apt_RU_MoonlightMaze_encrypted_keylog

Description

Rule to detect Moonlight Maze encrypted keylogger logs

Query · yara

strings:
	$a1={47 01 22 2A 6D 3E 39 2C}

condition:
	uint32(0) == 0x2a220147 and ($a1 at 0)
Raw source apt_RU_MoonlightMaze_encrypted_keylog · YARA
Esc
Published by Neo23x0/signature-base ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
rule apt_RU_MoonlightMaze_encrypted_keylog {

meta:

	author = "Kaspersky Lab"
	date = "2017-03-27"
	version = "1.0"
	last_modified = "2017-03-27"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect Moonlight Maze encrypted keylogger logs"

	id = "f0d464f0-3955-5f41-a57f-8aa225e1171d"
strings:
	$a1={47 01 22 2A 6D 3E 39 2C}

condition:
	uint32(0) == 0x2a220147 and ($a1 at 0)

}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.