13 lines
1.8 KiB
Plaintext
13 lines
1.8 KiB
Plaintext
|
|
rule TrojanDownloader_O97M_Donoff_O{
|
|
meta:
|
|
description = "TrojanDownloader:O97M/Donoff.O,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 02 00 03 00 00 "
|
|
|
|
strings :
|
|
$a_03_0 = {43 72 65 61 74 65 4f 62 6a 65 63 74 28 [0-0f] 28 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 2c 20 22 [0-0f] 22 29 29 (2e 52 75 6e|2e 65 78 65 63) } //1
|
|
$a_03_1 = {45 6e 76 69 72 6f 6e 28 [0-0f] 28 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 2c 20 22 [0-14] 22 29 29 20 26 20 22 5c 22 20 26 20 [0-0f] 20 26 20 [0-0f] 28 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 2c 20 22 [0-14] 22 29 } //1
|
|
$a_03_2 = {46 6f 72 20 42 69 6e 61 72 79 20 41 63 63 65 73 73 20 57 72 69 74 65 20 4c 6f 63 6b 20 57 72 69 74 65 20 41 73 20 23 [0-0f] 0d 0a 50 75 74 20 23 [0-0f] 2c 20 2c 20 [0-0f] 28 53 74 72 43 6f 6e 76 28 [0-0f] 2e 52 65 73 70 6f 6e 73 65 42 6f 64 79 2c 20 76 62 55 6e 69 63 6f 64 65 29 2c 20 [0-0f] 28 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 20 2b 20 43 68 72 28 [0-03] 29 2c 20 22 [0-14] 22 29 29 0d 0a 43 6c 6f 73 65 } //1
|
|
condition:
|
|
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1) >=2
|
|
|
|
} |