ATM.Malware.ATMSpitter.yar

import "hash"	

rule ATM_Malware_ATMSpitter {
  meta:
		description = "Detects ATM Malware ATMSpitter"
		author = "Frank Boldewin (@r3c0nst)"
		reference1 = "https://www.straitstimes.com/asia/east-asia/thieves-steal-3-million-in-taiwan-atm-heist-with-help-of-malware"
		reference2 = "https://topics.amcham.com.tw/2017/02/looking-back-at-the-first-banks-atm-heist/"
		date = "2016-07-20"
		hash = "658b0502b53f718bd0611a638dfd5969"
	
	strings:
		$Code_Bytes =  { B9 E0 07 00 00 66 ?? ?? ?? ?? 0F 85 DD 02 00 00 66 ?? ?? ?? ?? ?? 0F 85 D1 02 00 00 }
		
		$Service = "Congratulations! You are very skilled in reverse engineering!" nocase ascii
	
	condition:
		(hash.sha256(0, filesize) == "4035d977202b44666885f9781ac8755c799350a03838ff782eb730c0d7069958")
		or ($Code_Bytes and $Service)
		
}