Merge pull request #868 from avast/LZ_Installer_Viseman

Added YARA rule for VISEMAN installer
avast · Oct 14, 2020 · c3df2c4 · c3df2c4
2 parents ab54a03 + 467a82a
commit c3df2c4
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/support/yara_patterns/tools/pe/x86/installers.yara b/support/yara_patterns/tools/pe/x86/installers.yara
@@ -642,6 +642,16 @@ rule thinstall_3348_3350_vs {
 		$1 at pe.entry_point
 }
 
+rule viseman {
+	meta:
+		tool = "I"
+		name = "Viseman Installer"
+	condition:
+		pe.overlay.offset != 0 and
+		pe.overlay.size > 4 and
+		uint32(pe.overlay.offset) == 0x56495345     // Reversed "VISE"
+}
+
 rule wise_installer_uv_01 {
 	meta:
 		tool = "I"