11 lines
615 B
Plaintext
11 lines
615 B
Plaintext
|
|
rule Backdoor_BAT_Crysan_AAUA_MTB{
|
|
meta:
|
|
description = "Backdoor:BAT/Crysan.AAUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 05 00 "
|
|
|
|
strings :
|
|
$a_03_0 = {11 03 17 58 13 03 20 0a 00 00 00 38 90 01 01 ff ff ff 73 90 01 01 00 00 0a 13 0b 20 08 00 00 00 38 90 01 01 ff ff ff 12 07 28 90 01 01 00 00 0a 13 0a 20 09 00 00 00 38 90 01 01 ff ff ff 11 0b 11 0a 6f 90 01 01 00 00 0a 20 00 00 00 00 7e 90 01 01 09 00 04 7b 90 01 01 09 00 04 39 90 01 01 fe ff ff 26 20 00 00 00 00 38 90 01 01 fe ff ff 11 01 11 03 16 28 90 01 01 00 00 06 13 07 20 07 00 00 00 38 90 00 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |