MacGyver.cap Installer Malware - Detect
ID: macgyver-installer-malware
Severity: info
Author: daffainfo
Tags: malware,file
Description
Section titled “Description”YAML Source
Section titled “YAML Source”id: macgyver-installer-malware
info: name: MacGyver.cap Installer Malware - Detect author: daffainfo severity: info reference: - https://github.com/fboldewin/MacGyver-s-return---An-EMV-Chip-cloning-case/blob/master/MacGyver's%20return%20-%20An%20EMV%20Chip%20cloning%20case.pdf - https://github.com/Yara-Rules/rules/blob/master/malware/MALW_MacGyver.yar tags: malware,filefile: - extensions: - all matchers: - type: word part: raw words: - "delete -AID 315041592e5359532e4444463031" - "install -file MacGyver.cap -nvDataLimit 1000 -instParam 00 -priv 4" - "-mac_key 404142434445464748494a4b4c4d4e4f" - "-enc_key 404142434445464748494a4b4c4d4e4f" condition: and# digest: 4b0a004830460221009dfeca0ec91485f4e3c4d4b20196645189e462541e06e1caf860b6e84097324e022100a40514e8eec298019e34d2c1cf5e7076be30a33cbf61fb7820fda7552c1d78ea:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "file/malware/macgyver-installer-malware.yaml"