DefenderYara/TrojanDownloader/O97M/Obfuse/TrojanDownloader_O97M_Obfuse_IX_MTB.yar

rule TrojanDownloader_O97M_Obfuse_IX_MTB{
	meta:
		description = "TrojanDownloader:O97M/Obfuse.IX!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 00 "
		
	strings :
		$a_01_0 = {74 6c 79 2e 63 6f 6d 22 2c 20 22 } //1 tly.com", "
		$a_01_1 = {3d 20 53 68 65 6c 6c 28 4b 64 31 20 2b 20 4b 64 32 20 2b 20 4b 64 33 29 } //1 = Shell(Kd1 + Kd2 + Kd3)
		$a_03_2 = {74 68 69 72 64 20 3d 20 28 74 68 69 72 64 20 2b 20 [0-09] 28 73 65 63 6f 6e 64 29 20 2b 20 66 6f 75 72 74 68 28 73 65 63 6f 6e 64 20 4d 6f 64 20 4c 65 6e 28 [0-09] 29 29 29 20 4d 6f 64 20 32 35 36 } //1
		$a_03_3 = {66 6f 75 72 74 68 28 73 65 63 6f 6e 64 29 20 3d 20 66 6f 75 72 74 68 28 73 65 63 6f 6e 64 29 20 58 6f 72 20 [0-09] 28 54 65 6d 70 20 2b 20 [0-09] 28 28 74 68 69 72 64 20 2b 20 [0-09] 28 74 68 69 72 64 29 29 20 4d 6f 64 20 32 35 34 29 29 } //1
		$a_01_4 = {28 74 68 69 72 64 29 20 2b 20 31 29 20 4d 6f 64 20 32 35 36 } //1 (third) + 1) Mod 256
		$a_03_5 = {28 28 74 68 69 72 64 20 2b 20 [0-09] 28 74 68 69 72 64 29 29 20 4d 6f 64 20 32 35 34 29 29 } //1
		$a_03_6 = {44 69 6d 20 [0-09] 28 30 20 54 6f 20 32 35 35 29 20 41 73 20 49 6e 74 65 67 65 72 2c 20 73 65 63 6f 6e 64 20 41 73 20 49 6e 74 65 67 65 72 2c 20 74 68 69 72 64 20 41 73 20 4c 6f 6e 67 2c 20 66 6f 75 72 74 68 28 29 20 41 73 20 42 79 74 65 } //1
	condition:
		((#a_01_0  & 1)*1+(#a_01_1  & 1)*1+(#a_03_2  & 1)*1+(#a_03_3  & 1)*1+(#a_01_4  & 1)*1+(#a_03_5  & 1)*1+(#a_03_6  & 1)*1) >=7
 
}