100 Days of YARA – Day 35: nanomet

nanomet is another meterpreter stager, similar to TinyMet, written in C: https://github.com/kost/nanomet

I have encountered this malware in real-life intrusions and at attack/defend CTFs.

rule nanomet
{
	meta:
		description = "https://github.com/kost/nanomet"

	strings:
		$a = "github.com/kost/nanomet"
		$b = "nanomet.exe"
		$c = "Available transports are as follows:"

	condition:
		all of them
}

YARA Rules Index

One thought on “100 Days of YARA – Day 35: nanomet

  1. Pingback: Week 05 – 2022 – This Week In 4n6

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s