DefenderYara/Exploit/Win64/Sandsquarev/Exploit_Win64_Sandsquarev_C.yar

rule Exploit_Win64_Sandsquarev_C{
	meta:
		description = "Exploit:Win64/Sandsquarev.C,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 "
		
	strings :
		$a_80_0 = {7b 30 61 66 61 63 65 64 31 2d 65 38 32 38 2d 31 31 64 31 2d 39 31 38 37 2d 62 35 33 32 66 31 65 39 35 37 35 64 7d 5c } //{0afaced1-e828-11d1-9187-b532f1e9575d}\  1
		$a_80_1 = {5c 74 61 72 67 65 74 2e 6c 6e 6b } //\target.lnk  1
		$a_02_2 = {3c 00 68 00 74 00 6d 00 6c 00 3e 00 3c 00 62 00 6f 00 64 00 79 00 3e 00 3c 00 73 00 63 00 72 00 69 00 70 00 74 00 3e 00 90 02 a0 3c 00 2f 00 73 00 63 00 72 00 69 00 70 00 74 00 3e 00 3c 00 2f 00 62 00 6f 00 64 00 79 00 3e 00 3c 00 2f 00 68 00 74 00 6d 00 6c 00 3e 00 90 00 } //1
		$a_02_3 = {3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 3e 90 02 a0 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 90 00 } //1
	condition:
		((#a_80_0  & 1)*1+(#a_80_1  & 1)*1+(#a_02_2  & 1)*1+(#a_02_3  & 1)*1) >=3
 
}