14 lines
1.7 KiB
Plaintext
14 lines
1.7 KiB
Plaintext
|
|
rule TrojanDownloader_O97M_Donoff_DRG_MTB{
|
|
meta:
|
|
description = "TrojanDownloader:O97M/Donoff.DRG!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {49 65 37 51 47 76 32 4c 46 66 69 42 4b 46 44 57 6d 4c 56 4e 77 5f 63 6f } //1 Ie7QGv2LFfiBKFDWmLVNw_co
|
|
$a_01_1 = {69 6f 73 61 64 66 6f 64 73 69 20 35 36 34 36 20 64 73 61 66 64 73 79 61 67 66 38 20 66 69 73 64 75 65 72 77 39 38 } //1 iosadfodsi 5646 dsafdsyagf8 fisduerw98
|
|
$a_01_2 = {44 5f 5f 53 28 31 36 37 29 20 26 20 44 5f 5f 53 28 31 37 37 29 20 26 20 44 5f 5f 53 28 32 30 30 29 20 26 20 44 5f 5f 53 28 31 33 32 29 20 26 20 44 5f 5f 53 28 31 34 37 29 20 26 20 44 5f 5f 53 28 31 36 37 29 20 26 20 44 5f 5f 53 28 31 33 32 29 20 26 20 44 5f 5f 53 28 32 30 39 29 20 26 20 44 5f 5f 53 28 31 39 34 29 20 26 20 44 5f 5f 53 28 31 38 33 29 20 26 20 44 5f 5f 53 28 32 30 35 29 20 26 20 44 5f 5f 53 28 31 36 39 29 20 26 20 44 5f 5f 53 28 31 39 34 29 20 26 20 44 5f 5f 53 28 32 32 30 29 20 26 20 44 5f 5f 53 28 31 39 34 29 20 26 20 44 5f 5f 53 28 32 30 31 29 20 26 20 44 5f 5f 53 28 31 39 34 29 20 26 20 44 5f 5f 53 28 31 39 39 29 } //1 D__S(167) & D__S(177) & D__S(200) & D__S(132) & D__S(147) & D__S(167) & D__S(132) & D__S(209) & D__S(194) & D__S(183) & D__S(205) & D__S(169) & D__S(194) & D__S(220) & D__S(194) & D__S(201) & D__S(194) & D__S(199)
|
|
$a_01_3 = {2e 52 75 6e 28 41 48 31 4c 72 5f 4d 54 45 47 53 73 44 70 6b 6b 78 54 41 32 76 35 5a 72 78 49 7a 57 5f 35 76 75 33 70 54 70 6d 52 5f 6c 70 5f 66 58 58 4d 57 61 7a 62 4f 78 78 74 5f 5f 73 4a 58 68 34 79 4f 4a } //1 .Run(AH1Lr_MTEGSsDpkkxTA2v5ZrxIzW_5vu3pTpmR_lp_fXXMWazbOxxt__sJXh4yOJ
|
|
condition:
|
|
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
|
|
|
|
} |