capa-rules

capa-rules copied to clipboard

Idea - Malicious Libraries in TRJ_BANKER

3

Hi, what is the best way to create rule/rules to detect these suspicious libraries?  Would it be a rule for each library? Ref.: https://www.welivesecurity.com/2021/04/06/janeleiro-time-traveler-new-old-banking-trojan-brazil/

johnk3r

anushkavirgaonkar

Guards for rules with multiple "formats"

1

Create a standard to guard rules with multiple formats, e.g. binary, script, and .NET. I like the idea of `matches: xyz technology` where we expect the former to be included...

mr-tz

see dfd6...c4e0 - number: 56 - bytes: see constant tables e.g. in https://github.com/libtom/libtomcrypt/blob/develop/src/ciphers/des.c

mr-tz

I noticed that the current .NET rules missed a lot of functionality/API calls that the aspx test malware includes. I therefore modified the currently available rules and created new ones...

adamstorek

link: https://github.com/yck1509/ConfuserEx/blob/master/Confuser.Runtime/antinet/AntiManagedProfiler.cs

mike-hunhoff

check .NET-Anti-Debug coverage

5

https://github.com/Outbuilt/.NET-Anti-Debug

mike-hunhoff

https://github.com/Mecanik/Anti-DebugNET

mike-hunhoff

## Prerequisites * [x] Put an X between the brackets on this line if you have done all of the following: * Checked that your rule idea isn't already filed:...

re-fox

## Features - export: DllGetClassObject - (export: DllRegisterServer) ## Additional context https://docs.microsoft.com/en-us/windows/win32/api/combaseapi/nf-combaseapi-dllgetclassobject

mr-tz