Yara Rule - 이항은 gobfuscate로 난독 화 된 것을 식별
Yara 정의.
Yara Rule - Identifies binaries obfuscated with gobfuscate
Yara definition.
Author: James Quinn, Paul Hager (merged with new similar pattern)
Internal Research
date = "2021-05-14"
modified = "2024-04-02"
score = 70
id = "ae518296-b1c3-568c-bae0-3e0a6f7600ba"
$s1 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? 31 D? [0-1] 88 ?? ?? ?? 48 FF C? 48 83 F? ?? 7C E6 48 }
// $s1a = { 0f b6 ?? ?? ?? 0f b6 ?? ?? ?? 31 d6 40 88 ?? ?? ?? 48 ff c1 48 83 f9 ?? 7c e6 48 } // new
// $s1b = { 0f b6 ?? ?? ?? 0f b6 ?? ?? ?? 31 d1 88 ?? ?? ?? 48 ff c0 48 83 f8 ?? 7c e7 48 c7 }
$s2 = { 0F B6 ?? ?? ?? 31 DA 88 ?? ?? ?? 40 83 ?? ?? 7D 09 0F B6 }
score = 60
date = "2017-02-22"
modified = "2024-04-03"
nodeepdive = 1
id = "a763fb82-c840-531b-b631-f282bf035020"
$fp7 = "# RemoteSSHConfigurationScript" ascii /* \.vscode\extensions\ms-vscode-remote.remote-ssh */
$fp8 = "<helpItems" ascii fullword
$fp9 = "DownloadFile(\"https://codecov.io/bash" ascii
$fp10 = "DownloadFile('https://get.golang.org/installer.exe" ascii
$fpg1 = "All Rights"
$fpg2 = "<html"
$fpg3 = "<HTML"
$fpg4 = "Copyright"
$fpg5 = "License"
$fpg6 = "<?xml"
$fpg7 = "Help" fullword
$fpg8 = "COPYRIGHT" fullword```
[https://github.com/Neo23x0/signature-base/commit/1b9069ac3d8d5b6dd2b61d3c934bf19b70323011](https://github.com/Neo23x0/signature-base/commit/1b9069ac3d8d5b6dd2b61d3c934bf19b70323011)