11 lines
877 B
Plaintext
11 lines
877 B
Plaintext
|
|
rule TrojanDownloader_O97M_Donoff_CSM_MTB{
|
|
meta:
|
|
description = "TrojanDownloader:O97M/Donoff.CSM!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_03_0 = {7d 70 61 73 73 74 68 72 75 3b 69 6e 76 6f 6b 65 2d 77 65 62 72 65 71 75 65 73 74 2d 75 72 69 22 22 90 17 02 04 05 68 74 74 70 68 74 74 70 73 3a 2f 2f 90 02 2f 2f 90 02 1f 2e 65 78 65 22 22 2d 6f 75 74 66 69 6c 65 24 74 65 6d 70 66 69 6c 65 3b 73 74 61 72 74 2d 70 72 6f 63 65 73 73 24 74 65 6d 70 66 69 6c 65 3b 64 65 62 75 67 2e 70 72 69 6e 74 73 63 6f 6d 6d 61 6e 64 73 65 74 6f 77 73 68 73 68 65 6c 6c 3d 63 72 65 61 74 65 6f 62 6a 65 63 74 28 22 77 73 63 72 69 70 74 2e 73 68 65 6c 6c 22 29 73 65 74 6f 77 73 68 73 68 65 6c 6c 65 78 65 63 3d 6f 77 73 68 73 68 65 6c 6c 2e 65 78 65 63 28 73 63 6f 6d 6d 61 6e 64 29 73 6f 75 74 70 75 74 90 00 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |