(YARA) YARA_Base64

Download Raw

rule golang_base64_enc {
	meta:
		author = "RussianPanda"
		decription = "Detects Base64 Encoding and Decoding patterns in Golang binaries"
        	reference = "https://unprotect.it/technique/base64/"
		date = "1/10/2024"
		hash = "509a359b4d0cd993497671b91255c3775628b078cde31a32158c1bc3b2ce461c"
	strings:
	        $s1 = {62 61 73 65 36 34 2e 53 74 64 45 6e 63 6f 64 69 6e 67 2e 45 6e 63 6f 64 65 54 6f 53 74 72 69 6e 67 28 [0-15] 29}
	        $s2 = {62 61 73 65 36 34 2e 53 74 64 45 6e 63 6f 64 69 6e 67 2e 44 65 63 6f 64 65 53 74 72 69 6e 67 28 [0-15] 29}
	        $s3 = {69 66 20 65 72 72 20 21 3D 20 6E 69 6C 20 7B}
		$s4 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
 	condition:
		all of ($s*) 
        	and uint16(0) == 0x5A4D
}


rule base64_enc {
	meta:
		author = "RussianPanda"
		decription = "Detects Base64 Encoding"
        	reference = "https://unprotect.it/technique/base64/"
		date = "1/10/2024"
		hash = "09506d1af5d8e6570b2b7d05143f444f5685d2a9f3304780ef376edf7b2d79e6"
	strings:
		$s2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
        	$s3 = {83 E? 3F}
 	condition:
		all of ($s*) 
        	and uint16(0) == 0x5A4D
		
}

Associated Techniques

Technique Name Technique ID's Snippet(s) OS
Base64 U0706 E1027.m02

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
honeypot.exe 5 2024-12-04 2 hours, 54 minutes ago
Xulytaikhoan.xlsx 14 2024-11-26 1 week, 1 day ago
Setup.exe 5 2024-11-25 1 week, 2 days ago
8126a59c84aad134868c842eabc2...204cd859e6322d22ce5a3b937e2a 5 2024-11-19 2 weeks, 1 day ago
8e9583fb455e3381e29e40af8533...833f37f2d6927cb25dde2f3d4085 4 2024-11-19 2 weeks, 1 day ago
765edfc0c20fa35b84f7b36bf280...87d29cdf96ac9712ee6e05f59056 6 2024-11-19 2 weeks, 1 day ago
315194f647f925de53ce6f014d64...9fb23070d253276b626a132557e8 10 2024-11-19 2 weeks, 1 day ago
implant.exe 6 2024-11-18 2 weeks, 2 days ago
KnightOnLine.exe 7 2024-11-17 2 weeks, 2 days ago
chelentano.exe 5 2024-11-16 2 weeks, 4 days ago
View All

Created

January 11, 2024

Last Revised

January 11, 2024