoded string ' i s u a l B a s i c ' ) ; $ f j = [ M i c r o s o f t . V i s u a l B a s i c . I n t e r a c t' */
- $s14 = "AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBw" ascii /* base64 encoded string ' p e ] : : M e t h o d , ' h t t ' + [ C h a r ] 8 0 + ' s ' + [ C h a r ] 5 8 + ' / / p' */
- $s15 = "AHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBW" ascii /* base64 encoded string ' t i o n . A s s e m b l y ] : : L o a d W i t h P a r t i a l N a m e ( ' M i c r o s o f t . V' */
- $s16 = "ADcAOAAiACkAfABJAEUAWAA7AFsAQgB5AHQAZQBbAF0AXQAkAGYAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQBy" ascii /* base64 encoded string ' 7 8 " ) | I E X ; [ B y t e [ ] ] $ f = [ M i c r o s o f t . V i s u a l B a s i c . I n t e r' */
- $s17 = "Script lines most recently executed (oldest first). Press [F5] to refresh. The seconds elapsed between a line and the one afte" wide
- $s18 = "AGEAcwB0AGUALgBlAGUALwByAC8AbgBkAGUAeAAyACcAKQAuAHIAZQBwAGwAYQBjAGUAKAAnACQAJAAnACwAJwAwAHgAJwApAHwASQBFAFgAOwBbAGsALgBIAGEAYwBr" ascii /* base64 encoded string ' a s t e . e e / r / n d e x 2 ' ) . r e p l a c e ( ' $ $ ' , ' 0 x ' ) | I E X ; [ k . H a c k' */
- $s19 = "AC4AZQBlAC8AcgAvAHQANQBIAHEAcAAnACkALgBSAGUAcABsAGEAYwBlACgAIgBAAEAAIgAsACAAIgA0ADQAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAIQAiACwAIAAi" ascii /* base64 encoded string ' . e e / r / t 5 H q p ' ) . R e p l a c e ( " @ @ " , " 4 4 " ) . R e p l a c e ( " ! " , "' */
- $s20 = "UUUUUUS" fullword ascii /* reversed goodware string 'SUUUUUU' */
-
- $op0 = { e9 99 fb ff ff ff d3 80 7c 24 58 00 0f 85 e6 14 }
- $op1 = { 8b 14 b9 8d 44 24 34 50 8b 42 04 50 ff 15 ac e5 }
- $op2 = { 3b fa 7c b8 8b 5c 24 34 8b 74 24 3c 8b 44 24 38 }
- condition:
- uint16(0) == 0x5a4d and filesize < 2000KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_553 {
- meta:
- description = "Windows_553"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "3afe4dd1466eb99bc7ab905a2363173dc043f9060982c49b6f5da73293f7d6ed"
- strings:
- $x1 = "<" ascii
- $s6 = "AU3_Spy.exe" fullword wide
- $s7 = "AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGo" ascii /* base64 encoded string 'f t . V i s u a l B a s i c . I n t e r a c t i o n ] : : C a l l B y n a m e ( ( N e w - O b j' */
- $s8 = "\\AutoHotkey.exe" fullword wide
- $s9 = "RunAs: Missing advapi32.dll." fullword wide
- $s10 = "{Blind}%s%s{%s DownTemp}" fullword wide
- $s11 = "command option was not enabled in the original script." fullword wide
- $s12 = "WCreateProcessWithLogonW." fullword wide
- $s13 = "Script lines most recently executed (oldest first). Press [F5] to refresh. The seconds elapsed between a line and the one afte" wide
- $s14 = "AdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACc" ascii /* base64 encoded string 't . V i s u a l B a s i c . C a l l T y p e ] : : M e t h o d , ' h t t ' + [ C h a r ] 8 0 + '' */
- $s15 = "ALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABmAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGE" ascii /* base64 encoded string '. V i s u a l B a s i c ' ) ; $ f j = [ M i c r o s o f t . V i s u a l B a s i c . I n t e r a' */
- $s16 = "AIgA0ADgAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAIwAiACwAIAAiADcAOAAiACkAfABJAEUAWAA7AFsAQgB5AHQAZQBbAF0AXQAkAGYAPQBbAE0AaQBjAHIAbwBzAG8" ascii /* base64 encoded string '" 4 8 " ) . R e p l a c e ( " # " , " 7 8 " ) | I E X ; [ B y t e [ ] ] $ f = [ M i c r o s o' */
- $s17 = "AcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBwAGEAcwB0AGUALgBlAGUALwByAC8AbgByADIAZQBxACcAKQAuAHIAZQBwAGwAYQBjAGUAKAAnACQ" ascii /* base64 encoded string 's ' + [ C h a r ] 5 8 + ' / / p a s t e . e e / r / n r 2 e q ' ) . r e p l a c e ( ' $' */
- $s18 = "AZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAJwAgACsAIABbAEMAaABhAHIAXQA1ADgAIAArACAAJwAvAC8AcABhAHM" ascii /* base64 encoded string 'e ] : : M e t h o d , ' h t t ' + [ C h a r ] 8 0 + ' ' + [ C h a r ] 5 8 + ' / / p a s' */
- $s19 = "AdABlAC4AZQBlAC8AcgAvAEIAdABTAHgAYgAnACkALgBSAGUAcABsAGEAYwBlACgAIgBeACIALAAgACIANAA0ACIAKQAuAFIAZQBwAGwAYQBjAGUAKAAiACoAIgAsACA" ascii /* base64 encoded string 't e . e e / r / B t S x b ' ) . R e p l a c e ( " ^ " , " 4 4 " ) . R e p l a c e ( " * " , ' */
- $s20 = "AZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQ" ascii /* base64 encoded string 'e c t i o n . A s s e m b l y ] : : L o a d W i t h P a r t i a l N a m e ( ' M i c r o s o f t' */
-
- $op0 = { e9 99 fb ff ff ff d3 80 7c 24 58 00 0f 85 e6 14 }
- $op1 = { 8b 14 b9 8d 44 24 34 50 8b 42 04 50 ff 15 ac e5 }
- $op2 = { 3b fa 7c b8 8b 5c 24 34 8b 74 24 3c 8b 44 24 38 }
- condition:
- uint16(0) == 0x5a4d and filesize < 2000KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_554 {
- meta:
- description = "Windows_554"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "f06e544f16fabf2d2755185ac267926cc300e142feb2e3b987fa403f6202c860"
- strings:
- $s1 = "Aapi-ms-win-appmodel-runtime-l1-1-1" fullword wide
- $s2 = "\"%s\",global" fullword wide
- $s3 = "7$7,74787@7H7P7X7`7h7p7x7" fullword ascii
- $s4 = "9$969H9" fullword ascii
- $s5 = "6 6$6@6D6X6\\6`6d6h6l6p6t6x6|6" fullword ascii
- $s6 = "474<4D4y4" fullword ascii
- $s7 = "8(8I889A9" fullword ascii
- $s8 = "272N2b2p2" fullword ascii
- $s9 = "485p5y5" fullword ascii
- $s10 = "5c6t6{7" fullword ascii
- $s11 = "j,hpXA" fullword ascii
- $s12 = "3,4L4T4\\4d4|4" fullword ascii
- $s13 = "$>(>0>P>T>d>h>p>" fullword ascii
- $s14 = "_Richd&" fullword ascii
