APT_Neuron2_Loader_Strings

Description

Rule for detection of Neuron2 based on strings within the loader

Query · yara

strings:
      $ = "dcom_api" ascii
      $ = "http://*:80/OWA/OAB/" ascii
      $ = "https://*:443/OWA/OAB/" ascii
      $ = "dcomnetsrv.cpp" wide
      $ = "dcomnet.dll" ascii
      $ = "D:\\Develop\\sps\\neuron2\\x64\\Release\\dcomnet.pdb" ascii
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 2 of them
Raw source APT_Neuron2_Loader_Strings · YARA
Esc
Published by Neo23x0/signature-base ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
rule APT_Neuron2_Loader_Strings {
   meta:
      description = "Rule for detection of Neuron2 based on strings within the loader"
      author = "NCSC"
      referer = "https://otx.alienvault.com/pulse/5dad718fa5ec6c21e85c1c66"
      hash = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
      id = "eaef4710-1971-55a2-9079-07a9b8bd86eb"
   strings:
      $ = "dcom_api" ascii
      $ = "http://*:80/OWA/OAB/" ascii
      $ = "https://*:443/OWA/OAB/" ascii
      $ = "dcomnetsrv.cpp" wide
      $ = "dcomnet.dll" ascii
      $ = "D:\\Develop\\sps\\neuron2\\x64\\Release\\dcomnet.pdb" ascii
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 2 of them
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.