Skip to content

Commit 9aab9de

Browse files
committed
Revert "Update apt_apt36_operation_sindoor.yar"
This reverts commit df9b9c8.
1 parent df9b9c8 commit 9aab9de

File tree

1 file changed

+2
-4
lines changed

1 file changed

+2
-4
lines changed

yara/apt_apt36_operation_sindoor.yar

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
import "pe"
2-
31
rule SUSP_LNX_Sindoor_ELF_Obfuscation_Aug25 {
42
meta:
53
description = "Detects ELF obfuscation technique used by Sindoor dropper related to APT 36"
@@ -52,7 +50,7 @@ rule MAL_Sindoor_Decryptor_Aug25 {
5250
condition:
5351
filesize < 100MB
5452
and (
55-
uint16(0) == 0x5a4d // Windows
53+
uint16(0) == 0x5a4d // Windows
5654
or uint32be(0) == 0x7f454c46 // Linux
5755
or (uint32be(0) == 0xcafebabe and uint32be(4) < 0x20) // Universal mach-O App with dont-match-java-class-file hack
5856
or uint32(0) == 0xfeedface // 32-bit mach-O
@@ -78,7 +76,7 @@ rule MAL_Sindoor_Downloader_Aug25 {
7876
condition:
7977
filesize < 100MB
8078
and (
81-
uint16(0) == 0x5a4d // Windows
79+
uint16(0) == 0x5a4d // Windows
8280
or uint32be(0) == 0x7f454c46 // Linux
8381
or (uint32be(0) == 0xcafebabe and uint32be(4) < 0x20) // Universal mach-O App with dont-match-java-class-file hack
8482
or uint32(0) == 0xfeedface // 32-bit mach-O

0 commit comments

Comments
 (0)