Magic-Mirror/retdec
1
0
Fork 0
mirror of https://github.com/avast/retdec.git synced 2024-11-23 13:00:13 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Added detection of Advanced Installler

Browse Source
This commit is contained in:
Ladislav Zezula 2023-05-18 09:19:32 +02:00
parent 407f290c23
commit 27a2ab119c
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
support/yara_patterns/tools/pe/x86/installers.yara
View File

@ -5,6 +5,24 @@
import "pe"
rule advanced_installer
{
meta:
tool = "I"
name = "Advanced Installer"
strength = "high"
strings:
$s00 = "ADVINSTSFX"
$s01 = "Software\\Caphyon\\Advanced Installer\\"
$s02 = "Detected working Internet connection." wide
$s03 = "<< Advanced Installer (x86) Log >>" wide
$s04 = "=====================End of Log=====================" wide
$s05 = "REINSTALL=ALL REINSTALLMODE=vomus" wide
condition:
pe.number_of_sections == 5 and
all of them
}
rule arc_sfx {
meta:
tool = "I"