- $s15 = ">(>M>T>`>g>s>{>" fullword ascii
- $s16 = "tl=XvA" fullword ascii
- $s17 = "@3`3p3" fullword ascii
- $s18 = "PQhXqA" fullword ascii
- $s19 = "021X1c1" fullword ascii
- $s20 = "PQh`rA" fullword ascii
-
- $op0 = { ff d6 8b f8 8d 45 c0 50 ff b5 3c ff ff ff ff d6 }
- $op1 = { c7 85 44 ff ff ff 57 00 69 00 c7 85 48 ff ff ff }
- $op2 = { ff d7 8b f8 89 bd 04 ff ff ff 85 ff 75 0a 68 0e }
- condition:
- uint16(0) == 0x5a4d and filesize < 300KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_555 {
- meta:
- description = "Windows_555"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "a027b70b7af9dbfc171294afe1b231280216f5e7eb154f35d9760c33b6ea5121"
- strings:
- $s1 = "CMD.EXE DOWN" fullword ascii
- $s2 = "processorArchitecture='X86'" fullword ascii
- $s3 = "processorArchitecture='*'" fullword ascii
- $s4 = "publicKeyToken='6595b64144ccf1df'" fullword ascii
- $s5 = "a42.DLL_De" fullword ascii
- $s6 = "version='1.0.0.0'" fullword ascii
- $s7 = "version='6.0.0.0'" fullword ascii
- $s8 = "name='Microsoft.Windows.Common-Controls'" fullword ascii
- $s9 = " postfiy" fullword ascii
- $s10 = "Green software" fullword ascii
- $s11 = "* oo(x" fullword ascii
- $s12 = "qVQXP0C" fullword ascii
- $s13 = "* V* " fullword ascii
- $s3 = ")oGetKeyExchangeNumBitsWWW" fullword ascii
- $s4 = "method GetKeyExchangeNumBitsWW" fullword ascii
- $s5 = "method GetKeyExchangeAlgorithm" fullword ascii
- $s6 = "+mGetKeyExchangeAlgorithmW" fullword ascii
- $s7 = "LCNCPCRCT" fullword ascii /* base64 encoded string ',#B<$B' */
- $s8 = "method GetEncryptionNumBitsWWW" fullword ascii
- $s9 = "method GetEncryptionAlgorithmW" fullword ascii
- $s10 = "0GetEncryptionAlgorithmWW" fullword ascii
- $s11 = "7GetEncryptionNumBits" fullword ascii
- $s12 = "GetKeyContainerNameW" fullword ascii
- $s13 = "method GetHashAlgorithmWWW" fullword ascii
- $s14 = "method GetHashNumBitsW:" fullword ascii
- $s15 = "GetHashNumBitsWW" fullword ascii
- $s16 = "YNumKeyExchangeAlgorithms" fullword ascii
- $s17 = "method GetKeyContainerNamesWWW" fullword ascii
- $s18 = "method GetKeyContainerName" fullword ascii
- $s19 = "method GetBinaryWW" fullword ascii
- $s20 = "GetBinaryWWW," fullword ascii
-
- $op0 = { 68 8d bb 09 dc 36 88 08 e8 00 c0 0c 00 68 34 e0 }
- $op1 = { e8 a1 6c 34 00 8d 64 24 08 e9 4f 4f 33 00 80 83 }
- $op2 = { 22 98 b7 2e a6 2d bf c7 11 1f a0 6a d2 96 34 89 }
- condition:
- uint16(0) == 0x5a4d and filesize < 20000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_557 {
- meta:
- description = "Windows_557"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "c062b4a790666b338f7955ea792605bf0244a8d36cb1050c602727ff6d654e36"
- strings:
- $s1 = "3930355574" ascii /* hex encoded string '905Ut' */
- $s2 = "3931462134" ascii /* hex encoded string '91F!4' */
- $s3 = "3927766963" ascii /* hex encoded string '9'vic' */
- $s4 = "3926753069" ascii /* hex encoded string '9&u0i' */
- $s5 = "3925574938" ascii /* hex encoded string '9%WI8' */
- $s6 = "3926574500" ascii /* hex encoded string '9&WE' */
- $s7 = "3925467158" ascii /* hex encoded string '9%FqX' */
- $s8 = "3927723632" ascii /* hex encoded string '9'r62' */
- $s9 = "3931357524" ascii /* hex encoded string '915u$' */
- $s10 = "3926716078" ascii /* hex encoded string '9&q`x' */
- $s11 = "3925603178" ascii /* hex encoded string '9%`1x' */
- $s12 = "3931215923" ascii /* hex encoded string '91!Y#' */
- $s13 = "3931283542" ascii /* hex encoded string '91(5B' */
- $s14 = "3925535536" ascii /* hex encoded string '9%SU6' */
- $s15 = "3931212753" ascii /* hex encoded string '91!'S' */
- $s16 = "3930346800" ascii /* hex encoded string '904h' */
- $s17 = "3925606348" ascii /* hex encoded string '9%`cH' */
- $s18 = "3930202029" ascii /* hex encoded string '90 )' */
- $s19 = "3931354354" ascii /* hex encoded string '915CT' */
- $s20 = "3926617072" ascii /* hex encoded string '9&apr' */
-
- $op0 = { f3 a5 e9 6b ff ff ff 5a 5d 5f 5e 5b c3 a3 00 b0 }
- $op1 = { 80 fb 55 0f 84 34 f4 ff ff eb b3 8d 75 a7 8b 55 }
- $op2 = { 80 fb 55 0f 84 92 f3 ff ff e9 7a ff ff ff 80 f9 }
- condition:
- uint16(0) == 0x5a4d and filesize < 3000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_558 {
- meta:
- description = "Windows_558"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "d00cdc47ecf61320c65927dd2cd3ec52e5d1496264ba527b019eebca8d9b3410"
- strings:
- $s1 = "3930355574" ascii /* hex encoded string '905Ut' */
- $s2 = "3931462134" ascii /* hex encoded string '91F!4' */
- $s3 = "3927766963" ascii /* hex encoded string '9'vic' */
- $s4 = "3926753069" ascii /* hex encoded string '9&u0i' */
- $s5 = "3925574938" ascii /* hex encoded string '9%WI8' */
- $s6 = "3926574500" ascii /* hex encoded string '9&WE' */
- $s7 = "3925467158" ascii /* hex encoded string '9%FqX' */
- $s8 = "3927723632" ascii /* hex encoded string '9'r62' */
- $s9 = "3931357524" ascii /* hex encoded string '915u$' */
- $s10 = "3926716078" ascii /* hex encoded string '9&q`x' */
- $s11 = "3925603178" ascii /* hex encoded string '9%`1x' */
- $s12 = "3931215923" ascii /* hex encoded string '91!Y#' */
- $s13 = "3931283542" ascii /* hex encoded string '91(5B' */
- $s14 = "3925535536" ascii /* hex encoded string '9%SU6' */
- $s15 = "3931212753" ascii /* hex encoded string '91!'S' */
- $s16 = "3930346800" ascii /* hex encoded string '904h' */
- $s17 = "3925606348" ascii /* hex encoded string '9%`cH' */
- $s18 = "3930202029" ascii /* hex encoded string '90 )' */
- $s19 = "3931354354" ascii /* hex encoded string '915CT' */
