valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 18:15:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #26 from JohnLaTwC/patch-2

Browse Source 
yara rule for encoded python payloads for adware
This commit is contained in:
Florian Roth 2018-03-07 23:07:08 +01:00 committed by GitHub
commit 37ccc0a471
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
yara/gen_python_encoded_adware Normal file
View File

@ -0,0 +1,20 @@
rule gen_python_encoded_adware
{
meta:
description = "Encoded Python payload for adware"
author = "John Lambert @JohnLaTwC"
date = "2018-03-07"
hash = "5d7239be779367e69d2e63ffd9dc6e2a1f79c4e5c6c725e8c5e59a44c0ab2fff"
reference = "https://twitter.com/JohnLaTwC/status/949048002466914304"
strings:
$r1 = "=__import__(\"base64\").b64decode"
$r2 = ")))))"
$s1 = "bytes(map(lambda"
$s2 = "[1]^"
condition:
filesize < 100KB
and @r1 < 100
and @r2 > (filesize - 30)
and all of them
}