mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-02-09 12:13:30 +08:00
27 lines
784 B
YAML
27 lines
784 B
YAML
id: bandook-malware
|
|
|
|
info:
|
|
name: Bandook Malware - Detect
|
|
author: daffainfo
|
|
severity: info
|
|
reference: https://github.com/Yara-Rules/rules/blob/master/malware/RAT_Ratdecoders.yar
|
|
tags: malware,file
|
|
file:
|
|
- extensions:
|
|
- all
|
|
matchers:
|
|
- type: word
|
|
part: raw
|
|
words:
|
|
- "aaaaaa1|"
|
|
- "aaaaaa2|"
|
|
- "aaaaaa3|"
|
|
- "aaaaaa4|"
|
|
- "aaaaaa5|"
|
|
- "%s%d.exe"
|
|
- "astalavista"
|
|
- "givemecache"
|
|
- "%s\\system32\\drivers\\blogs\\*"
|
|
- "bndk13me"
|
|
condition: and
|
|
# digest: 4b0a004830460221008e284afa7601d122764a4c2b86fef3455f65fa5a73ea8bf96b6b1bb45e5d367d0221009059a727bae3f2d613c4f08269dbdcc91ee959de8b6598fa5d617c8f9331a7c2:922c64590222798bb761d5b6d8e72950 |