- $s20 = "3926617072" ascii /* hex encoded string '9&apr' */
-
- $op0 = { f3 a5 e9 6b ff ff ff 5a 5d 5f 5e 5b c3 a3 00 b0 }
- $op1 = { 80 fb 55 0f 84 34 f4 ff ff eb b3 8d 75 a7 8b 55 }
- $op2 = { 80 fb 55 0f 84 92 f3 ff ff e9 7a ff ff ff 80 f9 }
- condition:
- uint16(0) == 0x5a4d and filesize < 3000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_559 {
- meta:
- description = "Windows_559"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "883fbeeb3c809289ea68b62dd0c4156fbf8d51d31d543797ce7b73ace5956c93"
- strings:
- $s1 = "Error parsing function call.0Incorrect number of parameters in function call.'\"ReDim\" used without an array variable.>Illegal " wide
- $s2 = "AWINDESCRIPTION" fullword wide
- $s3 = "internal error: invalid forward reference offset" fullword ascii
- $s4 = "GETCOUNT" fullword wide
- $s5 = "=#=*=3=A=" fullword ascii /* hex encoded string ':' */
- $s6 = "Japi-ms-win-appmodel-runtime-l1-1-1" fullword wide
- $s7 = ":\":*:.:4:8:>:H:R:\\:g:o:s:y:}:" fullword ascii
- $s8 = ":(:9:G:\\:" fullword ascii
- $s9 = ":!:%:+:5:?:I:T:\\:`:f:j:p:z:" fullword ascii
- $s10 = "F@COM_EVENTOBJ" fullword wide
- $s11 = "Object Invoke failed" fullword wide
- $s12 = "PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDIN" ascii
- $s13 = "GVPPPPP" fullword ascii
- $s14 = "VVVVPPPP" fullword ascii
- $s15 = "PPPPWSPP" fullword ascii
- $s16 = "regular expression is too complicated" fullword ascii
- $s17 = "Iapi-ms-win-core-fibers-l1-1-1" fullword wide
- $s18 = "URPQQh08B" fullword ascii
- $s19 = "PPPhDiL" fullword ascii
- $s20 = "assertion expected after (?( or (?(?C)" fullword ascii
-
- $op0 = { 83 c4 0c 85 c0 75 27 4e 56 e8 9a ff ff ff 33 c9 }
- $op1 = { 59 85 d2 7c 17 7f 07 3d ff ff ff 7f 76 0e e8 4e }
- $op2 = { 33 c9 66 a3 32 15 4d 00 41 a2 34 15 4d 00 6a 0a }
- condition:
- uint16(0) == 0x5a4d and filesize < 3000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_560 {
- meta:
- description = "Windows_560"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "d7d94c81a09b9919714f7024a04a18e394198976107d3d9d35c56e69f2698ac8"
- strings:
- $s1 = "565d7d5e5b43564b48724170373931377e54436d59455c5053755e54585d523931377e54436a45564b45424978595f5e763931377e54436943585a70535d4352" ascii /* hex encoded string 'V]}^[CVKHrAp7917~TCmYE\PSu^TX]R917~TCjEVKEBIxY_^v917~TCiCXZpS]CR' */
- $s2 = "457b56525655547e5757587831373931705c457b56525655655e5454373931377e54437550444d74454b5e453931373976524d7742555d6758455f77505a5c70" ascii /* hex encoded string 'E{VRVUT~WWXx1791p\E{VRVUe^TT7917~TCuPDMtEK^E9179vRMwBU]gXE_wPZ\p' */
- $s3 = "56525c5c55735c52455c5c52574537393137705f435c435b56525c5c557e5752455c5c525745373931376f58454d44565560425c434e39313739665e5d547451" ascii /* hex encoded string 'VR\\Us\RE\\RWE7917p_C\C[VR\\U~WRE\\RWE7917oXEMDVU`B\CN9179f^]TtQ' */
- $s4 = "524b425e565f724170373931705c456351435258557b5652565554373931705c45644d435e5756634041527c49763931373976524d62435d795657555b5c3137" ascii /* hex encoded string 'RKB^V_rAp791p\EcQCRXU{VRVUT791p\EdMC^WVc@AR|Iv9179vRMbC]yVWU[\17' */
- $s5 = "7e54437a617e5757583931377e54437872673931373977584b5c564d7c524a42565e54763931373974594c5c74585d525755564b78595f5e763931377c5f435c" ascii /* hex encoded string '~TCza~WWX917~TCxrg9179wXK\VM|RJBV^Tv9179tYL\tX]RWUVKxY_^v917|_C\' */
- $s6 = "63565042527c49545c4143505e593931373976524d62435d795657555b5c31373931705c4571505d526a584d5c31373976524d775e5554634041523931377a43" ascii /* hex encoded string 'cVPBR|IT\ACP^Y9179vRMbC]yVWU[\1791p\EqP]RjXM\179vRMw^UTc@AR917zC' */
- $s7 = "4b5f524d7e475c5f76393137705f435c43595c4574555e445c795657555b5c31373979434d41664c54454078595f5e7639313739313739313739313739313739" ascii /* hex encoded string 'K_RM~G\_v917p_C\CY\EtU^D\yVWU[\179yCMAfLTE@xY_^v9179179179179179' */
- $s8 = "50454070373931377554564f54744b58435052565562525a455e565f37393137705f5e4d585655584d5c724550455e5a505b6a54544d58585731373976524d67" ascii /* hex encoded string 'PE@p7917uTVOTtKXCPRVUbRZE^V_7917p_^MXVUXM\rEPE^ZP[jTTMXXW179vRMg' */
- $s9 = "5c4244585652393137397c524a42565e5475564976393137755e565d62434b58595e70373931705c45644042435c5c7a5c45455052443931373976524d7c524a" ascii /* hex encoded string '\BDXVR9179|RJBV^TuVIv917u^V]bCKXY^p791p\Ed@BC\\z\EEPRD9179vRM|RJ' */
- $s10 = "4a42373931377e5443745e534c5d527150595d5d527831373931705c457a565542555471505d5277505a5c70373931377e5443755e54585d52705f5156703739" ascii /* hex encoded string 'JB7917~TCt^SL]RqPY]]Rx1791p\EzVUBUTqP]RwPZ\p7917~TCu^TX]Rp_QVp79' */
- $s11 = "454d44565560425c434e39313739675e4b4542585d674b5e435c524339313739675e4b4542585d76555d585a31373931645c4571505d52695e5e5745524b3137" ascii /* hex encoded string 'EMDVU`B\CN9179g^KEBX]gK^C\RC9179g^KEBX]vU]XZ1791d\EqP]Ri^^WERK17' */
- $s12 = "4e6954455f5e455450595a54745644594d54453931377e54436f54454a58585731373931705c45744c43455c5f436d59455c5053705537393137705f435c435b" ascii /* hex encoded string 'NiTE_^ETPYZTtVDYMTE917~TCoTEJXXW1791p\EtLCE\_CmYE\PSpU7917p_C\C[' */
- $s13 = "50456d5e7a4c5d4350734e4d543739317a4c5d4350734e4d546356665e5d54745150453931375542434b5d525770373931375542434b5247405f76393137755e" ascii /* hex encoded string 'PEm^zL]CPsNMT791zL]CPsNMTcVf^]TtQPE917UBCK]RWp7917UBCKRG@_v917u^' */
- $s14 = "5755373931376a50515c70454b504e7e54437573584c5f533931373962565f54764b43564072455c50435c31373967564b58565745745150595e546340415239" ascii /* hex encoded string 'WU7917jPQ\pEKPN~TCusXL_S9179bV_TvKCV@rE\PC\179gVKXVWEtQPY^Tc@AR9' */
- $s15 = "7c5f435c43744b58435052565562525a455e565f37393137705f5e4d585655584d5c724550455e5a505b6a54544d585857313739675e4b4542585d714b545239" ascii /* hex encoded string '|_C\CtKXCPRVUbRZE^V_7917p_^MXVUXM\rEPE^ZP[jTTMXXW179g^KEBX]qKTR9' */
- $s16 = "39313739313739313739313739313739313739313739313739313739313739313739313739313739313739313739313739313739313739313739313739313739" ascii /* hex encoded string '9179179179179179179179179179179179179179179179179179179179179179' */
- $s17 = "37393137393137393137393137393137393137393137393137393137393137393137393137393137393137393137393137393137393137393137393137393137" ascii /* hex encoded string '7917917917917917917917917917917917917917917917917917917917917917' */
- $s18 = "31373931373931373931373931373931373931373931373931373931373931373931373931373931373931373931373931373931373931373931373931373931" ascii /* hex encoded string '1791791791791791791791791791791791791791791791791791791791791791' */
- $s19 = "1f7831ba7ccddf8c2ac8c6f2de3224c8c6dac762686afaa162b2dd64b26c3fbaf2cbd236bc3ad996393137b232dfcbcdc8c6b5f74ddfbc3ad9acc4cec8626cf4" ascii
- $s20 = "d8c8c6d9bbd3cec8d146c1c6cedf23c3c8c602f763686e5db8275196ff7931f4d00642c6cedcc16cf4393137c6cec8c633373931074131376cbadb0af16251ec" ascii
-
- $op0 = { ba 34 b0 00 00 e8 12 ab ff ff 83 7e 04 00 75 5c }
- $op1 = { f3 a5 e9 6b ff ff ff 5a 5d 5f 5e 5b c3 a3 00 f0 }
- $op2 = { e8 cc dd ff ff 8b c3 e8 b9 ff ff ff 89 04 24 83 }
- condition:
- uint16(0) == 0x5a4d and filesize < 2000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_561 {
- meta:
- description = "Windows_561"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "09a67c040e7c62e6dd1c7ef264524d15f8ac6f91cf238e429ef638dfc3225556"
- strings:
- $s1 = "Window Text %s is already associated with %s" fullword wide
- $s2 = "TOpenDialogT" fullword ascii
- $s3 = "TSaveDialogL" fullword ascii
- $s4 = "IdDecoderXXE1" fullword ascii
- $s5 = ": :0:P:X:\\:`:d:h:l:p:t:x:" fullword ascii
- $s6 = "TPictureAdaptert" fullword ascii
- $s7 = ":4:<:@:D:H:L:P:T:X:\\:h:|:" fullword ascii
- $s8 = "EVariantUnexpectedErrorH" fullword ascii
- $s9 = "EThreadlZA" fullword ascii
- $s10 = "HelpKeyword8IA" fullword ascii
- $s11 = "EInOutError\\r@" fullword ascii
- $s12 = "AutoHotkeysdaD" fullword ascii
- $s13 = ": :@:H:L:P:T:X:\\:`:d:h:l:?;" fullword ascii
- $s14 = "OnNavigateComplete2P3F" fullword ascii
- $s15 = "TIdDecoderUUEBase4" fullword ascii
- $s16 = "TThreadList0PA" fullword ascii
- $s17 = "OnDragDrop 6C" fullword ascii
- $s18 = "OnChanging4" fullword ascii
- $s19 = "InitialDir4" fullword ascii
- $s20 = "#+ jH\"" fullword ascii
-
- $op0 = { f3 a5 5e e9 76 ff ff ff 5d 5f 5e 5b c3 a3 00 50 }
- $op1 = { e9 0a ff ff ff c3 90 83 3d 14 50 46 00 00 74 07 }
- $op2 = { 8b 04 82 c3 e8 9d ff ff ff a1 9c 50 46 00 50 e8 }
- condition:
- uint16(0) == 0x5a4d and filesize < 2000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_562 {
- meta:
- description = "Windows_562"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "af6fdd1254eefedc065dc12942f966620dbd4bd74ce24f66bc520192ae59ed7f"
- strings:
- $x1 = " /create /TN \"\\Microsoft\\Windows\\UPnP\\MaintenanceAgenTask\" /RU SYSTEM /TR \"regsvr32 /s /u tpmagentservice.dll\" /SC ONSTA" ascii
- $x2 = "tpmagentservice.dll" fullword ascii
- $x3 = " /create /TN \"\\Microsoft\\Windows\\UPnP\\MaintenanceAgenTask\" /RU SYSTEM /TR \"rundll32 tpmagentservice.dll,ServiceCrtMain\" " ascii
- $x4 = "%s\\System32\\ServicesHost.exe" fullword ascii
- $x5 = " /create /TN \"\\Microsoft\\Windows\\UPnP\\MaintenanceAgenTask\" /RU SYSTEM /TR \"rundll32 tpmagentservice.dll,ServiceCrtMain\" " ascii
- $s6 = "%s\\tpmagentservice.dll" fullword ascii
- $s7 = "%s\\System32\\SecUpdateHost.exe" fullword ascii
- $s8 = "%s\\System32\\SysprepThemes\\spoolsv.exe" fullword ascii
- $s9 = "%s\\SysprepThemes\\Microsoft\\svchost.exe" fullword ascii
- $s10 = "\\svchost.exe" fullword ascii
- $s11 = "x86.dll" fullword ascii
- $s12 = "%s\\IME\\Microsoft\\Svchost.exe" fullword ascii
- $s13 = "%s\\IME\\Crypt\\Svchost.exe" fullword ascii
- $s14 = "%s\\IME\\Daps\\Svchost.exe" fullword ascii
- $s15 = "\\schtasks.exe" fullword ascii
- $s16 = "%s\\SysprepThemes\\Microsoft\\spoolsv.exe" fullword ascii
- $s17 = " /run /TN \"\\Microsoft\\Windows\\UPnP\\MaintenanceAgenTask\"" fullword ascii
- $s18 = "tpmagentservice" fullword ascii
- $s19 = "%s\\IME\\Crypt\\Spoolsv.exe" fullword ascii
- $s20 = "%s\\IME\\Microsoft\\Spoolsv.exe" fullword ascii
-
- $op0 = { ff 75 18 51 ff 75 10 e8 65 ff ff ff 8b c8 8b 45 }
- $op1 = { 0f 11 44 24 34 50 0f 28 05 10 25 02 10 8d 44 24 }
- $op2 = { c7 47 18 8c 1b 02 10 c7 45 14 fd ff ff ff 8b 4f }
- condition:
- uint16(0) == 0x5a4d and filesize < 400KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_563 {
- meta:
- description = "Windows_563"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "906f37fbcdb68d6418add9b0bbcb02c34b8696dea8dded9247238e1eff8b3fad"
- strings:
- $s1 = "AutoLoginTimerTimer" fullword ascii
- $s2 = "AutLoginTCPClientConnected" fullword ascii
- $s3 = "AutoLoginTimer" fullword ascii
- $s4 = "AutLoginTCPClient" fullword ascii
- $s5 = "vHideProcess" fullword ascii
- $s6 = "Thread Error: %s (%d)*Windows socket error: %s (%d), on API '%s'" fullword wide
- $s7 = "8CEF56758A7f37736F1837624725A6DAB930FAF506610664260080B1DEBA253835E75B88D89A60CF6CDE762A676B8027F1003F06EC7C2130255B05A19C0D6A49" ascii
- $s8 = "3F06EC7C2130255B05A19C0D6A4918E18EF39F9B0F16E745F8D52984FFE2905FE3C5511ED73A759864DB95CF5D030FE692E8DA4EE8D982255D472389F47E3303" ascii
