100 Days of YARA – Day 12: Neshta

Neshta is a common virus targeting Windows executables. This rule should find files infected with Neshta.

rule neshta
{
	meta:
		description = "Files impacted by Neshta virus"
		hash = "769e6e12a5443217fd8c5ce510846775b714eb221cc11974969b5ff7442b5484"

	strings:
		$ = "Delphi-the best. Fuck off all the rest. Neshta "
		$ = "Made in Belarus."

	condition:
		all of them
}

YARA Rules Index

2 thoughts on “100 Days of YARA – Day 12: Neshta

  1. Pingback: YARA Rules Index – DMFR SECURITY

  2. Pingback: Week 01 – 2022 – This Week In 4n6

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s