Skip to content
Permalink
master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Malware-Misc-RE/2020-03-19-dridex-ldr-yara-vk.yar

Go to file
 
 
Cannot retrieve contributors at this time
24 lines (19 sloc) 649 Bytes
Raw Blame
Open in GitHub Desktop
////////////////////////////////////////////////////////////
//////////////////// DRIDEX LDR YARA ///////////////////////
////////////////////////////////////////////////////////////
rule crime_win32_dridex_ldr_40300 {
meta:
author = "@VK_Intel"
reference = "https://twitter.com/baberpervez2/status/1240801518959370240"
description = "Detects latest Dridex loader botnet 40300"
date = "2020-03-20"
strings:
$str1 = "ldr.exe"
$str2 = "OutputDebugString"
$str3 = "Sleep"
$api_hash = {5? 5? 8b fa 8b ?? 8b cf e8 ?? ?? ?? ?? 85 c0 75 ?? 81 ?? ?? ?? ?? ?? 7? ??}
condition:
( uint16(0) == 0x5a4d and
( 3 of them )
) or ( all of them )
}