Yara Rule - 의심스러운 단일 바이트 Xored 키워드 'Mozilla/5.0’을 감지 Yara의 XOR 수정자를 사용하므로 XOR 키를 인쇄 할 수 없습니다.참조 필드에 연결된 CyberChef 레시피를 사용하여 중고 키를 무차별
Yara 정의.
Yara Rule - Detects suspicious single byte XORed keyword ‘Mozilla/5.0’ - it uses yara’s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Yara definition.
Author: Florian Roth
https://gchq.github.io/CyberChef/#recipe
md5 = "fe34b7c071d96dac498b72a4a07cb246"
modified = "2023-11-25"
score = 60 // reduced score by Florian Roth due to FPs
$x = {8b ?? ?? 4? b8 04 00 00 00 [0 - 4] ba 02 00 00 00 be 01 00 00 00 [0 - 2] e8 ?? ?? ?? ?? 89 4? ?? 83 7? ?? 00 79 [0 - 50] ba 10 00 00 00 [0 - 10] e8}
date = "2023-03-23"
modified = "2023-11-25"
score = 65
hash = "12bf2795f4a140adbaa0af6ad4b2508d398d8ba69e9dadb155f800b10f7458c4"
hash = "14ec56489fbcc3c7f1ef9a4d4a80ff302a5e233cdc4429a29c635a88fb1278d6"
hash = "13731912823d6ce01c28a8d7d7f961505f461620bb35adbb409d4954ba1f4b8e"
date = "2018-08-17"
modified = "2023-11-25"
score = 55
$URL = "http"
$fp1 = "https://go.microsoft.com"
uint32(0) == 0x0d424557 and uint32(4) == 0x0a0d310a
date = "2018-01-22"
modified = "2023-11-25"
score = 65
date = "2019-10-28"
modified = "2023-11-25"
score = 65
$xo1 = "Mozilla/5.0" xor(0x01-0xff) ascii wide
$fp1 = "Sentinel Labs" wide
$fp2 = "<filter object at" ascii /* Norton Security */
and not uint32(0) == 0x434d5953 // Symantec AV sigs file```
[https://github.com/Neo23x0/signature-base/commit/8f6a4c4415445e6f52534b15eec1d657db36d83a](https://github.com/Neo23x0/signature-base/commit/8f6a4c4415445e6f52534b15eec1d657db36d83a)