14 lines
1.0 KiB
Plaintext
14 lines
1.0 KiB
Plaintext
|
|
rule TrojanDownloader_O97M_Powdow_RVA_MTB{
|
|
meta:
|
|
description = "TrojanDownloader:O97M/Powdow.RVA!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 77 73 63 72 69 70 74 2e 22 20 26 20 73 68 65 20 26 20 22 6c 22 29 2e 65 78 65 63 28 70 73 6f 77 65 72 73 73 20 26 20 22 68 65 6c 6c 20 2d 77 } //1 CreateObject("wscript." & she & "l").exec(psowerss & "hell -w
|
|
$a_03_1 = {49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 2d 55 72 69 20 22 20 26 20 43 68 72 28 33 34 29 20 26 20 22 68 74 74 70 3a 2f 2f [0-37] 2e 65 78 22 20 26 20 43 68 72 28 31 30 31 29 } //1
|
|
$a_03_2 = {43 68 72 28 33 34 29 20 26 20 22 3b 43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 44 6f 63 75 6d 65 6e 74 73 5c [0-0f] 2e 65 78 22 20 26 20 43 68 72 28 31 30 31 29 } //1
|
|
$a_01_3 = {70 73 6f 77 65 72 73 73 20 3d 20 22 70 6f 77 65 72 73 22 0d 0a 73 68 65 20 3d 20 22 73 68 65 6c 22 } //1
|
|
condition:
|
|
((#a_01_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_01_3 & 1)*1) >=4
|
|
|
|
} |