text Yara GoTrojan

Posted 2021-05-03

rule Carbanak_Go_Trojan
{

    meta:
        author = “RSA FW”

    strings:
        $mz = { 4D 5A }
        $build_id = “Go build ID:
        \”33ee104ab2c9fc37c067a26623e7fddd3bb76302\””
        $string = “xname.txt”
        $sgc = “2.16.840.1.113730.4.1”
        $msc = “1.3.6.1.4.1.311.10.3.3”
    condition:
        $mz at 0 and ($build_id or ($string and #sgc and $msc))
}