11 lines
893 B
Plaintext
11 lines
893 B
Plaintext
|
|
||
|
|
rule Exploit_Win32_Senglot_B{
|
||
|
|
meta:
|
||
|
|
description = "Exploit:Win32/Senglot.B,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 01 00 "
|
||
|
|
|
||
|
|
strings :
|
||
|
|
$a_01_0 = {90 33 c0 33 c9 eb 12 5e 66 b9 00 ef 8b fe 80 2e 02 80 36 0a 46 e2 f7 eb 05 e8 e9 ff ff ff e9 aa 00 00 00 5f 64 a1 30 00 00 00 8b 40 0c 8b 70 1c ad 8b 68 08 8b f7 6a 04 59 e8 4a 00 00 00 e2 f9 68 6f 6e 00 00 68 75 72 6c 6d 54 ff 16 8b e8 e8 34 00 00 00 83 ec 20 8b dc 6a 20 53 ff 56 04 c7 04 18 5c 63 70 75 c7 44 18 04 2e 65 78 65 c6 44 18 08 00 33 c0 50 50 53 57 50 ff 56 10 8b dc 6a 05 53 ff 56 08 ff 56 0c 51 56 8b 75 3c 8b 74 35 78 03 f5 56 8b 76 20 03 f5 33 c9 49 41 ad 03 c5 33 db 0f be 10 38 f2 74 08 c1 cb 0d 03 da 40 eb f1 3b 1f 75 e7 5e 8b 5e 24 03 dd 66 8b 0c 4b 8b 5e 1c 03 dd 8b 04 8b 03 c5 ab 5e 59 c3 e8 51 ff ff ff 8e 4e 0e ec ed db ec f8 98 fe 8a 0e 7e d8 e2 73 36 1a 2f 70 } //00 00
|
||
|
|
condition:
|
||
|
|
any of ($a_*)
|
||
|
|
|
||
|
|
}
|