.- - -----÷M÷E÷N÷U÷------------------------------------------------------------- --- ---- -------------. ! WALL ! STATS ! GOODIES ! YARA ! FAQ ! RSS ! EMV ! `-------------- - --- ---------- -------- -------- -------- -------- ----------------- - ---- ---- --'
__ .- - ---_\/_---------÷Y÷A÷R÷A÷--÷R÷U÷L÷E÷S÷---------------------------------- --- ---- ----------------. ! \/\/ ! ¦ ¦ ¦ Below here are fews yara rules for research and detection. Theses rules are public and was made by ¦ ¦ individuals and security companies interested in ATM Malwares, feel free to use them. ¦ ¦ ¦ ¦ Plotus related rules: ¦ ¦ Ploutus_1.yar by RSA ECAT ¦ ¦ ploutusi_1.yar (Ploutus-I) by r3c0nst ¦ ¦ ¦ ¦ ¦ ¦ Tyupkin related rules: ¦ ¦ tyupkin_1.yar by RSA ECAT ¦ ¦ ¦ ¦ ¦ ¦ Suceful related rules: ¦ ¦ suceful_1.yar by RSA ECAT ¦ ¦ ¦ ¦ ¦ ¦ GreenDispenser related rules: ¦ ¦ greendispenser_1.yar by RSA ECAT ¦ ¦ ¦ ¦ ¦ ¦ Atmosphere related rules: ¦ ¦ atmosphere_1.yar by pekeinfo ¦ ¦ ¦ ¦ ¦ ¦ Patched KDIAG related rules: ¦ ¦ kdiag_1.yar by Kaspersky Lab ¦ ¦ ¦ ¦ ¦ ¦ Winpot related rules: ¦ ¦ winpot_1.yar by ximerus ¦ ¦ winpot_2.yar by Xylit0l ¦ ¦ ¦ ¦ HelloWorld related rules: ¦ ¦ helloworld_1.yar by Xylit0l ¦ ¦ helloworld_2.yar by r3c0nst ¦ ¦ ¦ ¦ ATMSpitter related rules: ¦ ¦ atmspitter_1.yar by Quoscient GmbH ¦ ¦ atmspitter_2.yar by Quoscient GmbH ¦ ¦ atmspitter_3.yar by r3c0nst ¦ ¦ ¦ ¦ ¦ ¦ ATMRipper related rules: ¦ ¦ atmripper_1.yar by SadFud ¦ ¦ atmripper_2.yar by r3c0nst ¦ ¦ ¦ ¦ Atmitch related rules: ¦ ¦ atmitch_1.yar by r3c0nst ¦ ¦ ¦ ¦ Java/DispCash related rules: ¦ ¦ javadispcash_1.yar by r3c0nst ¦ ¦ ¦ ¦ NVISOSPIT related rules: ¦ ¦ nvisospit_1.yar by r3c0nst ¦ ¦ ¦ ¦ XFSADM related rules: ¦ ¦ xfsadm_1.yar by r3c0nst ¦ ¦ ¦ ¦ XFSCashNCR related rules: ¦ ¦ xfscashncr_1.yar by r3c0nst ¦ ¦ ¦ ¦ XFS_Direct related rules: ¦ ¦ xfsdirect_1.yar by r3c0nst ¦ ¦ ¦ ¦ Alice related rules: ¦ ¦ alice_1.yar by r3c0nst ¦ ¦ ¦ ¦ DispCashBR related rules: ¦ ¦ adispcashbr_1.yar by r3c0nst ¦ ¦ ¦ ¦ ATM.Loup related rules: ¦ ¦ loup_1.yar by r3c0nst ¦ ¦ ¦ ¦ ¦ `----[cybercrime-tracker.net]----- - --- --------------------------------------------- - ---- ---- --'