Skip to content

Commit ea7eea7

Browse files
authored
Merge pull request #10 from Slavetomints/edit/minecraft-post-iocs
edit: ioc presentation on minecraft RAT post
2 parents 8e9f0fe + 6b162be commit ea7eea7

1 file changed

Lines changed: 3 additions & 19 deletions

File tree

_posts/2025-07-10-just-another-minecraft-rat.md

Lines changed: 3 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -151,25 +151,9 @@ This malware was made for Minecraft users, so in addition to general system cont
151151
- `cookiehelp`, which gives a step-by-step guide on how to exploit stolen cookies
152152
- `logincookiehelp`, which explains how to stay secure if you suspect you've been a victim. An interesting thing to include in this program.
153153

154-
### YARA Detection Rule
154+
## Indicators of Compromise
155155

156-
```
157-
rule MinecraftRat
158-
{
159-
meta:
160-
description = "Detects known RAT based on Discord and ChatTriggers behavior"
161-
author = "DeTraced Security"
162-
reference = "https://detraced.org"
163-
strings:
164-
$url = "hst.sh/raw/"
165-
$regkey = "DisableShutdown"
166-
$vbscript = "{CAPSLOCK}"
167-
$powershell = "SetCursorPos"
168-
condition:
169-
all of them
170-
}
171-
```
172-
{: file="rule.yara" }
156+
*For the full list of IOCs and YARA rules, please check out [DeTraced-Security/detection-rules](https://github.com/DeTraced-Security/detection-rules/tree/main/malware/chattriggers-rat)*
173157

174158
### Hashes
175159

@@ -183,7 +167,7 @@ rule MinecraftRat
183167
| SHA-512 | 1f7c732e6903fabf985fafe90b628c4dcd5b96b92807b83420b8d1bab4de91267508e33ca0ad1402ba200159a2d8c411227fd9265a5ae3b779318f9928bce3b8 |
184168

185169

186-
### input_lock.vbs
170+
## input_lock.vbs
187171
```vb
188172
Set WShell = CreateObject("WScript.Shell")
189173

0 commit comments

Comments
 (0)