13 lines
929 B
Plaintext
13 lines
929 B
Plaintext
|
|
rule TrojanDownloader_O97M_AgentTesla_RVI_MTB{
|
|
meta:
|
|
description = "TrojanDownloader:O97M/AgentTesla.RVI!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 00 "
|
|
|
|
strings :
|
|
$a_03_0 = {53 68 65 6c 6c 20 28 22 63 6d 64 20 2f 63 20 63 75 72 6c 20 22 20 26 20 4f 20 26 20 [0-0a] 28 29 20 26 20 22 2f 22 20 26 20 [0-0a] 28 29 20 26 20 22 2f [0-1e] 2e 65 78 65 22 20 26 20 22 20 2d 2d 6f 75 74 70 75 74 20 25 41 50 50 44 41 54 41 25 5c [0-1e] 2e 65 78 65 20 20 26 26 20 74 69 6d 65 6f 75 74 20 31 20 26 26 20 73 74 61 72 74 20 25 41 50 50 44 41 54 41 25 5c [0-1e] 2e 65 78 65 22 29 } //1
|
|
$a_03_1 = {22 68 74 74 22 20 26 20 [0-0a] 28 29 20 26 20 22 63 64 6e 2e 64 22 20 26 20 [0-0a] 28 29 20 26 20 22 64 61 70 70 2e 63 22 20 26 20 [0-0a] 28 29 20 26 20 22 61 63 68 6d 65 6e 74 73 2f 22 } //1
|
|
$a_01_2 = {41 75 74 6f 4f 70 65 6e 28 29 } //1 AutoOpen()
|
|
condition:
|
|
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1) >=3
|
|
|
|
} |