rule TrojanDownloader_O97M_Donoff_CSM_MTB{
	meta:
		description = "TrojanDownloader:O97M/Donoff.CSM!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 00 "
		
	strings :
		$a_03_0 = {7d 70 61 73 73 74 68 72 75 3b 69 6e 76 6f 6b 65 2d 77 65 62 72 65 71 75 65 73 74 2d 75 72 69 22 22 90 17 02 04 05 68 74 74 70 68 74 74 70 73 3a 2f 2f [0-2f] 2f [0-1f] 2e 65 78 65 22 22 2d 6f 75 74 66 69 6c 65 24 74 65 6d 70 66 69 6c 65 3b 73 74 61 72 74 2d 70 72 6f 63 65 73 73 24 74 65 6d 70 66 69 6c 65 3b 64 65 62 75 67 2e 70 72 69 6e 74 73 63 6f 6d 6d 61 6e 64 73 65 74 6f 77 73 68 73 68 65 6c 6c 3d 63 72 65 61 74 65 6f 62 6a 65 63 74 28 22 77 73 63 72 69 70 74 2e 73 68 65 6c 6c 22 29 73 65 74 6f 77 73 68 73 68 65 6c 6c 65 78 65 63 3d 6f 77 73 68 73 68 65 6c 6c 2e 65 78 65 63 28 73 63 6f 6d 6d 61 6e 64 29 73 6f 75 74 70 75 74 } //1
	condition:
		((#a_03_0  & 1)*1) >=1
 
}