13 lines
1.5 KiB
Plaintext
13 lines
1.5 KiB
Plaintext
|
|
rule TrojanDownloader_O97M_Emotet_SXS_MTB{
|
|
meta:
|
|
description = "TrojanDownloader:O97M/Emotet.SXS!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {3a 22 26 22 2f 22 26 22 2f 61 22 26 22 6b 22 26 22 61 22 26 22 72 22 26 22 77 22 26 22 65 22 26 22 62 2e 6e 22 26 22 65 22 26 22 74 2f 63 22 26 22 67 22 26 22 69 2d 62 22 26 22 69 22 26 22 6e 2f 44 22 26 22 65 22 26 22 5a 22 26 22 34 22 26 22 70 22 26 22 34 22 26 22 78 22 26 22 47 2f 22 } //1 :"&"/"&"/a"&"k"&"a"&"r"&"w"&"e"&"b.n"&"e"&"t/c"&"g"&"i-b"&"i"&"n/D"&"e"&"Z"&"4"&"p"&"4"&"x"&"G/"
|
|
$a_01_1 = {3a 2f 2f 63 22 26 22 61 22 26 22 6c 22 26 22 7a 22 26 22 61 22 26 22 64 22 26 22 6f 22 26 22 79 22 26 22 75 22 26 22 79 22 26 22 69 22 26 22 6e 2e 63 22 26 22 6f 22 26 22 6d 2f 63 22 26 22 67 22 26 22 6a 2d 62 22 26 22 69 22 26 22 6e 2f 6a 22 26 22 5a 22 26 22 50 22 26 22 66 22 26 22 66 2f 22 } //1 ://c"&"a"&"l"&"z"&"a"&"d"&"o"&"y"&"u"&"y"&"i"&"n.c"&"o"&"m/c"&"g"&"j-b"&"i"&"n/j"&"Z"&"P"&"f"&"f/"
|
|
$a_01_2 = {3a 22 26 22 2f 22 26 22 2f 63 22 26 22 61 22 26 22 62 22 26 22 61 22 26 22 6e 22 26 22 73 2e 63 22 26 22 6f 22 26 22 6d 2f 43 22 26 22 65 22 26 22 75 22 26 22 64 22 26 22 57 22 26 22 59 22 26 22 52 22 26 22 51 22 26 22 45 22 26 22 7a 22 26 22 5a 22 26 22 67 22 26 22 72 22 26 22 48 22 26 22 50 22 26 22 63 22 26 22 49 2f 22 } //1 :"&"/"&"/c"&"a"&"b"&"a"&"n"&"s.c"&"o"&"m/C"&"e"&"u"&"d"&"W"&"Y"&"R"&"Q"&"E"&"z"&"Z"&"g"&"r"&"H"&"P"&"c"&"I/"
|
|
condition:
|
|
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1
|
|
|
|
} |