assemblyline 4.3.2.dev35__tar.gz → 4.3.2.dev36__tar.gz

{assemblyline-4.3.2.dev35/assemblyline.egg-info → assemblyline-4.3.2.dev36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: assemblyline
-Version: 4.3.2.dev35
+Version: 4.3.2.dev36
 Summary: Assemblyline 4 - Automated malware analysis framework
 Home-page: https://github.com/CybercentreCanada/assemblyline-base
 Author: CCCS Assemblyline development team

assemblyline-4.3.2.dev36/assemblyline/VERSION

@@ -0,0 +1 @@
+4.3.2.dev36

{assemblyline-4.3.2.dev35 → assemblyline-4.3.2.dev36}/assemblyline/common/custom.yara

@@ -718,8 +718,9 @@ rule code_batch {
         $obf1 = /%[^:\n\r%]+:~[ \t]*[\-+]?\d{1,3},[ \t]*[\-+]?\d{1,3}%/
         // Example: %blah1%%blah2%%blah3%%blah4%%blah5%%blah6%%blah7%%blah8%%blah9%%blah10%
         $obf2 = /\%([^:\n\r\%]+(\%\%)?)+\%/
+        $power1 = /(^|\n|@|&)\^?p(\^|%.+%)?o(\^|%.+%)?w(\^|%.+%)?e(\^|%.+%)?r(\^|%.+%)?s(\^|%.+%)?h(\^|%.+%)?e(\^|%.+%)?l(\^|%.+%)?l(\^|%.+%)?(\.(\^|%.+%)?e(\^|%.+%)?x(\^|%.+%)?e(\^|%.+%)?)?.+(-c|-command)(\^|%.+%)?[ \t]/i
         // powershell does not need to be followed with -c or -command for it to be considered batch
-        $power = /(^|\n|@|&|\b)\^?p(\^|%.+%)?o(\^|%.+%)?w(\^|%.+%)?e(\^|%.+%)?r(\^|%.+%)?s(\^|%.+%)?h(\^|%.+%)?e(\^|%.+%)?l(\^|%.+%)?l(\^|%.+%)?(\.(\^|%.+%)?e(\^|%.+%)?x(\^|%.+%)?e(\^|%.+%)?)?.+(-c|-command)?(\^|%.+%)?[ \t]/i
+        $power2 = /(^|\n|@|&|\b)\^?p(\^|%.+%)?o(\^|%.+%)?w(\^|%.+%)?e(\^|%.+%)?r(\^|%.+%)?s(\^|%.+%)?h(\^|%.+%)?e(\^|%.+%)?l(\^|%.+%)?l(\^|%.+%)?(\.(\^|%.+%)?e(\^|%.+%)?x(\^|%.+%)?e(\^|%.+%)?)?.+(-c|-command)?(\^|%.+%)?[ \t]/i
         $cmd1 = /(^|\n|@|&)(echo|netsh|goto|pkgmgr|del|netstat|timeout|taskkill|vssadmin|tasklist|schtasks)[ \t][\/]?\w+/i
         $cmd2 = /(^|\n|@|&)net[ \t]+(share|stop|start|accounts|computer|config|continue|file|group|localgroup|pause|session|statistics|time|use|user|view)/i
         $cmd3 = /(^|\n|@|&)reg[ \t]+(delete|query|add|copy|save|load|unload|restore|compare|export|import|flags)[ \t]+/i
@@ -733,7 +734,8 @@ rule code_batch {
     condition:
         (mime startswith "text" or $bom at 0)
         and (for 1 of ($obf1) :( # > 3 )
-             or ($power and 1 of ($cmd*))
+             or $power1
+             or ($power2 and 1 of ($cmd*))
              or for 1 of ($cmd*) :( # > 3 )
              or $exp
              or (2 of ($cmd*)

{assemblyline-4.3.2.dev35 → assemblyline-4.3.2.dev36/assemblyline.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: assemblyline
-Version: 4.3.2.dev35
+Version: 4.3.2.dev36
 Summary: Assemblyline 4 - Automated malware analysis framework
 Home-page: https://github.com/CybercentreCanada/assemblyline-base
 Author: CCCS Assemblyline development team

assemblyline-4.3.2.dev35/assemblyline/VERSION

@@ -1 +0,0 @@
-4.3.2.dev35