Merge pull request Yara-Rules#371 from utkonos/patch-1

Add detection for hex encoded text PEs
k0ko380 · Feb 24, 2020 · 10baa7e · 10baa7e
2 parents 00994cb + 6d3fa17
commit 10baa7e
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/utils/suspicious_strings.yar b/utils/suspicious_strings.yar
@@ -1324,3 +1324,17 @@ rule BITS_CLSID
     condition:
         any of them
 }
+
+rule HexEncodedTextPE
+{
+    meta:
+        author = "Malware Utkonos"
+        date = "2020-01-28"
+        reference = "https://blog.reversinglabs.com/blog/rats-in-the-library"
+        description = "Text string with hexadecimal encoded MZ/PE and comma+ separation"
+    strings:
+        $mz = /4D,.{0,6}5A/ nocase
+        $pe = /50,.{0,6}45/
+    condition:
+        all of them
+}