Created
June 4, 2015 03:02
-
-
Save idiom/f7518d7cb27ab40b5679 to your computer and use it in GitHub Desktop.
Unpacked GolRoted/HawkEye Keylogger Yara Rule
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| rule MSIL_GolRoted_Hawkeye_Unpacked { | |
| meta: | |
| description = "Detect Unpacked GolRoted/HawkEye Keylogger" | |
| author = "@seanmw" | |
| date = "2015-06-02" | |
| strings: | |
| $s1 = "encryptedemailstring" fullword ascii | |
| $s2 = "encryptedpassstring" fullword ascii | |
| $s3 = "encryptedsmtpstring" fullword ascii | |
| $s4 = "encryptedftphost" fullword ascii | |
| $s5 = "encryptedftpuser" fullword ascii | |
| $s6 = "encryptedftppass" fullword ascii | |
| $s7 = "encryptedemailstring" fullword ascii | |
| $s8 = ":\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe" fullword wide | |
| $s9 = "http://whatismyipaddress.com/" fullword wide | |
| $s10 = "Operating System Version: " fullword wide | |
| $s11 = "Keylogger Enabled: " fullword wide | |
| $s12 = "Clipboard-Logger Enabled: " fullword wide | |
| $s13 = "\\drivers\\etc\\hosts" fullword wide | |
| $s14 = "fakerror" fullword ascii | |
| $s15 = "Operating System Platform: " fullword wide | |
| $s16 = "Operating System: " fullword wide | |
| $s17 = "process__1" fullword ascii | |
| $s18 = "get_OperationalStatus" fullword ascii | |
| $s19 = "Disablelogger" fullword wide | |
| $s20 = "SendLogs" fullword ascii | |
| $s21 = "SendLogsPHP" fullword ascii | |
| $s22 = "SendLogsFTP" fullword ascii | |
| condition: | |
| uint16(0) == 0x5a4d and filesize < 2048KB and all of them | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment