rule Backdoor_Win32_InstantAccess{ meta: description = "Backdoor:Win32/InstantAccess,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 01 00 " strings : $a_00_0 = {50 6f 72 74 20 68 61 73 20 62 65 65 6e 20 6f 70 65 6e 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e } //01 00 Port has been opened successfully. $a_00_1 = {3c 68 74 6d 6c 3e 3c 69 66 72 61 6d 65 20 73 72 63 3d 22 } //01 00