intel-virtualization-malware.yaml

id: intel-virtualization-malware

info:
  name: Intel Virtualization Malware - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Intel_Virtualization.yar
  tags: malware,file
file:
  - extensions:
      - all

    matchers-condition: and
    matchers:
      - type: binary
        binary:
          - '4C6F6164535452494E47'
          - '496E697469616C697A654B6579486F6F6B'
          - '46696E645265736F7572636573'
          - '4C6F6164535452494E4746726F6D484B4355'
          - '6863637574696C732E444C4C'
        condition: and

      - type: binary
        binary:
          - '483A5C466173745C506C756728686B636D64295C'
          - '646C6C5C52656C656173655C48696A61636B446C6C2E706462'
        condition: and

# digest: 490a00463044022013d609856dcbea597a8972ccf79c7efbaf74a453066aa09f49f30de2d3ca41af022047495390e0f0cff609552ada8a7e3c8310f2bfb9322a392bbdd64db5f2140688:922c64590222798bb761d5b6d8e72950