- $s9 = "8CEF56758A7f37736F1837624725A6DAB930FAF506610664260080B1DEBA253835E75B88D89A60CF6CDE762A676B8027F1003F06EC7C2130255B05A19C0D6A49" ascii
- $s10 = "DownLoadFileUnit" fullword ascii
- $s11 = "Invalid stream operation" fullword wide
- $s12 = "guocyok" fullword ascii
- $s13 = "\\RUNExeMemUnit" fullword ascii
- $s14 = "18E18EF39F9B0F16E745F8D52984FFE2905FE3C5511ED73A759864DB95CF5D030FE692E8DA4EE8D982255D472389F47E33034BC66617AAD73015A744B1AEE81C" ascii
- $s15 = "SharedTypes" fullword ascii
- $s16 = ".ScktComp" fullword ascii
- $s17 = "T:\"C%L_\"U" fullword ascii
- $s18 = "?winntService" fullword ascii
- $s19 = "!Socks5Proxy" fullword ascii
- $s20 = "RunaTypes" fullword ascii
-
- $op0 = { 68 8f 07 52 00 e8 77 f4 11 00 55 c3 d3 f5 c8 9a }
- condition:
- uint16(0) == 0x5a4d and filesize < 2000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_564 {
- meta:
- description = "Windows_564"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "26448f5f651589c5fd39721e68693c8eba2ada59eee363b365b984e90f0a47b0"
- strings:
- $s1 = "ResetUsageDataActnExecute" fullword ascii
- $s2 = "cock.exe" fullword ascii
- $s3 = "extrac32.exe" fullword ascii
- $s4 = "Invalid ownerE%d is an invalid PageIndex value. PageIndex must be between 0 and %d=This control requires version 4.70 or greate" wide
- $s5 = "LargeIconsActnExecute" fullword ascii
- $s6 = "ShowShortCutsInTipsActnExecute" fullword ascii
- $s7 = "ResetActnExecute" fullword ascii
- $s8 = "ShowHintsActnExecute" fullword ascii
- $s9 = "RecentlyUsedActnExecute" fullword ascii
- $s10 = "ResetActnExecute " fullword ascii
- $s11 = "Systeml5B" fullword ascii /* base64 encoded string 'K+-ziy' */
- $s12 = "Borland C++ - Copyright 2002 Borland Corporation" fullword ascii
- $s13 = "*A key with the name of \"%s\" already exists" fullword wide
- $s14 = "MenuCommand\\.Current" fullword ascii
- $s15 = "EComponentErrorTv@" fullword ascii
- $s16 = ")Failed to read ImageList data from stream(Failed to write ImageList data to stream$Error creating window device context" fullword wide
- $s17 = "Stream write error!'%s' is not a valid integer value\"'%s' is not a valid currency value!'%g' is not a valid date and time" fullword wide
- $s18 = "OnGetItemCountL`D" fullword ascii
- $s19 = ";\";,;7;A;" fullword ascii /* hex encoded string 'z' */
- $s20 = "ResetUsageBtn" fullword ascii
-
- $op0 = { 80 ff ff ff ff 09 00 0a 49 6d 61 67 65 49 6e 64 }
- $op1 = { c7 86 6c 02 00 00 ff ff ff ff 8b d7 8b c6 e8 5a }
- $op2 = { 74 1a 8d 85 73 ff ff ff 50 33 c9 ba 1c 04 00 00 }
- condition:
- uint16(0) == 0x5a4d and filesize < 3000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_565 {
- meta:
- description = "Windows_565"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66"
- strings:
- $s1 = "ySystem.Windows.Controls.ToolTip, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" fullword ascii
- $s2 = "mSystem.Windows.UIElement, PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" fullword ascii
- $s3 = "TypemSystem.Windows.UIElement, PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" fullword ascii
- $s4 = "TypewSystem.Windows.Controls.Panel, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" fullword ascii
- $s5 = "{System.Windows.Media.GeometryConverter, PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" fullword ascii
- $s6 = "ControlzEx.dll" fullword wide
- $s7 = "C:\\projects\\controlzex\\src\\ControlzEx\\obj\\Release\\NET45\\ControlzEx.pdb" fullword ascii
- $s8 = "TrySearch.exe" fullword wide
- $s9 = "AControlzEx, Version=3.0.2.4, Culture=neutral, PublicKeyToken=null" fullword ascii
- $s10 = "(https://github.com/ControlzEx/ControlzEx" fullword ascii
- $s11 = "https://github.com/ControlzEx/ControlzEx" fullword wide
- $s12 = "SystemParameters2" fullword ascii
- $s13 = "ALLOWDROPDESCRIPTIONTEXT" fullword ascii
- $s14 = "DROPDESCRIPTION" fullword ascii
- $s15 = "ToolTipTargetPreviewMouseMove" fullword ascii
- $s16 = "get_ChildContentVisibility" fullword ascii
- $s17 = "ErrorTemplateProperty" fullword ascii
- $s18 = "DROPIMAGETYPE" fullword ascii
- $s19 = "b__6_0" fullword ascii
- $s20 = " 2015 - 2017 Jan Karger, Bastian Schmidt, James Willock" fullword wide
-
- $op0 = { c7 45 f8 dc 34 09 00 c7 45 fc }
- $op1 = { 8b c3 83 c8 0f 3d ff ff ff 7f 76 07 b8 ff ff ff }
- $op2 = { 8d bd 10 ff ff ff 8b 45 f8 b9 38 }
- condition:
- uint16(0) == 0x5a4d and filesize < 1000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_566 {
- meta:
- description = "Windows_566"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "b1b0fa6f46557e5804b683bc76db76dd71246753726ce7645ab3804ec1d68a44"
- strings:
- $s1 = "dialog failed" fullword ascii
- $s2 = "%s%s%s%s tmHeight=%d tmAscent=%d tmDescent=%d tmAveCharWidth=%d tmMaxCharWidth=%d tmWeight=%d tmPitchAndFamily=%u tmCharSet=%u" fullword ascii
- $s3 = "cell=(%u,%u) cursor=(%d,%d) attr=%02x pop-up=%02x font=%s/%u/%u hist=%u/%d flags=%c%c msk=%08x sb=(%u,%u) win=(%u,%u)x(%u,%u) ed" ascii
- $s4 = "cell=(%u,%u) cursor=(%d,%d) attr=%02x pop-up=%02x font=%s/%u/%u hist=%u/%d flags=%c%c msk=%08x sb=(%u,%u) win=(%u,%u)x(%u,%u) ed" ascii
- $s5 = "GetDpiForSystem" fullword ascii
- $s6 = "Unhandled yet command: %lx" fullword ascii
- $s7 = "NtReadFile failed: %#x" fullword ascii
- $s8 = "update %d-%d %s" fullword ascii
- $s9 = "--headless" fullword wide
- $s10 = "key code=%02x scan=%02x char=%02x state=%08x" fullword ascii
- $s11 = "too many params, skipping %u" fullword ascii
- $s12 = "Several matches found: ref=%d idx=%d" fullword ascii
