23 lines
768 B
Plaintext
23 lines
768 B
Plaintext
|
|
||
|
|
rule TrojanSpy_BAT_AgentTesla{
|
||
|
|
meta:
|
||
|
|
description = "TrojanSpy:BAT/AgentTesla,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 01 00 "
|
||
|
|
|
||
|
|
strings :
|
||
|
|
$a_01_0 = {16 0a 16 0b 2b 2d 03 25 4b 04 06 1f 0f 5f 95 61 54 04 06 1f 0f 5f 04 06 1f 0f 5f 95 03 25 1a 58 10 01 4b 61 20 84 e2 03 78 58 9e 06 17 58 0a 07 17 58 0b 07 02 37 cf 2a } //00 00
|
||
|
|
condition:
|
||
|
|
any of ($a_*)
|
||
|
|
|
||
|
|
}
|
||
|
|
rule TrojanSpy_BAT_AgentTesla_2{
|
||
|
|
meta:
|
||
|
|
description = "TrojanSpy:BAT/AgentTesla,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 01 00 "
|
||
|
|
|
||
|
|
strings :
|
||
|
|
$a_01_0 = {66 67 68 79 74 75 74 67 66 6e 6d 64 66 67 2e 4d 79 } //01 00
|
||
|
|
$a_01_1 = {50 4f 4f 59 55 47 48 59 46 55 47 2e 4d 79 } //02 00
|
||
|
|
$a_01_2 = {43 6f 6e 66 75 73 65 72 45 78 20 76 31 2e 30 2e 30 } //00 00
|
||
|
|
condition:
|
||
|
|
any of ($a_*)
|
||
|
|
|
||
|
|
}
|