valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 10:05:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update gen_macro_ShellExecute_action.yar

Browse Source
This commit is contained in:
John Lambert 2019-01-31 19:38:50 -08:00 committed by GitHub
parent 4dafd62d5e
commit 7bfd6e14da
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
yara/gen_macro_ShellExecute_action.yar
View File

@ -2,10 +2,10 @@ rule gen_macro_ShellExecute_action
{
meta:
description = "VBA macro technique to call ShellExecute to launch payload"
note = "This rule only works on VT or systems that perform macro subfile extraction"
author = "John Lambert @JohnLaTwC"
date = "2019-01-08"
reference = "https://twitter.com/StanHacked/status/1075088449768693762"
note = "This rule only works on VT or systems that perform macro subfile extraction"
author = "John Lambert @JohnLaTwC"
date = "2019-01-08"
reference = "https://twitter.com/StanHacked/status/1075088449768693762"
hash1 = "0878eec9ecae493659e42c1d87588573c1e6fc30acf7a59e6fdb5296b1c198ef"
hash2 = "a0963ac15339c9803b4355fd71b68bf6ddedad960d5b3ad40bae873263470191"
hash3 = "dd094e44a817604596d1ab06ca6e9597d49ca0a2cbe9239c73ceaad70265ec2a"
@ -13,14 +13,20 @@ rule gen_macro_ShellExecute_action
hash5 = "35d8242726b905882bbfcf2770f84cb6f40552e76bff8fb0082ca10de3d61e54"
hash6 = "bf9ff20d814bf21d46a22abbd7a8ad0276145807f9adf8d2787df9e3fce3f35d"
hash7 = "77966004fcbff147f6923b3405ad9ad4e1dda42d0931564d0cdc4c7e1c91106a"
reference_hash8 = "https://twitter.com/ItsReallyNick/status/1091170625698316288"
hash8 = "c77c8033a1e5f694fa119dd7f78811f6015726822121b9414fc01e7de8770447"
strings:
$s1 = "00A0C91F3880"
$s2 = "C08AFD90"
$com1a = "00A0C91F3880"
$com1b = "C08AFD90"
$com2a = "00A0C90A8F39"
$com2b = "9BA05972"
$s3 = "ShellExecute" fullword
$s4 = "GetObject" fullword
condition:
filesize < 1MB
and (uint32be(0) == 0x41747472 or uint32be(0) == 0x61747472 or uint32be(0) == 0x41545452) //File start with Attribute
and all of them
and all of ($s*)
and (all of ($com1*) or all of ($com2*))
}