Closed kkneomis closed 1 year ago
changed the way malware configs are defines to allow for custom hashes to be injected
Went from
name: goldenrabbit filenames: - a.exe - svchost.exe - msdtc.exe paths: - C:\ProgramData\PST\ - C:\ recon_processes:
To:
name: goldenrabbit files: - filename: a.exe hashes: - 42530f9f92f2440d66b96e610d07b5256566fe47af2fd6e01cd9e1cd9b85c01e - filename: svchost.exe hashes: - 9bd6a46182f145240e766380d2df56f299ef36dc05ed1f4637b75514c4fd051e - 0c3eff5d888cfd0c4c7f1cbc43fad5ca529e70c1a7edc6fcafadca9ebf1e3f88 - b54a65ca16116b92c6fe5eb6c046b5e7e91aab377703ad51c7def93f725a8c42 - filename: msdtc.exe paths: - C:\ProgramData\PST\ - C:\
changed the way malware configs are defines to allow for custom hashes to be injected
Went from
To: