Threat

rule VirTool_Win32_Meterpreter_A_2147754325_0
{
    meta:
        author = "defender2yara"
        detection_name = "VirTool:Win32/Meterpreter.gen!A!!Meterpreter.gen!A"
        threat_id = "2147754325"
        type = "VirTool"
        platform = "Win32: Windows 32-bit platform"
        family = "Meterpreter"
        severity = "Critical"
        info = "gen: malware that is detected using a generic signature"
        info = "Meterpreter: an internal category used to refer to some threats"
        info = "gen: malware that is detected using a generic signature"
        info = "A: an internal category used to refer to some threats"
        signature_type = "SIGNATURE_TYPE_ARHSTR_EXT"
        threshold = "7"
        strings_accuracy = "High"
    strings:
        $x_1_1 = "MeterpreterProcess(MeterpreterChannel)" ascii //weight: 1
        $x_1_2 = "super(MeterpreterSocketUDPClient" ascii //weight: 1
        $x_1_3 = "PythonMeterpreter(transport)" ascii //weight: 1
        $x_1_4 = "add_channel(MeterpreterSocketTCPClient" ascii //weight: 1
        $x_1_5 = "xor_bytes(xor_key" ascii //weight: 1
        $x_1_6 = "runcode(compile" ascii //weight: 1
        $x_1_7 = "_try_to_fork" ascii //weight: 1
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}