signature-base/yara/apt_fancybear_computrace_agent.yar

rule PUP_ComputraceAgent {
   meta:
      description = "Absolute Computrace Agent Executable"
      author = "ASERT - Arbor Networks (slightly modified by Florian Roth)"
      date = "2018-05-01"
      reference = "https://asert.arbornetworks.com/lojack-becomes-a-double-agent/"
   strings:
      $a = { D1 E0 F5 8B 4D 0C 83 D1 00 8B EC FF 33 83 C3 04 }
      $b1 = { 72 70 63 6E 65 74 70 2E 65 78 65 00 72 70 63 6E 65 74 70 00 }
      $b2 = { 54 61 67 49 64 00 }
   condition:
      uint16(0) == 0x5a4d and filesize < 40KB and ($a or ($b1 and $b2))
}