- $s13 = "%s%s%s%s lfHeight=%d lfWidth=%d lfEscapement=%d lfOrientation=%d lfWeight=%d lfItalic=%u lfUnderline=%u lfStrikeOut=%u lfCharSe" ascii
- $s14 = "input setup failed: %#x" fullword ascii
- $s15 = "%s%s%s%s lfHeight=%d lfWidth=%d lfEscapement=%d lfOrientation=%d lfWeight=%d lfItalic=%u lfUnderline=%u lfStrikeOut=%u lfCharSe" ascii
- $s16 = "write failed: %u" fullword ascii
- $s17 = "loading %s registry settings." fullword ascii
- $s18 = "!console->read_ioctl" fullword wide
- $s19 = "e:\"cm<;" fullword ascii
- $s20 = "equal to current" fullword ascii
-
- $op0 = { 89 4d fc 6a 04 8d 55 fc 52 6a 04 6a 00 68 34 86 }
- $op1 = { 6a 06 ff 15 48 00 42 00 50 8b 85 68 ff ff ff 50 }
- $op2 = { 8b 45 f4 8b 4d fc 8b 34 85 00 05 42 00 0f af 71 }
- condition:
- uint16(0) == 0x5a4d and filesize < 2000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_567 {
- meta:
- description = "Windows_567"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "e062aea7aa7f1e6d4f5ad5a5029cf7cc2ef0724852ad03d76f2d07b8f5558615"
- strings:
- $s1 = "dialog failed" fullword ascii
- $s2 = "%s%s%s%s tmHeight=%d tmAscent=%d tmDescent=%d tmAveCharWidth=%d tmMaxCharWidth=%d tmWeight=%d tmPitchAndFamily=%u tmCharSet=%u" fullword ascii
- $s3 = "cell=(%u,%u) cursor=(%d,%d) attr=%02x pop-up=%02x font=%s/%u/%u hist=%u/%d flags=%c%c msk=%08x sb=(%u,%u) win=(%u,%u)x(%u,%u) ed" ascii
- $s4 = "cell=(%u,%u) cursor=(%d,%d) attr=%02x pop-up=%02x font=%s/%u/%u hist=%u/%d flags=%c%c msk=%08x sb=(%u,%u) win=(%u,%u)x(%u,%u) ed" ascii
- $s5 = "GetDpiForSystem" fullword ascii
- $s6 = "Unhandled yet command: %lx" fullword ascii
- $s7 = "NtReadFile failed: %#x" fullword ascii
- $s8 = "update %d-%d %s" fullword ascii
- $s9 = "--headless" fullword wide
- $s10 = "key code=%02x scan=%02x char=%02x state=%08x" fullword ascii
- $s11 = "too many params, skipping %u" fullword ascii
- $s12 = "Several matches found: ref=%d idx=%d" fullword ascii
- $s13 = "%s%s%s%s lfHeight=%d lfWidth=%d lfEscapement=%d lfOrientation=%d lfWeight=%d lfItalic=%u lfUnderline=%u lfStrikeOut=%u lfCharSe" ascii
- $s14 = "input setup failed: %#x" fullword ascii
- $s15 = "%s%s%s%s lfHeight=%d lfWidth=%d lfEscapement=%d lfOrientation=%d lfWeight=%d lfItalic=%u lfUnderline=%u lfStrikeOut=%u lfCharSe" ascii
- $s16 = "write failed: %u" fullword ascii
- $s17 = "loading %s registry settings." fullword ascii
- $s18 = "!console->read_ioctl" fullword wide
- $s19 = "equal to current" fullword ascii
- $s20 = "no server handle" fullword ascii
-
- $op0 = { 89 4d fc 6a 04 8d 55 fc 52 6a 04 6a 00 68 34 86 }
- $op1 = { 6a 06 ff 15 48 00 42 00 50 8b 85 68 ff ff ff 50 }
- $op2 = { 8b 45 f4 8b 4d fc 8b 34 85 00 05 42 00 0f af 71 }
- condition:
- uint16(0) == 0x5a4d and filesize < 2000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_568 {
- meta:
- description = "Windows_568"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "fbb68d8435857838998c6bc25af2854e56916be9e4935106264d06733286aec6"
- strings:
- $s1 = "dialog failed" fullword ascii
- $s2 = "%s%s%s%s tmHeight=%d tmAscent=%d tmDescent=%d tmAveCharWidth=%d tmMaxCharWidth=%d tmWeight=%d tmPitchAndFamily=%u tmCharSet=%u" fullword ascii
- $s3 = "cell=(%u,%u) cursor=(%d,%d) attr=%02x pop-up=%02x font=%s/%u/%u hist=%u/%d flags=%c%c msk=%08x sb=(%u,%u) win=(%u,%u)x(%u,%u) ed" ascii
- $s4 = "cell=(%u,%u) cursor=(%d,%d) attr=%02x pop-up=%02x font=%s/%u/%u hist=%u/%d flags=%c%c msk=%08x sb=(%u,%u) win=(%u,%u)x(%u,%u) ed" ascii
- $s5 = "GetDpiForSystem" fullword ascii
- $s6 = "Unhandled yet command: %lx" fullword ascii
- $s7 = "NtReadFile failed: %#x" fullword ascii
- $s8 = "update %d-%d %s" fullword ascii
- $s9 = "--headless" fullword wide
- $s10 = "key code=%02x scan=%02x char=%02x state=%08x" fullword ascii
- $s11 = "too many params, skipping %u" fullword ascii
- $s12 = "Several matches found: ref=%d idx=%d" fullword ascii
- $s13 = "%s%s%s%s lfHeight=%d lfWidth=%d lfEscapement=%d lfOrientation=%d lfWeight=%d lfItalic=%u lfUnderline=%u lfStrikeOut=%u lfCharSe" ascii
- $s14 = "input setup failed: %#x" fullword ascii
- $s15 = "%s%s%s%s lfHeight=%d lfWidth=%d lfEscapement=%d lfOrientation=%d lfWeight=%d lfItalic=%u lfUnderline=%u lfStrikeOut=%u lfCharSe" ascii
- $s16 = "write failed: %u" fullword ascii
- $s17 = "loading %s registry settings." fullword ascii
- $s18 = "!console->read_ioctl" fullword wide
- $s19 = "equal to current" fullword ascii
- $s20 = "no server handle" fullword ascii
-
- $op0 = { 89 4d fc 6a 04 8d 55 fc 52 6a 04 6a 00 68 34 86 }
- $op1 = { 6a 06 ff 15 48 00 42 00 50 8b 85 68 ff ff ff 50 }
- $op2 = { 8b 45 f4 8b 4d fc 8b 34 85 00 05 42 00 0f af 71 }
- condition:
- uint16(0) == 0x5a4d and filesize < 1000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_569 {
- meta:
- description = "Windows_569"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "2eb4a5759fb76c10520c4456e3b179da2cf8a27f675ddede55bbcdd8b443ec50"
- strings:
- $s1 = "impacket.examples.logger(" fullword ascii
- $s2 = "spyi_rth_multiprocessing" fullword ascii
- $s3 = "Failed to execute script %s" fullword ascii
- $s4 = "b_multiprocessing.pyd" fullword ascii
- $s5 = "Failed to get address for PyRun_SimpleString" fullword ascii
- $s6 = "multiprocessing.pool(" fullword ascii
- $s7 = "multiprocessing.util(" fullword ascii
- $s8 = "multiprocessing.synchronize(" fullword ascii
- $s9 = "multiprocessing.connection(" fullword ascii
- $s10 = "multiprocessing.sharedctypes(" fullword ascii
- $s11 = "multiprocessing.process(" fullword ascii
- $s12 = "multiprocessing.forking(" fullword ascii
