WaterBug_fa_malware

YARA detection rule by Symantec Security Response · GPL-2.0

Symantec Waterbug Attack - FA malware variant

rule WaterBug_fa_malware 
{ 

    meta: 
        description = "Symantec Waterbug Attack - FA malware variant"
        author = "Symantec Security Response"
        date = "22.01.2015"
        reference = "http://t.co/rF35OaAXrl"

    strings:
        $mz = "MZ"
        $string1 = "C:\\proj\\drivers\\fa _ 2009\\objfre\\i386\\atmarpd.pdb"
        $string2 = "d:\\proj\\cn\\fa64\\"
        $string3 = "sengoku_Win32.sys\x00"
        $string4 = "rk_ntsystem.c"
        $string5 = "\\uroboros\\"
        $string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"

    condition:
        ($mz at 0) and (any of ($string*))
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0ae1b4b9-a6cb-412a-9b32-ec35533838d3

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion