valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 18:15:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

PowerShell Obfuscated Invoke - PE Loader

Browse Source
This commit is contained in:
Florian Roth 2017-11-03 08:28:52 +01:00
parent b6522edf1f
commit be700a3c42
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
yara/thor-hacktools.yar
View File

@ -3922,3 +3922,19 @@ rule Invoke_Metasploit {
condition:
( filesize < 20KB and 1 of them )
}
rule PowerShell_Mal_HackTool_Gen {
meta:
description = "Detects PowerShell hack tool samples - generic PE loader"
author = "Florian Roth"
reference = "Internal Research"
date = "2017-11-02"
hash1 = "d442304ca839d75b34e30e49a8b9437b5ab60b74d85ba9005642632ce7038b32"
strings:
$x1 = "$PEBytes32 = 'TVqQAAMAAAAEAAAA" wide
$x2 = "Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp" fullword wide
$x3 = "@($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword wide
$x4 = "(Shellcode: LoadLibraryA.asm)" fullword wide
condition:
filesize < 8000KB and 1 of them
}