- $s13 = "multiprocessing.queues(" fullword ascii
- $s14 = "multiprocessing.managers(" fullword ascii
- $s15 = "multiprocessing.dummy.connection(" fullword ascii
- $s16 = "multiprocessing.dummy(" fullword ascii
- $s17 = "multiprocessing.reduction(" fullword ascii
- $s18 = "multiprocessing.heap(" fullword ascii
- $s19 = "impacket.system_errors(" fullword ascii
- $s20 = "TNTNRNUNS" fullword ascii /* base64 encoded string '53Q5CR' */
-
- $op0 = { 33 c0 8d 54 24 34 66 89 04 6b 8b f2 66 8b 02 83 }
- $op1 = { 8b c3 5b 5f 5e c3 b8 fa ff ff ff c3 cc cc cc cc }
- $op2 = { b8 fe ff ff ff c3 cc cc cc cc cc cc cc cc cc cc }
- condition:
- uint16(0) == 0x5a4d and filesize < 20000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Windows_570 {
- meta:
- description = "Windows_570"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "2db4ee21ea51c36e7dac362a31f5791643de1ced086758c80ad2cb8b8b70f80e"
- strings:
- $x1 = "C:\\WINDOWS\\system32\\userinit.exe" fullword ascii
- $s2 = "C:\\WINDOWS\\system32\\userinit.exe, " fullword wide
- $s3 = "eventvwr.exe" fullword ascii
- $s4 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\" fullword wide
- $s5 = "!\\svchost.exe" fullword wide
- $s6 = "mscfile\\shell\\open\\command" fullword ascii
- $s7 = "Remcos_Mutex_Inj" fullword ascii
- $s8 = "Mutex_RemWatchdog" fullword ascii
- $s9 = "Software\\Classes\\mscfile\\shell\\open\\command" fullword ascii
- $s10 = "WScript.Sleep 1000" fullword wide
- $s11 = "\\install.vbs" fullword wide
- $s12 = "\\uninstall.vbs" fullword wide
- $s13 = "\\restart.vbs" fullword wide
- $s14 = " * BreakingSecurity.Net" fullword ascii
- $s15 = "licence_code.txt" fullword ascii
- $s16 = "cSoftware\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\" fullword wide
- $s17 = "363=3`3{3" fullword ascii /* hex encoded string '633' */
- $s18 = " [Ctrl + V]" fullword ascii
- $s19 = " [Ctrl + " fullword ascii
- $s20 = "origmsc" fullword ascii
-
- $op0 = { 5d c3 55 8b ec 83 ec 34 53 56 8b f1 8d 45 ff 57 }
- $op1 = { 5d c2 04 00 55 8b ec 83 ec 34 53 56 8b f1 33 db }
- $op2 = { 05 46 ff ff ff 83 f8 24 0f 87 60 05 00 00 0f b6 }
- condition:
- uint16(0) == 0x5a4d and filesize < 400KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_571 {
- meta:
- description = "Windows_571"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "5d9ade026742dcc73e12a5d0091356ae9f6ac419ca6d0f27ddd102ebe024320b"
- strings:
- $x1 = "C:\\WINDOWS\\system32\\userinit.exe" fullword ascii
- $s2 = "C:\\WINDOWS\\system32\\userinit.exe, " fullword wide
- $s3 = "eventvwr.exe" fullword ascii
- $s4 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\" fullword wide
- $s5 = "!\\svchost.exe" fullword wide
- $s6 = "mscfile\\shell\\open\\command" fullword ascii
- $s7 = "Remcos_Mutex_Inj" fullword ascii
- $s8 = "Mutex_RemWatchdog" fullword ascii
- $s9 = "Software\\Classes\\mscfile\\shell\\open\\command" fullword ascii
- $s10 = "WScript.Sleep 1000" fullword wide
- $s11 = "\\install.vbs" fullword wide
- $s12 = "\\uninstall.vbs" fullword wide
- $s13 = "\\restart.vbs" fullword wide
- $s14 = " * BreakingSecurity.Net" fullword ascii
- $s15 = "licence_code.txt" fullword ascii
- $s16 = "cSoftware\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\" fullword wide
- $s17 = "363=3`3{3" fullword ascii /* hex encoded string '633' */
- $s18 = " [Ctrl + V]" fullword ascii
- $s19 = " [Ctrl + " fullword ascii
- $s20 = "origmsc" fullword ascii
-
- $op0 = { 5d c3 55 8b ec 83 ec 34 53 56 8b f1 8d 45 ff 57 }
- $op1 = { 5d c2 04 00 55 8b ec 83 ec 34 53 56 8b f1 33 db }
- $op2 = { 05 46 ff ff ff 83 f8 24 0f 87 60 05 00 00 0f b6 }
- condition:
- uint16(0) == 0x5a4d and filesize < 400KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_572 {
- meta:
- description = "Windows_572"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "28b6bbc6b1d6ee21ccdc25c5eefccad5e21556954542cd19a0a87f7dde91df78"
- strings:
- $x1 = "C:\\WINDOWS\\system32\\userinit.exe" fullword ascii
- $s2 = "C:\\WINDOWS\\system32\\userinit.exe, " fullword wide
- $s3 = "eventvwr.exe" fullword ascii
- $s4 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\" fullword wide
- $s5 = "!\\svchost.exe" fullword wide
- $s6 = "mscfile\\shell\\open\\command" fullword ascii
- $s7 = "Remcos_Mutex_Inj" fullword ascii
- $s8 = "Mutex_RemWatchdog" fullword ascii
- $s9 = "Software\\Classes\\mscfile\\shell\\open\\command" fullword ascii
- $s10 = "WScript.Sleep 1000" fullword wide
- $s11 = "\\install.vbs" fullword wide
- $s12 = "\\uninstall.vbs" fullword wide
- $s13 = "\\restart.vbs" fullword wide
- $s14 = " * BreakingSecurity.Net" fullword ascii
- $s15 = "licence_code.txt" fullword ascii
- $s16 = "cSoftware\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\" fullword wide
- $s17 = "363=3`3{3" fullword ascii /* hex encoded string '633' */
- $s18 = " [Ctrl + V]" fullword ascii
- $s19 = " [Ctrl + " fullword ascii
- $s20 = "origmsc" fullword ascii
-
- $op0 = { 5d c3 55 8b ec 83 ec 34 53 56 8b f1 8d 45 ff 57 }
- $op1 = { 5d c2 04 00 55 8b ec 83 ec 34 53 56 8b f1 33 db }
- $op2 = { 05 46 ff ff ff 83 f8 24 0f 87 60 05 00 00 0f b6 }
- condition:
- uint16(0) == 0x5a4d and filesize < 400KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_573 {
- meta:
- description = "Windows_573"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "5be1955cc565b499f3948429e16db2d902ceb8953132d39ae54954ed5cf73de0"
- strings:
- $x1 = "C:\\WINDOWS\\system32\\userinit.exe" fullword ascii
- $s2 = "C:\\WINDOWS\\system32\\userinit.exe, " fullword wide
