diff --git a/Rules/PYAS_Rules_A1.yar b/Rules/PYAS_Rules_A1.yar deleted file mode 100644 index d464f2f..0000000 --- a/Rules/PYAS_Rules_A1.yar +++ /dev/null @@ -1,1472 +0,0 @@ -import "pe" - -rule General_1 { - meta: - description = "1" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "System.Object, mscorlib, Version=" ascii - $x2 = ".pdb" ascii - $x3 = "System.Drawing" ascii - $s1 = "a2VybmVsMzIuZGxs" fullword wide - $s2 = "RnJlZUNvbnNvbGU=" fullword wide - $s3 = "Paleozoologist Timpanist Troubling" ascii - $s4 = "Paleozoologist Timpanist Troubling" wide - $s5 = "Levitating" fullword ascii - $s6 = ".Properties" ascii - $s7 = "PublicKeyToken" ascii - $s8 = "helpToolStripButton.Image" fullword wide - $s9 = "newToolStripButton.Image" fullword wide - $s10 = "openToolStripButton.Image" fullword wide - $s11 = "printToolStripButton.Image" fullword wide - $s12 = "printPreviewToolStripButton.Image" fullword wide - $s13 = "Extractor" ascii - $s14 = "Congratulations" fullword ascii - $s15 = "Byrnies" fullword wide - $s16 = "showString" fullword ascii - $s17 = "AScsrhgtr" fullword ascii - $s18 = "ZknciocoiAw" fullword ascii - $s19 = "Volute Transitions" fullword wide - $s20 = "IOasuoihciujo" fullword ascii - $s21 = "labelComp" wide - $s22 = "ErrorImage" wide - $s23 = "get_QuestCompletionItems" fullword ascii - $s24 = "get_DropPercentage" fullword ascii - $s25 = "PlayerData.xml" fullword wide - $s26 = "get_LootTable" fullword ascii - $s27 = "get_Potions" ascii - $s28 = "get_CurrentMonster" fullword ascii - $s29 = "MONSTER_ID_RAT" fullword ascii - $s30 = "get_AddExtraNewLine" fullword ascii - $s31 = "get_LootItems" fullword ascii - $s32 = "get_HasAMonster" fullword ascii - $s33 = "get_MinimumDamage" fullword ascii - $s34 = "get_RewardGold" fullword ascii - $s35 = "get_VendorWorkingHere" fullword ascii - $s36 = "get_RewardItem" fullword ascii - $s37 = "get_MaximumDamage" fullword ascii - $s38 = "get_RewardExperiencePoints" fullword ascii - $s39 = "imgur.com" wide - $s40 = "CURD_ALUNOS.md" wide - $s41 = "Parametros.xml" fullword wide - $s42 = "dgEditar_CellContentClick" fullword ascii - $s43 = "dgDados_CellContentClick" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 5000KB and - 1 of ($x*) and 8 of them -} - -rule General_2 { - meta: - description = "2" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "You walk into the" wide - $s2 = "_unprocessedInterAgentMessages" fullword ascii - $s3 = "ProcessAllInterAgentMessages" fullword ascii - $s4 = "AgentsComunnicationExecution" fullword ascii - $s5 = "SendExecuteMessage" fullword ascii - $s6 = "TemporarySetAgentModel" fullword ascii - $s7 = "immediatelyProcess" fullword ascii - $s8 = "ProcessTheMessage" fullword ascii - $s9 = "HoldTarget" ascii nocase - $s10 = "SimulationEngine." ascii - $s11 = "FindAddresseeAgent" ascii - $s12 = "AgentIsAlreadyRegistredException" fullword ascii - $s13 = "MessageTimestampComparer" fullword ascii - $s14 = "startcombat" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 5000KB and - 8 of them -} - -rule General_3 { - meta: - description = "3" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "GrapeCity.ActiveReports.Chart.Win" ascii - $s1 = "ComponentlessCollectionEditor" ascii - $s2 = "LabelsCollectionEditorGrapeCity" ascii - $s3 = "AxesEditor" ascii - $s4 = "AnnotationEditor" ascii - $s5 = "GradientEditor" ascii - $s6 = "DoubleArrayEditor" ascii - $s7 = "LegendsEditor" ascii - $s8 = "DataPointsEditor" ascii - $s9 = "ChartAreasEditor" ascii - $s10 = "AxesSelectEditor" ascii - $s11 = "StyleEditor" ascii - $s12 = "PatternEditor" ascii - condition: - uint16(0) == 0x5a4d and filesize < 30000KB and - $x1 and 8 of them -} - -rule General_4 { - meta: - description = "PYAS_Rules_A4" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = ".Properties" ascii nocase - $x2 = ".Resources" ascii nocase - $s1 = "ListenToAll" fullword ascii - $s2 = "Abberant" fullword ascii - $s3 = "Shlyber" fullword ascii - $s4 = ".exe" wide - $s5 = ".pdb" wide - condition: - uint16(0) == 0x5a4d and filesize < 4000KB and - ($x1 and $x2) and 5 of them -} - -rule General_5 { - meta: - description = "5" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "Microsoft.VSDesigner.DataSource.Design" ascii - $s1 = "columnPostcode" fullword ascii - $s2 = "GetRealUpdatedRows" fullword ascii - $s3 = "set_Postcode" fullword ascii - $s4 = "System.Drawing.Design.UITypeEditor" fullword ascii - $s5 = "postcodeDataGridViewTextBoxColumn" fullword wide - $s6 = "get_AlexandraDBConnectionString" fullword ascii - $s7 = "SELECT [Number]" wide - $s8 = "Original_Postcode" fullword wide - $s9 = "get_CellPhone" fullword ascii - $s10 = "get_CellPhoneColumn" fullword ascii - $s11 = "postcodeTextBox" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 5000KB and - $x1 and 3 of them -} - -rule General_6 { - meta: - description = "6" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "System.Drawing" ascii - $x2 = "PublicKeyToken" ascii - $x3 = "System.Security.Permissions.SecurityPermission" wide - $x4 = "urn:schemas-microsoft-com:asm" ascii - $s1 = "feffeeffeef" ascii - $s2 = "fefefeffefe" ascii - $s3 = "feffefeeffe" ascii - $s4 = "ffeefeffeefa" ascii - $s5 = "ffeeffefeef" ascii - $s6 = "ffeeffeeffe" ascii - $s7 = "ffefeeffefe" ascii - $s8 = "feffefefe" ascii - $s9 = "fefefeffea" ascii - $s10 = "supercommerce@example.com" fullword wide - $s11 = "btnLogin" fullword ascii - $s12 = "loginToolStripMenuItem" fullword wide - $s13 = "loginToolStripMenuItem_Click" fullword ascii - $s14 = "LoginController" fullword ascii - $s15 = "Erro: login Mal Sucedido" fullword wide - $s16 = "Erro de Login" fullword wide - $s17 = "supermercado.Login.resources" fullword ascii - $s18 = "get_Cordinations" fullword ascii - $s19 = "get_Utgivnings" fullword ascii - $s20 = "The Dark Knight" fullword wide - $s21 = "get_Both_Shiled_and_Sword_Hero" fullword ascii - $s22 = "get_Empty_handed_Hero" fullword ascii - $s23 = "LogicValues1" fullword ascii - $s24 = "by adguard" fullword wide - $s25 = "ErrorImage" wide - $s26 = "thedarkknight.jpg" fullword wide - $s27 = "terkomst.jpg" fullword wide - $s28 = "rymdimperiet.jpg" fullword wide - $s29 = "get_Hero_with_shield" fullword ascii - $s30 = "get_PowerOfDistraction" fullword ascii - $s31 = "operationPressed" fullword ascii - $s32 = "get_RadiusOfAttack" fullword ascii - $s33 = "get_FilmNamn" fullword ascii - $s34 = "operatorClick" fullword ascii - $s35 = "get_Hero_with_sword" fullword ascii - $s36 = "CustomImageFormat.txt" wide - $s37 = "get_BeatsPerSecond" fullword ascii - $s38 = "get_BeatPerSecond" fullword ascii - $s39 = "DJ Control" fullword wide - $s40 = "add_BeatChanged" fullword ascii - $s41 = "_presenterModel" fullword ascii - $s42 = "set_BeatsPerSecond" fullword ascii - $s43 = "HandleBeat" fullword ascii - $s44 = "BeatEventArgs" fullword ascii - $s45 = ".NET Framework 4.6l" fullword ascii - $s46 = ".?AV?$IListEnum@PAVECChildEvent@@@bd@@" fullword ascii - $s47 = ".?AV?$_Func_impl_no_alloc@V@@_NABUDllProtectEvent@@@std@@" fullword ascii - $s48 = ".?AV?$_Func_base@_NABUDllProtectEvent@@@std@@" fullword ascii - $s49 = ".?AV?$ListEnum@PAVECChildEvent@@@bd@@" fullword ascii - $s50 = ".?AV?$IConstListEnum@PAVECChildEvent@@@bd@@" fullword ascii - $s51 = ".?AV?$ConstListEnum@PAVECChildEvent@@@bd@@" fullword ascii - $s52 = "labelComp" wide - condition: - uint16(0) == 0x5a4d and filesize < 10000KB and - 1 of ($x*) and 5 of them -} - -rule General_7 { - meta: - description = "7" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "python3" ascii nocase - $s2 = "_:@:P:H:X:D:T:L:\\:B:R:J:Z:F:V:N:^:A:Q:I:Y:E:U:M:]:C:S:K:[:G:W:O:_" fullword ascii - $s3 = "KkdgJiVj1" fullword ascii - $s4 = "2V1V5V3V7" fullword ascii - $s5 = "Cxz.Yfc" fullword ascii - $s6 = "'7 7$7\"7&7!7%7#7'" fullword ascii - $s7 = "* %\\5?" fullword ascii - $s8 = "xezygjy" fullword ascii - $s9 = "tgkvdjv" fullword ascii - $s10 = "bfDs /nU," fullword ascii - $s11 = "zktmxjuxjeh" fullword ascii - $s12 = "indljaj" fullword ascii - $s13 = "Z t:\"-" fullword ascii - $s14 = "o^EX:\"" fullword ascii - $s15 = "rjF.tNb" fullword ascii - $s16 = "pynput.keyboard._dummy)" fullword ascii - $s17 = "pynput.keyboard._darwin)" fullword ascii - $s18 = "pynput.keyboard)" fullword ascii - $s19 = "pynput.keyboard._uinput)" fullword ascii - $s20 = "pynput.keyboard._win32)" fullword ascii - $s21 = "pynput.keyboard._xorg)" fullword ascii - $s22 = "pynput.keyboard._base)" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 50000KB and - 10 of them -} - -rule General_8 { - meta: - description = "8" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "TASKKILL /F /IM" wide nocase - $x2 = "processhacker" wide nocase - $x3 = "cmd.exe /" wide nocase - $s1 = "SHELL32.dll" wide nocase - $s2 = "mmc.exe" wide nocase - $s3 = "Execute ERROR" fullword wide - $s4 = "WindowsServiceMode.exe" fullword wide - $s5 = "ping 0" wide nocase - $s6 = "Microsoft" wide nocase - $s7 = "shutdown" wide nocase - $s8 = "Download ERROR" fullword wide - $s9 = "Executed As " fullword wide - $s10 = "winmgmts:\\\\.\\root\\SecurityCenter2" fullword wide - $s11 = "ScanProcess" fullword ascii - $s12 = "HKEY_CURRENT_USER\\Software\\" wide nocase - $s13 = "HKEY_LOCAL_MACHINE\\SOFTWARE\\" wide nocase - $s14 = "TerminateProcessPath" ascii nocase - $s15 = "svchost.exe" wide nocase - $s16 = "wscript.exe" wide nocase - $s17 = "Application.exe" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 15000KB and - 2 of ($x*) and 6 of them -} - -rule General_9 { - meta: - description = "9" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "SignalEventHandler" fullword ascii - $s2 = "get_CrossTraffic" fullword ascii - $s3 = "get_BeforeIntersection" fullword ascii - $s4 = "get_InIntersection" fullword ascii - $s5 = "get_CloseToIntersection" fullword ascii - $s6 = "TrafficSignal.Settings" fullword ascii - $s7 = "TrafficSignal.Strategy" fullword ascii - $s8 = "TrafficSignal.Serializers" fullword ascii - $s9 = "lblComputerName" fullword wide - $s10 = "TrafficSignal.Properties.Resources.resources" fullword ascii - $s11 = "TrafficSignal.TrafficSignalForm.resources" fullword ascii - $s12 = "TrafficSignal.Properties" fullword ascii - $s13 = "TrafficSignal.Properties.Resources" fullword wide - $s14 = "get_pmYK" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 5000KB and - 6 of them -} - -rule General_10 { - meta: - description = "10" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "DQuasar.Common" ascii - $x2 = "PublicKeyToken" ascii - $s1 = "GetKeyShareHelloRetryRequest" ascii - $s2 = "GetKeyShareServerHello" ascii - $s3 = "Process already elevated." fullword wide - $s4 = "get_PotentiallyVulnerablePasswords" ascii - $s5 = "GetKeyloggerLogsDirectory" ascii - $s6 = "Gma.System.MouseKeyHook.KeyPressEventArgsExt" ascii - $s7 = "GetKeyloggerLogsDirectoryResponse" ascii - $s8 = "Quasar.Common.Models.FileChunk" ascii - $s12 = "set_PotentiallyVulnerablePasswords" ascii - $s13 = "potentiallyVulnerablePasswords" ascii - $s16 = "getBytesProcessed" ascii - $s17 = "GetPreSharedKeyClientHello" ascii - $s18 = "GetKeyShareClientHello" ascii - condition: - uint16(0) == 0x5a4d and filesize < 20000KB and - ($x1 and $x2) and 6 of them -} - -rule General_11 { - meta: - description = "11" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "/c schtasks /create /f /sc onlogon /rl highest /tn \"" fullword wide - $s2 = "get_SendSync" fullword ascii - $s3 = "get_SslClient" fullword ascii - $s4 = "kpTBNFtPhayeH" fullword ascii - $s5 = "get_ActivatePong" fullword ascii - $s6 = "Pastebin" fullword wide - $s7 = "GetUtf8Bytes" fullword ascii - $s8 = "Plugin.Plugin" fullword wide - $s9 = "RunAntiAnalysis" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 1000KB and - 6 of them -} - -rule General_12 { - meta: - description = "12" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "-ExecutionPolicy Bypass" wide - $s1 = "shutdown" wide nocase - $s2 = "OfflineKeylogger Not Enabled" fullword wide - $s3 = "Win32_Processor.deviceid" wide - $s4 = "CloseMutex" fullword ascii - $s5 = "AES_Encryptor" fullword ascii - $s6 = "POST / HTTP/1.1" fullword wide - $s7 = "GetHashT" fullword ascii - $s8 = "AES_Decryptor" fullword ascii - $s9 = "PCLogoff" fullword wide - $s10 = "RunShell" fullword wide - $s11 = "HostsMSG" fullword wide - $s12 = "HostsErr" fullword wide - $s13 = "OfflineGet" fullword wide - $s14 = "Content-length:" wide - $s15 = "Mozilla/5.0" wide - condition: - uint16(0) == 0x5a4d and filesize < 30000KB and - 1 of ($x*) and 5 of them -} - -rule General_13 { - meta: - description = "13" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "xehook.exe" fullword wide - $s2 = "System.Collections.Generic" ascii - $s3 = "" ascii - $s7 = "Confuser.Core 1.6.0+447341964f" fullword ascii - $s8 = "rsqypuz" fullword ascii - $s9 = "scyt6m$!k-}qbwu|ud6m#!k-sctbqs6m\"!k-u}q~s`6 -cbud|yv6m!!k-dhu6m !k-~u{" fullword ascii - $s10 = "s6m%k-u}q~buce6m$k-cuy{" fullword ascii - $s11 = "ETALUME" fullword ascii - $s12 = "EYKLLGJCYEHBODMAHOGOCDNCJABEGNCG" fullword ascii - $s13 = "JGVIWIWIPUVG" fullword ascii - $s14 = "BAAD10E40DF6B5D52A22FCCE498BBD641EBB2377BB7DA4FE04EE26F084647F69" ascii - $s15 = "(&'(/- /.,$ $, & */! .('% ,#$+(" fullword ascii - $s16 = "xehook" fullword ascii - $s17 = "#+- +e,:'?;;)8" fullword ascii - $s18 = "\\DVzVCRz " fullword ascii - $s19 = "gv8) -" fullword ascii - $s20 = "[oBxxnhdy[" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 2000KB and - 6 of them -} - -rule General_14 { - meta: - description = "14" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "jdownloader" wide nocase - $s2 = "cmdvrt32.dll" fullword wide - $s3 = "accounts.dat" fullword wide - $s4 = "SxIn.dll" fullword wide - $s5 = "Paltalk NG" wide - $s6 = "encrypted" fullword wide - $s7 = "ip-api.com" wide - $s8 = "mRzIs.exe" fullword wide - $s9 = "SmtpPassword" fullword wide - $s10 = "FTP Commander" wide - $s14 = "privateinternetaccess.com" fullword wide - $s15 = "paltalk.com" fullword wide - $s16 = "discord.com" fullword wide - $s17 = "Sf2.dll" fullword wide - $s18 = "account.dyn.com" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 2000KB and - 8 of them -} - -rule General_15 { - meta: - description = "15" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "aGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBn" wide - $s2 = "Could not list processes locking resource." wide - $s3 = "Failed to get size of result." wide - $s4 = "DownloadAndExecuteUpdate" fullword ascii - $s5 = "loginusers.vdf" fullword wide - $s7 = "ProcessInfo" wide - $s8 = "get_encrypted_key" fullword ascii - $s9 = "Tokens.txt" fullword wide - $s10 = "DisplayDown" wide - $s11 = "VisualPlus-Debug.log" fullword wide - $s12 = "Total of RAMExecutablePath" fullword wide - $s13 = "loginPairs" fullword ascii - $s15 = "Software\\Valve\\SteamLogin Data" fullword wide - $s16 = "SELSystem" wide - $s17 = "FRSystem" wide - $s18 = "WinSystem" wide - $s19 = "%localappdata%\\" fullword wide - $s20 = "NoEngrdVpEngn.exe*" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 2000KB and - 8 of them -} - -rule General_16 { - meta: - description = "16" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "LoginForm." ascii - $x2 = ".pdb" ascii - $s1 = "btnLogin" fullword ascii - $s2 = "Wrong ID or Password" fullword wide - $s3 = "Log In" wide - $s4 = "CodiNauts" wide - $s5 = "btnclear" fullword ascii - $s6 = "GridFactura.Factura.resources" fullword ascii - $s7 = "txtUserID_Validating" fullword ascii - $s8 = "TrabajoPractico.GridFactura.resources" fullword ascii - $s9 = "txtUserPass" fullword wide - $s10 = "txtUserID" fullword wide - $s11 = "Please Enter User ID" fullword wide - $s12 = "Properties.Resources" ascii - $s13 = "Log In Successfully" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 4000KB and - ($x1 and $x2) and 6 of them -} - -rule General_17 { - meta: - description = "17" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "select * from user" wide nocase - $s1 = "ltromatic.ttf" wide - $s2 = "password mismatch issue" fullword wide - $s3 = "tada.wav" wide - $s4 = "GetAllIncome" fullword ascii - $s5 = "getIcomeData" fullword ascii - $s6 = "execQueryForStoredProcedure" fullword ascii - $s7 = "GetAllIncomeValues" fullword ascii - $s8 = "GetTotalIncomeSum" fullword ascii - $s9 = "getAllUser" fullword ascii - $s10 = "The password must include letters and numbers both" fullword wide - $s11 = "Passwords not mathced" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 4000KB and - $x1 and 8 of them -} - -rule General_18 { - meta: - description = "18" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "WINDESCRIPTION" fullword wide - $s2 = "2#2?2a2{2" fullword ascii - $s3 = "CWM_GETCONTROLNAME" fullword wide - $s4 = ":%:=:C:L:R:\\:g:" fullword ascii - $s5 = ":-:I:T:\\:g:o:{:" fullword ascii - $s6 = "C@COM_EVENTOBJ" fullword wide - $s7 = "ISTABLE" fullword wide - $s8 = "Cstatic" fullword wide - $s9 = "HtZHtEHt2" fullword ascii - $s10 = "tgHuM95" fullword ascii - $s11 = "EEnvironment" fullword wide - $s12 = "Invalid characters behind Object assignment!" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 6000KB and - 6 of them -} - -rule General_19 { - meta: - description = "19" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "step executed succcessfully" wide - $x2 = "NurseWorkstationDemo" wide - $s1 = "get_ObejctOperation" fullword ascii - $s2 = "man.png" wide - $s3 = "woman.png" fullword wide - $s4 = "get_AUTHORITY_ALL" fullword ascii - $s5 = "GetDataTableInfo_CommonGood" fullword ascii - $s6 = "from CommonGood where user_name=@user_Name" wide - $s7 = "PSYCHOLOGY" fullword ascii - $s8 = "GYNECOLOGY" fullword ascii - $s9 = "Workstation_Library.Common" fullword ascii - $s10 = "get_DataColumn1" fullword ascii - $s11 = "get_DataColumn1Column" fullword ascii - $s12 = "get_DataTable1" fullword ascii - $s13 = "get_Status_R" fullword ascii - $s14 = "GetAllBedNum" fullword ascii - $s15 = "GetDataTableInfo_PatientName" fullword ascii - $s16 = "get_Major_Doctor" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 5000KB and - ($x1 and $x2) and 8 of them -} - -rule General_20 { - meta: - description = "20" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "Log_Clientes.txt" wide - $s2 = "Log_Produtos.txt" wide - $s3 = "Log_Vendas.txt" wide - $s4 = "SCV - Sistema de Cadastro e Vendas" fullword wide - $s5 = "SCV - Novo Cliente" fullword wide - $s6 = "SCV - Lista de Clientes" fullword wide - $s7 = "SCV - Lista de Produtos" fullword wide - $s8 = "SCV - Listar Vendas" fullword wide - $s9 = "SCV - Novo Produto" fullword wide - $s10 = "SCV - Nova Venda" fullword wide - $s11 = "dgvListaClientes_CellContentClick" fullword ascii - $s12 = "Comprador" fullword wide - $s13 = "LogProdutos" fullword ascii - $s14 = "LogVendas" fullword ascii - $s15 = "dgvListaProdutos_CellContentClick" fullword ascii - $s16 = "LogClientes" fullword ascii - $s17 = "Compras" fullword ascii - $s18 = "dgvProdutos_CellContentClick" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 5000KB and - 8 of them -} - -rule General_21 { - meta: - description = "21" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "xeno rat client" wide - $s2 = "Windows Functionality" wide - $s3 = "mutex_string" fullword ascii - $s4 = "5__2" fullword ascii - $s5 = "xeno_rat_client" ascii - $s6 = "_EncryptionKey" fullword ascii - $s7 = "/query /v /fo csv" fullword wide - $s8 = "5__3" fullword ascii - $s9 = "5__2" fullword ascii - $s10 = "GetIdleTimeAsync" ascii - $s11 = "PT0S" wide - $s12 = "L0MgY2hvaWNlIC9DIFkgL04gL0QgWSAvVCAzICYgRGVsICI=" fullword wide - $s13 = "d__5" fullword ascii - $s14 = "5__7" fullword ascii - $s15 = "_dllhandler" fullword ascii - $s16 = "d__3" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 500KB and - 8 of them -} - -rule General_22 { - meta: - description = "22" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "Single.exe" fullword wide - $s2 = "Single.pdb" fullword ascii - $s3 = "Overchills" fullword wide - $s4 = "Single.g.resources" fullword ascii - $s5 = "dYuVXzkLLVWbcxpNkzwMQNycwFrMShzJDdw" fullword ascii - $s6 = "ZtrbobDfRVDVSYJDbiTjJYMtnApmznZIIGm" fullword ascii - $s7 = "OmmLUOYnOXYPbQacJiJgtIiOzIZqtuzkkZYgGzISElssPeGNll" fullword wide - $s8 = "RuJwfBUCLwnFkjrsmBeNtwwSyNBZKewfylZFqqPiXRqujAEskL" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 2000KB and - 6 of them -} - -rule General_23 { - meta: - description = "23" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide - $s2 = "-ItemProperty -Path" wide - $s3 = "Kutc64InaW" fullword ascii - $s4 = "Cronos-Crypter" fullword wide - $s5 = "PrivateImplementationDetails" ascii - $s6 = "SetProcessSecurityDescriptor" ascii - $s7 = "Systemhost" fullword wide - $s8 = "decKey" fullword ascii - $s9 = "StartupInformation" fullword ascii - $s10 = "InstallRegistry" fullword ascii - $s11 = "EEC0C451-6B9A-45A0-A879-90E70D3033F5" ascii - condition: - uint16(0) == 0x5a4d and filesize < 500KB and - 7 of them -} - -rule General_24 { - meta: - description = "24" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "LcD$`Mi" fullword ascii - $s2 = "yBZh11AY&SYS" fullword ascii - $s3 = "+HcD$DHcL$DH" fullword ascii - $s4 = "D$P9D$@}0" fullword ascii - $s5 = "tkHcD$8H" fullword ascii - $s6 = "BHcD$D" fullword ascii - $s7 = "|$(2t%" fullword ascii - $s8 = "D$ 9D$(}z" fullword ascii - $s9 = "D$ 9D$$}w" fullword ascii - $s10 = "|$02t\"" fullword ascii - $s11 = "L$P9H$s" fullword ascii - $s12 = "L$P9H$|uH" fullword ascii - $s13 = "D$89D$(}," fullword ascii - $s14 = " `l;Vig" fullword ascii - $s15 = "D$@HcL$\\H" fullword ascii - $s16 = "L$p9A