Create MALW_XHide.yar

Yara-Rules · Nov 30, 2017 · 5f193ee · 5f193ee
1 parent 6caded7
commit 5f193ee
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/malware/MALW_XHide.yar b/malware/MALW_XHide.yar
@@ -0,0 +1,15 @@
+rule XHide: MALW
+{
+	meta:
+		description = "XHide - Process Faker"
+		author = "Joan Soriano / @w0lfvan"
+		date = "2017-12-01"
+		version = "1.0"
+		MD5 = "c644c04bce21dacdeb1e6c14c081e359"
+		SHA256 = "59f5b21ef8a570c02453b5edb0e750a42a1382f6"
+	strings:
+		$a = "XHide - Process Faker"
+		$b = "Fakename: %s PidNum: %d"
+	condition:
+		all of them
+}