DefenderYara/Worm/Win32/Rebhip/Worm_Win32_Rebhip_F.yar

rule Worm_Win32_Rebhip_F{
	meta:
		description = "Worm:Win32/Rebhip.F,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 05 00 07 00 00 "
		
	strings :
		$a_00_0 = {48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 5c 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 5c 00 4c 00 69 00 6d 00 65 00 57 00 69 00 72 00 65 00 5c 00 5c 00 } //1 HKEY_LOCAL_MACHINE\\SOFTWARE\\LimeWire\\
		$a_01_1 = {5a 69 70 53 70 72 65 61 64 } //2 ZipSpread
		$a_01_2 = {41 6e 74 69 4d 61 6c 77 61 72 65 62 79 74 65 73 } //3 AntiMalwarebytes
		$a_00_3 = {73 00 68 00 65 00 6c 00 6c 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 3d 00 55 00 53 00 42 00 20 00 44 00 69 00 73 00 6b 00 20 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 20 00 76 00 2e 00 31 00 2e 00 38 00 2e 00 30 00 2e 00 31 00 2e 00 65 00 78 00 65 00 } //3 shellexecute=USB Disk Security v.1.8.0.1.exe
		$a_00_4 = {73 00 63 00 2e 00 65 00 78 00 65 00 20 00 63 00 6f 00 6e 00 66 00 69 00 67 00 20 00 41 00 6e 00 74 00 69 00 56 00 69 00 72 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 73 00 74 00 61 00 72 00 74 00 3d 00 20 00 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 64 00 } //3 sc.exe config AntiVirService start= disabled
		$a_01_5 = {41 56 4b 69 6c 6c 65 72 73 69 6e 42 69 6e 64 65 72 } //2 AVKillersinBinder
		$a_01_6 = {41 65 6f 6e 48 61 63 6b 52 75 6e 50 45 } //2 AeonHackRunPE
	condition:
		((#a_00_0  & 1)*1+(#a_01_1  & 1)*2+(#a_01_2  & 1)*3+(#a_00_3  & 1)*3+(#a_00_4  & 1)*3+(#a_01_5  & 1)*2+(#a_01_6  & 1)*2) >=5
 
}