24 lines
1.4 KiB
Plaintext
24 lines
1.4 KiB
Plaintext
|
|
rule TrojanDownloader_O97M_Obfuse_ZD_MTB{
|
|
meta:
|
|
description = "TrojanDownloader:O97M/Obfuse.ZD!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,0e 00 0e 00 0e 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_03_0 = {2e 4f 70 65 6e 20 90 02 46 2e 56 61 6c 75 65 2c 20 46 61 6c 73 65 90 00 } //01 00
|
|
$a_01_1 = {2e 53 65 74 4f 70 74 69 6f 6e 20 32 2c 20 2e 47 65 74 4f 70 74 69 6f 6e 28 32 29 } //01 00 .SetOption 2, .GetOption(2)
|
|
$a_03_2 = {3d 20 49 6e 53 74 72 28 90 02 14 2c 20 90 02 14 2c 20 90 02 14 29 90 00 } //01 00
|
|
$a_03_3 = {3d 20 53 70 6c 69 74 28 90 02 0a 2c 20 90 02 0a 2c 20 90 02 14 29 90 00 } //01 00
|
|
$a_01_4 = {49 66 20 2e 53 74 61 74 75 73 20 3d 20 32 30 30 20 54 68 65 6e } //01 00 If .Status = 200 Then
|
|
$a_03_5 = {3d 20 41 74 6e 28 90 02 14 29 90 00 } //01 00
|
|
$a_03_6 = {3d 20 52 65 70 6c 61 63 65 28 90 02 0a 2c 20 90 02 0a 2c 20 90 02 14 29 90 00 } //01 00
|
|
$a_03_7 = {3d 20 41 62 73 28 43 4c 6e 67 28 28 28 90 02 1e 20 2a 20 90 02 14 29 90 00 } //01 00
|
|
$a_03_8 = {45 78 70 28 90 02 0a 29 90 00 } //01 00
|
|
$a_03_9 = {59 65 61 72 28 90 02 0f 29 90 00 } //01 00
|
|
$a_03_10 = {3d 20 57 65 65 6b 64 61 79 28 90 02 0f 29 90 00 } //01 00
|
|
$a_03_11 = {3d 20 4d 6f 6e 74 68 4e 61 6d 65 28 90 01 01 29 90 00 } //01 00
|
|
$a_03_12 = {56 61 72 54 79 70 65 28 90 02 0a 29 90 00 } //01 00
|
|
$a_01_13 = {44 65 62 75 67 2e 50 72 69 6e 74 } //00 00 Debug.Print
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |