nuclei-templates/file/malware/universal-1337-malware.yaml

id: universal-1337-malware

info:
  name: Universal 1337 Stealer Malware - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Stealer.yar
  tags: malware,file
file:
  - extensions:
      - all

    matchers-condition: or
    matchers:
      - type: binary
        binary:
          - "2A5B532D502D4C2D492D545D2A"
          - "2A5B482D452D522D455D2A"
        condition: and

      - type: binary
        binary:
          - "4654507E"
          - "7E317E317E307E30"
        condition: and
# digest: 4a0a00473045022100934a8fea41845f3f2e2ada963d94f3d0514de952f61c95317f80f69abd290cba022035655bb6bc7250a231fe3f8bb15b236617c6749da8848cefb3b46ea209aff675:922c64590222798bb761d5b6d8e72950