DefenderYara/VirTool/WinNT/Bancos/VirTool_WinNT_Bancos_DQ.yar

rule VirTool_WinNT_Bancos_DQ{
	meta:
		description = "VirTool:WinNT/Bancos.DQ,SIGNATURE_TYPE_PEHSTR_EXT,ffffffbd 01 ffffffbd 01 11 00 00 64 00 "
		
	strings :
		$a_01_0 = {4f 6e 55 6e 6c 6f 61 64 20 63 61 6c 6c 65 64 } //64 00  OnUnload called
		$a_01_1 = {44 72 69 76 65 72 45 6e 74 72 79 20 63 61 6c 6c 65 64 } //64 00  DriverEntry called
		$a_01_2 = {52 53 44 53 3a } //64 00  RSDS:
		$a_01_3 = {5a 77 44 65 6c 65 74 65 46 69 6c 65 } //14 00  ZwDeleteFile
		$a_00_4 = {5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 48 00 61 00 72 00 64 00 64 00 69 00 73 00 6b 00 56 00 6f 00 6c 00 75 00 6d 00 65 00 31 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 5c 00 47 00 62 00 50 00 6c 00 75 00 67 00 69 00 6e 00 } //14 00  \Device\HarddiskVolume1\Program Files\GbPlugin
		$a_00_5 = {5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 48 00 61 00 72 00 64 00 64 00 69 00 73 00 6b 00 56 00 6f 00 6c 00 75 00 6d 00 65 00 31 00 5c 00 41 00 72 00 71 00 75 00 69 00 76 00 6f 00 73 00 20 00 64 00 65 00 20 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 61 00 73 00 5c 00 47 00 62 00 50 00 6c 00 75 00 67 00 69 00 6e 00 } //01 00  \Device\HarddiskVolume1\Arquivos de Programas\GbPlugin
		$a_00_6 = {5c 00 67 00 62 00 70 00 73 00 76 00 2e 00 65 00 78 00 65 00 } //01 00  \gbpsv.exe
		$a_00_7 = {5c 00 67 00 62 00 69 00 65 00 68 00 2e 00 64 00 6c 00 6c 00 } //01 00  \gbieh.dll
		$a_00_8 = {5c 00 67 00 62 00 70 00 64 00 69 00 73 00 74 00 2e 00 64 00 6c 00 6c 00 } //01 00  \gbpdist.dll
		$a_00_9 = {5c 00 67 00 62 00 69 00 65 00 68 00 2e 00 67 00 6d 00 64 00 } //01 00  \gbieh.gmd
		$a_00_10 = {5c 00 62 00 62 00 2e 00 67 00 70 00 63 00 } //01 00  \bb.gpc
		$a_00_11 = {5c 00 61 00 62 00 6e 00 2e 00 67 00 70 00 63 00 } //01 00  \abn.gpc
		$a_00_12 = {5c 00 63 00 65 00 66 00 2e 00 67 00 70 00 63 00 } //01 00  \cef.gpc
		$a_00_13 = {5c 00 67 00 62 00 69 00 65 00 68 00 61 00 62 00 6e 00 2e 00 64 00 6c 00 6c 00 } //01 00  \gbiehabn.dll
		$a_00_14 = {5c 00 67 00 62 00 69 00 65 00 68 00 63 00 65 00 66 00 2e 00 64 00 6c 00 6c 00 } //01 00  \gbiehcef.dll
		$a_00_15 = {5c 00 67 00 62 00 69 00 65 00 68 00 69 00 73 00 67 00 2e 00 64 00 6c 00 6c 00 } //01 00  \gbiehisg.dll
		$a_00_16 = {5c 00 69 00 73 00 67 00 2e 00 67 00 70 00 63 00 } //00 00  \isg.gpc
	condition:
		any of ($a_*)
 
}