hatman_compiled_python

Description

Detects Hatman malware

Query · yara

condition:
        hatman_nullsub and hatman_setstatus and hatman_dividers

Rule dependencies

Depends on

Raw source hatman_compiled_python · YARA
Esc
Published by Neo23x0/signature-base ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
rule hatman_compiled_python : hatman {
    meta:
        description = "Detects Hatman malware"
        reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
        date = "2017/12/19"
        author = "DHS/NCCIC/ICS-CERT"
        id = "fd156669-72b4-59a5-8f36-aac21d7b3105"
    condition:
        hatman_nullsub and hatman_setstatus and hatman_dividers
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.