YARA Detection Rule: Win32_Virus_Negt
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Yara rule that detects Negt virus.
Malware family: NEGT
Author: ReversingLabs

Pattern signatures:
$negt_body_and_infector_1 = {
            6A 00 E8 99 08 00 00 A3 ?? ?? ?? ?? 68 04 01 00 00 68 ?? ?? ?? ?? 6A 00 E8 7D 08 00 00 6A 00 68 ?? ?? ?? ?? 68 ?? ?? ??
            ?? E8 48 08 00 00 BB 00 00 00 00 8D 05 ?? ?? ?? ?? FE 00 68 ?? ?? ?? ?? E8 2D 00 00 00 43 83 FB 18 7C E8 E8 92 08 00 00
            3C 9F 7F 17 6A 01 68 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 6A 00 6A 00 E8 7D 08 00 00 6A 00 E8 10 08 00 00 55 8B EC 81 C4 B8
            FD FF FF FF 75 08 E8 35 08 00 00 0B C0 0F 84 C2 00 00 00 8D 85 C2 FE FF FF 50 68 ?? ?? ?? ?? E8 F2 07 00 00 89 85 BC FE
            FF FF 83 BD BC FE FF FF FF 0F 84 9E 00 00 00 8D 9D EE FE FF FF 53 E8 21 08 00 00 8B F3 BB 00 00 00 00 F7 D3 68 ?? ?? ??
            ?? 56 E8 01 08 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 F4 07 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 E7 07 00 00 23 D8 68 ?? ?? ?? ??
            56 E8 DA 07 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 CD 07 00 00 23 D8 83 FB 00 74 28 FF 75 08 68 ?? ?? ?? ?? E8 BF 07 00 00 8D
            85 EE FE FF FF 50 68 ?? ?? ?? ?? E

Detection condition:
uint16(0) == 0x5A4D and 
        (($negt_infector at pe.entry_point) or
        (($negt_body_and_infector_1 at pe.entry_point) and $negt_body_and_infector_2 and
        $negt_body_and_infector_3 and $negt_body_and_infector_4))

Full rule:
rule Win32_Virus_Negt : tc_detection malicious
{
    meta:

        author              = "ReversingLabs"

        source              = "ReversingLabs"
        status              = "RELEASED"
        sharing             = "TLP:WHITE"
        category            = "MALWARE"
        malware             = "NEGT"
        description         = "Yara rule that detects Negt virus."

        tc_detection_type   = "Virus"
        tc_detection_name   = "Negt"
        tc_detection_factor = 5

    strings:
        $negt_body_and_infector_1 = {
            6A 00 E8 99 08 00 00 A3 ?? ?? ?? ?? 68 04 01 00 00 68 ?? ?? ?? ?? 6A 00 E8 7D 08 00 00 6A 00 68 ?? ?? ?? ?? 68 ?? ?? ??
            ?? E8 48 08 00 00 BB 00 00 00 00 8D 05 ?? ?? ?? ?? FE 00 68 ?? ?? ?? ?? E8 2D 00 00 00 43 83 FB 18 7C E8 E8 92 08 00 00
            3C 9F 7F 17 6A 01 68 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 6A 00 6A 00 E8 7D 08 00 00 6A 00 E8 10 08 00 00 55 8B EC 81 C4 B8
            FD FF FF FF 75 08 E8 35 08 00 00 0B C0 0F 84 C2 00 00 00 8D 85 C2 FE FF FF 50 68 ?? ?? ?? ?? E8 F2 07 00 00 89 85 BC FE
            FF FF 83 BD BC FE FF FF FF 0F 84 9E 00 00 00 8D 9D EE FE FF FF 53 E8 21 08 00 00 8B F3 BB 00 00 00 00 F7 D3 68 ?? ?? ??
            ?? 56 E8 01 08 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 F4 07 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 E7 07 00 00 23 D8 68 ?? ?? ?? ??
            56 E8 DA 07 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 CD 07 00 00 23 D8 83 FB 00 74 28 FF 75 08 68 ?? ?? ?? ?? E8 BF 07 00 00 8D
            85 EE FE FF FF 50 68 ?? ?? ?? ?? E8 A2 07 00 00 68 ?? ?? ?? ?? E8 08 01 00 00 8D 85 C2 FE FF FF 50 FF B5 BC FE FF FF E8
            50 07 00 00 83 F8 00 0F 85 62 FF FF FF FF B5 BC FE FF FF E8 30 07 00 00 8D 85 C2 FE FF FF 50 68 ?? ?? ?? ?? E8 25 07 00
            00 89 85 BC FE FF FF 83 BD BC FE FF FF FF 0F 84 AF 00 00 00 8D BD C2 FE FF FF 8B 07 66 83 E0 10 0F 84 82 00 00 00 8D 9D
        }

        $negt_body_and_infector_2 = {
            EE FE FF FF 53 E8 42 07 00 00 8B F3 BB 00 00 00 00 F7 D3 68 ?? ?? ?? ?? 56 E8 2