hidden_cobra_fastcash_malware_sysmon

Description

HIDDEN COBRA FASTCash Malware Detector for Sysmon. License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md.

Query · yara_l

events:
($selection.metadata.product_event_type = "1" and ($selection.target.file.md5 = "10ac312c8dd02e417dd24d53c99525c29d74dcbc84730351ad7a4e0a4b1a0eba" or $selection.target.file.md5 = "3a5ba44f140821849de2d82d5a137c3bb5a736130dddb86b296d94e6b421594c" or $selection.target.file.md5 = "4a740227eeb82c20286d9c112ef95f0c1380d0e90ffb39fc75c8456db4f60756" or $selection.target.file.md5 = "820ca1903a30516263d630c7c08f2b95f7b65dffceb21129c51c9e21cf9551c6" or $selection.target.file.md5 = "a9bc09a17d55fc790568ac864e3885434a43c33834551e027adb1896a463aafc" or $selection.target.file.md5 = "ab88f12f0a30b4601dc26dbae57646efb77d5c6382fb25522c529437e5428629" or $selection.target.file.md5 = "ca9ab48d293cc84092e8db8f0ca99cb155b30c61d32a1da7cd3687de454fe86c" or $selection.target.file.md5 = "d465637518024262c063f4a82d799a4e40ff3381014972f24ea18bc23c3b27ee" or $selection.target.file.md5 = "e03dc5f1447f243cf1f305c58d95000ef4e7dbcc5c4e91154daa5acd83fea9a8" or $selection.target.file.md5 = "f3e521996c85c0cdb2bfb3a0fd91eb03e25ba6feef2ba3a1da844f1b17278dd2" or $selection.target.file.md5 = "1f2cd2bc23556fb84a51467fedb89cbde7a5883f49e3cfd75a241a6f08a42d6d" or $selection.target.file.md5 = "9ddacbcd0700dc4b9babcd09ac1cebe23a0035099cb612e6c85ff4dffd087a26"))

  condition:
    $selection
Raw source hidden_cobra_fastcash_malware_sysmon · YARA-L
Esc
Published by chronicle/detection-rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule hidden_cobra_fastcash_malware_sysmon {
 meta:
    author = "Alexandr Yampolskyi, SOC Prime"
    description = "HIDDEN COBRA FASTCash Malware Detector for Sysmon.  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/5hJwsTm4kTDu"
    version = "0.01"
    created = "2018/10/02"
    product = "windows"
    service = "sysmon"
    mitre = "Execution, t1035, t1177"

  events:
($selection.metadata.product_event_type = "1" and ($selection.target.file.md5 = "10ac312c8dd02e417dd24d53c99525c29d74dcbc84730351ad7a4e0a4b1a0eba" or $selection.target.file.md5 = "3a5ba44f140821849de2d82d5a137c3bb5a736130dddb86b296d94e6b421594c" or $selection.target.file.md5 = "4a740227eeb82c20286d9c112ef95f0c1380d0e90ffb39fc75c8456db4f60756" or $selection.target.file.md5 = "820ca1903a30516263d630c7c08f2b95f7b65dffceb21129c51c9e21cf9551c6" or $selection.target.file.md5 = "a9bc09a17d55fc790568ac864e3885434a43c33834551e027adb1896a463aafc" or $selection.target.file.md5 = "ab88f12f0a30b4601dc26dbae57646efb77d5c6382fb25522c529437e5428629" or $selection.target.file.md5 = "ca9ab48d293cc84092e8db8f0ca99cb155b30c61d32a1da7cd3687de454fe86c" or $selection.target.file.md5 = "d465637518024262c063f4a82d799a4e40ff3381014972f24ea18bc23c3b27ee" or $selection.target.file.md5 = "e03dc5f1447f243cf1f305c58d95000ef4e7dbcc5c4e91154daa5acd83fea9a8" or $selection.target.file.md5 = "f3e521996c85c0cdb2bfb3a0fd91eb03e25ba6feef2ba3a1da844f1b17278dd2" or $selection.target.file.md5 = "1f2cd2bc23556fb84a51467fedb89cbde7a5883f49e3cfd75a241a6f08a42d6d" or $selection.target.file.md5 = "9ddacbcd0700dc4b9babcd09ac1cebe23a0035099cb612e6c85ff4dffd087a26"))

  condition:
    $selection
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.