- $s3 = "eventvwr.exe" fullword ascii
- $s4 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\" fullword wide
- $s5 = "!\\svchost.exe" fullword wide
- $s6 = "mscfile\\shell\\open\\command" fullword ascii
- $s7 = "Remcos_Mutex_Inj" fullword ascii
- $s8 = "Mutex_RemWatchdog" fullword ascii
- $s9 = "Software\\Classes\\mscfile\\shell\\open\\command" fullword ascii
- $s10 = "WScript.Sleep 1000" fullword wide
- $s11 = "\\install.vbs" fullword wide
- $s12 = "\\uninstall.vbs" fullword wide
- $s13 = "\\restart.vbs" fullword wide
- $s14 = " * BreakingSecurity.Net" fullword ascii
- $s15 = "licence_code.txt" fullword ascii
- $s16 = "cSoftware\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\" fullword wide
- $s17 = "363=3`3{3" fullword ascii /* hex encoded string '633' */
- $s18 = " [Ctrl + V]" fullword ascii
- $s19 = " [Ctrl + " fullword ascii
- $s20 = "origmsc" fullword ascii
-
- $op0 = { 5d c3 55 8b ec 83 ec 34 53 56 8b f1 8d 45 ff 57 }
- $op1 = { 5d c2 04 00 55 8b ec 83 ec 34 53 56 8b f1 33 db }
- $op2 = { 05 46 ff ff ff 83 f8 24 0f 87 60 05 00 00 0f b6 }
- condition:
- uint16(0) == 0x5a4d and filesize < 400KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_574 {
- meta:
- description = "Windows_574"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "28d692bdce30404b89c0d2c4758ee6f7f16a397ef51d0ddae4b3e2e4c1de4c0b"
- strings:
- $x1 = "C:\\WINDOWS\\system32\\userinit.exe" fullword ascii
- $s2 = "C:\\WINDOWS\\system32\\userinit.exe, " fullword wide
- $s3 = "eventvwr.exe" fullword ascii
- $s4 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\" fullword wide
- $s5 = "!\\svchost.exe" fullword wide
- $s6 = "mscfile\\shell\\open\\command" fullword ascii
- $s7 = "Remcos_Mutex_Inj" fullword ascii
- $s8 = "Mutex_RemWatchdog" fullword ascii
- $s9 = "Software\\Classes\\mscfile\\shell\\open\\command" fullword ascii
- $s10 = "WScript.Sleep 1000" fullword wide
- $s11 = "\\install.vbs" fullword wide
- $s12 = "\\uninstall.vbs" fullword wide
- $s13 = "\\restart.vbs" fullword wide
- $s14 = " * BreakingSecurity.Net" fullword ascii
- $s15 = "licence_code.txt" fullword ascii
- $s16 = "cSoftware\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\" fullword wide
- $s17 = "363=3`3{3" fullword ascii /* hex encoded string '633' */
- $s18 = " [Ctrl + V]" fullword ascii
- $s19 = " [Ctrl + " fullword ascii
- $s20 = "origmsc" fullword ascii
-
- $op0 = { 5d c3 55 8b ec 83 ec 34 53 56 8b f1 8d 45 ff 57 }
- $op1 = { 5d c2 04 00 55 8b ec 83 ec 34 53 56 8b f1 33 db }
- $op2 = { 05 46 ff ff ff 83 f8 24 0f 87 60 05 00 00 0f b6 }
- condition:
- uint16(0) == 0x5a4d and filesize < 400KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_575 {
- meta:
- description = "Windows_575"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "8a6bf2bc00a6d746dd60c82d00c5a226ffda03638cdcc937a0acb090363562ab"
- strings:
- $x1 = "C:\\WINDOWS\\system32\\userinit.exe" fullword ascii
- $s2 = "[Cleared browsers logins and cooksoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" fullword ascii
- $s3 = " %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVe" fullword ascii
- $s4 = "rnel32.dll" fullword ascii
- $s5 = "eventvwr.exe" fullword ascii
- $s6 = "ftermgr.exe" fullword ascii
- $s7 = "buddata.exe" fullword wide
- $s8 = "C:\\WINDOWS\\system32\\useCurrentVersion\\Policies\\Explorer\\Run" fullword wide
- $s9 = "!\\svchost.exe" fullword wide
- $s10 = "GetWindowThreadProcessIddowTextW" fullword ascii
- $s11 = "re\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\" fullword ascii
- $s12 = "fso.Dll" fullword wide
- $s13 = "locaVAPI32.dll" fullword ascii
- $s14 = "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Logxt]" fullword ascii
- $s15 = "SreateObject(\"WScript.Shell\").Run \"cmeleteFile(Wscript.ScriptFullName)" fullword wide
- $s16 = "et fso = CreateObject(\"Scripting.Fild /c \"\"" fullword wide
- $s17 = "Offline Keylogger wnloading file: " fullword ascii
- $s18 = "line Keylogger Started" fullword ascii
- $s19 = "cfile\\shell\\open\\command" fullword wide
- $s20 = "GetTempF" fullword ascii
-
- $op0 = { 5d c2 04 00 55 8b ec 83 ec 34 53 56 8b f1 33 db }
- $op1 = { 8b 7e 0c 03 f8 57 e8 00 ff ff ff 85 c0 59 89 45 }
- $op2 = { e9 02 ff ff ff 8d 4d e8 ff 15 ec 42 41 00 3b c6 }
- condition:
- uint16(0) == 0x5a4d and filesize < 1000KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Windows_576 {
- meta:
- description = "Windows_576"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "48b5a4f81d9cdcc637aeb99f3485a2dbd67f2f64744326b06e2d8d55a70be47d"
- strings:
- $s1 = "Execute not supported: %s1Operation not allowed on a unidirectional dataset" fullword wide
- $s2 = "Unknown erroreInterBase library gds32.dll not found in the path. Please install InterBase to use this functionalityoInterBase In" wide
- $s3 = "IB.SQL.MONITOR.Mutex4_1" fullword ascii
- $s4 = "SPB Constant Unknown3Cannot perform operation -- service is not attached" fullword wide
- $s5 = "TPB Constant (%d) is unknown*Cannot perform operation -- DB is not open0Cannot perform operation -- DB is currently open" fullword wide
- $s6 = "/Lookup information for field '%s' is incomplete0Cannot perform this operation on an open dataset\"Dataset not in edit or insert" wide
- $s7 = "TPB Constant (%s) is unknown#Unknown Error - Can't retrieve plan3Size Mismatch - Field %s size is too small for data" fullword wide
- $s8 = "/Cannot perform operation -- service is attached" fullword wide
- $s9 = "Required Param value not set!No Stored Procedure Name assigned |