11 lines
289 B
Plaintext
11 lines
289 B
Plaintext
|
|
||
|
rule VirTool_WinNT_Cutwail_E{
|
||
|
meta:
|
||
|
description = "VirTool:WinNT/Cutwail.E,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 01 00 "
|
||
|
|
||
|
strings :
|
||
|
$a_01_0 = {e8 7d ff ff ff 0f b7 c0 83 f8 19 74 28 83 f8 50 74 23 3d e8 03 00 00 72 07 3d b8 0b 00 00 } //00 00
|
||
|
condition:
|
||
|
any of ($a_*)
|
||
|
|
||
|
}
|