Yara Rule - 이항은 gobfuscate로 난독 화 된 것을 식별
Yara 정의.
Yara Rule - Identifies binaries obfuscated with gobfuscate
Yara definition.
Author: James Quinn, Paul Hager (merged with new similar pattern)
https://github.com/unixpickle/gobfuscate
date = "2021-05-14"
modified = "2024-04-02"
score = 70
id = "ae518296-b1c3-568c-bae0-3e0a6f7600ba"
$s1 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? 31 D? [0-1] 88 ?? ?? ?? 48 FF C? 48 83 F? ?? 7C E6 48 }
// $s1a = { 0f b6 ?? ?? ?? 0f b6 ?? ?? ?? 31 d6 40 88 ?? ?? ?? 48 ff c1 48 83 f9 ?? 7c e6 48 } // new
// $s1b = { 0f b6 ?? ?? ?? 0f b6 ?? ?? ?? 31 d1 88 ?? ?? ?? 48 ff c0 48 83 f8 ?? 7c e7 48 c7 }
$s2 = { 0F B6 ?? ?? ?? 31 DA 88 ?? ?? ?? 40 83 ?? ?? 7D 09 0F B6 }```
[https://github.com/Neo23x0/signature-base/commit/86c6964bc2cd06173c5bb49e85fc37a02f9fd29e](https://github.com/Neo23x0/signature-base/commit/86c6964bc2cd06173c5bb49e85fc37a02f9fd29e)