15 lines
1.0 KiB
Plaintext
15 lines
1.0 KiB
Plaintext
|
|
rule TrojanDownloader_O97M_JpgFetch_KA{
|
|
meta:
|
|
description = "TrojanDownloader:O97M/JpgFetch.KA,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 05 00 00 "
|
|
|
|
strings :
|
|
$a_02_0 = {54 68 69 73 44 6f 63 75 6d 65 6e 74 2e 44 65 66 61 75 6c 74 54 61 72 67 65 74 46 72 61 6d 65 20 26 20 22 [0-28] 2e 6a 70 67 27 2c 20 20 27 25 41 50 50 44 41 54 41 25 5c [0-1e] 2e 65 78 65 27 29 } //2
|
|
$a_02_1 = {54 68 69 73 44 6f 63 75 6d 65 6e 74 2e 44 65 66 61 75 6c 74 54 61 72 67 65 74 46 72 61 6d 65 20 26 20 22 [0-28] 2e 6a 70 67 27 2c 20 20 27 25 41 50 50 44 41 54 41 25 5c [0-1e] 2e 6a 73 27 29 } //2
|
|
$a_00_2 = {3d 20 45 6e 76 69 72 6f 6e 28 22 41 50 50 44 41 54 41 22 29 20 26 20 22 5c 22 } //1 = Environ("APPDATA") & "\"
|
|
$a_02_3 = {4f 70 65 6e 20 65 6e 76 20 26 20 22 [0-20] 22 20 26 20 22 2e 62 61 74 22 } //1
|
|
$a_00_4 = {41 74 74 72 69 62 75 74 65 20 56 42 5f 4e 61 6d 65 20 3d 20 22 4d 6f 64 65 6c 73 50 61 67 65 31 22 } //1 Attribute VB_Name = "ModelsPage1"
|
|
condition:
|
|
((#a_02_0 & 1)*2+(#a_02_1 & 1)*2+(#a_00_2 & 1)*1+(#a_02_3 & 1)*1+(#a_00_4 & 1)*1) >=3
|
|
|
|
} |