Yara Rule - 그레이스 (일명 결함과 그라 워리) 쥐를 감지
Yara 정의.
Yara Rule - Detects Grace (aka FlawedGrace and GraceWire) RAT
Yara definition.
Author: X__Junior
https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/
date = "2022-12-13"
hash1 = "a66df3454b8c13f1b92d8b2cf74f5bfcdedfbff41a5e4add62e15277d14dd169"
hash2 = "e113a8df3c4845365f924bacf10c00bcc5e17587a204b640852dafca6db20404"
score = 70
$sa1 = "Grace finalized, no more library calls allowed." ascii
$sa2 = "Socket forcibly closed due to no response to DISCONNECT signal from other side, worker id(%d)" ascii
$sa3 = "AVWireCleanupThread" ascii
$sa4 = "AVTunnelClientDirectIO" ascii
$sa5 = "AVGraceTunnelWriteThread" ascii
$sa6 = "AVGraceTunnelClientDirectIO" ascii```
[https://github.com/Neo23x0/signature-base/commit/9b001d21af9577d6ecb054ca0ba10060e5b4839c](https://github.com/Neo23x0/signature-base/commit/9b001d21af9577d6ecb054ca0ba10060e5b4839c)