From 7cab50215051871b901e7c37a433e23f1f7f635e Mon Sep 17 00:00:00 2001
From: JohnLaTwC <johnla@microsoft.com>
Date: Wed, 7 Mar 2018 08:45:57 -0800
Subject: [PATCH] yara rule for encoded python payloads for adware

Ran it through a retrohunt earlier and has good true positive track record in VT.  Very interesting python samples that it is a part of.
---
 yara/gen_python_encoded_adware | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 yara/gen_python_encoded_adware

diff --git a/yara/gen_python_encoded_adware b/yara/gen_python_encoded_adware
new file mode 100644
index 0000000..f864df4
--- /dev/null
+++ b/yara/gen_python_encoded_adware
@@ -0,0 +1,20 @@
+rule gen_python_encoded_adware
+{
+    meta: 
+        description = "Encoded Python payload for adware"
+        author = "John Lambert @JohnLaTwC"
+        date = "2018-03-07"
+        hash = "5d7239be779367e69d2e63ffd9dc6e2a1f79c4e5c6c725e8c5e59a44c0ab2fff"
+        reference = "https://twitter.com/JohnLaTwC/status/949048002466914304"
+        
+    strings:
+        $r1 = "=__import__(\"base64\").b64decode"
+        $r2 = ")))))"
+        $s1 = "bytes(map(lambda"
+        $s2 = "[1]^"
+    condition:
+        filesize < 100KB
+        and @r1 < 100
+        and @r2 > (filesize - 30)
+        and all of them
+}