GlassWorm Malware Executable and Logging Activity
The first rule, 'GlassWorm_Malware_Executable', detects GlassWorm malware executables by looking for a combination of specific string patterns and the presence of 'logs.txt'. It requires the file to be a Windows executable (MZ header). The detection logic combines multiple conditions, including the presence of specific character patterns ($char_pattern1, $char_pattern2, $char_pattern3) along with 'logs.txt', and optionally regex patterns related to 'glassworm' in names, filenames, or function names. The rule also enforces minimum counts for 'logs.txt' and the character patterns. The second rule, 'GlassWorm_Logging_Activity', focuses on detecting GlassWorm logging activity within a Windows executable. It requires the presence of 'logs.txt' and specific character patterns ($char_pattern1, $char_pattern2, $char_pattern3), with stricter minimum occurrence counts for 'logs.txt' compared to the first rule. Both rules are designed to identify GlassWorm based on its characteristic strings and logging behavior.
YARA
