Live Stream VOD: Yara Triage How-To with SoulSearcher Malware and a Mystery Worm
Added 2023-03-03 22:50:49 +0000 UTCIn this Twitch stream we work through the process of triaging a bad Yara rule and disambiguating the relationship between SoulSearcher Malware and a mystery worm!
Yara Rule
Soul Searcher Samples
All samples available on UnpacMe
- 579fa00bc212a3784d523f8ddd0cfc118f51ca926d8f7ea2eb6e27157ec61260
- 69a9ab243011f95b0a1611f7d3c333eb32aee45e74613a6cddf7bcb19f51c8ab
- 0f7af0cad4aade0e7058051a449059b35358ddda075d88b2d289625adc02deef
- 1af5252cadbe8cef16b4d73d4c4886ee9cecddd3625e28a59b59773f5a2a9f7f
- a6f75af45c331a3fac8d2ce010969f4954e8480cbe9f9ea19ce3c51c44d17e98
- c4efb58723fd75d51eb92302fbd7541e4462f438282582b5efa3c6c7685e69fd
Worm Samples
All samples available on UnpacMe
- 7a9397dc47ce8a604c359da17dded029580b56cc6d988e841eaaabe622b23fa4
- b3ba13bbd74e20a40d9c02c0398a474c93a352322211561f35d60cdc26739477
- a36f318370a5ace5f9c4611c1f8edfffdb05dd8e109a3dd2127ca3881670d7bd
- a803aa42fe614cafdb86da10d730cecbc8a2432eb7080fd004e640cc536b595c
- fc2642273c70d99a172ce45f57fe02d7f65b0ecd2b29b882ce84d0f3e01c8197
Notes
Comments
yeh it's crazy, Sean and I see this all the time... "new malware?" nope just 10k copies of a worm from 2005 lol!
OALABS
2023-03-06 19:15:08 +0000 UTCThat is the problem with sample streams in general, they are full of worms, and it is annoying when you have to work with them X) E.g. some training their AI on them and then in the real world it does not work as good as expected because worms are not nearly as prevalent in the wild.
Karsten Hahn
2023-03-06 05:07:17 +0000 UTC
